diff --git a/include/image-commands.mk b/include/image-commands.mk
index fdaaadcde7..0ee2656251 100644
--- a/include/image-commands.mk
+++ b/include/image-commands.mk
@@ -226,6 +226,11 @@ define Build/copy-file
 	cat "$(1)" > "$@"
 endef
 
+define Build/dlink-sge-image
+	$(STAGING_DIR_HOST)/bin/dlink-sge-image $(1) $@ $@.enc
+	mv $@.enc $@
+endef
+
 define Build/edimax-header
 	$(STAGING_DIR_HOST)/bin/mkedimaximg -i $@ -o $@.new $(1)
 	@mv $@.new $@
diff --git a/include/prereq-build.mk b/include/prereq-build.mk
index 49340ce3e4..2378f5ad90 100644
--- a/include/prereq-build.mk
+++ b/include/prereq-build.mk
@@ -182,6 +182,7 @@ $(eval $(call SetupHostCommand,perl,Please install Perl 5.x, \
 	perl --version | grep "perl.*v5"))
 
 $(eval $(call SetupHostCommand,python,Please install Python >= 3.7, \
+	python3.12 -V 2>&1 | grep 'Python 3', \
 	python3.11 -V 2>&1 | grep 'Python 3', \
 	python3.10 -V 2>&1 | grep 'Python 3', \
 	python3.9 -V 2>&1 | grep 'Python 3', \
@@ -190,6 +191,7 @@ $(eval $(call SetupHostCommand,python,Please install Python >= 3.7, \
 	python3 -V 2>&1 | grep -E 'Python 3\.([7-9]|[0-9][0-9])\.?'))
 
 $(eval $(call SetupHostCommand,python3,Please install Python >= 3.7, \
+	python3.12 -V 2>&1 | grep 'Python 3', \
 	python3.11 -V 2>&1 | grep 'Python 3', \
 	python3.10 -V 2>&1 | grep 'Python 3', \
 	python3.9 -V 2>&1 | grep 'Python 3', \
diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index bb369a82d9..67fc5d29c1 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -199,7 +199,8 @@ define Package/base-files/install
 		$(1)/usr/lib \
 		$(1)/usr/bin \
 		$(1)/sys \
-		$(1)/www \
+		$(1)/www
+	mkdir -p -m 750 \
 		$(1)/root
 
 	$(LN) /proc/mounts $(1)/etc/mtab
diff --git a/package/kernel/linux/modules/usb.mk b/package/kernel/linux/modules/usb.mk
index ab55b42da8..7acf87c11c 100644
--- a/package/kernel/linux/modules/usb.mk
+++ b/package/kernel/linux/modules/usb.mk
@@ -750,8 +750,9 @@ $(eval $(call KernelPackage,usb-serial-mct))
 
 define KernelPackage/usb-serial-mos7720
   TITLE:=Support for Moschip MOS7720 devices
-  KCONFIG:=CONFIG_USB_SERIAL_MOS7720
+  KCONFIG:=CONFIG_USB_SERIAL_MOS7720 CONFIG_USB_SERIAL_MOS7715_PARPORT=y
   FILES:=$(LINUX_DIR)/drivers/usb/serial/mos7720.ko
+  DEPENDS:=+kmod-ppdev
   AUTOLOAD:=$(call AutoProbe,mos7720)
   $(call AddDepends/usb-serial)
 endef
diff --git a/package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch b/package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
index 4c6b175ebe..23b7340e25 100644
--- a/package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
+++ b/package/kernel/mac80211/patches/ath/400-ath_move_debug_code.patch
@@ -14,7 +14,7 @@
  CFLAGS_trace.o := -I$(src)
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
-@@ -319,14 +319,7 @@ void _ath_dbg(struct ath_common *common,
+@@ -321,14 +321,7 @@ void _ath_dbg(struct ath_common *common,
  #endif /* CPTCFG_ATH_DEBUG */
  
  /** Returns string describing opmode, or NULL if unknown mode. */
diff --git a/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch b/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
index 2f5e75be8a..d23d70b2ce 100644
--- a/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath9k/500-ath9k_eeprom_debugfs.patch
@@ -1,14 +1,24 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1413,6 +1413,54 @@ void ath9k_deinit_debug(struct ath_softc
- 	ath9k_cmn_spectral_deinit_debug(&sc->spec_priv);
- }
+@@ -1471,6 +1471,7 @@ int ath9k_init_debug(struct ath_hw *ah)
  
+ 	ath9k_cmn_debug_base_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
+ 	ath9k_cmn_debug_modal_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
++	ath9k_cmn_debug_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
+ 
+ 	debugfs_create_u32("gpio_mask", 0600,
+ 			   sc->debug.debugfs_phy, &sc->sc_ah->gpio_mask);
+--- a/drivers/net/wireless/ath/ath9k/common-debug.c
++++ b/drivers/net/wireless/ath/ath9k/common-debug.c
+@@ -260,3 +260,58 @@ void ath9k_cmn_debug_phy_err(struct dent
+ 			    &fops_phy_err);
+ }
+ EXPORT_SYMBOL(ath9k_cmn_debug_phy_err);
++
 +static ssize_t read_file_eeprom(struct file *file, char __user *user_buf,
 +			     size_t count, loff_t *ppos)
 +{
-+	struct ath_softc *sc = file->private_data;
-+	struct ath_hw *ah = sc->sc_ah;
++	struct ath_hw *ah = file->private_data;
 +	struct ath_common *common = ath9k_hw_common(ah);
 +	int bytes = 0;
 +	int pos = *ppos;
@@ -52,15 +62,31 @@
 +	.owner = THIS_MODULE
 +};
 +
- int ath9k_init_debug(struct ath_hw *ah)
- {
- 	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1432,6 +1480,8 @@ int ath9k_init_debug(struct ath_hw *ah)
- 	ath9k_tx99_init_debug(sc);
- 	ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
- 
-+	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
++void ath9k_cmn_debug_eeprom(struct dentry *debugfs_phy,
++			    struct ath_hw *ah)
++{
++	debugfs_create_file("eeprom", S_IRUSR, debugfs_phy, ah,
 +			    &fops_eeprom);
- 	debugfs_create_devm_seqfile(sc->dev, "dma", sc->debug.debugfs_phy,
- 				    read_file_dma);
- 	debugfs_create_devm_seqfile(sc->dev, "interrupt", sc->debug.debugfs_phy,
++}
++EXPORT_SYMBOL(ath9k_cmn_debug_eeprom);
+--- a/drivers/net/wireless/ath/ath9k/common-debug.h
++++ b/drivers/net/wireless/ath/ath9k/common-debug.h
+@@ -69,6 +69,8 @@ void ath9k_cmn_debug_modal_eeprom(struct
+ 				  struct ath_hw *ah);
+ void ath9k_cmn_debug_base_eeprom(struct dentry *debugfs_phy,
+ 				 struct ath_hw *ah);
++void ath9k_cmn_debug_eeprom(struct dentry *debugfs_phy,
++			    struct ath_hw *ah);
+ void ath9k_cmn_debug_stat_rx(struct ath_rx_stats *rxstats,
+ 			     struct ath_rx_status *rs);
+ void ath9k_cmn_debug_recv(struct dentry *debugfs_phy,
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+@@ -519,6 +519,7 @@ int ath9k_htc_init_debug(struct ath_hw *
+ 
+ 	ath9k_cmn_debug_base_eeprom(priv->debug.debugfs_phy, priv->ah);
+ 	ath9k_cmn_debug_modal_eeprom(priv->debug.debugfs_phy, priv->ah);
++	ath9k_cmn_debug_eeprom(priv->debug.debugfs_phy, priv->ah);
+ 
+ 	return 0;
+ }
diff --git a/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch b/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
index 94a191e0d8..54abb4d425 100644
--- a/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
@@ -1,70 +1,16 @@
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1461,6 +1461,52 @@ static const struct file_operations fops
- 	.owner = THIS_MODULE
- };
+@@ -1472,6 +1472,7 @@ int ath9k_init_debug(struct ath_hw *ah)
+ 	ath9k_cmn_debug_base_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
+ 	ath9k_cmn_debug_modal_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
+ 	ath9k_cmn_debug_eeprom(sc->debug.debugfs_phy, sc->sc_ah);
++	ath9k_cmn_debug_chanbw(sc->debug.debugfs_phy, sc->sc_ah);
  
-+
-+static ssize_t read_file_chan_bw(struct file *file, char __user *user_buf,
-+			     size_t count, loff_t *ppos)
-+{
-+	struct ath_softc *sc = file->private_data;
-+	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-+	char buf[32];
-+	unsigned int len;
-+
-+	len = sprintf(buf, "0x%08x\n", common->chan_bw);
-+	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-+}
-+
-+static ssize_t write_file_chan_bw(struct file *file, const char __user *user_buf,
-+			     size_t count, loff_t *ppos)
-+{
-+	struct ath_softc *sc = file->private_data;
-+	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-+	unsigned long chan_bw;
-+	char buf[32];
-+	ssize_t len;
-+
-+	len = min(count, sizeof(buf) - 1);
-+	if (copy_from_user(buf, user_buf, len))
-+		return -EFAULT;
-+
-+	buf[len] = '\0';
-+	if (kstrtoul(buf, 0, &chan_bw))
-+		return -EINVAL;
-+
-+	common->chan_bw = chan_bw;
-+	if (!test_bit(ATH_OP_INVALID, &common->op_flags))
-+		ath9k_ops.config(sc->hw, IEEE80211_CONF_CHANGE_CHANNEL);
-+
-+	return count;
-+}
-+
-+static const struct file_operations fops_chanbw = {
-+	.read = read_file_chan_bw,
-+	.write = write_file_chan_bw,
-+	.open = simple_open,
-+	.owner = THIS_MODULE,
-+	.llseek = default_llseek,
-+};
-+
-+
- int ath9k_init_debug(struct ath_hw *ah)
- {
- 	struct ath_common *common = ath9k_hw_common(ah);
-@@ -1482,6 +1528,8 @@ int ath9k_init_debug(struct ath_hw *ah)
- 
- 	debugfs_create_file("eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
- 			    &fops_eeprom);
-+	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
-+			    sc, &fops_chanbw);
- 	debugfs_create_devm_seqfile(sc->dev, "dma", sc->debug.debugfs_phy,
- 				    read_file_dma);
- 	debugfs_create_devm_seqfile(sc->dev, "interrupt", sc->debug.debugfs_phy,
+ 	debugfs_create_u32("gpio_mask", 0600,
+ 			   sc->debug.debugfs_phy, &sc->sc_ah->gpio_mask);
 --- a/drivers/net/wireless/ath/ath.h
 +++ b/drivers/net/wireless/ath/ath.h
-@@ -151,6 +151,7 @@ struct ath_common {
+@@ -153,6 +153,7 @@ struct ath_common {
  	int debug_mask;
  	enum ath_device_state state;
  	unsigned long op_flags;
@@ -72,6 +18,14 @@
  
  	struct ath_ani ani;
  
+@@ -181,6 +182,7 @@ struct ath_common {
+ 	const struct ath_ops *ops;
+ 	const struct ath_bus_ops *bus_ops;
+ 	const struct ath_ps_ops *ps_ops;
++	const struct ieee80211_ops *ieee_ops;
+ 
+ 	bool btcoex_enabled;
+ 	bool disable_ani;
 --- a/drivers/net/wireless/ath/ath9k/common.c
 +++ b/drivers/net/wireless/ath/ath9k/common.c
 @@ -297,11 +297,13 @@ EXPORT_SYMBOL(ath9k_cmn_get_hw_crypto_ke
@@ -123,3 +77,115 @@
  
  	return channel;
  }
+--- a/drivers/net/wireless/ath/ath9k/common-debug.c
++++ b/drivers/net/wireless/ath/ath9k/common-debug.c
+@@ -316,3 +316,55 @@ void ath9k_cmn_debug_eeprom(struct dentr
+ 			    &fops_eeprom);
+ }
+ EXPORT_SYMBOL(ath9k_cmn_debug_eeprom);
++
++static ssize_t read_file_chan_bw(struct file *file, char __user *user_buf,
++			     size_t count, loff_t *ppos)
++{
++	struct ath_hw *ah = file->private_data;
++	struct ath_common *common = ath9k_hw_common(ah);
++	char buf[32];
++	unsigned int len;
++
++	len = sprintf(buf, "0x%08x\n", common->chan_bw);
++	return simple_read_from_buffer(user_buf, count, ppos, buf, len);
++}
++
++static ssize_t write_file_chan_bw(struct file *file, const char __user *user_buf,
++			     size_t count, loff_t *ppos)
++{
++	struct ath_hw *ah = file->private_data;
++	struct ath_common *common = ath9k_hw_common(ah);
++	unsigned long chan_bw;
++	char buf[32];
++	ssize_t len;
++
++	len = min(count, sizeof(buf) - 1);
++	if (copy_from_user(buf, user_buf, len))
++		return -EFAULT;
++
++	buf[len] = '\0';
++	if (kstrtoul(buf, 0, &chan_bw))
++		return -EINVAL;
++
++	common->chan_bw = chan_bw;
++	if (!test_bit(ATH_OP_INVALID, &common->op_flags))
++		common->ieee_ops->config(ah->hw, IEEE80211_CONF_CHANGE_CHANNEL);
++
++	return count;
++}
++
++static const struct file_operations fops_chanbw = {
++	.read = read_file_chan_bw,
++	.write = write_file_chan_bw,
++	.open = simple_open,
++	.owner = THIS_MODULE,
++	.llseek = default_llseek,
++};
++
++void ath9k_cmn_debug_chanbw(struct dentry *debugfs_phy,
++			    struct ath_hw *ah)
++{
++	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, debugfs_phy, ah,
++			    &fops_chanbw);
++}
++EXPORT_SYMBOL(ath9k_cmn_debug_chanbw);
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+@@ -520,6 +520,7 @@ int ath9k_htc_init_debug(struct ath_hw *
+ 	ath9k_cmn_debug_base_eeprom(priv->debug.debugfs_phy, priv->ah);
+ 	ath9k_cmn_debug_modal_eeprom(priv->debug.debugfs_phy, priv->ah);
+ 	ath9k_cmn_debug_eeprom(priv->debug.debugfs_phy, priv->ah);
++	ath9k_cmn_debug_chanbw(priv->debug.debugfs_phy, priv->ah);
+ 
+ 	return 0;
+ }
+--- a/drivers/net/wireless/ath/ath9k/common-debug.h
++++ b/drivers/net/wireless/ath/ath9k/common-debug.h
+@@ -71,6 +71,8 @@ void ath9k_cmn_debug_base_eeprom(struct
+ 				 struct ath_hw *ah);
+ void ath9k_cmn_debug_eeprom(struct dentry *debugfs_phy,
+ 			    struct ath_hw *ah);
++void ath9k_cmn_debug_chanbw(struct dentry *debugfs_phy,
++			    struct ath_hw *ah);
+ void ath9k_cmn_debug_stat_rx(struct ath_rx_stats *rxstats,
+ 			     struct ath_rx_status *rs);
+ void ath9k_cmn_debug_recv(struct dentry *debugfs_phy,
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -631,6 +631,7 @@ static int ath9k_init_priv(struct ath9k_
+ 	priv->ah = ah;
+ 
+ 	common = ath9k_hw_common(ah);
++	common->ieee_ops = &ath9k_htc_ops;
+ 	common->ops = &ah->reg_ops;
+ 	common->ps_ops = &ath9k_htc_ps_ops;
+ 	common->bus_ops = &ath9k_usb_bus_ops;
+@@ -746,9 +747,9 @@ static void ath9k_set_hw_capab(struct at
+ 
+ 	hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN |
+ 			    WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+-			    WIPHY_FLAG_HAS_CHANNEL_SWITCH;
+-
+-	hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS;
++			    WIPHY_FLAG_HAS_CHANNEL_SWITCH |
++			    WIPHY_FLAG_SUPPORTS_5_10_MHZ |
++			    WIPHY_FLAG_SUPPORTS_TDLS;
+ 
+ 	hw->queues = 4;
+ 	hw->max_listen_interval = 1;
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -733,6 +733,7 @@ static int ath9k_init_softc(u16 devid, s
+ 	if (!ath9k_is_chanctx_enabled())
+ 		sc->cur_chan->hw_queue_base = 0;
+ 
++	common->ieee_ops = &ath9k_ops;
+ 	common->ops = &ah->reg_ops;
+ 	common->bus_ops = bus_ops;
+ 	common->ps_ops = &ath9k_ps_ops;
diff --git a/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
index af656b832e..9568b091de 100644
--- a/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
@@ -181,7 +181,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1088,7 +1088,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -1089,7 +1089,7 @@ int ath9k_init_device(u16 devid, struct
  
  #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
@@ -192,9 +192,9 @@
  #endif
 --- a/drivers/net/wireless/ath/ath9k/debug.c
 +++ b/drivers/net/wireless/ath/ath9k/debug.c
-@@ -1506,6 +1506,61 @@ static const struct file_operations fops
- 	.llseek = default_llseek,
- };
+@@ -128,6 +128,61 @@ static const struct file_operations fops
+ 
+ #define DMA_BUF_LEN 1024
  
 +#ifdef CONFIG_MAC80211_LEDS
 +
@@ -252,12 +252,12 @@
 +#endif
 +
  
- int ath9k_init_debug(struct ath_hw *ah)
- {
-@@ -1530,6 +1585,10 @@ int ath9k_init_debug(struct ath_hw *ah)
- 			    &fops_eeprom);
- 	debugfs_create_file("chanbw", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
- 			    sc, &fops_chanbw);
+ static ssize_t read_file_ani(struct file *file, char __user *user_buf,
+ 			     size_t count, loff_t *ppos)
+@@ -1432,6 +1487,10 @@ int ath9k_init_debug(struct ath_hw *ah)
+ 	ath9k_tx99_init_debug(sc);
+ 	ath9k_cmn_spectral_init_debug(&sc->spec_priv, sc->debug.debugfs_phy);
+ 
 +#ifdef CONFIG_MAC80211_LEDS
 +	debugfs_create_file("gpio_led", S_IWUSR,
 +			   sc->debug.debugfs_phy, sc, &fops_gpio_led);
diff --git a/package/kernel/mac80211/patches/rt2x00/000-v6.6-wifi-rt2x00-correct-MAC_SYS_CTRL-register-RX-mask-i.patch b/package/kernel/mac80211/patches/rt2x00/000-v6.6-wifi-rt2x00-correct-MAC_SYS_CTRL-register-RX-mask-i.patch
new file mode 100644
index 0000000000..c84b5a1408
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/000-v6.6-wifi-rt2x00-correct-MAC_SYS_CTRL-register-RX-mask-i.patch
@@ -0,0 +1,28 @@
+From 186f2432741f6d28d86ff723ac7830446affddfc Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sat, 5 Aug 2023 17:17:28 +0800
+Subject: wifi: rt2x00: correct MAC_SYS_CTRL register RX mask in R-Calibration
+
+For MAC_SYS_CTRL register, Bit[2] controls MAC_TX_EN and Bit[3]
+controls MAC_RX_EN (Bit index starts from 0). Therefore, 0x08 is
+the correct mask for RX.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB03150B571B67B896A504AC34BC0EA@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8561,7 +8561,7 @@ static void rt2800_r_calibration(struct
+ 		rt2x00_warn(rt2x00dev, "Wait MAC Tx Status to MAX !!!\n");
+ 
+ 	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
+-	maccfg &= (~0x04);
++	maccfg &= (~0x08);
+ 	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
+ 
+ 	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_RX)))
diff --git a/package/kernel/mac80211/patches/rt2x00/997-wifi-rt2x00-limit-MT7620-TX-power-based-on-eeprom-ca.patch b/package/kernel/mac80211/patches/rt2x00/001-v6.6-wifi-rt2x00-limit-MT7620-TX-power-based-on-eeprom.patch
similarity index 73%
rename from package/kernel/mac80211/patches/rt2x00/997-wifi-rt2x00-limit-MT7620-TX-power-based-on-eeprom-ca.patch
rename to package/kernel/mac80211/patches/rt2x00/001-v6.6-wifi-rt2x00-limit-MT7620-TX-power-based-on-eeprom.patch
index fd1b3d8bf3..aa843d4219 100644
--- a/package/kernel/mac80211/patches/rt2x00/997-wifi-rt2x00-limit-MT7620-TX-power-based-on-eeprom-ca.patch
+++ b/package/kernel/mac80211/patches/rt2x00/001-v6.6-wifi-rt2x00-limit-MT7620-TX-power-based-on-eeprom.patch
@@ -1,7 +1,7 @@
+From 821b5192c955144bd2f0aeea6cd153e1aedd16e1 Mon Sep 17 00:00:00 2001
 From: Shiji Yang <yangshiji66@outlook.com>
-Date: Sat, 22 Jul 2023 21:56:30 +0800
-Subject: [PATCH] wifi: rt2x00: limit MT7620 TX power based on eeprom
- calibration
+Date: Fri, 11 Aug 2023 14:34:54 +0800
+Subject: wifi: rt2x00: limit MT7620 TX power based on eeprom calibration
 
 In the vendor driver, the current channel power is queried from
 EEPROM_TXPOWER_BG1 and EEPROM_TXPOWER_BG2. And then the mixed value
@@ -18,29 +18,36 @@ Based on these eeprom values, this patch adds basic TX power control
 for the MT7620 and limits its maximum TX power. This can avoid the
 link speed decrease caused by chip overheating. rt2800_config_alc()
 function has also been renamed to rt2800_config_alc_rt6352() because
-it's only used by RT6352(MT7620).
+it's only used by RT6352 (MT7620).
 
 Notice:
 It's still need some work to sync the max channel power to the user
-interface. This part is missing from the rt2x00 driver structure. If
+interface. This part is missing from the rt2x00 driver framework. If
 we set the power exceed the calibration value, it won't take effect.
 
 Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB03159090ED14044215E59FD6BC10A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
 ---
- .../net/wireless/ralink/rt2x00/rt2800lib.c    | 49 +++++++++++++------
- 1 file changed, 34 insertions(+), 15 deletions(-)
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 57 ++++++++++++++++++--------
+ 1 file changed, 40 insertions(+), 17 deletions(-)
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3891,28 +3891,47 @@ static void rt2800_config_channel_rf7620
+@@ -3865,28 +3865,51 @@ static void rt2800_config_channel_rf7620
  	}
  }
  
 -static void rt2800_config_alc(struct rt2x00_dev *rt2x00dev,
-+static void rt2800_config_alc_rt6352(struct rt2x00_dev *rt2x00dev,
- 			      struct ieee80211_channel *chan,
- 			      int power_level) {
+-			      struct ieee80211_channel *chan,
+-			      int power_level) {
 -	u16 eeprom, target_power, max_power;
++static void rt2800_config_alc_rt6352(struct rt2x00_dev *rt2x00dev,
++				     struct ieee80211_channel *chan,
++				     int power_level)
++{
++	int cur_channel = rt2x00dev->rf_channel;
 +	u16 eeprom, chan_power, rate_power, target_power;
 +	u16 tx_power[2];
 +	s8 *power_group[2];
@@ -57,27 +64,29 @@ Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
 -	max_power = chan->max_power * 2;
 -	if (max_power > 0x2f)
 -		max_power = 0x2f;
-+	/* get per channel power, 2 channels in total, unit is 0.5dBm */
++	if (WARN_ON(cur_channel < 1 || cur_channel > 14))
++		return;
++
++	/* get per chain power, 2 chains in total, unit is 0.5dBm */
 +	power_level = (power_level - 3) * 2;
-+	/*
-+	 * We can't get the accurate TX power. Based on some tests, the real
++
++	/* We can't get the accurate TX power. Based on some tests, the real
 +	 * TX power is approximately equal to channel_power + (max)rate_power.
 +	 * Usually max rate_power is the gain of the OFDM 6M rate. The antenna
 +	 * gain and externel PA gain are not included as we are unable to
 +	 * obtain these values.
 +	 */
 +	rate_power = rt2800_eeprom_read_from_array(rt2x00dev,
-+				EEPROM_TXPOWER_BYRATE, 1) & 0x3f;
++						   EEPROM_TXPOWER_BYRATE, 1);
++	rate_power &= 0x3f;
 +	power_level -= rate_power;
 +	if (power_level < 1)
 +		power_level = 1;
-+	if (power_level > chan->max_power * 2)
-+		power_level = chan->max_power * 2;
 +
 +	power_group[0] = rt2800_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG1);
 +	power_group[1] = rt2800_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_BG2);
 +	for (cnt = 0; cnt < 2; cnt++) {
-+		chan_power = power_group[cnt][rt2x00dev->rf_channel - 1];
++		chan_power = power_group[cnt][cur_channel - 1];
 +		if (chan_power >= 0x20 || chan_power == 0)
 +			chan_power = 0x10;
 +		tx_power[cnt] = power_level < chan_power ? power_level : chan_power;
@@ -95,7 +104,7 @@ Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
  
  	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1);
  	if (rt2x00_get_field16(eeprom, EEPROM_NIC_CONF1_INTERNAL_TX_ALC)) {
-@@ -5321,7 +5340,7 @@ static void rt2800_config_txpower_rt6352
+@@ -5268,7 +5291,7 @@ static void rt2800_config_txpower_rt6352
  	rt2x00_set_field32(&pwreg, TX_PWR_CFG_9B_STBC_MCS7, t);
  	rt2800_register_write(rt2x00dev, TX_PWR_CFG_9, pwreg);
  
diff --git a/package/kernel/mac80211/patches/rt2x00/999-wifi-rt2x00-fix-MT7620-low-RSSI-issue.patch b/package/kernel/mac80211/patches/rt2x00/002-v6.7-wifi-rt2x00-fix-MT7620-low-RSSI-issue.patch
similarity index 76%
rename from package/kernel/mac80211/patches/rt2x00/999-wifi-rt2x00-fix-MT7620-low-RSSI-issue.patch
rename to package/kernel/mac80211/patches/rt2x00/002-v6.7-wifi-rt2x00-fix-MT7620-low-RSSI-issue.patch
index 8f7343d14e..ffb66559d1 100644
--- a/package/kernel/mac80211/patches/rt2x00/999-wifi-rt2x00-fix-MT7620-low-RSSI-issue.patch
+++ b/package/kernel/mac80211/patches/rt2x00/002-v6.7-wifi-rt2x00-fix-MT7620-low-RSSI-issue.patch
@@ -1,6 +1,7 @@
+From 2ecfe6f07e8e6257cad3d3290c5aec2102120041 Mon Sep 17 00:00:00 2001
 From: Shiji Yang <yangshiji66@outlook.com>
-Date: Sat, 23 Sep 2023 07:51:39 +0800
-Subject: [PATCH] wifi: rt2x00: fix MT7620 low RSSI issue
+Date: Sat, 23 Sep 2023 09:01:01 +0800
+Subject: wifi: rt2x00: fix MT7620 low RSSI issue
 
 On Mediatek vendor driver[1], MT7620 (RT6352) uses different RSSI
 base value '-2' compared to the other RT2x00 chips. This patch
@@ -10,13 +11,16 @@ reports on MT7620.
 [1] Found on MT76x2E_MT7620_LinuxAP_V3.0.4.0_P3 ConvertToRssi().
 
 Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB031571CDB146C414A908A66DBCFEA@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
 ---
  drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 7 ++++---
  1 file changed, 4 insertions(+), 3 deletions(-)
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -875,6 +875,7 @@ static int rt2800_agc_to_rssi(struct rt2
+@@ -856,6 +856,7 @@ static int rt2800_agc_to_rssi(struct rt2
  	s8 rssi0 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI0);
  	s8 rssi1 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI1);
  	s8 rssi2 = rt2x00_get_field32(rxwi_w2, RXWI_W2_RSSI2);
@@ -24,7 +28,7 @@ Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
  	u16 eeprom;
  	u8 offset0;
  	u8 offset1;
-@@ -899,9 +900,9 @@ static int rt2800_agc_to_rssi(struct rt2
+@@ -880,9 +881,9 @@ static int rt2800_agc_to_rssi(struct rt2
  	 * If the value in the descriptor is 0, it is considered invalid
  	 * and the default (extremely low) rssi value is assumed
  	 */
diff --git a/package/kernel/mac80211/patches/rt2x00/003-v6.7-wifi-rt2x00-fix-rt2800-watchdog-function.patch b/package/kernel/mac80211/patches/rt2x00/003-v6.7-wifi-rt2x00-fix-rt2800-watchdog-function.patch
new file mode 100644
index 0000000000..f253dacf2b
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/003-v6.7-wifi-rt2x00-fix-rt2800-watchdog-function.patch
@@ -0,0 +1,78 @@
+From 69708fbb2c698f262e03360d064c7066e0679953 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sat, 14 Oct 2023 14:55:01 +0800
+Subject: wifi: rt2x00: fix rt2800 watchdog function
+
+The watchdog function is broken on rt2800 series SoCs. This patch
+fixes the incorrect watchdog logic to make it work again.
+
+1. Update current wdt queue index if it's not equal to the previous
+   index. Watchdog compares the current and previous queue index to
+   judge if the queue hung.
+2. Make sure hung_{rx,tx} 'true' status won't be override by the
+   normal queue. Any queue hangs should trigger a reset action.
+3. Clear the watchdog counter of all queues before resetting the
+   hardware. This change may help to avoid the reset loop.
+4. Change hang check function return type to bool as we only need
+   to return two status, yes or no.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB0315BC1D83D31154924F0D39BCD1A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1237,13 +1237,14 @@ void rt2800_txdone_nostatus(struct rt2x0
+ }
+ EXPORT_SYMBOL_GPL(rt2800_txdone_nostatus);
+ 
+-static int rt2800_check_hung(struct data_queue *queue)
++static bool rt2800_check_hung(struct data_queue *queue)
+ {
+ 	unsigned int cur_idx = rt2800_drv_get_dma_done(queue);
+ 
+-	if (queue->wd_idx != cur_idx)
++	if (queue->wd_idx != cur_idx) {
++		queue->wd_idx = cur_idx;
+ 		queue->wd_count = 0;
+-	else
++	} else
+ 		queue->wd_count++;
+ 
+ 	return queue->wd_count > 16;
+@@ -1280,7 +1281,7 @@ void rt2800_watchdog(struct rt2x00_dev *
+ 		case QID_MGMT:
+ 			if (rt2x00queue_empty(queue))
+ 				continue;
+-			hung_tx = rt2800_check_hung(queue);
++			hung_tx = hung_tx || rt2800_check_hung(queue);
+ 			break;
+ 		case QID_RX:
+ 			/* For station mode we should reactive at least
+@@ -1289,7 +1290,7 @@ void rt2800_watchdog(struct rt2x00_dev *
+ 			 */
+ 			if (rt2x00dev->intf_sta_count == 0)
+ 				continue;
+-			hung_rx = rt2800_check_hung(queue);
++			hung_rx = hung_rx || rt2800_check_hung(queue);
+ 			break;
+ 		default:
+ 			break;
+@@ -1302,8 +1303,12 @@ void rt2800_watchdog(struct rt2x00_dev *
+ 	if (hung_rx)
+ 		rt2x00_warn(rt2x00dev, "Watchdog RX hung detected\n");
+ 
+-	if (hung_tx || hung_rx)
++	if (hung_tx || hung_rx) {
++		queue_for_each(rt2x00dev, queue)
++			queue->wd_count = 0;
++
+ 		ieee80211_restart_hw(rt2x00dev->hw);
++	}
+ }
+ EXPORT_SYMBOL_GPL(rt2800_watchdog);
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/004-1-v6.7-wifi-rt2x00-improve-MT7620-register-initialization.patch b/package/kernel/mac80211/patches/rt2x00/004-1-v6.7-wifi-rt2x00-improve-MT7620-register-initialization.patch
new file mode 100644
index 0000000000..9f4dbb8346
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/004-1-v6.7-wifi-rt2x00-improve-MT7620-register-initialization.patch
@@ -0,0 +1,124 @@
+From 1ffe76d5ae78553948d67a978acd9945c2f0a175 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Thu, 19 Oct 2023 19:58:56 +0800
+Subject: wifi: rt2x00: improve MT7620 register initialization
+
+1. Do not hard reset the BBP. We can use soft reset instead. This
+   change has some help to the calibration failure issue.
+2. Enable falling back to legacy rate from the HT/RTS rate by
+   setting the HT_FBK_TO_LEGACY register.
+3. Implement MCS rate specific maximum PSDU size. It can improve
+   the transmission quality under the low RSSI condition.
+4. Set BBP_84 register value to 0x19. This is used for extension
+   channel overlapping IOT.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB031553CCD4B7A3B89C85935DBCD4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800.h     | 18 ++++++++++++++++++
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c  | 24 ++++++++++++++++++++++++
+ drivers/net/wireless/ralink/rt2x00/rt2800mmio.c |  3 +++
+ 3 files changed, 45 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+@@ -871,6 +871,18 @@
+ #define LED_CFG_LED_POLAR		FIELD32(0x40000000)
+ 
+ /*
++ * AMPDU_MAX_LEN_20M1S: Per MCS max A-MPDU length, 20 MHz, MCS 0-7
++ * AMPDU_MAX_LEN_20M2S: Per MCS max A-MPDU length, 20 MHz, MCS 8-15
++ * AMPDU_MAX_LEN_40M1S: Per MCS max A-MPDU length, 40 MHz, MCS 0-7
++ * AMPDU_MAX_LEN_40M2S: Per MCS max A-MPDU length, 40 MHz, MCS 8-15
++ * Maximum A-MPDU length = 2^(AMPDU_MAX - 5) kilobytes
++ */
++#define AMPDU_MAX_LEN_20M1S		0x1030
++#define AMPDU_MAX_LEN_20M2S		0x1034
++#define AMPDU_MAX_LEN_40M1S		0x1038
++#define AMPDU_MAX_LEN_40M2S		0x103C
++
++/*
+  * AMPDU_BA_WINSIZE: Force BlockAck window size
+  * FORCE_WINSIZE_ENABLE:
+  *   0: Disable forcing of BlockAck window size
+@@ -1545,6 +1557,12 @@
+  */
+ #define EXP_ACK_TIME			0x1380
+ 
++/*
++ * HT_FBK_TO_LEGACY: Enable/Disable HT/RTS fallback to OFDM/CCK rate
++ * Not available for legacy SoCs
++ */
++#define HT_FBK_TO_LEGACY		0x1384
++
+ /* TX_PWR_CFG_5 */
+ #define TX_PWR_CFG_5			0x1384
+ #define TX_PWR_CFG_5_MCS16_CH0		FIELD32(0x0000000f)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5851,6 +5851,7 @@ static int rt2800_init_registers(struct
+ 	struct rt2800_drv_data *drv_data = rt2x00dev->drv_data;
+ 	u32 reg;
+ 	u16 eeprom;
++	u8 bbp;
+ 	unsigned int i;
+ 	int ret;
+ 
+@@ -5860,6 +5861,19 @@ static int rt2800_init_registers(struct
+ 	if (ret)
+ 		return ret;
+ 
++	if (rt2x00_rt(rt2x00dev, RT6352)) {
++		rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x01);
++
++		bbp = rt2800_bbp_read(rt2x00dev, 21);
++		bbp |= 0x01;
++		rt2800_bbp_write(rt2x00dev, 21, bbp);
++		bbp = rt2800_bbp_read(rt2x00dev, 21);
++		bbp &= (~0x01);
++		rt2800_bbp_write(rt2x00dev, 21, bbp);
++
++		rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00);
++	}
++
+ 	rt2800_register_write(rt2x00dev, LEGACY_BASIC_RATE, 0x0000013f);
+ 	rt2800_register_write(rt2x00dev, HT_BASIC_RATE, 0x00008003);
+ 
+@@ -6013,6 +6027,14 @@ static int rt2800_init_registers(struct
+ 		reg = rt2800_register_read(rt2x00dev, TX_ALC_CFG_1);
+ 		rt2x00_set_field32(&reg, TX_ALC_CFG_1_ROS_BUSY_EN, 0);
+ 		rt2800_register_write(rt2x00dev, TX_ALC_CFG_1, reg);
++
++		rt2800_register_write(rt2x00dev, AMPDU_MAX_LEN_20M1S, 0x77754433);
++		rt2800_register_write(rt2x00dev, AMPDU_MAX_LEN_20M2S, 0x77765543);
++		rt2800_register_write(rt2x00dev, AMPDU_MAX_LEN_40M1S, 0x77765544);
++		rt2800_register_write(rt2x00dev, AMPDU_MAX_LEN_40M2S, 0x77765544);
++
++		rt2800_register_write(rt2x00dev, HT_FBK_TO_LEGACY, 0x1010);
++
+ 	} else {
+ 		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000000);
+ 		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
+@@ -7231,6 +7253,8 @@ static void rt2800_init_bbp_6352(struct
+ 	rt2800_bbp_dcoc_write(rt2x00dev, 159, 0x64);
+ 
+ 	rt2800_bbp4_mac_if_ctrl(rt2x00dev);
++
++	rt2800_bbp_write(rt2x00dev, 84, 0x19);
+ }
+ 
+ static void rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -760,6 +760,9 @@ int rt2800mmio_init_registers(struct rt2
+ 
+ 	rt2x00mmio_register_write(rt2x00dev, PWR_PIN_CFG, 0x00000003);
+ 
++	if (rt2x00_rt(rt2x00dev, RT6352))
++		return 0;
++
+ 	reg = 0;
+ 	rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_CSR, 1);
+ 	rt2x00_set_field32(&reg, MAC_SYS_CTRL_RESET_BBP, 1);
diff --git a/package/kernel/mac80211/patches/rt2x00/004-2-v6.7-wifi-rt2x00-rework-MT7620-channel-config-function.patch b/package/kernel/mac80211/patches/rt2x00/004-2-v6.7-wifi-rt2x00-rework-MT7620-channel-config-function.patch
new file mode 100644
index 0000000000..1aec73d762
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/004-2-v6.7-wifi-rt2x00-rework-MT7620-channel-config-function.patch
@@ -0,0 +1,146 @@
+From a28533c6be1711584bf3ec978309d5c590029821 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Thu, 19 Oct 2023 19:58:57 +0800
+Subject: wifi: rt2x00: rework MT7620 channel config function
+
+1. Move the channel configuration code from rt2800_vco_calibration()
+   to the rt2800_config_channel().
+2. Use MT7620 SoC specific AGC initial LNA value instead of the
+   RT5592's value.
+3. BBP{195,196} pairing write has been replaced with
+   rt2800_bbp_glrt_write() to reduce redundant code.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB0315622A4340BFFA530B1B86BCD4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 91 ++++++++++----------------
+ 1 file changed, 35 insertions(+), 56 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3861,14 +3861,6 @@ static void rt2800_config_channel_rf7620
+ 		rfcsr |= tx_agc_fc;
+ 		rt2800_rfcsr_write_bank(rt2x00dev, 7, 59, rfcsr);
+ 	}
+-
+-	if (conf_is_ht40(conf)) {
+-		rt2800_bbp_glrt_write(rt2x00dev, 141, 0x10);
+-		rt2800_bbp_glrt_write(rt2x00dev, 157, 0x2f);
+-	} else {
+-		rt2800_bbp_glrt_write(rt2x00dev, 141, 0x1a);
+-		rt2800_bbp_glrt_write(rt2x00dev, 157, 0x40);
+-	}
+ }
+ 
+ static void rt2800_config_alc_rt6352(struct rt2x00_dev *rt2x00dev,
+@@ -4437,32 +4429,46 @@ static void rt2800_config_channel(struct
+ 		usleep_range(1000, 1500);
+ 	}
+ 
+-	if (rt2x00_rt(rt2x00dev, RT5592) || rt2x00_rt(rt2x00dev, RT6352)) {
+-		reg = 0x10;
+-		if (!conf_is_ht40(conf)) {
+-			if (rt2x00_rt(rt2x00dev, RT6352) &&
+-			    rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
+-				reg |= 0x5;
+-			} else {
+-				reg |= 0xa;
+-			}
+-		}
+-		rt2800_bbp_write(rt2x00dev, 195, 141);
+-		rt2800_bbp_write(rt2x00dev, 196, reg);
++	if (rt2x00_rt(rt2x00dev, RT5592)) {
++		bbp = conf_is_ht40(conf) ? 0x10 : 0x1a;
++		rt2800_bbp_glrt_write(rt2x00dev, 141, bbp);
+ 
+-		/* AGC init.
+-		 * Despite the vendor driver using different values here for
+-		 * RT6352 chip, we use 0x1c for now. This may have to be changed
+-		 * once TSSI got implemented.
+-		 */
+-		reg = (rf->channel <= 14 ? 0x1c : 0x24) + 2*rt2x00dev->lna_gain;
+-		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
++		bbp = (rf->channel <= 14 ? 0x1c : 0x24) + 2 * rt2x00dev->lna_gain;
++		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, bbp);
+ 
+-		if (rt2x00_rt(rt2x00dev, RT5592))
+-			rt2800_iq_calibrate(rt2x00dev, rf->channel);
++		rt2800_iq_calibrate(rt2x00dev, rf->channel);
+ 	}
+ 
+ 	if (rt2x00_rt(rt2x00dev, RT6352)) {
++		/* BBP for GLRT BW */
++		bbp = conf_is_ht40(conf) ?
++		      0x10 : rt2x00_has_cap_external_lna_bg(rt2x00dev) ?
++		      0x15 : 0x1a;
++		rt2800_bbp_glrt_write(rt2x00dev, 141, bbp);
++
++		bbp = conf_is_ht40(conf) ? 0x2f : 0x40;
++		rt2800_bbp_glrt_write(rt2x00dev, 157, bbp);
++
++		if (rt2x00dev->default_ant.rx_chain_num == 1) {
++			rt2800_bbp_write(rt2x00dev, 91, 0x07);
++			rt2800_bbp_write(rt2x00dev, 95, 0x1a);
++			rt2800_bbp_glrt_write(rt2x00dev, 128, 0xa0);
++			rt2800_bbp_glrt_write(rt2x00dev, 170, 0x12);
++			rt2800_bbp_glrt_write(rt2x00dev, 171, 0x10);
++		} else {
++			rt2800_bbp_write(rt2x00dev, 91, 0x06);
++			rt2800_bbp_write(rt2x00dev, 95, 0x9a);
++			rt2800_bbp_glrt_write(rt2x00dev, 128, 0xe0);
++			rt2800_bbp_glrt_write(rt2x00dev, 170, 0x30);
++			rt2800_bbp_glrt_write(rt2x00dev, 171, 0x30);
++		}
++
++		/* AGC init */
++		bbp = rf->channel <= 14 ? 0x04 + 2 * rt2x00dev->lna_gain : 0;
++		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, bbp);
++
++		usleep_range(1000, 1500);
++
+ 		if (test_bit(CAPABILITY_EXTERNAL_PA_TX0,
+ 			     &rt2x00dev->cap_flags)) {
+ 			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
+@@ -5608,26 +5614,6 @@ void rt2800_vco_calibration(struct rt2x0
+ 	rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
+ 
+ 	if (rt2x00_rt(rt2x00dev, RT6352)) {
+-		if (rt2x00dev->default_ant.rx_chain_num == 1) {
+-			rt2800_bbp_write(rt2x00dev, 91, 0x07);
+-			rt2800_bbp_write(rt2x00dev, 95, 0x1A);
+-			rt2800_bbp_write(rt2x00dev, 195, 128);
+-			rt2800_bbp_write(rt2x00dev, 196, 0xA0);
+-			rt2800_bbp_write(rt2x00dev, 195, 170);
+-			rt2800_bbp_write(rt2x00dev, 196, 0x12);
+-			rt2800_bbp_write(rt2x00dev, 195, 171);
+-			rt2800_bbp_write(rt2x00dev, 196, 0x10);
+-		} else {
+-			rt2800_bbp_write(rt2x00dev, 91, 0x06);
+-			rt2800_bbp_write(rt2x00dev, 95, 0x9A);
+-			rt2800_bbp_write(rt2x00dev, 195, 128);
+-			rt2800_bbp_write(rt2x00dev, 196, 0xE0);
+-			rt2800_bbp_write(rt2x00dev, 195, 170);
+-			rt2800_bbp_write(rt2x00dev, 196, 0x30);
+-			rt2800_bbp_write(rt2x00dev, 195, 171);
+-			rt2800_bbp_write(rt2x00dev, 196, 0x30);
+-		}
+-
+ 		if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
+ 			rt2800_bbp_write(rt2x00dev, 75, 0x68);
+ 			rt2800_bbp_write(rt2x00dev, 76, 0x4C);
+@@ -5635,13 +5621,6 @@ void rt2800_vco_calibration(struct rt2x0
+ 			rt2800_bbp_write(rt2x00dev, 80, 0x0C);
+ 			rt2800_bbp_write(rt2x00dev, 82, 0xB6);
+ 		}
+-
+-		/* On 11A, We should delay and wait RF/BBP to be stable
+-		 * and the appropriate time should be 1000 micro seconds
+-		 * 2005/06/05 - On 11G, we also need this delay time.
+-		 * Otherwise it's difficult to pass the WHQL.
+-		 */
+-		usleep_range(1000, 1500);
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(rt2800_vco_calibration);
diff --git a/package/kernel/mac80211/patches/rt2x00/004-3-v6.7-wifi-rt2x00-rework-MT7620-PA-LNA-RF-calibration.patch b/package/kernel/mac80211/patches/rt2x00/004-3-v6.7-wifi-rt2x00-rework-MT7620-PA-LNA-RF-calibration.patch
new file mode 100644
index 0000000000..64cd599c02
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/004-3-v6.7-wifi-rt2x00-rework-MT7620-PA-LNA-RF-calibration.patch
@@ -0,0 +1,241 @@
+From cca74bed37af1c8217bcd8282d9b384efdbf73bd Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Thu, 19 Oct 2023 19:58:58 +0800
+Subject: wifi: rt2x00: rework MT7620 PA/LNA RF calibration
+
+1. Move MT7620 PA/LNA calibration code to dedicated functions.
+2. For external PA/LNA devices, restore RF and BBP registers before
+   R-Calibration.
+3. Do Rx DCOC calibration again before RXIQ calibration.
+4. Add some missing LNA related registers' initialization.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB0315979F92DC563019B8F238BCD4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 176 +++++++++++++++++--------
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h    |   6 +
+ 2 files changed, 130 insertions(+), 52 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -4468,41 +4468,6 @@ static void rt2800_config_channel(struct
+ 		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, bbp);
+ 
+ 		usleep_range(1000, 1500);
+-
+-		if (test_bit(CAPABILITY_EXTERNAL_PA_TX0,
+-			     &rt2x00dev->cap_flags)) {
+-			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
+-			reg |= 0x00000101;
+-			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
+-
+-			reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
+-			reg |= 0x00000101;
+-			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
+-
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0x73);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0x73);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0x73);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0xC8);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xA4);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x05);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0xC8);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xA4);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x05);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x27);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0xC8);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xA4);
+-			rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x05);
+-			rt2800_rfcsr_write_dccal(rt2x00dev, 05, 0x00);
+-
+-			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT,
+-					      0x36303636);
+-			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN,
+-					      0x6C6C6B6C);
+-			rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN,
+-					      0x6C6C6B6C);
+-		}
+ 	}
+ 
+ 	bbp = rt2800_bbp_read(rt2x00dev, 4);
+@@ -5612,16 +5577,6 @@ void rt2800_vco_calibration(struct rt2x0
+ 		}
+ 	}
+ 	rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
+-
+-	if (rt2x00_rt(rt2x00dev, RT6352)) {
+-		if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
+-			rt2800_bbp_write(rt2x00dev, 75, 0x68);
+-			rt2800_bbp_write(rt2x00dev, 76, 0x4C);
+-			rt2800_bbp_write(rt2x00dev, 79, 0x1C);
+-			rt2800_bbp_write(rt2x00dev, 80, 0x0C);
+-			rt2800_bbp_write(rt2x00dev, 82, 0xB6);
+-		}
+-	}
+ }
+ EXPORT_SYMBOL_GPL(rt2800_vco_calibration);
+ 
+@@ -10348,6 +10303,128 @@ do_cal:
+ 	rt2800_register_write(rt2x00dev, RF_BYPASS0, MAC_RF_BYPASS0);
+ }
+ 
++static void rt2800_restore_rf_bbp_rt6352(struct rt2x00_dev *rt2x00dev)
++{
++	if (rt2x00_has_cap_external_pa(rt2x00dev)) {
++		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x0);
++		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0);
++	}
++
++	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x16);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x23);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x02);
++	}
++
++	if (rt2x00_has_cap_external_pa(rt2x00dev)) {
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0xd3);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0xb3);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0xd5);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0x6c);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xfc);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x1f);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x66);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xff);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x1c);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x20);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0x6b);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xf7);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x09);
++	}
++
++	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++		rt2800_bbp_write(rt2x00dev, 75, 0x60);
++		rt2800_bbp_write(rt2x00dev, 76, 0x44);
++		rt2800_bbp_write(rt2x00dev, 79, 0x1c);
++		rt2800_bbp_write(rt2x00dev, 80, 0x0c);
++		rt2800_bbp_write(rt2x00dev, 82, 0xB6);
++	}
++
++	if (rt2x00_has_cap_external_pa(rt2x00dev)) {
++		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT, 0x3630363a);
++		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN, 0x6c6c666c);
++		rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN, 0x6c6c666c);
++	}
++}
++
++static void rt2800_calibration_rt6352(struct rt2x00_dev *rt2x00dev)
++{
++	u32 reg;
++
++	if (rt2x00_has_cap_external_pa(rt2x00dev) ||
++	    rt2x00_has_cap_external_lna_bg(rt2x00dev))
++		rt2800_restore_rf_bbp_rt6352(rt2x00dev);
++
++	rt2800_r_calibration(rt2x00dev);
++	rt2800_rf_self_txdc_cal(rt2x00dev);
++	rt2800_rxdcoc_calibration(rt2x00dev);
++	rt2800_bw_filter_calibration(rt2x00dev, true);
++	rt2800_bw_filter_calibration(rt2x00dev, false);
++	rt2800_loft_iq_calibration(rt2x00dev);
++
++	/* missing DPD calibration for internal PA devices */
++
++	rt2800_rxdcoc_calibration(rt2x00dev);
++	rt2800_rxiq_calibration(rt2x00dev);
++
++	if (!rt2x00_has_cap_external_pa(rt2x00dev) &&
++	    !rt2x00_has_cap_external_lna_bg(rt2x00dev))
++		return;
++
++	if (rt2x00_has_cap_external_pa(rt2x00dev)) {
++		reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++		reg |= 0x00000101;
++		rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
++
++		reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++		reg |= 0x00000101;
++		rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
++	}
++
++	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
++	}
++
++	if (rt2x00_has_cap_external_pa(rt2x00dev)) {
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0x73);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0x73);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0x73);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0xc8);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xa4);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x05);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0xc8);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xa4);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x05);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x27);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0xc8);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xa4);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x05);
++	}
++
++	if (rt2x00_has_cap_external_pa(rt2x00dev))
++		rt2800_rfcsr_write_dccal(rt2x00dev, 05, 0x00);
++
++	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++		rt2800_bbp_write(rt2x00dev, 75, 0x68);
++		rt2800_bbp_write(rt2x00dev, 76, 0x4c);
++		rt2800_bbp_write(rt2x00dev, 79, 0x1c);
++		rt2800_bbp_write(rt2x00dev, 80, 0x0c);
++		rt2800_bbp_write(rt2x00dev, 82, 0xb6);
++	}
++
++	if (rt2x00_has_cap_external_pa(rt2x00dev)) {
++		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT, 0x36303636);
++		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN, 0x6c6c6b6c);
++		rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN, 0x6c6c6b6c);
++	}
++}
++
+ static void rt2800_init_rfcsr_6352(struct rt2x00_dev *rt2x00dev)
+ {
+ 	/* Initialize RF central register to default value */
+@@ -10612,13 +10689,8 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+ 
+-	rt2800_r_calibration(rt2x00dev);
+-	rt2800_rf_self_txdc_cal(rt2x00dev);
+-	rt2800_rxdcoc_calibration(rt2x00dev);
+-	rt2800_bw_filter_calibration(rt2x00dev, true);
+-	rt2800_bw_filter_calibration(rt2x00dev, false);
+-	rt2800_loft_iq_calibration(rt2x00dev);
+-	rt2800_rxiq_calibration(rt2x00dev);
++	/* Do calibration and init PA/LNA */
++	rt2800_calibration_rt6352(rt2x00dev);
+ }
+ 
+ static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -1263,6 +1263,12 @@ rt2x00_has_cap_external_lna_bg(struct rt
+ }
+ 
+ static inline bool
++rt2x00_has_cap_external_pa(struct rt2x00_dev *rt2x00dev)
++{
++	return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_EXTERNAL_PA_TX0);
++}
++
++static inline bool
+ rt2x00_has_cap_double_antenna(struct rt2x00_dev *rt2x00dev)
+ {
+ 	return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_DOUBLE_ANTENNA);
diff --git a/package/kernel/mac80211/patches/rt2x00/005-1-v6.8-wifi-rt2x00-introduce-DMA-busy-check-watchdog-for-rt.patch b/package/kernel/mac80211/patches/rt2x00/005-1-v6.8-wifi-rt2x00-introduce-DMA-busy-check-watchdog-for-rt.patch
new file mode 100644
index 0000000000..c1c3225733
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/005-1-v6.8-wifi-rt2x00-introduce-DMA-busy-check-watchdog-for-rt.patch
@@ -0,0 +1,177 @@
+From b1275cdd7456ef811747dfb4f3c46310ddd300cd Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sat, 4 Nov 2023 16:57:58 +0800
+Subject: wifi: rt2x00: introduce DMA busy check watchdog for rt2800
+
+When I tried to fix the watchdog of rt2800, I found that sometimes
+the watchdog can not reset the hung device. This is because the
+queue is not completely stuck, it just becomes very slow. The MTK
+vendor driver for the new chip MT7603/MT7612 has a DMA busy watchdog
+to detect device hangs by checking DMA busy status. This watchdog
+implementation is something similar to it. To reduce unnecessary
+reset, we can check the INT_SOURCE_CSR register together as I found
+that when the radio hung, the RX/TX coherent interrupt will always
+stuck at triggered state.
+
+The 'watchdog' module parameter has been extended to control all
+watchdogs(0=disabled, 1=hang watchdog, 2=DMA watchdog, 3=both). This
+new watchdog function is a slight schedule and it won't affect the
+transmission speed. So we can turn on it by default. Due to the
+INT_SOURCE_CSR register is invalid on rt2800 USB NICs, the DMA busy
+watchdog will be automatically disabled for them.
+
+Tested on MT7620 and RT5350.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB0315D7462CE08A119A99DE34BCA4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800.h    |  4 ++
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 77 ++++++++++++++++++++++----
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h    |  3 +
+ 3 files changed, 73 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+@@ -3194,4 +3194,8 @@ enum rt2800_eeprom_word {
+  */
+ #define BCN_TBTT_OFFSET 64
+ 
++/* Watchdog type mask */
++#define RT2800_WATCHDOG_HANG		BIT(0)
++#define RT2800_WATCHDOG_DMA_BUSY	BIT(1)
++
+ #endif /* RT2800_H */
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -30,9 +30,10 @@
+ #include "rt2800lib.h"
+ #include "rt2800.h"
+ 
+-static bool modparam_watchdog;
+-module_param_named(watchdog, modparam_watchdog, bool, S_IRUGO);
+-MODULE_PARM_DESC(watchdog, "Enable watchdog to detect tx/rx hangs and reset hardware if detected");
++static unsigned int modparam_watchdog = RT2800_WATCHDOG_DMA_BUSY;
++module_param_named(watchdog, modparam_watchdog, uint, 0444);
++MODULE_PARM_DESC(watchdog, "Enable watchdog to recover tx/rx hangs.\n"
++		 "\t\t(0=disabled, 1=hang watchdog, 2=DMA watchdog(default), 3=both)");
+ 
+ /*
+  * Register access.
+@@ -1261,15 +1262,12 @@ static void rt2800_update_survey(struct
+ 	chan_survey->time_ext_busy += rt2800_register_read(rt2x00dev, CH_BUSY_STA_SEC);
+ }
+ 
+-void rt2800_watchdog(struct rt2x00_dev *rt2x00dev)
++static bool rt2800_watchdog_hung(struct rt2x00_dev *rt2x00dev)
+ {
+ 	struct data_queue *queue;
+ 	bool hung_tx = false;
+ 	bool hung_rx = false;
+ 
+-	if (test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags))
+-		return;
+-
+ 	rt2800_update_survey(rt2x00dev);
+ 
+ 	queue_for_each(rt2x00dev, queue) {
+@@ -1297,18 +1295,72 @@ void rt2800_watchdog(struct rt2x00_dev *
+ 		}
+ 	}
+ 
++	if (!hung_tx && !hung_rx)
++		return false;
++
+ 	if (hung_tx)
+ 		rt2x00_warn(rt2x00dev, "Watchdog TX hung detected\n");
+ 
+ 	if (hung_rx)
+ 		rt2x00_warn(rt2x00dev, "Watchdog RX hung detected\n");
+ 
+-	if (hung_tx || hung_rx) {
+-		queue_for_each(rt2x00dev, queue)
+-			queue->wd_count = 0;
++	queue_for_each(rt2x00dev, queue)
++		queue->wd_count = 0;
++
++	return true;
++}
++
++static bool rt2800_watchdog_dma_busy(struct rt2x00_dev *rt2x00dev)
++{
++	bool busy_rx, busy_tx;
++	u32 reg_cfg = rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG);
++	u32 reg_int = rt2800_register_read(rt2x00dev, INT_SOURCE_CSR);
++
++	if (rt2x00_get_field32(reg_cfg, WPDMA_GLO_CFG_RX_DMA_BUSY) &&
++	    rt2x00_get_field32(reg_int, INT_SOURCE_CSR_RX_COHERENT))
++		rt2x00dev->rxdma_busy++;
++	else
++		rt2x00dev->rxdma_busy = 0;
+ 
++	if (rt2x00_get_field32(reg_cfg, WPDMA_GLO_CFG_TX_DMA_BUSY) &&
++	    rt2x00_get_field32(reg_int, INT_SOURCE_CSR_TX_COHERENT))
++		rt2x00dev->txdma_busy++;
++	else
++		rt2x00dev->txdma_busy = 0;
++
++	busy_rx = rt2x00dev->rxdma_busy > 30 ? true : false;
++	busy_tx = rt2x00dev->txdma_busy > 30 ? true : false;
++
++	if (!busy_rx && !busy_tx)
++		return false;
++
++	if (busy_rx)
++		rt2x00_warn(rt2x00dev, "Watchdog RX DMA busy detected\n");
++
++	if (busy_tx)
++		rt2x00_warn(rt2x00dev, "Watchdog TX DMA busy detected\n");
++
++	rt2x00dev->rxdma_busy = 0;
++	rt2x00dev->txdma_busy = 0;
++
++	return true;
++}
++
++void rt2800_watchdog(struct rt2x00_dev *rt2x00dev)
++{
++	bool reset = false;
++
++	if (test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags))
++		return;
++
++	if (modparam_watchdog & RT2800_WATCHDOG_DMA_BUSY)
++		reset = rt2800_watchdog_dma_busy(rt2x00dev);
++
++	if (modparam_watchdog & RT2800_WATCHDOG_HANG)
++		reset = rt2800_watchdog_hung(rt2x00dev) || reset;
++
++	if (reset)
+ 		ieee80211_restart_hw(rt2x00dev->hw);
+-	}
+ }
+ EXPORT_SYMBOL_GPL(rt2800_watchdog);
+ 
+@@ -12016,6 +12068,9 @@ int rt2800_probe_hw(struct rt2x00_dev *r
+ 		__set_bit(REQUIRE_TASKLET_CONTEXT, &rt2x00dev->cap_flags);
+ 	}
+ 
++	/* USB NICs don't support DMA watchdog as INT_SOURCE_CSR is invalid */
++	if (rt2x00_is_usb(rt2x00dev))
++		modparam_watchdog &= ~RT2800_WATCHDOG_DMA_BUSY;
+ 	if (modparam_watchdog) {
+ 		__set_bit(CAPABILITY_RESTART_HW, &rt2x00dev->cap_flags);
+ 		rt2x00dev->link.watchdog_interval = msecs_to_jiffies(100);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -926,6 +926,9 @@ struct rt2x00_dev {
+ 	 */
+ 	u16 beacon_int;
+ 
++	/* Rx/Tx DMA busy watchdog counter */
++	u16 rxdma_busy, txdma_busy;
++
+ 	/**
+ 	 * Timestamp of last received beacon
+ 	 */
diff --git a/package/kernel/mac80211/patches/rt2x00/005-2-v6.8-wifi-rt2x00-disable-RTS-threshold-for-rt2800-by-defa.patch b/package/kernel/mac80211/patches/rt2x00/005-2-v6.8-wifi-rt2x00-disable-RTS-threshold-for-rt2800-by-defa.patch
new file mode 100644
index 0000000000..b3e95da5a6
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/005-2-v6.8-wifi-rt2x00-disable-RTS-threshold-for-rt2800-by-defa.patch
@@ -0,0 +1,43 @@
+From 570beb6285fd355904b22625da20809f477096c5 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sat, 4 Nov 2023 16:57:59 +0800
+Subject: wifi: rt2x00: disable RTS threshold for rt2800 by default
+
+rt2800 has a lot of registers to control the RTS enable/disable
+status for different rates. And the driver control them via
+rt2800_set_rts_threshold(). When RTS was disabled in user
+interface, this function won't be called at all. This means that
+the RTS is still 'on' for CCK and OFDM rates. So we'd better to
+disable them by default because it should be like this. The RTS
+for HT20 and HT40 is already default off so we don't need to
+touch them. If we toggle the RTS status, these register bits
+will be enable/disable again by rt2800_set_rts_threshold().
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB03155DDB953155B7A2DE849ABCA4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -6100,7 +6100,7 @@ static int rt2800_init_registers(struct
+ 	rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_MM40, 0);
+ 	rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+ 	rt2x00_set_field32(&reg, CCK_PROT_CFG_TX_OP_ALLOW_GF40, 0);
+-	rt2x00_set_field32(&reg, CCK_PROT_CFG_RTS_TH_EN, 1);
++	rt2x00_set_field32(&reg, CCK_PROT_CFG_RTS_TH_EN, 0);
+ 	rt2800_register_write(rt2x00dev, CCK_PROT_CFG, reg);
+ 
+ 	reg = rt2800_register_read(rt2x00dev, OFDM_PROT_CFG);
+@@ -6113,7 +6113,7 @@ static int rt2800_init_registers(struct
+ 	rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_MM40, 0);
+ 	rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_GF20, 1);
+ 	rt2x00_set_field32(&reg, OFDM_PROT_CFG_TX_OP_ALLOW_GF40, 0);
+-	rt2x00_set_field32(&reg, OFDM_PROT_CFG_RTS_TH_EN, 1);
++	rt2x00_set_field32(&reg, OFDM_PROT_CFG_RTS_TH_EN, 0);
+ 	rt2800_register_write(rt2x00dev, OFDM_PROT_CFG, reg);
+ 
+ 	reg = rt2800_register_read(rt2x00dev, MM20_PROT_CFG);
diff --git a/package/kernel/mac80211/patches/rt2x00/005-3-v6.8-wifi-rt2x00-restart-beacon-queue-when-hardware-reset.patch b/package/kernel/mac80211/patches/rt2x00/005-3-v6.8-wifi-rt2x00-restart-beacon-queue-when-hardware-reset.patch
new file mode 100644
index 0000000000..1fa7b8b0fb
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/005-3-v6.8-wifi-rt2x00-restart-beacon-queue-when-hardware-reset.patch
@@ -0,0 +1,67 @@
+From a11d965a218f0cd95b13fe44d0bcd8a20ce134a8 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sat, 4 Nov 2023 16:58:00 +0800
+Subject: wifi: rt2x00: restart beacon queue when hardware reset
+
+When a hardware reset is triggered, all registers are reset, so all
+queues are forced to stop in hardware interface. However, mac80211
+will not automatically stop the queue. If we don't manually stop the
+beacon queue, the queue will be deadlocked and unable to start again.
+This patch fixes the issue where Apple devices cannot connect to the
+AP after calling ieee80211_restart_hw().
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/TYAP286MB031530EB6D98DCE4DF20766CBCA4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00dev.c |  3 +++
+ drivers/net/wireless/ralink/rt2x00/rt2x00mac.c | 11 +++++++++++
+ 2 files changed, 14 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+@@ -101,6 +101,7 @@ void rt2x00lib_disable_radio(struct rt2x
+ 	rt2x00link_stop_tuner(rt2x00dev);
+ 	rt2x00queue_stop_queues(rt2x00dev);
+ 	rt2x00queue_flush_queues(rt2x00dev, true);
++	rt2x00queue_stop_queue(rt2x00dev->bcn);
+ 
+ 	/*
+ 	 * Disable radio.
+@@ -1286,6 +1287,7 @@ int rt2x00lib_start(struct rt2x00_dev *r
+ 	rt2x00dev->intf_ap_count = 0;
+ 	rt2x00dev->intf_sta_count = 0;
+ 	rt2x00dev->intf_associated = 0;
++	rt2x00dev->intf_beaconing = 0;
+ 
+ 	/* Enable the radio */
+ 	retval = rt2x00lib_enable_radio(rt2x00dev);
+@@ -1312,6 +1314,7 @@ void rt2x00lib_stop(struct rt2x00_dev *r
+ 	rt2x00dev->intf_ap_count = 0;
+ 	rt2x00dev->intf_sta_count = 0;
+ 	rt2x00dev->intf_associated = 0;
++	rt2x00dev->intf_beaconing = 0;
+ }
+ 
+ static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+@@ -598,6 +598,17 @@ void rt2x00mac_bss_info_changed(struct i
+ 	 */
+ 	if (changes & BSS_CHANGED_BEACON_ENABLED) {
+ 		mutex_lock(&intf->beacon_skb_mutex);
++
++		/*
++		 * Clear the 'enable_beacon' flag and clear beacon because
++		 * the beacon queue has been stopped after hardware reset.
++		 */
++		if (test_bit(DEVICE_STATE_RESET, &rt2x00dev->flags) &&
++		    intf->enable_beacon) {
++			intf->enable_beacon = false;
++			rt2x00queue_clear_beacon(rt2x00dev, vif);
++		}
++
+ 		if (!bss_conf->enable_beacon && intf->enable_beacon) {
+ 			rt2x00dev->intf_beaconing--;
+ 			intf->enable_beacon = false;
diff --git a/package/kernel/mac80211/patches/rt2x00/101-wifi-rt2x00-correct-wrong-BBP-register-in-RxDCOC-cal.patch b/package/kernel/mac80211/patches/rt2x00/101-wifi-rt2x00-correct-wrong-BBP-register-in-RxDCOC-cal.patch
new file mode 100644
index 0000000000..253d1d9c19
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/101-wifi-rt2x00-correct-wrong-BBP-register-in-RxDCOC-cal.patch
@@ -0,0 +1,26 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Thu, 9 Nov 2023 12:01:18 +0800
+Subject: [PATCH] wifi: rt2x00: correct wrong BBP register in RxDCOC
+ calibration
+
+Refer to Mediatek vendor driver RxDCOC_Calibration() function, when
+performing gainfreeze calibration, we should write register 140
+instead of 141. This fix can reduce the total calibration time from
+6 seconds to 1 second.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8711,7 +8711,7 @@ static void rt2800_rxdcoc_calibration(st
+ 	rt2800_rfcsr_write_bank(rt2x00dev, 5, 4, saverfb5r4);
+ 	rt2800_rfcsr_write_bank(rt2x00dev, 7, 4, saverfb7r4);
+ 
+-	rt2800_bbp_write(rt2x00dev, 158, 141);
++	rt2800_bbp_write(rt2x00dev, 158, 140);
+ 	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
+ 	bbpreg = bbpreg & (~0x40);
+ 	rt2800_bbp_write(rt2x00dev, 159, bbpreg);
diff --git a/package/kernel/mac80211/patches/rt2x00/602-03-wifi-rt2x00-Add-support-for-loading-EEPROM-from-MTD.patch b/package/kernel/mac80211/patches/rt2x00/602-03-wifi-rt2x00-Add-support-for-loading-EEPROM-from-MTD.patch
index 6a343db9c7..fab4bf39c0 100644
--- a/package/kernel/mac80211/patches/rt2x00/602-03-wifi-rt2x00-Add-support-for-loading-EEPROM-from-MTD.patch
+++ b/package/kernel/mac80211/patches/rt2x00/602-03-wifi-rt2x00-Add-support-for-loading-EEPROM-from-MTD.patch
@@ -94,7 +94,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  static const char *
  rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
-@@ -83,5 +141,13 @@ err_exit:
+@@ -83,6 +141,14 @@ err_exit:
  
  int rt2x00lib_read_eeprom(struct rt2x00_dev *rt2x00dev)
  {
@@ -108,3 +108,4 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 +
  	return rt2x00lib_read_eeprom_file(rt2x00dev);
  }
+ EXPORT_SYMBOL_GPL(rt2x00lib_read_eeprom);
diff --git a/package/kernel/mac80211/patches/rt2x00/602-05-wifi-rt2x00-support-loading-eeprom-from-NVMEM-cells.patch b/package/kernel/mac80211/patches/rt2x00/602-05-wifi-rt2x00-support-loading-eeprom-from-NVMEM-cells.patch
index efe6e52720..e6633363bd 100644
--- a/package/kernel/mac80211/patches/rt2x00/602-05-wifi-rt2x00-support-loading-eeprom-from-NVMEM-cells.patch
+++ b/package/kernel/mac80211/patches/rt2x00/602-05-wifi-rt2x00-support-loading-eeprom-from-NVMEM-cells.patch
@@ -84,7 +84,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  static const char *
  rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
-@@ -164,5 +199,9 @@ int rt2x00lib_read_eeprom(struct rt2x00_
+@@ -164,6 +199,10 @@ int rt2x00lib_read_eeprom(struct rt2x00_
  		return 0;
  #endif
  
@@ -94,3 +94,4 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 +
  	return rt2x00lib_read_eeprom_file(rt2x00dev);
  }
+ EXPORT_SYMBOL_GPL(rt2x00lib_read_eeprom);
diff --git a/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch b/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
index ffee2189d2..ab09a68297 100644
--- a/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
+++ b/package/kernel/mac80211/patches/rt2x00/606-rt2x00-allow_disabling_bands_through_platform_data.patch
@@ -12,7 +12,7 @@
  #endif /* _RT2X00_PLATFORM_H */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1007,6 +1007,22 @@ static int rt2x00lib_probe_hw_modes(stru
+@@ -1008,6 +1008,22 @@ static int rt2x00lib_probe_hw_modes(stru
  	unsigned int num_rates;
  	unsigned int i;
  
diff --git a/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch b/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
index 37553bb80a..79f99ffdf4 100644
--- a/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
+++ b/package/kernel/mac80211/patches/rt2x00/607-rt2x00-add_platform_data_mac_addr.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -989,6 +989,12 @@ static void rt2x00lib_rate(struct ieee80
+@@ -990,6 +990,12 @@ static void rt2x00lib_rate(struct ieee80
  
  void rt2x00lib_set_mac_address(struct rt2x00_dev *rt2x00dev, u8 *eeprom_mac_addr)
  {
diff --git a/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch b/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
index 6211809c0a..31f2f0261f 100644
--- a/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
+++ b/package/kernel/mac80211/patches/rt2x00/608-rt2x00-allow_disabling_bands_through_dts.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1012,6 +1012,16 @@ static int rt2x00lib_probe_hw_modes(stru
+@@ -1013,6 +1013,16 @@ static int rt2x00lib_probe_hw_modes(stru
  	struct ieee80211_rate *rates;
  	unsigned int num_rates;
  	unsigned int i;
diff --git a/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
index 7b50bc275e..8ee4e6cafa 100644
--- a/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
+++ b/package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch
@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -11129,6 +11130,17 @@ static int rt2800_init_eeprom(struct rt2
+@@ -11285,6 +11286,17 @@ static int rt2800_init_eeprom(struct rt2
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
  
diff --git a/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch b/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
index aa2b25ba7f..9564f02edd 100644
--- a/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
+++ b/package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1359,7 +1359,7 @@ static inline void rt2x00lib_set_if_comb
+@@ -1362,7 +1362,7 @@ static inline void rt2x00lib_set_if_comb
  	 */
  	if_limit = &rt2x00dev->if_limits_ap;
  	if_limit->max = rt2x00dev->ops->max_ap_intf;
diff --git a/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch b/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch
index 634b677722..3e48eab5d2 100644
--- a/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch
+++ b/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch
@@ -27,7 +27,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -304,6 +304,24 @@ static void rt2800_rf_write(struct rt2x0
+@@ -305,6 +305,24 @@ static void rt2800_rf_write(struct rt2x0
  	mutex_unlock(&rt2x00dev->csr_mutex);
  }
  
@@ -52,67 +52,27 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  static const unsigned int rt2800_eeprom_map[EEPROM_WORD_COUNT] = {
  	[EEPROM_CHIP_ID]		= 0x0000,
  	[EEPROM_VERSION]		= 0x0001,
-@@ -4469,6 +4487,29 @@ static void rt2800_config_channel(struct
- 			rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN,
- 					      0x6C6C6B6C);
- 		}
-+
-+		if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
-+			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+			reg |= 0x00000101;
-+			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
-+
-+			reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
-+			reg |= 0x00000101;
-+			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
-+
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
-+			rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
-+			rt2800_bbp_write(rt2x00dev, 75, 0x68);
-+			rt2800_bbp_write(rt2x00dev, 76, 0x4C);
-+			rt2800_bbp_write(rt2x00dev, 79, 0x1C);
-+			rt2800_bbp_write(rt2x00dev, 80, 0x0C);
-+			rt2800_bbp_write(rt2x00dev, 82, 0xB6);
-+			/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in
-+			 * config channel function in dependence of channel and
-+			 * HT20/HT40 so don't touch it
-+			 */
-+		}
- 	}
+@@ -10407,8 +10425,10 @@ static void rt2800_calibration_rt6352(st
+ 	u32 reg;
  
- 	bbp = rt2800_bbp_read(rt2x00dev, 4);
-@@ -10581,6 +10622,7 @@ static void rt2800_init_rfcsr_6352(struc
- 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
- 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+ 	if (rt2x00_has_cap_external_pa(rt2x00dev) ||
+-	    rt2x00_has_cap_external_lna_bg(rt2x00dev))
++	    rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++		rt6352_enable_pa_pin(rt2x00dev, 0);
+ 		rt2800_restore_rf_bbp_rt6352(rt2x00dev);
++	}
  
-+	rt6352_enable_pa_pin(rt2x00dev, 0);
  	rt2800_r_calibration(rt2x00dev);
  	rt2800_rf_self_txdc_cal(rt2x00dev);
- 	rt2800_rxdcoc_calibration(rt2x00dev);
-@@ -10588,6 +10630,22 @@ static void rt2800_init_rfcsr_6352(struc
- 	rt2800_bw_filter_calibration(rt2x00dev, false);
- 	rt2800_loft_iq_calibration(rt2x00dev);
- 	rt2800_rxiq_calibration(rt2x00dev);
+@@ -10426,6 +10446,8 @@ static void rt2800_calibration_rt6352(st
+ 	    !rt2x00_has_cap_external_lna_bg(rt2x00dev))
+ 		return;
+ 
 +	rt6352_enable_pa_pin(rt2x00dev, 1);
 +
-+	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
-+		rt2800_bbp_write(rt2x00dev, 75, 0x68);
-+		rt2800_bbp_write(rt2x00dev, 76, 0x4C);
-+		rt2800_bbp_write(rt2x00dev, 79, 0x1C);
-+		rt2800_bbp_write(rt2x00dev, 80, 0x0C);
-+		rt2800_bbp_write(rt2x00dev, 82, 0xB6);
-+		/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in config
-+		 * channel function in dependence of channel and HT20/HT40,
-+		 * so don't touch them here.
-+		 */
-+	}
- }
- 
- static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+ 	if (rt2x00_has_cap_external_pa(rt2x00dev)) {
+ 		reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
+ 		reg |= 0x00000101;
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
 @@ -28,6 +28,7 @@
@@ -123,7 +83,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  #include <linux/rt2x00_platform.h>
  
  #include <net/mac80211.h>
-@@ -1024,6 +1025,11 @@ struct rt2x00_dev {
+@@ -1027,6 +1028,11 @@ struct rt2x00_dev {
  
  	/* Clock for System On Chip devices. */
  	struct clk *clk;
diff --git a/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch b/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
index 4b3e549109..0f699f5e18 100644
--- a/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
+++ b/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -1044,6 +1044,11 @@
+@@ -1056,6 +1056,11 @@
  #define MIMO_PS_CFG_RX_STBY_POL		FIELD32(0x00000010)
  #define MIMO_PS_CFG_RX_RX_STBY0		FIELD32(0x00000020)
  
@@ -14,7 +14,7 @@
   */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3778,14 +3778,16 @@ static void rt2800_config_channel_rf7620
+@@ -3836,14 +3836,16 @@ static void rt2800_config_channel_rf7620
  	rt2x00_set_field8(&rfcsr, RFCSR19_K, rf->rf4);
  	rt2800_rfcsr_write(rt2x00dev, 19, rfcsr);
  
@@ -39,7 +39,7 @@
  
  	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
  	rt2x00_set_field8(&rfcsr, RFCSR1_TX2_EN_MT7620,
-@@ -3819,18 +3821,23 @@ static void rt2800_config_channel_rf7620
+@@ -3877,18 +3879,23 @@ static void rt2800_config_channel_rf7620
  		rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x20);
  	}
  
@@ -73,7 +73,7 @@
  
  	if (!test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags)) {
  		if (conf_is_ht40(conf)) {
-@@ -3929,25 +3936,29 @@ static void rt2800_config_alc(struct rt2
+@@ -4002,25 +4009,29 @@ static void rt2800_config_alc_rt6352(str
  	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
  		rt2x00_warn(rt2x00dev, "RF busy while configuring ALC\n");
  
@@ -121,7 +121,17 @@
  	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, mac_sys_ctrl);
  
  	rt2800_vco_calibration(rt2x00dev);
-@@ -6011,18 +6022,33 @@ static int rt2800_init_registers(struct
+@@ -4513,7 +4524,8 @@ static void rt2800_config_channel(struct
+ 	if (rt2x00_rt(rt2x00dev, RT6352)) {
+ 		/* BBP for GLRT BW */
+ 		bbp = conf_is_ht40(conf) ?
+-		      0x10 : rt2x00_has_cap_external_lna_bg(rt2x00dev) ?
++		      0x10 : !rt2x00_has_cap_external_lna_bg(rt2x00dev) ?
++		      0x1a : rt2800_hw_get_chippkg(rt2x00dev) == 1 ?
+ 		      0x15 : 0x1a;
+ 		rt2800_bbp_glrt_write(rt2x00dev, 141, bbp);
+ 
+@@ -6017,18 +6029,33 @@ static int rt2800_init_registers(struct
  	} else if (rt2x00_rt(rt2x00dev, RT5350)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
  	} else if (rt2x00_rt(rt2x00dev, RT6352)) {
@@ -167,7 +177,7 @@
  		reg = rt2800_register_read(rt2x00dev, TX_ALC_CFG_1);
  		rt2x00_set_field32(&reg, TX_ALC_CFG_1_ROS_BUSY_EN, 0);
  		rt2800_register_write(rt2x00dev, TX_ALC_CFG_1, reg);
-@@ -7127,14 +7153,16 @@ static void rt2800_init_bbp_6352(struct
+@@ -7141,14 +7168,16 @@ static void rt2800_init_bbp_6352(struct
  	rt2800_bbp_write(rt2x00dev, 188, 0x00);
  	rt2800_bbp_write(rt2x00dev, 189, 0x00);
  
@@ -192,7 +202,27 @@
  
  	/* BBP for G band GLRT function (BBP_128 ~ BBP_221) */
  	rt2800_bbp_glrt_write(rt2x00dev, 0, 0x00);
-@@ -10406,31 +10434,36 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10381,6 +10410,9 @@ static void rt2800_restore_rf_bbp_rt6352
+ 		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0);
+ 	}
+ 
++	if (rt2800_hw_get_chippkg(rt2x00dev) != 1)
++		return;
++
+ 	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
+ 		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x16);
+ 		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x23);
+@@ -10458,6 +10490,9 @@ static void rt2800_calibration_rt6352(st
+ 		rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
+ 	}
+ 
++	if (rt2800_hw_get_chippkg(rt2x00dev) != 1)
++		return;
++
+ 	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
+ 		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
+ 		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
+@@ -10548,31 +10583,36 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write(rt2x00dev, 42, 0x5B);
  	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
  
@@ -254,7 +284,7 @@
  
  	/* Initialize RF channel register to default value */
  	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x03);
-@@ -10496,63 +10529,71 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10638,63 +10678,71 @@ static void rt2800_init_rfcsr_6352(struc
  
  	rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0xC5);
  
@@ -288,33 +318,6 @@
 -	rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0x6B);
 -	rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xF7);
 -	rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x09);
--
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 10, 0x51);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x06);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 19, 0xA7);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 28, 0x2C);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x64);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 8, 0x51);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 9, 0x36);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 11, 0x53);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x16);
--
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0x6C);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xFC);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x1F);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x66);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0x6B);
--
--	/* Initialize RF channel register for DRQFN */
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0xD3);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0xE3);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0xE5);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0x28);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x68);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xF7);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x02);
--	rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xC7);
 +	if (rt2800_hw_get_chipver(rt2x00dev) > 1) {
 +		rt2800_rfcsr_write_chanreg(rt2x00dev, 9, 0x47);
 +		rt2800_rfcsr_write_chanreg(rt2x00dev, 10, 0x71);
@@ -347,7 +350,16 @@
 +		rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xF7);
 +		rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x09);
 +	}
-+
+ 
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 10, 0x51);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x06);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 19, 0xA7);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 28, 0x2C);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x64);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 8, 0x51);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 9, 0x36);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 11, 0x53);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x16);
 +	if (rt2800_hw_get_chipver(rt2x00dev) > 1 &&
 +	    rt2800_hw_get_chipeco(rt2x00dev) >= 2) {
 +		rt2800_rfcsr_write_chanreg(rt2x00dev, 10, 0x51);
@@ -367,7 +379,23 @@
 +		rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x66);
 +		rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0x6B);
 +	}
-+
+ 
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0x6C);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xFC);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x1F);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x66);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0x6B);
+-
+-	/* Initialize RF channel register for DRQFN */
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0xD3);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0xE3);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0xE5);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0x28);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x68);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xF7);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x02);
+-	rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xC7);
 +	if (rt2800_hw_get_chippkg(rt2x00dev) == 0 &&
 +	    rt2800_hw_get_chipver(rt2x00dev) == 1) {
 +		/* Initialize RF channel register for DRQFN */
@@ -383,7 +411,7 @@
  
  	/* Initialize RF DC calibration register to default value */
  	rt2800_rfcsr_write_dccal(rt2x00dev, 0, 0x47);
-@@ -10615,12 +10656,17 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10757,12 +10805,17 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 62, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 63, 0x00);
  
@@ -404,5 +432,5 @@
 +		rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
 +	}
  
- 	rt6352_enable_pa_pin(rt2x00dev, 0);
- 	rt2800_r_calibration(rt2x00dev);
+ 	/* Do calibration and init PA/LNA */
+ 	rt2800_calibration_rt6352(rt2x00dev);
diff --git a/package/kernel/mac80211/patches/rt2x00/998-wifi-rt2x00-rework-MT7620-PA-LNA-RF-calibration.patch b/package/kernel/mac80211/patches/rt2x00/998-wifi-rt2x00-rework-MT7620-PA-LNA-RF-calibration.patch
deleted file mode 100644
index 1eb5ee8aa0..0000000000
--- a/package/kernel/mac80211/patches/rt2x00/998-wifi-rt2x00-rework-MT7620-PA-LNA-RF-calibration.patch
+++ /dev/null
@@ -1,413 +0,0 @@
-From: Shiji Yang <yangshiji66@outlook.com>
-Date: Tue, 25 Jul 2023 20:05:06 +0800
-Subject: [PATCH] wifi: rt2x00: rework MT7620 PA/LNA RF calibration
-
-1. Move MT7620 PA/LNA calibration code to dedicated functions.
-2. For external PA/LNA devices, restore RF and BBP registers before
-   R-Calibration.
-3. Do Rx DCOC calibration again before RXIQ calibration.
-4. Correct MAC_SYS_CTRL register RX mask to 0x08 in R-Calibration
-   function. For MAC_SYS_CTRL register, Bit[2] controls MAC_TX_EN
-   and Bit[3] controls MAC_RX_EN (Bit index starts from 0).
-5. Move the channel configuration code from rt2800_vco_calibration()
-   to the rt2800_config_channel().
-6. Use MT7620 SOC specific AGC initial LNA value instead of the
-   RT5592's value.
-7. Adjust the register operation sequence according to the vendor
-   driver code. This may not be useful, but it can make things
-   clearer when developers try to review it.
-
-Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
----
- .../net/wireless/ralink/rt2x00/rt2800lib.c    | 306 ++++++++++--------
- drivers/net/wireless/ralink/rt2x00/rt2x00.h   |   6 +
- 2 files changed, 182 insertions(+), 130 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3881,14 +3881,6 @@ static void rt2800_config_channel_rf7620
- 		rfcsr |= tx_agc_fc;
- 		rt2800_rfcsr_write_bank(rt2x00dev, 7, 59, rfcsr);
- 	}
--
--	if (conf_is_ht40(conf)) {
--		rt2800_bbp_glrt_write(rt2x00dev, 141, 0x10);
--		rt2800_bbp_glrt_write(rt2x00dev, 157, 0x2f);
--	} else {
--		rt2800_bbp_glrt_write(rt2x00dev, 141, 0x1a);
--		rt2800_bbp_glrt_write(rt2x00dev, 157, 0x40);
--	}
- }
- 
- static void rt2800_config_alc_rt6352(struct rt2x00_dev *rt2x00dev,
-@@ -4457,89 +4449,63 @@ static void rt2800_config_channel(struct
- 		usleep_range(1000, 1500);
- 	}
- 
--	if (rt2x00_rt(rt2x00dev, RT5592) || rt2x00_rt(rt2x00dev, RT6352)) {
-+	if (rt2x00_rt(rt2x00dev, RT5592)) {
- 		reg = 0x10;
--		if (!conf_is_ht40(conf)) {
--			if (rt2x00_rt(rt2x00dev, RT6352) &&
--			    rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
--				reg |= 0x5;
--			} else {
--				reg |= 0xa;
--			}
--		}
-+		if (!conf_is_ht40(conf))
-+			reg |= 0xa;
- 		rt2800_bbp_write(rt2x00dev, 195, 141);
- 		rt2800_bbp_write(rt2x00dev, 196, reg);
- 
--		/* AGC init.
--		 * Despite the vendor driver using different values here for
--		 * RT6352 chip, we use 0x1c for now. This may have to be changed
--		 * once TSSI got implemented.
--		 */
- 		reg = (rf->channel <= 14 ? 0x1c : 0x24) + 2*rt2x00dev->lna_gain;
- 		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
--
--		if (rt2x00_rt(rt2x00dev, RT5592))
--			rt2800_iq_calibrate(rt2x00dev, rf->channel);
-+	
-+		rt2800_iq_calibrate(rt2x00dev, rf->channel);
- 	}
- 
- 	if (rt2x00_rt(rt2x00dev, RT6352)) {
--		if (test_bit(CAPABILITY_EXTERNAL_PA_TX0,
--			     &rt2x00dev->cap_flags)) {
--			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
--			reg |= 0x00000101;
--			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
--
--			reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
--			reg |= 0x00000101;
--			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
--
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0x73);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0x73);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0x73);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0xC8);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xA4);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x05);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0xC8);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xA4);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x05);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x27);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0xC8);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xA4);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x05);
--			rt2800_rfcsr_write_dccal(rt2x00dev, 05, 0x00);
-+		/* BBP for GLRT BW */
-+		if (conf_is_ht40(conf)) {
-+			rt2800_bbp_glrt_write(rt2x00dev, 141, 0x10);
-+			rt2800_bbp_glrt_write(rt2x00dev, 157, 0x2f);
-+		} else {
-+			rt2800_bbp_glrt_write(rt2x00dev, 141, 0x1a);
-+			rt2800_bbp_glrt_write(rt2x00dev, 157, 0x40);
- 
--			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT,
--					      0x36303636);
--			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN,
--					      0x6C6C6B6C);
--			rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN,
--					      0x6C6C6B6C);
-+			if (rt2800_hw_get_chippkg(rt2x00dev) == 1 &&
-+				rt2x00_has_cap_external_lna_bg(rt2x00dev))
-+				rt2800_bbp_glrt_write(rt2x00dev, 141, 0x15);
- 		}
- 
--		if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
--			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
--			reg |= 0x00000101;
--			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
--
--			reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
--			reg |= 0x00000101;
--			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
--
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
--			rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
--			rt2800_bbp_write(rt2x00dev, 75, 0x68);
--			rt2800_bbp_write(rt2x00dev, 76, 0x4C);
--			rt2800_bbp_write(rt2x00dev, 79, 0x1C);
--			rt2800_bbp_write(rt2x00dev, 80, 0x0C);
--			rt2800_bbp_write(rt2x00dev, 82, 0xB6);
--			/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in
--			 * config channel function in dependence of channel and
--			 * HT20/HT40 so don't touch it
--			 */
-+		if (rt2x00dev->default_ant.rx_chain_num == 1) {
-+			rt2800_bbp_write(rt2x00dev, 91, 0x07);
-+			rt2800_bbp_write(rt2x00dev, 95, 0x1A);
-+			rt2800_bbp_write(rt2x00dev, 195, 128);
-+			rt2800_bbp_write(rt2x00dev, 196, 0xA0);
-+			rt2800_bbp_write(rt2x00dev, 195, 170);
-+			rt2800_bbp_write(rt2x00dev, 196, 0x12);
-+			rt2800_bbp_write(rt2x00dev, 195, 171);
-+			rt2800_bbp_write(rt2x00dev, 196, 0x10);
-+		} else {
-+			rt2800_bbp_write(rt2x00dev, 91, 0x06);
-+			rt2800_bbp_write(rt2x00dev, 95, 0x9A);
-+			rt2800_bbp_write(rt2x00dev, 195, 128);
-+			rt2800_bbp_write(rt2x00dev, 196, 0xE0);
-+			rt2800_bbp_write(rt2x00dev, 195, 170);
-+			rt2800_bbp_write(rt2x00dev, 196, 0x30);
-+			rt2800_bbp_write(rt2x00dev, 195, 171);
-+			rt2800_bbp_write(rt2x00dev, 196, 0x30);
- 		}
-+
-+		/* AGC init */
-+		reg = rf->channel <= 14 ? 0x04 + 2 * rt2x00dev->lna_gain : 0;
-+		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
-+
-+		/* On 11A, We should delay and wait RF/BBP to be stable
-+		 * and the appropriate time should be 1000 micro seconds
-+		 * 2005/06/05 - On 11G, we also need this delay time.
-+		 * Otherwise it's difficult to pass the WHQL.
-+		 */
-+		usleep_range(1000, 1500);
- 	}
- 
- 	bbp = rt2800_bbp_read(rt2x00dev, 4);
-@@ -5649,43 +5615,6 @@ void rt2800_vco_calibration(struct rt2x0
- 		}
- 	}
- 	rt2800_register_write(rt2x00dev, TX_PIN_CFG, tx_pin);
--
--	if (rt2x00_rt(rt2x00dev, RT6352)) {
--		if (rt2x00dev->default_ant.rx_chain_num == 1) {
--			rt2800_bbp_write(rt2x00dev, 91, 0x07);
--			rt2800_bbp_write(rt2x00dev, 95, 0x1A);
--			rt2800_bbp_write(rt2x00dev, 195, 128);
--			rt2800_bbp_write(rt2x00dev, 196, 0xA0);
--			rt2800_bbp_write(rt2x00dev, 195, 170);
--			rt2800_bbp_write(rt2x00dev, 196, 0x12);
--			rt2800_bbp_write(rt2x00dev, 195, 171);
--			rt2800_bbp_write(rt2x00dev, 196, 0x10);
--		} else {
--			rt2800_bbp_write(rt2x00dev, 91, 0x06);
--			rt2800_bbp_write(rt2x00dev, 95, 0x9A);
--			rt2800_bbp_write(rt2x00dev, 195, 128);
--			rt2800_bbp_write(rt2x00dev, 196, 0xE0);
--			rt2800_bbp_write(rt2x00dev, 195, 170);
--			rt2800_bbp_write(rt2x00dev, 196, 0x30);
--			rt2800_bbp_write(rt2x00dev, 195, 171);
--			rt2800_bbp_write(rt2x00dev, 196, 0x30);
--		}
--
--		if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
--			rt2800_bbp_write(rt2x00dev, 75, 0x68);
--			rt2800_bbp_write(rt2x00dev, 76, 0x4C);
--			rt2800_bbp_write(rt2x00dev, 79, 0x1C);
--			rt2800_bbp_write(rt2x00dev, 80, 0x0C);
--			rt2800_bbp_write(rt2x00dev, 82, 0xB6);
--		}
--
--		/* On 11A, We should delay and wait RF/BBP to be stable
--		 * and the appropriate time should be 1000 micro seconds
--		 * 2005/06/05 - On 11G, we also need this delay time.
--		 * Otherwise it's difficult to pass the WHQL.
--		 */
--		usleep_range(1000, 1500);
--	}
- }
- EXPORT_SYMBOL_GPL(rt2800_vco_calibration);
- 
-@@ -8650,7 +8579,7 @@ static void rt2800_r_calibration(struct
- 		rt2x00_warn(rt2x00dev, "Wait MAC Tx Status to MAX !!!\n");
- 
- 	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
--	maccfg &= (~0x04);
-+	maccfg &= (~0x08);
- 	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
- 
- 	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_RX)))
-@@ -10686,30 +10615,143 @@ static void rt2800_init_rfcsr_6352(struc
- 		rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
- 		rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
- 	}
-+}
- 
--	rt6352_enable_pa_pin(rt2x00dev, 0);
--	rt2800_r_calibration(rt2x00dev);
--	rt2800_rf_self_txdc_cal(rt2x00dev);
--	rt2800_rxdcoc_calibration(rt2x00dev);
--	rt2800_bw_filter_calibration(rt2x00dev, true);
--	rt2800_bw_filter_calibration(rt2x00dev, false);
--	rt2800_loft_iq_calibration(rt2x00dev);
--	rt2800_rxiq_calibration(rt2x00dev);
--	rt6352_enable_pa_pin(rt2x00dev, 1);
-+static void rt2800_init_palna_rt6352(struct rt2x00_dev *rt2x00dev)
-+{
-+	u32 reg;
-+
-+	if (rt2x00_has_cap_external_pa(rt2x00dev)) {
-+		reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
-+		reg |= 0x00000101;
-+		rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
-+
-+		reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
-+		reg |= 0x00000101;
-+		rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
-+	}
- 
--	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
-+	if (rt2800_hw_get_chippkg(rt2x00dev) == 1 &&
-+	    rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
- 		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
- 		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
- 		rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
-+	}
-+
-+	if (rt2800_hw_get_chippkg(rt2x00dev) == 1 &&
-+	    rt2x00_has_cap_external_pa(rt2x00dev)) {
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0x73);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0x73);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0x73);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0xC8);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xA4);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x05);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0xC8);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xA4);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x05);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x27);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0xC8);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xA4);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x05);
-+	}
-+
-+	if (rt2800_hw_get_chippkg(rt2x00dev) == 1 &&
-+	    rt2x00_has_cap_external_pa(rt2x00dev))
-+		rt2800_rfcsr_write_dccal(rt2x00dev, 05, 0x00);
-+
-+	if (rt2800_hw_get_chippkg(rt2x00dev) == 1 &&
-+	    rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
- 		rt2800_bbp_write(rt2x00dev, 75, 0x68);
- 		rt2800_bbp_write(rt2x00dev, 76, 0x4C);
- 		rt2800_bbp_write(rt2x00dev, 79, 0x1C);
- 		rt2800_bbp_write(rt2x00dev, 80, 0x0C);
- 		rt2800_bbp_write(rt2x00dev, 82, 0xB6);
--		/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in config
--		 * channel function in dependence of channel and HT20/HT40,
--		 * so don't touch them here.
--		 */
-+	}
-+
-+	if (rt2800_hw_get_chippkg(rt2x00dev) == 1 &&
-+	    rt2x00_has_cap_external_pa(rt2x00dev)) {
-+		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT, 0x36303636);
-+		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN, 0x6C6C6B6C);
-+		rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN, 0x6C6C6B6C);
-+	}
-+}
-+
-+static void rt2800_restore_rf_bbp_rt6352(struct rt2x00_dev *rt2x00dev)
-+{
-+	if (rt2x00_has_cap_external_pa(rt2x00dev)) {
-+		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x0);
-+		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0);
-+	}
-+
-+	if (rt2800_hw_get_chippkg(rt2x00dev) == 1 &&
-+	    rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x16);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x23);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x02);
-+	}
-+
-+	if (rt2800_hw_get_chippkg(rt2x00dev) == 1 &&
-+	    rt2x00_has_cap_external_pa(rt2x00dev)) {
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 43, 0xD3);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 44, 0xB3);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 45, 0xD5);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 46, 0x27);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 47, 0x6C);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 48, 0xFC);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 49, 0x1F);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 54, 0x27);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 55, 0x66);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 56, 0xFF);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 57, 0x1C);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 58, 0x20);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 59, 0x6B);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 60, 0xF7);
-+		rt2800_rfcsr_write_chanreg(rt2x00dev, 61, 0x09);
-+	}
-+
-+	if (rt2800_hw_get_chippkg(rt2x00dev) == 1 &&
-+	    rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
-+		rt2800_bbp_write(rt2x00dev, 75, 0x60);
-+		rt2800_bbp_write(rt2x00dev, 76, 0x44);
-+		rt2800_bbp_write(rt2x00dev, 79, 0x1C);
-+		rt2800_bbp_write(rt2x00dev, 80, 0x0C);
-+		rt2800_bbp_write(rt2x00dev, 82, 0xB6);
-+	}
-+
-+	if (rt2800_hw_get_chippkg(rt2x00dev) == 1 &&
-+	    rt2x00_has_cap_external_pa(rt2x00dev)) {
-+		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_CORRECT, 0x3630363A);
-+		rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN, 0x6C6C666C);
-+		rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN, 0x6C6C666C);
-+	}
-+}
-+
-+static void rt2800_calibration_rt6352(struct rt2x00_dev *rt2x00dev)
-+{
-+	if (rt2x00_has_cap_external_pa(rt2x00dev) ||
-+	    rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
-+		rt6352_enable_pa_pin(rt2x00dev, 0);
-+		rt2800_restore_rf_bbp_rt6352(rt2x00dev);
-+	}
-+
-+	rt2800_r_calibration(rt2x00dev);
-+	rt2800_rf_self_txdc_cal(rt2x00dev);
-+	rt2800_rxdcoc_calibration(rt2x00dev);
-+	rt2800_bw_filter_calibration(rt2x00dev, true);
-+	rt2800_bw_filter_calibration(rt2x00dev, false);
-+	rt2800_loft_iq_calibration(rt2x00dev);
-+
-+	/* missing DPD Calibration for devices using internal PA */
-+
-+	rt2800_rxdcoc_calibration(rt2x00dev);
-+	rt2800_rxiq_calibration(rt2x00dev);
-+
-+	if (rt2x00_has_cap_external_pa(rt2x00dev) ||
-+	   rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
-+		rt6352_enable_pa_pin(rt2x00dev, 1);
-+		rt2800_init_palna_rt6352(rt2x00dev);
- 	}
- }
- 
-@@ -10802,6 +10844,10 @@ int rt2800_enable_radio(struct rt2x00_de
- 	rt2800_init_bbp(rt2x00dev);
- 	rt2800_init_rfcsr(rt2x00dev);
- 
-+	/* Do calibration and init PA/LNA for RT6352 */
-+	if (rt2x00_rt(rt2x00dev, RT6352))
-+		rt2800_calibration_rt6352(rt2x00dev);
-+
- 	if (rt2x00_is_usb(rt2x00dev) &&
- 	    (rt2x00_rt(rt2x00dev, RT3070) ||
- 	     rt2x00_rt(rt2x00dev, RT3071) ||
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
-@@ -1272,6 +1272,12 @@ rt2x00_has_cap_external_lna_bg(struct rt
- }
- 
- static inline bool
-+rt2x00_has_cap_external_pa(struct rt2x00_dev *rt2x00dev)
-+{
-+	return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_EXTERNAL_PA_TX0);
-+}
-+
-+static inline bool
- rt2x00_has_cap_double_antenna(struct rt2x00_dev *rt2x00dev)
- {
- 	return rt2x00_has_cap_flag(rt2x00dev, CAPABILITY_DOUBLE_ANTENNA);
diff --git a/package/kernel/mac80211/realtek.mk b/package/kernel/mac80211/realtek.mk
index 9c14358326..48109b94b2 100644
--- a/package/kernel/mac80211/realtek.mk
+++ b/package/kernel/mac80211/realtek.mk
@@ -1,7 +1,8 @@
 PKG_DRIVERS += \
 	rtlwifi rtlwifi-pci rtlwifi-btcoexist rtlwifi-usb rtl8192c-common \
 	rtl8192ce rtl8192se rtl8192de rtl8192cu rtl8723bs rtl8821ae \
-	rtl8xxxu rtw88
+	rtl8xxxu rtw88 rtw88-pci rtw88-usb rtw88-8822b rtw88-8822c rtw88-8723d \
+	rtw88-8822be rtw88-8822bu rtw88-8822ce rtw88-8723de
 
 config-$(call config_package,rtlwifi) += RTL_CARDS RTLWIFI
 config-$(call config_package,rtlwifi-pci) += RTLWIFI_PCI
@@ -21,8 +22,16 @@ config-y += RTL8XXXU_UNTESTED
 config-$(call config_package,rtl8723bs) += RTL8723BS
 config-y += STAGING
 
-config-$(call config_package,rtw88) += RTW88 RTW88_CORE RTW88_PCI
-config-y += RTW88_8822BE RTW88_8822CE RTW88_8723DE
+config-$(call config_package,rtw88) += RTW88 RTW88_CORE
+config-$(call config_package,rtw88-pci) += RTW88_PCI
+config-$(call config_package,rtw88-usb) += RTW88_USB
+config-$(call config_package,rtw88-8822b) += RTW88_8822B
+config-$(call config_package,rtw88-8822be) += RTW88_8822BE
+config-$(call config_package,rtw88-8822bu) += RTW88_8822BU
+config-$(call config_package,rtw88-8822c) += RTW88_8822C
+config-$(call config_package,rtw88-8822ce) += RTW88_8822CE
+config-$(call config_package,rtw88-8723d) += RTW88_8723D
+config-$(call config_package,rtw88-8723de) += RTW88_8723DE
 config-$(CONFIG_PACKAGE_RTW88_DEBUG) += RTW88_DEBUG
 config-$(CONFIG_PACKAGE_RTW88_DEBUGFS) += RTW88_DEBUGFS
 
@@ -168,18 +177,88 @@ endef
 
 define KernelPackage/rtw88
   $(call KernelPackage/mac80211/Default)
-  TITLE:=Realtek RTL8822BE/RTL8822CE/RTL8723DE
-  DEPENDS+= @(PCI_SUPPORT) +kmod-mac80211 +@DRIVER_11AC_SUPPORT
-  FILES:=\
-	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822be.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822b.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822ce.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822c.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8723de.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8723d.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_core.ko \
-	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_pci.ko
-  AUTOLOAD:=$(call AutoProbe,rtw88_8822be rtw88_8822ce rtw88_8723de)
+  TITLE:=Realtek RTW88 common part
+  DEPENDS+= @(PCI_SUPPORT||USB_SUPPORT) +kmod-mac80211
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_core.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_core)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtw88-pci
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTW88 PCI chips support
+  DEPENDS+= @PCI_SUPPORT +kmod-rtw88
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_pci.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_pci)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtw88-usb
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTW88 USB chips support
+  DEPENDS+= @USB_SUPPORT +kmod-rtw88
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_usb.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_usb)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtw88-8822b
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8822B family support
+  DEPENDS+= +kmod-rtw88 +@DRIVER_11AC_SUPPORT
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822b.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8822b)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtw88-8822c
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8822C family support
+  DEPENDS+= +kmod-rtw88 +@DRIVER_11AC_SUPPORT
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822c.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8822c)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtw88-8723d
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8723D family support
+  DEPENDS+= +kmod-rtw88
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8723d.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8723d)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtw88-8822be
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8822BE support
+  DEPENDS+= +kmod-rtw88-pci +kmod-rtw88-8822b
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822be.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8822be)
+endef
+
+define KernelPackage/rtw88-8822bu
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8822BU support
+  DEPENDS+= +kmod-rtw88-usb +rtl8822be-firmware +kmod-rtw88-8822b
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822bu.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8822bu)
+endef
+
+define KernelPackage/rtw88-8822ce
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8822CE support
+  DEPENDS+= +kmod-rtw88-pci +kmod-rtw88-8822c
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8822ce.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8822ce)
+endef
+
+define KernelPackage/rtw88-8723de
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8723DE support
+  DEPENDS+= +kmod-rtw88-pci +kmod-rtw88-8723d
+  FILES:= $(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8723de.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8723)
 endef
 
 define KernelPackage/rtl8723bs
diff --git a/package/network/utils/iptables/Makefile b/package/network/utils/iptables/Makefile
index aded1b7b1f..45a2b49070 100644
--- a/package/network/utils/iptables/Makefile
+++ b/package/network/utils/iptables/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=iptables
 PKG_VERSION:=1.8.8
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_URL:=https://netfilter.org/projects/iptables/files
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
diff --git a/package/network/utils/iptables/patches/070-extensions-string-Review-parse_string-function.patch b/package/network/utils/iptables/patches/070-extensions-string-Review-parse_string-function.patch
new file mode 100644
index 0000000000..cfcb6c77f3
--- /dev/null
+++ b/package/network/utils/iptables/patches/070-extensions-string-Review-parse_string-function.patch
@@ -0,0 +1,40 @@
+From da5b32fb4656ab69fe1156eb7e36c7c961839e8a Mon Sep 17 00:00:00 2001
+From: Phil Sutter <phil@nwl.cc>
+Date: Wed, 8 Jun 2022 13:45:13 +0200
+Subject: [PATCH] extensions: string: Review parse_string() function
+
+* Compare against sizeof(info->pattern) which is more clear than having
+  to know that this buffer is of size XT_STRING_MAX_PATTERN_SIZE
+
+* Invert the check and error early to reduce indenting
+
+* Pass info->patlen to memcpy() to avoid reading past end of 's'
+
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+---
+ extensions/libxt_string.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+--- a/extensions/libxt_string.c
++++ b/extensions/libxt_string.c
+@@ -78,14 +78,13 @@ static void string_init(struct xt_entry_
+ 
+ static void
+ parse_string(const char *s, struct xt_string_info *info)
+-{	
++{
+ 	/* xt_string does not need \0 at the end of the pattern */
+-	if (strlen(s) <= XT_STRING_MAX_PATTERN_SIZE) {
+-		memcpy(info->pattern, s, XT_STRING_MAX_PATTERN_SIZE);
+-		info->patlen = strnlen(s, XT_STRING_MAX_PATTERN_SIZE);
+-		return;
+-	}
+-	xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s);
++	if (strlen(s) > sizeof(info->pattern))
++		xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s);
++
++	info->patlen = strnlen(s, sizeof(info->pattern));
++	memcpy(info->pattern, s, info->patlen);
+ }
+ 
+ static void
diff --git a/scripts/getver.sh b/scripts/getver.sh
index 49260a2260..61906040b1 100755
--- a/scripts/getver.sh
+++ b/scripts/getver.sh
@@ -21,7 +21,7 @@ try_git() {
 	r*)
 		GET_REV="$(echo $GET_REV | tr -d 'r')"
 		BASE_REV="$(git rev-list ${REBOOT}..HEAD 2>/dev/null | wc -l | awk '{print $1}')"
-		REV="$(git rev-parse HEAD~$((BASE_REV - GET_REV)))"
+		[ $((BASE_REV - GET_REV)) -ge 0 ] && REV="$(git rev-parse HEAD~$((BASE_REV - GET_REV)))"
 		;;
 	*)
 		BRANCH="$(git rev-parse --abbrev-ref HEAD)"
diff --git a/target/linux/mediatek/dts/mt7622-dlink-eagle-pro-ai-m32-a1.dts b/target/linux/mediatek/dts/mt7622-dlink-eagle-pro-ai-m32-a1.dts
new file mode 100644
index 0000000000..ca680e4c29
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7622-dlink-eagle-pro-ai-m32-a1.dts
@@ -0,0 +1,399 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7622.dtsi"
+#include "mt6380.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "D-Link EAGLE PRO AI M32 A1";
+	compatible = "dlink,eagle-pro-ai-m32-a1", "mediatek,mt7622";
+
+	aliases {
+		led-boot = &status_orange;
+		led-failsafe = &status_red;
+		led-running = &status_white;
+		led-upgrade = &status_red;
+		serial0 = &uart0;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n8 swiotlb=512";
+	};
+
+	cpus {
+		cpu@0 {
+			proc-supply = <&mt6380_vcpu_reg>;
+			sram-supply = <&mt6380_vm_reg>;
+		};
+
+		cpu@1 {
+			proc-supply = <&mt6380_vcpu_reg>;
+			sram-supply = <&mt6380_vm_reg>;
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			gpios = <&pio 102 GPIO_ACTIVE_LOW>;
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		status_white: status_white {
+			label = "white:status";
+			gpios = <&pio 85 GPIO_ACTIVE_LOW>;
+		};
+
+		status_orange: status_orange {
+			label = "orange:status";
+			gpios = <&pio 20 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		status_red: status_red {
+			label = "red:status";
+			gpios = <&pio 17 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x40000000>;
+	};
+};
+
+&bch {
+	status = "okay";
+};
+
+&btif {
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&eth_pins>;
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		nvmem-cells = <&macaddr_odm_83>;
+		nvmem-cell-names = "mac-address";
+		phy-mode = "2500base-x";
+		reg = <0>;
+
+		fixed-link {
+			full-duplex;
+			pause;
+			speed = <2500>;
+		};
+	};
+
+	mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		switch@0 {
+			compatible = "mediatek,mt7531";
+			reg = <0>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			interrupt-parent = <&pio>;
+			interrupts = <53 IRQ_TYPE_LEVEL_HIGH>;
+			reset-gpios = <&pio 54 0>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@2 {
+					reg = <2>;
+					label = "lan2";
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan1";
+				};
+
+				wan: port@4 {
+					reg = <4>;
+					label = "wan";
+				};
+
+				port@6 {
+					reg = <6>;
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&pcie0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie0_pins>;
+	status = "okay";
+};
+
+&pcie1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie1_pins>;
+	status = "okay";
+};
+
+&pio {
+    epa_elna_pins: epa-elna-pins {
+		mux {
+			function = "antsel";
+			groups = "antsel0", "antsel1", "antsel2", "antsel3",
+				  "antsel4", "antsel5", "antsel6", "antsel7",
+      				  "antsel8", "antsel9", "antsel12", "antsel13",
+    				  "antsel14", "antsel15", "antsel16", "antsel17";
+		};
+	};
+
+	eth_pins: eth-pins {
+		mux {
+			function = "eth";
+			groups = "mdc_mdio", "rgmii_via_gmac2";
+		};
+	};
+
+	pcie0_pins: pcie0-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie0_pad_perst",
+				 "pcie0_1_waken",
+				 "pcie0_1_clkreq";
+		};
+	};
+
+	pcie1_pins: pcie1-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie1_pad_perst",
+				 "pcie1_0_waken",
+				 "pcie1_0_clkreq";
+		};
+	};
+
+	pmic_bus_pins: pmic-bus-pins {
+		mux {
+			function = "pmic";
+			groups = "pmic_bus";
+		};
+	};
+
+	/* Serial NAND is shared pin with SPI-NOR */
+	serial_nand_pins: serial-nand-pins {
+		mux {
+			function = "flash";
+			groups = "snfi";
+		};
+	};
+
+	uart0_pins: uart0-pins {
+		mux {
+			function = "uart";
+			groups = "uart0_0_tx_rx";
+		};
+	};
+
+	watchdog_pins: watchdog-pins {
+		mux {
+			function = "watchdog";
+			groups = "watchdog";
+		};
+	};
+};
+
+&pwrap {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pmic_bus_pins>;
+	status = "okay";
+};
+
+&rtc {
+	status = "disabled";
+};
+
+&sata {
+	status = "disabled";
+};
+
+&sata_phy {
+	status = "disabled";
+};
+
+&slot0 {
+	wmac1: mt7915@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		ieee80211-freq-limit = <5000000 6000000>;
+		mediatek,mtd-eeprom = <&factory 0x05000>;
+	};
+};
+
+&snfi {
+	pinctrl-names = "default";
+	pinctrl-0 = <&serial_nand_pins>;
+	status = "okay";
+
+	snand: flash@0 {
+		compatible = "spi-nand";
+		mediatek,bmt-table-size = <0x1000>;
+		mediatek,bmt-v2;
+		nand-ecc-engine = <&snfi>;
+		reg = <0>;
+		spi-rx-bus-width = <4>;
+		spi-tx-bus-width = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Preloader";
+				reg = <0x00000000 0x00080000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "ATF";
+				reg = <0x00080000 0x00040000>;
+				read-only;
+			};
+
+			partition@C0000 {
+				label = "Bootloader";
+				reg = <0x000C0000 0x00080000>;
+				read-only;
+			};
+
+			partition@140000 {
+				label = "BootConfig";
+				reg = <0x00140000 0x00040000>;
+				read-only;
+			};
+
+			odm: partition@180000 {
+				compatible = "nvmem-cells";
+				label = "Odm";
+				reg = <0x00180000 0x00040000>;
+				read-only;
+
+				macaddr_odm_83: macaddr@83 {
+					reg = <0x83 0x6>;
+				};
+			};
+
+			config1: partition@1C0000 {
+				compatible = "nvmem-cells";
+				label = "Config1";
+				reg = <0x001C0000 0x00080000>;
+				#address-cells = <1>;
+				#size-cells = <1>;
+				read-only;
+			};
+
+			partition@240000 {
+				label = "Config2";
+				reg = <0x00240000 0x00080000>;
+				read-only;
+			};
+
+			partition@2C0000 {
+				label = "Kernel1";
+				reg = <0x002C0000 0x02D00000>;
+
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+				partition@0 {
+					label = "kernel";
+					reg = <0x00000000 0x00800000>;
+				};
+
+				partition@800000 {
+					label = "ubi";
+					reg = <0x00800000 0x02500000>;
+				};
+			};
+
+			partition@2FC0000 {
+				label = "Kernel2";
+				reg = <0x02FC0000 0x02D00000>;
+				read-only;
+			};
+
+			factory: partition@5CC0000 {
+				label = "Factory";
+				reg = <0x05CC0000 0x00100000>;
+				read-only;
+			};
+
+			partition@5DC0000 {
+				label = "Mydlink";
+				reg = <0x05DC0000 0x00200000>;
+				read-only;
+			};
+
+			partition@5FC0000 {
+				label = "Storage";
+				reg = <0x05FC0000 0x00300000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ssusb {
+	status = "disabled";
+};
+
+&u3phy {
+	status = "disabled";
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins>;
+	status = "okay";
+};
+
+&watchdog {
+	pinctrl-names = "default";
+	pinctrl-0 = <&watchdog_pins>;
+	status = "okay";
+};
+
+&wmac {
+	pinctrl-names = "default";
+	pinctrl-0 = <&epa_elna_pins>;
+	mediatek,mtd-eeprom = <&factory 0x0000>;
+	status = "okay";
+};
+
diff --git a/target/linux/mediatek/dts/mt7629-tplink_eap225-v5.dts b/target/linux/mediatek/dts/mt7629-tplink_eap225-v5.dts
new file mode 100644
index 0000000000..52e22541fa
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7629-tplink_eap225-v5.dts
@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include "mt7629.dtsi"
+
+/ {
+	model = "TP-Link EAP225 v5";
+	compatible = "tplink,eap225-v5", "mediatek,mt7629";
+
+	aliases {
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_amber;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_amber;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-override = "console=ttyS0,115200n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&pio 21 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_green: status_green {
+			label = "green:status";
+			gpios = <&pio 55 GPIO_ACTIVE_HIGH>;
+			default-state = "on";
+		};
+
+		led_status_amber: status_amber {
+			label = "amber:status";
+			gpios = <&pio 56 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&eth_pins>;
+	pinctrl-1 = <&ephy_leds_pins>;
+	status = "okay";
+
+	mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&phy0>;
+		nvmem-cells = <&macaddr_factory_8>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		phy0: ethernet-phy@0 {
+			reg = <0>;
+		};
+	};
+};
+
+&qspi {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&qspi_pins>;
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Bootloader";
+				reg = <0x0 0x00080000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "Partition";
+				reg = <0x00080000 0x00010000>;
+				read-only;
+			};
+
+			partition@90000 {
+				label = "Factory";
+				reg = <0x00090000 0x00010000>;
+				compatible = "nvmem-cells";
+				read-only;
+
+				macaddr_factory_8: macaddr@8 {
+					reg = <0x8 0x6>;
+				};
+			};
+
+			partition@A0000 {
+				label = "Radio";
+				reg = <0x000A0000 0x00010000>;
+				read-only;
+			};
+
+			partition@B0000 {
+				label = "Extra";
+				reg = <0x000B0000 0x00010000>;
+				read-only;
+			};
+
+			/* Vendor layout: kernel (0x000C0000 0x001A0000) - rootfs (0x00260000 0x00BE0000) */
+			/* OpenWrt flash layout: combine kernel and rootfs from OEM layout */
+			partition@C0000 {
+				label = "firmware";
+				reg = <0x000C0000 0x00D80000>;
+			};
+
+			partition@E40000 {
+				label = "Config";
+				reg = <0x00E40000 0x0001B0000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pio {
+	eth_pins: eth-pins {
+		mux {
+			function = "eth";
+			groups = "mdc_mdio";
+		};
+	};
+
+	ephy_leds_pins: ephy-leds-pins {
+		mux {
+			function = "led";
+			groups = "ephy_leds";
+		};
+	};
+
+	qspi_pins: qspi-pins {
+		mux {
+			function = "flash";
+			groups = "spi_nor";
+		};
+	};
+
+	uart0_pins: uart0-pins {
+		mux {
+			function = "uart";
+			groups = "uart0_txd_rxd" ;
+		};
+	};
+
+	watchdog_pins: watchdog-pins {
+		mux {
+			function = "watchdog";
+			groups = "watchdog";
+		};
+	};
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins>;
+	status = "okay";
+};
+
+&watchdog {
+	pinctrl-names = "default";
+	pinctrl-0 = <&watchdog_pins>;
+	status = "okay";
+};
diff --git a/target/linux/mediatek/image/mt7622.mk b/target/linux/mediatek/image/mt7622.mk
index 65db1ebe2e..85776ef6d9 100644
--- a/target/linux/mediatek/image/mt7622.mk
+++ b/target/linux/mediatek/image/mt7622.mk
@@ -37,6 +37,25 @@ define Build/bl31-uboot
 	cat $(STAGING_DIR_IMAGE)/mt7622_$1-u-boot.fip >> $@
 endef
 
+# Append header to a D-Link M32 Kernel 1 partition
+define Build/m32-recovery-header-kernel1
+	echo -en "DLK6E6010001\x00\x00\xCF\x33" > "$@.header"
+	echo -en "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x8D\x57\x30\x0B" >> "$@.header"
+# Byte 0-3: Erase Start 0x002C0000
+# Byte 4-7: Erase Length 0x02D00000
+# Byte 8-11: Data offset: 0x002C0000
+# Byte 12-15: Data Length: 0x02D00000
+	echo -en "\x00\x00\x2C\x00\x00\x00\xD0\x02\x00\x00\x2C\x00\x00\x00\xD0\x02" >> "$@.header"
+# Only zeros
+	echo -en "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" >> "$@.header"
+# Note: The last 2 bytes of the following line are the checksum of the header
+# If any data in the header will be changed, the checksum must be re-calculated
+	echo -en "\x42\x48\x02\x00\x00\x00\x08\x00\x00\x00\x00\x00\x60\x6E\x68\x61" >> "$@.header"
+	cat "$@.header" "$@" > "$@.new"
+	mv "$@.new" "$@"
+	rm "$@.header"
+endef
+
 define Build/mt7622-gpt
 	cp $@ $@.tmp 2>/dev/null || true
 	ptgen -g -o $@.tmp -a 1 -l 1024 \
@@ -147,6 +166,25 @@ define Device/buffalo_wsr-3200ax4s
 endef
 TARGET_DEVICES += buffalo_wsr-3200ax4s
 
+define Device/dlink_eagle-pro-ai-m32-a1
+  IMAGE_SIZE := 46080k
+  DEVICE_VENDOR := D-Link
+  DEVICE_MODEL := EAGLE PRO AI M32
+  DEVICE_VARIANT := A1
+  DEVICE_DTS := mt7622-dlink-eagle-pro-ai-m32-a1
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915-firmware
+  KERNEL_SIZE := 8192k
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  UBINIZE_OPTS := -E 5
+  IMAGES += tftp.bin recovery.bin
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  IMAGE/tftp.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | check-size
+  IMAGE/recovery.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | pad-to $$(IMAGE_SIZE) | m32-recovery-header-kernel1
+endef
+TARGET_DEVICES += dlink_eagle-pro-ai-m32-a1
+
 define Device/elecom_wrc-2533gent
   DEVICE_VENDOR := Elecom
   DEVICE_MODEL := WRC-2533GENT
diff --git a/target/linux/mediatek/image/mt7629.mk b/target/linux/mediatek/image/mt7629.mk
index 33c557190f..9374228808 100644
--- a/target/linux/mediatek/image/mt7629.mk
+++ b/target/linux/mediatek/image/mt7629.mk
@@ -48,3 +48,12 @@ define Device/netgear_ex6250-v2
 	pad-rootfs | check-size | netgear-encrypted-factory
 endef
 TARGET_DEVICES += netgear_ex6250-v2
+
+define Device/tplink_eap225-v5
+  DEVICE_VENDOR := TP-Link
+  DEVICE_MODEL := EAP225
+  DEVICE_VARIANT := v5
+  DEVICE_DTS := mt7629-tplink_eap225-v5
+  DEVICE_DTS_DIR := ../dts
+endef
+TARGET_DEVICES += tplink_eap225-v5
diff --git a/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network b/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network
index d1341099bc..75c5e37be1 100644
--- a/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/mt7622/base-files/etc/board.d/02_network
@@ -24,6 +24,9 @@ mediatek_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0:lan" "1:lan" "2:lan" "3:lan" "4:wan" "6@eth0"
 		;;
+	dlink,eagle-pro-ai-m32-a1)
+		ucidef_set_interfaces_lan_wan "lan1 lan2" wan
+		;;
 	ubnt,unifi-6-lr*)
 		ucidef_set_interface_lan "eth0"
 		;;
@@ -61,6 +64,10 @@ mediatek_setup_macs()
 		wan_mac=$lan_mac
 		label_mac=$lan_mac
 		;;
+	dlink,eagle-pro-ai-m32-a1)
+		wan_mac=$(get_mac_label)
+		lan_mac=$(macaddr_add $(get_mac_label) 1)
+		;;
 	reyee,ax3200-e5|\
 	ruijie,rg-ew3200gx-pro)
 		lan_mac=$(macaddr_add $(get_mac_label) 1)
diff --git a/target/linux/mediatek/mt7622/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/target/linux/mediatek/mt7622/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
index 7ee9f24071..e9cc592237 100644
--- a/target/linux/mediatek/mt7622/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
+++ b/target/linux/mediatek/mt7622/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -18,6 +18,10 @@ case "$board" in
 		[ "$PHYNBR" = "0" ] && macaddr_add $basemac 1 > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && macaddr_add $basemac 8 > /sys${DEVPATH}/macaddress
 		;;
+	dlink,eagle-pro-ai-m32-a1)
+		[ "$PHYNBR" = "0" ] && macaddr_add $(cat /sys/class/net/eth0/address) 2 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $(cat /sys/class/net/eth0/address) 3 > /sys${DEVPATH}/macaddress
+		;;
 	reyee,ax3200-e5|\
 	ruijie,rg-ew3200gx-pro)
 		[ "$PHYNBR" = "0" ] && macaddr_add $(get_mac_label) 3 > /sys${DEVPATH}/macaddress
diff --git a/target/linux/mediatek/mt7622/base-files/lib/upgrade/platform.sh b/target/linux/mediatek/mt7622/base-files/lib/upgrade/platform.sh
index ea3176d2d1..e256d2b533 100755
--- a/target/linux/mediatek/mt7622/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mediatek/mt7622/base-files/lib/upgrade/platform.sh
@@ -34,6 +34,7 @@ platform_do_upgrade() {
 			nand_do_upgrade "$1"
 		fi
 		;;
+	dlink,eagle-pro-ai-m32-a1|\
 	elecom,wrc-x3200gst3|\
 	mediatek,mt7622-rfb1-ubi|\
 	netgear,wax206|\
@@ -72,6 +73,7 @@ platform_check_image() {
 	buffalo,wsr-3200ax4s)
 		buffalo_check_image "$board" "$magic" "$1" || return 1
 		;;
+  	dlink,eagle-pro-ai-m32-a1|\
 	elecom,wrc-x3200gst3|\
 	mediatek,mt7622-rfb1-ubi|\
 	netgear,wax206|\
diff --git a/target/linux/mediatek/mt7629/base-files/etc/board.d/02_network b/target/linux/mediatek/mt7629/base-files/etc/board.d/02_network
index db931c8334..df042f8ad2 100644
--- a/target/linux/mediatek/mt7629/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/mt7629/base-files/etc/board.d/02_network
@@ -16,7 +16,8 @@ mediatek_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0:lan" "1:lan" "2:lan" "3:lan" "6@eth0"
 		;;
-	netgear,ex6250-v2)
+	netgear,ex6250-v2|\
+	tplink,eap225-v5)
 		ucidef_set_interface_lan "eth0"
 		;;
 	esac
diff --git a/target/linux/mvebu/patches-5.15/106-Revert-i2c-pxa-move-to-generic-GPIO-recovery.patch b/target/linux/mvebu/patches-5.15/106-Revert-i2c-pxa-move-to-generic-GPIO-recovery.patch
new file mode 100644
index 0000000000..7a0dc15ff6
--- /dev/null
+++ b/target/linux/mvebu/patches-5.15/106-Revert-i2c-pxa-move-to-generic-GPIO-recovery.patch
@@ -0,0 +1,139 @@
+From ea8444b6fa5955c16b713dc83310882b93b44e62 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Fri, 10 Nov 2023 10:10:29 +0100
+Subject: [PATCH] Revert "i2c: pxa: move to generic GPIO recovery"
+
+This reverts commit 0b01392c18b9993a584f36ace1d61118772ad0ca.
+
+Conversion of PXA to generic I2C recovery, makes the I2C bus completely
+lock up if recovery pinctrl is present in the DT and I2C recovery is
+enabled.
+
+So, until the generic I2C recovery can also work with PXA lets revert
+to have working I2C and I2C recovery again.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+Cc: stable@vger.kernel.org # 5.11+
+---
+ drivers/i2c/busses/i2c-pxa.c | 76 ++++++++++++++++++++++++++++++++----
+ 1 file changed, 68 insertions(+), 8 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-pxa.c
++++ b/drivers/i2c/busses/i2c-pxa.c
+@@ -264,6 +264,9 @@ struct pxa_i2c {
+ 	u32			hs_mask;
+ 
+ 	struct i2c_bus_recovery_info recovery;
++	struct pinctrl		*pinctrl;
++	struct pinctrl_state	*pinctrl_default;
++	struct pinctrl_state	*pinctrl_recovery;
+ };
+ 
+ #define _IBMR(i2c)	((i2c)->reg_ibmr)
+@@ -1302,12 +1305,13 @@ static void i2c_pxa_prepare_recovery(str
+ 	 */
+ 	gpiod_set_value(i2c->recovery.scl_gpiod, ibmr & IBMR_SCLS);
+ 	gpiod_set_value(i2c->recovery.sda_gpiod, ibmr & IBMR_SDAS);
++
++	WARN_ON(pinctrl_select_state(i2c->pinctrl, i2c->pinctrl_recovery));
+ }
+ 
+ static void i2c_pxa_unprepare_recovery(struct i2c_adapter *adap)
+ {
+ 	struct pxa_i2c *i2c = adap->algo_data;
+-	struct i2c_bus_recovery_info *bri = adap->bus_recovery_info;
+ 	u32 isr;
+ 
+ 	/*
+@@ -1321,7 +1325,7 @@ static void i2c_pxa_unprepare_recovery(s
+ 		i2c_pxa_do_reset(i2c);
+ 	}
+ 
+-	WARN_ON(pinctrl_select_state(bri->pinctrl, bri->pins_default));
++	WARN_ON(pinctrl_select_state(i2c->pinctrl, i2c->pinctrl_default));
+ 
+ 	dev_dbg(&i2c->adap.dev, "recovery: IBMR 0x%08x ISR 0x%08x\n",
+ 	        readl(_IBMR(i2c)), readl(_ISR(i2c)));
+@@ -1343,20 +1347,76 @@ static int i2c_pxa_init_recovery(struct
+ 	if (IS_ENABLED(CONFIG_I2C_PXA_SLAVE))
+ 		return 0;
+ 
+-	bri->pinctrl = devm_pinctrl_get(dev);
+-	if (PTR_ERR(bri->pinctrl) == -ENODEV) {
+-		bri->pinctrl = NULL;
++	i2c->pinctrl = devm_pinctrl_get(dev);
++	if (PTR_ERR(i2c->pinctrl) == -ENODEV)
++		i2c->pinctrl = NULL;
++	if (IS_ERR(i2c->pinctrl))
++		return PTR_ERR(i2c->pinctrl);
++
++	if (!i2c->pinctrl)
++		return 0;
++
++	i2c->pinctrl_default = pinctrl_lookup_state(i2c->pinctrl,
++						    PINCTRL_STATE_DEFAULT);
++	i2c->pinctrl_recovery = pinctrl_lookup_state(i2c->pinctrl, "recovery");
++
++	if (IS_ERR(i2c->pinctrl_default) || IS_ERR(i2c->pinctrl_recovery)) {
++		dev_info(dev, "missing pinmux recovery information: %ld %ld\n",
++			 PTR_ERR(i2c->pinctrl_default),
++			 PTR_ERR(i2c->pinctrl_recovery));
++		return 0;
++	}
++
++	/*
++	 * Claiming GPIOs can influence the pinmux state, and may glitch the
++	 * I2C bus. Do this carefully.
++	 */
++	bri->scl_gpiod = devm_gpiod_get(dev, "scl", GPIOD_OUT_HIGH_OPEN_DRAIN);
++	if (bri->scl_gpiod == ERR_PTR(-EPROBE_DEFER))
++		return -EPROBE_DEFER;
++	if (IS_ERR(bri->scl_gpiod)) {
++		dev_info(dev, "missing scl gpio recovery information: %pe\n",
++			 bri->scl_gpiod);
++		return 0;
++	}
++
++	/*
++	 * We have SCL. Pull SCL low and wait a bit so that SDA glitches
++	 * have no effect.
++	 */
++	gpiod_direction_output(bri->scl_gpiod, 0);
++	udelay(10);
++	bri->sda_gpiod = devm_gpiod_get(dev, "sda", GPIOD_OUT_HIGH_OPEN_DRAIN);
++
++	/* Wait a bit in case of a SDA glitch, and then release SCL. */
++	udelay(10);
++	gpiod_direction_output(bri->scl_gpiod, 1);
++
++	if (bri->sda_gpiod == ERR_PTR(-EPROBE_DEFER))
++		return -EPROBE_DEFER;
++
++	if (IS_ERR(bri->sda_gpiod)) {
++		dev_info(dev, "missing sda gpio recovery information: %pe\n",
++			 bri->sda_gpiod);
+ 		return 0;
+ 	}
+-	if (IS_ERR(bri->pinctrl))
+-		return PTR_ERR(bri->pinctrl);
+ 
+ 	bri->prepare_recovery = i2c_pxa_prepare_recovery;
+ 	bri->unprepare_recovery = i2c_pxa_unprepare_recovery;
++	bri->recover_bus = i2c_generic_scl_recovery;
+ 
+ 	i2c->adap.bus_recovery_info = bri;
+ 
+-	return 0;
++	/*
++	 * Claiming GPIOs can change the pinmux state, which confuses the
++	 * pinctrl since pinctrl's idea of the current setting is unaffected
++	 * by the pinmux change caused by claiming the GPIO. Work around that
++	 * by switching pinctrl to the GPIO state here. We do it this way to
++	 * avoid glitching the I2C bus.
++	 */
++	pinctrl_select_state(i2c->pinctrl, i2c->pinctrl_recovery);
++
++	return pinctrl_select_state(i2c->pinctrl, i2c->pinctrl_default);
+ }
+ 
+ static int i2c_pxa_probe(struct platform_device *dev)
diff --git a/target/linux/mvebu/patches-6.1/106-Revert-i2c-pxa-move-to-generic-GPIO-recovery.patch b/target/linux/mvebu/patches-6.1/106-Revert-i2c-pxa-move-to-generic-GPIO-recovery.patch
new file mode 100644
index 0000000000..7a0dc15ff6
--- /dev/null
+++ b/target/linux/mvebu/patches-6.1/106-Revert-i2c-pxa-move-to-generic-GPIO-recovery.patch
@@ -0,0 +1,139 @@
+From ea8444b6fa5955c16b713dc83310882b93b44e62 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Fri, 10 Nov 2023 10:10:29 +0100
+Subject: [PATCH] Revert "i2c: pxa: move to generic GPIO recovery"
+
+This reverts commit 0b01392c18b9993a584f36ace1d61118772ad0ca.
+
+Conversion of PXA to generic I2C recovery, makes the I2C bus completely
+lock up if recovery pinctrl is present in the DT and I2C recovery is
+enabled.
+
+So, until the generic I2C recovery can also work with PXA lets revert
+to have working I2C and I2C recovery again.
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+Cc: stable@vger.kernel.org # 5.11+
+---
+ drivers/i2c/busses/i2c-pxa.c | 76 ++++++++++++++++++++++++++++++++----
+ 1 file changed, 68 insertions(+), 8 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-pxa.c
++++ b/drivers/i2c/busses/i2c-pxa.c
+@@ -264,6 +264,9 @@ struct pxa_i2c {
+ 	u32			hs_mask;
+ 
+ 	struct i2c_bus_recovery_info recovery;
++	struct pinctrl		*pinctrl;
++	struct pinctrl_state	*pinctrl_default;
++	struct pinctrl_state	*pinctrl_recovery;
+ };
+ 
+ #define _IBMR(i2c)	((i2c)->reg_ibmr)
+@@ -1302,12 +1305,13 @@ static void i2c_pxa_prepare_recovery(str
+ 	 */
+ 	gpiod_set_value(i2c->recovery.scl_gpiod, ibmr & IBMR_SCLS);
+ 	gpiod_set_value(i2c->recovery.sda_gpiod, ibmr & IBMR_SDAS);
++
++	WARN_ON(pinctrl_select_state(i2c->pinctrl, i2c->pinctrl_recovery));
+ }
+ 
+ static void i2c_pxa_unprepare_recovery(struct i2c_adapter *adap)
+ {
+ 	struct pxa_i2c *i2c = adap->algo_data;
+-	struct i2c_bus_recovery_info *bri = adap->bus_recovery_info;
+ 	u32 isr;
+ 
+ 	/*
+@@ -1321,7 +1325,7 @@ static void i2c_pxa_unprepare_recovery(s
+ 		i2c_pxa_do_reset(i2c);
+ 	}
+ 
+-	WARN_ON(pinctrl_select_state(bri->pinctrl, bri->pins_default));
++	WARN_ON(pinctrl_select_state(i2c->pinctrl, i2c->pinctrl_default));
+ 
+ 	dev_dbg(&i2c->adap.dev, "recovery: IBMR 0x%08x ISR 0x%08x\n",
+ 	        readl(_IBMR(i2c)), readl(_ISR(i2c)));
+@@ -1343,20 +1347,76 @@ static int i2c_pxa_init_recovery(struct
+ 	if (IS_ENABLED(CONFIG_I2C_PXA_SLAVE))
+ 		return 0;
+ 
+-	bri->pinctrl = devm_pinctrl_get(dev);
+-	if (PTR_ERR(bri->pinctrl) == -ENODEV) {
+-		bri->pinctrl = NULL;
++	i2c->pinctrl = devm_pinctrl_get(dev);
++	if (PTR_ERR(i2c->pinctrl) == -ENODEV)
++		i2c->pinctrl = NULL;
++	if (IS_ERR(i2c->pinctrl))
++		return PTR_ERR(i2c->pinctrl);
++
++	if (!i2c->pinctrl)
++		return 0;
++
++	i2c->pinctrl_default = pinctrl_lookup_state(i2c->pinctrl,
++						    PINCTRL_STATE_DEFAULT);
++	i2c->pinctrl_recovery = pinctrl_lookup_state(i2c->pinctrl, "recovery");
++
++	if (IS_ERR(i2c->pinctrl_default) || IS_ERR(i2c->pinctrl_recovery)) {
++		dev_info(dev, "missing pinmux recovery information: %ld %ld\n",
++			 PTR_ERR(i2c->pinctrl_default),
++			 PTR_ERR(i2c->pinctrl_recovery));
++		return 0;
++	}
++
++	/*
++	 * Claiming GPIOs can influence the pinmux state, and may glitch the
++	 * I2C bus. Do this carefully.
++	 */
++	bri->scl_gpiod = devm_gpiod_get(dev, "scl", GPIOD_OUT_HIGH_OPEN_DRAIN);
++	if (bri->scl_gpiod == ERR_PTR(-EPROBE_DEFER))
++		return -EPROBE_DEFER;
++	if (IS_ERR(bri->scl_gpiod)) {
++		dev_info(dev, "missing scl gpio recovery information: %pe\n",
++			 bri->scl_gpiod);
++		return 0;
++	}
++
++	/*
++	 * We have SCL. Pull SCL low and wait a bit so that SDA glitches
++	 * have no effect.
++	 */
++	gpiod_direction_output(bri->scl_gpiod, 0);
++	udelay(10);
++	bri->sda_gpiod = devm_gpiod_get(dev, "sda", GPIOD_OUT_HIGH_OPEN_DRAIN);
++
++	/* Wait a bit in case of a SDA glitch, and then release SCL. */
++	udelay(10);
++	gpiod_direction_output(bri->scl_gpiod, 1);
++
++	if (bri->sda_gpiod == ERR_PTR(-EPROBE_DEFER))
++		return -EPROBE_DEFER;
++
++	if (IS_ERR(bri->sda_gpiod)) {
++		dev_info(dev, "missing sda gpio recovery information: %pe\n",
++			 bri->sda_gpiod);
+ 		return 0;
+ 	}
+-	if (IS_ERR(bri->pinctrl))
+-		return PTR_ERR(bri->pinctrl);
+ 
+ 	bri->prepare_recovery = i2c_pxa_prepare_recovery;
+ 	bri->unprepare_recovery = i2c_pxa_unprepare_recovery;
++	bri->recover_bus = i2c_generic_scl_recovery;
+ 
+ 	i2c->adap.bus_recovery_info = bri;
+ 
+-	return 0;
++	/*
++	 * Claiming GPIOs can change the pinmux state, which confuses the
++	 * pinctrl since pinctrl's idea of the current setting is unaffected
++	 * by the pinmux change caused by claiming the GPIO. Work around that
++	 * by switching pinctrl to the GPIO state here. We do it this way to
++	 * avoid glitching the I2C bus.
++	 */
++	pinctrl_select_state(i2c->pinctrl, i2c->pinctrl_recovery);
++
++	return pinctrl_select_state(i2c->pinctrl, i2c->pinctrl_default);
+ }
+ 
+ static int i2c_pxa_probe(struct platform_device *dev)
diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index 7efb39a50a..e1d7e881c2 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -685,10 +685,9 @@ define Device/dlink_dir-8xx-a1
   DEVICE_VENDOR := D-Link
   DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
   KERNEL := $$(KERNEL) | uimage-sgehdr
-  IMAGES += factory.bin
-  IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | \
-	check-size | append-metadata
-  IMAGE/factory.bin := append-kernel | append-rootfs | check-size
+  IMAGES += recovery.bin factory.bin
+  IMAGE/recovery.bin := append-kernel | append-rootfs | check-size
+  IMAGE/factory.bin := $$(IMAGE/recovery.bin) | dlink-sge-image $$$$(DEVICE_MODEL)
 endef
 
 define Device/dlink_dir-8xx-r1
@@ -708,8 +707,8 @@ define Device/dlink_dir-xx60-a1
   DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
 	kmod-usb-ledtrig-usbport -uboot-envtools
   KERNEL := $$(KERNEL) | uimage-sgehdr
-  IMAGES += factory.bin
-  IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
+  IMAGES += recovery.bin
+  IMAGE/recovery.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
 	check-size
 endef
 
@@ -761,6 +760,8 @@ define Device/dlink_dir-853-a3
   $(Device/dlink_dir-xx60-a1)
   DEVICE_MODEL := DIR-853
   DEVICE_VARIANT := A3
+  IMAGES += factory.bin
+  IMAGE/factory.bin := $$(IMAGE/recovery.bin) | dlink-sge-image $$(DEVICE_MODEL)
 endef
 TARGET_DEVICES += dlink_dir-853-a3
 
@@ -2082,6 +2083,7 @@ TARGET_DEVICES += samknows_whitebox-v8
 
 define Device/sercomm_na502
   $(Device/nand)
+  $(Device/uimage-lzma-loader)
   IMAGE_SIZE := 20480k
   DEVICE_VENDOR := SERCOMM
   DEVICE_MODEL := NA502