Merge branch 'master'

2025-12-16 17:15:26 +00:00 · 2025-08-02 23:13:39 +08:00 · 2025-08-02 23:13:39 +08:00 · 42d80a41c9
commit 42d80a41c9
parent a7e74f3803 893695dba0
58 changed files with 2714 additions and 285 deletions
--- a/include/target.mk
+++ b/include/target.mk
@ -405,7 +405,7 @@ define BuildTargets/DumpCurrent
 	 echo 'Default-Packages: $(DEFAULT_PACKAGES) $(call extra_packages,$(DEFAULT_PACKAGES))'; \
 	 $(DUMPINFO)
 	$(if $(CUR_SUBTARGET),$(SUBMAKE) -r --no-print-directory -C image -s DUMP=1 SUBTARGET=$(CUR_SUBTARGET))
-	$(if $(SUBTARGET),,@$(foreach SUBTARGET,$(SUBTARGETS),$(SUBMAKE) -s DUMP=1 SUBTARGET=$(SUBTARGET); ))
+	$(if $(SUBTARGET),,@$(foreach SUBTARGET,$(SUBTARGETS),$(SUBMAKE) --no-print-directory -s DUMP=1 SUBTARGET=$(SUBTARGET); ))
 endef

 include $(INCLUDE_DIR)/kernel.mk
--- a/package/base-files/files/lib/functions.sh
+++ b/package/base-files/files/lib/functions.sh
@ -447,7 +447,7 @@ find_mmc_part() {
 	fi

 	for DEVNAME in /sys/block/$ROOTDEV/mmcblk*p*; do
-		PARTNAME="$(grep PARTNAME ${DEVNAME}/uevent | cut -f2 -d'=')"
+		PARTNAME="$(grep PARTNAME ${DEVNAME}/uevent | cut -f2 -d'=' 2>/dev/null)"
 		[ "$PARTNAME" = "$1" ] && echo "/dev/$(basename $DEVNAME)" && return 0
 	done
 }
--- a/package/boot/uboot-mediatek/patches/006-env-Fix-possible-out-of-bound-access-in-env_do_env_s.patch
+++ b/package/boot/uboot-mediatek/patches/006-env-Fix-possible-out-of-bound-access-in-env_do_env_s.patch
@ -0,0 +1,55 @@
+From 0ffd456516b5f0c126c9705d6b2368a45ee2353f Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sun, 29 Jun 2025 15:21:18 +0200
+Subject: [PATCH] env: Fix possible out-of-bound access in env_do_env_set
+
+It was discovered that env_do_env_set() currently suffer from a long
+time of a possible out-of-bound access for the argv array handling.
+
+The BUG is present in the function env_do_env_set() line:
+
+name = argv[1];
+
+where the function at this point assume the argv at index 1 is always
+present and can't be NULL. Aside from the fact that it's always
+better to validate argv entry with the argc variable, situation where
+the argv[1] is NULL is actually possible and not an error condition.
+
+A example of where an out-of-bound access is triggered is with the
+command "askenv - Press ENTER to ...".
+This is a common pattern for bootmenu entry to ask the user input after
+a bootmenu command succeeded.
+
+In the context of such command, the while loop before "name = argv[1];"
+parse the "-" char as an option arg and increment the argv pointer by
+one (to make the rest of the logic code ignore the option argv) and
+decrement argc value.
+
+The while loop logic is correct but at the "name = argv[1];" line, the
+argv have only one element left (the "-" char) and accessing argv[1]
+(aka the secong element from argv pointer) cause an out-of-bound access
+(making the bootloader eventually crash with strchr searching in invalid
+data)
+
+To better handle this and prevent the out-of-bound access, actually
+check the argv entry left (with the use of the argc variable) and exit
+early before doing any kind of array access.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ env/common.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/env/common.c
+++ b/env/common.c
+@@ -82,6 +82,10 @@ int env_do_env_set(int flag, int argc, c
+ 		}
+ 	}
+ 	debug("Final value for argc=%d\n", argc);
+	/* Exit early if we don't have an env to apply */
+	if (argc < 2)
+		return 0;
+
+ 	name = argv[1];
+ 
+ 	if (strchr(name, '=')) {
--- a/package/boot/uboot-mediatek/patches/101-01-mtd-spinand-add-support-for-FORESEE-F35SQA002G.patch
+++ b/package/boot/uboot-mediatek/patches/101-01-mtd-spinand-add-support-for-FORESEE-F35SQA002G.patch
@ -40,7 +40,7 @@ Link: https://lore.kernel.org/linux-mtd/20231002140458.147605-1-mmkurbanov@salut
 
 --- /dev/null
 +++ b/drivers/mtd/nand/spi/foresee.c
-@@ -0,0 +1,97 @@
+@@ -0,0 +1,95 @@
 +// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
 +/*
 + * Copyright (c) 2023, SberDevices. All Rights Reserved.
@ -96,8 +96,6 @@ Link: https://lore.kernel.org/linux-mtd/20231002140458.147605-1-mmkurbanov@salut
 +
 +static int f35sqa002g_ecc_get_status(struct spinand_device *spinand, u8 status)
 +{
-+	struct nand_device *nand = spinand_to_nand(spinand);
-+
 +	switch (status & STATUS_ECC_MASK) {
 +	case STATUS_ECC_NO_BITFLIPS:
 +		return 0;
--- a/package/boot/uboot-mediatek/patches/101-02-mtd-spinand-add-support-for-FORESEE-F35SQA001G.patch
+++ b/package/boot/uboot-mediatek/patches/101-02-mtd-spinand-add-support-for-FORESEE-F35SQA001G.patch
@ -19,7 +19,7 @@ Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>

 --- a/drivers/mtd/nand/spi/foresee.c
 +++ b/drivers/mtd/nand/spi/foresee.c
-@@ -83,6 +83,16 @@ static const struct spinand_info foresee
+@@ -81,6 +81,16 @@ static const struct spinand_info foresee
 		     SPINAND_HAS_QE_BIT,
 		     SPINAND_ECCINFO(&f35sqa002g_ooblayout,
 				     f35sqa002g_ecc_get_status)),
--- a/package/boot/uboot-mediatek/patches/107-configs-add-useful-options-to-mt7981-rfb.patch
+++ b/package/boot/uboot-mediatek/patches/107-configs-add-useful-options-to-mt7981-rfb.patch
@ -356,7 +356,7 @@
 -CONFIG_LMB_MAX_REGIONS=64
 --- a/configs/mt7981_nor_rfb_defconfig
 +++ b/configs/mt7981_nor_rfb_defconfig
-@@ -5,37 +5,74 @@ CONFIG_ARCH_MEDIATEK=y
+@@ -5,37 +5,73 @@ CONFIG_ARCH_MEDIATEK=y
 CONFIG_TEXT_BASE=0x41e00000
 CONFIG_SYS_MALLOC_F_LEN=0x4000
 CONFIG_NR_DRAM_BANKS=1
@ -421,9 +421,8 @@
 CONFIG_ENV_OVERWRITE=y
 +CONFIG_ENV_IS_IN_MTD=y
 +CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
-+CONFIG_ENV_MTD_NAME="u-boot-env"
-+CONFIG_ENV_SIZE_REDUND=0x4000
 +CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_MTD_DEV="u-boot-env"
 CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 CONFIG_NET_RANDOM_ETHADDR=y
 CONFIG_REGMAP=y
@ -438,7 +437,7 @@
 # CONFIG_MMC is not set
 CONFIG_MTD=y
 CONFIG_DM_MTD=y
-@@ -60,9 +97,9 @@ CONFIG_PINCTRL_MT7981=y
+@@ -60,9 +96,9 @@ CONFIG_PINCTRL_MT7981=y
 CONFIG_POWER_DOMAIN=y
 CONFIG_MTK_POWER_DOMAIN=y
 CONFIG_DM_SERIAL=y
--- a/package/boot/uboot-mediatek/patches/130-01-env-mtd-add-the-missing-put_mtd_device.patch
+++ b/package/boot/uboot-mediatek/patches/130-01-env-mtd-add-the-missing-put_mtd_device.patch
@ -0,0 +1,47 @@
+From 0508c8e120d275d994e6099eb9c60bfaec0c3f5f Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Mon, 21 Jul 2025 21:32:16 +0800
+Subject: [PATCH 1/2] env: mtd: add the missing put_mtd_device()
+
+The mtd device is got in setup_mtd_device(), we must put the mtd
+device before exiting the function to update the mtd use count. This
+patch fixes the following env error:
+
+> Removing MTD device #2 (u-boot-env) with use count 1
+> Error when deleting partition "u-boot-env" (-16)
+
+Fixes: 03fb08d4aef8 ("env: Introduce support for MTD")
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ env/mtd.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/env/mtd.c
+++ b/env/mtd.c
+@@ -131,6 +131,8 @@ static int env_mtd_save(void)
+ 	puts("done\n");
+ 
+ done:
+	put_mtd_device(mtd_env);
+
+ 	if (saved_buf)
+ 		free(saved_buf);
+ 
+@@ -188,6 +190,8 @@ static int env_mtd_load(void)
+ 		gd->env_valid = ENV_VALID;
+ 
+ out:
+	put_mtd_device(mtd_env);
+
+ 	free(buf);
+ 
+ 	return ret;
+@@ -280,6 +284,8 @@ static int env_mtd_erase(void)
+ 	ret = 0;
+ 
+ done:
+	put_mtd_device(mtd_env);
+
+ 	if (saved_buf)
+ 		free(saved_buf);
+ 
--- a/package/boot/uboot-mediatek/patches/130-02-env-mtd-initialize-saved_buf-pointer.patch
+++ b/package/boot/uboot-mediatek/patches/130-02-env-mtd-initialize-saved_buf-pointer.patch
@ -0,0 +1,25 @@
+From 0ef932f509fd9f9215af2ea4ca2919d3285ddf60 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Thu, 24 Jul 2025 07:50:40 +0800
+Subject: [PATCH 2/2] env: mtd: initialize saved_buf pointer
+
+When sect_size is greater than CONFIG_ENV_SIZE, this wild
+pointer will cause CPU halt or system crash.
+
+Fixes: 03fb08d4aef8 ("env: Introduce support for MTD")
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ env/mtd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/env/mtd.c
+++ b/env/mtd.c
+@@ -201,7 +201,7 @@ static int env_mtd_erase(void)
+ {
+ 	struct mtd_info *mtd_env;
+ 	u32 sect_size, sect_num;
+-	char *saved_buf, *tmp;
+	char *saved_buf = NULL, *tmp;
+ 	struct erase_info ei;
+ 	size_t ret_len;
+ 	int remaining;
--- a/package/boot/uboot-mediatek/patches/412-add-ubnt-unifi-6-lr.patch
+++ b/package/boot/uboot-mediatek/patches/412-add-ubnt-unifi-6-lr.patch
@ -1,6 +1,6 @@
 --- /dev/null
 +++ b/configs/mt7622_ubnt_unifi-6-lr-v1_defconfig
-@@ -0,0 +1,114 @@
+@@ -0,0 +1,113 @@
 +CONFIG_ARM=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_POSITION_INDEPENDENT=y
@ -56,9 +56,8 @@
 +CONFIG_CMD_MTDPARTS=y
 +CONFIG_MTDPARTS_DEFAULT="mtdparts=nor0:128k(bl2),640k(fip),64k(u-boot-env),256k(factory),64k(eeprom),15232k(recovery),-(firmware)"
 +CONFIG_ENV_IS_IN_MTD=y
-+CONFIG_ENV_MTD_NAME="nor0"
-+CONFIG_ENV_SIZE_REDUND=0x4000
 +CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_MTD_DEV="nor0"
 +CONFIG_USE_DEFAULT_ENV_FILE=y
 +CONFIG_DEFAULT_ENV_FILE="defenvs/ubnt_unifi-6-lr_env"
 +CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
@ -117,7 +116,7 @@
 +CONFIG_HEXDUMP=y
 --- /dev/null
 +++ b/configs/mt7622_ubnt_unifi-6-lr-v2_defconfig
-@@ -0,0 +1,114 @@
+@@ -0,0 +1,113 @@
 +CONFIG_ARM=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_POSITION_INDEPENDENT=y
@ -173,9 +172,8 @@
 +CONFIG_CMD_MTDPARTS=y
 +CONFIG_MTDPARTS_DEFAULT="mtdparts=nor0:128k(bl2),640k(fip),64k(u-boot-env),256k(factory),64k(eeprom),15232k(recovery),-(firmware)"
 +CONFIG_ENV_IS_IN_MTD=y
-+CONFIG_ENV_MTD_NAME="nor0"
-+CONFIG_ENV_SIZE_REDUND=0x4000
 +CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_MTD_DEV="nor0"
 +CONFIG_USE_DEFAULT_ENV_FILE=y
 +CONFIG_DEFAULT_ENV_FILE="defenvs/ubnt_unifi-6-lr-v2_env"
 +CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
@ -234,7 +232,7 @@
 +CONFIG_HEXDUMP=y
 --- /dev/null
 +++ b/configs/mt7622_ubnt_unifi-6-lr-v3_defconfig
-@@ -0,0 +1,113 @@
+@@ -0,0 +1,112 @@
 +CONFIG_ARM=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_POSITION_INDEPENDENT=y
@ -290,9 +288,8 @@
 +CONFIG_CMD_MTDPARTS=y
 +CONFIG_MTDPARTS_DEFAULT="mtdparts=nor0:128k(bl2),640k(fip),64k(u-boot-env),256k(factory),64k(eeprom),15232k(recovery),-(firmware)"
 +CONFIG_ENV_IS_IN_MTD=y
-+CONFIG_ENV_MTD_NAME="nor0"
-+CONFIG_ENV_SIZE_REDUND=0x4000
 +CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_MTD_DEV="nor0"
 +CONFIG_USE_DEFAULT_ENV_FILE=y
 +CONFIG_DEFAULT_ENV_FILE="defenvs/ubnt_unifi-6-lr_env"
 +CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
--- a/package/boot/uboot-mediatek/patches/421-zbtlink_zbt-wg3526-16m.patch
+++ b/package/boot/uboot-mediatek/patches/421-zbtlink_zbt-wg3526-16m.patch
@ -1,6 +1,6 @@
 --- /dev/null
 +++ b/configs/mt7621_zbtlink_zbt-wg3526-16m_defconfig
-@@ -0,0 +1,98 @@
+@@ -0,0 +1,97 @@
 +CONFIG_MIPS=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_SYS_MALLOC_LEN=0x100000
@ -64,9 +64,8 @@
 +# CONFIG_SPL_DOS_PARTITION is not set
 +# CONFIG_ISO_PARTITION is not set
 +CONFIG_ENV_IS_IN_MTD=y
-+CONFIG_ENV_MTD_NAME="nor0"
-+CONFIG_ENV_SIZE_REDUND=0x10000
 +CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_MTD_DEV="nor0"
 +CONFIG_USE_DEFAULT_ENV_FILE=y
 +CONFIG_DEFAULT_ENV_FILE="defenvs/zbtlink_zbt-wg3526-16m_env"
 +CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
--- a/package/boot/uboot-mediatek/patches/430-add-bpi-r3.patch
+++ b/package/boot/uboot-mediatek/patches/430-add-bpi-r3.patch
@ -140,7 +140,7 @@
 +CONFIG_HEXDUMP=y
 --- /dev/null
 +++ b/configs/mt7986a_bpi-r3-nor_defconfig
-@@ -0,0 +1,137 @@
+@@ -0,0 +1,136 @@
 +CONFIG_ARM=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_POSITION_INDEPENDENT=y
@ -213,9 +213,8 @@
 +CONFIG_ENV_OVERWRITE=y
 +CONFIG_ENV_IS_IN_MTD=y
 +CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
-+CONFIG_ENV_MTD_NAME="u-boot-env"
-+CONFIG_ENV_SIZE_REDUND=0x20000
 +CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_MTD_DEV="u-boot-env"
 +CONFIG_USE_DEFAULT_ENV_FILE=y
 +CONFIG_DEFAULT_ENV_FILE="defenvs/bananapi_bpi-r3_nor_env"
 +CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
--- a/package/boot/uboot-mediatek/patches/458-add-GatoNetworks-GDSP.patch
+++ b/package/boot/uboot-mediatek/patches/458-add-GatoNetworks-GDSP.patch
@ -253,7 +253,7 @@ Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
 +};
 --- /dev/null
 +++ b/configs/mt7981_gatonetworks_gdsp_defconfig
-@@ -0,0 +1,146 @@
+@@ -0,0 +1,145 @@
 +CONFIG_ARM=y
 +CONFIG_SYS_HAS_NONCACHED_MEMORY=y
 +CONFIG_POSITION_INDEPENDENT=y
@ -341,9 +341,8 @@ Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
 +CONFIG_EFI_PARTITION=y
 +CONFIG_ENV_OVERWRITE=y
 +CONFIG_ENV_IS_IN_MTD=y
-+CONFIG_ENV_MTD_NAME="u-boot-env"
-+CONFIG_ENV_SIZE_REDUND=0x0
 +CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_ENV_MTD_DEV="u-boot-env"
 +CONFIG_USE_DEFAULT_ENV_FILE=y
 +CONFIG_DEFAULT_ENV_FILE="defenvs/gatonetworks_gdsp_env"
 +CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
--- a/package/boot/uboot-mediatek/patches/461-add-asus-zenwifi-bt8.patch
+++ b/package/boot/uboot-mediatek/patches/461-add-asus-zenwifi-bt8.patch
@ -80,7 +80,7 @@
 +CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
 +CONFIG_SYS_RELOC_GD_ENV_ADDR=y
 +CONFIG_USE_DEFAULT_ENV_FILE=y
-+CONFIG_DEFAULT_ENV_FILE="asus_zenwifi-bt8_env"
+CONFIG_DEFAULT_ENV_FILE="defenvs/asus_zenwifi-bt8_env"
 +CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
 +CONFIG_VERSION_VARIABLE=y
 +CONFIG_NETCONSOLE=y
@ -132,7 +132,7 @@
 +CONFIG_ZSTD=y
 +CONFIG_HEXDUMP=y
 --- /dev/null
-+++ b/asus_zenwifi-bt8_env
+++ b/defenvs/asus_zenwifi-bt8_env
@@ -0,0 +1,56 @@
 +ethaddr_factory=ubi read 0x46000000 factory && env readmem -b ethaddr 0x46000004 0x6 ; setenv ethaddr_factory
 +ipaddr=192.168.1.1
--- a/package/kernel/mac80211/ath.mk
+++ b/package/kernel/mac80211/ath.mk
@ -323,7 +323,7 @@ define KernelPackage/ath10k-sdio
  FILES:= \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_core.ko \
 	$(PKG_BUILD_DIR)/drivers/net/wireless/ath/ath10k/ath10k_sdio.ko
-  AUTOLOAD:=$(call AutoProbe,ath10k_core ath10k_sdio)
+  AUTOLOAD:=$(call AutoProbe,ath10k_core)
  MODPARAMS.ath10k_core:=frame_mode=2
  VARIANT:=sdio
 endef
--- a/package/libs/libbpf/patches/100-bpf_tc_classid.patch
+++ b/package/libs/libbpf/patches/100-bpf_tc_classid.patch
@ -0,0 +1,54 @@
+--- a/src/libbpf.h
+++ b/src/libbpf.h
+@@ -1291,9 +1291,10 @@ struct bpf_tc_opts {
+ 	__u32 prog_id;
+ 	__u32 handle;
+ 	__u32 priority;
+	__u32 classid;
+ 	size_t :0;
+ };
+-#define bpf_tc_opts__last_field priority
+#define bpf_tc_opts__last_field classid
+ 
+ LIBBPF_API int bpf_tc_hook_create(struct bpf_tc_hook *hook);
+ LIBBPF_API int bpf_tc_hook_destroy(struct bpf_tc_hook *hook);
+--- a/src/netlink.c
+++ b/src/netlink.c
+@@ -673,6 +673,8 @@ static int __get_tc_info(void *cookie, s
+ 	OPTS_SET(info->opts, prog_id, libbpf_nla_getattr_u32(tbb[TCA_BPF_ID]));
+ 	OPTS_SET(info->opts, handle, tc->tcm_handle);
+ 	OPTS_SET(info->opts, priority, TC_H_MAJ(tc->tcm_info) >> 16);
+	if (tbb[TCA_BPF_CLASSID])
+		OPTS_SET(info->opts, classid, libbpf_nla_getattr_u32(tbb[TCA_BPF_CLASSID]));
+ 
+ 	info->processed = true;
+ 	return unicast ? NL_NEXT : NL_DONE;
+@@ -717,7 +719,7 @@ static int tc_add_fd_and_name(struct lib
+ 
+ int bpf_tc_attach(const struct bpf_tc_hook *hook, struct bpf_tc_opts *opts)
+ {
+-	__u32 protocol, bpf_flags, handle, priority, parent, prog_id, flags;
+	__u32 protocol, bpf_flags, handle, priority, parent, prog_id, flags, classid;
+ 	int ret, ifindex, attach_point, prog_fd;
+ 	struct bpf_cb_ctx info = {};
+ 	struct libbpf_nla_req req;
+@@ -737,6 +739,7 @@ int bpf_tc_attach(const struct bpf_tc_ho
+ 	prog_fd      = OPTS_GET(opts, prog_fd, 0);
+ 	prog_id      = OPTS_GET(opts, prog_id, 0);
+ 	flags        = OPTS_GET(opts, flags, 0);
+	classid      = OPTS_GET(opts, classid, 0);
+ 
+ 	if (ifindex <= 0 || !prog_fd || prog_id)
+ 		return libbpf_err(-EINVAL);
+@@ -776,6 +779,11 @@ int bpf_tc_attach(const struct bpf_tc_ho
+ 	ret = nlattr_add(&req, TCA_BPF_FLAGS, &bpf_flags, sizeof(bpf_flags));
+ 	if (ret < 0)
+ 		return libbpf_err(ret);
+	if (classid) {
+		ret = nlattr_add(&req, TCA_BPF_CLASSID, &classid, sizeof(classid));
+		if (ret < 0)
+			return libbpf_err(ret);
+	}
+ 	nlattr_end_nested(&req, nla);
+ 
+ 	info.opts = opts;
--- a/package/libs/mbedtls/Config.in
+++ b/package/libs/mbedtls/Config.in
@ -84,6 +84,10 @@ config MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
 	bool "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED"
 	default n

+config MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED"
+	default n
+
 comment "Curves - unselect old or less-used curves to reduce binary size"

 config MBEDTLS_ECP_DP_SECP192R1_ENABLED
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@ -53,6 +53,7 @@ MBEDTLS_BUILD_OPTS_CIPHERS= \
  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \
  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED \
  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED \
  CONFIG_MBEDTLS_NIST_KW_C \
  CONFIG_MBEDTLS_RIPEMD160_C \
  CONFIG_MBEDTLS_RSA_NO_CRT \
--- a/package/utils/ucode-mod-bpf/src/bpf.c
+++ b/package/utils/ucode-mod-bpf/src/bpf.c
@ -620,7 +620,7 @@ uc_bpf_map_pin(uc_vm_t *vm, size_t nargs)

 static uc_value_t *
 uc_bpf_set_tc_hook(uc_value_t *ifname, uc_value_t *type, uc_value_t *prio,
-		   int fd)
+		   uc_value_t *classid, int fd)
 {
 	DECLARE_LIBBPF_OPTS(bpf_tc_hook, hook);
 	DECLARE_LIBBPF_OPTS(bpf_tc_opts, attach_tc,
@ -657,6 +657,7 @@ uc_bpf_set_tc_hook(uc_value_t *ifname, uc_value_t *type, uc_value_t *prio,
 		goto out;

 	attach_tc.prog_fd = fd;
+	attach_tc.classid = ucv_int64_get(classid);
 	if (bpf_tc_attach(&hook, &attach_tc) < 0)
 		goto error;

@ -676,11 +677,12 @@ uc_bpf_program_tc_attach(uc_vm_t *vm, size_t nargs)
 	uc_value_t *ifname = uc_fn_arg(0);
 	uc_value_t *type = uc_fn_arg(1);
 	uc_value_t *prio = uc_fn_arg(2);
+	uc_value_t *classid = uc_fn_arg(3);

 	if (!f)
 		err_return(EINVAL, NULL);

-	return uc_bpf_set_tc_hook(ifname, type, prio, f->fd);
+	return uc_bpf_set_tc_hook(ifname, type, prio, classid, f->fd);
 }

 static uc_value_t *
@ -690,7 +692,7 @@ uc_bpf_tc_detach(uc_vm_t *vm, size_t nargs)
 	uc_value_t *type = uc_fn_arg(1);
 	uc_value_t *prio = uc_fn_arg(2);

-	return uc_bpf_set_tc_hook(ifname, type, prio, -1);
+	return uc_bpf_set_tc_hook(ifname, type, prio, NULL, -1);
 }

 static int
--- a/target/linux/apm821xx/config-6.12
+++ b/target/linux/apm821xx/config-6.12
@ -128,7 +128,6 @@ CONFIG_IBM_EMAC_RX_COPY_THRESHOLD=256
 CONFIG_IBM_EMAC_TAH=y
 CONFIG_IBM_EMAC_TXB=128
 # CONFIG_ICON is not set
-# CONFIG_IDPF is not set
 CONFIG_ILLEGAL_POINTER_VALUE=0
 CONFIG_IRQCHIP=y
 CONFIG_IRQ_DOMAIN=y
@ -244,6 +243,7 @@ CONFIG_RAS=y
 CONFIG_RATIONAL=y
 CONFIG_REGULATOR=y
 CONFIG_RSEQ=y
+CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES=y
 # CONFIG_SAM440EP is not set
 # CONFIG_SCOM_DEBUGFS is not set
 # CONFIG_SEQUOIA is not set
--- a/target/linux/apm821xx/sata/config-default
+++ b/target/linux/apm821xx/sata/config-default
@ -1,3 +1,4 @@
+CONFIG_460EX=y
 CONFIG_APOLLO3G=y
 CONFIG_ATA=y
 CONFIG_BCM_NET_PHYLIB=y
@ -16,10 +17,10 @@ CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_MD5_PPC=y
 CONFIG_CRYPTO_SHA1_PPC=y
-+# CONFIG_DM_CRYPT is not set
-+# CONFIG_DM_INIT is not set
-+# CONFIG_DM_MIRROR is not set
-+# CONFIG_DM_SNAPSHOT is not set
+# CONFIG_DM_CRYPT is not set
+# CONFIG_DM_INIT is not set
+# CONFIG_DM_MIRROR is not set
+# CONFIG_DM_SNAPSHOT is not set
 CONFIG_EXT4_FS=y
 CONFIG_F2FS_FS=y
 CONFIG_FREEZER=y
@ -47,6 +48,7 @@ CONFIG_PM_SLEEP=y
 CONFIG_PM_WAKELOCKS=y
 CONFIG_PM_WAKELOCKS_GC=y
 CONFIG_PM_WAKELOCKS_LIMIT=100
+CONFIG_PPC4xx_CPM=y
 CONFIG_PPC_EARLY_DEBUG=y
 # CONFIG_PPC_EARLY_DEBUG_16550 is not set
 CONFIG_PPC_EARLY_DEBUG_44x=y
--- a/target/linux/bcm53xx/image/Makefile
+++ b/target/linux/bcm53xx/image/Makefile
@ -141,7 +141,7 @@ BRCMFMAC_43602A1 := $(IEEE8021X) kmod-brcmfmac brcmfmac-firmware-43602a1-pcie
 BRCMFMAC_4366B1 := $(IEEE8021X) kmod-brcmfmac brcmfmac-firmware-4366b1-pcie
 BRCMFMAC_4366C0 := $(IEEE8021X) kmod-brcmfmac brcmfmac-firmware-4366c0-pcie
 USB2_PACKAGES := kmod-usb-ohci kmod-usb2 kmod-phy-bcm-ns-usb2
-USB2_PACKAGES += kmod-usb-ledtrig-usbport
+USB2_PACKAGES += kmod-usb-ledtrig-usbport automount
 USB3_PACKAGES := $(USB2_PACKAGES) kmod-usb3 kmod-phy-bcm-ns-usb3

 define Device/Default
--- a/target/linux/generic/backport-6.12/830-v6.17-Revert-leds-trigger-netdev-Configure-LED-blink-inter.patch
+++ b/target/linux/generic/backport-6.12/830-v6.17-Revert-leds-trigger-netdev-Configure-LED-blink-inter.patch
@ -0,0 +1,81 @@
+From 26f732791f2bcab18f59c61915bbe35225f30136 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 12 Jul 2025 16:39:21 +0100
+Subject: [PATCH] Revert "leds: trigger: netdev: Configure LED blink interval
+ for HW offload"
+
+This reverts commit c629c972b310af41e9e072febb6dae9a299edde6.
+
+While .led_blink_set() would previously put an LED into an unconditional
+permanently blinking state, the offending commit now uses same operation
+to (also?) set the blink timing of the netdev trigger when offloading.
+
+This breaks many if not all of the existing PHY drivers which offer
+offloading LED operations, as those drivers would just put the LED into
+blinking state after .led_blink_set() has been called.
+
+Unfortunately the change even made it into stable kernels for unknown
+reasons, so it should be reverted there as well.
+
+Fixes: c629c972b310a ("leds: trigger: netdev: Configure LED blink interval for HW offload")
+Link: https://lore.kernel.org/linux-leds/c6134e26-2e45-4121-aa15-58aaef327201@lunn.ch/T/#m9d6fe81bbcb273e59f12bbedbd633edd32118387
+Suggested-by: Andrew Lunn <andrew@lunn.ch>
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/6dcc77ee1c9676891d6250d8994850f521426a0f.1752334655.git.daniel@makrotopia.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 16 +++-------------
+ 1 file changed, 3 insertions(+), 13 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
+++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -68,7 +68,6 @@ struct led_netdev_data {
+ 	unsigned int last_activity;
+ 
+ 	unsigned long mode;
+-	unsigned long blink_delay;
+ 	int link_speed;
+ 	__ETHTOOL_DECLARE_LINK_MODE_MASK(supported_link_modes);
+ 	u8 duplex;
+@@ -87,10 +86,6 @@ static void set_baseline_state(struct le
+ 	/* Already validated, hw control is possible with the requested mode */
+ 	if (trigger_data->hw_control) {
+ 		led_cdev->hw_control_set(led_cdev, trigger_data->mode);
+-		if (led_cdev->blink_set) {
+-			led_cdev->blink_set(led_cdev, &trigger_data->blink_delay,
+-					    &trigger_data->blink_delay);
+-		}
+ 
+ 		return;
+ 	}
+@@ -459,11 +454,10 @@ static ssize_t interval_store(struct dev
+ 			      size_t size)
+ {
+ 	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
+-	struct led_classdev *led_cdev = trigger_data->led_cdev;
+ 	unsigned long value;
+ 	int ret;
+ 
+-	if (trigger_data->hw_control && !led_cdev->blink_set)
+	if (trigger_data->hw_control)
+ 		return -EINVAL;
+ 
+ 	ret = kstrtoul(buf, 0, &value);
+@@ -472,13 +466,9 @@ static ssize_t interval_store(struct dev
+ 
+ 	/* impose some basic bounds on the timer interval */
+ 	if (value >= 5 && value <= 10000) {
+-		if (trigger_data->hw_control) {
+-			trigger_data->blink_delay = value;
+-		} else {
+-			cancel_delayed_work_sync(&trigger_data->work);
+		cancel_delayed_work_sync(&trigger_data->work);
+ 
+-			atomic_set(&trigger_data->interval, msecs_to_jiffies(value));
+-		}
+		atomic_set(&trigger_data->interval, msecs_to_jiffies(value));
+ 		set_baseline_state(trigger_data);	/* resets timer */
+ 	}
+ 
--- a/target/linux/generic/backport-6.6/847-v6.17-Revert-leds-trigger-netdev-Configure-LED-blink-inter.patch
+++ b/target/linux/generic/backport-6.6/847-v6.17-Revert-leds-trigger-netdev-Configure-LED-blink-inter.patch
@ -0,0 +1,81 @@
+From 26f732791f2bcab18f59c61915bbe35225f30136 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 12 Jul 2025 16:39:21 +0100
+Subject: [PATCH] Revert "leds: trigger: netdev: Configure LED blink interval
+ for HW offload"
+
+This reverts commit c629c972b310af41e9e072febb6dae9a299edde6.
+
+While .led_blink_set() would previously put an LED into an unconditional
+permanently blinking state, the offending commit now uses same operation
+to (also?) set the blink timing of the netdev trigger when offloading.
+
+This breaks many if not all of the existing PHY drivers which offer
+offloading LED operations, as those drivers would just put the LED into
+blinking state after .led_blink_set() has been called.
+
+Unfortunately the change even made it into stable kernels for unknown
+reasons, so it should be reverted there as well.
+
+Fixes: c629c972b310a ("leds: trigger: netdev: Configure LED blink interval for HW offload")
+Link: https://lore.kernel.org/linux-leds/c6134e26-2e45-4121-aa15-58aaef327201@lunn.ch/T/#m9d6fe81bbcb273e59f12bbedbd633edd32118387
+Suggested-by: Andrew Lunn <andrew@lunn.ch>
+Cc: stable@vger.kernel.org
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/r/6dcc77ee1c9676891d6250d8994850f521426a0f.1752334655.git.daniel@makrotopia.org
+Signed-off-by: Lee Jones <lee@kernel.org>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 16 +++-------------
+ 1 file changed, 3 insertions(+), 13 deletions(-)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
+++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -54,7 +54,6 @@ struct led_netdev_data {
+ 	unsigned int last_activity;
+ 
+ 	unsigned long mode;
+-	unsigned long blink_delay;
+ 	int link_speed;
+ 	u8 duplex;
+ 
+@@ -70,10 +69,6 @@ static void set_baseline_state(struct le
+ 	/* Already validated, hw control is possible with the requested mode */
+ 	if (trigger_data->hw_control) {
+ 		led_cdev->hw_control_set(led_cdev, trigger_data->mode);
+-		if (led_cdev->blink_set) {
+-			led_cdev->blink_set(led_cdev, &trigger_data->blink_delay,
+-					    &trigger_data->blink_delay);
+-		}
+ 
+ 		return;
+ 	}
+@@ -415,11 +410,10 @@ static ssize_t interval_store(struct dev
+ 			      size_t size)
+ {
+ 	struct led_netdev_data *trigger_data = led_trigger_get_drvdata(dev);
+-	struct led_classdev *led_cdev = trigger_data->led_cdev;
+ 	unsigned long value;
+ 	int ret;
+ 
+-	if (trigger_data->hw_control && !led_cdev->blink_set)
+	if (trigger_data->hw_control)
+ 		return -EINVAL;
+ 
+ 	ret = kstrtoul(buf, 0, &value);
+@@ -428,13 +422,9 @@ static ssize_t interval_store(struct dev
+ 
+ 	/* impose some basic bounds on the timer interval */
+ 	if (value >= 5 && value <= 10000) {
+-		if (trigger_data->hw_control) {
+-			trigger_data->blink_delay = value;
+-		} else {
+-			cancel_delayed_work_sync(&trigger_data->work);
+		cancel_delayed_work_sync(&trigger_data->work);
+ 
+-			atomic_set(&trigger_data->interval, msecs_to_jiffies(value));
+-		}
+		atomic_set(&trigger_data->interval, msecs_to_jiffies(value));
+ 		set_baseline_state(trigger_data);	/* resets timer */
+ 	}
+ 
--- a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_h3c_vfs.c
+++ b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_h3c_vfs.c
@ -98,8 +98,11 @@ static int mtdsplit_h3c_vfs_parse(struct mtd_info *mtd,
 	if (retlen != sizeof(format_flag))
 		return -EIO;

-	if (format_flag != FORMAT_FLAG)
-		return -EINVAL;
+	if (format_flag != FORMAT_FLAG) {
+		pr_info("mtdsplit_h3c_vfs: unexpected format flag %08x\n",
+			format_flag);
+		return 0;
+	}

 	/* Check file entry */
 	err = mtd_read(mtd, FILE_ENTRY_OFFSET, sizeof(file_entry), &retlen,
@ -110,20 +113,14 @@ static int mtdsplit_h3c_vfs_parse(struct mtd_info *mtd,
 	if (retlen != sizeof(file_entry))
 		return -EIO;

-	if (file_entry.flags != FILE_ENTRY_FLAGS)
-		return -EINVAL;
-
-	if (file_entry.parent_block != FILE_ENTRY_PARENT_BLOCK)
-		return -EINVAL;
-
-	if (file_entry.parent_index != FILE_ENTRY_PARENT_INDEX)
-		return -EINVAL;
-
-	if (file_entry.data_block != FILE_ENTRY_DATA_BLOCK)
-		return -EINVAL;
-
-	if (strncmp(file_entry.name, FILE_ENTRY_NAME, sizeof(file_entry.name)) != 0)
-		return -EINVAL;
+	if (file_entry.flags != FILE_ENTRY_FLAGS ||
+	    file_entry.parent_block != FILE_ENTRY_PARENT_BLOCK ||
+	    file_entry.parent_index != FILE_ENTRY_PARENT_INDEX ||
+	    file_entry.data_block != FILE_ENTRY_DATA_BLOCK ||
+	    strncmp(file_entry.name, FILE_ENTRY_NAME, sizeof(file_entry.name)) != 0) {
+		pr_info("mtdsplit_h3c_vfs: unexpected file entry - OpenWrt probably not installed\n");
+		return 0;
+	}

 	/* Find rootfs offset */
 	kernel_size = block_offset(file_entry.data_block +
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@ -1273,8 +1273,16 @@ define Device/iptime_ax3000sm
  DEVICE_MODEL := AX3000SM
  DEVICE_DTS := mt7981b-iptime-ax3000sm
  DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 32768k
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGES := factory.bin sysupgrade.bin
+  IMAGE/factory.bin := sysupgrade-tar | append-metadata | check-size | iptime-crc32 ax3ksm
  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
  SUPPORTED_DEVICES += mediatek,mt7981-spim-snand-rfb
 endef
 TARGET_DEVICES += iptime_ax3000sm
--- a/target/linux/realtek/dts/rtl9303_hasivo_s1100w-8xgt-se.dts
+++ b/target/linux/realtek/dts/rtl9303_hasivo_s1100w-8xgt-se.dts
@ -0,0 +1,275 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/dts-v1/;
+
+#include "rtl930x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "hasivo,s1100w-8xgt-se", "realtek,rtl930x-soc";
+	model = "Hasivo S1100W-8XGT-SE";
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x00000000 0x10000000>, /* 256 MiB lowmem */
+		      <0x20000000 0x10000000>; /* 256 MiB highmem */
+	};
+
+	aliases {
+		led-boot = &led_sys;
+		led-failsafe = &led_sys;
+		led-running = &led_sys;
+		led-upgrade = &led_sys;
+	};
+
+	chosen {
+		stdout-path = "serial0:38400n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			gpios = <&gpio0 5 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_sys: led-0 {
+			gpios = <&gpio0 21 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+		};
+	};
+
+	led_set {
+		compatible = "realtek,rtl9300-leds";
+		active-low;
+
+		/*
+		* LED set 0
+		*
+		* - LED[0](Amber): 5G/LINK/ACT
+		* - LED[1](Green): 10G/LINK/ACT
+		* - LED[2](Amber): 1G/100M/10M/LINK/ACT
+		* - LED[3](Green): 2.5G/LINK/ACT
+		*/
+		led_set0 = <0x0a02 0x0a01 0x0ba0 0x0a08>;
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			/* stock is LOADER */
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0000000 0x00e0000>;
+				read-only;
+			};
+
+			/* stock is BDINFO */
+			partition@e0000 {
+				label = "u-boot-env";
+				reg = <0x00e0000 0x0010000>;
+			};
+
+			/* stock is SYSINFO */
+			partition@f0000 {
+				label = "u-boot-env2";
+				reg = <0x00f0000 0x0010000>;
+				read-only;
+			};
+
+			/* stock is JFFS2_CFG */
+			partition@100000 {
+				label = "jffs";
+				reg = <0x0100000 0x0100000>;
+			};
+
+			/* stock is JFFS2_LOG */
+			partition@200000 {
+				label = "jffs2";
+				reg = <0x0200000 0x0100000>;
+			};
+
+			/* stock is RUNTIME */
+			partition@300000 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				label = "firmware";
+				reg = <0x0300000 0x0c00000>;
+			};
+
+			/* stock is OEMINFO */
+			partition@f00000 {
+				label = "oeminfo";
+				reg = <0x0f00000 0x0100000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		phy0: ethernet-phy@0 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <0 0>;
+			reg = <0>;
+			sds = <2>;
+		};
+
+		phy8: ethernet-phy@8 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <0 1>;
+			reg = <8>;
+			sds = <3>;
+		};
+
+		phy16: ethernet-phy@16 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <0 2>;
+			reg = <16>;
+			sds = <4>;
+		};
+
+		phy20: ethernet-phy@20 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <0 3>;
+			reg = <20>;
+			sds = <5>;
+		};
+
+		phy24: ethernet-phy@24 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <3 16>;
+			reg = <24>;
+			sds = <6>;
+		};
+
+		phy25: ethernet-phy@25 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <3 17>;
+			reg = <25>;
+			sds = <7>;
+		};
+
+		phy26: ethernet-phy@26 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <3 18>;
+			reg = <26>;
+			sds = <8>;
+		};
+
+		phy27: ethernet-phy@27 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			rtl9300,smi-address = <3 19>;
+			reg = <27>;
+			sds = <9>;
+		};
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy0>;
+			led-set = <0>;
+		};
+
+		port@8 {
+			reg = <8>;
+			label = "lan2";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy8>;
+			led-set = <0>;
+		};
+
+		port@16 {
+			reg = <16>;
+			label = "lan3";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy16>;
+			led-set = <0>;
+		};
+
+		port@20 {
+			reg = <20>;
+			label = "lan4";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy20>;
+			led-set = <0>;
+		};
+
+		port@24 {
+			reg = <24>;
+			label = "lan5";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy24>;
+			led-set = <0>;
+		};
+
+		port@25 {
+			reg = <25>;
+			label = "lan6";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy25>;
+			led-set = <0>;
+		};
+
+		port@26 {
+			reg = <26>;
+			label = "lan7";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy26>;
+			led-set = <0>;
+		};
+
+		port@27 {
+			reg = <27>;
+			label = "lan8";
+			phy-mode = "usxgmii";
+			phy-handle = <&phy27>;
+			led-set = <0>;
+		};
+
+		/* Internal SoC */
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <10000>;
+				full-duplex;
+			};
+		};
+	};
+};
--- a/target/linux/realtek/dts/rtl9303_vimin_vm-s100-0800ms.dts
+++ b/target/linux/realtek/dts/rtl9303_vimin_vm-s100-0800ms.dts
@ -0,0 +1,388 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl930x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "vimin,vm-s100-0800ms", "realtek,rtl930x-soc";
+	model = "Vimin VM-S100-0800MS";
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x00000000 0x10000000>, /* first 256 MiB */
+		      <0x20000000 0x10000000>; /* remaining 256 MiB */
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	i2c_master: i2c@1b00036c {
+		compatible = "realtek,rtl9300-i2c";
+		reg = <0x1b00036c 0x3c>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+		scl-pin = <8>;
+		sda-pin = <9>;
+		clock-frequency = <100000>;
+	};
+
+	i2c-mux {
+		compatible = "realtek,i2c-mux-rtl9300";
+		i2c-parent = <&i2c_master>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		i2c0: i2c@0 {
+			reg = <0>;
+			scl-pin = <8>;
+			sda-pin = <9>;
+		};
+
+		i2c1: i2c@1 {
+			reg = <1>;
+			scl-pin = <8>;
+			sda-pin = <10>;
+		};
+
+		i2c2: i2c@2 {
+			reg = <2>;
+			scl-pin = <8>;
+			sda-pin = <11>;
+		};
+
+		i2c3: i2c@3 {
+			reg = <3>;
+			scl-pin = <8>;
+			sda-pin = <12>;
+		};
+
+		i2c4: i2c@4 {
+			reg = <4>;
+			scl-pin = <8>;
+			sda-pin = <13>;
+		};
+
+		i2c5: i2c@5 {
+			reg = <5>;
+			scl-pin = <8>;
+			sda-pin = <14>;
+		};
+
+		i2c6: i2c@6 {
+			reg = <6>;
+			scl-pin = <8>;
+			sda-pin = <15>;
+		};
+
+		i2c7: i2c@7 {
+			reg = <7>;
+			scl-pin = <8>;
+			sda-pin = <16>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			gpios = <&gpio0 7 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	led_set {
+		compatible = "realtek,rtl9300-leds";
+		active-low;
+
+		/*
+		 * LED set 0
+		 *
+		 * - LED[0](Green): 10M/100M/1G/2.5G/5G/10G/LINK/ACT
+		 */
+		led_set0 = <0x0bab>;
+	};
+
+	sfp0: sfp-p1 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 0 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 1 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 2 GPIO_ACTIVE_HIGH>;
+		maximum-power-milliwatt = <2900>;
+		#thermal-sensor-cells = <0>;
+	};
+
+	sfp1: sfp-p2 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 3 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 4 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 5 GPIO_ACTIVE_HIGH>;
+		maximum-power-milliwatt = <1500>;
+		#thermal-sensor-cells = <0>;
+	};
+
+	sfp2: sfp-p3 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c2>;
+		los-gpio = <&gpio1 6 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 7 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 8 GPIO_ACTIVE_HIGH>;
+		maximum-power-milliwatt = <1500>;
+		#thermal-sensor-cells = <0>;
+	};
+
+	sfp3: sfp-p4 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c3>;
+		los-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 10 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 11 GPIO_ACTIVE_HIGH>;
+		maximum-power-milliwatt = <2000>;
+		#thermal-sensor-cells = <0>;
+	};
+
+	sfp4: sfp-p5 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c4>;
+		los-gpio = <&gpio1 12 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 13 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 14 GPIO_ACTIVE_HIGH>;
+		maximum-power-milliwatt = <2000>;
+		#thermal-sensor-cells = <0>;
+	};
+
+	sfp5: sfp-p6 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c5>;
+		los-gpio = <&gpio1 21 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 22 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>;
+		maximum-power-milliwatt = <1500>;
+		#thermal-sensor-cells = <0>;
+	};
+
+	sfp6: sfp-p7 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c6>;
+		los-gpio = <&gpio1 24 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 25 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 26 GPIO_ACTIVE_HIGH>;
+		maximum-power-milliwatt = <1500>;
+		#thermal-sensor-cells = <0>;
+	};
+
+	sfp7: sfp-p8 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c7>;
+		los-gpio = <&gpio1 27 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 28 GPIO_ACTIVE_LOW>;
+		tx-disable-gpio = <&gpio1 29 GPIO_ACTIVE_HIGH>;
+		maximum-power-milliwatt = <2900>;
+		#thermal-sensor-cells = <0>;
+	};
+};
+
+&mdio_aux {
+	status = "okay";
+
+	gpio1: gpio@0 {
+		compatible = "realtek,rtl8231";
+		reg = <0>;
+
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0xe0000>;
+				read-only;
+			};
+
+			partition@e0000 {
+				label = "u-boot-env";
+				reg = <0xe0000 0x10000>;
+			};
+
+			partition@f0000 {
+				label = "u-boot-env2";
+				reg = <0xf0000 0x10000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "jffs";
+				reg = <0x100000 0x100000>;
+			};
+
+			partition@200000 {
+				label = "jffs2";
+				reg = <0x200000 0x100000>;
+			};
+
+			partition@300000 {
+				label = "firmware";
+				reg = <0x300000 0xd00000>;
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <0x93000000>;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio: mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		INTERNAL_PHY_SDS(0, 2)
+		INTERNAL_PHY_SDS(8, 3)
+		INTERNAL_PHY_SDS(16, 4)
+		INTERNAL_PHY_SDS(20, 5)
+		INTERNAL_PHY_SDS(24, 6)
+		INTERNAL_PHY_SDS(25, 7)
+		INTERNAL_PHY_SDS(26, 8)
+		INTERNAL_PHY_SDS(27, 9)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+			pseudo-phy-handle = <&phy0>;
+			phy-mode = "10gbase-r";
+			sfp = <&sfp0>;
+			managed = "in-band-status";
+			led-set = <0>;
+		};
+
+		port@8 {
+			reg = <8>;
+			label = "lan2";
+			pseudo-phy-handle = <&phy8>;
+			phy-mode = "10gbase-r";
+			sfp = <&sfp1>;
+			managed = "in-band-status";
+			led-set = <0>;
+		};
+
+		port@10 {
+			reg = <16>;
+			label = "lan3";
+			pseudo-phy-handle = <&phy16>;
+			phy-mode = "10gbase-r";
+			sfp = <&sfp2>;
+			managed = "in-band-status";
+			led-set = <0>;
+		};
+
+		port@14 {
+			reg = <20>;
+			label = "lan4";
+			pseudo-phy-handle = <&phy20>;
+			phy-mode = "10gbase-r";
+			sfp = <&sfp3>;
+			managed = "in-band-status";
+			led-set = <0>;
+		};
+
+		port@18 {
+			reg = <24>;
+			label = "lan5";
+			pseudo-phy-handle = <&phy24>;
+			phy-mode = "10gbase-r";
+			sfp = <&sfp4>;
+			managed = "in-band-status";
+			led-set = <0>;
+		};
+
+		port@19 {
+			reg = <25>;
+			label = "lan6";
+			pseudo-phy-handle = <&phy25>;
+			phy-mode = "10gbase-r";
+			sfp = <&sfp5>;
+			managed = "in-band-status";
+			led-set = <0>;
+		};
+
+		port@1a {
+			reg = <26>;
+			label = "lan7";
+			pseudo-phy-handle = <&phy26>;
+			phy-mode = "10gbase-r";
+			sfp = <&sfp6>;
+			managed = "in-band-status";
+			led-set = <0>;
+		};
+
+		port@1b {
+			reg = <27>;
+			label = "lan8";
+			pseudo-phy-handle = <&phy27>;
+			phy-mode = "10gbase-r";
+			sfp = <&sfp7>;
+			managed = "in-band-status";
+			led-set = <0>;
+		};
+
+		port@1c {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <10000>;
+				full-duplex;
+			};
+		};
+	};
+};
+
+&thermal_zones {
+	sfp-thermal {
+		polling-delay-passive = <10000>;
+		polling-delay = <10000>;
+		thermal-sensors = <&sfp0>, <&sfp1>, <&sfp2>, <&sfp3>, <&sfp4>, <&sfp5>, <&sfp6>, <&sfp7>;
+		trips {
+			sfp-crit {
+				temperature = <110000>;
+				hysteresis = <1000>;
+				type = "critical";
+			};
+		};
+	};
+};
--- a/target/linux/realtek/dts/rtl930x.dtsi
+++ b/target/linux/realtek/dts/rtl930x.dtsi
@ -59,7 +59,7 @@
 		compatible = "simple-bus";
 		#address-cells = <1>;
 		#size-cells = <1>;
-		ranges = <0x0 0x18000000 0x10000>;
+		ranges = <0x0 0x18000000 0x20000>;

 		intc: interrupt-controller@3000 {
 			compatible = "realtek,rtl9300-intc", "realtek,rtl-intc";
@ -71,6 +71,18 @@
 			interrupts = <2>, <3>, <4>, <5>, <6>, <7>;
 		};

+		snand: spi@1a400 {
+			compatible = "realtek,rtl9301-snand";
+			reg = <0x1a400 0x44>;
+			interrupt-parent = <&intc>;
+			interrupts = <19 2>;
+			clocks = <&lx_clk>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "disabled";
+		};
+
 		spi0: spi@1200 {
 			compatible = "realtek,rtl8380-spi";
 			reg = <0x1200 0x100>;
--- a/target/linux/realtek/dts/rtl931x.dtsi
+++ b/target/linux/realtek/dts/rtl931x.dtsi
@ -95,7 +95,7 @@
 		compatible = "simple-bus";
 		#address-cells = <1>;
 		#size-cells = <1>;
-		ranges = <0x0 0x18000000 0x10000>;
+		ranges = <0x0 0x18000000 0x20000>;

 		spi0: spi@1200 {
 			status = "okay";
@ -107,6 +107,18 @@
 			#size-cells = <0>;
 		};

+		snand: spi@1a400 {
+			compatible = "realtek,rtl9301-snand";
+			reg = <0x1a400 0x44>;
+			interrupt-parent = <&gic>;
+			interrupts = <GIC_SHARED 37 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&lx_clk>;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "disabled";
+		};
+
 		watchdog0: watchdog@3260 {
 			compatible = "realtek,rtl9310-wdt";
 			reg = <0x3260 0xc>;
--- a/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/common.c
+++ b/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/common.c
@ -29,9 +29,6 @@ extern const struct dsa_switch_ops rtl930x_switch_ops;
 extern const struct phylink_pcs_ops rtl83xx_pcs_ops;
 extern const struct phylink_pcs_ops rtl93xx_pcs_ops;

-extern int rtmdio_838x_read_phy(u32 port, u32 page, u32 reg, u32 *val);
-extern int rtmdio_838x_write_phy(u32 port, u32 page, u32 reg, u32 val);
-
 DEFINE_MUTEX(smi_lock);

 int rtl83xx_port_get_stp_state(struct rtl838x_switch_priv *priv, int port)
@ -243,38 +240,6 @@ u64 rtl839x_get_port_reg_le(int reg)
 	return v;
 }

-int read_phy(u32 port, u32 page, u32 reg, u32 *val)
-{
-	switch (soc_info.family) {
-	case RTL8380_FAMILY_ID:
-		return rtmdio_838x_read_phy(port, page, reg, val);
-	case RTL8390_FAMILY_ID:
-		return rtl839x_read_phy(port, page, reg, val);
-	case RTL9300_FAMILY_ID:
-		return rtl930x_read_phy(port, page, reg, val);
-	case RTL9310_FAMILY_ID:
-		return rtl931x_read_phy(port, page, reg, val);
-	}
-
-	return -1;
-}
-
-int write_phy(u32 port, u32 page, u32 reg, u32 val)
-{
-	switch (soc_info.family) {
-	case RTL8380_FAMILY_ID:
-		return rtmdio_838x_write_phy(port, page, reg, val);
-	case RTL8390_FAMILY_ID:
-		return rtl839x_write_phy(port, page, reg, val);
-	case RTL9300_FAMILY_ID:
-		return rtl930x_write_phy(port, page, reg, val);
-	case RTL9310_FAMILY_ID:
-		return rtl931x_write_phy(port, page, reg, val);
-	}
-
-	return -1;
-}
-
 static int rtldsa_bus_read(struct mii_bus *bus, int addr, int regnum)
 {
 	struct rtl838x_switch_priv *priv = bus->priv;
@ -1599,7 +1564,7 @@ static int __init rtl83xx_sw_probe(struct platform_device *pdev)
 		priv->cpu_port = RTL931X_CPU_PORT;
 		priv->port_mask = 0x3f;
 		priv->port_width = 2;
-		priv->irq_mask = 0xFFFFFFFFFFFFFULL;
+		priv->irq_mask = GENMASK_ULL(priv->cpu_port - 1, 0);
 		priv->r = &rtl931x_reg;
 		priv->ds->num_ports = 57;
 		priv->fib_entries = 16384;
--- a/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/dsa.c
+++ b/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/dsa.c
@ -16,8 +16,18 @@ static const u8 ipv6_all_hosts_mcast_addr_base[ETH_ALEN] =
 static const u8 ipv6_all_hosts_mcast_addr_mask[ETH_ALEN] =
 { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };

+/* This interval needs to be short enough to prevent an undetected counter
+ * overflow. The octet counters don't need to be considered for this, because
+ * they are 64 bits on all platforms. Based on the possible packets per second
+ * at the highest supported speeds, an interval of a minute is probably a safe
+ * choice for the other counters.
+ */
+#define RTLDSA_COUNTERS_POLL_INTERVAL	(60 * HZ)
+
 extern struct rtl83xx_soc_info soc_info;

+static void rtldsa_init_counters(struct rtl838x_switch_priv *priv);
+
 static void rtl83xx_init_stats(struct rtl838x_switch_priv *priv)
 {
 	mutex_lock(&priv->reg_mutex);
@ -55,53 +65,263 @@ static void rtl83xx_enable_phy_polling(struct rtl838x_switch_priv *priv)
 		sw_w32_mask(0, 0x8000, RTL838X_SMI_GLB_CTRL);
 }

-const struct rtl83xx_mib_desc rtl83xx_mib[] = {
-	MIB_DESC(2, 0xf8, "ifInOctets"),
-	MIB_DESC(2, 0xf0, "ifOutOctets"),
-	MIB_DESC(1, 0xec, "dot1dTpPortInDiscards"),
-	MIB_DESC(1, 0xe8, "ifInUcastPkts"),
-	MIB_DESC(1, 0xe4, "ifInMulticastPkts"),
-	MIB_DESC(1, 0xe0, "ifInBroadcastPkts"),
-	MIB_DESC(1, 0xdc, "ifOutUcastPkts"),
-	MIB_DESC(1, 0xd8, "ifOutMulticastPkts"),
-	MIB_DESC(1, 0xd4, "ifOutBroadcastPkts"),
-	MIB_DESC(1, 0xd0, "ifOutDiscards"),
-	MIB_DESC(1, 0xcc, ".3SingleCollisionFrames"),
-	MIB_DESC(1, 0xc8, ".3MultipleCollisionFrames"),
-	MIB_DESC(1, 0xc4, ".3DeferredTransmissions"),
-	MIB_DESC(1, 0xc0, ".3LateCollisions"),
-	MIB_DESC(1, 0xbc, ".3ExcessiveCollisions"),
-	MIB_DESC(1, 0xb8, ".3SymbolErrors"),
-	MIB_DESC(1, 0xb4, ".3ControlInUnknownOpcodes"),
-	MIB_DESC(1, 0xb0, ".3InPauseFrames"),
-	MIB_DESC(1, 0xac, ".3OutPauseFrames"),
-	MIB_DESC(1, 0xa8, "DropEvents"),
-	MIB_DESC(1, 0xa4, "tx_BroadcastPkts"),
-	MIB_DESC(1, 0xa0, "tx_MulticastPkts"),
-	MIB_DESC(1, 0x9c, "CRCAlignErrors"),
-	MIB_DESC(1, 0x98, "tx_UndersizePkts"),
-	MIB_DESC(1, 0x94, "rx_UndersizePkts"),
-	MIB_DESC(1, 0x90, "rx_UndersizedropPkts"),
-	MIB_DESC(1, 0x8c, "tx_OversizePkts"),
-	MIB_DESC(1, 0x88, "rx_OversizePkts"),
-	MIB_DESC(1, 0x84, "Fragments"),
-	MIB_DESC(1, 0x80, "Jabbers"),
-	MIB_DESC(1, 0x7c, "Collisions"),
-	MIB_DESC(1, 0x78, "tx_Pkts64Octets"),
-	MIB_DESC(1, 0x74, "rx_Pkts64Octets"),
-	MIB_DESC(1, 0x70, "tx_Pkts65to127Octets"),
-	MIB_DESC(1, 0x6c, "rx_Pkts65to127Octets"),
-	MIB_DESC(1, 0x68, "tx_Pkts128to255Octets"),
-	MIB_DESC(1, 0x64, "rx_Pkts128to255Octets"),
-	MIB_DESC(1, 0x60, "tx_Pkts256to511Octets"),
-	MIB_DESC(1, 0x5c, "rx_Pkts256to511Octets"),
-	MIB_DESC(1, 0x58, "tx_Pkts512to1023Octets"),
-	MIB_DESC(1, 0x54, "rx_Pkts512to1023Octets"),
-	MIB_DESC(1, 0x50, "tx_Pkts1024to1518Octets"),
-	MIB_DESC(1, 0x4c, "rx_StatsPkts1024to1518Octets"),
-	MIB_DESC(1, 0x48, "tx_Pkts1519toMaxOctets"),
-	MIB_DESC(1, 0x44, "rx_Pkts1519toMaxOctets"),
-	MIB_DESC(1, 0x40, "rxMacDiscards")
+const struct rtldsa_mib_list_item rtldsa_838x_mib_list[] = {
+	MIB_LIST_ITEM("dot1dTpPortInDiscards", MIB_ITEM(MIB_REG_STD, 0xec, 1)),
+	MIB_LIST_ITEM("ifOutDiscards", MIB_ITEM(MIB_REG_STD, 0xd0, 1)),
+	MIB_LIST_ITEM("DropEvents", MIB_ITEM(MIB_REG_STD, 0xa8, 1)),
+	MIB_LIST_ITEM("tx_BroadcastPkts", MIB_ITEM(MIB_REG_STD, 0xa4, 1)),
+	MIB_LIST_ITEM("tx_MulticastPkts", MIB_ITEM(MIB_REG_STD, 0xa0, 1)),
+	MIB_LIST_ITEM("tx_UndersizePkts", MIB_ITEM(MIB_REG_STD, 0x98, 1)),
+	MIB_LIST_ITEM("rx_UndersizeDropPkts", MIB_ITEM(MIB_REG_STD, 0x90, 1)),
+	MIB_LIST_ITEM("tx_OversizePkts", MIB_ITEM(MIB_REG_STD, 0x8c, 1)),
+	MIB_LIST_ITEM("Collisions", MIB_ITEM(MIB_REG_STD, 0x7c, 1)),
+	MIB_LIST_ITEM("rx_MacDiscards", MIB_ITEM(MIB_REG_STD, 0x40, 1))
+};
+
+const struct rtldsa_mib_desc rtldsa_838x_mib = {
+	.symbol_errors = MIB_ITEM(MIB_REG_STD, 0xb8, 1),
+
+	.if_in_octets = MIB_ITEM(MIB_REG_STD, 0xf8, 2),
+	.if_out_octets = MIB_ITEM(MIB_REG_STD, 0xf0, 2),
+	.if_in_ucast_pkts = MIB_ITEM(MIB_REG_STD, 0xe8, 1),
+	.if_in_mcast_pkts = MIB_ITEM(MIB_REG_STD, 0xe4, 1),
+	.if_in_bcast_pkts = MIB_ITEM(MIB_REG_STD, 0xe0, 1),
+	.if_out_ucast_pkts = MIB_ITEM(MIB_REG_STD, 0xdc, 1),
+	.if_out_mcast_pkts = MIB_ITEM(MIB_REG_STD, 0xd8, 1),
+	.if_out_bcast_pkts = MIB_ITEM(MIB_REG_STD, 0xd4, 1),
+	.if_out_discards = MIB_ITEM(MIB_REG_STD, 0xd0, 1),
+	.single_collisions = MIB_ITEM(MIB_REG_STD, 0xcc, 1),
+	.multiple_collisions = MIB_ITEM(MIB_REG_STD, 0xc8, 1),
+	.deferred_transmissions = MIB_ITEM(MIB_REG_STD, 0xc4, 1),
+	.late_collisions = MIB_ITEM(MIB_REG_STD, 0xc0, 1),
+	.excessive_collisions = MIB_ITEM(MIB_REG_STD, 0xbc, 1),
+	.crc_align_errors = MIB_ITEM(MIB_REG_STD, 0x9c, 1),
+
+	.unsupported_opcodes = MIB_ITEM(MIB_REG_STD, 0xb4, 1),
+
+	.rx_undersize_pkts = MIB_ITEM(MIB_REG_STD, 0x94, 1),
+	.rx_oversize_pkts = MIB_ITEM(MIB_REG_STD, 0x88, 1),
+	.rx_fragments = MIB_ITEM(MIB_REG_STD, 0x84, 1),
+	.rx_jabbers = MIB_ITEM(MIB_REG_STD, 0x80, 1),
+
+	.tx_pkts = {
+		MIB_ITEM(MIB_REG_STD, 0x78, 1),
+		MIB_ITEM(MIB_REG_STD, 0x70, 1),
+		MIB_ITEM(MIB_REG_STD, 0x68, 1),
+		MIB_ITEM(MIB_REG_STD, 0x60, 1),
+		MIB_ITEM(MIB_REG_STD, 0x58, 1),
+		MIB_ITEM(MIB_REG_STD, 0x50, 1),
+		MIB_ITEM(MIB_REG_STD, 0x48, 1)
+	},
+	.rx_pkts = {
+		MIB_ITEM(MIB_REG_STD, 0x74, 1),
+		MIB_ITEM(MIB_REG_STD, 0x6c, 1),
+		MIB_ITEM(MIB_REG_STD, 0x64, 1),
+		MIB_ITEM(MIB_REG_STD, 0x5c, 1),
+		MIB_ITEM(MIB_REG_STD, 0x54, 1),
+		MIB_ITEM(MIB_REG_STD, 0x4c, 1),
+		MIB_ITEM(MIB_REG_STD, 0x44, 1)
+	},
+	.rmon_ranges = {
+		{ 0, 64 },
+		{ 65, 127 },
+		{ 128, 255 },
+		{ 256, 511 },
+		{ 512, 1023 },
+		{ 1024, 1518 },
+		{ 1519, 10000 }
+	},
+
+	.drop_events = MIB_ITEM(MIB_REG_STD, 0xa8, 1),
+	.collisions = MIB_ITEM(MIB_REG_STD, 0x7c, 1),
+
+	.rx_pause_frames = MIB_ITEM(MIB_REG_STD, 0xb0, 1),
+	.tx_pause_frames = MIB_ITEM(MIB_REG_STD, 0xac, 1),
+
+	.list_count = ARRAY_SIZE(rtldsa_838x_mib_list),
+	.list = rtldsa_838x_mib_list
+};
+
+const struct rtldsa_mib_list_item rtldsa_839x_mib_list[] = {
+	MIB_LIST_ITEM("ifOutDiscards", MIB_ITEM(MIB_REG_STD, 0xd4, 1)),
+	MIB_LIST_ITEM("dot1dTpPortInDiscards", MIB_ITEM(MIB_REG_STD, 0xd0, 1)),
+	MIB_LIST_ITEM("DropEvents", MIB_ITEM(MIB_REG_STD, 0xa8, 1)),
+	MIB_LIST_ITEM("tx_BroadcastPkts", MIB_ITEM(MIB_REG_STD, 0xa4, 1)),
+	MIB_LIST_ITEM("tx_MulticastPkts", MIB_ITEM(MIB_REG_STD, 0xa0, 1)),
+	MIB_LIST_ITEM("tx_UndersizePkts", MIB_ITEM(MIB_REG_STD, 0x98, 1)),
+	MIB_LIST_ITEM("rx_UndersizeDropPkts", MIB_ITEM(MIB_REG_STD, 0x90, 1)),
+	MIB_LIST_ITEM("tx_OversizePkts", MIB_ITEM(MIB_REG_STD, 0x8c, 1)),
+	MIB_LIST_ITEM("Collisions", MIB_ITEM(MIB_REG_STD, 0x7c, 1)),
+	MIB_LIST_ITEM("rx_LengthFieldError", MIB_ITEM(MIB_REG_STD, 0x40, 1)),
+	MIB_LIST_ITEM("rx_FalseCarrierTimes", MIB_ITEM(MIB_REG_STD, 0x3c, 1)),
+	MIB_LIST_ITEM("rx_UnderSizeOctets", MIB_ITEM(MIB_REG_STD, 0x38, 1)),
+	MIB_LIST_ITEM("tx_Fragments", MIB_ITEM(MIB_REG_STD, 0x34, 1)),
+	MIB_LIST_ITEM("tx_Jabbers", MIB_ITEM(MIB_REG_STD, 0x30, 1)),
+	MIB_LIST_ITEM("tx_CRCAlignErrors", MIB_ITEM(MIB_REG_STD, 0x2c, 1)),
+	MIB_LIST_ITEM("rx_FramingErrors", MIB_ITEM(MIB_REG_STD, 0x28, 1)),
+	MIB_LIST_ITEM("rx_MacDiscards", MIB_ITEM(MIB_REG_STD, 0x24, 1))
+};
+
+const struct rtldsa_mib_desc rtldsa_839x_mib = {
+	.symbol_errors = MIB_ITEM(MIB_REG_STD, 0xb8, 1),
+
+	.if_in_octets = MIB_ITEM(MIB_REG_STD, 0xf8, 2),
+	.if_out_octets = MIB_ITEM(MIB_REG_STD, 0xf0, 2),
+	.if_in_ucast_pkts = MIB_ITEM(MIB_REG_STD, 0xec, 1),
+	.if_in_mcast_pkts = MIB_ITEM(MIB_REG_STD, 0xe8, 1),
+	.if_in_bcast_pkts = MIB_ITEM(MIB_REG_STD, 0xe4, 1),
+	.if_out_ucast_pkts = MIB_ITEM(MIB_REG_STD, 0xe0, 1),
+	.if_out_mcast_pkts = MIB_ITEM(MIB_REG_STD, 0xdc, 1),
+	.if_out_bcast_pkts = MIB_ITEM(MIB_REG_STD, 0xd8, 1),
+	.if_out_discards = MIB_ITEM(MIB_REG_STD, 0xd4, 1),
+	.single_collisions = MIB_ITEM(MIB_REG_STD, 0xcc, 1),
+	.multiple_collisions = MIB_ITEM(MIB_REG_STD, 0xc8, 1),
+	.deferred_transmissions = MIB_ITEM(MIB_REG_STD, 0xc4, 1),
+	.late_collisions = MIB_ITEM(MIB_REG_STD, 0xc0, 1),
+	.excessive_collisions = MIB_ITEM(MIB_REG_STD, 0xbc, 1),
+	.crc_align_errors = MIB_ITEM(MIB_REG_STD, 0x9c, 1),
+
+	.unsupported_opcodes = MIB_ITEM(MIB_REG_STD, 0xb4, 1),
+
+	.rx_undersize_pkts = MIB_ITEM(MIB_REG_STD, 0x94, 1),
+	.rx_oversize_pkts = MIB_ITEM(MIB_REG_STD, 0x88, 1),
+	.rx_fragments = MIB_ITEM(MIB_REG_STD, 0x84, 1),
+	.rx_jabbers = MIB_ITEM(MIB_REG_STD, 0x80, 1),
+
+	.tx_pkts = {
+		MIB_ITEM(MIB_REG_STD, 0x78, 1),
+		MIB_ITEM(MIB_REG_STD, 0x70, 1),
+		MIB_ITEM(MIB_REG_STD, 0x68, 1),
+		MIB_ITEM(MIB_REG_STD, 0x60, 1),
+		MIB_ITEM(MIB_REG_STD, 0x58, 1),
+		MIB_ITEM(MIB_REG_STD, 0x50, 1),
+		MIB_ITEM(MIB_REG_STD, 0x48, 1)
+	},
+	.rx_pkts = {
+		MIB_ITEM(MIB_REG_STD, 0x74, 1),
+		MIB_ITEM(MIB_REG_STD, 0x6c, 1),
+		MIB_ITEM(MIB_REG_STD, 0x64, 1),
+		MIB_ITEM(MIB_REG_STD, 0x5c, 1),
+		MIB_ITEM(MIB_REG_STD, 0x54, 1),
+		MIB_ITEM(MIB_REG_STD, 0x4c, 1),
+		MIB_ITEM(MIB_REG_STD, 0x44, 1)
+	},
+	.rmon_ranges = {
+		{ 0, 64 },
+		{ 65, 127 },
+		{ 128, 255 },
+		{ 256, 511 },
+		{ 512, 1023 },
+		{ 1024, 1518 },
+		{ 1519, 12288 }
+	},
+
+	.drop_events = MIB_ITEM(MIB_REG_STD, 0xa8, 1),
+	.collisions = MIB_ITEM(MIB_REG_STD, 0x7c, 1),
+
+	.rx_pause_frames = MIB_ITEM(MIB_REG_STD, 0xb0, 1),
+	.tx_pause_frames = MIB_ITEM(MIB_REG_STD, 0xac, 1),
+
+	.list_count = ARRAY_SIZE(rtldsa_839x_mib_list),
+	.list = rtldsa_839x_mib_list
+};
+
+const struct rtldsa_mib_list_item rtldsa_930x_mib_list[] = {
+	MIB_LIST_ITEM("ifOutDiscards", MIB_ITEM(MIB_REG_STD, 0xbc, 1)),
+	MIB_LIST_ITEM("dot1dTpPortInDiscards", MIB_ITEM(MIB_REG_STD, 0xb8, 1)),
+	MIB_LIST_ITEM("DropEvents", MIB_ITEM(MIB_REG_STD, 0x90, 1)),
+	MIB_LIST_ITEM("tx_BroadcastPkts", MIB_ITEM(MIB_REG_STD, 0x8c, 1)),
+	MIB_LIST_ITEM("tx_MulticastPkts", MIB_ITEM(MIB_REG_STD, 0x88, 1)),
+	MIB_LIST_ITEM("tx_CRCAlignErrors", MIB_ITEM(MIB_REG_STD, 0x84, 1)),
+	MIB_LIST_ITEM("tx_UndersizePkts", MIB_ITEM(MIB_REG_STD, 0x7c, 1)),
+	MIB_LIST_ITEM("tx_OversizePkts", MIB_ITEM(MIB_REG_STD, 0x74, 1)),
+	MIB_LIST_ITEM("tx_Fragments", MIB_ITEM(MIB_REG_STD, 0x6c, 1)),
+	MIB_LIST_ITEM("tx_Jabbers", MIB_ITEM(MIB_REG_STD, 0x64, 1)),
+	MIB_LIST_ITEM("tx_Collisions", MIB_ITEM(MIB_REG_STD, 0x5c, 1)),
+	MIB_LIST_ITEM("rx_UndersizeDropPkts", MIB_ITEM(MIB_REG_PRV, 0x7c, 1)),
+	MIB_LIST_ITEM("tx_PktsFlexibleOctetsSet1", MIB_ITEM(MIB_REG_PRV, 0x68, 1)),
+	MIB_LIST_ITEM("rx_PktsFlexibleOctetsSet1", MIB_ITEM(MIB_REG_PRV, 0x64, 1)),
+	MIB_LIST_ITEM("tx_PktsFlexibleOctetsCRCSet1", MIB_ITEM(MIB_REG_PRV, 0x60, 1)),
+	MIB_LIST_ITEM("rx_PktsFlexibleOctetsCRCSet1", MIB_ITEM(MIB_REG_PRV, 0x5c, 1)),
+	MIB_LIST_ITEM("tx_PktsFlexibleOctetsSet0", MIB_ITEM(MIB_REG_PRV, 0x58, 1)),
+	MIB_LIST_ITEM("rx_PktsFlexibleOctetsSet0", MIB_ITEM(MIB_REG_PRV, 0x54, 1)),
+	MIB_LIST_ITEM("tx_PktsFlexibleOctetsCRCSet0", MIB_ITEM(MIB_REG_PRV, 0x50, 1)),
+	MIB_LIST_ITEM("rx_PktsFlexibleOctetsCRCSet0", MIB_ITEM(MIB_REG_PRV, 0x4c, 1)),
+	MIB_LIST_ITEM("LengthFieldError", MIB_ITEM(MIB_REG_PRV, 0x48, 1)),
+	MIB_LIST_ITEM("FalseCarrierTimes", MIB_ITEM(MIB_REG_PRV, 0x44, 1)),
+	MIB_LIST_ITEM("UndersizeOctets", MIB_ITEM(MIB_REG_PRV, 0x40, 1)),
+	MIB_LIST_ITEM("FramingErrors", MIB_ITEM(MIB_REG_PRV, 0x3c, 1)),
+	MIB_LIST_ITEM("ParserErrors", MIB_ITEM(MIB_REG_PRV, 0x38, 1)),
+	MIB_LIST_ITEM("rx_MacDiscards", MIB_ITEM(MIB_REG_PRV, 0x34, 1)),
+	MIB_LIST_ITEM("rx_MacIPGShortDrop", MIB_ITEM(MIB_REG_PRV, 0x30, 1))
+};
+
+const struct rtldsa_mib_desc rtldsa_930x_mib = {
+	.symbol_errors = MIB_ITEM(MIB_REG_STD, 0xa0, 1),
+
+	.if_in_octets = MIB_ITEM(MIB_REG_STD, 0xf8, 2),
+	.if_out_octets = MIB_ITEM(MIB_REG_STD, 0xf0, 2),
+	.if_in_ucast_pkts = MIB_ITEM(MIB_REG_STD, 0xe8, 2),
+	.if_in_mcast_pkts = MIB_ITEM(MIB_REG_STD, 0xe0, 2),
+	.if_in_bcast_pkts = MIB_ITEM(MIB_REG_STD, 0xd8, 2),
+	.if_out_ucast_pkts = MIB_ITEM(MIB_REG_STD, 0xd0, 2),
+	.if_out_mcast_pkts = MIB_ITEM(MIB_REG_STD, 0xc8, 2),
+	.if_out_bcast_pkts = MIB_ITEM(MIB_REG_STD, 0xc0, 2),
+	.if_out_discards = MIB_ITEM(MIB_REG_STD, 0xbc, 1),
+	.single_collisions = MIB_ITEM(MIB_REG_STD, 0xb4, 1),
+	.multiple_collisions = MIB_ITEM(MIB_REG_STD, 0xb0, 1),
+	.deferred_transmissions = MIB_ITEM(MIB_REG_STD, 0xac, 1),
+	.late_collisions = MIB_ITEM(MIB_REG_STD, 0xa8, 1),
+	.excessive_collisions = MIB_ITEM(MIB_REG_STD, 0xa4, 1),
+	.crc_align_errors = MIB_ITEM(MIB_REG_STD, 0x80, 1),
+	.rx_pkts_over_max_octets = MIB_ITEM(MIB_REG_PRV, 0x6c, 1),
+
+	.unsupported_opcodes = MIB_ITEM(MIB_REG_STD, 0x9c, 1),
+
+	.rx_undersize_pkts = MIB_ITEM(MIB_REG_STD, 0x78, 1),
+	.rx_oversize_pkts = MIB_ITEM(MIB_REG_STD, 0x70, 1),
+	.rx_fragments = MIB_ITEM(MIB_REG_STD, 0x68, 1),
+	.rx_jabbers = MIB_ITEM(MIB_REG_STD, 0x60, 1),
+
+	.tx_pkts = {
+		MIB_ITEM(MIB_REG_STD, 0x58, 1),
+		MIB_ITEM(MIB_REG_STD, 0x50, 1),
+		MIB_ITEM(MIB_REG_STD, 0x48, 1),
+		MIB_ITEM(MIB_REG_STD, 0x40, 1),
+		MIB_ITEM(MIB_REG_STD, 0x38, 1),
+		MIB_ITEM(MIB_REG_STD, 0x30, 1),
+		MIB_ITEM(MIB_REG_PRV, 0x78, 1),
+		MIB_ITEM(MIB_REG_PRV, 0x70, 1)
+	},
+	.rx_pkts = {
+		MIB_ITEM(MIB_REG_STD, 0x54, 1),
+		MIB_ITEM(MIB_REG_STD, 0x4c, 1),
+		MIB_ITEM(MIB_REG_STD, 0x44, 1),
+		MIB_ITEM(MIB_REG_STD, 0x3c, 1),
+		MIB_ITEM(MIB_REG_STD, 0x34, 1),
+		MIB_ITEM(MIB_REG_STD, 0x2c, 1),
+		MIB_ITEM(MIB_REG_PRV, 0x74, 1),
+		MIB_ITEM(MIB_REG_PRV, 0x6c, 1),
+	},
+	.rmon_ranges = {
+		{ 0, 64 },
+		{ 65, 127 },
+		{ 128, 255 },
+		{ 256, 511 },
+		{ 512, 1023 },
+		{ 1024, 1518 },
+		{ 1519, 12288 },
+		{ 12289, 65535 }
+	},
+
+	.drop_events = MIB_ITEM(MIB_REG_STD, 0x90, 1),
+	.collisions = MIB_ITEM(MIB_REG_STD, 0x5c, 1),
+
+	.rx_pause_frames = MIB_ITEM(MIB_REG_STD, 0x98, 1),
+	.tx_pause_frames = MIB_ITEM(MIB_REG_STD, 0x94, 1),
+
+	.list_count = ARRAY_SIZE(rtldsa_930x_mib_list),
+	.list = rtldsa_930x_mib_list
 };


@ -237,6 +457,7 @@ static int rtl83xx_setup(struct dsa_switch *ds)
 		rtl839x_print_matrix();

 	rtl83xx_init_stats(priv);
+	rtldsa_init_counters(priv);

 	rtl83xx_vlan_setup(priv);

@ -298,9 +519,13 @@ static int rtl93xx_setup(struct dsa_switch *ds)
 	}
 	priv->r->traffic_set(priv->cpu_port, BIT_ULL(priv->cpu_port));

-	rtl930x_print_matrix();
+	if (priv->family_id == RTL9300_FAMILY_ID)
+		rtl930x_print_matrix();
+	else if (priv->family_id == RTL9310_FAMILY_ID)
+		rtl931x_print_matrix();

 	/* TODO: Initialize statistics */
+	rtldsa_init_counters(priv);

 	rtl83xx_vlan_setup(priv);

@ -836,40 +1061,475 @@ static void rtl93xx_phylink_mac_link_up(struct dsa_switch *ds, int port,
 	sw_w32_mask(0, 0x3, priv->r->mac_port_ctrl(port));
 }

-static void rtl83xx_get_strings(struct dsa_switch *ds,
-				int port, u32 stringset, u8 *data)
+static const struct rtldsa_mib_desc *rtldsa_get_mib_desc(struct rtl838x_switch_priv *priv)
 {
-	if (stringset != ETH_SS_STATS)
-		return;
-
-	for (int i = 0; i < ARRAY_SIZE(rtl83xx_mib); i++)
-		ethtool_puts(&data, rtl83xx_mib[i].name);
-}
-
-static void rtl83xx_get_ethtool_stats(struct dsa_switch *ds, int port,
-				      uint64_t *data)
-{
-	struct rtl838x_switch_priv *priv = ds->priv;
-	const struct rtl83xx_mib_desc *mib;
-	u64 h;
-
-	for (int i = 0; i < ARRAY_SIZE(rtl83xx_mib); i++) {
-		mib = &rtl83xx_mib[i];
-
-		data[i] = sw_r32(priv->r->stat_port_std_mib + (port << 8) + 252 - mib->offset);
-		if (mib->size == 2) {
-			h = sw_r32(priv->r->stat_port_std_mib + (port << 8) + 248 - mib->offset);
-			data[i] |= h << 32;
-		}
+	switch (priv->family_id) {
+	case RTL8380_FAMILY_ID:
+		return &rtldsa_838x_mib;
+	case RTL8390_FAMILY_ID:
+		return &rtldsa_839x_mib;
+	case RTL9300_FAMILY_ID:
+		return &rtldsa_930x_mib;
+	default:
+		return NULL;
 	}
 }

-static int rtl83xx_get_sset_count(struct dsa_switch *ds, int port, int sset)
+static bool rtldsa_read_mib_item(struct rtl838x_switch_priv *priv, int port,
+				 const struct rtldsa_mib_item *mib_item,
+				 uint64_t *data)
 {
+	uint32_t high1, high2;
+	int reg, reg_offset, addr_low;
+
+	switch (mib_item->reg) {
+	case MIB_REG_STD:
+		reg = priv->r->stat_port_std_mib;
+		reg_offset = 256;
+		break;
+	case MIB_REG_PRV:
+		reg = priv->r->stat_port_prv_mib;
+		reg_offset = 128;
+		break;
+	default:
+		return false;
+	}
+
+	addr_low = reg + (port + 1) * reg_offset - 4 - mib_item->offset;
+
+	if (mib_item->size == 2) {
+		high1 = sw_r32(addr_low - 4);
+		*data = sw_r32(addr_low);
+		high2 = sw_r32(addr_low - 4);
+		if (high1 != high2) {
+			/* Low must have wrapped and overflowed into high, read again */
+			*data = sw_r32(addr_low);
+		}
+		*data |= (uint64_t)high2 << 32;
+	} else {
+		*data = sw_r32(addr_low);
+	}
+
+	return true;
+}
+
+static void rtldsa_update_counter(struct rtl838x_switch_priv *priv, int port,
+				  struct rtldsa_counter *counter,
+				  const struct rtldsa_mib_item *mib_item)
+{
+	uint64_t val;
+	uint32_t val32, diff;
+
+	if (!rtldsa_read_mib_item(priv, port, mib_item, &val))
+		return;
+
+	if (mib_item->size == 2) {
+		counter->val = val;
+	} else {
+		val32 = (uint32_t)val;
+		diff = val32 - counter->last;
+		counter->val += diff;
+		counter->last = val32;
+	}
+}
+
+static void rtldsa_update_port_counters(struct rtl838x_switch_priv *priv, int port)
+{
+	struct rtldsa_counter_state *counters = &priv->ports[port].counters;
+	const struct rtldsa_mib_desc *mib_desc;
+	ktime_t now;
+
+	mib_desc = rtldsa_get_mib_desc(priv);
+	if (!mib_desc)
+		return;
+
+	/* Prevent unnecessary updates when the user accesses different stats quickly.
+	 * This compensates a bit for always updating all stats, even when just a
+	 * subset is actually requested.
+	 */
+	now = ktime_get();
+	if (ktime_before(now, ktime_add_ms(counters->last_update, 100)))
+		return;
+	counters->last_update = now;
+
+	rtldsa_update_counter(priv, port, &counters->symbol_errors,
+			      &mib_desc->symbol_errors);
+
+	rtldsa_update_counter(priv, port, &counters->if_in_octets,
+			      &mib_desc->if_in_octets);
+	rtldsa_update_counter(priv, port, &counters->if_out_octets,
+			      &mib_desc->if_out_octets);
+	rtldsa_update_counter(priv, port, &counters->if_in_ucast_pkts,
+			      &mib_desc->if_in_ucast_pkts);
+	rtldsa_update_counter(priv, port, &counters->if_in_mcast_pkts,
+			      &mib_desc->if_in_mcast_pkts);
+	rtldsa_update_counter(priv, port, &counters->if_in_bcast_pkts,
+			      &mib_desc->if_in_bcast_pkts);
+	rtldsa_update_counter(priv, port, &counters->if_out_ucast_pkts,
+			      &mib_desc->if_out_ucast_pkts);
+	rtldsa_update_counter(priv, port, &counters->if_out_mcast_pkts,
+			      &mib_desc->if_out_mcast_pkts);
+	rtldsa_update_counter(priv, port, &counters->if_out_bcast_pkts,
+			      &mib_desc->if_out_bcast_pkts);
+	rtldsa_update_counter(priv, port, &counters->if_out_discards,
+			      &mib_desc->if_out_discards);
+	rtldsa_update_counter(priv, port, &counters->single_collisions,
+			      &mib_desc->single_collisions);
+	rtldsa_update_counter(priv, port, &counters->multiple_collisions,
+			      &mib_desc->multiple_collisions);
+	rtldsa_update_counter(priv, port, &counters->deferred_transmissions,
+			      &mib_desc->deferred_transmissions);
+	rtldsa_update_counter(priv, port, &counters->late_collisions,
+			      &mib_desc->late_collisions);
+	rtldsa_update_counter(priv, port, &counters->excessive_collisions,
+			      &mib_desc->excessive_collisions);
+	rtldsa_update_counter(priv, port, &counters->crc_align_errors,
+			      &mib_desc->crc_align_errors);
+	rtldsa_update_counter(priv, port, &counters->rx_pkts_over_max_octets,
+			      &mib_desc->rx_pkts_over_max_octets);
+
+	rtldsa_update_counter(priv, port, &counters->unsupported_opcodes,
+			      &mib_desc->unsupported_opcodes);
+
+	rtldsa_update_counter(priv, port, &counters->rx_undersize_pkts,
+			      &mib_desc->rx_undersize_pkts);
+	rtldsa_update_counter(priv, port, &counters->rx_oversize_pkts,
+			      &mib_desc->rx_oversize_pkts);
+	rtldsa_update_counter(priv, port, &counters->rx_fragments,
+			      &mib_desc->rx_fragments);
+	rtldsa_update_counter(priv, port, &counters->rx_jabbers,
+			      &mib_desc->rx_jabbers);
+
+	for (int i = 0; i < ARRAY_SIZE(mib_desc->tx_pkts); i++) {
+		if (mib_desc->tx_pkts[i].reg == MIB_REG_INVALID)
+			break;
+
+		rtldsa_update_counter(priv, port, &counters->tx_pkts[i],
+				      &mib_desc->tx_pkts[i]);
+	}
+	for (int i = 0; i < ARRAY_SIZE(mib_desc->rx_pkts); i++) {
+		if (mib_desc->rx_pkts[i].reg == MIB_REG_INVALID)
+			break;
+
+		rtldsa_update_counter(priv, port, &counters->rx_pkts[i],
+				      &mib_desc->rx_pkts[i]);
+	}
+
+	rtldsa_update_counter(priv, port, &counters->drop_events,
+			      &mib_desc->drop_events);
+	rtldsa_update_counter(priv, port, &counters->collisions,
+			      &mib_desc->collisions);
+
+	rtldsa_update_counter(priv, port, &counters->rx_pause_frames,
+			      &mib_desc->rx_pause_frames);
+	rtldsa_update_counter(priv, port, &counters->tx_pause_frames,
+			      &mib_desc->tx_pause_frames);
+}
+
+static void rtldsa_poll_counters(struct work_struct *work)
+{
+	struct rtl838x_switch_priv *priv = container_of(to_delayed_work(work),
+							struct rtl838x_switch_priv,
+							counters_work);
+	struct rtldsa_counter_state *counters;
+
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (!priv->ports[i].phy)
+			continue;
+
+		counters = &priv->ports[i].counters;
+
+		spin_lock(&counters->lock);
+		rtldsa_update_port_counters(priv, i);
+		spin_unlock(&counters->lock);
+	}
+
+	schedule_delayed_work(&priv->counters_work, RTLDSA_COUNTERS_POLL_INTERVAL);
+}
+
+static void rtldsa_init_counters(struct rtl838x_switch_priv *priv)
+{
+	struct rtldsa_counter_state *counters;
+
+	for (int i = 0; i < priv->cpu_port; i++) {
+		if (!priv->ports[i].phy)
+			continue;
+
+		counters = &priv->ports[i].counters;
+
+		memset(counters, 0, sizeof(*counters));
+		spin_lock_init(&counters->lock);
+	}
+
+	INIT_DELAYED_WORK(&priv->counters_work, rtldsa_poll_counters);
+	schedule_delayed_work(&priv->counters_work, RTLDSA_COUNTERS_POLL_INTERVAL);
+}
+
+static void rtldsa_get_strings(struct dsa_switch *ds,
+			       int port, u32 stringset, u8 *data)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	const struct rtldsa_mib_desc *mib_desc;
+
+	if (stringset != ETH_SS_STATS)
+		return;
+
+	if (port < 0 || port >= priv->cpu_port)
+		return;
+
+	mib_desc = rtldsa_get_mib_desc(priv);
+	if (!mib_desc)
+		return;
+
+	for (int i = 0; i < mib_desc->list_count; i++)
+		ethtool_puts(&data, mib_desc->list[i].name);
+}
+
+static void rtldsa_get_ethtool_stats(struct dsa_switch *ds, int port,
+				     uint64_t *data)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	const struct rtldsa_mib_desc *mib_desc;
+	const struct rtldsa_mib_item *mib_item;
+
+	if (port < 0 || port >= priv->cpu_port)
+		return;
+
+	mib_desc = rtldsa_get_mib_desc(priv);
+	if (!mib_desc)
+		return;
+
+	for (int i = 0; i < mib_desc->list_count; i++) {
+		mib_item = &mib_desc->list[i].item;
+		rtldsa_read_mib_item(priv, port, mib_item, &data[i]);
+	}
+}
+
+static int rtldsa_get_sset_count(struct dsa_switch *ds, int port, int sset)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	const struct rtldsa_mib_desc *mib_desc;
+
 	if (sset != ETH_SS_STATS)
 		return 0;

-	return ARRAY_SIZE(rtl83xx_mib);
+	if (port < 0 || port >= priv->cpu_port)
+		return 0;
+
+	mib_desc = rtldsa_get_mib_desc(priv);
+	if (!mib_desc)
+		return 0;
+
+	return mib_desc->list_count;
+}
+
+
+static void rtldsa_get_eth_phy_stats(struct dsa_switch *ds, int port,
+				     struct ethtool_eth_phy_stats *phy_stats)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	struct rtldsa_counter_state *counters = &priv->ports[port].counters;
+
+	if (port < 0 || port >= priv->cpu_port)
+		return;
+
+	if (!rtldsa_get_mib_desc(priv))
+		return;
+
+	spin_lock(&counters->lock);
+
+	rtldsa_update_port_counters(priv, port);
+
+	phy_stats->SymbolErrorDuringCarrier = counters->symbol_errors.val;
+
+	spin_unlock(&counters->lock);
+}
+
+static void rtldsa_get_eth_mac_stats(struct dsa_switch *ds, int port,
+				     struct ethtool_eth_mac_stats *mac_stats)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	struct rtldsa_counter_state *counters = &priv->ports[port].counters;
+
+	if (port < 0 || port >= priv->cpu_port)
+		return;
+
+	if (!rtldsa_get_mib_desc(priv))
+		return;
+
+	spin_lock(&counters->lock);
+
+	rtldsa_update_port_counters(priv, port);
+
+	/* Frame and octet counters are calculated based on RFC3635, while also
+	 * taking into account that the behaviour of the hardware counters differs
+	 * in some places.
+	 */
+
+	mac_stats->FramesReceivedOK = counters->if_in_ucast_pkts.val +
+				      counters->if_in_mcast_pkts.val +
+				      counters->if_in_bcast_pkts.val +
+				      counters->rx_pause_frames.val +
+				      counters->rx_pkts_over_max_octets.val;
+
+	mac_stats->FramesTransmittedOK = counters->if_out_ucast_pkts.val +
+					 counters->if_out_mcast_pkts.val +
+					 counters->if_out_bcast_pkts.val +
+					 counters->tx_pause_frames.val -
+					 counters->if_out_discards.val;
+
+	mac_stats->OctetsReceivedOK = counters->if_in_octets.val -
+				      18 * mac_stats->FramesReceivedOK;
+	mac_stats->OctetsTransmittedOK = counters->if_out_octets.val -
+				         18 * mac_stats->FramesTransmittedOK;
+
+	mac_stats->SingleCollisionFrames = counters->single_collisions.val;
+	mac_stats->MultipleCollisionFrames = counters->multiple_collisions.val;
+	mac_stats->FramesWithDeferredXmissions = counters->deferred_transmissions.val;
+	mac_stats->LateCollisions = counters->late_collisions.val;
+	mac_stats->FramesAbortedDueToXSColls = counters->excessive_collisions.val;
+
+	mac_stats->FrameCheckSequenceErrors = counters->crc_align_errors.val;
+
+	spin_unlock(&counters->lock);
+}
+
+static void rtldsa_get_eth_ctrl_stats(struct dsa_switch *ds, int port,
+				      struct ethtool_eth_ctrl_stats *ctrl_stats)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	struct rtldsa_counter_state *counters = &priv->ports[port].counters;
+
+	if (port < 0 || port >= priv->cpu_port)
+		return;
+
+	if (!rtldsa_get_mib_desc(priv))
+		return;
+
+	spin_lock(&counters->lock);
+
+	rtldsa_update_port_counters(priv, port);
+
+	ctrl_stats->UnsupportedOpcodesReceived = counters->unsupported_opcodes.val;
+
+	spin_unlock(&counters->lock);
+}
+
+static void rtldsa_get_rmon_stats(struct dsa_switch *ds, int port,
+				  struct ethtool_rmon_stats *rmon_stats,
+				  const struct ethtool_rmon_hist_range **ranges)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	const struct rtldsa_mib_desc *mib_desc;
+	struct rtldsa_counter_state *counters = &priv->ports[port].counters;
+
+	if (port < 0 || port >= priv->cpu_port)
+		return;
+
+	mib_desc = rtldsa_get_mib_desc(priv);
+	if (!mib_desc)
+		return;
+
+	spin_lock(&counters->lock);
+
+	rtldsa_update_port_counters(priv, port);
+
+	rmon_stats->undersize_pkts = counters->rx_undersize_pkts.val;
+	rmon_stats->oversize_pkts = counters->rx_oversize_pkts.val;
+	rmon_stats->fragments = counters->rx_fragments.val;
+	rmon_stats->jabbers = counters->rx_jabbers.val;
+
+	for (int i = 0; i < ARRAY_SIZE(mib_desc->rx_pkts); i++) {
+		if (mib_desc->rx_pkts[i].reg == MIB_REG_INVALID)
+			break;
+
+		rmon_stats->hist[i] = counters->rx_pkts[i].val;
+	}
+
+
+	for (int i = 0; i < ARRAY_SIZE(mib_desc->tx_pkts); i++) {
+		if (mib_desc->tx_pkts[i].reg == MIB_REG_INVALID)
+			break;
+
+		rmon_stats->hist_tx[i] = counters->tx_pkts[i].val;
+	}
+
+	*ranges = mib_desc->rmon_ranges;
+
+	spin_unlock(&counters->lock);
+}
+
+static void rtldsa_get_stats64(struct dsa_switch *ds, int port,
+			       struct rtnl_link_stats64 *s)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	struct rtldsa_counter_state *counters = &priv->ports[port].counters;
+
+	if (port < 0 || port >= priv->cpu_port)
+		return;
+
+	if (!rtldsa_get_mib_desc(priv)) {
+		dev_get_tstats64(dsa_to_port(ds, port)->user, s);
+		return;
+	}
+
+	spin_lock(&counters->lock);
+
+	rtldsa_update_port_counters(priv, port);
+
+	s->rx_packets = counters->if_in_ucast_pkts.val +
+			counters->if_in_mcast_pkts.val +
+			counters->if_in_bcast_pkts.val +
+			counters->rx_pkts_over_max_octets.val;
+
+	s->tx_packets = counters->if_out_ucast_pkts.val +
+			counters->if_out_mcast_pkts.val +
+			counters->if_out_bcast_pkts.val -
+			counters->if_out_discards.val;
+
+	/* Subtract FCS for each packet, and pause frames */
+	s->rx_bytes = counters->if_in_octets.val -
+		      4 * s->rx_packets -
+		      64 * counters->rx_pause_frames.val;
+	s->tx_bytes = counters->if_out_octets.val -
+		      4 * s->tx_packets -
+		      64 * counters->tx_pause_frames.val;
+
+	s->collisions = counters->collisions.val;
+
+	s->rx_dropped = counters->drop_events.val;
+	s->tx_dropped = counters->if_out_discards.val;
+
+	s->rx_crc_errors = counters->crc_align_errors.val;
+	s->rx_errors = s->rx_crc_errors;
+
+	s->tx_aborted_errors = counters->excessive_collisions.val;
+	s->tx_window_errors = counters->late_collisions.val;
+	s->tx_errors = s->tx_aborted_errors + s->tx_window_errors;
+
+	spin_unlock(&counters->lock);
+}
+
+static void rtldsa_get_pause_stats(struct dsa_switch *ds, int port,
+				   struct ethtool_pause_stats *pause_stats)
+{
+	struct rtl838x_switch_priv *priv = ds->priv;
+	struct rtldsa_counter_state *counters = &priv->ports[port].counters;
+
+	if (port < 0 || port >= priv->cpu_port)
+		return;
+
+	if (!rtldsa_get_mib_desc(priv))
+		return;
+
+	spin_lock(&counters->lock);
+
+	rtldsa_update_port_counters(priv, port);
+
+	pause_stats->tx_pause_frames = counters->tx_pause_frames.val;
+	pause_stats->rx_pause_frames = counters->rx_pause_frames.val;
+
+	spin_unlock(&counters->lock);
 }

 static int rtl83xx_mc_group_alloc(struct rtl838x_switch_priv *priv, int port)
@ -2014,39 +2674,18 @@ out:
 	return 0;
 }

-static int rtl83xx_dsa_phy_read(struct dsa_switch *ds, int phy_addr, int phy_reg)
+static int rtldsa_phy_read(struct dsa_switch *ds, int addr, int regnum)
 {
-	u32 val;
-	u32 offset = 0;
 	struct rtl838x_switch_priv *priv = ds->priv;

-	if ((phy_addr >= 24) &&
-	    (phy_addr <= 27) &&
-	    (priv->ports[24].phy == PHY_RTL838X_SDS)) {
-		if (phy_addr == 26)
-			offset = 0x100;
-		val = sw_r32(RTL838X_SDS4_FIB_REG0 + offset + (phy_reg << 2)) & 0xffff;
-		return val;
-	}
-
-	read_phy(phy_addr, 0, phy_reg, &val);
-	return val;
+	return mdiobus_read_nested(priv->parent_bus, addr, regnum);
 }

-static int rtl83xx_dsa_phy_write(struct dsa_switch *ds, int phy_addr, int phy_reg, u16 val)
+static int rtldsa_phy_write(struct dsa_switch *ds, int addr, int regnum, u16 val)
 {
-	u32 offset = 0;
 	struct rtl838x_switch_priv *priv = ds->priv;

-	if ((phy_addr >= 24) &&
-	    (phy_addr <= 27) &&
-	    (priv->ports[24].phy == PHY_RTL838X_SDS)) {
-		if (phy_addr == 26)
-			offset = 0x100;
-		sw_w32(val, RTL838X_SDS4_FIB_REG0 + offset + (phy_reg << 2));
-		return 0;
-	}
-	return write_phy(phy_addr, 0, phy_reg, val);
+	return mdiobus_write_nested(priv->parent_bus, addr, regnum, val);
 }

 const struct phylink_pcs_ops rtl83xx_pcs_ops = {
@ -2059,8 +2698,8 @@ const struct dsa_switch_ops rtl83xx_switch_ops = {
 	.get_tag_protocol	= rtl83xx_get_tag_protocol,
 	.setup			= rtl83xx_setup,

-	.phy_read		= rtl83xx_dsa_phy_read,
-	.phy_write		= rtl83xx_dsa_phy_write,
+	.phy_read		= rtldsa_phy_read,
+	.phy_write		= rtldsa_phy_write,

 	.phylink_get_caps	= rtldsa_phylink_get_caps,
 	.phylink_mac_config	= rtl83xx_phylink_mac_config,
@ -2068,9 +2707,15 @@ const struct dsa_switch_ops rtl83xx_switch_ops = {
 	.phylink_mac_link_up	= rtl83xx_phylink_mac_link_up,
 	.phylink_mac_select_pcs	= rtl83xx_phylink_mac_select_pcs,

-	.get_strings		= rtl83xx_get_strings,
-	.get_ethtool_stats	= rtl83xx_get_ethtool_stats,
-	.get_sset_count		= rtl83xx_get_sset_count,
+	.get_strings		= rtldsa_get_strings,
+	.get_ethtool_stats	= rtldsa_get_ethtool_stats,
+	.get_sset_count		= rtldsa_get_sset_count,
+	.get_eth_phy_stats	= rtldsa_get_eth_phy_stats,
+	.get_eth_mac_stats	= rtldsa_get_eth_mac_stats,
+	.get_eth_ctrl_stats	= rtldsa_get_eth_ctrl_stats,
+	.get_rmon_stats		= rtldsa_get_rmon_stats,
+	.get_stats64		= rtldsa_get_stats64,
+	.get_pause_stats	= rtldsa_get_pause_stats,

 	.port_enable		= rtl83xx_port_enable,
 	.port_disable		= rtl83xx_port_disable,
@ -2116,8 +2761,8 @@ const struct dsa_switch_ops rtl930x_switch_ops = {
 	.get_tag_protocol	= rtl83xx_get_tag_protocol,
 	.setup			= rtl93xx_setup,

-	.phy_read		= rtl83xx_dsa_phy_read,
-	.phy_write		= rtl83xx_dsa_phy_write,
+	.phy_read		= rtldsa_phy_read,
+	.phy_write		= rtldsa_phy_write,

 	.phylink_get_caps	= rtldsa_phylink_get_caps,
 	.phylink_mac_config	= rtl93xx_phylink_mac_config,
@ -2125,9 +2770,15 @@ const struct dsa_switch_ops rtl930x_switch_ops = {
 	.phylink_mac_link_up	= rtl93xx_phylink_mac_link_up,
 	.phylink_mac_select_pcs	= rtl83xx_phylink_mac_select_pcs,

-	.get_strings		= rtl83xx_get_strings,
-	.get_ethtool_stats	= rtl83xx_get_ethtool_stats,
-	.get_sset_count		= rtl83xx_get_sset_count,
+	.get_strings		= rtldsa_get_strings,
+	.get_ethtool_stats	= rtldsa_get_ethtool_stats,
+	.get_sset_count		= rtldsa_get_sset_count,
+	.get_eth_phy_stats	= rtldsa_get_eth_phy_stats,
+	.get_eth_mac_stats	= rtldsa_get_eth_mac_stats,
+	.get_eth_ctrl_stats	= rtldsa_get_eth_ctrl_stats,
+	.get_rmon_stats		= rtldsa_get_rmon_stats,
+	.get_stats64		= rtldsa_get_stats64,
+	.get_pause_stats	= rtldsa_get_pause_stats,

 	.port_enable		= rtl83xx_port_enable,
 	.port_disable		= rtl83xx_port_disable,
--- a/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/rtl838x.h
+++ b/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/rtl838x.h
@ -34,6 +34,7 @@
 #define RTL838X_STAT_PORT_STD_MIB		(0x1200)
 #define RTL839X_STAT_PORT_STD_MIB		(0xC000)
 #define RTL930X_STAT_PORT_MIB_CNTR		(0x0664)
+#define RTL930X_STAT_PORT_PRVTE_CNTR		(0x2364)
 #define RTL838X_STAT_RST			(0x3100)
 #define RTL839X_STAT_RST			(0xF504)
 #define RTL930X_STAT_RST			(0x3240)
@ -638,6 +639,51 @@ enum pbvlan_mode {
 	PBVLAN_MODE_ALL_PKT,
 };

+struct rtldsa_counter {
+	uint64_t val;
+	uint32_t last;
+};
+
+struct rtldsa_counter_state {
+	spinlock_t lock;
+	ktime_t last_update;
+
+	struct rtldsa_counter symbol_errors;
+
+	struct rtldsa_counter if_in_octets;
+	struct rtldsa_counter if_out_octets;
+	struct rtldsa_counter if_in_ucast_pkts;
+	struct rtldsa_counter if_in_mcast_pkts;
+	struct rtldsa_counter if_in_bcast_pkts;
+	struct rtldsa_counter if_out_ucast_pkts;
+	struct rtldsa_counter if_out_mcast_pkts;
+	struct rtldsa_counter if_out_bcast_pkts;
+	struct rtldsa_counter if_out_discards;
+	struct rtldsa_counter single_collisions;
+	struct rtldsa_counter multiple_collisions;
+	struct rtldsa_counter deferred_transmissions;
+	struct rtldsa_counter late_collisions;
+	struct rtldsa_counter excessive_collisions;
+	struct rtldsa_counter crc_align_errors;
+	struct rtldsa_counter rx_pkts_over_max_octets;
+
+	struct rtldsa_counter unsupported_opcodes;
+
+	struct rtldsa_counter rx_undersize_pkts;
+	struct rtldsa_counter rx_oversize_pkts;
+	struct rtldsa_counter rx_fragments;
+	struct rtldsa_counter rx_jabbers;
+
+	struct rtldsa_counter tx_pkts[ETHTOOL_RMON_HIST_MAX];
+	struct rtldsa_counter rx_pkts[ETHTOOL_RMON_HIST_MAX];
+
+	struct rtldsa_counter drop_events;
+	struct rtldsa_counter collisions;
+
+	struct rtldsa_counter rx_pause_frames;
+	struct rtldsa_counter tx_pause_frames;
+};
+
 struct rtl838x_port {
 	bool enable;
 	u64 pm;
@ -650,6 +696,7 @@ struct rtl838x_port {
 	int sds_num;
 	int led_set;
 	int leds_on_this_port;
+	struct rtldsa_counter_state counters;
 	const struct dsa_port *dp;
 };

@ -981,6 +1028,7 @@ struct rtl838x_reg {
 	int stat_port_rst;
 	int stat_rst;
 	int stat_port_std_mib;
+	int stat_port_prv_mib;
 	int (*port_iso_ctrl)(int p);
 	void (*traffic_enable)(int source, int dest);
 	void (*traffic_disable)(int source, int dest);
@ -1114,6 +1162,7 @@ struct rtl838x_switch_priv {
 	struct rtl838x_l3_intf *interfaces[MAX_INTERFACES];
 	u16 intf_mtus[MAX_INTF_MTUS];
 	int intf_mtu_count[MAX_INTF_MTUS];
+	struct delayed_work counters_work;
 };

 void rtl838x_dbgfs_init(struct rtl838x_switch_priv *priv);
--- a/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/rtl83xx.h
+++ b/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/rtl83xx.h
@ -17,11 +17,68 @@ struct fdb_update_work {
 	u64 macs[];
 };

-#define MIB_DESC(_size, _offset, _name) {.size = _size, .offset = _offset, .name = _name}
-struct rtl83xx_mib_desc {
-	unsigned int size;
+enum mib_reg {
+	MIB_REG_INVALID = 0,
+	MIB_REG_STD,
+	MIB_REG_PRV
+};
+
+#define MIB_ITEM(_reg, _offset, _size) \
+		{.reg = _reg, .offset = _offset, .size = _size}
+
+#define MIB_LIST_ITEM(_name, _item) \
+		{.name = _name, .item = _item}
+
+struct rtldsa_mib_item {
+	enum mib_reg reg;
 	unsigned int offset;
+	unsigned int size;
+};
+
+struct rtldsa_mib_list_item {
 	const char *name;
+	struct rtldsa_mib_item item;
+};
+
+struct rtldsa_mib_desc {
+	struct rtldsa_mib_item symbol_errors;
+
+	struct rtldsa_mib_item if_in_octets;
+	struct rtldsa_mib_item if_out_octets;
+	struct rtldsa_mib_item if_in_ucast_pkts;
+	struct rtldsa_mib_item if_in_mcast_pkts;
+	struct rtldsa_mib_item if_in_bcast_pkts;
+	struct rtldsa_mib_item if_out_ucast_pkts;
+	struct rtldsa_mib_item if_out_mcast_pkts;
+	struct rtldsa_mib_item if_out_bcast_pkts;
+	struct rtldsa_mib_item if_out_discards;
+	struct rtldsa_mib_item single_collisions;
+	struct rtldsa_mib_item multiple_collisions;
+	struct rtldsa_mib_item deferred_transmissions;
+	struct rtldsa_mib_item late_collisions;
+	struct rtldsa_mib_item excessive_collisions;
+	struct rtldsa_mib_item crc_align_errors;
+	struct rtldsa_mib_item rx_pkts_over_max_octets;
+
+	struct rtldsa_mib_item unsupported_opcodes;
+
+	struct rtldsa_mib_item rx_undersize_pkts;
+	struct rtldsa_mib_item rx_oversize_pkts;
+	struct rtldsa_mib_item rx_fragments;
+	struct rtldsa_mib_item rx_jabbers;
+
+	struct rtldsa_mib_item tx_pkts[ETHTOOL_RMON_HIST_MAX];
+	struct rtldsa_mib_item rx_pkts[ETHTOOL_RMON_HIST_MAX];
+	struct ethtool_rmon_hist_range rmon_ranges[ETHTOOL_RMON_HIST_MAX];
+
+	struct rtldsa_mib_item drop_events;
+	struct rtldsa_mib_item collisions;
+
+	struct rtldsa_mib_item rx_pause_frames;
+	struct rtldsa_mib_item tx_pause_frames;
+
+	size_t list_count;
+	const struct rtldsa_mib_list_item *list;
 };

 /* API for switch table access */
@ -82,9 +139,6 @@ int rtl83xx_port_is_under(const struct net_device * dev, struct rtl838x_switch_p
 void rtl83xx_port_stp_state_set(struct dsa_switch *ds, int port, u8 state);
 int rtl83xx_setup_tc(struct net_device *dev, enum tc_setup_type type, void *type_data);

-int read_phy(u32 port, u32 page, u32 reg, u32 *val);
-int write_phy(u32 port, u32 page, u32 reg, u32 val);
-
 /* Port register accessor functions for the RTL839x and RTL931X SoCs */
 void rtl839x_mask_port_reg_be(u64 clear, u64 set, int reg);
 u32 rtl839x_get_egress_rate(struct rtl838x_switch_priv *priv, int port);
@ -133,15 +187,13 @@ irqreturn_t rtl931x_switch_irq(int irq, void *dev_id);
 int rtl931x_sds_cmu_band_get(int sds, phy_interface_t mode);
 int rtl931x_sds_cmu_band_set(int sds, bool enable, u32 band, phy_interface_t mode);
 extern void rtl931x_sds_init(u32 sds, phy_interface_t mode);
+void rtl931x_print_matrix(void);

 int rtl83xx_lag_add(struct dsa_switch *ds, int group, int port, struct netdev_lag_upper_info *info);
 int rtl83xx_lag_del(struct dsa_switch *ds, int group, int port);

 /* phy functions that will need to be moved to the future mdio driver */

-int rtl838x_read_mmd_phy(u32 port, u32 addr, u32 reg, u32 *val);
-int rtl838x_write_mmd_phy(u32 port, u32 addr, u32 reg, u32 val);
-
 int rtl839x_read_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 *val);
 int rtl839x_write_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 val);

--- a/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/rtl930x.c
+++ b/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/rtl930x.c
@ -2439,6 +2439,7 @@ const struct rtl838x_reg rtl930x_reg = {
 	.stat_port_rst = RTL930X_STAT_PORT_RST,
 	.stat_rst = RTL930X_STAT_RST,
 	.stat_port_std_mib = RTL930X_STAT_PORT_MIB_CNTR,
+	.stat_port_prv_mib = RTL930X_STAT_PORT_PRVTE_CNTR,
 	.traffic_enable = rtl930x_traffic_enable,
 	.traffic_disable = rtl930x_traffic_disable,
 	.traffic_get = rtl930x_traffic_get,
--- a/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/rtl931x.c
+++ b/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/rtl931x.c
@ -464,12 +464,14 @@ int rtl931x_write_mmd_phy(u32 port, u32 devnum, u32 regnum, u32 val)

 void rtl931x_print_matrix(void)
 {
-	volatile u64 *ptr = RTL838X_SW_BASE + RTL839X_PORT_ISO_CTRL(0);
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_2, 1);

-	for (int i = 0; i < 52; i += 4)
-		pr_debug("> %16llx %16llx %16llx %16llx\n",
-			ptr[i + 0], ptr[i + 1], ptr[i + 2], ptr[i + 3]);
-	pr_debug("CPU_PORT> %16llx\n", ptr[52]);
+	for (int i = 0; i < 64; i++) {
+		rtl_table_read(r, i);
+		pr_info("> %08x %08x\n", sw_r32(rtl_table_data(r, 0)),
+			sw_r32(rtl_table_data(r, 1)));
+	}
+	rtl_table_release(r);
 }

 void rtl931x_set_receive_management_action(int port, rma_ctrl_t type, action_type_t action)
@ -530,13 +532,15 @@ void rtl931x_set_receive_management_action(int port, rma_ctrl_t type, action_typ

 static u64 rtl931x_traffic_get(int source)
 {
-	u32 v;
-	struct table_reg *r = rtl_table_get(RTL9310_TBL_0, 6);
+	u64 v;
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_2, 1);

 	rtl_table_read(r, source);
 	v = sw_r32(rtl_table_data(r, 0));
+	v <<= 32;
+	v |= sw_r32(rtl_table_data(r, 1));
+	v >>= 7;
 	rtl_table_release(r);
-	v = v >> 3;

 	return v;
 }
@ -544,27 +548,28 @@ static u64 rtl931x_traffic_get(int source)
 /* Enable traffic between a source port and a destination port matrix */
 static void rtl931x_traffic_set(int source, u64 dest_matrix)
 {
-	struct table_reg *r = rtl_table_get(RTL9310_TBL_0, 6);
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_2, 1);

-	sw_w32((dest_matrix << 3), rtl_table_data(r, 0));
+	sw_w32(dest_matrix >> (32 - 7), rtl_table_data(r, 0));
+	sw_w32(dest_matrix << 7, rtl_table_data(r, 1));
 	rtl_table_write(r, source);
 	rtl_table_release(r);
 }

 static void rtl931x_traffic_enable(int source, int dest)
 {
-	struct table_reg *r = rtl_table_get(RTL9310_TBL_0, 6);
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_2, 1);
 	rtl_table_read(r, source);
-	sw_w32_mask(0, BIT(dest + 3), rtl_table_data(r, 0));
+	sw_w32_mask(0, BIT((dest + 7) % 32), rtl_table_data(r, (dest + 7) / 32 ? 0 : 1));
 	rtl_table_write(r, source);
 	rtl_table_release(r);
 }

 static void rtl931x_traffic_disable(int source, int dest)
 {
-	struct table_reg *r = rtl_table_get(RTL9310_TBL_0, 6);
+	struct table_reg *r = rtl_table_get(RTL9310_TBL_2, 1);
 	rtl_table_read(r, source);
-	sw_w32_mask(BIT(dest + 3), 0, rtl_table_data(r, 0));
+	sw_w32_mask(BIT((dest + 7) % 32), 0, rtl_table_data(r, (dest + 7) / 32 ? 0 : 1));
 	rtl_table_write(r, source);
 	rtl_table_release(r);
 }
--- a/target/linux/realtek/files-6.12/drivers/net/phy/rtl83xx-phy.c
+++ b/target/linux/realtek/files-6.12/drivers/net/phy/rtl83xx-phy.c
@ -120,7 +120,10 @@ static u64 disable_polling(int port)
 		sw_w32_mask(BIT(port), 0, RTL930X_SMI_POLL_CTRL);
 		break;
 	case RTL9310_FAMILY_ID:
-		pr_warn("%s not implemented for RTL931X\n", __func__);
+		saved_state = sw_r32(RTL931X_SMI_PORT_POLLING_CTRL + 4);
+		saved_state <<= 32;
+		saved_state |= sw_r32(RTL931X_SMI_PORT_POLLING_CTRL);
+		sw_w32_mask(BIT(port % 32), 0, RTL931X_SMI_PORT_POLLING_CTRL + ((port >> 5) << 2));
 		break;
 	}

@ -145,7 +148,8 @@ static int resume_polling(u64 saved_state)
 		sw_w32(saved_state, RTL930X_SMI_POLL_CTRL);
 		break;
 	case RTL9310_FAMILY_ID:
-		pr_warn("%s not implemented for RTL931X\n", __func__);
+		sw_w32(saved_state >> 32, RTL931X_SMI_PORT_POLLING_CTRL + 4);
+		sw_w32(saved_state, RTL931X_SMI_PORT_POLLING_CTRL);
 		break;
 	}

@ -1707,9 +1711,11 @@ static int rtsds_930x_get_internal_mode(int sds)

 static void rtsds_930x_set_power(int sds, bool on)
 {
-	int power = on ? 0 : 3;
+	int power_down = on ? 0x0 : 0x3;
+	int rx_enable = on ? 0x3 : 0x1;

-	rtl9300_sds_field_w(sds, 0x20, 0x00, 7, 6, power);
+	rtl9300_sds_field_w(sds, 0x20, 0x00, 7, 6, power_down);
+	rtl9300_sds_field_w(sds, 0x20, 0x00, 5, 4, rx_enable);
 }

 static int rtsds_930x_config_pll(int sds, phy_interface_t interface)
@ -3048,7 +3054,7 @@ static void rtl9310_sds_field_w(int sds, u32 page, u32 reg, int end_bit, int sta
 	if (l < 32) {
 		u32 mask = BIT(l) - 1;

-		data = rtl930x_read_sds_phy(sds, page, reg);
+		data = rtl931x_read_sds_phy(sds, page, reg);
 		data &= ~(mask << start_bit);
 		data |= (v & mask) << start_bit;
 	}
--- a/target/linux/realtek/image/Makefile
+++ b/target/linux/realtek/image/Makefile
@ -119,6 +119,19 @@ define Device/Default
 	append-metadata
 endef

+define Device/kernel-lzma
+  KERNEL := \
+	kernel-bin | \
+	append-dtb | \
+	lzma | \
+	uImage lzma
+  KERNEL_INITRAMFS := \
+	kernel-bin | \
+	append-dtb | \
+	lzma | \
+	uImage lzma
+endef
+
 define Device/uimage-rt-loader
 	KERNEL/rt-loader := kernel-bin | append-dtb | rt-compress | rt-loader
 	KERNEL := $$(KERNEL/rt-loader) | uImage none
--- a/target/linux/realtek/image/rtl930x.mk
+++ b/target/linux/realtek/image/rtl930x.mk
@ -5,6 +5,19 @@ define Build/xikestor-nosimg
  mv $@.new $@
 endef

+define Device/hasivo_s1100w-8xgt-se
+  SOC := rtl9303
+  DEVICE_VENDOR := Hasivo
+  DEVICE_MODEL := S1100W-8XGT-SE
+  IMAGE_SIZE := 12288k
+  KERNEL_INITRAMFS := \
+	kernel-bin | \
+	append-dtb | \
+	lzma | \
+	uImage lzma
+endef
+TARGET_DEVICES += hasivo_s1100w-8xgt-se
+
 define Device/tplink_tl-st1008f_v2
  SOC := rtl9303
  UIMAGE_MAGIC := 0x93030000
@ -16,6 +29,16 @@ define Device/tplink_tl-st1008f_v2
 endef
 TARGET_DEVICES += tplink_tl-st1008f_v2

+define Device/vimin_vm-s100-0800ms
+  SOC := rtl9303
+  UIMAGE_MAGIC := 0x93000000
+  DEVICE_VENDOR := Vimin
+  DEVICE_MODEL := VM-S100-0800MS
+  IMAGE_SIZE := 13312k
+  $(Device/kernel-lzma)
+endef
+TARGET_DEVICES += vimin_vm-s100-0800ms
+
 define Device/xikestor_sks8300-8x
  SOC := rtl9303
  DEVICE_VENDOR := XikeStor
--- a/target/linux/realtek/patches-6.12/001-v6.13-spi-mem-add-realtek-nand-controller.patch
+++ b/target/linux/realtek/patches-6.12/001-v6.13-spi-mem-add-realtek-nand-controller.patch
@ -0,0 +1,481 @@
+From 42d20a6a61b8fccbb57d80df1ccde7dd82d5bbd6 Mon Sep 17 00:00:00 2001
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Wed, 16 Oct 2024 11:54:34 +1300
+Subject: [PATCH] spi: spi-mem: Add Realtek SPI-NAND controller
+
+Add a driver for the SPI-NAND controller on the RTL9300 family of
+devices.
+
+The controller supports
+* Serial/Dual/Quad data with
+* PIO and DMA data read/write operation
+* Configurable flash access timing
+
+There is a separate ECC controller on the RTL9300 which isn't currently
+supported (instead we rely on the on-die ECC supported by most SPI-NAND
+chips).
+
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Link: https://patch.msgid.link/20241015225434.3970360-4-chris.packham@alliedtelesis.co.nz
+Signed-off-by: Mark Brown <broonie@kernel.org>
+---
+ MAINTAINERS                         |   6 +
+ drivers/spi/Kconfig                 |  11 +
+ drivers/spi/Makefile                |   1 +
+ drivers/spi/spi-realtek-rtl-snand.c | 405 ++++++++++++++++++++++++++++
+ 4 files changed, 423 insertions(+)
+ create mode 100644 drivers/spi/spi-realtek-rtl-snand.c
+
+--- a/MAINTAINERS
+++ b/MAINTAINERS
+@@ -19494,6 +19494,12 @@ S:	Maintained
+ F:	Documentation/devicetree/bindings/net/dsa/realtek.yaml
+ F:	drivers/net/dsa/realtek/*
+ 
+REALTEK SPI-NAND
+M:	Chris Packham <chris.packham@alliedtelesis.co.nz>
+S:	Maintained
+F:	Documentation/devicetree/bindings/spi/realtek,rtl9301-snand.yaml
+F:	drivers/spi/spi-realtek-rtl-snand.c
+
+ REALTEK WIRELESS DRIVER (rtlwifi family)
+ M:	Ping-Ke Shih <pkshih@realtek.com>
+ L:	linux-wireless@vger.kernel.org
+--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
+@@ -843,6 +843,17 @@ config SPI_PXA2XX
+ config SPI_PXA2XX_PCI
+ 	def_tristate SPI_PXA2XX && PCI && COMMON_CLK
+ 
+config SPI_REALTEK_SNAND
+	tristate "Realtek SPI-NAND Flash Controller"
+	depends on MACH_REALTEK_RTL || COMPILE_TEST
+	select REGMAP
+	help
+	  This enables support for the SPI-NAND Flash controller on
+	  Realtek SoCs.
+
+	  This driver does not support generic SPI. The implementation
+	  only supports the spi-mem interface.
+
+ config SPI_ROCKCHIP
+ 	tristate "Rockchip SPI controller driver"
+ 	depends on ARCH_ROCKCHIP || COMPILE_TEST
+--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
+@@ -120,6 +120,7 @@ obj-$(CONFIG_SPI_ROCKCHIP)		+= spi-rockc
+ obj-$(CONFIG_SPI_ROCKCHIP_SFC)		+= spi-rockchip-sfc.o
+ obj-$(CONFIG_SPI_RB4XX)			+= spi-rb4xx.o
+ obj-$(CONFIG_MACH_REALTEK_RTL)		+= spi-realtek-rtl.o
+obj-$(CONFIG_SPI_REALTEK_SNAND)		+= spi-realtek-rtl-snand.o
+ obj-$(CONFIG_SPI_RPCIF)			+= spi-rpc-if.o
+ obj-$(CONFIG_SPI_RSPI)			+= spi-rspi.o
+ obj-$(CONFIG_SPI_RZV2M_CSI)		+= spi-rzv2m-csi.o
+--- /dev/null
+++ b/drivers/spi/spi-realtek-rtl-snand.c
+@@ -0,0 +1,405 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+#include <linux/completion.h>
+#include <linux/dma-mapping.h>
+#include <linux/interrupt.h>
+#include <linux/mod_devicetable.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+#include <linux/spi/spi.h>
+#include <linux/spi/spi-mem.h>
+
+#define SNAFCFR 0x00
+#define   SNAFCFR_DMA_IE BIT(20)
+#define SNAFCCR 0x04
+#define SNAFWCMR 0x08
+#define SNAFRCMR 0x0c
+#define SNAFRDR 0x10
+#define SNAFWDR 0x14
+#define SNAFDTR 0x18
+#define SNAFDRSAR 0x1c
+#define SNAFDIR 0x20
+#define   SNAFDIR_DMA_IP BIT(0)
+#define SNAFDLR 0x24
+#define SNAFSR 0x40
+#define  SNAFSR_NFCOS BIT(3)
+#define  SNAFSR_NFDRS BIT(2)
+#define  SNAFSR_NFDWS BIT(1)
+
+#define CMR_LEN(len) ((len) - 1)
+#define CMR_WID(width) (((width) >> 1) << 28)
+
+struct rtl_snand {
+	struct device *dev;
+	struct regmap *regmap;
+	struct completion comp;
+};
+
+static irqreturn_t rtl_snand_irq(int irq, void *data)
+{
+	struct rtl_snand *snand = data;
+	u32 val = 0;
+
+	regmap_read(snand->regmap, SNAFSR, &val);
+	if (val & (SNAFSR_NFCOS | SNAFSR_NFDRS | SNAFSR_NFDWS))
+		return IRQ_NONE;
+
+	regmap_write(snand->regmap, SNAFDIR, SNAFDIR_DMA_IP);
+	complete(&snand->comp);
+
+	return IRQ_HANDLED;
+}
+
+static bool rtl_snand_supports_op(struct spi_mem *mem,
+				  const struct spi_mem_op *op)
+{
+	if (!spi_mem_default_supports_op(mem, op))
+		return false;
+	if (op->cmd.nbytes != 1 || op->cmd.buswidth != 1)
+		return false;
+	return true;
+}
+
+static void rtl_snand_set_cs(struct rtl_snand *snand, int cs, bool active)
+{
+	u32 val;
+
+	if (active)
+		val = ~(1 << (4 * cs));
+	else
+		val = ~0;
+
+	regmap_write(snand->regmap, SNAFCCR, val);
+}
+
+static int rtl_snand_wait_ready(struct rtl_snand *snand)
+{
+	u32 val;
+
+	return regmap_read_poll_timeout(snand->regmap, SNAFSR, val, !(val & SNAFSR_NFCOS),
+					0, 2 * USEC_PER_MSEC);
+}
+
+static int rtl_snand_xfer_head(struct rtl_snand *snand, int cs, const struct spi_mem_op *op)
+{
+	int ret;
+	u32 val, len = 0;
+
+	rtl_snand_set_cs(snand, cs, true);
+
+	val = op->cmd.opcode << 24;
+	len = 1;
+	if (op->addr.nbytes && op->addr.buswidth == 1) {
+		val |= op->addr.val << ((3 - op->addr.nbytes) * 8);
+		len += op->addr.nbytes;
+	}
+
+	ret = rtl_snand_wait_ready(snand);
+	if (ret)
+		return ret;
+
+	ret = regmap_write(snand->regmap, SNAFWCMR, CMR_LEN(len));
+	if (ret)
+		return ret;
+
+	ret = regmap_write(snand->regmap, SNAFWDR, val);
+	if (ret)
+		return ret;
+
+	ret = rtl_snand_wait_ready(snand);
+	if (ret)
+		return ret;
+
+	if (op->addr.buswidth > 1) {
+		val = op->addr.val << ((3 - op->addr.nbytes) * 8);
+		len = op->addr.nbytes;
+
+		ret = regmap_write(snand->regmap, SNAFWCMR,
+				   CMR_WID(op->addr.buswidth) | CMR_LEN(len));
+		if (ret)
+			return ret;
+
+		ret = regmap_write(snand->regmap, SNAFWDR, val);
+		if (ret)
+			return ret;
+
+		ret = rtl_snand_wait_ready(snand);
+		if (ret)
+			return ret;
+	}
+
+	if (op->dummy.nbytes) {
+		val = 0;
+
+		ret = regmap_write(snand->regmap, SNAFWCMR,
+				   CMR_WID(op->dummy.buswidth) | CMR_LEN(op->dummy.nbytes));
+		if (ret)
+			return ret;
+
+		ret = regmap_write(snand->regmap, SNAFWDR, val);
+		if (ret)
+			return ret;
+
+		ret = rtl_snand_wait_ready(snand);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static void rtl_snand_xfer_tail(struct rtl_snand *snand, int cs)
+{
+	rtl_snand_set_cs(snand, cs, false);
+}
+
+static int rtl_snand_xfer(struct rtl_snand *snand, int cs, const struct spi_mem_op *op)
+{
+	unsigned int pos, nbytes;
+	int ret;
+	u32 val, len = 0;
+
+	ret = rtl_snand_xfer_head(snand, cs, op);
+	if (ret)
+		goto out_deselect;
+
+	if (op->data.dir == SPI_MEM_DATA_IN) {
+		pos = 0;
+		len = op->data.nbytes;
+
+		while (pos < len) {
+			nbytes = len - pos;
+			if (nbytes > 4)
+				nbytes = 4;
+
+			ret = rtl_snand_wait_ready(snand);
+			if (ret)
+				goto out_deselect;
+
+			ret = regmap_write(snand->regmap, SNAFRCMR,
+					   CMR_WID(op->data.buswidth) | CMR_LEN(nbytes));
+			if (ret)
+				goto out_deselect;
+
+			ret = rtl_snand_wait_ready(snand);
+			if (ret)
+				goto out_deselect;
+
+			ret = regmap_read(snand->regmap, SNAFRDR, &val);
+			if (ret)
+				goto out_deselect;
+
+			memcpy(op->data.buf.in + pos, &val, nbytes);
+
+			pos += nbytes;
+		}
+	} else if (op->data.dir == SPI_MEM_DATA_OUT) {
+		pos = 0;
+		len = op->data.nbytes;
+
+		while (pos < len) {
+			nbytes = len - pos;
+			if (nbytes > 4)
+				nbytes = 4;
+
+			memcpy(&val, op->data.buf.out + pos, nbytes);
+
+			pos += nbytes;
+
+			ret = regmap_write(snand->regmap, SNAFWCMR, CMR_LEN(nbytes));
+			if (ret)
+				goto out_deselect;
+
+			ret = regmap_write(snand->regmap, SNAFWDR, val);
+			if (ret)
+				goto out_deselect;
+
+			ret = rtl_snand_wait_ready(snand);
+			if (ret)
+				goto out_deselect;
+		}
+	}
+
+out_deselect:
+	rtl_snand_xfer_tail(snand, cs);
+
+	if (ret)
+		dev_err(snand->dev, "transfer failed %d\n", ret);
+
+	return ret;
+}
+
+static int rtl_snand_dma_xfer(struct rtl_snand *snand, int cs, const struct spi_mem_op *op)
+{
+	int ret;
+	dma_addr_t buf_dma;
+	enum dma_data_direction dir;
+	u32 trig;
+
+	ret = rtl_snand_xfer_head(snand, cs, op);
+	if (ret)
+		goto out_deselect;
+
+	if (op->data.dir == SPI_MEM_DATA_IN) {
+		dir = DMA_FROM_DEVICE;
+		trig = 0;
+	} else if (op->data.dir == SPI_MEM_DATA_OUT) {
+		dir = DMA_TO_DEVICE;
+		trig = 1;
+	} else {
+		ret = -EOPNOTSUPP;
+		goto out_deselect;
+	}
+
+	buf_dma = dma_map_single(snand->dev, op->data.buf.in, op->data.nbytes, dir);
+	ret = dma_mapping_error(snand->dev, buf_dma);
+	if (ret)
+		goto out_deselect;
+
+	ret = regmap_write(snand->regmap, SNAFDIR, SNAFDIR_DMA_IP);
+	if (ret)
+		goto out_unmap;
+
+	ret = regmap_update_bits(snand->regmap, SNAFCFR, SNAFCFR_DMA_IE, SNAFCFR_DMA_IE);
+	if (ret)
+		goto out_unmap;
+
+	reinit_completion(&snand->comp);
+
+	ret = regmap_write(snand->regmap, SNAFDRSAR, buf_dma);
+	if (ret)
+		goto out_disable_int;
+
+	ret = regmap_write(snand->regmap, SNAFDLR,
+			   CMR_WID(op->data.buswidth) | (op->data.nbytes & 0xffff));
+	if (ret)
+		goto out_disable_int;
+
+	ret = regmap_write(snand->regmap, SNAFDTR, trig);
+	if (ret)
+		goto out_disable_int;
+
+	if (!wait_for_completion_timeout(&snand->comp, usecs_to_jiffies(20000)))
+		ret = -ETIMEDOUT;
+
+	if (ret)
+		goto out_disable_int;
+
+out_disable_int:
+	regmap_update_bits(snand->regmap, SNAFCFR, SNAFCFR_DMA_IE, 0);
+out_unmap:
+	dma_unmap_single(snand->dev, buf_dma, op->data.nbytes, dir);
+out_deselect:
+	rtl_snand_xfer_tail(snand, cs);
+
+	if (ret)
+		dev_err(snand->dev, "transfer failed %d\n", ret);
+
+	return ret;
+}
+
+static bool rtl_snand_dma_op(const struct spi_mem_op *op)
+{
+	switch (op->data.dir) {
+	case SPI_MEM_DATA_IN:
+	case SPI_MEM_DATA_OUT:
+		return op->data.nbytes > 32;
+	default:
+		return false;
+	}
+}
+
+static int rtl_snand_exec_op(struct spi_mem *mem, const struct spi_mem_op *op)
+{
+	struct rtl_snand *snand = spi_controller_get_devdata(mem->spi->controller);
+	int cs = spi_get_chipselect(mem->spi, 0);
+
+	dev_dbg(snand->dev, "cs %d op cmd %02x %d:%d, dummy %d:%d, addr %08llx@%d:%d, data %d:%d\n",
+		cs, op->cmd.opcode,
+		op->cmd.buswidth, op->cmd.nbytes, op->dummy.buswidth,
+		op->dummy.nbytes, op->addr.val, op->addr.buswidth,
+		op->addr.nbytes, op->data.buswidth, op->data.nbytes);
+
+	if (rtl_snand_dma_op(op))
+		return rtl_snand_dma_xfer(snand, cs, op);
+	else
+		return rtl_snand_xfer(snand, cs, op);
+}
+
+static const struct spi_controller_mem_ops rtl_snand_mem_ops = {
+	.supports_op = rtl_snand_supports_op,
+	.exec_op = rtl_snand_exec_op,
+};
+
+static const struct of_device_id rtl_snand_match[] = {
+	{ .compatible = "realtek,rtl9301-snand" },
+	{ .compatible = "realtek,rtl9302b-snand" },
+	{ .compatible = "realtek,rtl9302c-snand" },
+	{ .compatible = "realtek,rtl9303-snand" },
+	{},
+};
+MODULE_DEVICE_TABLE(of, rtl_snand_match);
+
+static int rtl_snand_probe(struct platform_device *pdev)
+{
+	struct rtl_snand *snand;
+	struct device *dev = &pdev->dev;
+	struct spi_controller *ctrl;
+	void __iomem *base;
+	const struct regmap_config rc = {
+		.reg_bits	= 32,
+		.val_bits	= 32,
+		.reg_stride	= 4,
+		.cache_type	= REGCACHE_NONE,
+	};
+	int irq, ret;
+
+	ctrl = devm_spi_alloc_host(dev, sizeof(*snand));
+	if (!ctrl)
+		return -ENOMEM;
+
+	snand = spi_controller_get_devdata(ctrl);
+	snand->dev = dev;
+
+	base = devm_platform_ioremap_resource(pdev, 0);
+	if (IS_ERR(base))
+		return PTR_ERR(base);
+
+	snand->regmap = devm_regmap_init_mmio(dev, base, &rc);
+	if (IS_ERR(snand->regmap))
+		return PTR_ERR(snand->regmap);
+
+	init_completion(&snand->comp);
+
+	irq = platform_get_irq(pdev, 0);
+	if (irq < 0)
+		return irq;
+
+	ret = dma_set_mask(snand->dev, DMA_BIT_MASK(32));
+	if (ret)
+		return dev_err_probe(dev, ret, "failed to set DMA mask\n");
+
+	ret = devm_request_irq(dev, irq, rtl_snand_irq, 0, "rtl-snand", snand);
+	if (ret)
+		return dev_err_probe(dev, ret, "failed to request irq\n");
+
+	ctrl->num_chipselect = 2;
+	ctrl->mem_ops = &rtl_snand_mem_ops;
+	ctrl->bits_per_word_mask = SPI_BPW_MASK(8);
+	ctrl->mode_bits = SPI_RX_DUAL | SPI_RX_QUAD | SPI_TX_DUAL | SPI_TX_QUAD;
+	device_set_node(&ctrl->dev, dev_fwnode(dev));
+
+	return devm_spi_register_controller(dev, ctrl);
+}
+
+static struct platform_driver rtl_snand_driver = {
+	.driver = {
+		.name = "realtek-rtl-snand",
+		.of_match_table = rtl_snand_match,
+	},
+	.probe = rtl_snand_probe,
+};
+module_platform_driver(rtl_snand_driver);
+
+MODULE_DESCRIPTION("Realtek SPI-NAND Flash Controller Driver");
+MODULE_LICENSE("GPL");
--- a/target/linux/realtek/patches-6.12/002-v6.13-spi-mem-rtl-snand-correctly-handle-dma-transfers.patch
+++ b/target/linux/realtek/patches-6.12/002-v6.13-spi-mem-rtl-snand-correctly-handle-dma-transfers.patch
@ -0,0 +1,96 @@
+From 25d284715845a465a1a3693a09cf8b6ab8bd9caf Mon Sep 17 00:00:00 2001
+From: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Date: Thu, 31 Oct 2024 08:49:20 +1300
+Subject: [PATCH] spi: spi-mem: rtl-snand: Correctly handle DMA transfers
+
+The RTL9300 has some limitations on the maximum DMA transfers possible.
+For reads this is 2080 bytes (520*4) for writes this is 520 bytes. Deal
+with this by splitting transfers into appropriately sized parts.
+
+Fixes: 42d20a6a61b8 ("spi: spi-mem: Add Realtek SPI-NAND controller")
+Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
+Link: https://patch.msgid.link/20241030194920.3202282-1-chris.packham@alliedtelesis.co.nz
+Signed-off-by: Mark Brown <broonie@kernel.org>
+---
+ drivers/spi/spi-realtek-rtl-snand.c | 46 +++++++++++++++++++----------
+ 1 file changed, 30 insertions(+), 16 deletions(-)
+
+--- a/drivers/spi/spi-realtek-rtl-snand.c
+++ b/drivers/spi/spi-realtek-rtl-snand.c
+@@ -231,19 +231,22 @@ out_deselect:
+ 
+ static int rtl_snand_dma_xfer(struct rtl_snand *snand, int cs, const struct spi_mem_op *op)
+ {
+	unsigned int pos, nbytes;
+ 	int ret;
+ 	dma_addr_t buf_dma;
+ 	enum dma_data_direction dir;
+-	u32 trig;
+	u32 trig, len, maxlen;
+ 
+ 	ret = rtl_snand_xfer_head(snand, cs, op);
+ 	if (ret)
+ 		goto out_deselect;
+ 
+ 	if (op->data.dir == SPI_MEM_DATA_IN) {
+		maxlen = 2080;
+ 		dir = DMA_FROM_DEVICE;
+ 		trig = 0;
+ 	} else if (op->data.dir == SPI_MEM_DATA_OUT) {
+		maxlen = 520;
+ 		dir = DMA_TO_DEVICE;
+ 		trig = 1;
+ 	} else {
+@@ -264,26 +267,37 @@ static int rtl_snand_dma_xfer(struct rtl
+ 	if (ret)
+ 		goto out_unmap;
+ 
+-	reinit_completion(&snand->comp);
+	pos = 0;
+	len = op->data.nbytes;
+ 
+-	ret = regmap_write(snand->regmap, SNAFDRSAR, buf_dma);
+-	if (ret)
+-		goto out_disable_int;
+	while (pos < len) {
+		nbytes = len - pos;
+		if (nbytes > maxlen)
+			nbytes = maxlen;
+ 
+-	ret = regmap_write(snand->regmap, SNAFDLR,
+-			   CMR_WID(op->data.buswidth) | (op->data.nbytes & 0xffff));
+-	if (ret)
+-		goto out_disable_int;
+		reinit_completion(&snand->comp);
+ 
+-	ret = regmap_write(snand->regmap, SNAFDTR, trig);
+-	if (ret)
+-		goto out_disable_int;
+		ret = regmap_write(snand->regmap, SNAFDRSAR, buf_dma + pos);
+		if (ret)
+			goto out_disable_int;
+ 
+-	if (!wait_for_completion_timeout(&snand->comp, usecs_to_jiffies(20000)))
+-		ret = -ETIMEDOUT;
+		pos += nbytes;
+ 
+-	if (ret)
+-		goto out_disable_int;
+		ret = regmap_write(snand->regmap, SNAFDLR,
+				CMR_WID(op->data.buswidth) | nbytes);
+		if (ret)
+			goto out_disable_int;
+
+		ret = regmap_write(snand->regmap, SNAFDTR, trig);
+		if (ret)
+			goto out_disable_int;
+
+		if (!wait_for_completion_timeout(&snand->comp, usecs_to_jiffies(20000)))
+			ret = -ETIMEDOUT;
+
+		if (ret)
+			goto out_disable_int;
+	}
+ 
+ out_disable_int:
+ 	regmap_update_bits(snand->regmap, SNAFCFR, SNAFCFR_DMA_IE, 0);
--- a/target/linux/realtek/patches-6.12/308-tune-switch-4kec.patch
+++ b/target/linux/realtek/patches-6.12/308-tune-switch-4kec.patch
@ -0,0 +1,24 @@
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+Date: Fri, 13 Jun 2025 20:25:37 +0100
+Subject: [PATCH] realtek: set mtune 4kec for RTL838x targets
+
+Generic patches will always force the gcc kernel tuning to 34kc. With RTL838x 
+being only 4kec this does not harm but is not right. Match the tuning properly.
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+---
+
+--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
+@@ -164,6 +164,11 @@ cflags-$(CONFIG_CPU_R4X00)	+= $(call cc-
+ cflags-$(CONFIG_CPU_TX49XX)	+= $(call cc-option,-march=r4600,-march=mips3) -Wa,--trap
+ cflags-$(CONFIG_CPU_MIPS32_R1)	+= -march=mips32 -Wa,--trap
+ cflags-$(CONFIG_CPU_MIPS32_R2)	+= -march=mips32r2 -mtune=34kc -Wa,--trap
+
+#ifdef CONFIG_RTL838X
+cflags-$(CONFIG_CPU_MIPS32_R2) := $(subst 34kc,4kec,$(cflags-$(CONFIG_CPU_MIPS32_R2)))
+#endif
+
+ cflags-$(CONFIG_CPU_MIPS32_R5)	+= -march=mips32r5 -Wa,--trap -modd-spreg
+ cflags-$(CONFIG_CPU_MIPS32_R6)	+= -march=mips32r6 -Wa,--trap -modd-spreg
+ cflags-$(CONFIG_CPU_MIPS64_R1)	+= -march=mips64 -Wa,--trap
--- a/target/linux/realtek/rtl838x/config-6.12
+++ b/target/linux/realtek/rtl838x/config-6.12
@ -226,6 +226,7 @@ CONFIG_SFP=y
 CONFIG_SPI=y
 CONFIG_SPI_MASTER=y
 CONFIG_SPI_MEM=y
+# CONFIG_SPI_REALTEK_SNAND is not set
 CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
 CONFIG_SRAM=y
 CONFIG_SWPHY=y
--- a/target/linux/realtek/rtl838x/target.mk
+++ b/target/linux/realtek/rtl838x/target.mk
@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 ARCH:=mips
 SUBTARGET:=rtl838x
-CPU_TYPE:=4kec
+CPU_TYPE:=24kc
 BOARD:=realtek
 BOARDNAME:=Realtek MIPS RTL838X

--- a/target/linux/realtek/rtl839x/config-6.12
+++ b/target/linux/realtek/rtl839x/config-6.12
@ -239,6 +239,7 @@ CONFIG_SOCK_RX_QUEUE_MAPPING=y
 CONFIG_SPI=y
 CONFIG_SPI_MASTER=y
 CONFIG_SPI_MEM=y
+# CONFIG_SPI_REALTEK_SNAND is not set
 CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
 CONFIG_SRAM=y
 CONFIG_SWPHY=y
--- a/target/linux/realtek/rtl930x/config-6.12
+++ b/target/linux/realtek/rtl930x/config-6.12
@ -137,6 +137,7 @@ CONFIG_MTD_CFI_ADV_OPTIONS=y
 CONFIG_MTD_CFI_GEOMETRY=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_SPI_NAND=y
 CONFIG_MTD_SPI_NOR=y
 CONFIG_MTD_SPLIT_BRNIMAGE_FW=y
 CONFIG_MTD_SPLIT_EVA_FW=y
@ -195,6 +196,7 @@ CONFIG_REGMAP_I2C=y
 CONFIG_REGMAP_MDIO=y
 CONFIG_REGMAP_MMIO=y
 CONFIG_RESET_CONTROLLER=y
+CONFIG_RTL8261N_PHY=y
 # CONFIG_RTL838X is not set
 # CONFIG_RTL839X is not set
 CONFIG_RTL930X=y
@ -205,6 +207,7 @@ CONFIG_SFP=y
 CONFIG_SPI=y
 CONFIG_SPI_MASTER=y
 CONFIG_SPI_MEM=y
+CONFIG_SPI_REALTEK_SNAND=y
 CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
 CONFIG_SWPHY=y
 CONFIG_SYSCTL_EXCEPTION_TRACE=y
--- a/target/linux/realtek/rtl931x/config-6.12
+++ b/target/linux/realtek/rtl931x/config-6.12
@ -153,6 +153,7 @@ CONFIG_MTD_CFI_ADV_OPTIONS=y
 CONFIG_MTD_CFI_GEOMETRY=y
 CONFIG_MTD_CMDLINE_PARTS=y
 CONFIG_MTD_JEDECPROBE=y
+CONFIG_MTD_SPI_NAND=y
 CONFIG_MTD_SPI_NOR=y
 CONFIG_MTD_SPLIT_BRNIMAGE_FW=y
 CONFIG_MTD_SPLIT_EVA_FW=y
@ -227,6 +228,7 @@ CONFIG_SOCK_RX_QUEUE_MAPPING=y
 CONFIG_SPI=y
 CONFIG_SPI_MASTER=y
 CONFIG_SPI_MEM=y
+CONFIG_SPI_REALTEK_SNAND=y
 CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
 CONFIG_SWPHY=y
 CONFIG_SYNC_R4K=y
--- a/target/linux/rockchip/armv8/base-files/etc/init.d/reload-sdio-wifi
+++ b/target/linux/rockchip/armv8/base-files/etc/init.d/reload-sdio-wifi
@ -5,7 +5,7 @@ START=99
 boot() {
 	case "$(board_name)" in
 	ariaboard,photonicat)
-		( sleep 15s; wifi; ) &
+		( modprobe ath10k_sdio; sleep 5s; wifi config; wifi; ) &
 		;;
 	armsom,sige3)
 		( sleep 50s; wifi; ) &
--- a/toolchain/glibc/common.mk
+++ b/toolchain/glibc/common.mk
@ -8,12 +8,12 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=glibc
 PKG_VERSION:=2.41
-PKG_RELEASE:=1
+PKG_RELEASE:=2

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=6e489c17f827317bcf8544efefa65f13b5a079dc
-PKG_MIRROR_HASH:=37527af9a3cbc41201b8a8bead3e6ec973e922e11639ff1762de50c46cf4913e
+PKG_SOURCE_VERSION:=e7c419a2957590fb657900fc92a89708f41abd9d
+PKG_MIRROR_HASH:=8613b8765c8651888178623355bb019538a1e1e32d9cc5a83ab7f063054748e1
 PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.zst
 PKG_CPE_ID:=cpe:/a:gnu:glibc
--- a/tools/automake/patches/310-maintainer-clean-built_sources.patch
+++ b/tools/automake/patches/310-maintainer-clean-built_sources.patch
@ -21,7 +21,7 @@
 +      if (! grep { $_ eq '$(BUILT_SOURCES)' } $mcleanvar->value_as_list ($rcond)) {
 +	Automake::Variable::define ($mcleanvar->name, VAR_MAKEFILE, '+', $rcond,
 +				    '$(BUILT_SOURCES)', '', INTERNAL, VAR_ASIS)
-+	  if vardef ('BUILT_SOURCES', $rcond);
+	  if var ('BUILT_SOURCES');
 +      }
 +    }
 +    my $bsources = var ('BUILT_SOURCES');
@ -30,9 +30,9 @@
 +      {
 +	Automake::Variable::define ($mcleanvar->name, VAR_MAKEFILE, '', $rcond,
 +				    '$(BUILT_SOURCES)', '', INTERNAL, VAR_ASIS)
-+	  if ! vardef ($mcleanvar, $rcond);
+	  if ! ($mcleanvar->def ($rcond) || $mcleanvar->def (TRUE));
 +      }
-+      if (! vardef ($mcleanvar, TRUE)) {
+      if (! $mcleanvar->def (TRUE)) {
 +	Automake::Variable::define ($mcleanvar->name, VAR_MAKEFILE, '', TRUE,
 +				    '$(BUILT_SOURCES)', '', INTERNAL, VAR_ASIS);
 +      }
--- a/tools/bash/Makefile
+++ b/tools/bash/Makefile
@ -8,11 +8,11 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=bash
 PKG_CPE_ID:=cpe:/a:gnu:bash
-PKG_VERSION:=5.2.37
+PKG_VERSION:=5.3

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/bash
-PKG_HASH:=9599b22ecd1d5787ad7d3b7bf0c59f312b3396d1e281175dd1f8a4014da621ff
+PKG_HASH:=62dd49c44c399ed1b3f7f731e87a782334d834f08e098a35f2c87547d5dbb269

 HOST_BUILD_PARALLEL := 1

--- a/tools/bison/Makefile
+++ b/tools/bison/Makefile
@ -21,13 +21,13 @@ include $(INCLUDE_DIR)/host-build.mk
 HOST_CONFIGURE_ARGS += --enable-threads=posix --disable-nls

 define Host/Install
-	$(call Host/Install/Default)
+	$(call Host/Compile/Default,install aclocal_DATA=) # Macro provided by gnulib
 	$(INSTALL_BIN) ./scripts/yacc $(STAGING_DIR_HOST)/bin/yacc
 endef

 define Host/Uninstall
 	rm -f $(STAGING_DIR_HOST)/bin/yacc
-	-$(call Host/Compile/Default,uninstall)
+	-$(call Host/Compile/Default,uninstall aclocal_DATA=) # Macro provided by gnulib
 endef

 $(eval $(call HostBuild))
--- a/tools/expat/Makefile
+++ b/tools/expat/Makefile
@ -20,6 +20,7 @@ HOST_BUILD_PARALLEL:=1
 include $(INCLUDE_DIR)/host-build.mk

 HOSTCC := $(HOSTCC_NOCACHE)
+HOSTCXX := $(HOSTCXX_NOCACHE)

 HOST_CONFIGURE_ARGS += \
 	--disable-shared \
--- a/tools/fakeroot/Makefile
+++ b/tools/fakeroot/Makefile
@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=fakeroot
-PKG_VERSION:=1.37
+PKG_VERSION:=1.37.1.2
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)_$(PKG_VERSION).orig.tar.gz
 PKG_SOURCE_URL:=@DEBIAN/pool/main/f/fakeroot
-PKG_HASH:=9831cc912bc1da6dadac15699c5a07a82c00d6f0dd5c15ec02e20908dd527d3a
+PKG_HASH:=959496928c8a676ec8377f665ff6a19a707bfad693325f9cc4a4126642f53224
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_LICENSE_FILES:=COPYING
 PKG_FIXUP:=autoreconf
--- a/tools/mtools/Makefile
+++ b/tools/mtools/Makefile
@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=mtools
-PKG_VERSION:=4.0.44
+PKG_VERSION:=4.0.49

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=@GNU/$(PKG_NAME)
-PKG_HASH:=37dc4df022533c3d4b2ec1c78973c27c7e8b585374c2d46ab64c6a3db31eddb8
+PKG_HASH:=6fe5193583d6e7c59da75e63d7234f76c0b07caf33b103894f46f66a871ffc9f

 HOST_BUILD_PARALLEL:=1

--- a/tools/pkgconf/Makefile
+++ b/tools/pkgconf/Makefile
@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=pkgconf
-PKG_VERSION:=2.2.0
+PKG_VERSION:=2.5.1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://distfiles.dereferenced.org/pkgconf
-PKG_HASH:=28f8dfc279a10ef66148befa3f6eb266e5f3570316600208ed50e9781c7269d8
+PKG_HASH:=ab89d59810d9cad5dfcd508f25efab8ea0b1c8e7bad91c2b6351f13e6a5940d8

 PKG_CPE_ID:=cpe:/a:pkgconf:pkgconf

--- a/tools/util-linux/Makefile
+++ b/tools/util-linux/Makefile
@ -14,42 +14,15 @@ PKG_SOURCE_URL:=@KERNEL/linux/utils/$(PKG_NAME)/v2.41
 PKG_HASH:=be9ad9a276f4305ab7dd2f5225c8be1ff54352f565ff4dede9628c1aaa7dec57
 PKG_CPE_ID:=cpe:/a:kernel:util-linux

-PKG_FIXUP:=autoreconf
-
-HOST_BUILD_PARALLEL:=1
-
 include $(INCLUDE_DIR)/host-build.mk
+include $(INCLUDE_DIR)/meson.mk

-HOST_CONFIGURE_ARGS += \
-	--with-pic \
-	--disable-shared \
-	--disable-nls \
-	--disable-all-programs \
-	--enable-hexdump \
-	--enable-libuuid \
-	--without-util \
-	--without-selinux \
-	--without-audit \
-	--without-udev \
-	--without-ncursesw \
-	--without-ncurses \
-	--without-slang \
-	--without-tinfo \
-	--without-readline \
-	--without-utempter \
-	--without-cap-ng \
-	--without-libz \
-	--without-libmagic \
-	--without-user \
-	--without-btrfs \
-	--without-systemd \
-	--without-smack \
-	--without-econf \
-	--without-python \
-	--without-cryptsetup
-
-define Host/Uninstall
-	-$(call Host/Compile/Default,uninstall)
-endef
+MESON_HOST_ARGS += \
+	$(if $(findstring y,$(YEAR_2038)),,-Dallow-32bit-time=true) \
+	-Dauto_features=disabled \
+	-Dbuild-hexdump=enabled \
+	-Dbuild-libuuid=enabled \
+	-Dncurses=enabled \
+	-Dprogram-tests=false

 $(eval $(call HostBuild))
--- a/tools/util-linux/patches/010-meson-curses.patch
+++ b/tools/util-linux/patches/010-meson-curses.patch
@ -0,0 +1,24 @@
+From c1ca5ec4a5c6a0e4acbdcc6ff4e4fa2109c1ec24 Mon Sep 17 00:00:00 2001
+From: Rosen Penev <rosenp@gmail.com>
+Date: Wed, 30 Jul 2025 14:13:07 -0700
+Subject: [PATCH] meson: use curses for the non wide version
+
+The curses dependency in meson in special in that it uses a combination
+of pkg-config, config-tool, and various system lookups to find it.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/meson.build
+++ b/meson.build
+@@ -289,7 +289,7 @@ if lib_ncursesw.found()
+   lib_ncurses = disabler()
+ else
+   lib_ncurses = dependency(
+-    'ncurses',
+    'curses',
+     disabler : true,
+     required : get_option('ncurses'))
+   headers += ['ncurses.h',
--- a/tools/util-linux/patches/110-meson-fix-a-bug-in-posixipc_libs-configuration.patch
+++ b/tools/util-linux/patches/110-meson-fix-a-bug-in-posixipc_libs-configuration.patch
@ -0,0 +1,23 @@
+From 946c0b9c6f6481ed9370b8bd0f54a622a0c4a574 Mon Sep 17 00:00:00 2001
+From: Martin Valgur <martin.valgur@gmail.com>
+Date: Tue, 15 Apr 2025 16:19:21 +0300
+Subject: [PATCH] meson: fix a bug in posixipc_libs configuration
+
+Should append instead of assigning. Otherwise fails with
+
+meson.build:1482:22: ERROR: Object <[ExternalLibraryHolder] holds [ExternalLibrary]: <ExternalLibrary rt: True>> of type ExternalLibrary does not support the `+` operator.
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/meson.build
+++ b/meson.build
+@@ -1473,7 +1473,7 @@ has_seminfo_type = cc.has_type('struct s
+ 
+ posixipc_libs = []
+ if not cc.has_function('shm_open') and conf.get('HAVE_SYS_MMAN_H').to_string() == '1'
+-  posixipc_libs = cc.find_library('rt', required : true)
+  posixipc_libs += cc.find_library('rt', required : true)
+ endif
+ 
+ if not cc.has_function('sem_close') and conf.get('HAVE_SEMAPHORE_H').to_string() == '1'