diff --git a/include/image-commands.mk b/include/image-commands.mk
index daa01a3d09..684646e233 100644
--- a/include/image-commands.mk
+++ b/include/image-commands.mk
@@ -207,13 +207,16 @@ endef
 define Build/fit
 	$(TOPDIR)/scripts/mkits.sh \
 		-D $(DEVICE_NAME) -o $@.its -k $@ \
-		$(if $(word 2,$(1)),-d $(word 2,$(1))) -C $(word 1,$(1)) \
+		-C $(word 1,$(1)) $(if $(word 2,$(1)),\
+		$(if $(DEVICE_DTS_OVERLAY),-d $(KERNEL_BUILD_DIR)/image-$$(basename $(word 2,$(1))),\
+			-d $(word 2,$(1)))) \
 		$(if $(findstring with-rootfs,$(word 3,$(1))),-r $(IMAGE_ROOTFS)) \
 		$(if $(findstring with-initrd,$(word 3,$(1))), \
 			$(if $(CONFIG_TARGET_ROOTFS_INITRAMFS_SEPARATE), \
 				-i $(KERNEL_BUILD_DIR)/initrd.cpio$(strip $(call Build/initrd_compression)))) \
 		-a $(KERNEL_LOADADDR) -e $(if $(KERNEL_ENTRY),$(KERNEL_ENTRY),$(KERNEL_LOADADDR)) \
 		$(if $(DEVICE_FDT_NUM),-n $(DEVICE_FDT_NUM)) \
+		$(if $(DEVICE_DTS_OVERLAY),$(foreach dtso,$(DEVICE_DTS_OVERLAY), -O $(dtso):$(KERNEL_BUILD_DIR)/image-$(dtso).dtb)) \
 		-c $(if $(DEVICE_DTS_CONFIG),$(DEVICE_DTS_CONFIG),"config-1") \
 		-A $(LINUX_KARCH) -v $(LINUX_VERSION)
 	PATH=$(LINUX_DIR)/scripts/dtc:$(PATH) mkimage $(if $(findstring external,$(word 3,$(1))),\
diff --git a/include/image.mk b/include/image.mk
index f1282514b7..48038f4c7c 100644
--- a/include/image.mk
+++ b/include/image.mk
@@ -190,6 +190,7 @@ define Image/BuildDTB
 		-o $(2).tmp $(1)
 	$(LINUX_DIR)/scripts/dtc/dtc -O dtb \
 		-i$(dir $(1)) $(DTC_FLAGS) $(4) \
+	$(if $(CONFIG_HAS_DT_OVERLAY_SUPPORT),-@) \
 		-o $(2) $(2).tmp
 	$(RM) $(2).tmp
 endef
@@ -393,6 +394,7 @@ define Device/Init
   DEVICE_DTS :=
   DEVICE_DTS_CONFIG :=
   DEVICE_DTS_DIR :=
+  DEVICE_DTS_OVERLAY :=
   DEVICE_FDT_NUM :=
   SOC :=
 
@@ -416,8 +418,8 @@ DEFAULT_DEVICE_VARS := \
   DEVICE_NAME KERNEL KERNEL_INITRAMFS KERNEL_INITRAMFS_IMAGE KERNEL_SIZE \
   CMDLINE UBOOTENV_IN_UBI KERNEL_IN_UBI BLOCKSIZE PAGESIZE SUBPAGESIZE \
   VID_HDR_OFFSET UBINIZE_OPTS UBINIZE_PARTS MKUBIFS_OPTS DEVICE_DTS \
-  DEVICE_DTS_CONFIG DEVICE_DTS_DIR DEVICE_FDT_NUM SOC BOARD_NAME \
-  UIMAGE_MAGIC UIMAGE_NAME \
+  DEVICE_DTS_CONFIG DEVICE_DTS_DIR DEVICE_DTS_OVERLAY DEVICE_FDT_NUM \
+  SOC BOARD_NAME UIMAGE_MAGIC UIMAGE_NAME \
   SUPPORTED_DEVICES IMAGE_METADATA KERNEL_ENTRY KERNEL_LOADADDR \
   UBOOT_PATH IMAGE_SIZE \
   DEVICE_COMPAT_VERSION DEVICE_COMPAT_MESSAGE \
@@ -539,7 +541,7 @@ endef
 endif
 
 define Device/Build/kernel
-  $$(eval $$(foreach dts,$$(DEVICE_DTS), \
+  $$(eval $$(foreach dts,$$(DEVICE_DTS) $$(DEVICE_DTS_OVERLAY), \
 	$$(call Device/Build/dtb,$$(notdir $$(dts)), \
 		$$(if $$(DEVICE_DTS_DIR),$$(DEVICE_DTS_DIR),$$(DTS_DIR)), \
 		$$(dts) \
diff --git a/include/kernel.mk b/include/kernel.mk
index d2a5b42138..e4074a48f4 100644
--- a/include/kernel.mk
+++ b/include/kernel.mk
@@ -118,6 +118,9 @@ KERNEL_MAKE_FLAGS = \
 	cmd_syscalls= \
 	$(if $(__package_mk),KBUILD_EXTRA_SYMBOLS="$(wildcard $(PKG_SYMVERS_DIR)/*.symvers)")
 
+KERNEL_NOSTDINC_FLAGS = \
+	-nostdinc $(if $(DUMP),, -isystem $(shell $(TARGET_CC) -print-file-name=include))
+
 ifeq ($(call qstrip,$(CONFIG_EXTERNAL_KERNEL_TREE))$(call qstrip,$(CONFIG_KERNEL_GIT_CLONE_URI)),)
   KERNEL_MAKE_FLAGS += \
 	KERNELRELEASE=$(LINUX_VERSION)
diff --git a/package/boot/uboot-envtools/files/mediatek b/package/boot/uboot-envtools/files/mediatek
index ce28fb31cb..4db1c6ef4d 100644
--- a/package/boot/uboot-envtools/files/mediatek
+++ b/package/boot/uboot-envtools/files/mediatek
@@ -25,7 +25,7 @@ case "$board" in
 	ubootenv_add_uci_config "$envdev" "0x80000" "0x80000" "0x80000" "1"
 	;;
 buffalo,wsr-2533dhp2)
-	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x1000" "0x1000"
+	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x1000" "0x20000"
 	;;
 esac
 
diff --git a/package/boot/uboot-mediatek/patches/010-ahci-mediatek-fix-missing-dev_err-definition.patch b/package/boot/uboot-mediatek/patches/010-ahci-mediatek-fix-missing-dev_err-definition.patch
index 5e2b4aa39b..448bf7b865 100644
--- a/package/boot/uboot-mediatek/patches/010-ahci-mediatek-fix-missing-dev_err-definition.patch
+++ b/package/boot/uboot-mediatek/patches/010-ahci-mediatek-fix-missing-dev_err-definition.patch
@@ -7,8 +7,6 @@ Subject: [PATCH] ahci: mediatek: fix missing dev_err definition
  drivers/ata/mtk_ahci.c | 1 +
  1 file changed, 1 insertion(+)
 
-diff --git a/drivers/ata/mtk_ahci.c b/drivers/ata/mtk_ahci.c
-index 554175bc00..2c5227df30 100644
 --- a/drivers/ata/mtk_ahci.c
 +++ b/drivers/ata/mtk_ahci.c
 @@ -21,6 +21,7 @@
@@ -19,6 +17,3 @@ index 554175bc00..2c5227df30 100644
  
  #define SYS_CFG			0x14
  #define SYS_CFG_SATA_MSK	GENMASK(31, 30)
--- 
-2.30.2
-
diff --git a/package/boot/uboot-mediatek/patches/120-use-xz-instead-of-lzma.patch b/package/boot/uboot-mediatek/patches/120-use-xz-instead-of-lzma.patch
new file mode 100644
index 0000000000..d33b0b93a0
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/120-use-xz-instead-of-lzma.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -1008,7 +1008,7 @@ quiet_cmd_pad_cat = CAT     $@
+ cmd_pad_cat = $(cmd_objcopy) && $(append) || { rm -f $@; false; }
+ 
+ quiet_cmd_lzma = LZMA    $@
+-cmd_lzma = lzma -c -z -k -9 $< > $@
++cmd_lzma = xz --format=lzma -c -z -k -9 $< > $@
+ 
+ cfg: u-boot.cfg
+ 
diff --git a/package/boot/uboot-mediatek/patches/403-add-bananapi_bpi-r64_defconfigs.patch b/package/boot/uboot-mediatek/patches/403-add-bananapi_bpi-r64_defconfigs.patch
index 03a1a71064..d79095a0a7 100644
--- a/package/boot/uboot-mediatek/patches/403-add-bananapi_bpi-r64_defconfigs.patch
+++ b/package/boot/uboot-mediatek/patches/403-add-bananapi_bpi-r64_defconfigs.patch
@@ -147,12 +147,15 @@
 +CONFIG_USB_STORAGE=y
 --- /dev/null
 +++ b/bananapi_bpi-r64-sdmmc_env
-@@ -0,0 +1,57 @@
+@@ -0,0 +1,60 @@
 +ipaddr=192.168.1.1
 +serverip=192.168.1.254
 +loadaddr=0x4007ff28
 +bootcmd=run boot_sdmmc
 +bootargs=root=/dev/mmcblk1p6
++bootconf=config-mt7622-bananapi-bpi-r64-pcie1
++bootconf_pcie=config-mt7622-bananapi-bpi-r64-pcie1
++bootconf_sata=config-mt7622-bananapi-bpi-r64-sata
 +bootdelay=0
 +bootfile=openwrt-mediatek-mt7622-bananapi_bpi-r64-initramfs-recovery.itb
 +bootfile_upg=openwrt-mediatek-mt7622-bananapi_bpi-r64-squashfs-sysupgrade.itb
@@ -174,12 +177,12 @@
 +bootmenu_8=Reset all settings to factory defaults.=run reset_factory ; reset
 +boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; run boot_tftp_forever
 +boot_first=if button reset ; then run boot_tftp_forever ; fi ; setenv flag_recover 1 ; bootmenu
-+boot_production=led bpi-r64:pio:green on ; run sdmmc_read_production && bootm $loadaddr
-+boot_recovery=led bpi-r64:pio:green off ; run sdmmc_read_recovery && bootm $loadaddr
++boot_production=led bpi-r64:pio:green on ; run sdmmc_read_production && bootm $loadaddr#$bootconf
++boot_recovery=led bpi-r64:pio:green off ; run sdmmc_read_recovery && bootm $loadaddr#$bootconf
 +boot_sdmmc=run boot_production ; run boot_recovery
 +boot_tftp_forever=led bpi-r64:pio:blue on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
-+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && run sdmmc_write_production ; if env exists noboot ; then else bootm $loadaddr ; fi
-+boot_tftp_recovery=tftpboot $loadaddr $bootfile && iminfo $loadaddr && run sdmmc_write_recovery ; if env exists noboot ; then else bootm $loadaddr ; fi
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && run sdmmc_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && iminfo $loadaddr && run sdmmc_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
 +boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr
 +emmc_write_bl2=mmc dev 0 1 && mmc partconf 0 1 1 1 && mmc erase 0x0 0x400 && mmc write $loadaddr 0x0 0x100 ; mmc partconf 0 1 1 0
 +emmc_write_hdr=mmc dev 0 0 && mmc erase 0x0 0x40 && mmc write $loadaddr 0x0 0x40
@@ -223,7 +226,7 @@
 +CONFIG_DEFAULT_DEVICE_TREE="mt7622-bananapi-bpi-r64"
 +CONFIG_OF_LIBFDT_OVERLAY=y
 +CONFIG_DEBUG_UART=y
-+CONFIG_DEFAULT_ENV_FILE="bananapi_bpi-r64-sdmmc_env"
++CONFIG_DEFAULT_ENV_FILE="bananapi_bpi-r64-emmc_env"
 +CONFIG_NET_RANDOM_ETHADDR=y
 +CONFIG_SMBIOS_PRODUCT_NAME=""
 +CONFIG_AUTOBOOT_KEYED=y
@@ -354,12 +357,15 @@
 +CONFIG_USB_STORAGE=y
 --- /dev/null
 +++ b/bananapi_bpi-r64-emmc_env
-@@ -0,0 +1,43 @@
+@@ -0,0 +1,46 @@
 +ipaddr=192.168.1.1
 +serverip=192.168.1.254
 +loadaddr=0x4007ff28
 +bootcmd=run boot_emmc
 +bootargs=root=/dev/mmcblk0p5
++bootconf=config-mt7622-bananapi-bpi-r64-pcie1
++bootconf_pcie=config-mt7622-bananapi-bpi-r64-pcie1
++bootconf_sata=config-mt7622-bananapi-bpi-r64-sata
 +bootdelay=0
 +bootfile=openwrt-mediatek-mt7622-bananapi_bpi-r64-initramfs-recovery.itb
 +bootfile_upg=openwrt-mediatek-mt7622-bananapi_bpi-r64-squashfs-sysupgrade.itb
@@ -378,12 +384,12 @@
 +bootmenu_7=Reset all settings to factory defaults.=run reset_factory ; reset
 +boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; run boot_tftp_forever
 +boot_first=if button reset ; then run boot_tftp_forever ; fi ; setenv flag_recover 1 ; bootmenu
-+boot_production=led bpi-r64:pio:green on ; run emmc_read_production && bootm $loadaddr
-+boot_recovery=led bpi-r64:pio:green off ; run emmc_read_recovery && bootm $loadaddr
++boot_production=led bpi-r64:pio:green on ; run emmc_read_production && bootm $loadaddr#$bootconf
++boot_recovery=led bpi-r64:pio:green off ; run emmc_read_recovery && bootm $loadaddr#$bootconf
 +boot_emmc=run boot_production ; run boot_recovery
 +boot_tftp_forever=led bpi-r64:pio:blue on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
-+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && run emmc_write_production ; if env exists noboot ; then else bootm $loadaddr ; fi
-+boot_tftp_recovery=tftpboot $loadaddr $bootfile && iminfo $loadaddr && run emmc_write_recovery ; if env exists noboot ; then else bootm $loadaddr ; fi
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && run emmc_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && iminfo $loadaddr && run emmc_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
 +boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr
 +emmc_write_production=iminfo $fileaddr && mmc dev 0 && part start mmc 0 $part_default part_addr && part size mmc 0 $part_default part_size && run mmc_write_vol
 +emmc_write_recovery=iminfo $fileaddr && mmc dev 0 && part start mmc 0 $part_recovery part_addr && part size mmc 0 $part_recovery part_size && run mmc_write_vol
diff --git a/package/kernel/ath10k-ct/Makefile b/package/kernel/ath10k-ct/Makefile
index 32b294a69f..a225bd8b19 100644
--- a/package/kernel/ath10k-ct/Makefile
+++ b/package/kernel/ath10k-ct/Makefile
@@ -52,7 +52,8 @@ $(call KernelPackage/ath10k-ct)
   VARIANT:=smallbuffers
 endef
 
-NOSTDINC_FLAGS = \
+NOSTDINC_FLAGS := \
+	$(KERNEL_NOSTDINC_FLAGS) \
 	-I$(PKG_BUILD_DIR) \
 	-I$(STAGING_DIR)/usr/include/mac80211-backport/uapi \
 	-I$(STAGING_DIR)/usr/include/mac80211-backport \
diff --git a/package/kernel/mt76/Makefile b/package/kernel/mt76/Makefile
index b60afb355d..aa6619e78f 100644
--- a/package/kernel/mt76/Makefile
+++ b/package/kernel/mt76/Makefile
@@ -8,9 +8,9 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2021-03-15
-PKG_SOURCE_VERSION:=ca22cc221ae7c87535d6f24b12c0280f6b560b31
-PKG_MIRROR_HASH:=291f078568a83aa9e930e3d496a8b0e406feb720c472aafc82fefe01c921e04d
+PKG_SOURCE_DATE:=2021-03-18
+PKG_SOURCE_VERSION:=fbef8bba038f5aff755e383025f0a8b34879aa5c
+PKG_MIRROR_HASH:=987826653cd8722671263c218a9f3cdf5b0bc0e24accf66fe68e1138f9c694b2
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_BUILD_PARALLEL:=1
@@ -235,7 +235,8 @@ endef
 
 TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include/libnl-tiny
 
-NOSTDINC_FLAGS = \
+NOSTDINC_FLAGS := \
+	$(KERNEL_NOSTDINC_FLAGS) \
 	-I$(PKG_BUILD_DIR) \
 	-I$(STAGING_DIR)/usr/include/mac80211-backport/uapi \
 	-I$(STAGING_DIR)/usr/include/mac80211-backport \
diff --git a/package/kernel/mwlwifi/Makefile b/package/kernel/mwlwifi/Makefile
index ebd88bb352..648c826ccb 100644
--- a/package/kernel/mwlwifi/Makefile
+++ b/package/kernel/mwlwifi/Makefile
@@ -33,7 +33,8 @@ define KernelPackage/mwlwifi
   AUTOLOAD:=$(call AutoLoad,50,mwlwifi)
 endef
 
-NOSTDINC_FLAGS = \
+NOSTDINC_FLAGS := \
+	$(KERNEL_NOSTDINC_FLAGS) \
 	-I$(PKG_BUILD_DIR) \
 	-I$(STAGING_DIR)/usr/include/mac80211-backport/uapi \
 	-I$(STAGING_DIR)/usr/include/mac80211-backport \
diff --git a/package/kernel/rtl8812au-ct/Makefile b/package/kernel/rtl8812au-ct/Makefile
index bac73a300c..fa2cd295ab 100644
--- a/package/kernel/rtl8812au-ct/Makefile
+++ b/package/kernel/rtl8812au-ct/Makefile
@@ -31,7 +31,8 @@ define KernelPackage/rtl8812au-ct
   PROVIDES:=kmod-rtl8812au
 endef
 
-NOSTDINC_FLAGS = \
+NOSTDINC_FLAGS := \
+	$(KERNEL_NOSTDINC_FLAGS) \
 	-I$(PKG_BUILD_DIR) \
 	-I$(PKG_BUILD_DIR)/include \
 	-I$(STAGING_DIR)/usr/include/mac80211-backport \
diff --git a/package/system/mtd/src/mtd.h b/package/system/mtd/src/mtd.h
index d2facc8e3b..5d56113b1c 100644
--- a/package/system/mtd/src/mtd.h
+++ b/package/system/mtd/src/mtd.h
@@ -2,6 +2,7 @@
 #define __mtd_h
 
 #include <stdbool.h>
+#include <stdint.h>
 
 #if defined(target_bcm47xx) || defined(target_bcm53xx)
 #define target_brcm 1
diff --git a/scripts/mkits.sh b/scripts/mkits.sh
index e5369548d7..7533baf799 100755
--- a/scripts/mkits.sh
+++ b/scripts/mkits.sh
@@ -32,7 +32,9 @@ usage() {
 	printf "\n\t-d ==> include Device Tree Blob 'dtb'"
 	printf "\n\t-r ==> include RootFS blob 'rootfs'"
 	printf "\n\t-H ==> specify hash algo instead of SHA1"
-	printf "\n\t-o ==> create output file 'its_file'\n"
+	printf "\n\t-o ==> create output file 'its_file'"
+	printf "\n\t-O ==> create config with dt overlay 'name:dtb'"
+	printf "\n\t\t(can be specified more than once)\n"
 	exit 1
 }
 
@@ -41,8 +43,10 @@ ROOTFSNUM=1
 INITRDNUM=1
 HASH=sha1
 LOADABLES=
+DTOVERLAY=
+DTADDR=
 
-while getopts ":A:a:c:C:D:d:e:f:i:k:n:o:v:r:S" OPTION
+while getopts ":A:a:c:C:D:d:e:f:i:k:n:o:O:v:r:S" OPTION
 do
 	case $OPTION in
 		A ) ARCH=$OPTARG;;
@@ -57,6 +61,7 @@ do
 		k ) KERNEL=$OPTARG;;
 		n ) FDTNUM=$OPTARG;;
 		o ) OUTPUT=$OPTARG;;
+		O ) DTOVERLAY="$DTOVERLAY ${OPTARG}";;
 		r ) ROOTFS=$OPTARG;;
 		S ) HASH=$OPTARG;;
 		v ) VERSION=$OPTARG;;
@@ -78,6 +83,11 @@ if [ -n "${COMPATIBLE}" ]; then
 	COMPATIBLE_PROP="compatible = \"${COMPATIBLE}\";"
 fi
 
+[ "$DTOVERLAY" ] && {
+	dtbsize=$(wc -c "$DTB" | cut -d' ' -f1)
+	DTADDR=$(printf "0x%08x" $(($LOAD_ADDR - $dtbsize)) )
+}
+
 # Conditionally create fdt information
 if [ -n "${DTB}" ]; then
 	FDT_NODE="
@@ -86,6 +96,7 @@ if [ -n "${DTB}" ]; then
 			${COMPATIBLE_PROP}
 			data = /incbin/(\"${DTB}\");
 			type = \"flat_dt\";
+			${DTADDR:+load = <${DTADDR}>;}
 			arch = \"${ARCH}\";
 			compression = \"none\";
 			hash@1 {
@@ -141,6 +152,47 @@ if [ -n "${ROOTFS}" ]; then
 	LOADABLES="${LOADABLES:+$LOADABLES, }\"rootfs-${ROOTFSNUM}\""
 fi
 
+# add DT overlay blobs
+FDTOVERLAY_NODE=""
+OVCONFIGS=""
+[ "$DTOVERLAY" ] && for overlay in $DTOVERLAY ; do
+	overlay_blob=${overlay##*:}
+	ovname=${overlay%%:*}
+	ovnode="fdt-$ovname"
+	ovsize=$(wc -c "$overlay_blob" | cut -d' ' -f1)
+	echo "$ovname ($overlay_blob) : $ovsize" >&2
+	DTADDR=$(printf "0x%08x" $(($DTADDR - $ovsize)))
+	FDTOVERLAY_NODE="$FDTOVERLAY_NODE
+
+		$ovnode {
+			description = \"${ARCH_UPPER} OpenWrt ${DEVICE} device tree overlay $ovname\";
+			${COMPATIBLE_PROP}
+			data = /incbin/(\"${overlay_blob}\");
+			type = \"flat_dt\";
+			arch = \"${ARCH}\";
+			load = <${DTADDR}>;
+			compression = \"none\";
+			hash@1 {
+				algo = \"crc32\";
+			};
+			hash@2 {
+				algo = \"${HASH}\";
+			};
+		};
+"
+	OVCONFIGS="$OVCONFIGS
+
+		config-$ovname {
+			description = \"OpenWrt ${DEVICE} with $ovname\";
+			kernel = \"kernel-1\";
+			fdt = \"fdt-$FDTNUM\", \"$ovnode\";
+			${LOADABLES:+loadables = ${LOADABLES};}
+			${COMPATIBLE_PROP}
+			${INITRD_PROP}
+		};
+	"
+done
+
 # Create a default, fully populated DTS file
 DATA="/dts-v1/;
 
@@ -167,6 +219,7 @@ DATA="/dts-v1/;
 		};
 ${INITRD_NODE}
 ${FDT_NODE}
+${FDTOVERLAY_NODE}
 ${ROOTFS_NODE}
 	};
 
@@ -180,6 +233,7 @@ ${ROOTFS_NODE}
 			${COMPATIBLE_PROP}
 			${INITRD_PROP}
 		};
+		${OVCONFIGS}
 	};
 };"
 
diff --git a/scripts/target-metadata.pl b/scripts/target-metadata.pl
index ef62310cb5..4cbea0993b 100755
--- a/scripts/target-metadata.pl
+++ b/scripts/target-metadata.pl
@@ -45,6 +45,7 @@ sub target_config_features(@) {
 		/^rootfs-part$/ and $ret .= "\tselect USES_ROOTFS_PART\n";
 		/^boot-part$/ and $ret .= "\tselect USES_BOOT_PART\n";
 		/^testing-kernel$/ and $ret .= "\tselect HAS_TESTING_KERNEL\n";
+		/^dt-overlay$/ and $ret .= "\tselect HAS_DT_OVERLAY_SUPPORT\n";
 	}
 	return $ret;
 }
diff --git a/target/Config.in b/target/Config.in
index 86d39ce07c..51a278cae9 100644
--- a/target/Config.in
+++ b/target/Config.in
@@ -13,6 +13,9 @@ config HAS_SPE_FPU
 config HAS_FPU
 	bool
 
+config HAS_DT_OVERLAY_SUPPORT
+	bool
+
 config AUDIO_SUPPORT
 	bool
 
diff --git a/target/linux/ath79/dts/ar9344_teltonika_rut955-h7v3c0.dts b/target/linux/ath79/dts/ar9344_teltonika_rut955-h7v3c0.dts
index f61f2bf628..eb9606e58b 100644
--- a/target/linux/ath79/dts/ar9344_teltonika_rut955-h7v3c0.dts
+++ b/target/linux/ath79/dts/ar9344_teltonika_rut955-h7v3c0.dts
@@ -159,10 +159,6 @@
 	};
 };
 
-&hs_uart {
-	dtr-gpios = <&gpio_ext 15 GPIO_ACTIVE_HIGH>;
-};
-
 &eth0 {
 	status = "okay";
 
diff --git a/target/linux/ath79/dts/ar9344_teltonika_rut955.dts b/target/linux/ath79/dts/ar9344_teltonika_rut955.dts
index 7914928aa0..ba840a05d3 100644
--- a/target/linux/ath79/dts/ar9344_teltonika_rut955.dts
+++ b/target/linux/ath79/dts/ar9344_teltonika_rut955.dts
@@ -158,10 +158,6 @@
 	};
 };
 
-&hs_uart {
-	dtr-gpios = <&gpio_ext 13 GPIO_ACTIVE_HIGH>;
-};
-
 &eth0 {
 	status = "okay";
 
diff --git a/target/linux/ath79/dts/ar9344_teltonika_rut9xx.dtsi b/target/linux/ath79/dts/ar9344_teltonika_rut9xx.dtsi
index 88b9170fc0..d9c66d2745 100644
--- a/target/linux/ath79/dts/ar9344_teltonika_rut9xx.dtsi
+++ b/target/linux/ath79/dts/ar9344_teltonika_rut9xx.dtsi
@@ -154,20 +154,20 @@
 &pinmux {
 	pmx_spi: spi {
 		// SPI_CS1 on GPIO 3
-		pinctrl-single,bits = <0x0 0x07000000 0xff000000>;
+		pinctrl-single,bits =	<0x0 0x07000000 0xff000000>;
 	};
 
 	pmx_leds_switch: leds_switch {
 		// switch port LEDs on GPIO 1, GPIO 13, GPIO 14 and GPIO 22
-		pinctrl-single,bits =  <0x0 0x00002d00 0x0000ff00>,
-					<0xc 0x002c2b00 0x00ffff00>,
+		pinctrl-single,bits =	<0x00 0x00002d00 0x0000ff00>,
+					<0x0c 0x002c2b00 0x00ffff00>,
 					<0x14 0x002a0000 0x00ff0000>;
 	};
 
 	pmx_uart2: uart2 {
 		// UART1_DTR on GPIO 0, UART1_RD on GPIO 11, UART1_TD on GPIO 18
-		pinctrl-single,bits = <0x0 0x0 0xff>,
-				<0x10 0x4f000000 0xff000000>,
-				<0x3c 0x000b0000 0x00ff0000>;
+		pinctrl-single,bits =	<0x00 0x00000000 0x000000ff>,
+					<0x10 0x004f0000 0x00ff0000>,
+					<0x3c 0x000b0000 0x00ff0000>;
 	};
 };
diff --git a/target/linux/bcm4908/patches-5.4/071-v5.12-0029-net-dsa-bcm_sf2-support-BCM4908-s-integrated-switch.patch b/target/linux/bcm4908/patches-5.4/071-v5.12-0001-net-dsa-bcm_sf2-support-BCM4908-s-integrated-switch.patch
similarity index 100%
rename from target/linux/bcm4908/patches-5.4/071-v5.12-0029-net-dsa-bcm_sf2-support-BCM4908-s-integrated-switch.patch
rename to target/linux/bcm4908/patches-5.4/071-v5.12-0001-net-dsa-bcm_sf2-support-BCM4908-s-integrated-switch.patch
diff --git a/target/linux/bcm4908/patches-5.4/071-v5.12-0002-net-dsa-bcm_sf2-use-2-Gbps-IMP-port-link-on-BCM4908.patch b/target/linux/bcm4908/patches-5.4/071-v5.12-0002-net-dsa-bcm_sf2-use-2-Gbps-IMP-port-link-on-BCM4908.patch
new file mode 100644
index 0000000000..2ab34c1261
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.4/071-v5.12-0002-net-dsa-bcm_sf2-use-2-Gbps-IMP-port-link-on-BCM4908.patch
@@ -0,0 +1,33 @@
+From 8373a0fe9c7160a55482effa8a3f725efd3f8434 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 10 Mar 2021 13:51:59 +0100
+Subject: [PATCH] net: dsa: bcm_sf2: use 2 Gbps IMP port link on BCM4908
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 uses 2 Gbps link between switch and the Ethernet interface.
+Without this BCM4908 devices were able to achieve only 2 x ~895 Mb/s.
+This allows handling e.g. NAT traffic with 940 Mb/s.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/bcm_sf2.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -70,7 +70,10 @@ static void bcm_sf2_imp_setup(struct dsa
+ 		/* Force link status for IMP port */
+ 		reg = core_readl(priv, offset);
+ 		reg |= (MII_SW_OR | LINK_STS);
+-		reg &= ~GMII_SPEED_UP_2G;
++		if (priv->type == BCM4908_DEVICE_ID)
++			reg |= GMII_SPEED_UP_2G;
++		else
++			reg &= ~GMII_SPEED_UP_2G;
+ 		core_writel(priv, reg, offset);
+ 
+ 		/* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
diff --git a/target/linux/bcm4908/patches-5.4/073-v5.12-0013-net-broadcom-BCM4908_ENET-should-not-default-to-y-un.patch b/target/linux/bcm4908/patches-5.4/073-v5.12-0013-net-broadcom-BCM4908_ENET-should-not-default-to-y-un.patch
new file mode 100644
index 0000000000..43e5ee01bf
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.4/073-v5.12-0013-net-broadcom-BCM4908_ENET-should-not-default-to-y-un.patch
@@ -0,0 +1,33 @@
+From a3bc483216650a7232559bf0a1debfbabff3e12c Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Tue, 16 Mar 2021 15:03:41 +0100
+Subject: [PATCH] net: broadcom: BCM4908_ENET should not default to y,
+ unconditionally
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Merely enabling compile-testing should not enable additional code.
+To fix this, restrict the automatic enabling of BCM4908_ENET to
+ARCH_BCM4908.
+
+Fixes: 4feffeadbcb2e5b1 ("net: broadcom: bcm4908enet: add BCM4908 controller driver")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/broadcom/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/Kconfig
++++ b/drivers/net/ethernet/broadcom/Kconfig
+@@ -54,7 +54,7 @@ config B44_PCI
+ config BCM4908_ENET
+ 	tristate "Broadcom BCM4908 internal mac support"
+ 	depends on ARCH_BCM4908 || COMPILE_TEST
+-	default y
++	default y if ARCH_BCM4908
+ 	help
+ 	  This driver supports Ethernet controller integrated into Broadcom
+ 	  BCM4908 family SoCs.
diff --git a/target/linux/bcm4908/patches-5.4/074-v5.13-0001-net-broadcom-bcm4908_enet-read-MAC-from-OF.patch b/target/linux/bcm4908/patches-5.4/074-v5.13-0001-net-broadcom-bcm4908_enet-read-MAC-from-OF.patch
new file mode 100644
index 0000000000..4b8e1f83b8
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.4/074-v5.13-0001-net-broadcom-bcm4908_enet-read-MAC-from-OF.patch
@@ -0,0 +1,48 @@
+From 3559c1ea4336636c886002996d50805365d3055c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Wed, 10 Mar 2021 09:48:13 +0100
+Subject: [PATCH] net: broadcom: bcm4908_enet: read MAC from OF
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+BCM4908 devices have MAC address accessible using NVMEM so it's needed
+to use OF helper for reading it.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -9,6 +9,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
++#include <linux/of_net.h>
+ #include <linux/platform_device.h>
+ #include <linux/slab.h>
+ #include <linux/string.h>
+@@ -620,6 +621,7 @@ static int bcm4908_enet_probe(struct pla
+ 	struct device *dev = &pdev->dev;
+ 	struct net_device *netdev;
+ 	struct bcm4908_enet *enet;
++	const u8 *mac;
+ 	int err;
+ 
+ 	netdev = devm_alloc_etherdev(dev, sizeof(*enet));
+@@ -647,7 +649,11 @@ static int bcm4908_enet_probe(struct pla
+ 		return err;
+ 
+ 	SET_NETDEV_DEV(netdev, &pdev->dev);
+-	eth_hw_addr_random(netdev);
++	mac = of_get_mac_address(dev->of_node);
++	if (!IS_ERR(mac))
++		ether_addr_copy(netdev->dev_addr, mac);
++	else
++		eth_hw_addr_random(netdev);
+ 	netdev->netdev_ops = &bcm4908_enet_netdev_ops;
+ 	netdev->min_mtu = ETH_ZLEN;
+ 	netdev->mtu = ETH_DATA_LEN;
diff --git a/target/linux/bcm4908/patches-5.4/074-v5.13-0002-dt-bindings-net-bcm4908-enet-add-optional-TX-interru.patch b/target/linux/bcm4908/patches-5.4/074-v5.13-0002-dt-bindings-net-bcm4908-enet-add-optional-TX-interru.patch
new file mode 100644
index 0000000000..b61437a2de
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.4/074-v5.13-0002-dt-bindings-net-bcm4908-enet-add-optional-TX-interru.patch
@@ -0,0 +1,50 @@
+From ab4dda7a8cb7e55ea3d92fd5e249cf6f5396028c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 11 Mar 2021 13:35:20 +0100
+Subject: [PATCH] dt-bindings: net: bcm4908-enet: add optional TX interrupt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+I discovered that hardware actually supports two interrupts, one per DMA
+channel (RX and TX).
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ .../bindings/net/brcm,bcm4908-enet.yaml         | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/Documentation/devicetree/bindings/net/brcm,bcm4908-enet.yaml
++++ b/Documentation/devicetree/bindings/net/brcm,bcm4908-enet.yaml
+@@ -22,10 +22,18 @@ properties:
+     maxItems: 1
+ 
+   interrupts:
+-    description: RX interrupt
++    minItems: 1
++    maxItems: 2
++    items:
++      - description: RX interrupt
++      - description: TX interrupt
+ 
+   interrupt-names:
+-    const: rx
++    minItems: 1
++    maxItems: 2
++    items:
++      - const: rx
++      - const: tx
+ 
+ required:
+   - reg
+@@ -43,6 +51,7 @@ examples:
+         compatible = "brcm,bcm4908-enet";
+         reg = <0x80002000 0x1000>;
+ 
+-        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
+-        interrupt-names = "rx";
++        interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>,
++                     <GIC_SPI 87 IRQ_TYPE_LEVEL_HIGH>;
++        interrupt-names = "rx", "tx";
+     };
diff --git a/target/linux/bcm4908/patches-5.4/074-v5.13-0003-net-broadcom-bcm4908_enet-support-TX-interrupt.patch b/target/linux/bcm4908/patches-5.4/074-v5.13-0003-net-broadcom-bcm4908_enet-support-TX-interrupt.patch
new file mode 100644
index 0000000000..a20be2ae8b
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.4/074-v5.13-0003-net-broadcom-bcm4908_enet-support-TX-interrupt.patch
@@ -0,0 +1,300 @@
+From 12bb508bfe5a564c36864b12253db23cac83bfa1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 11 Mar 2021 13:35:21 +0100
+Subject: [PATCH] net: broadcom: bcm4908_enet: support TX interrupt
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It appears that each DMA channel has its own interrupt and both rings
+can be configured (the same way) to handle interrupts.
+
+1. Make ring interrupts code generic (make it operate on given ring)
+2. Move napi to ring (so each has its own)
+3. Make IRQ handler generic (match ring against received IRQ number)
+4. Add (optional) support for TX interrupt
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/broadcom/bcm4908_enet.c | 138 ++++++++++++++-----
+ 1 file changed, 103 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c
+@@ -54,6 +54,7 @@ struct bcm4908_enet_dma_ring {
+ 	int length;
+ 	u16 cfg_block;
+ 	u16 st_ram_block;
++	struct napi_struct napi;
+ 
+ 	union {
+ 		void *cpu_addr;
+@@ -67,8 +68,8 @@ struct bcm4908_enet_dma_ring {
+ struct bcm4908_enet {
+ 	struct device *dev;
+ 	struct net_device *netdev;
+-	struct napi_struct napi;
+ 	void __iomem *base;
++	int irq_tx;
+ 
+ 	struct bcm4908_enet_dma_ring tx_ring;
+ 	struct bcm4908_enet_dma_ring rx_ring;
+@@ -123,24 +124,31 @@ static void enet_umac_set(struct bcm4908
+  * Helpers
+  */
+ 
+-static void bcm4908_enet_intrs_on(struct bcm4908_enet *enet)
++static void bcm4908_enet_set_mtu(struct bcm4908_enet *enet, int mtu)
+ {
+-	enet_write(enet, ENET_DMA_CH_RX_CFG + ENET_DMA_CH_CFG_INT_MASK, ENET_DMA_INT_DEFAULTS);
++	enet_umac_write(enet, UMAC_MAX_FRAME_LEN, mtu + ENET_MAX_ETH_OVERHEAD);
+ }
+ 
+-static void bcm4908_enet_intrs_off(struct bcm4908_enet *enet)
++/***
++ * DMA ring ops
++ */
++
++static void bcm4908_enet_dma_ring_intrs_on(struct bcm4908_enet *enet,
++					   struct bcm4908_enet_dma_ring *ring)
+ {
+-	enet_write(enet, ENET_DMA_CH_RX_CFG + ENET_DMA_CH_CFG_INT_MASK, 0);
++	enet_write(enet, ring->cfg_block + ENET_DMA_CH_CFG_INT_MASK, ENET_DMA_INT_DEFAULTS);
+ }
+ 
+-static void bcm4908_enet_intrs_ack(struct bcm4908_enet *enet)
++static void bcm4908_enet_dma_ring_intrs_off(struct bcm4908_enet *enet,
++					    struct bcm4908_enet_dma_ring *ring)
+ {
+-	enet_write(enet, ENET_DMA_CH_RX_CFG + ENET_DMA_CH_CFG_INT_STAT, ENET_DMA_INT_DEFAULTS);
++	enet_write(enet, ring->cfg_block + ENET_DMA_CH_CFG_INT_MASK, 0);
+ }
+ 
+-static void bcm4908_enet_set_mtu(struct bcm4908_enet *enet, int mtu)
++static void bcm4908_enet_dma_ring_intrs_ack(struct bcm4908_enet *enet,
++					    struct bcm4908_enet_dma_ring *ring)
+ {
+-	enet_umac_write(enet, UMAC_MAX_FRAME_LEN, mtu + ENET_MAX_ETH_OVERHEAD);
++	enet_write(enet, ring->cfg_block + ENET_DMA_CH_CFG_INT_STAT, ENET_DMA_INT_DEFAULTS);
+ }
+ 
+ /***
+@@ -414,11 +422,14 @@ static void bcm4908_enet_gmac_init(struc
+ static irqreturn_t bcm4908_enet_irq_handler(int irq, void *dev_id)
+ {
+ 	struct bcm4908_enet *enet = dev_id;
++	struct bcm4908_enet_dma_ring *ring;
+ 
+-	bcm4908_enet_intrs_off(enet);
+-	bcm4908_enet_intrs_ack(enet);
++	ring = (irq == enet->irq_tx) ? &enet->tx_ring : &enet->rx_ring;
+ 
+-	napi_schedule(&enet->napi);
++	bcm4908_enet_dma_ring_intrs_off(enet, ring);
++	bcm4908_enet_dma_ring_intrs_ack(enet, ring);
++
++	napi_schedule(&ring->napi);
+ 
+ 	return IRQ_HANDLED;
+ }
+@@ -426,6 +437,8 @@ static irqreturn_t bcm4908_enet_irq_hand
+ static int bcm4908_enet_open(struct net_device *netdev)
+ {
+ 	struct bcm4908_enet *enet = netdev_priv(netdev);
++	struct bcm4908_enet_dma_ring *tx_ring = &enet->tx_ring;
++	struct bcm4908_enet_dma_ring *rx_ring = &enet->rx_ring;
+ 	struct device *dev = enet->dev;
+ 	int err;
+ 
+@@ -435,6 +448,17 @@ static int bcm4908_enet_open(struct net_
+ 		return err;
+ 	}
+ 
++	if (enet->irq_tx > 0) {
++		err = request_irq(enet->irq_tx, bcm4908_enet_irq_handler, 0,
++				  "tx", enet);
++		if (err) {
++			dev_err(dev, "Failed to request IRQ %d: %d\n",
++				enet->irq_tx, err);
++			free_irq(netdev->irq, enet);
++			return err;
++		}
++	}
++
+ 	bcm4908_enet_gmac_init(enet);
+ 	bcm4908_enet_dma_reset(enet);
+ 	bcm4908_enet_dma_init(enet);
+@@ -443,14 +467,19 @@ static int bcm4908_enet_open(struct net_
+ 
+ 	enet_set(enet, ENET_DMA_CONTROLLER_CFG, ENET_DMA_CTRL_CFG_MASTER_EN);
+ 	enet_maskset(enet, ENET_DMA_CONTROLLER_CFG, ENET_DMA_CTRL_CFG_FLOWC_CH1_EN, 0);
+-	bcm4908_enet_dma_rx_ring_enable(enet, &enet->rx_ring);
+ 
+-	napi_enable(&enet->napi);
++	if (enet->irq_tx > 0) {
++		napi_enable(&tx_ring->napi);
++		bcm4908_enet_dma_ring_intrs_ack(enet, tx_ring);
++		bcm4908_enet_dma_ring_intrs_on(enet, tx_ring);
++	}
++
++	bcm4908_enet_dma_rx_ring_enable(enet, rx_ring);
++	napi_enable(&rx_ring->napi);
+ 	netif_carrier_on(netdev);
+ 	netif_start_queue(netdev);
+-
+-	bcm4908_enet_intrs_ack(enet);
+-	bcm4908_enet_intrs_on(enet);
++	bcm4908_enet_dma_ring_intrs_ack(enet, rx_ring);
++	bcm4908_enet_dma_ring_intrs_on(enet, rx_ring);
+ 
+ 	return 0;
+ }
+@@ -458,16 +487,20 @@ static int bcm4908_enet_open(struct net_
+ static int bcm4908_enet_stop(struct net_device *netdev)
+ {
+ 	struct bcm4908_enet *enet = netdev_priv(netdev);
++	struct bcm4908_enet_dma_ring *tx_ring = &enet->tx_ring;
++	struct bcm4908_enet_dma_ring *rx_ring = &enet->rx_ring;
+ 
+ 	netif_stop_queue(netdev);
+ 	netif_carrier_off(netdev);
+-	napi_disable(&enet->napi);
++	napi_disable(&rx_ring->napi);
++	napi_disable(&tx_ring->napi);
+ 
+ 	bcm4908_enet_dma_rx_ring_disable(enet, &enet->rx_ring);
+ 	bcm4908_enet_dma_tx_ring_disable(enet, &enet->tx_ring);
+ 
+ 	bcm4908_enet_dma_uninit(enet);
+ 
++	free_irq(enet->irq_tx, enet);
+ 	free_irq(enet->netdev->irq, enet);
+ 
+ 	return 0;
+@@ -484,25 +517,19 @@ static int bcm4908_enet_start_xmit(struc
+ 	u32 tmp;
+ 
+ 	/* Free transmitted skbs */
+-	while (ring->read_idx != ring->write_idx) {
+-		buf_desc = &ring->buf_desc[ring->read_idx];
+-		if (le32_to_cpu(buf_desc->ctl) & DMA_CTL_STATUS_OWN)
+-			break;
+-		slot = &ring->slots[ring->read_idx];
+-
+-		dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE);
+-		dev_kfree_skb(slot->skb);
+-		if (++ring->read_idx == ring->length)
+-			ring->read_idx = 0;
+-	}
++	if (enet->irq_tx < 0 &&
++	    !(le32_to_cpu(ring->buf_desc[ring->read_idx].ctl) & DMA_CTL_STATUS_OWN))
++		napi_schedule(&enet->tx_ring.napi);
+ 
+ 	/* Don't use the last empty buf descriptor */
+ 	if (ring->read_idx <= ring->write_idx)
+ 		free_buf_descs = ring->read_idx - ring->write_idx + ring->length;
+ 	else
+ 		free_buf_descs = ring->read_idx - ring->write_idx;
+-	if (free_buf_descs < 2)
++	if (free_buf_descs < 2) {
++		netif_stop_queue(netdev);
+ 		return NETDEV_TX_BUSY;
++	}
+ 
+ 	/* Hardware removes OWN bit after sending data */
+ 	buf_desc = &ring->buf_desc[ring->write_idx];
+@@ -539,9 +566,10 @@ static int bcm4908_enet_start_xmit(struc
+ 	return NETDEV_TX_OK;
+ }
+ 
+-static int bcm4908_enet_poll(struct napi_struct *napi, int weight)
++static int bcm4908_enet_poll_rx(struct napi_struct *napi, int weight)
+ {
+-	struct bcm4908_enet *enet = container_of(napi, struct bcm4908_enet, napi);
++	struct bcm4908_enet_dma_ring *rx_ring = container_of(napi, struct bcm4908_enet_dma_ring, napi);
++	struct bcm4908_enet *enet = container_of(rx_ring, struct bcm4908_enet, rx_ring);
+ 	struct device *dev = enet->dev;
+ 	int handled = 0;
+ 
+@@ -590,7 +618,7 @@ static int bcm4908_enet_poll(struct napi
+ 
+ 	if (handled < weight) {
+ 		napi_complete_done(napi, handled);
+-		bcm4908_enet_intrs_on(enet);
++		bcm4908_enet_dma_ring_intrs_on(enet, rx_ring);
+ 	}
+ 
+ 	/* Hardware could disable ring if it run out of descriptors */
+@@ -599,6 +627,42 @@ static int bcm4908_enet_poll(struct napi
+ 	return handled;
+ }
+ 
++static int bcm4908_enet_poll_tx(struct napi_struct *napi, int weight)
++{
++	struct bcm4908_enet_dma_ring *tx_ring = container_of(napi, struct bcm4908_enet_dma_ring, napi);
++	struct bcm4908_enet *enet = container_of(tx_ring, struct bcm4908_enet, tx_ring);
++	struct bcm4908_enet_dma_ring_bd *buf_desc;
++	struct bcm4908_enet_dma_ring_slot *slot;
++	struct device *dev = enet->dev;
++	unsigned int bytes = 0;
++	int handled = 0;
++
++	while (handled < weight && tx_ring->read_idx != tx_ring->write_idx) {
++		buf_desc = &tx_ring->buf_desc[tx_ring->read_idx];
++		if (le32_to_cpu(buf_desc->ctl) & DMA_CTL_STATUS_OWN)
++			break;
++		slot = &tx_ring->slots[tx_ring->read_idx];
++
++		dma_unmap_single(dev, slot->dma_addr, slot->len, DMA_TO_DEVICE);
++		dev_kfree_skb(slot->skb);
++		bytes += slot->len;
++		if (++tx_ring->read_idx == tx_ring->length)
++			tx_ring->read_idx = 0;
++
++		handled++;
++	}
++
++	if (handled < weight) {
++		napi_complete_done(napi, handled);
++		bcm4908_enet_dma_ring_intrs_on(enet, tx_ring);
++	}
++
++	if (netif_queue_stopped(enet->netdev))
++		netif_wake_queue(enet->netdev);
++
++	return handled;
++}
++
+ static int bcm4908_enet_change_mtu(struct net_device *netdev, int new_mtu)
+ {
+ 	struct bcm4908_enet *enet = netdev_priv(netdev);
+@@ -642,6 +706,8 @@ static int bcm4908_enet_probe(struct pla
+ 	if (netdev->irq < 0)
+ 		return netdev->irq;
+ 
++	enet->irq_tx = platform_get_irq_byname(pdev, "tx");
++
+ 	dma_set_coherent_mask(dev, DMA_BIT_MASK(32));
+ 
+ 	err = bcm4908_enet_dma_alloc(enet);
+@@ -658,7 +724,8 @@ static int bcm4908_enet_probe(struct pla
+ 	netdev->min_mtu = ETH_ZLEN;
+ 	netdev->mtu = ETH_DATA_LEN;
+ 	netdev->max_mtu = ENET_MTU_MAX;
+-	netif_napi_add(netdev, &enet->napi, bcm4908_enet_poll, 64);
++	netif_tx_napi_add(netdev, &enet->tx_ring.napi, bcm4908_enet_poll_tx, NAPI_POLL_WEIGHT);
++	netif_napi_add(netdev, &enet->rx_ring.napi, bcm4908_enet_poll_rx, NAPI_POLL_WEIGHT);
+ 
+ 	err = register_netdev(netdev);
+ 	if (err) {
+@@ -676,7 +743,8 @@ static int bcm4908_enet_remove(struct pl
+ 	struct bcm4908_enet *enet = platform_get_drvdata(pdev);
+ 
+ 	unregister_netdev(enet->netdev);
+-	netif_napi_del(&enet->napi);
++	netif_napi_del(&enet->rx_ring.napi);
++	netif_napi_del(&enet->tx_ring.napi);
+ 	bcm4908_enet_dma_free(enet);
+ 
+ 	return 0;
diff --git a/target/linux/bcm4908/patches-5.4/075-v5.13-0001-net-dsa-bcm_sf2-store-PHY-interface-mode-in-port-str.patch b/target/linux/bcm4908/patches-5.4/075-v5.13-0001-net-dsa-bcm_sf2-store-PHY-interface-mode-in-port-str.patch
new file mode 100644
index 0000000000..e9a0b2c79d
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.4/075-v5.13-0001-net-dsa-bcm_sf2-store-PHY-interface-mode-in-port-str.patch
@@ -0,0 +1,72 @@
+From 01488a0ccd9abe15565bed50a45afcddbb0fe199 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 12 Mar 2021 11:41:07 +0100
+Subject: [PATCH] net: dsa: bcm_sf2: store PHY interface/mode in port structure
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+It's needed later for proper switch / crossbar setup.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/bcm_sf2.c | 16 ++++++++++++----
+ drivers/net/dsa/bcm_sf2.h |  1 +
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -385,8 +385,9 @@ static void bcm_sf2_intr_disable(struct
+ static void bcm_sf2_identify_ports(struct bcm_sf2_priv *priv,
+ 				   struct device_node *dn)
+ {
++	struct device *dev = priv->dev->ds->dev;
++	struct bcm_sf2_port_status *port_st;
+ 	struct device_node *port;
+-	int mode;
+ 	unsigned int port_num;
+ 
+ 	priv->moca_port = -1;
+@@ -395,19 +396,26 @@ static void bcm_sf2_identify_ports(struc
+ 		if (of_property_read_u32(port, "reg", &port_num))
+ 			continue;
+ 
++		if (port_num >= DSA_MAX_PORTS) {
++			dev_err(dev, "Invalid port number %d\n", port_num);
++			continue;
++		}
++
++		port_st = &priv->port_sts[port_num];
++
+ 		/* Internal PHYs get assigned a specific 'phy-mode' property
+ 		 * value: "internal" to help flag them before MDIO probing
+ 		 * has completed, since they might be turned off at that
+ 		 * time
+ 		 */
+-		mode = of_get_phy_mode(port);
+-		if (mode < 0)
++		port_st->mode = of_get_phy_mode(port);
++		if (port_st->mode < 0)
+ 			continue;
+ 
+-		if (mode == PHY_INTERFACE_MODE_INTERNAL)
++		if (port_st->mode == PHY_INTERFACE_MODE_INTERNAL)
+ 			priv->int_phy_mask |= 1 << port_num;
+ 
+-		if (mode == PHY_INTERFACE_MODE_MOCA)
++		if (port_st->mode == PHY_INTERFACE_MODE_MOCA)
+ 			priv->moca_port = port_num;
+ 
+ 		if (of_property_read_bool(port, "brcm,use-bcm-hdr"))
+--- a/drivers/net/dsa/bcm_sf2.h
++++ b/drivers/net/dsa/bcm_sf2.h
+@@ -43,6 +43,7 @@ struct bcm_sf2_hw_params {
+ #define BCM_SF2_REGS_NUM	6
+ 
+ struct bcm_sf2_port_status {
++	int mode;
+ 	unsigned int link;
+ };
+ 
diff --git a/target/linux/bcm4908/patches-5.4/075-v5.13-0002-net-dsa-bcm_sf2-setup-BCM4908-internal-crossbar.patch b/target/linux/bcm4908/patches-5.4/075-v5.13-0002-net-dsa-bcm_sf2-setup-BCM4908-internal-crossbar.patch
new file mode 100644
index 0000000000..cd49ec1ab8
--- /dev/null
+++ b/target/linux/bcm4908/patches-5.4/075-v5.13-0002-net-dsa-bcm_sf2-setup-BCM4908-internal-crossbar.patch
@@ -0,0 +1,152 @@
+From a9349f08ec6c1251d41ef167d27a15cc39bc5b97 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 12 Mar 2021 11:41:08 +0100
+Subject: [PATCH] net: dsa: bcm_sf2: setup BCM4908 internal crossbar
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+On some SoCs (e.g. BCM4908, BCM631[345]8) SF2 has an integrated
+crossbar. It allows connecting its selected external ports to internal
+ports. It's used by vendors to handle custom Ethernet setups.
+
+BCM4908 has following 3x2 crossbar. On Asus GT-AC5300 rgmii is used for
+connecting external BCM53134S switch. GPHY4 is usually used for WAN
+port. More fancy devices use SerDes for 2.5 Gbps Ethernet.
+
+              ┌──────────┐
+SerDes ─── 0 ─┤          │
+              │   3x2    ├─ 0 ─── switch port 7
+ GPHY4 ─── 1 ─┤          │
+              │ crossbar ├─ 1 ─── runner (accelerator)
+ rgmii ─── 2 ─┤          │
+              └──────────┘
+
+Use setup data based on DT info to configure BCM4908's switch port 7.
+Right now only GPHY and rgmii variants are supported. Handling SerDes
+can be implemented later.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Acked-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/bcm_sf2.c      | 45 ++++++++++++++++++++++++++++++++++
+ drivers/net/dsa/bcm_sf2.h      |  1 +
+ drivers/net/dsa/bcm_sf2_regs.h |  7 ++++++
+ 3 files changed, 53 insertions(+)
+
+--- a/drivers/net/dsa/bcm_sf2.c
++++ b/drivers/net/dsa/bcm_sf2.c
+@@ -374,6 +374,44 @@ static int bcm_sf2_sw_rst(struct bcm_sf2
+ 	return 0;
+ }
+ 
++static void bcm_sf2_crossbar_setup(struct bcm_sf2_priv *priv)
++{
++	struct device *dev = priv->dev->ds->dev;
++	int shift;
++	u32 mask;
++	u32 reg;
++	int i;
++
++	mask = BIT(priv->num_crossbar_int_ports) - 1;
++
++	reg = reg_readl(priv, REG_CROSSBAR);
++	switch (priv->type) {
++	case BCM4908_DEVICE_ID:
++		shift = CROSSBAR_BCM4908_INT_P7 * priv->num_crossbar_int_ports;
++		reg &= ~(mask << shift);
++		if (0) /* FIXME */
++			reg |= CROSSBAR_BCM4908_EXT_SERDES << shift;
++		else if (priv->int_phy_mask & BIT(7))
++			reg |= CROSSBAR_BCM4908_EXT_GPHY4 << shift;
++		else if (phy_interface_mode_is_rgmii(priv->port_sts[7].mode))
++			reg |= CROSSBAR_BCM4908_EXT_RGMII << shift;
++		else if (WARN(1, "Invalid port mode\n"))
++			return;
++		break;
++	default:
++		return;
++	}
++	reg_writel(priv, reg, REG_CROSSBAR);
++
++	reg = reg_readl(priv, REG_CROSSBAR);
++	for (i = 0; i < priv->num_crossbar_int_ports; i++) {
++		shift = i * priv->num_crossbar_int_ports;
++
++		dev_dbg(dev, "crossbar int port #%d - ext port #%d\n", i,
++			(reg >> shift) & mask);
++	}
++}
++
+ static void bcm_sf2_intr_disable(struct bcm_sf2_priv *priv)
+ {
+ 	intrl2_0_mask_set(priv, 0xffffffff);
+@@ -737,6 +775,8 @@ static int bcm_sf2_sw_resume(struct dsa_
+ 		return ret;
+ 	}
+ 
++	bcm_sf2_crossbar_setup(priv);
++
+ 	ret = bcm_sf2_cfp_resume(ds);
+ 	if (ret)
+ 		return ret;
+@@ -999,6 +1039,7 @@ struct bcm_sf2_of_data {
+ 	const u16 *reg_offsets;
+ 	unsigned int core_reg_align;
+ 	unsigned int num_cfp_rules;
++	unsigned int num_crossbar_int_ports;
+ };
+ 
+ static const u16 bcm_sf2_4908_reg_offsets[] = {
+@@ -1023,6 +1064,7 @@ static const struct bcm_sf2_of_data bcm_
+ 	.core_reg_align	= 0,
+ 	.reg_offsets	= bcm_sf2_4908_reg_offsets,
+ 	.num_cfp_rules	= 0, /* FIXME */
++	.num_crossbar_int_ports = 2,
+ };
+ 
+ /* Register offsets for the SWITCH_REG_* block */
+@@ -1133,6 +1175,7 @@ static int bcm_sf2_sw_probe(struct platf
+ 	priv->reg_offsets = data->reg_offsets;
+ 	priv->core_reg_align = data->core_reg_align;
+ 	priv->num_cfp_rules = data->num_cfp_rules;
++	priv->num_crossbar_int_ports = data->num_crossbar_int_ports;
+ 
+ 	/* Auto-detection using standard registers will not work, so
+ 	 * provide an indication of what kind of device we are for
+@@ -1187,6 +1230,8 @@ static int bcm_sf2_sw_probe(struct platf
+ 		return ret;
+ 	}
+ 
++	bcm_sf2_crossbar_setup(priv);
++
+ 	bcm_sf2_gphy_enable_set(priv->dev->ds, true);
+ 
+ 	ret = bcm_sf2_mdio_register(ds);
+--- a/drivers/net/dsa/bcm_sf2.h
++++ b/drivers/net/dsa/bcm_sf2.h
+@@ -70,6 +70,7 @@ struct bcm_sf2_priv {
+ 	const u16			*reg_offsets;
+ 	unsigned int			core_reg_align;
+ 	unsigned int			num_cfp_rules;
++	unsigned int			num_crossbar_int_ports;
+ 
+ 	/* spinlock protecting access to the indirect registers */
+ 	spinlock_t			indir_lock;
+--- a/drivers/net/dsa/bcm_sf2_regs.h
++++ b/drivers/net/dsa/bcm_sf2_regs.h
+@@ -48,6 +48,13 @@ enum bcm_sf2_reg_offs {
+ #define  PHY_PHYAD_SHIFT		8
+ #define  PHY_PHYAD_MASK			0x1F
+ 
++/* Relative to REG_CROSSBAR */
++#define CROSSBAR_BCM4908_INT_P7		0
++#define CROSSBAR_BCM4908_INT_RUNNER	1
++#define CROSSBAR_BCM4908_EXT_SERDES	0
++#define CROSSBAR_BCM4908_EXT_GPHY4	1
++#define CROSSBAR_BCM4908_EXT_RGMII	2
++
+ #define REG_RGMII_CNTRL_P(x)		(REG_RGMII_0_CNTRL + (x))
+ 
+ /* Relative to REG_RGMII_CNTRL */
diff --git a/target/linux/bcm4908/patches-5.4/700-net-dsa-bcm_sf2-enable-GPHY-for-switch-probing.patch b/target/linux/bcm4908/patches-5.4/700-net-dsa-bcm_sf2-enable-GPHY-for-switch-probing.patch
index 26f6216061..7ba7f73f15 100644
--- a/target/linux/bcm4908/patches-5.4/700-net-dsa-bcm_sf2-enable-GPHY-for-switch-probing.patch
+++ b/target/linux/bcm4908/patches-5.4/700-net-dsa-bcm_sf2-enable-GPHY-for-switch-probing.patch
@@ -29,7 +29,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/dsa/bcm_sf2.c
 +++ b/drivers/net/dsa/bcm_sf2.c
-@@ -1234,10 +1234,14 @@ static int bcm_sf2_sw_probe(struct platf
+@@ -1290,10 +1290,14 @@ static int bcm_sf2_sw_probe(struct platf
  	rev = reg_readl(priv, REG_PHY_REVISION);
  	priv->hw_params.gphy_rev = rev & PHY_REVISION_MASK;
  
diff --git a/target/linux/bcm4908/patches-5.4/701-net-dsa-bcm_sf2-keep-GPHY-enabled-on-the-BCM4908.patch b/target/linux/bcm4908/patches-5.4/701-net-dsa-bcm_sf2-keep-GPHY-enabled-on-the-BCM4908.patch
index 559430a3a7..da5fec8022 100644
--- a/target/linux/bcm4908/patches-5.4/701-net-dsa-bcm_sf2-keep-GPHY-enabled-on-the-BCM4908.patch
+++ b/target/linux/bcm4908/patches-5.4/701-net-dsa-bcm_sf2-keep-GPHY-enabled-on-the-BCM4908.patch
@@ -15,7 +15,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/dsa/bcm_sf2.c
 +++ b/drivers/net/dsa/bcm_sf2.c
-@@ -1248,6 +1248,12 @@ static int bcm_sf2_sw_probe(struct platf
+@@ -1304,6 +1304,12 @@ static int bcm_sf2_sw_probe(struct platf
  		 priv->hw_params.core_rev >> 8, priv->hw_params.core_rev & 0xff,
  		 priv->irq0, priv->irq1);
  
diff --git a/target/linux/bcm4908/patches-5.4/702-net-dsa-bcm_sf2-quick-fix-for-RGMII-reg-access-on-BC.patch b/target/linux/bcm4908/patches-5.4/702-net-dsa-bcm_sf2-quick-fix-for-RGMII-reg-access-on-BC.patch
index 2d88cf353b..49b1ef68a3 100644
--- a/target/linux/bcm4908/patches-5.4/702-net-dsa-bcm_sf2-quick-fix-for-RGMII-reg-access-on-BC.patch
+++ b/target/linux/bcm4908/patches-5.4/702-net-dsa-bcm_sf2-quick-fix-for-RGMII-reg-access-on-BC.patch
@@ -16,7 +16,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 
 --- a/drivers/net/dsa/bcm_sf2.c
 +++ b/drivers/net/dsa/bcm_sf2.c
-@@ -543,10 +543,19 @@ static void bcm_sf2_sw_mac_config(struct
+@@ -592,10 +592,19 @@ static void bcm_sf2_sw_mac_config(struct
  	struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
  	u32 id_mode_dis = 0, port_mode;
  	u32 reg, offset;
@@ -36,7 +36,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  	if (priv->type == BCM4908_DEVICE_ID ||
  	    priv->type == BCM7445_DEVICE_ID)
  		offset = CORE_STS_OVERRIDE_GMIIP_PORT(port);
-@@ -574,7 +583,7 @@ static void bcm_sf2_sw_mac_config(struct
+@@ -623,7 +632,7 @@ static void bcm_sf2_sw_mac_config(struct
  	/* Clear id_mode_dis bit, and the existing port mode, let
  	 * RGMII_MODE_EN bet set by mac_link_{up,down}
  	 */
@@ -45,7 +45,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  	reg &= ~ID_MODE_DIS;
  	reg &= ~(PORT_MODE_MASK << PORT_MODE_SHIFT);
  	reg &= ~(RX_PAUSE_EN | TX_PAUSE_EN);
-@@ -589,7 +598,7 @@ static void bcm_sf2_sw_mac_config(struct
+@@ -638,7 +647,7 @@ static void bcm_sf2_sw_mac_config(struct
  		reg |= RX_PAUSE_EN;
  	}
  
@@ -54,7 +54,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  
  force_link:
  	/* Force link settings detected from the PHY */
-@@ -615,6 +624,7 @@ static void bcm_sf2_sw_mac_link_set(stru
+@@ -664,6 +673,7 @@ static void bcm_sf2_sw_mac_link_set(stru
  				    phy_interface_t interface, bool link)
  {
  	struct bcm_sf2_priv *priv = bcm_sf2_to_priv(ds);
@@ -62,7 +62,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  	u32 reg;
  
  	if (!phy_interface_mode_is_rgmii(interface) &&
-@@ -622,13 +632,21 @@ static void bcm_sf2_sw_mac_link_set(stru
+@@ -671,13 +681,21 @@ static void bcm_sf2_sw_mac_link_set(stru
  	    interface != PHY_INTERFACE_MODE_REVMII)
  		return;
  
@@ -86,7 +86,7 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  }
  
  static void bcm_sf2_sw_mac_link_down(struct dsa_switch *ds, int port,
-@@ -999,9 +1017,7 @@ static const u16 bcm_sf2_4908_reg_offset
+@@ -1051,9 +1069,7 @@ static const u16 bcm_sf2_4908_reg_offset
  	[REG_PHY_REVISION]	= 0x14,
  	[REG_SPHY_CNTRL]	= 0x24,
  	[REG_CROSSBAR]		= 0xc8,
diff --git a/target/linux/malta/Makefile b/target/linux/malta/Makefile
index 18b463f1ea..6915fb357b 100644
--- a/target/linux/malta/Makefile
+++ b/target/linux/malta/Makefile
@@ -11,6 +11,7 @@ INITRAMFS_EXTRA_FILES:=
 FEATURES:=cpiogz ext4 ramdisk squashfs targz
 
 KERNEL_PATCHVER:=5.4
+KERNEL_TESTING_PATCHVER:=5.10
 
 include $(INCLUDE_DIR)/target.mk
 
diff --git a/target/linux/malta/be/config-default b/target/linux/malta/be/config-default
index 735296f5b3..5586be6b7c 100644
--- a/target/linux/malta/be/config-default
+++ b/target/linux/malta/be/config-default
@@ -1,12 +1,4 @@
 CONFIG_CPU_BIG_ENDIAN=y
-CONFIG_CPU_HAS_RIXI=y
 # CONFIG_CPU_LITTLE_ENDIAN is not set
 CONFIG_CPU_MIPS32_R2=y
-CONFIG_CPU_MIPSR2=y
-CONFIG_CPU_SUPPORTS_MSA=y
-CONFIG_HAVE_CBPF_JIT=y
-CONFIG_HAVE_KVM=y
 CONFIG_HIGHMEM=y
-CONFIG_MIPS_CBPF_JIT=y
-CONFIG_MIPS_SPRAM=y
-CONFIG_TARGET_ISA_REV=2
diff --git a/target/linux/malta/be64/config-default b/target/linux/malta/be64/config-default
index fee1bc8c9d..ef044bb8ca 100644
--- a/target/linux/malta/be64/config-default
+++ b/target/linux/malta/be64/config-default
@@ -1,32 +1,9 @@
 # CONFIG_32BIT is not set
 CONFIG_64BIT=y
-CONFIG_ARCH_DMA_ADDR_T_64BIT=y
 CONFIG_ARCH_MMAP_RND_BITS=12
-CONFIG_ARCH_MMAP_RND_BITS_MAX=18
-CONFIG_ARCH_MMAP_RND_BITS_MIN=12
-CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y
 CONFIG_CPU_BIG_ENDIAN=y
-CONFIG_CPU_HAS_RIXI=y
 # CONFIG_CPU_LITTLE_ENDIAN is not set
-CONFIG_CPU_MIPS64=y
 CONFIG_CPU_MIPS64_R2=y
-CONFIG_CPU_MIPSR2=y
-CONFIG_CPU_SUPPORTS_64BIT_KERNEL=y
-CONFIG_CPU_SUPPORTS_HUGEPAGES=y
-CONFIG_CPU_SUPPORTS_MSA=y
-CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y
-CONFIG_HAVE_EBPF_JIT=y
-CONFIG_HAVE_KVM=y
-CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
 # CONFIG_MIPS32_N32 is not set
 # CONFIG_MIPS32_O32 is not set
-CONFIG_MIPS_EBPF_JIT=y
-CONFIG_MIPS_PGD_C0_CONTEXT=y
-CONFIG_MIPS_SPRAM=y
 # CONFIG_MIPS_VA_BITS_48 is not set
-CONFIG_MODULES_USE_ELF_RELA=y
-CONFIG_PGTABLE_LEVELS=3
-CONFIG_PHYS_ADDR_T_64BIT=y
-CONFIG_SYS_SUPPORTS_HUGETLBFS=y
-CONFIG_TARGET_ISA_REV=2
-CONFIG_ZONE_DMA32=y
diff --git a/target/linux/malta/config-5.10 b/target/linux/malta/config-5.10
new file mode 100644
index 0000000000..65e82eef8c
--- /dev/null
+++ b/target/linux/malta/config-5.10
@@ -0,0 +1,287 @@
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_MAY_HAVE_PC_FDC=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MIGHT_HAVE_PC_SERIO=y
+CONFIG_ARCH_MMAP_RND_BITS_MAX=15
+CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
+CONFIG_ATA=y
+CONFIG_ATA_PIIX=y
+CONFIG_BLK_DEV_BSG=y
+CONFIG_BLK_DEV_BSGLIB=y
+# CONFIG_BLK_DEV_DM is not set
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_LOOP=y
+# CONFIG_BLK_DEV_MD is not set
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_COUNT=16
+CONFIG_BLK_DEV_RAM_SIZE=4096
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_MQ_PCI=y
+CONFIG_BLK_SCSI_REQUEST=y
+CONFIG_BOARD_SCACHE=y
+CONFIG_BOOT_ELF32=y
+CONFIG_BOUNCE=y
+CONFIG_BUILTIN_DTB=y
+CONFIG_CEVT_R4K=y
+CONFIG_CLKBLD_I8253=y
+CONFIG_CLKDEV_LOOKUP=y
+CONFIG_CLKEVT_I8253=y
+CONFIG_CLKSRC_I8253=y
+CONFIG_CLKSRC_MIPS_GIC=y
+CONFIG_CLOCKSOURCE_WATCHDOG=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_COMMON_CLK=y
+# CONFIG_COMMON_CLK_BOSTON is not set
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CPU_GENERIC_DUMP_TLB=y
+CONFIG_CPU_HAS_PREFETCH=y
+# CONFIG_CPU_HAS_SMARTMIPS is not set
+CONFIG_CPU_HAS_SYNC=y
+# CONFIG_CPU_MICROMIPS is not set
+# CONFIG_CPU_MIPS32 is not set
+# CONFIG_CPU_MIPS32_3_5_FEATURES is not set
+# CONFIG_CPU_MIPS32_R1 is not set
+# CONFIG_CPU_MIPS32_R2 is not set
+# CONFIG_CPU_MIPS32_R5 is not set
+# CONFIG_CPU_MIPS32_R5_FEATURES is not set
+# CONFIG_CPU_MIPS32_R6 is not set
+# CONFIG_CPU_MIPS64_R1 is not set
+# CONFIG_CPU_MIPS64_R2 is not set
+# CONFIG_CPU_MIPS64_R6 is not set
+# CONFIG_CPU_MIPSR2 is not set
+# CONFIG_CPU_MIPSR2_IRQ_EI is not set
+# CONFIG_CPU_MIPSR2_IRQ_VI is not set
+CONFIG_CPU_NEEDS_NO_SMARTMIPS_OR_MICROMIPS=y
+# CONFIG_CPU_NEVADA is not set
+CONFIG_CPU_R4K_CACHE_TLB=y
+# CONFIG_CPU_RM7000 is not set
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SUPPORTS_32BIT_KERNEL=y
+CONFIG_CPU_SUPPORTS_HIGHMEM=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
+CONFIG_CRYPTO_CRC32=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_LIB_POLY1305_RSIZE=2
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_NULL2=y
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CSRC_R4K=y
+CONFIG_DMA_MAYBE_COHERENT=y
+CONFIG_DMA_NONCOHERENT=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_EXT4_FS=y
+CONFIG_F2FS_FS=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FS_POSIX_ACL=y
+CONFIG_FW_LOADER_PAGED_BUF=y
+CONFIG_GENERIC_ATOMIC64=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CMOS_UPDATE=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IOMAP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_ISA_DMA=y
+CONFIG_GENERIC_LIB_ASHLDI3=y
+CONFIG_GENERIC_LIB_ASHRDI3=y
+CONFIG_GENERIC_LIB_CMPDI2=y
+CONFIG_GENERIC_LIB_LSHRDI3=y
+CONFIG_GENERIC_LIB_UCMPDI2=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GLOB=y
+CONFIG_HANDLE_DOMAIN_IRQ=y
+CONFIG_HARDWARE_WATCHPOINTS=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HZ=250
+CONFIG_HZ_250=y
+CONFIG_I8253=y
+CONFIG_I8253_LOCK=y
+CONFIG_I8259=y
+CONFIG_INPUT=y
+# CONFIG_INPUT_MISC is not set
+CONFIG_INPUT_MOUSEDEV=y
+CONFIG_INPUT_MOUSEDEV_PSAUX=y
+CONFIG_INPUT_MOUSEDEV_SCREEN_X=1024
+CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
+CONFIG_IRQCHIP=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_MIPS_CPU=y
+CONFIG_IRQ_WORK=y
+CONFIG_ISA_DMA_API=y
+CONFIG_JBD2=y
+CONFIG_JFFS2_FS_POSIX_ACL=y
+CONFIG_JFFS2_FS_SECURITY=y
+CONFIG_KALLSYMS=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_XZ is not set
+CONFIG_LIBFDT=y
+CONFIG_LLD_VERSION=0
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MD=y
+CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGRATION=y
+CONFIG_MIPS=y
+CONFIG_MIPS_ASID_BITS=8
+CONFIG_MIPS_ASID_SHIFT=0
+CONFIG_MIPS_BONITO64=y
+CONFIG_MIPS_CLOCK_VSYSCALL=y
+CONFIG_MIPS_CM=y
+# CONFIG_MIPS_CMDLINE_DTB_EXTEND is not set
+CONFIG_MIPS_CMDLINE_FROM_BOOTLOADER=y
+# CONFIG_MIPS_CMDLINE_FROM_DTB is not set
+# CONFIG_MIPS_CMP is not set
+CONFIG_MIPS_CPC=y
+# CONFIG_MIPS_CPS is not set
+CONFIG_MIPS_CPU_SCACHE=y
+# CONFIG_MIPS_ELF_APPENDED_DTB is not set
+CONFIG_MIPS_EXTERNAL_TIMER=y
+CONFIG_MIPS_GIC=y
+CONFIG_MIPS_L1_CACHE_SHIFT=6
+CONFIG_MIPS_L1_CACHE_SHIFT_6=y
+CONFIG_MIPS_LD_CAN_LINK_VDSO=y
+CONFIG_MIPS_MALTA=y
+CONFIG_MIPS_MSC=y
+CONFIG_MIPS_MT=y
+CONFIG_MIPS_MT_FPAFF=y
+CONFIG_MIPS_MT_SMP=y
+CONFIG_MIPS_NO_APPENDED_DTB=y
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_PERF_SHARED_TC_COUNTERS=y
+# CONFIG_MIPS_RAW_APPENDED_DTB is not set
+# CONFIG_MIPS_VPE_LOADER is not set
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MTD_CFI_STAA=y
+# CONFIG_MTD_COMPLEX_MAPPINGS is not set
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NLS=y
+CONFIG_NO_GENERIC_PCI_IOPORT_MAP=y
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=2
+CONFIG_NVMEM=y
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_NET=y
+CONFIG_PADATA=y
+# CONFIG_PARTITION_ADVANCED is not set
+CONFIG_PATA_LEGACY=y
+CONFIG_PATA_TIMINGS=y
+CONFIG_PCI=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_DRIVERS_LEGACY=y
+CONFIG_PCI_GT64XXX_PCI0=y
+CONFIG_PCSPKR_PLATFORM=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_PIIX4_POWEROFF=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_PRINT_QUOTA_WARNING=y
+CONFIG_PROC_PAGE_MONITOR=y
+# CONFIG_QFMT_V1 is not set
+CONFIG_QFMT_V2=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_QUOTA=y
+CONFIG_QUOTACTL=y
+# CONFIG_QUOTA_NETLINK_INTERFACE is not set
+CONFIG_QUOTA_TREE=y
+CONFIG_RATIONAL=y
+CONFIG_RCU_NEED_SEGCBLIST=y
+CONFIG_RCU_STALL_COMMON=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_RELAY=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_MC146818_LIB=y
+CONFIG_SATA_HOST=y
+CONFIG_SCSI=y
+CONFIG_SECCOMP=y
+CONFIG_SECCOMP_FILTER=y
+CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIO=y
+CONFIG_SERIO_SERPORT=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SRCU=y
+CONFIG_SWAP_IO_SPACE=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYSCTL_EXCEPTION_TRACE=y
+CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_SYS_HAS_CPU_MIPS32_R1=y
+CONFIG_SYS_HAS_CPU_MIPS32_R2=y
+CONFIG_SYS_HAS_CPU_MIPS32_R3_5=y
+CONFIG_SYS_HAS_CPU_MIPS32_R5=y
+CONFIG_SYS_HAS_CPU_MIPS32_R6=y
+CONFIG_SYS_HAS_CPU_MIPS64_R1=y
+CONFIG_SYS_HAS_CPU_MIPS64_R2=y
+CONFIG_SYS_HAS_CPU_MIPS64_R6=y
+CONFIG_SYS_HAS_CPU_NEVADA=y
+CONFIG_SYS_HAS_CPU_RM7000=y
+CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_64BIT_KERNEL=y
+CONFIG_SYS_SUPPORTS_ARBIT_HZ=y
+CONFIG_SYS_SUPPORTS_BIG_ENDIAN=y
+CONFIG_SYS_SUPPORTS_HIGHMEM=y
+CONFIG_SYS_SUPPORTS_LITTLE_ENDIAN=y
+CONFIG_SYS_SUPPORTS_MICROMIPS=y
+CONFIG_SYS_SUPPORTS_MIPS16=y
+CONFIG_SYS_SUPPORTS_MIPS_CMP=y
+CONFIG_SYS_SUPPORTS_MIPS_CPS=y
+CONFIG_SYS_SUPPORTS_MULTITHREADING=y
+CONFIG_SYS_SUPPORTS_RELOCATABLE=y
+CONFIG_SYS_SUPPORTS_SCHED_SMT=y
+CONFIG_SYS_SUPPORTS_SMARTMIPS=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_SYS_SUPPORTS_VPE_LOADER=y
+CONFIG_SYS_SUPPORTS_ZBOOT=y
+CONFIG_TARGET_ISA_REV=1
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_USB_SUPPORT=y
+# CONFIG_USERIO is not set
+CONFIG_USE_OF=y
+# CONFIG_VGA_CONSOLE is not set
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_VXFS_FS=y
+CONFIG_WAR_ICACHE_REFILLS=y
+CONFIG_XPS=y
diff --git a/target/linux/malta/le/config-default b/target/linux/malta/le/config-default
index 2c6148195e..ff8a7a84c6 100644
--- a/target/linux/malta/le/config-default
+++ b/target/linux/malta/le/config-default
@@ -1,11 +1,3 @@
-CONFIG_CPU_HAS_RIXI=y
 CONFIG_CPU_LITTLE_ENDIAN=y
 CONFIG_CPU_MIPS32_R2=y
-CONFIG_CPU_MIPSR2=y
-CONFIG_CPU_SUPPORTS_MSA=y
-CONFIG_HAVE_CBPF_JIT=y
-CONFIG_HAVE_KVM=y
 CONFIG_HIGHMEM=y
-CONFIG_MIPS_CBPF_JIT=y
-CONFIG_MIPS_SPRAM=y
-CONFIG_TARGET_ISA_REV=2
diff --git a/target/linux/malta/le64/config-default b/target/linux/malta/le64/config-default
index 531d93d58e..69e5387a1f 100644
--- a/target/linux/malta/le64/config-default
+++ b/target/linux/malta/le64/config-default
@@ -1,31 +1,8 @@
 # CONFIG_32BIT is not set
 CONFIG_64BIT=y
-CONFIG_ARCH_DMA_ADDR_T_64BIT=y
 CONFIG_ARCH_MMAP_RND_BITS=12
-CONFIG_ARCH_MMAP_RND_BITS_MAX=18
-CONFIG_ARCH_MMAP_RND_BITS_MIN=12
-CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y
-CONFIG_CPU_HAS_RIXI=y
 CONFIG_CPU_LITTLE_ENDIAN=y
-CONFIG_CPU_MIPS64=y
 CONFIG_CPU_MIPS64_R2=y
-CONFIG_CPU_MIPSR2=y
-CONFIG_CPU_SUPPORTS_64BIT_KERNEL=y
-CONFIG_CPU_SUPPORTS_HUGEPAGES=y
-CONFIG_CPU_SUPPORTS_MSA=y
-CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y
-CONFIG_HAVE_EBPF_JIT=y
-CONFIG_HAVE_KVM=y
-CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
 # CONFIG_MIPS32_N32 is not set
 # CONFIG_MIPS32_O32 is not set
-CONFIG_MIPS_EBPF_JIT=y
-CONFIG_MIPS_PGD_C0_CONTEXT=y
-CONFIG_MIPS_SPRAM=y
 # CONFIG_MIPS_VA_BITS_48 is not set
-CONFIG_MODULES_USE_ELF_RELA=y
-CONFIG_PGTABLE_LEVELS=3
-CONFIG_PHYS_ADDR_T_64BIT=y
-CONFIG_SYS_SUPPORTS_HUGETLBFS=y
-CONFIG_TARGET_ISA_REV=2
-CONFIG_ZONE_DMA32=y
diff --git a/target/linux/mediatek/Makefile b/target/linux/mediatek/Makefile
index 2ee00e5d17..0825b8c6ed 100644
--- a/target/linux/mediatek/Makefile
+++ b/target/linux/mediatek/Makefile
@@ -6,7 +6,7 @@ ARCH:=arm
 BOARD:=mediatek
 BOARDNAME:=MediaTek Ralink ARM
 SUBTARGETS:=mt7622 mt7623 mt7629
-FEATURES:=squashfs nand separate_ramdisk fpu
+FEATURES:=squashfs nand separate_ramdisk fpu dt-overlay
 
 KERNEL_PATCHVER:=5.4
 KERNEL_TESTING_PATCHVER:=5.10
diff --git a/target/linux/mediatek/dts/mt7622-buffalo-wsr-2533dhp2.dts b/target/linux/mediatek/dts/mt7622-buffalo-wsr-2533dhp2.dts
index 397be1445b..ce5cd1c9be 100644
--- a/target/linux/mediatek/dts/mt7622-buffalo-wsr-2533dhp2.dts
+++ b/target/linux/mediatek/dts/mt7622-buffalo-wsr-2533dhp2.dts
@@ -269,7 +269,6 @@
 			partition@140000 {
 				label = "Config";
 				reg = <0x140000 0x80000>;
-				read-only;
 			};
 
 			factory: partition@1c0000 {
diff --git a/target/linux/mediatek/image/mt7622.mk b/target/linux/mediatek/image/mt7622.mk
index 13f734b38c..88d71600b2 100644
--- a/target/linux/mediatek/image/mt7622.mk
+++ b/target/linux/mediatek/image/mt7622.mk
@@ -73,6 +73,7 @@ define Device/bananapi_bpi-r64
   DEVICE_VENDOR := Bananapi
   DEVICE_MODEL := BPi-R64
   DEVICE_DTS := mt7622-bananapi-bpi-r64
+  DEVICE_DTS_OVERLAY := mt7622-bananapi-bpi-r64-pcie1 mt7622-bananapi-bpi-r64-sata
   DEVICE_PACKAGES := kmod-ata-ahci-mtk kmod-btmtkuart kmod-usb3 e2fsprogs mkf2fs f2fsck
   ARTIFACTS := sdcard.img
   IMAGES := sysupgrade.itb
@@ -192,6 +193,7 @@ TARGET_DEVICES += mediatek_mt7622-rfb1-ubi
 define Device/ubnt_unifi-6-lr
   DEVICE_VENDOR := Ubiquiti
   DEVICE_MODEL := UniFi 6 LR
+  DEVICE_DTS_CONFIG := config@1
   DEVICE_DTS := mt7622-ubnt-unifi-6-lr
   DEVICE_DTS_DIR := ../dts
   DEVICE_PACKAGES := kmod-mt7915e
diff --git a/target/linux/mediatek/patches-5.10/900-dts-mt7622-bpi-r64-aliases-for-dtoverlay.patch b/target/linux/mediatek/patches-5.10/900-dts-mt7622-bpi-r64-aliases-for-dtoverlay.patch
new file mode 100644
index 0000000000..4c6df93089
--- /dev/null
+++ b/target/linux/mediatek/patches-5.10/900-dts-mt7622-bpi-r64-aliases-for-dtoverlay.patch
@@ -0,0 +1,80 @@
+--- a/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64.dts
+@@ -279,14 +279,14 @@
+ &pcie1 {
+ 	pinctrl-names = "default";
+ 	pinctrl-0 = <&pcie1_pins>;
+-	status = "okay";
++	status = "disabled";
+ };
+ 
+ &pio {
+ 	/* Attention: GPIO 90 is used to switch between PCIe@1,0 and
+ 	 * SATA functions. i.e. output-high: PCIe, output-low: SATA
+ 	 */
+-	asm_sel {
++	asmsel: asm_sel {
+ 		gpio-hog;
+ 		gpios = <90 GPIO_ACTIVE_HIGH>;
+ 		output-high;
+--- /dev/null
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64-sata.dts
+@@ -0,0 +1,31 @@
++/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
++
++#include <dt-bindings/gpio/gpio.h>
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "bananapi,bpi-r64", "mediatek,mt7622";
++
++	fragment@0 {
++		target = <&asmsel>;
++		__overlay__ {
++			gpios = <90 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	fragment@1 {
++		target = <&sata>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&sata_phy>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++};
+--- /dev/null
++++ b/arch/arm64/boot/dts/mediatek/mt7622-bananapi-bpi-r64-pcie1.dts
+@@ -0,0 +1,24 @@
++/* SPDX-License-Identifier: (GPL-2.0-only OR MIT) */
++
++#include <dt-bindings/gpio/gpio.h>
++
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "bananapi,bpi-r64", "mediatek,mt7622";
++
++	fragment@0 {
++		target = <&asmsel>;
++		__overlay__ {
++			gpios = <90 GPIO_ACTIVE_HIGH>;
++		};
++	};
++
++	fragment@1 {
++		target = <&pcie1>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++};
diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index dea1de1da2..c2b022f645 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -1191,6 +1191,7 @@ define Device/ubnt_unifi-6-lite
   $(Device/dsa-migration)
   DEVICE_VENDOR := Ubiquiti
   DEVICE_MODEL := UniFi 6 Lite
+  DEVICE_DTS_CONFIG := config@1
   DEVICE_PACKAGES += kmod-mt7603 kmod-mt7915e
   KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
   IMAGE_SIZE := 15424k
diff --git a/target/linux/realtek/config-5.4 b/target/linux/realtek/config-5.4
index 2fbd904376..51025d5d89 100644
--- a/target/linux/realtek/config-5.4
+++ b/target/linux/realtek/config-5.4
@@ -82,6 +82,7 @@ CONFIG_HAS_DMA=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT_MAP=y
 # CONFIG_HIGH_RES_TIMERS is not set
+CONFIG_HWMON=y
 CONFIG_HZ=250
 CONFIG_HZ_250=y
 CONFIG_HZ_PERIODIC=y
@@ -101,6 +102,7 @@ CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MARVELL_PHY=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_I2C=y
@@ -159,6 +161,7 @@ CONFIG_PINCTRL=y
 CONFIG_POWER_RESET=y
 CONFIG_POWER_RESET_SYSCON=y
 CONFIG_PSB6970_PHY=y
+CONFIG_REALTEK_PHY=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_MMIO=y
 CONFIG_RESET_CONTROLLER=y
diff --git a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-10hp.dts b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-10hp.dts
index 92d0e25fc4..c16028788e 100644
--- a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-10hp.dts
+++ b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-10hp.dts
@@ -17,7 +17,7 @@
 	};
 
 	sfp0: sfp-p9 {
-		compatible = "_sff,sfp";
+		compatible = "sff,sfp";
 		i2c-bus = <&i2c0>;
 		los-gpio = <&gpio1 27 GPIO_ACTIVE_HIGH>;
 		tx-fault-gpio = <&gpio1 22 GPIO_ACTIVE_HIGH>;
@@ -36,7 +36,7 @@
 	};
 
 	sfp1: sfp-p10 {
-		compatible = "_sff,sfp";
+		compatible = "sff,sfp";
 		i2c-bus = <&i2c1>;
 		los-gpio = <&gpio1 33 GPIO_ACTIVE_HIGH>;
 		tx-fault-gpio = <&gpio1 28 GPIO_ACTIVE_HIGH>;
@@ -55,29 +55,17 @@
 		port@24 {
 			reg = <24>;
 			label = "lan9";
-			phy-mode = "rgmii-id";
-			phy-handle = <&phy24>;
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
 			sfp = <&sfp0>;
-
-			fixed-link {
-				speed = <1000>;
-				full-duplex;
-				pause;
-			};
 		};
 
 		port@26 {
 			reg = <26>;
 			label = "lan10";
-			phy-mode = "rgmii-id";
-			phy-handle = <&phy26>;
+			phy-mode = "1000base-x";
+			managed = "in-band-status";
 			sfp = <&sfp1>;
-
-			fixed-link {
-				speed = <1000>;
-				full-duplex;
-				pause;
-			};
 		};
 	};
 };
diff --git a/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/common.c b/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/common.c
index 698f2892ea..6940afa7f2 100644
--- a/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/common.c
+++ b/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/common.c
@@ -368,8 +368,8 @@ static int __init rtl83xx_mdio_probe(struct rtl838x_switch_priv *priv)
 
 	/* Enable PHY control via SoC */
 	if (priv->family_id == RTL8380_FAMILY_ID) {
-		/* Enable PHY control via SoC */
-		sw_w32_mask(0, BIT(15), RTL838X_SMI_GLB_CTRL);
+		/* Enable SerDes NWAY and PHY control via SoC */
+		sw_w32_mask(BIT(7), BIT(15), RTL838X_SMI_GLB_CTRL);
 	} else {
 		/* Disable PHY polling via SoC */
 		sw_w32_mask(BIT(7), 0, RTL839X_SMI_GLB_CTRL);
@@ -555,7 +555,6 @@ static int __init rtl83xx_sw_probe(struct platform_device *pdev)
 	int err = 0, i;
 	struct rtl838x_switch_priv *priv;
 	struct device *dev = &pdev->dev;
-	u64 irq_mask;
 	u64 bpdu_mask;
 
 	pr_debug("Probing RTL838X switch device\n");
@@ -650,9 +649,9 @@ static int __init rtl83xx_sw_probe(struct platform_device *pdev)
 
 	/* Enable link and media change interrupts. Are the SERDES masks needed? */
 	sw_w32_mask(0, 3, priv->r->isr_glb_src);
-	
-	priv->r->set_port_reg_le(irq_mask, priv->r->isr_port_link_sts_chg);
-	priv->r->set_port_reg_le(irq_mask, priv->r->imr_port_link_sts_chg);
+
+	priv->r->set_port_reg_le(priv->irq_mask, priv->r->isr_port_link_sts_chg);
+	priv->r->set_port_reg_le(priv->irq_mask, priv->r->imr_port_link_sts_chg);
 
 	priv->link_state_irq = platform_get_irq(pdev, 0);
 	pr_info("LINK state irq: %d\n", priv->link_state_irq);
diff --git a/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/dsa.c b/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/dsa.c
index af6d92cbc2..987b47dc8f 100644
--- a/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/dsa.c
+++ b/target/linux/realtek/files-5.4/drivers/net/dsa/rtl83xx/dsa.c
@@ -245,6 +245,7 @@ static void rtl83xx_phylink_validate(struct dsa_switch *ds, int port,
 	pr_debug("In %s port %d", __func__, port);
 
 	if (!phy_interface_mode_is_rgmii(state->interface) &&
+	    state->interface != PHY_INTERFACE_MODE_NA &&
 	    state->interface != PHY_INTERFACE_MODE_1000BASEX &&
 	    state->interface != PHY_INTERFACE_MODE_MII &&
 	    state->interface != PHY_INTERFACE_MODE_REVMII &&
@@ -343,6 +344,44 @@ static int rtl83xx_phylink_mac_link_state(struct dsa_switch *ds, int port,
 	return 1;
 }
 
+
+static void rtl83xx_config_interface(int port, phy_interface_t interface)
+{
+	u32 old, int_shift, sds_shift;
+
+	switch (port) {
+	case 24:
+		int_shift = 0;
+		sds_shift = 5;
+		break;
+	case 26:
+		int_shift = 3;
+		sds_shift = 0;
+		break;
+	default:
+		return;
+	}
+
+	old = sw_r32(RTL838X_SDS_MODE_SEL);
+	switch (interface) {
+	case PHY_INTERFACE_MODE_1000BASEX:
+		if ((old >> sds_shift & 0x1f) == 4)
+			return;
+		sw_w32_mask(0x7 << int_shift, 1 << int_shift, RTL838X_INT_MODE_CTRL);
+		sw_w32_mask(0x1f << sds_shift, 4 << sds_shift, RTL838X_SDS_MODE_SEL);
+		break;
+	case PHY_INTERFACE_MODE_SGMII:
+		if ((old >> sds_shift & 0x1f) == 2)
+			return;
+		sw_w32_mask(0x7 << int_shift, 2 << int_shift, RTL838X_INT_MODE_CTRL);
+		sw_w32_mask(0x1f << sds_shift, 2 << sds_shift, RTL838X_SDS_MODE_SEL);
+		break;
+	default:
+		return;
+	}
+	pr_debug("configured port %d for interface %s\n", port, phy_modes(interface));
+}
+
 static void rtl83xx_phylink_mac_config(struct dsa_switch *ds, int port,
 					unsigned int mode,
 					const struct phylink_link_state *state)
@@ -376,10 +415,11 @@ static void rtl83xx_phylink_mac_config(struct dsa_switch *ds, int port,
 	reg = sw_r32(priv->r->mac_force_mode_ctrl(port));
 	/* Auto-Negotiation does not work for MAC in RTL8390 */
 	if (priv->family_id == RTL8380_FAMILY_ID) {
-		if (mode == MLO_AN_PHY) {
+		if (mode == MLO_AN_PHY || phylink_autoneg_inband(mode)) {
 			pr_debug("PHY autonegotiates\n");
 			reg |= BIT(2);
 			sw_w32(reg, priv->r->mac_force_mode_ctrl(port));
+			rtl83xx_config_interface(port, state->interface);
 			return;
 		}
 	}