diff --git a/package/boot/uboot-mediatek/Makefile b/package/boot/uboot-mediatek/Makefile
index 0adea8b10d..f0d4534a4e 100644
--- a/package/boot/uboot-mediatek/Makefile
+++ b/package/boot/uboot-mediatek/Makefile
@@ -568,6 +568,18 @@ define U-Boot/mt7986_rfb
   DEPENDS:=+trusted-firmware-a-mt7986-sdmmc-ddr4
 endef
 
+define U-Boot/mt7986_acer_predator-w6x
+  NAME:=Acer Predator Connect W6x
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=acer_predator-w6x-ubootmod
+  UBOOT_CONFIG:=mt7986_acer_predator-w6x
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7986
+  BL2_DDRTYPE:=ddr4
+  DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-ddr4
+endef
+
 define U-Boot/mt7986_bananapi_bpi-r3-emmc
   NAME:=BananaPi BPi-R3
   BUILD_SUBTARGET:=filogic
@@ -978,6 +990,7 @@ UBOOT_TARGETS := \
 	mt7981_snr_snr-cpe-ax2 \
 	mt7981_xiaomi_mi-router-ax3000t \
 	mt7981_xiaomi_mi-router-wr30u \
+	mt7986_acer_predator-w6x \
 	mt7986_bananapi_bpi-r3-emmc \
 	mt7986_bananapi_bpi-r3-sdmmc \
 	mt7986_bananapi_bpi-r3-snand \
diff --git a/package/boot/uboot-mediatek/patches/465-add-acer_predator-w6x.patch b/package/boot/uboot-mediatek/patches/465-add-acer_predator-w6x.patch
new file mode 100644
index 0000000000..97e638d786
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/465-add-acer_predator-w6x.patch
@@ -0,0 +1,318 @@
+--- /dev/null
++++ b/arch/arm/dts/mt7986a-acer_predator-w6x.dts
+@@ -0,0 +1,150 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++
++/dts-v1/;
++#include <dt-bindings/input/linux-event-codes.h>
++#include "mt7986.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "Acer Predator Connect W6x";
++	compatible = "mediatek,mt7986", "mediatek,mt7986-sd-rfb";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	memory@40000000 {
++		device_type = "memory";
++		reg = <0x40000000 0x20000000>;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		factory {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
++		};
++
++		wps {
++			label = "wps";
++			linux,code = <KEY_WPS_BUTTON>;
++			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "2500base-x";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <2500>;
++		full-duplex;
++	};
++};
++
++&pio {
++	spic_pins: spi1-pins-func-1 {
++		mux {
++			function = "spi";
++			groups = "spi1_2";
++		};
++	};
++
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
++		};
++
++		conf-pd {
++			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
++		};
++	};
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <1>;
++	sample_sel = <0>;
++	pinctrl-names = "default";
++
++	spi_nand@0 {
++		compatible = "spi-nand";
++		reg = <0>;
++		spi-max-frequency = <52000000>;
++		spi-tx-bus-width = <4>;
++		spi-rx-bus-width = <4>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "bl2";
++				reg = <0x0 0x100000>;
++			};
++
++			partition@100000 {
++				label = "u-boot-env";
++				reg = <0x100000 0x80000>;
++			};
++
++			partition@180000 {
++				label = "factory";
++				reg = <0x180000 0x200000>;
++			};
++
++			partition@380000 {
++				label = "fip";
++				reg = <0x380000 0x200000>;
++			};
++
++			partition@580000 {
++				label = "prod";
++				reg = <0x580000 0x20000>;
++				read-only;
++			};
++
++			partition@600000 {
++				label = "ubi";
++				reg = <0x600000 0xD200000>;
++			};
++		};
++	};
++};
++
++&uart0 {
++	mediatek,force-highspeed;
++	status = "okay";
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/configs/mt7986_acer_predator-w6x_defconfig
+@@ -0,0 +1,105 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7986a-acer_predator-w6x"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7986=y
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_DEBUG_UART=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7986a-acer_predator-w6x.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++# CONFIG_BOARD_INIT is not set
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7986> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_ENV_REDUNDANT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_ENV_RELOC_GD_ENV_ADDR=y
++CONFIG_ENV_USE_DEFAULT_ENV_TEXT_FILE=y
++CONFIG_ENV_DEFAULT_ENV_TEXT_FILE="defenvs/acer_predator-w6x_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++# CONFIG_I2C is not set
++# CONFIG_MMC is not set
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7986=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_SERIAL_RX_BUFFER=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_RANDOM_UUID=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
+--- /dev/null
++++ b/defenvs/acer_predator-w6x_env
+@@ -0,0 +1,54 @@
++ethaddr_factory=mtd read u-boot-env 0x40080000 0x0 0x18000 && env import -t 0x40080004 0x18000 ethaddr ; setenv ethaddr_factory
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++bootargs=console=ttyS0,115200n8 console_msg_format=syslog
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-acer_predator-w6x-ubootmod-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-acer_predator-w6x-ubootmod-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-acer_predator-w6x-ubootmod-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-acer_predator-w6x-ubootmod-squashfs-sysupgrade.itb
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=run ubi_read_production && bootm $loadaddr#$bootconf
++boot_recovery=run ubi_read_recovery && bootm $loadaddr#$bootconf
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++part_fit=fit
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr $part_fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
diff --git a/package/boot/uboot-tools/uboot-envtools/files/mediatek_filogic b/package/boot/uboot-tools/uboot-envtools/files/mediatek_filogic
index 90636579f0..1986e05b4e 100644
--- a/package/boot/uboot-tools/uboot-envtools/files/mediatek_filogic
+++ b/package/boot/uboot-tools/uboot-envtools/files/mediatek_filogic
@@ -23,6 +23,7 @@ ubootenv_add_nor_default() {
 
 case "$board" in
 abt,asr3000|\
+acer,predator-w6x-ubootmod|\
 asus,zenwifi-bt8-ubootmod|\
 cmcc,a10-ubootmod|\
 cudy,tr3000-v1-ubootmod|\
diff --git a/package/boot/uboot-tools/uboot-envtools/files/realtek b/package/boot/uboot-tools/uboot-envtools/files/realtek
index 9b8bf90c27..0a03792f8a 100644
--- a/package/boot/uboot-tools/uboot-envtools/files/realtek
+++ b/package/boot/uboot-tools/uboot-envtools/files/realtek
@@ -17,17 +17,17 @@ d-link,dgs-1210-10p|\
 d-link,dgs-1210-16|\
 d-link,dgs-1210-20|\
 d-link,dgs-1210-28|\
-zyxel,gs1900-8|\
-zyxel,gs1900-8hp-v1|\
-zyxel,gs1900-8hp-v2|\
-zyxel,gs1900-10hp|\
-zyxel,gs1900-16|\
-zyxel,gs1900-24-v1|\
-zyxel,gs1900-24e|\
-zyxel,gs1900-24ep|\
-zyxel,gs1900-24hp-v1|\
-zyxel,gs1900-24hp-v2|\
-zyxel,gs1900-48)
+zyxel,gs1900-8-a1|\
+zyxel,gs1900-8hp-a1|\
+zyxel,gs1900-8hp-b1|\
+zyxel,gs1900-10hp-a1|\
+zyxel,gs1900-16-a1|\
+zyxel,gs1900-24-a1|\
+zyxel,gs1900-24e-a1|\
+zyxel,gs1900-24ep-a1|\
+zyxel,gs1900-24hp-a1|\
+zyxel,gs1900-24hp-b1|\
+zyxel,gs1900-48-a1)
 	ubootenv_add_mtd "u-boot-env" "0x0" "0x400" "0x10000"
 	ubootenv_add_sys_mtd "u-boot-env2" "0x0" "0x1000" "0x10000"
 	;;
diff --git a/package/network/services/hostapd/files/wpa_supplicant.uc b/package/network/services/hostapd/files/wpa_supplicant.uc
index b2a61090f3..2f0279d069 100644
--- a/package/network/services/hostapd/files/wpa_supplicant.uc
+++ b/package/network/services/hostapd/files/wpa_supplicant.uc
@@ -1,4 +1,5 @@
 let libubus = require("ubus");
+import * as uloop from "uloop";
 import { open, readfile } from "fs";
 import { wdev_create, wdev_set_mesh_params, wdev_remove, is_equal, wdev_set_up, vlist_new, phy_open } from "common";
 
@@ -16,6 +17,7 @@ libubus.guard(ex_handler);
 wpas.data.mld = {};
 wpas.data.config = {};
 wpas.data.iface_phy = {};
+wpas.data.iface_ubus = {};
 wpas.data.macaddr_list = {};
 
 function iface_stop(iface)
@@ -548,7 +550,7 @@ let main_obj = {
 				set_config(phy, req.args.phy, req.args.radio, req.args.num_global_macaddr, req.args.macaddr_base, req.args.config);
 
 			if (!req.args.defer)
-				start_pending(phy);
+				uloop.timer(100, () => start_pending(phy));
 
 			return {
 				pid: wpas.getpid()
@@ -720,6 +722,76 @@ function iface_channel_switch(ifname, iface, info)
 	ubus.call("hostapd", "apsta_state", msg);
 }
 
+function iface_ubus_remove(ifname)
+{
+	let obj = wpas.data.iface_ubus[ifname];
+	if (!obj)
+		return;
+
+	obj.remove();
+	delete wpas.data.iface_ubus[ifname];
+}
+
+function iface_ubus_add(ifname)
+{
+	let ubus = wpas.data.ubus;
+
+	iface_ubus_remove(ifname);
+
+	let obj = ubus.publish(`wpa_supplicant.${ifname}`, {
+		reload: {
+			args: {},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				iface.ctrl("RECONFIGURE");
+				return 0;
+			},
+		},
+		wps_start: {
+			args: {
+				multi_ap: true
+			},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				iface.ctrl(`WPS_PBC multi_ap=${+req.args.multi_ap}`);
+				return 0;
+			},
+		},
+		wps_cancel: {
+			args: {},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				iface.ctrl("WPS_CANCEL");
+				return 0;
+			},
+		},
+		control: {
+			args: {
+				command: ""
+			},
+			call: (req) => {
+				let iface = wpas.interfaces[ifname];
+				if (!iface)
+					return libubus.STATUS_NOT_FOUND;
+
+				return {
+					result: iface.ctrl(req.args.command)
+				};
+			},
+		},
+	});
+	wpas.data.iface_ubus[ifname] = obj;
+}
+
 return {
 	shutdown: function() {
 		for (let phy in wpas.data.config)
@@ -734,10 +806,12 @@ return {
 		return mld_bss_allowed(mld, bss);
 	},
 	iface_add: function(name, obj) {
+		iface_ubus_add(name);
 		iface_event("add", name);
 	},
 	iface_remove: function(name, obj) {
 		iface_event("remove", name);
+		iface_ubus_remove(name);
 	},
 	state: function(ifname, iface, state) {
 		let event_data = iface.status();
@@ -773,5 +847,9 @@ return {
 	event: function(ifname, iface, ev, info) {
 		if (ev == "CH_SWITCH_STARTED")
 			iface_channel_switch(ifname, iface, info);
+	},
+	wps_credentials: function(ifname, iface, cred) {
+		cred.ifname = ifname;
+		ubus.event("wps_credentials", cred);
 	}
 };
diff --git a/package/network/services/hostapd/patches/600-ubus_support.patch b/package/network/services/hostapd/patches/600-ubus_support.patch
index 66cc75f37d..0c132b9d27 100644
--- a/package/network/services/hostapd/patches/600-ubus_support.patch
+++ b/package/network/services/hostapd/patches/600-ubus_support.patch
@@ -636,32 +636,6 @@ probe/assoc/auth requests via object subscribe.
 +
 +	eloop_register_cb(uloop_poll_handler, uloop_timeout_poll_handler);
 +}
---- a/wpa_supplicant/Makefile
-+++ b/wpa_supplicant/Makefile
-@@ -191,6 +191,13 @@ ifdef CONFIG_EAPOL_TEST
- CFLAGS += -Werror -DEAPOL_TEST
- endif
- 
-+ifdef CONFIG_UBUS
-+CFLAGS += -DUBUS_SUPPORT
-+OBJS += ubus.o
-+OBJS += ../src/utils/uloop.o
-+LIBS += -lubox -lubus
-+endif
-+
- ifdef CONFIG_CODE_COVERAGE
- CFLAGS += -O0 -fprofile-arcs -ftest-coverage -U_FORTIFY_SOURCE
- LIBS += -lgcov
-@@ -1046,6 +1053,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
- CFLAGS += -DCONFIG_CTRL_IFACE_MIB
- endif
- OBJS += ../src/ap/ctrl_iface_ap.o
-+ifdef CONFIG_UBUS
-+OBJS += ../src/ap/ubus.o
-+endif
- endif
- 
- CFLAGS += -DEAP_SERVER -DEAP_SERVER_IDENTITY
 --- a/wpa_supplicant/main.c
 +++ b/wpa_supplicant/main.c
 @@ -203,7 +203,7 @@ int main(int argc, char *argv[])
@@ -683,82 +657,3 @@ probe/assoc/auth requests via object subscribe.
  		case 'o':
  			params.override_driver = optarg;
  			break;
---- a/wpa_supplicant/wpa_supplicant.c
-+++ b/wpa_supplicant/wpa_supplicant.c
-@@ -8289,6 +8289,8 @@ struct wpa_supplicant * wpa_supplicant_a
- 	}
- #endif /* CONFIG_P2P */
- 
-+	wpas_ubus_add_bss(wpa_s);
-+
- 	return wpa_s;
- }
- 
-@@ -8315,6 +8317,8 @@ int wpa_supplicant_remove_iface(struct w
- 	struct wpa_supplicant *parent = wpa_s->parent;
- #endif /* CONFIG_MESH */
- 
-+	wpas_ubus_free_bss(wpa_s);
-+
- 	/* Remove interface from the global list of interfaces */
- 	prev = global->ifaces;
- 	if (prev == wpa_s) {
-@@ -8661,8 +8665,12 @@ int wpa_supplicant_run(struct wpa_global
- 	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
- 	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
- 
-+	wpas_ubus_add(global);
-+
- 	eloop_run();
- 
-+	wpas_ubus_free(global);
-+
- 	return 0;
- }
- 
---- a/wpa_supplicant/wpa_supplicant_i.h
-+++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -21,6 +21,7 @@
- #include "config_ssid.h"
- #include "wmm_ac.h"
- #include "pasn/pasn_common.h"
-+#include "ubus.h"
- 
- extern const char *const wpa_supplicant_version;
- extern const char *const wpa_supplicant_license;
-@@ -319,6 +320,8 @@ struct wpa_global {
- #endif /* CONFIG_WIFI_DISPLAY */
- 
- 	struct psk_list_entry *add_psk; /* From group formation */
-+
-+	struct ubus_object ubus_global;
- };
- 
- 
-@@ -697,6 +700,7 @@ struct wpa_supplicant {
- 	unsigned char own_addr[ETH_ALEN];
- 	unsigned char perm_addr[ETH_ALEN];
- 	char ifname[100];
-+	struct wpas_ubus_bss ubus;
- #ifdef CONFIG_MATCH_IFACE
- 	int matched;
- #endif /* CONFIG_MATCH_IFACE */
---- a/wpa_supplicant/wps_supplicant.c
-+++ b/wpa_supplicant/wps_supplicant.c
-@@ -33,6 +33,7 @@
- #include "p2p/p2p.h"
- #include "p2p_supplicant.h"
- #include "wps_supplicant.h"
-+#include "ubus.h"
- 
- 
- #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
-@@ -401,6 +402,8 @@ static int wpa_supplicant_wps_cred(void
- 	wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
- 			cred->cred_attr, cred->cred_attr_len);
- 
-+	wpas_ubus_notify(wpa_s, cred);
-+
- 	if (wpa_s->conf->wps_cred_processing == 1)
- 		return 0;
- 
diff --git a/package/network/services/hostapd/patches/601-ucode_support.patch b/package/network/services/hostapd/patches/601-ucode_support.patch
index 7bbf781275..f72f2601c3 100644
--- a/package/network/services/hostapd/patches/601-ucode_support.patch
+++ b/package/network/services/hostapd/patches/601-ucode_support.patch
@@ -6,6 +6,104 @@ This implements vastly improved dynamic configuration reload support.
 It can handle configuration changes on individual wifi interfaces, as well
 as adding/removing interfaces.
 
+--- a/wpa_supplicant/wpa_supplicant.c
++++ b/wpa_supplicant/wpa_supplicant.c
+@@ -1278,6 +1278,7 @@ void wpa_supplicant_set_state(struct wpa
+ 		sme_sched_obss_scan(wpa_s, 0);
+ 	}
+ 	wpa_s->wpa_state = state;
++	wpas_ucode_update_state(wpa_s);
+ 
+ #ifndef CONFIG_NO_ROBUST_AV
+ 	if (state == WPA_COMPLETED && dl_list_len(&wpa_s->active_scs_ids) &&
+@@ -8289,6 +8290,8 @@ struct wpa_supplicant * wpa_supplicant_a
+ 	}
+ #endif /* CONFIG_P2P */
+ 
++	wpas_ucode_add_bss(wpa_s);
++
+ 	return wpa_s;
+ }
+ 
+@@ -8315,6 +8318,8 @@ int wpa_supplicant_remove_iface(struct w
+ 	struct wpa_supplicant *parent = wpa_s->parent;
+ #endif /* CONFIG_MESH */
+ 
++	wpas_ucode_free_bss(wpa_s);
++
+ 	/* Remove interface from the global list of interfaces */
+ 	prev = global->ifaces;
+ 	if (prev == wpa_s) {
+@@ -8623,6 +8628,7 @@ struct wpa_global * wpa_supplicant_init(
+ 
+ 	eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
+ 			       wpas_periodic, global, NULL);
++	wpas_ucode_init(global);
+ 
+ 	return global;
+ }
+@@ -8695,6 +8701,8 @@ void wpa_supplicant_deinit(struct wpa_gl
+ 
+ 	wpas_notify_supplicant_deinitialized(global);
+ 
++	wpas_ucode_free();
++
+ 	eap_peer_unregister_methods();
+ #ifdef CONFIG_AP
+ 	eap_server_unregister_methods();
+--- a/wpa_supplicant/wpa_supplicant_i.h
++++ b/wpa_supplicant/wpa_supplicant_i.h
+@@ -15,12 +15,14 @@
+ #include "common/sae.h"
+ #include "common/wpa_ctrl.h"
+ #include "common/dpp.h"
++#include "common/ieee802_11_common.h"
+ #include "crypto/sha384.h"
+ #include "eapol_supp/eapol_supp_sm.h"
+ #include "wps/wps_defs.h"
+ #include "config_ssid.h"
+ #include "wmm_ac.h"
+ #include "pasn/pasn_common.h"
++#include "ucode.h"
+ 
+ extern const char *const wpa_supplicant_version;
+ extern const char *const wpa_supplicant_license;
+@@ -697,6 +699,7 @@ struct wpa_supplicant {
+ 	unsigned char own_addr[ETH_ALEN];
+ 	unsigned char perm_addr[ETH_ALEN];
+ 	char ifname[100];
++	struct wpas_ucode_bss ucode;
+ #ifdef CONFIG_MATCH_IFACE
+ 	int matched;
+ #endif /* CONFIG_MATCH_IFACE */
+@@ -1564,6 +1567,8 @@ struct wpa_supplicant {
+ 	unsigned int enabled_4addr_mode:1;
+ 	unsigned int multi_bss_support:1;
+ 	unsigned int drv_authorized_port:1;
++
++	struct multi_ap_params multi_ap;
+ 	unsigned int multi_ap_ie:1;
+ 	unsigned int multi_ap_backhaul:1;
+ 	unsigned int multi_ap_fronthaul:1;
+--- a/wpa_supplicant/wps_supplicant.c
++++ b/wpa_supplicant/wps_supplicant.c
+@@ -33,6 +33,7 @@
+ #include "p2p/p2p.h"
+ #include "p2p_supplicant.h"
+ #include "wps_supplicant.h"
++#include "ucode.h"
+ 
+ 
+ #ifndef WPS_PIN_SCAN_IGNORE_SEL_REG
+@@ -401,6 +402,8 @@ static int wpa_supplicant_wps_cred(void
+ 	wpa_hexdump_key(MSG_DEBUG, "WPS: Received Credential attribute",
+ 			cred->cred_attr, cred->cred_attr_len);
+ 
++	wpas_ucode_wps_complete(wpa_s, cred);
++
+ 	if (wpa_s->conf->wps_cred_processing == 1)
+ 		return 0;
+ 
 --- a/hostapd/Makefile
 +++ b/hostapd/Makefile
 @@ -169,9 +169,21 @@ OBJS += ../src/eapol_auth/eapol_auth_sm.
@@ -310,6 +408,152 @@ as adding/removing interfaces.
  void hostapd_ocv_check_csa_sa_query(void *eloop_ctx, void *timeout_ctx);
  
  void hostapd_switch_color(struct hostapd_data *hapd, u64 bitmap);
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -659,12 +659,17 @@ const char * sae_get_password(struct hos
+ 			      struct sae_pt **s_pt,
+ 			      const struct sae_pk **s_pk)
+ {
++	struct hostapd_bss_config *conf = hapd->conf;
++	struct hostapd_ssid *ssid = &conf->ssid;
+ 	const char *password = NULL;
+-	struct sae_password_entry *pw;
++	struct sae_password_entry *pw = NULL;
+ 	struct sae_pt *pt = NULL;
+ 	const struct sae_pk *pk = NULL;
+ 	struct hostapd_sta_wpa_psk_short *psk = NULL;
+ 
++	if (sta && sta->use_sta_psk)
++		goto use_sta_psk;
++
+ 	/* With sae_track_password functionality enabled, try to first find the
+ 	 * next viable wildcard-address password if a password identifier was
+ 	 * not used. Select an wildcard-addr entry if the STA is known to have
+@@ -725,12 +730,30 @@ const char * sae_get_password(struct hos
+ 		pt = hapd->conf->ssid.pt;
+ 	}
+ 
++use_sta_psk:
+ 	if (!password && sta && !rx_id) {
+ 		for (psk = sta->psk; psk; psk = psk->next) {
+-			if (psk->is_passphrase) {
+-				password = psk->passphrase;
++			if (!psk->is_passphrase)
++				continue;
++
++			password = psk->passphrase;
++			if (!sta->use_sta_psk)
++				break;
++
++#ifdef CONFIG_SAE
++			if (sta->sae_pt) {
++				pt = sta->sae_pt;
+ 				break;
+ 			}
++
++			pt = sae_derive_pt(conf->sae_groups, ssid->ssid,
++					   ssid->ssid_len,
++					   (const u8 *) password,
++					   os_strlen(password),
++					   NULL);
++			sta->sae_pt = pt;
++			break;
++#endif
+ 		}
+ 	}
+ 
+@@ -3489,6 +3512,12 @@ static void handle_auth(struct hostapd_d
+ 		goto fail;
+ 	}
+ 
++	res = hostapd_ucode_sta_auth(hapd, sta);
++	if (res) {
++		resp = res;
++		goto fail;
++	}
++
+ 	sta->flags &= ~WLAN_STA_PREAUTH;
+ 	ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
+ 
+--- a/src/ap/sta_info.c
++++ b/src/ap/sta_info.c
+@@ -477,6 +477,11 @@ void ap_free_sta(struct hostapd_data *ha
+ 	forced_memzero(sta->last_tk, WPA_TK_MAX_LEN);
+ #endif /* CONFIG_TESTING_OPTIONS */
+ 
++#ifdef CONFIG_SAE
++	if (sta->sae_pt)
++		sae_deinit_pt(sta->sae_pt);
++#endif
++
+ 	os_free(sta);
+ }
+ 
+@@ -1576,6 +1581,8 @@ void ap_sta_set_authorized_event(struct
+ #endif /* CONFIG_P2P */
+ 	const u8 *ip_ptr = NULL;
+ 
++	if (authorized)
++		hostapd_ucode_sta_connected(hapd, sta);
+ #ifdef CONFIG_P2P
+ 	if (hapd->p2p_group == NULL) {
+ 		if (sta->p2p_ie != NULL &&
+--- a/src/ap/sta_info.h
++++ b/src/ap/sta_info.h
+@@ -180,6 +180,9 @@ struct sta_info {
+ 	int vlan_id_bound; /* updated by ap_sta_bind_vlan() */
+ 	 /* PSKs from RADIUS authentication server */
+ 	struct hostapd_sta_wpa_psk_short *psk;
++	struct sae_pt *sae_pt;
++	int use_sta_psk;
++	int psk_idx;
+ 
+ 	char *identity; /* User-Name from RADIUS */
+ 	char *radius_cui; /* Chargeable-User-Identity from RADIUS */
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -392,6 +392,7 @@ static const u8 * hostapd_wpa_auth_get_p
+ 	struct sta_info *sta = ap_get_sta(hapd, addr);
+ 	const u8 *psk;
+ 
++	sta->psk_idx = 0;
+ 	if (vlan_id)
+ 		*vlan_id = 0;
+ 	if (psk_len)
+@@ -442,13 +443,18 @@ static const u8 * hostapd_wpa_auth_get_p
+ 	 * returned psk which should not be returned again.
+ 	 * logic list (all hostapd_get_psk; all sta->psk)
+ 	 */
++	if (sta && sta->use_sta_psk)
++		psk = NULL;
+ 	if (sta && sta->psk && !psk) {
+ 		struct hostapd_sta_wpa_psk_short *pos;
++		int psk_idx = 1;
+ 
+ 		if (vlan_id)
+ 			*vlan_id = 0;
+ 		psk = sta->psk->psk;
+-		for (pos = sta->psk; pos; pos = pos->next) {
++		if (vlan_id)
++			sta->psk_idx = psk_idx;
++		for (pos = sta->psk; pos; pos = pos->next, psk_idx++) {
+ 			if (pos->is_passphrase) {
+ 				if (pbkdf2_sha1(pos->passphrase,
+ 						hapd->conf->ssid.ssid,
+@@ -462,9 +468,13 @@ static const u8 * hostapd_wpa_auth_get_p
+ 			}
+ 			if (pos->psk == prev_psk) {
+ 				psk = pos->next ? pos->next->psk : NULL;
++				if (vlan_id)
++					sta->psk_idx = psk_idx + 1;
+ 				break;
+ 			}
+ 		}
++		if (vlan_id && !psk)
++			sta->psk_idx = 0;
+ 	}
+ 	return psk;
+ }
 --- a/src/drivers/driver.h
 +++ b/src/drivers/driver.h
 @@ -4072,6 +4072,25 @@ struct wpa_driver_ops {
@@ -668,32 +912,25 @@ as adding/removing interfaces.
  extern int wpa_debug_timestamp;
 --- a/wpa_supplicant/Makefile
 +++ b/wpa_supplicant/Makefile
-@@ -194,8 +194,20 @@ endif
- ifdef CONFIG_UBUS
- CFLAGS += -DUBUS_SUPPORT
- OBJS += ubus.o
-+LIBS += -lubus
-+NEED_ULOOP:=y
-+endif
-+
+@@ -191,6 +191,14 @@ ifdef CONFIG_EAPOL_TEST
+ CFLAGS += -Werror -DEAPOL_TEST
+ endif
+ 
 +ifdef CONFIG_UCODE
 +CFLAGS += -DUCODE_SUPPORT
 +OBJS += ../src/utils/ucode.o
++OBJS += ../src/utils/uloop.o
 +OBJS += ucode.o
-+NEED_ULOOP:=y
++LIBS += -lubox
 +endif
 +
-+ifdef NEED_ULOOP
- OBJS += ../src/utils/uloop.o
--LIBS += -lubox -lubus
-+LIBS += -lubox
- endif
- 
  ifdef CONFIG_CODE_COVERAGE
-@@ -1056,6 +1068,9 @@ OBJS += ../src/ap/ctrl_iface_ap.o
- ifdef CONFIG_UBUS
- OBJS += ../src/ap/ubus.o
+ CFLAGS += -O0 -fprofile-arcs -ftest-coverage -U_FORTIFY_SOURCE
+ LIBS += -lgcov
+@@ -1046,6 +1054,9 @@ ifdef CONFIG_CTRL_IFACE_MIB
+ CFLAGS += -DCONFIG_CTRL_IFACE_MIB
  endif
+ OBJS += ../src/ap/ctrl_iface_ap.o
 +ifdef CONFIG_UCODE
 +OBJS += ../src/ap/ucode.o
 +endif
@@ -758,240 +995,3 @@ as adding/removing interfaces.
  	switch (event) {
  	case EVENT_AUTH:
  #ifdef CONFIG_FST
---- a/wpa_supplicant/wpa_supplicant.c
-+++ b/wpa_supplicant/wpa_supplicant.c
-@@ -1278,6 +1278,7 @@ void wpa_supplicant_set_state(struct wpa
- 		sme_sched_obss_scan(wpa_s, 0);
- 	}
- 	wpa_s->wpa_state = state;
-+	wpas_ucode_update_state(wpa_s);
- 
- #ifndef CONFIG_NO_ROBUST_AV
- 	if (state == WPA_COMPLETED && dl_list_len(&wpa_s->active_scs_ids) &&
-@@ -8290,6 +8291,7 @@ struct wpa_supplicant * wpa_supplicant_a
- #endif /* CONFIG_P2P */
- 
- 	wpas_ubus_add_bss(wpa_s);
-+	wpas_ucode_add_bss(wpa_s);
- 
- 	return wpa_s;
- }
-@@ -8317,6 +8319,7 @@ int wpa_supplicant_remove_iface(struct w
- 	struct wpa_supplicant *parent = wpa_s->parent;
- #endif /* CONFIG_MESH */
- 
-+	wpas_ucode_free_bss(wpa_s);
- 	wpas_ubus_free_bss(wpa_s);
- 
- 	/* Remove interface from the global list of interfaces */
-@@ -8627,6 +8630,7 @@ struct wpa_global * wpa_supplicant_init(
- 
- 	eloop_register_timeout(WPA_SUPPLICANT_CLEANUP_INTERVAL, 0,
- 			       wpas_periodic, global, NULL);
-+	wpas_ucode_init(global);
- 
- 	return global;
- }
-@@ -8665,12 +8669,8 @@ int wpa_supplicant_run(struct wpa_global
- 	eloop_register_signal_terminate(wpa_supplicant_terminate, global);
- 	eloop_register_signal_reconfig(wpa_supplicant_reconfig, global);
- 
--	wpas_ubus_add(global);
--
- 	eloop_run();
- 
--	wpas_ubus_free(global);
--
- 	return 0;
- }
- 
-@@ -8703,6 +8703,8 @@ void wpa_supplicant_deinit(struct wpa_gl
- 
- 	wpas_notify_supplicant_deinitialized(global);
- 
-+	wpas_ucode_free();
-+
- 	eap_peer_unregister_methods();
- #ifdef CONFIG_AP
- 	eap_server_unregister_methods();
---- a/wpa_supplicant/wpa_supplicant_i.h
-+++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -15,6 +15,7 @@
- #include "common/sae.h"
- #include "common/wpa_ctrl.h"
- #include "common/dpp.h"
-+#include "common/ieee802_11_common.h"
- #include "crypto/sha384.h"
- #include "eapol_supp/eapol_supp_sm.h"
- #include "wps/wps_defs.h"
-@@ -22,6 +23,7 @@
- #include "wmm_ac.h"
- #include "pasn/pasn_common.h"
- #include "ubus.h"
-+#include "ucode.h"
- 
- extern const char *const wpa_supplicant_version;
- extern const char *const wpa_supplicant_license;
-@@ -701,6 +703,7 @@ struct wpa_supplicant {
- 	unsigned char perm_addr[ETH_ALEN];
- 	char ifname[100];
- 	struct wpas_ubus_bss ubus;
-+	struct wpas_ucode_bss ucode;
- #ifdef CONFIG_MATCH_IFACE
- 	int matched;
- #endif /* CONFIG_MATCH_IFACE */
-@@ -1568,6 +1571,8 @@ struct wpa_supplicant {
- 	unsigned int enabled_4addr_mode:1;
- 	unsigned int multi_bss_support:1;
- 	unsigned int drv_authorized_port:1;
-+
-+	struct multi_ap_params multi_ap;
- 	unsigned int multi_ap_ie:1;
- 	unsigned int multi_ap_backhaul:1;
- 	unsigned int multi_ap_fronthaul:1;
---- a/src/ap/ieee802_11.c
-+++ b/src/ap/ieee802_11.c
-@@ -659,12 +659,17 @@ const char * sae_get_password(struct hos
- 			      struct sae_pt **s_pt,
- 			      const struct sae_pk **s_pk)
- {
-+	struct hostapd_bss_config *conf = hapd->conf;
-+	struct hostapd_ssid *ssid = &conf->ssid;
- 	const char *password = NULL;
--	struct sae_password_entry *pw;
-+	struct sae_password_entry *pw = NULL;
- 	struct sae_pt *pt = NULL;
- 	const struct sae_pk *pk = NULL;
- 	struct hostapd_sta_wpa_psk_short *psk = NULL;
- 
-+	if (sta && sta->use_sta_psk)
-+		goto use_sta_psk;
-+
- 	/* With sae_track_password functionality enabled, try to first find the
- 	 * next viable wildcard-address password if a password identifier was
- 	 * not used. Select an wildcard-addr entry if the STA is known to have
-@@ -725,12 +730,30 @@ const char * sae_get_password(struct hos
- 		pt = hapd->conf->ssid.pt;
- 	}
- 
-+use_sta_psk:
- 	if (!password && sta && !rx_id) {
- 		for (psk = sta->psk; psk; psk = psk->next) {
--			if (psk->is_passphrase) {
--				password = psk->passphrase;
-+			if (!psk->is_passphrase)
-+				continue;
-+
-+			password = psk->passphrase;
-+			if (!sta->use_sta_psk)
-+				break;
-+
-+#ifdef CONFIG_SAE
-+			if (sta->sae_pt) {
-+				pt = sta->sae_pt;
- 				break;
- 			}
-+
-+			pt = sae_derive_pt(conf->sae_groups, ssid->ssid,
-+					   ssid->ssid_len,
-+					   (const u8 *) password,
-+					   os_strlen(password),
-+					   NULL);
-+			sta->sae_pt = pt;
-+			break;
-+#endif
- 		}
- 	}
- 
-@@ -3489,6 +3512,12 @@ static void handle_auth(struct hostapd_d
- 		goto fail;
- 	}
- 
-+	res = hostapd_ucode_sta_auth(hapd, sta);
-+	if (res) {
-+		resp = res;
-+		goto fail;
-+	}
-+
- 	sta->flags &= ~WLAN_STA_PREAUTH;
- 	ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
- 
---- a/src/ap/sta_info.c
-+++ b/src/ap/sta_info.c
-@@ -477,6 +477,11 @@ void ap_free_sta(struct hostapd_data *ha
- 	forced_memzero(sta->last_tk, WPA_TK_MAX_LEN);
- #endif /* CONFIG_TESTING_OPTIONS */
- 
-+#ifdef CONFIG_SAE
-+	if (sta->sae_pt)
-+		sae_deinit_pt(sta->sae_pt);
-+#endif
-+
- 	os_free(sta);
- }
- 
-@@ -1576,6 +1581,8 @@ void ap_sta_set_authorized_event(struct
- #endif /* CONFIG_P2P */
- 	const u8 *ip_ptr = NULL;
- 
-+	if (authorized)
-+		hostapd_ucode_sta_connected(hapd, sta);
- #ifdef CONFIG_P2P
- 	if (hapd->p2p_group == NULL) {
- 		if (sta->p2p_ie != NULL &&
---- a/src/ap/sta_info.h
-+++ b/src/ap/sta_info.h
-@@ -180,6 +180,9 @@ struct sta_info {
- 	int vlan_id_bound; /* updated by ap_sta_bind_vlan() */
- 	 /* PSKs from RADIUS authentication server */
- 	struct hostapd_sta_wpa_psk_short *psk;
-+	struct sae_pt *sae_pt;
-+	int use_sta_psk;
-+	int psk_idx;
- 
- 	char *identity; /* User-Name from RADIUS */
- 	char *radius_cui; /* Chargeable-User-Identity from RADIUS */
---- a/src/ap/wpa_auth_glue.c
-+++ b/src/ap/wpa_auth_glue.c
-@@ -392,6 +392,7 @@ static const u8 * hostapd_wpa_auth_get_p
- 	struct sta_info *sta = ap_get_sta(hapd, addr);
- 	const u8 *psk;
- 
-+	sta->psk_idx = 0;
- 	if (vlan_id)
- 		*vlan_id = 0;
- 	if (psk_len)
-@@ -442,13 +443,18 @@ static const u8 * hostapd_wpa_auth_get_p
- 	 * returned psk which should not be returned again.
- 	 * logic list (all hostapd_get_psk; all sta->psk)
- 	 */
-+	if (sta && sta->use_sta_psk)
-+		psk = NULL;
- 	if (sta && sta->psk && !psk) {
- 		struct hostapd_sta_wpa_psk_short *pos;
-+		int psk_idx = 1;
- 
- 		if (vlan_id)
- 			*vlan_id = 0;
- 		psk = sta->psk->psk;
--		for (pos = sta->psk; pos; pos = pos->next) {
-+		if (vlan_id)
-+			sta->psk_idx = psk_idx;
-+		for (pos = sta->psk; pos; pos = pos->next, psk_idx++) {
- 			if (pos->is_passphrase) {
- 				if (pbkdf2_sha1(pos->passphrase,
- 						hapd->conf->ssid.ssid,
-@@ -462,9 +468,13 @@ static const u8 * hostapd_wpa_auth_get_p
- 			}
- 			if (pos->psk == prev_psk) {
- 				psk = pos->next ? pos->next->psk : NULL;
-+				if (vlan_id)
-+					sta->psk_idx = psk_idx + 1;
- 				break;
- 			}
- 		}
-+		if (vlan_id && !psk)
-+			sta->psk_idx = 0;
- 	}
- 	return psk;
- }
diff --git a/package/network/services/hostapd/src/wpa_supplicant/ubus.c b/package/network/services/hostapd/src/wpa_supplicant/ubus.c
deleted file mode 100644
index 1c477f0c0c..0000000000
--- a/package/network/services/hostapd/src/wpa_supplicant/ubus.c
+++ /dev/null
@@ -1,280 +0,0 @@
-/*
- * wpa_supplicant / ubus support
- * Copyright (c) 2018, Daniel Golle <daniel@makrotopia.org>
- * Copyright (c) 2013, Felix Fietkau <nbd@nbd.name>
- *
- * This software may be distributed under the terms of the BSD license.
- * See README for more details.
- */
-
-#include "utils/includes.h"
-#include "utils/common.h"
-#include "utils/eloop.h"
-#include "utils/wpabuf.h"
-#include "common/ieee802_11_defs.h"
-#include "wpa_supplicant_i.h"
-#include "wps_supplicant.h"
-#include "ubus.h"
-
-static struct ubus_context *ctx;
-static struct blob_buf b;
-static int ctx_ref;
-
-static inline struct wpa_global *get_wpa_global_from_object(struct ubus_object *obj)
-{
-	return container_of(obj, struct wpa_global, ubus_global);
-}
-
-static inline struct wpa_supplicant *get_wpas_from_object(struct ubus_object *obj)
-{
-	return container_of(obj, struct wpa_supplicant, ubus.obj);
-}
-
-static void ubus_reconnect_timeout(void *eloop_data, void *user_ctx)
-{
-	if (ubus_reconnect(ctx, NULL)) {
-		eloop_register_timeout(1, 0, ubus_reconnect_timeout, ctx, NULL);
-		return;
-	}
-
-	ubus_add_uloop(ctx);
-}
-
-static void wpas_ubus_connection_lost(struct ubus_context *ctx)
-{
-	uloop_fd_delete(&ctx->sock);
-	eloop_register_timeout(1, 0, ubus_reconnect_timeout, ctx, NULL);
-}
-
-static bool wpas_ubus_init(void)
-{
-	if (ctx)
-		return true;
-
-	eloop_add_uloop();
-	ctx = ubus_connect(NULL);
-	if (!ctx)
-		return false;
-
-	ctx->connection_lost = wpas_ubus_connection_lost;
-	ubus_add_uloop(ctx);
-
-	return true;
-}
-
-static void wpas_ubus_ref_inc(void)
-{
-	ctx_ref++;
-}
-
-static void wpas_ubus_ref_dec(void)
-{
-	ctx_ref--;
-	if (!ctx)
-		return;
-
-	if (ctx_ref)
-		return;
-
-	uloop_fd_delete(&ctx->sock);
-	ubus_free(ctx);
-	ctx = NULL;
-}
-
-static int
-wpas_bss_get_features(struct ubus_context *ctx, struct ubus_object *obj,
-			struct ubus_request_data *req, const char *method,
-			struct blob_attr *msg)
-{
-	struct wpa_supplicant *wpa_s = get_wpas_from_object(obj);
-
-	blob_buf_init(&b, 0);
-	blobmsg_add_u8(&b, "ht_supported", ht_supported(wpa_s->hw.modes));
-	blobmsg_add_u8(&b, "vht_supported", vht_supported(wpa_s->hw.modes));
-	ubus_send_reply(ctx, req, b.head);
-
-	return 0;
-}
-
-static int
-wpas_bss_reload(struct ubus_context *ctx, struct ubus_object *obj,
-		struct ubus_request_data *req, const char *method,
-		struct blob_attr *msg)
-{
-	struct wpa_supplicant *wpa_s = get_wpas_from_object(obj);
-
-	if (wpa_supplicant_reload_configuration(wpa_s))
-		return UBUS_STATUS_UNKNOWN_ERROR;
-	else
-		return 0;
-}
-
-#ifdef CONFIG_WPS
-enum {
-	WPS_START_MULTI_AP,
-	__WPS_START_MAX
-};
-
-static const struct blobmsg_policy wps_start_policy[] = {
-	[WPS_START_MULTI_AP] = { "multi_ap", BLOBMSG_TYPE_BOOL },
-};
-
-static int
-wpas_bss_wps_start(struct ubus_context *ctx, struct ubus_object *obj,
-			struct ubus_request_data *req, const char *method,
-			struct blob_attr *msg)
-{
-	int rc;
-	struct wpa_supplicant *wpa_s = get_wpas_from_object(obj);
-	struct blob_attr *tb[__WPS_START_MAX], *cur;
-	int multi_ap = 0;
-
-	blobmsg_parse(wps_start_policy, __WPS_START_MAX, tb, blobmsg_data(msg), blobmsg_data_len(msg));
-
-	if (tb[WPS_START_MULTI_AP])
-		multi_ap = blobmsg_get_bool(tb[WPS_START_MULTI_AP]);
-
-	rc = wpas_wps_start_pbc(wpa_s, NULL, 0, multi_ap);
-
-	if (rc != 0)
-		return UBUS_STATUS_NOT_SUPPORTED;
-
-	return 0;
-}
-
-static int
-wpas_bss_wps_cancel(struct ubus_context *ctx, struct ubus_object *obj,
-			struct ubus_request_data *req, const char *method,
-			struct blob_attr *msg)
-{
-	int rc;
-	struct wpa_supplicant *wpa_s = get_wpas_from_object(obj);
-
-	rc = wpas_wps_cancel(wpa_s);
-
-	if (rc != 0)
-		return UBUS_STATUS_NOT_SUPPORTED;
-
-	return 0;
-}
-#endif
-
-static const struct ubus_method bss_methods[] = {
-	UBUS_METHOD_NOARG("reload", wpas_bss_reload),
-	UBUS_METHOD_NOARG("get_features", wpas_bss_get_features),
-#ifdef CONFIG_WPS
-	UBUS_METHOD_NOARG("wps_start", wpas_bss_wps_start),
-	UBUS_METHOD_NOARG("wps_cancel", wpas_bss_wps_cancel),
-#endif
-};
-
-static struct ubus_object_type bss_object_type =
-	UBUS_OBJECT_TYPE("wpas_bss", bss_methods);
-
-void wpas_ubus_add_bss(struct wpa_supplicant *wpa_s)
-{
-	struct ubus_object *obj = &wpa_s->ubus.obj;
-	char *name;
-	int ret;
-
-	if (!wpas_ubus_init())
-		return;
-
-	if (asprintf(&name, "wpa_supplicant.%s", wpa_s->ifname) < 0)
-		return;
-
-	obj->name = name;
-	obj->type = &bss_object_type;
-	obj->methods = bss_object_type.methods;
-	obj->n_methods = bss_object_type.n_methods;
-	ret = ubus_add_object(ctx, obj);
-	wpas_ubus_ref_inc();
-}
-
-void wpas_ubus_free_bss(struct wpa_supplicant *wpa_s)
-{
-	struct ubus_object *obj = &wpa_s->ubus.obj;
-	char *name = (char *) obj->name;
-
-	if (!ctx)
-		return;
-
-	if (obj->id) {
-		ubus_remove_object(ctx, obj);
-		wpas_ubus_ref_dec();
-	}
-
-	free(name);
-}
-
-#ifdef CONFIG_WPS
-void wpas_ubus_notify(struct wpa_supplicant *wpa_s, const struct wps_credential *cred)
-{
-	u16 auth_type;
-	char *ifname, *encryption, *ssid, *key;
-	size_t ifname_len;
-
-	if (!cred)
-		return;
-
-	auth_type = cred->auth_type;
-
-	if (auth_type == (WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK))
-		auth_type = WPS_AUTH_WPA2PSK;
-
-	if (auth_type != WPS_AUTH_OPEN &&
-	    auth_type != WPS_AUTH_WPAPSK &&
-	    auth_type != WPS_AUTH_WPA2PSK) {
-		wpa_printf(MSG_DEBUG, "WPS: Ignored credentials for "
-			   "unsupported authentication type 0x%x",
-			   auth_type);
-		return;
-	}
-
-	if (auth_type == WPS_AUTH_WPAPSK || auth_type == WPS_AUTH_WPA2PSK) {
-		if (cred->key_len < 8 || cred->key_len > 2 * PMK_LEN) {
-			wpa_printf(MSG_ERROR, "WPS: Reject PSK credential with "
-				   "invalid Network Key length %lu",
-				   (unsigned long) cred->key_len);
-			return;
-		}
-	}
-
-	blob_buf_init(&b, 0);
-
-	ifname_len = strlen(wpa_s->ifname);
-	ifname = blobmsg_alloc_string_buffer(&b, "ifname", ifname_len + 1);
-	memcpy(ifname, wpa_s->ifname, ifname_len + 1);
-	ifname[ifname_len] = '\0';
-	blobmsg_add_string_buffer(&b);
-
-	switch (auth_type) {
-		case WPS_AUTH_WPA2PSK:
-			encryption = "psk2";
-			break;
-		case WPS_AUTH_WPAPSK:
-			encryption = "psk";
-			break;
-		default:
-			encryption = "none";
-			break;
-	}
-
-	blobmsg_add_string(&b, "encryption", encryption);
-
-	ssid = blobmsg_alloc_string_buffer(&b, "ssid", cred->ssid_len + 1);
-	memcpy(ssid, cred->ssid, cred->ssid_len);
-	ssid[cred->ssid_len] = '\0';
-	blobmsg_add_string_buffer(&b);
-
-	if (cred->key_len > 0) {
-		key = blobmsg_alloc_string_buffer(&b, "key", cred->key_len + 1);
-		memcpy(key, cred->key, cred->key_len);
-		key[cred->key_len] = '\0';
-		blobmsg_add_string_buffer(&b);
-	}
-
-//	ubus_notify(ctx, &wpa_s->ubus.obj, "wps_credentials", b.head, -1);
-	ubus_send_event(ctx, "wps_credentials", b.head);
-}
-#endif /* CONFIG_WPS */
diff --git a/package/network/services/hostapd/src/wpa_supplicant/ubus.h b/package/network/services/hostapd/src/wpa_supplicant/ubus.h
deleted file mode 100644
index f6681cb26d..0000000000
--- a/package/network/services/hostapd/src/wpa_supplicant/ubus.h
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * wpa_supplicant / ubus support
- * Copyright (c) 2018, Daniel Golle <daniel@makrotopia.org>
- * Copyright (c) 2013, Felix Fietkau <nbd@nbd.name>
- *
- * This software may be distributed under the terms of the BSD license.
- * See README for more details.
- */
-#ifndef __WPAS_UBUS_H
-#define __WPAS_UBUS_H
-
-struct wpa_supplicant;
-struct wpa_global;
-
-#include "wps_supplicant.h"
-
-#ifdef UBUS_SUPPORT
-#include <libubus.h>
-
-struct wpas_ubus_bss {
-	struct ubus_object obj;
-};
-
-void wpas_ubus_add_bss(struct wpa_supplicant *wpa_s);
-void wpas_ubus_free_bss(struct wpa_supplicant *wpa_s);
-
-#ifdef CONFIG_WPS
-void wpas_ubus_notify(struct wpa_supplicant *wpa_s, const struct wps_credential *cred);
-#endif
-
-#else
-struct wpas_ubus_bss {};
-
-static inline void wpas_ubus_add_bss(struct wpa_supplicant *wpa_s)
-{
-}
-
-static inline void wpas_ubus_free_bss(struct wpa_supplicant *wpa_s)
-{
-}
-
-static inline void wpas_ubus_notify(struct wpa_supplicant *wpa_s, struct wps_credential *cred)
-{
-}
-
-static inline void wpas_ubus_add(struct wpa_global *global)
-{
-}
-
-static inline void wpas_ubus_free(struct wpa_global *global)
-{
-}
-#endif
-
-#endif
diff --git a/package/network/services/hostapd/src/wpa_supplicant/ucode.c b/package/network/services/hostapd/src/wpa_supplicant/ucode.c
index 761649498c..fd0d3405c9 100644
--- a/package/network/services/hostapd/src/wpa_supplicant/ucode.c
+++ b/package/network/services/hostapd/src/wpa_supplicant/ucode.c
@@ -157,6 +157,64 @@ void wpas_ucode_event(struct wpa_supplicant *wpa_s, int event, union wpa_event_d
 	ucv_put(wpa_ucode_call(4));
 }
 
+void wpas_ucode_wps_complete(struct wpa_supplicant *wpa_s,
+			     const struct wps_credential *cred)
+{
+#ifdef CONFIG_WPS
+	uc_value_t *val;
+	char *ifname, *encryption, *ssid, *key;
+	size_t ifname_len;
+
+	if (!cred)
+		return;
+
+	switch (cred->auth_type) {
+	case WPS_AUTH_WPAPSK | WPS_AUTH_WPA2PSK:
+	case WPS_AUTH_WPA2PSK:
+		encryption = "psk2";
+		break;
+	case WPS_AUTH_WPAPSK:
+		encryption = "psk";
+		break;
+	case WPS_AUTH_OPEN:
+		encryption = "none";
+		break;
+	default:
+		wpa_printf(MSG_DEBUG, "WPS: Ignored credentials for "
+			   "unsupported authentication type 0x%x",
+			   cred->auth_type);
+		return;
+	}
+
+	if (cred->auth_type != WPS_AUTH_OPEN &&
+	    (cred->key_len < 8 || cred->key_len > 2 * PMK_LEN)) {
+		wpa_printf(MSG_ERROR, "WPS: Reject PSK credential with "
+			   "invalid Network Key length %lu",
+			   (unsigned long) cred->key_len);
+		return;
+	}
+
+	val = wpa_ucode_registry_get(iface_registry, wpa_s->ucode.idx);
+	if (!val)
+		return;
+
+	if (wpa_ucode_call_prepare("wps_credentials"))
+		return;
+
+	uc_value_push(ucv_string_new(wpa_s->ifname));
+	uc_value_push(ucv_get(val));
+
+	val = ucv_object_new(vm);
+	uc_value_push(val);
+
+	ucv_object_add(val, "encryption", ucv_string_new(encryption));
+	ucv_object_add(val, "ssid", ucv_string_new_length(cred->ssid, cred->ssid_len));
+	ucv_object_add(val, "key", ucv_string_new_length(cred->key, cred->key_len));
+
+	ucv_put(wpa_ucode_call(3));
+#endif /* CONFIG_WPS */
+}
+
 static const char *obj_stringval(uc_value_t *obj, const char *name)
 {
 	uc_value_t *val = ucv_object_get(obj, name, NULL);
diff --git a/package/network/services/hostapd/src/wpa_supplicant/ucode.h b/package/network/services/hostapd/src/wpa_supplicant/ucode.h
index fd339fa3e9..de9930bec5 100644
--- a/package/network/services/hostapd/src/wpa_supplicant/ucode.h
+++ b/package/network/services/hostapd/src/wpa_supplicant/ucode.h
@@ -3,9 +3,11 @@
 
 #include "utils/ucode.h"
 
+struct wpa_bss;
 struct wpa_global;
 union wpa_event_data;
 struct wpa_supplicant;
+struct wps_credential;
 
 struct wpas_ucode_bss {
 #ifdef UCODE_SUPPORT
@@ -21,6 +23,8 @@ void wpas_ucode_free_bss(struct wpa_supplicant *wpa_s);
 void wpas_ucode_update_state(struct wpa_supplicant *wpa_s);
 void wpas_ucode_event(struct wpa_supplicant *wpa_s, int event, union wpa_event_data *data);
 bool wpas_ucode_bss_allowed(struct wpa_supplicant *wpa_s, struct wpa_bss *bss);
+void wpas_ucode_wps_complete(struct wpa_supplicant *wpa_s,
+			     const struct wps_credential *cred);
 #else
 static inline int wpas_ucode_init(struct wpa_global *gl)
 {
@@ -49,6 +53,10 @@ static inline bool wpas_ucode_bss_allowed(struct wpa_supplicant *wpa_s, struct w
 {
 	return true;
 }
+
+static inline void wpas_ucode_wps_complete(struct wpa_supplicant *wpa_s, const struct wps_credential *cred)
+{
+}
 #endif
 
 #endif
diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index 0c8a5d8aa5..469c0626ee 100644
--- a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -9,11 +9,6 @@ board=$(board_name)
 case "$FIRMWARE" in
 "ath10k/pre-cal-pci-0000:01:00.0.bin")
 	case "$board" in
-	asus,map-ac2200)
-		caldata_extract_ubi "Factory" 0x9000 0x2f20
-		ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
-			/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
-		;;
 	asus,rt-ac42u)
 		caldata_extract_ubi "Factory" 0x9000 0x2f20
 		;;
@@ -48,7 +43,6 @@ case "$FIRMWARE" in
 	;;
 "ath10k/pre-cal-ahb-a000000.wifi.bin")
 	case "$board" in
-	asus,map-ac2200|\
 	asus,rt-ac42u)
 		caldata_extract_ubi "Factory" 0x1000 0x2f20
 		;;
@@ -143,9 +137,6 @@ case "$FIRMWARE" in
 	;;
 "ath10k/pre-cal-ahb-a800000.wifi.bin")
 	case "$board" in
-	asus,map-ac2200)
-		caldata_extract_ubi "Factory" 0x5000 0x2f20
-		;;
 	avm,fritzbox-4040)
 		/usr/bin/fritz_cal_extract -i 1 -s 0x400 -e 0x208 -l 12064 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader_config")
 		;;
diff --git a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
index 092f9da440..12d9b4eeec 100644
--- a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
+++ b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
@@ -2,11 +2,6 @@
 
 preinit_set_mac_address() {
 	case $(board_name) in
-	asus,map-ac2200)
-		base_mac=$(mtd_get_mac_binary_ubi Factory 0x1006)
-		ip link set dev eth0 address $(macaddr_add "$base_mac" 1)
-		ip link set dev eth1 address $(macaddr_add "$base_mac" 3)
-		;;
 	asus,rt-ac42u)
 		base_mac=$(mtd_get_mac_binary_ubi Factory 0x1006)
 		ip link set dev eth0 address $base_mac
diff --git a/target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4019-map-ac2200.dts b/target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4019-map-ac2200.dts
index 497e38f018..f64ffd8522 100644
--- a/target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4019-map-ac2200.dts
+++ b/target/linux/ipq40xx/files-6.12/arch/arm/boot/dts/qcom/qcom-ipq4019-map-ac2200.dts
@@ -15,9 +15,8 @@
 		led-failsafe = &led_red0;
 		led-running = &led_blue0;
 		led-upgrade = &led_red0;
-		// TODO: Verify if the ethernet0 alias is needed
-		ethernet0 = &gmac;
 		ethernet1 = &swport4;
+		label-mac-device = &wifi0;
 	};
 
 	soc {
@@ -117,13 +116,46 @@
 			};
 
 			partition@400000 {
-				label = "ubi";
+				compatible = "linux,ubi";
 				reg = <0x400000 0x7c00000>;
+				label = "ubi";
+
+				volumes {
+					ubi_factory: ubi-volume-factory {
+						volname = "Factory";
+					};
+				};
 			};
 		};
 	};
 };
 
+&ubi_factory {
+	nvmem-layout {
+		compatible = "fixed-layout";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		precal_factory_1000: precal@1000 {
+			reg = <0x1000 0x2f20>;
+		};
+
+		macaddr_factory_1006: macaddr@1006 {
+			compatible = "mac-base";
+			reg = <0x1006 0x6>;
+			#nvmem-cell-cells = <1>;
+		};
+
+		precal_factory_5000: precal@5000 {
+			reg = <0x5000 0x2f20>;
+		};
+
+		precal_factory_9000: precal@9000 {
+			reg = <0x9000 0x2f20>;
+		};
+	};
+};
+
 &tlmm {
 	i2c_0_pins: i2c_0_pinmux {
 		pinmux {
@@ -192,11 +224,15 @@
 
 &wifi0 {
 	status = "okay";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_factory_1000>;
 	qcom,ath10k-calibration-variant = "ASUS-MAP-AC2200";
 };
 
 &wifi1 {
 	status = "okay";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_factory_5000>;
 	qcom,ath10k-calibration-variant = "ASUS-MAP-AC2200";
 	ieee80211-freq-limit = <5470000 5875000>;
 };
@@ -212,7 +248,10 @@
 		compatible = "qcom,ath10k";
 		reg = <0x00010000 0 0 0 0>;
 		ieee80211-freq-limit = <5170000 5350000>;
+		nvmem-cell-names = "pre-calibration";
+		nvmem-cells = <&precal_factory_9000>;
 		qcom,ath10k-calibration-variant = "ASUS-MAP-AC2200";
+		status = "okay";
 	};
 };
 
@@ -340,6 +379,8 @@
 
 &gmac {
 	status = "okay";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_factory_1006 1>;
 };
 
 &switch {
@@ -348,6 +389,8 @@
 
 &swport4 {
 	status = "okay";
+	nvmem-cell-names = "mac-address";
+	nvmem-cells = <&macaddr_factory_1006 3>;
 
 	label = "wan";
 };
diff --git a/target/linux/mediatek/dts/mt7622-netgear-wax206.dts b/target/linux/mediatek/dts/mt7622-netgear-wax206.dts
index 6399743223..adb9e3bd82 100644
--- a/target/linux/mediatek/dts/mt7622-netgear-wax206.dts
+++ b/target/linux/mediatek/dts/mt7622-netgear-wax206.dts
@@ -208,7 +208,7 @@
 			reg = <7>;
 			reset-gpios = <&pio 101 GPIO_ACTIVE_LOW>;
 			interrupt-parent = <&pio>;
-			interrupts = <52 IRQ_TYPE_LEVEL_HIGH>;
+			interrupts = <77 IRQ_TYPE_LEVEL_LOW>;
 			reset-assert-us = <100000>;
 			reset-deassert-us = <100000>;
 		};
diff --git a/target/linux/mediatek/dts/mt7986a-acer-predator-w6x-stock.dts b/target/linux/mediatek/dts/mt7986a-acer-predator-w6x-stock.dts
new file mode 100644
index 0000000000..68b3481dd8
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-acer-predator-w6x-stock.dts
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7986a-acer-predator-w6x.dtsi"
+
+/ {
+	model = "Acer Predator Connect W6x (Stock Layout)";
+	compatible = "acer,predator-w6x-stock", "mediatek,mt7986a";
+};
+
+&partitions {
+	partition@600000 {
+		label = "dual";
+		reg = <0x600000 0x100000>;
+		read-only;
+	};
+
+	partition@700000 {
+		label = "pot";
+		reg = <0x700000 0x100000>;
+		read-only;
+	};
+
+	partition@800000 {
+		label = "ubi";
+		reg = <0x800000 0x6400000>;
+	};
+
+	partition@6C00000 {
+		label = "ubi1";
+		reg = <0x6C00000 0x6400000>;
+	};
+
+	partition@D000000 {
+		label = "storage";
+		reg = <0xD000000 0x800000>;
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7986a-acer-predator-w6x-ubootmod.dts b/target/linux/mediatek/dts/mt7986a-acer-predator-w6x-ubootmod.dts
new file mode 100644
index 0000000000..e7920f515d
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-acer-predator-w6x-ubootmod.dts
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7986a-acer-predator-w6x.dtsi"
+
+/ {
+	model = "Acer Predator Connect W6x (OpenWrt U-Boot Layout)";
+	compatible = "acer,predator-w6x-ubootmod", "mediatek,mt7986a";
+};
+
+&chosen {
+	rootdisk = <&ubi_rootdisk>;
+	bootargs-append = " root=/dev/fit0 rootwait";
+};
+
+&partitions {
+	partition@600000 {
+		label = "ubi";
+		reg = <0x600000 0xD200000>;
+		compatible = "linux,ubi";
+
+		volumes {
+			ubi_rootdisk: ubi-volume-fit {
+				volname = "fit";
+			};
+		};
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7986a-acer-predator-w6x.dts b/target/linux/mediatek/dts/mt7986a-acer-predator-w6x.dtsi
similarity index 89%
rename from target/linux/mediatek/dts/mt7986a-acer-predator-w6x.dts
rename to target/linux/mediatek/dts/mt7986a-acer-predator-w6x.dtsi
index b72cf7ecc3..7581716c86 100644
--- a/target/linux/mediatek/dts/mt7986a-acer-predator-w6x.dts
+++ b/target/linux/mediatek/dts/mt7986a-acer-predator-w6x.dtsi
@@ -9,14 +9,11 @@
 #include "mt7986a.dtsi"
 
 / {
-	model = "Acer Predator Connect W6x";
-	compatible = "acer,predator-w6x", "mediatek,mt7986a";
-
 	aliases {
 		serial0 = &uart0;
 	};
 
-    chosen {
+	chosen: chosen {
 		stdout-path = "serial0:115200n8";
 	};
 
@@ -56,15 +53,14 @@
 		compatible = "gpio-keys";
 
 		factory {
-			label = "factory";
+			label = "reset";
 			linux,code = <KEY_RESTART>;
-			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
 		};
-
 		wps {
 			label = "wps";
 			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
 		};
 	};
 };
@@ -159,12 +155,12 @@
 		conf-pu {
 			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
 			drive-strength = <MTK_DRIVE_8mA>;
-			bias-disable; /* bias-disable */
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
 		};
 		conf-pd {
 			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
 			drive-strength = <MTK_DRIVE_8mA>;
-			bias-disable; /* bias-disable */
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
 		};
 	};
 
@@ -225,7 +221,7 @@
 		spi-tx-bus-width = <4>;
 		spi-rx-bus-width = <4>;
 
-		partitions {
+		partitions: partitions {
 			compatible = "fixed-partitions";
 			#address-cells = <1>;
 			#size-cells = <1>;
@@ -268,33 +264,6 @@
 				reg = <0x580000 0x20000>;
 				read-only;
 			};
-
-			partition@600000 {
-				label = "dual";
-				reg = <0x600000 0x100000>;
-				read-only;
-			};
-
-			partition@700000 {
-				label = "pot";
-				reg = <0x700000 0x100000>;
-				read-only;
-			};
-
-			partition@800000 {
-				label = "ubi";
-				reg = <0x800000 0x6400000>;
-			};
-
-			partition@6C00000 {
-				label = "ubi1";
-				reg = <0x6C00000 0x6400000>;
-			};
-
-			partition@D000000 {
-				label = "storage";
-				reg = <0xD000000 0x800000>;
-			};
 		};
 	};
 };
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds b/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
index 2443ab5407..8a00ec3b94 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
@@ -16,7 +16,8 @@ acer,predator-w6d)
 	ucidef_set_led_netdev "internet" "INTERNET" "mdio-bus:06:amber:wan" "eth1" "link_10 link_100 link_1000 tx rx"
 	ucidef_set_led_netdev "internet" "INTERNET" "mdio-bus:06:green:wan" "eth1" "link_2500 tx rx"
 	;;
-acer,predator-w6x)
+acer,predator-w6x-stock|\
+acer,predator-w6x-ubootmod)
 	ucidef_set_led_netdev "wan" "wan" "rgb:status" "eth1"
 	;;
 asus,rt-ax52|\
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
index 0fdb44b986..faa06a5057 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
@@ -27,7 +27,8 @@ mediatek_setup_interfaces()
 	acer,predator-w6d)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 game" eth1
 		;;
-	acer,predator-w6x)
+	acer,predator-w6x-stock|\
+	acer,predator-w6x-ubootmod)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" eth1
 		;;
 	acer,vero-w6m)
@@ -186,7 +187,8 @@ mediatek_setup_macs()
 		wan_mac=$(mmc_get_mac_ascii u-boot-env WANMAC)
 		lan_mac=$(mmc_get_mac_ascii u-boot-env LANMAC)
 		;;
-	acer,predator-w6x)
+	acer,predator-w6x-stock|\
+	acer,predator-w6x-ubootmod)
 		wan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		lan_mac=$(macaddr_add "$wan_mac" 1)
 		label_mac=$wan_mac
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
index 93a3e86a16..0516889959 100644
--- a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -27,7 +27,8 @@ case "$board" in
 		[ "$PHYNBR" = "0" ] && mmc_get_mac_ascii u-boot-env 2gMAC > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && mmc_get_mac_ascii u-boot-env 5gMAC > /sys${DEVPATH}/macaddress
 		;;
-	acer,predator-w6x)
+	acer,predator-w6x-stock|\
+	acer,predator-w6x-ubootmod)
 		hw_mac_addr="$(mtd_get_mac_ascii u-boot-env ethaddr)"
 		[ "$PHYNBR" = "0" ] && macaddr_add $hw_mac_addr 2 > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && macaddr_add $hw_mac_addr 3 > /sys${DEVPATH}/macaddress
diff --git a/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh b/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
index f5032a2a36..f9401b0389 100644
--- a/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
+++ b/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
@@ -12,7 +12,8 @@ preinit_set_mac_address() {
 		ip link set dev game address "$lan_mac"
 		ip link set dev eth1 address "$wan_mac"
 		;;
-	acer,predator-w6x)
+	acer,predator-w6x-stock|\
+	acer,predator-w6x-ubootmod)
 		wan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		lan_mac=$(macaddr_add "$wan_mac" 1)
 		ip link set dev lan1 address "$lan_mac"
diff --git a/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh b/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
index 10cd2dfb82..24388b0336 100755
--- a/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
@@ -79,6 +79,7 @@ platform_do_upgrade() {
 
 	case "$board" in
 	abt,asr3000|\
+	acer,predator-w6x-ubootmod|\
 	asus,zenwifi-bt8-ubootmod|\
 	bananapi,bpi-r3|\
 	bananapi,bpi-r3-mini|\
@@ -153,7 +154,8 @@ platform_do_upgrade() {
 	cudy,re3000-v1|\
 	cudy,wr3000-v1|\
 	yuncore,ax835|\
-	wavlink,wl-wn573hx3)
+	wavlink,wl-wn573hx3|\
+	totolink,x6000r)
 		default_do_upgrade "$1"
 		;;
 	dlink,aquila-pro-ai-m30-a1|\
@@ -243,6 +245,7 @@ platform_check_image() {
 
 	case "$board" in
 	abt,asr3000|\
+	acer,predator-w6x-ubootmod|\
 	asus,zenwifi-bt8-ubootmod|\
 	bananapi,bpi-r3|\
 	bananapi,bpi-r3-mini|\
diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index fe14b75ca8..e1026180c7 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -193,10 +193,11 @@ define Device/acer_predator-w6d
 endef
 TARGET_DEVICES += acer_predator-w6d
 
-define Device/acer_predator-w6x
+define Device/acer_predator-w6x-stock
   DEVICE_VENDOR := Acer
-  DEVICE_MODEL := Predator Connect W6x
-  DEVICE_DTS := mt7986a-acer-predator-w6x
+  DEVICE_MODEL := Predator Connect W6x (Stock Layout)
+  DEVICE_DTS := mt7986a-acer-predator-w6x-stock
+  SUPPORTED_DEVICES += acer,predator-w6x
   DEVICE_DTS_DIR := ../dts
   DEVICE_DTS_LOADADDR := 0x47000000
   KERNEL_IN_UBI := 1
@@ -208,7 +209,31 @@ define Device/acer_predator-w6x
 	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
-TARGET_DEVICES += acer_predator-w6x
+TARGET_DEVICES += acer_predator-w6x-stock
+
+define Device/acer_predator-w6x-ubootmod
+  DEVICE_VENDOR := Acer
+  DEVICE_MODEL := Predator Connect W6x (OpenWrt U-Boot Layout)
+  DEVICE_DTS := mt7986a-acer-predator-w6x-ubootmod
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-usb3 kmod-leds-ws2812b kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  IMAGES := sysupgrade.itb
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+        fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7986-bl2 spim-nand-ddr4
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot acer_predator-w6x
+endef
+TARGET_DEVICES += acer_predator-w6x-ubootmod
 
 define Device/acer_vero-w6m
   DEVICE_VENDOR := Acer
diff --git a/target/linux/realtek/base-files/etc/board.d/02_network b/target/linux/realtek/base-files/etc/board.d/02_network
index b8e588f286..70a44d6bac 100644
--- a/target/linux/realtek/base-files/etc/board.d/02_network
+++ b/target/linux/realtek/base-files/etc/board.d/02_network
@@ -160,18 +160,18 @@ realtek_setup_poe()
 	netgear,gs310tp-v1)
 		ucidef_set_poe 55 "$(filter_port_list "$lan_list" "lan9 lan10")"
 		;;
-	zyxel,gs1900-10hp)
+	zyxel,gs1900-10hp-a1)
 		ucidef_set_poe 77 "$(filter_port_list "$lan_list" "lan9 lan10")"
 		;;
-	zyxel,gs1900-8hp-v1|\
-	zyxel,gs1900-8hp-v2)
+	zyxel,gs1900-8hp-a1|\
+	zyxel,gs1900-8hp-b1)
 		ucidef_set_poe 70 "$lan_list"
 		;;
-	zyxel,gs1900-24ep)
+	zyxel,gs1900-24ep-a1)
 		ucidef_set_poe 130 "lan1 lan2 lan3 lan4 lan5 lan6 lan7 lan8 lan9 lan10 lan11 lan12"
 		;;
-	zyxel,gs1900-24hp-v1|\
-	zyxel,gs1900-24hp-v2)
+	zyxel,gs1900-24hp-a1|\
+	zyxel,gs1900-24hp-b1)
 		ucidef_set_poe 170 "$(filter_port_list "$lan_list" "lan25 lan26")"
 		;;
 	esac
diff --git a/target/linux/realtek/base-files/etc/board.d/05_compat-version b/target/linux/realtek/base-files/etc/board.d/05_compat-version
index 52dbdc627e..d448681840 100644
--- a/target/linux/realtek/base-files/etc/board.d/05_compat-version
+++ b/target/linux/realtek/base-files/etc/board.d/05_compat-version
@@ -13,18 +13,18 @@ case "$(board_name)" in
 	hpe,1920-24g-poe-370w)
 		ucidef_set_compat_version "1.1"
 	;;
-	zyxel,gs1900-8-v1 | \
-	zyxel,gs1900-8-v2 | \
-	zyxel,gs1900-8hp-v1 | \
-	zyxel,gs1900-8hp-v2 | \
-	zyxel,gs1900-10hp | \
-	zyxel,gs1900-16 | \
-	zyxel,gs1900-24e | \
-	zyxel,gs1900-24ep | \
-	zyxel,gs1900-24hp-v1 | \
-	zyxel,gs1900-24hp-v2 | \
-	zyxel,gs1900-24-v1 | \
-	zyxel,gs1900-48)
+	zyxel,gs1900-8-a1 | \
+	zyxel,gs1900-8-b1 | \
+	zyxel,gs1900-8hp-a1 | \
+	zyxel,gs1900-8hp-b1 | \
+	zyxel,gs1900-10hp-a1 | \
+	zyxel,gs1900-16-a1 | \
+	zyxel,gs1900-24e-a1 | \
+	zyxel,gs1900-24ep-a1 | \
+	zyxel,gs1900-24hp-a1 | \
+	zyxel,gs1900-24hp-b1 | \
+	zyxel,gs1900-24-a1 | \
+	zyxel,gs1900-48-a1)
 		ucidef_set_compat_version "2.0"
         ;;
 esac