diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 22286c054e2..8744bc7737a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,6 +2,8 @@ name: Build sub target
 
 on:
   workflow_call:
+    secrets:
+      coverity_api_token:
     inputs:
       target:
         required: true
@@ -25,6 +27,23 @@ on:
       use_openwrt_container:
         type: boolean
         default: true
+      coverity_project_name:
+        type: string
+        default: OpenWrt
+      coverity_check_packages:
+        type: string
+      coverity_compiler_template_list:
+        type: string
+        default: >-
+          arm-openwrt-linux-gcc
+      coverity_force_compile_packages:
+        type: string
+        default: >-
+          curl
+          libnl
+          mbedtls
+          wolfssl
+          openssl
 
 permissions:
   contents: read
@@ -361,6 +380,57 @@ jobs:
         working-directory: openwrt
         run: make -j$(nproc) BUILD_LOG=1 || ret=$? .github/workflows/scripts/show_build_failures.sh
 
+      - name: Coverity prepare toolchain
+        if: inputs.coverity_check_packages != ''
+        shell: su buildbot -c "sh -e {0}"
+        working-directory: openwrt
+        run: |
+          wget -q https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.coverity_api_token }}&project=${{ inputs.coverity_project_name }}" -O coverity.tar.gz
+          wget -q https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.coverity_api_token }}&project=${{ inputs.coverity_project_name }}&md5=1" -O coverity.tar.gz.md5
+          echo ' coverity.tar.gz' >> coverity.tar.gz.md5
+          md5sum -c coverity.tar.gz.md5
+
+          mkdir cov-analysis-linux64
+          tar xzf coverity.tar.gz --strip 1 -C cov-analysis-linux64
+          export PATH=$(pwd)/cov-analysis-linux64/bin:$PATH
+
+          for template in ${{ inputs.coverity_compiler_template_list }}; do
+            cov-configure --template --comptype gcc --compiler "$template"
+          done
+
+      - name: Clean and recompile packages with Coverity toolchain
+        if: inputs.coverity_check_packages != ''
+        shell: su buildbot -c "bash {0}"
+        working-directory: openwrt
+        run: |
+          set -o pipefail -o errexit
+
+          coverity_check_packages=(${{ inputs.coverity_check_packages }})
+          printf -v clean_packages "package/%s/clean " "${coverity_check_packages[@]}"
+          make -j$(nproc) BUILD_LOG=1 $clean_packages || ret=$? .github/workflows/scripts/show_build_failures.sh
+
+          coverity_force_compile_packages=(${{ inputs.coverity_force_compile_packages }})
+          printf -v force_compile_packages "package/%s/compile " "${coverity_force_compile_packages[@]}"
+          make -j$(nproc) BUILD_LOG=1 $force_compile_packages || ret=$? .github/workflows/scripts/show_build_failures.sh
+
+          printf -v compile_packages "package/%s/compile " "${coverity_check_packages[@]}"
+          export PATH=$(pwd)/cov-analysis-linux64/bin:$PATH
+          cov-build --dir cov-int make -j $(nproc) BUILD_LOG=1 $compile_packages || ret=$? .github/workflows/scripts/show_build_failures.sh
+
+      - name: Upload build to Coverity for analysis
+        if: inputs.coverity_check_packages != ''
+        shell: su buildbot -c "sh -e {0}"
+        working-directory: openwrt
+        run: |
+          tar czf cov-int.tar.gz ./cov-int
+          curl \
+            --form token="${{ secrets.coverity_api_token }}" \
+            --form email="contact@openwrt.org" \
+            --form file=@cov-int.tar.gz \
+            --form version="${{ github.ref_name }}-${{ github.sha }}" \
+            --form description="OpenWrt ${{ github.ref_name }}-${{ github.sha }}" \
+            "https://scan.coverity.com/builds?project=${{ inputs.coverity_project_name }}"
+
       - name: Upload logs
         if: failure()
         uses: actions/upload-artifact@v3
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
new file mode 100644
index 00000000000..db628d05eec
--- /dev/null
+++ b/.github/workflows/coverity.yml
@@ -0,0 +1,64 @@
+name: Coverity scan build
+
+on:
+  schedule:
+    - cron: '30 2 * * 6'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  coverity_build:
+    name: Coverity x86/64 build
+    secrets:
+      coverity_api_token: ${{ secrets.COVERITY_API_TOKEN }}
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/build.yml
+    with:
+      target: x86/64
+      build_full: true
+      include_feeds: true
+      coverity_compiler_template_list: >-
+        x86_64-openwrt-linux-gcc
+        x86_64-openwrt-linux-musl-gcc
+      #  qosify fails to build with cov-build
+      coverity_check_packages: >-
+        cgi-io
+        dnsmasq
+        dropbear
+        firewall
+        fstools
+        fwtool
+        iwinfo
+        jsonfilter
+        libnl-tiny
+        libubox
+        mtd
+        netifd
+        odhcp6c
+        odhcpd
+        opkg
+        procd
+        relayd
+        rpcd
+        swconfig
+        ubox
+        ubus
+        ucert
+        uci
+        uclient
+        ucode
+        ugps
+        uhttpd
+        umbim
+        umdns
+        unetd
+        uqmi
+        urngd
+        usbmode
+        usign
+        usteer
+        ustp
+        ustream-ssl
diff --git a/package/utils/busybox/Config-defaults.in b/package/utils/busybox/Config-defaults.in
index 220d9eac204..b3c3f9a0b23 100644
--- a/package/utils/busybox/Config-defaults.in
+++ b/package/utils/busybox/Config-defaults.in
@@ -982,7 +982,7 @@ config BUSYBOX_DEFAULT_RESET
 	default y
 config BUSYBOX_DEFAULT_RESIZE
 	bool
-	default n
+	default y
 config BUSYBOX_DEFAULT_FEATURE_RESIZE_PRINT
 	bool
 	default n
@@ -3023,7 +3023,7 @@ config BUSYBOX_DEFAULT_ASH_ALIAS
 	default y
 config BUSYBOX_DEFAULT_ASH_RANDOM_SUPPORT
 	bool
-	default n
+	default y
 config BUSYBOX_DEFAULT_ASH_EXPAND_PRMT
 	bool
 	default y
diff --git a/target/linux/ath79/image/generic.mk b/target/linux/ath79/image/generic.mk
index ecc46bc6b12..fc9ffa6de96 100644
--- a/target/linux/ath79/image/generic.mk
+++ b/target/linux/ath79/image/generic.mk
@@ -419,6 +419,12 @@ define Device/aruba_ap-175
   DEVICE_MODEL := AP-175
   IMAGE_SIZE := 16000k
   DEVICE_PACKAGES := kmod-gpio-pca953x kmod-hwmon-lm75 kmod-i2c-gpio kmod-rtc-ds1374
+  LOADER_TYPE := bin
+  LOADER_FLASH_OFFS := 0x42000
+  COMPILE := loader-$(1).bin
+  COMPILE/loader-$(1).bin := loader-okli-compile
+  KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49 | loader-okli $(1) 8128 | uImage none
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
 endef
 TARGET_DEVICES += aruba_ap-175
 
diff --git a/target/linux/generic/files/drivers/bcma/fallback-sprom.c b/target/linux/generic/files/drivers/bcma/fallback-sprom.c
index 6da41cd3b47..ce93560a482 100644
--- a/target/linux/generic/files/drivers/bcma/fallback-sprom.c
+++ b/target/linux/generic/files/drivers/bcma/fallback-sprom.c
@@ -19,16 +19,15 @@
 
 #define BCMA_FBS_MAX_SIZE 468
 
-/* Get the word-offset for a SSB_SPROM_XXX define. */
+/* SPROM Extraction */
 #define SPOFF(offset)	((offset) / sizeof(u16))
-/* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
-#define SPEX16(_outvar, _offset, _mask, _shift)	\
+
+#define SPEX(_outvar, _offset, _mask, _shift)	\
 	out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
+
 #define SPEX32(_outvar, _offset, _mask, _shift)	\
 	out->_outvar = ((((u32)in[SPOFF((_offset)+2)] << 16 | \
 			   in[SPOFF(_offset)]) & (_mask)) >> (_shift))
-#define SPEX(_outvar, _offset, _mask, _shift) \
-	SPEX16(_outvar, _offset, _mask, _shift)
 
 #define SPEX_ARRAY8(_field, _offset, _mask, _shift)	\
 	do {	\
@@ -48,8 +47,7 @@ struct bcma_fbs {
 	struct ssb_sprom sprom;
 	u32 pci_bus;
 	u32 pci_dev;
-	u8 mac[ETH_ALEN];
-	int devid_override;
+	bool devid_override;
 };
 
 static DEFINE_SPINLOCK(bcma_fbs_lock);
@@ -57,9 +55,14 @@ static struct list_head bcma_fbs_list = LIST_HEAD_INIT(bcma_fbs_list);
 
 int bcma_get_fallback_sprom(struct bcma_bus *bus, struct ssb_sprom *out)
 {
-	const u32 pci_bus = bus->host_pci->bus->number;
-	const u32 pci_dev = PCI_SLOT(bus->host_pci->devfn);
 	struct bcma_fbs *pos;
+	u32 pci_bus, pci_dev;
+
+	if (bus->hosttype != BCMA_HOSTTYPE_PCI)
+		return -ENOENT;
+
+	pci_bus = bus->host_pci->bus->number;
+	pci_dev = PCI_SLOT(bus->host_pci->devfn);
 
 	list_for_each_entry(pos, &bcma_fbs_list, list) {
 		if (pos->pci_bus != pci_bus ||
@@ -81,19 +84,15 @@ int bcma_get_fallback_sprom(struct bcma_bus *bus, struct ssb_sprom *out)
 	return -EINVAL;
 }
 
-static s8 sprom_extract_antgain(u8 sprom_revision, const u16 *in, u16 offset,
-				u16 mask, u16 shift)
+static s8 sprom_extract_antgain(const u16 *in, u16 offset, u16 mask, u16 shift)
 {
 	u16 v;
 	u8 gain;
 
 	v = in[SPOFF(offset)];
 	gain = (v & mask) >> shift;
-	if (gain == 0xFF)
-		gain = 2; /* If unset use 2dBm */
-	if (sprom_revision == 1) {
-		/* Convert to Q5.2 */
-		gain <<= 2;
+	if (gain == 0xFF) {
+		gain = 8; /* If unset use 2dBm */
 	} else {
 		/* Q5.2 Fractional part is stored in 0xC0 */
 		gain = ((gain & 0xC0) >> 6) | ((gain & 0x3F) << 2);
@@ -102,338 +101,66 @@ static s8 sprom_extract_antgain(u8 sprom_revision, const u16 *in, u16 offset,
 	return (s8)gain;
 }
 
-static void sprom_extract_r23(struct ssb_sprom *out, const u16 *in)
-{
-	SPEX(boardflags_hi, SSB_SPROM2_BFLHI, 0xFFFF, 0);
-	SPEX(opo, SSB_SPROM2_OPO, SSB_SPROM2_OPO_VALUE, 0);
-	SPEX(pa1lob0, SSB_SPROM2_PA1LOB0, 0xFFFF, 0);
-	SPEX(pa1lob1, SSB_SPROM2_PA1LOB1, 0xFFFF, 0);
-	SPEX(pa1lob2, SSB_SPROM2_PA1LOB2, 0xFFFF, 0);
-	SPEX(pa1hib0, SSB_SPROM2_PA1HIB0, 0xFFFF, 0);
-	SPEX(pa1hib1, SSB_SPROM2_PA1HIB1, 0xFFFF, 0);
-	SPEX(pa1hib2, SSB_SPROM2_PA1HIB2, 0xFFFF, 0);
-	SPEX(maxpwr_ah, SSB_SPROM2_MAXP_A, SSB_SPROM2_MAXP_A_HI, 0);
-	SPEX(maxpwr_al, SSB_SPROM2_MAXP_A, SSB_SPROM2_MAXP_A_LO,
-	     SSB_SPROM2_MAXP_A_LO_SHIFT);
-}
-
-static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
-{
-	u16 loc[3];
-
-	if (out->revision == 3)			/* rev 3 moved MAC */
-		loc[0] = SSB_SPROM3_IL0MAC;
-	else {
-		loc[0] = SSB_SPROM1_IL0MAC;
-		loc[1] = SSB_SPROM1_ET0MAC;
-		loc[2] = SSB_SPROM1_ET1MAC;
-	}
-
-	SPEX(et0phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0A, 0);
-	SPEX(et1phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1A,
-	     SSB_SPROM1_ETHPHY_ET1A_SHIFT);
-	SPEX(et0mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0M, 14);
-	SPEX(et1mdcport, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1M, 15);
-	SPEX(board_rev, SSB_SPROM1_BINF, SSB_SPROM1_BINF_BREV, 0);
-	SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
-	if (out->revision == 1)
-		SPEX(country_code, SSB_SPROM1_BINF, SSB_SPROM1_BINF_CCODE,
-		     SSB_SPROM1_BINF_CCODE_SHIFT);
-	SPEX(ant_available_a, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTA,
-	     SSB_SPROM1_BINF_ANTA_SHIFT);
-	SPEX(ant_available_bg, SSB_SPROM1_BINF, SSB_SPROM1_BINF_ANTBG,
-	     SSB_SPROM1_BINF_ANTBG_SHIFT);
-	SPEX(pa0b0, SSB_SPROM1_PA0B0, 0xFFFF, 0);
-	SPEX(pa0b1, SSB_SPROM1_PA0B1, 0xFFFF, 0);
-	SPEX(pa0b2, SSB_SPROM1_PA0B2, 0xFFFF, 0);
-	SPEX(pa1b0, SSB_SPROM1_PA1B0, 0xFFFF, 0);
-	SPEX(pa1b1, SSB_SPROM1_PA1B1, 0xFFFF, 0);
-	SPEX(pa1b2, SSB_SPROM1_PA1B2, 0xFFFF, 0);
-	SPEX(gpio0, SSB_SPROM1_GPIOA, SSB_SPROM1_GPIOA_P0, 0);
-	SPEX(gpio1, SSB_SPROM1_GPIOA, SSB_SPROM1_GPIOA_P1,
-	     SSB_SPROM1_GPIOA_P1_SHIFT);
-	SPEX(gpio2, SSB_SPROM1_GPIOB, SSB_SPROM1_GPIOB_P2, 0);
-	SPEX(gpio3, SSB_SPROM1_GPIOB, SSB_SPROM1_GPIOB_P3,
-	     SSB_SPROM1_GPIOB_P3_SHIFT);
-	SPEX(maxpwr_a, SSB_SPROM1_MAXPWR, SSB_SPROM1_MAXPWR_A,
-	     SSB_SPROM1_MAXPWR_A_SHIFT);
-	SPEX(maxpwr_bg, SSB_SPROM1_MAXPWR, SSB_SPROM1_MAXPWR_BG, 0);
-	SPEX(itssi_a, SSB_SPROM1_ITSSI, SSB_SPROM1_ITSSI_A,
-	     SSB_SPROM1_ITSSI_A_SHIFT);
-	SPEX(itssi_bg, SSB_SPROM1_ITSSI, SSB_SPROM1_ITSSI_BG, 0);
-	SPEX(boardflags_lo, SSB_SPROM1_BFLLO, 0xFFFF, 0);
-
-	SPEX(alpha2[0], SSB_SPROM1_CCODE, 0xff00, 8);
-	SPEX(alpha2[1], SSB_SPROM1_CCODE, 0x00ff, 0);
-
-	/* Extract the antenna gain values. */
-	out->antenna_gain.a0 = sprom_extract_antgain(out->revision, in,
-						     SSB_SPROM1_AGAIN,
-						     SSB_SPROM1_AGAIN_BG,
-						     SSB_SPROM1_AGAIN_BG_SHIFT);
-	out->antenna_gain.a1 = sprom_extract_antgain(out->revision, in,
-						     SSB_SPROM1_AGAIN,
-						     SSB_SPROM1_AGAIN_A,
-						     SSB_SPROM1_AGAIN_A_SHIFT);
-	if (out->revision >= 2)
-		sprom_extract_r23(out, in);
-}
-
-/* Revs 4 5 and 8 have partially shared layout */
-static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
-{
-	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01,
-	     SSB_SPROM4_TXPID2G0, SSB_SPROM4_TXPID2G0_SHIFT);
-	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01,
-	     SSB_SPROM4_TXPID2G1, SSB_SPROM4_TXPID2G1_SHIFT);
-	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23,
-	     SSB_SPROM4_TXPID2G2, SSB_SPROM4_TXPID2G2_SHIFT);
-	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23,
-	     SSB_SPROM4_TXPID2G3, SSB_SPROM4_TXPID2G3_SHIFT);
-
-	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01,
-	     SSB_SPROM4_TXPID5GL0, SSB_SPROM4_TXPID5GL0_SHIFT);
-	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01,
-	     SSB_SPROM4_TXPID5GL1, SSB_SPROM4_TXPID5GL1_SHIFT);
-	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23,
-	     SSB_SPROM4_TXPID5GL2, SSB_SPROM4_TXPID5GL2_SHIFT);
-	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23,
-	     SSB_SPROM4_TXPID5GL3, SSB_SPROM4_TXPID5GL3_SHIFT);
-
-	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01,
-	     SSB_SPROM4_TXPID5G0, SSB_SPROM4_TXPID5G0_SHIFT);
-	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01,
-	     SSB_SPROM4_TXPID5G1, SSB_SPROM4_TXPID5G1_SHIFT);
-	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23,
-	     SSB_SPROM4_TXPID5G2, SSB_SPROM4_TXPID5G2_SHIFT);
-	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23,
-	     SSB_SPROM4_TXPID5G3, SSB_SPROM4_TXPID5G3_SHIFT);
-
-	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01,
-	     SSB_SPROM4_TXPID5GH0, SSB_SPROM4_TXPID5GH0_SHIFT);
-	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01,
-	     SSB_SPROM4_TXPID5GH1, SSB_SPROM4_TXPID5GH1_SHIFT);
-	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23,
-	     SSB_SPROM4_TXPID5GH2, SSB_SPROM4_TXPID5GH2_SHIFT);
-	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23,
-	     SSB_SPROM4_TXPID5GH3, SSB_SPROM4_TXPID5GH3_SHIFT);
-}
-
-static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
+static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
 {
 	static const u16 pwr_info_offset[] = {
-		SSB_SPROM4_PWR_INFO_CORE0, SSB_SPROM4_PWR_INFO_CORE1,
-		SSB_SPROM4_PWR_INFO_CORE2, SSB_SPROM4_PWR_INFO_CORE3
+		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
+		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
 	};
+	u16 o;
 	int i;
 
 	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
 		     ARRAY_SIZE(out->core_pwr_info));
 
-	SPEX(et0phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET0A, 0);
-	SPEX(et1phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET1A,
-	     SSB_SPROM4_ETHPHY_ET1A_SHIFT);
-	SPEX(board_rev, SSB_SPROM4_BOARDREV, 0xFFFF, 0);
-	SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
-	if (out->revision == 4) {
-		SPEX(alpha2[0], SSB_SPROM4_CCODE, 0xff00, 8);
-		SPEX(alpha2[1], SSB_SPROM4_CCODE, 0x00ff, 0);
-		SPEX(boardflags_lo, SSB_SPROM4_BFLLO, 0xFFFF, 0);
-		SPEX(boardflags_hi, SSB_SPROM4_BFLHI, 0xFFFF, 0);
-		SPEX(boardflags2_lo, SSB_SPROM4_BFL2LO, 0xFFFF, 0);
-		SPEX(boardflags2_hi, SSB_SPROM4_BFL2HI, 0xFFFF, 0);
-	} else {
-		SPEX(alpha2[0], SSB_SPROM5_CCODE, 0xff00, 8);
-		SPEX(alpha2[1], SSB_SPROM5_CCODE, 0x00ff, 0);
-		SPEX(boardflags_lo, SSB_SPROM5_BFLLO, 0xFFFF, 0);
-		SPEX(boardflags_hi, SSB_SPROM5_BFLHI, 0xFFFF, 0);
-		SPEX(boardflags2_lo, SSB_SPROM5_BFL2LO, 0xFFFF, 0);
-		SPEX(boardflags2_hi, SSB_SPROM5_BFL2HI, 0xFFFF, 0);
-	}
-	SPEX(ant_available_a, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_A,
-	     SSB_SPROM4_ANTAVAIL_A_SHIFT);
-	SPEX(ant_available_bg, SSB_SPROM4_ANTAVAIL, SSB_SPROM4_ANTAVAIL_BG,
-	     SSB_SPROM4_ANTAVAIL_BG_SHIFT);
-	SPEX(maxpwr_bg, SSB_SPROM4_MAXP_BG, SSB_SPROM4_MAXP_BG_MASK, 0);
-	SPEX(itssi_bg, SSB_SPROM4_MAXP_BG, SSB_SPROM4_ITSSI_BG,
-	     SSB_SPROM4_ITSSI_BG_SHIFT);
-	SPEX(maxpwr_a, SSB_SPROM4_MAXP_A, SSB_SPROM4_MAXP_A_MASK, 0);
-	SPEX(itssi_a, SSB_SPROM4_MAXP_A, SSB_SPROM4_ITSSI_A,
-	     SSB_SPROM4_ITSSI_A_SHIFT);
-	if (out->revision == 4) {
-		SPEX(gpio0, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P0, 0);
-		SPEX(gpio1, SSB_SPROM4_GPIOA, SSB_SPROM4_GPIOA_P1,
-		     SSB_SPROM4_GPIOA_P1_SHIFT);
-		SPEX(gpio2, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P2, 0);
-		SPEX(gpio3, SSB_SPROM4_GPIOB, SSB_SPROM4_GPIOB_P3,
-		     SSB_SPROM4_GPIOB_P3_SHIFT);
-	} else {
-		SPEX(gpio0, SSB_SPROM5_GPIOA, SSB_SPROM5_GPIOA_P0, 0);
-		SPEX(gpio1, SSB_SPROM5_GPIOA, SSB_SPROM5_GPIOA_P1,
-		     SSB_SPROM5_GPIOA_P1_SHIFT);
-		SPEX(gpio2, SSB_SPROM5_GPIOB, SSB_SPROM5_GPIOB_P2, 0);
-		SPEX(gpio3, SSB_SPROM5_GPIOB, SSB_SPROM5_GPIOB_P3,
-		     SSB_SPROM5_GPIOB_P3_SHIFT);
-	}
+	SPEX(board_rev, SSB_SPROM8_BOARDREV, ~0, 0);
+	SPEX(board_type, SSB_SPROM1_SPID, ~0, 0);
 
-	/* Extract the antenna gain values. */
-	out->antenna_gain.a0 = sprom_extract_antgain(out->revision, in,
-						     SSB_SPROM4_AGAIN01,
-						     SSB_SPROM4_AGAIN0,
-						     SSB_SPROM4_AGAIN0_SHIFT);
-	out->antenna_gain.a1 = sprom_extract_antgain(out->revision, in,
-						     SSB_SPROM4_AGAIN01,
-						     SSB_SPROM4_AGAIN1,
-						     SSB_SPROM4_AGAIN1_SHIFT);
-	out->antenna_gain.a2 = sprom_extract_antgain(out->revision, in,
-						     SSB_SPROM4_AGAIN23,
-						     SSB_SPROM4_AGAIN2,
-						     SSB_SPROM4_AGAIN2_SHIFT);
-	out->antenna_gain.a3 = sprom_extract_antgain(out->revision, in,
-						     SSB_SPROM4_AGAIN23,
-						     SSB_SPROM4_AGAIN3,
-						     SSB_SPROM4_AGAIN3_SHIFT);
+	SPEX(txpid2g[0], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G0,
+	     SSB_SPROM4_TXPID2G0_SHIFT);
+	SPEX(txpid2g[1], SSB_SPROM4_TXPID2G01, SSB_SPROM4_TXPID2G1,
+	     SSB_SPROM4_TXPID2G1_SHIFT);
+	SPEX(txpid2g[2], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G2,
+	     SSB_SPROM4_TXPID2G2_SHIFT);
+	SPEX(txpid2g[3], SSB_SPROM4_TXPID2G23, SSB_SPROM4_TXPID2G3,
+	     SSB_SPROM4_TXPID2G3_SHIFT);
 
-	/* Extract cores power info info */
-	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
-		u16 o = pwr_info_offset[i];
+	SPEX(txpid5gl[0], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL0,
+	     SSB_SPROM4_TXPID5GL0_SHIFT);
+	SPEX(txpid5gl[1], SSB_SPROM4_TXPID5GL01, SSB_SPROM4_TXPID5GL1,
+	     SSB_SPROM4_TXPID5GL1_SHIFT);
+	SPEX(txpid5gl[2], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL2,
+	     SSB_SPROM4_TXPID5GL2_SHIFT);
+	SPEX(txpid5gl[3], SSB_SPROM4_TXPID5GL23, SSB_SPROM4_TXPID5GL3,
+	     SSB_SPROM4_TXPID5GL3_SHIFT);
 
-		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SPROM4_2G_MAXP_ITSSI,
-			SSB_SPROM4_2G_ITSSI, SSB_SPROM4_2G_ITSSI_SHIFT);
-		SPEX(core_pwr_info[i].maxpwr_2g, o + SSB_SPROM4_2G_MAXP_ITSSI,
-			SSB_SPROM4_2G_MAXP, 0);
+	SPEX(txpid5g[0], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G0,
+	     SSB_SPROM4_TXPID5G0_SHIFT);
+	SPEX(txpid5g[1], SSB_SPROM4_TXPID5G01, SSB_SPROM4_TXPID5G1,
+	     SSB_SPROM4_TXPID5G1_SHIFT);
+	SPEX(txpid5g[2], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G2,
+	     SSB_SPROM4_TXPID5G2_SHIFT);
+	SPEX(txpid5g[3], SSB_SPROM4_TXPID5G23, SSB_SPROM4_TXPID5G3,
+	     SSB_SPROM4_TXPID5G3_SHIFT);
 
-		SPEX(core_pwr_info[i].pa_2g[0], o + SSB_SPROM4_2G_PA_0, ~0, 0);
-		SPEX(core_pwr_info[i].pa_2g[1], o + SSB_SPROM4_2G_PA_1, ~0, 0);
-		SPEX(core_pwr_info[i].pa_2g[2], o + SSB_SPROM4_2G_PA_2, ~0, 0);
-		SPEX(core_pwr_info[i].pa_2g[3], o + SSB_SPROM4_2G_PA_3, ~0, 0);
+	SPEX(txpid5gh[0], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH0,
+	     SSB_SPROM4_TXPID5GH0_SHIFT);
+	SPEX(txpid5gh[1], SSB_SPROM4_TXPID5GH01, SSB_SPROM4_TXPID5GH1,
+	     SSB_SPROM4_TXPID5GH1_SHIFT);
+	SPEX(txpid5gh[2], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH2,
+	     SSB_SPROM4_TXPID5GH2_SHIFT);
+	SPEX(txpid5gh[3], SSB_SPROM4_TXPID5GH23, SSB_SPROM4_TXPID5GH3,
+	     SSB_SPROM4_TXPID5GH3_SHIFT);
 
-		SPEX(core_pwr_info[i].itssi_5g, o + SSB_SPROM4_5G_MAXP_ITSSI,
-			SSB_SPROM4_5G_ITSSI, SSB_SPROM4_5G_ITSSI_SHIFT);
-		SPEX(core_pwr_info[i].maxpwr_5g, o + SSB_SPROM4_5G_MAXP_ITSSI,
-			SSB_SPROM4_5G_MAXP, 0);
-		SPEX(core_pwr_info[i].maxpwr_5gh, o + SSB_SPROM4_5GHL_MAXP,
-			SSB_SPROM4_5GH_MAXP, 0);
-		SPEX(core_pwr_info[i].maxpwr_5gl, o + SSB_SPROM4_5GHL_MAXP,
-			SSB_SPROM4_5GL_MAXP, SSB_SPROM4_5GL_MAXP_SHIFT);
+	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, ~0, 0);
+	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, ~0, 0);
+	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, ~0, 0);
+	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, ~0, 0);
 
-		SPEX(core_pwr_info[i].pa_5gl[0], o + SSB_SPROM4_5GL_PA_0, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5gl[1], o + SSB_SPROM4_5GL_PA_1, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5gl[2], o + SSB_SPROM4_5GL_PA_2, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5gl[3], o + SSB_SPROM4_5GL_PA_3, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5g[0], o + SSB_SPROM4_5G_PA_0, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5g[1], o + SSB_SPROM4_5G_PA_1, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5g[2], o + SSB_SPROM4_5G_PA_2, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5g[3], o + SSB_SPROM4_5G_PA_3, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5gh[0], o + SSB_SPROM4_5GH_PA_0, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5gh[1], o + SSB_SPROM4_5GH_PA_1, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SPROM4_5GH_PA_2, ~0, 0);
-		SPEX(core_pwr_info[i].pa_5gh[3], o + SSB_SPROM4_5GH_PA_3, ~0, 0);
-	}
-
-	sprom_extract_r458(out, in);
-
-	/* TODO - get remaining rev 4 stuff needed */
-}
-
-static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
-{
-	int i;
-	u16 o;
-	static const u16 pwr_info_offset[] = {
-		SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
-		SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
-	};
-	BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
-			ARRAY_SIZE(out->core_pwr_info));
-
-	SPEX(board_rev, SSB_SPROM8_BOARDREV, 0xFFFF, 0);
-	SPEX(board_type, SSB_SPROM1_SPID, 0xFFFF, 0);
 	SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
 	SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
-	SPEX(boardflags_lo, SSB_SPROM8_BFLLO, 0xFFFF, 0);
-	SPEX(boardflags_hi, SSB_SPROM8_BFLHI, 0xFFFF, 0);
-	SPEX(boardflags2_lo, SSB_SPROM8_BFL2LO, 0xFFFF, 0);
-	SPEX(boardflags2_hi, SSB_SPROM8_BFL2HI, 0xFFFF, 0);
-	SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
-	     SSB_SPROM8_ANTAVAIL_A_SHIFT);
-	SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
-	     SSB_SPROM8_ANTAVAIL_BG_SHIFT);
-	SPEX(maxpwr_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_MAXP_BG_MASK, 0);
-	SPEX(itssi_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_ITSSI_BG,
-	     SSB_SPROM8_ITSSI_BG_SHIFT);
-	SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
-	SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
-	     SSB_SPROM8_ITSSI_A_SHIFT);
-	SPEX(maxpwr_ah, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AH_MASK, 0);
-	SPEX(maxpwr_al, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AL_MASK,
-	     SSB_SPROM8_MAXP_AL_SHIFT);
-	SPEX(gpio0, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P0, 0);
-	SPEX(gpio1, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P1,
-	     SSB_SPROM8_GPIOA_P1_SHIFT);
-	SPEX(gpio2, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P2, 0);
-	SPEX(gpio3, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P3,
-	     SSB_SPROM8_GPIOB_P3_SHIFT);
-	SPEX(tri2g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI2G, 0);
-	SPEX(tri5g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI5G,
-	     SSB_SPROM8_TRI5G_SHIFT);
-	SPEX(tri5gl, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GL, 0);
-	SPEX(tri5gh, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GH,
-	     SSB_SPROM8_TRI5GH_SHIFT);
-	SPEX(rxpo2g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO2G, 0);
-	SPEX(rxpo5g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO5G,
-	     SSB_SPROM8_RXPO5G_SHIFT);
-	SPEX(rssismf2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMF2G, 0);
-	SPEX(rssismc2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMC2G,
-	     SSB_SPROM8_RSSISMC2G_SHIFT);
-	SPEX(rssisav2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISAV2G,
-	     SSB_SPROM8_RSSISAV2G_SHIFT);
-	SPEX(bxa2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_BXA2G,
-	     SSB_SPROM8_BXA2G_SHIFT);
-	SPEX(rssismf5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMF5G, 0);
-	SPEX(rssismc5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMC5G,
-	     SSB_SPROM8_RSSISMC5G_SHIFT);
-	SPEX(rssisav5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISAV5G,
-	     SSB_SPROM8_RSSISAV5G_SHIFT);
-	SPEX(bxa5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_BXA5G,
-	     SSB_SPROM8_BXA5G_SHIFT);
-	SPEX(pa0b0, SSB_SPROM8_PA0B0, 0xFFFF, 0);
-	SPEX(pa0b1, SSB_SPROM8_PA0B1, 0xFFFF, 0);
-	SPEX(pa0b2, SSB_SPROM8_PA0B2, 0xFFFF, 0);
-	SPEX(pa1b0, SSB_SPROM8_PA1B0, 0xFFFF, 0);
-	SPEX(pa1b1, SSB_SPROM8_PA1B1, 0xFFFF, 0);
-	SPEX(pa1b2, SSB_SPROM8_PA1B2, 0xFFFF, 0);
-	SPEX(pa1lob0, SSB_SPROM8_PA1LOB0, 0xFFFF, 0);
-	SPEX(pa1lob1, SSB_SPROM8_PA1LOB1, 0xFFFF, 0);
-	SPEX(pa1lob2, SSB_SPROM8_PA1LOB2, 0xFFFF, 0);
-	SPEX(pa1hib0, SSB_SPROM8_PA1HIB0, 0xFFFF, 0);
-	SPEX(pa1hib1, SSB_SPROM8_PA1HIB1, 0xFFFF, 0);
-	SPEX(pa1hib2, SSB_SPROM8_PA1HIB2, 0xFFFF, 0);
-	SPEX(cck2gpo, SSB_SPROM8_CCK2GPO, 0xFFFF, 0);
-	SPEX32(ofdm2gpo, SSB_SPROM8_OFDM2GPO, 0xFFFFFFFF, 0);
-	SPEX32(ofdm5glpo, SSB_SPROM8_OFDM5GLPO, 0xFFFFFFFF, 0);
-	SPEX32(ofdm5gpo, SSB_SPROM8_OFDM5GPO, 0xFFFFFFFF, 0);
-	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, 0xFFFFFFFF, 0);
 
-	/* Extract the antenna gain values. */
-	out->antenna_gain.a0 = sprom_extract_antgain(out->revision, in,
-						     SSB_SPROM8_AGAIN01,
-						     SSB_SPROM8_AGAIN0,
-						     SSB_SPROM8_AGAIN0_SHIFT);
-	out->antenna_gain.a1 = sprom_extract_antgain(out->revision, in,
-						     SSB_SPROM8_AGAIN01,
-						     SSB_SPROM8_AGAIN1,
-						     SSB_SPROM8_AGAIN1_SHIFT);
-	out->antenna_gain.a2 = sprom_extract_antgain(out->revision, in,
-						     SSB_SPROM8_AGAIN23,
-						     SSB_SPROM8_AGAIN2,
-						     SSB_SPROM8_AGAIN2_SHIFT);
-	out->antenna_gain.a3 = sprom_extract_antgain(out->revision, in,
-						     SSB_SPROM8_AGAIN23,
-						     SSB_SPROM8_AGAIN3,
-						     SSB_SPROM8_AGAIN3_SHIFT);
-
-	/* Extract cores power info info */
+	/* Extract core's power info */
 	for (i = 0; i < ARRAY_SIZE(pwr_info_offset); i++) {
 		o = pwr_info_offset[i];
 		SPEX(core_pwr_info[i].itssi_2g, o + SSB_SROM8_2G_MAXP_ITSSI,
@@ -465,28 +192,107 @@ static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
 		SPEX(core_pwr_info[i].pa_5gh[2], o + SSB_SROM8_5GH_PA_2, ~0, 0);
 	}
 
-	/* Extract FEM info */
-	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G,
-		SSB_SROM8_FEM_TSSIPOS, SSB_SROM8_FEM_TSSIPOS_SHIFT);
-	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G,
-		SSB_SROM8_FEM_EXTPA_GAIN, SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
-	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G,
-		SSB_SROM8_FEM_PDET_RANGE, SSB_SROM8_FEM_PDET_RANGE_SHIFT);
-	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G,
-		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
-	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G,
-		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+	SPEX(fem.ghz2.tssipos, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TSSIPOS,
+	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
+	SPEX(fem.ghz2.extpa_gain, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_EXTPA_GAIN,
+	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
+	SPEX(fem.ghz2.pdet_range, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_PDET_RANGE,
+	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
+	SPEX(fem.ghz2.tr_iso, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_TR_ISO,
+	     SSB_SROM8_FEM_TR_ISO_SHIFT);
+	SPEX(fem.ghz2.antswlut, SSB_SPROM8_FEM2G, SSB_SROM8_FEM_ANTSWLUT,
+	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
 
-	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G,
-		SSB_SROM8_FEM_TSSIPOS, SSB_SROM8_FEM_TSSIPOS_SHIFT);
-	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G,
-		SSB_SROM8_FEM_EXTPA_GAIN, SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
-	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G,
-		SSB_SROM8_FEM_PDET_RANGE, SSB_SROM8_FEM_PDET_RANGE_SHIFT);
-	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G,
-		SSB_SROM8_FEM_TR_ISO, SSB_SROM8_FEM_TR_ISO_SHIFT);
-	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G,
-		SSB_SROM8_FEM_ANTSWLUT, SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+	SPEX(fem.ghz5.tssipos, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TSSIPOS,
+	     SSB_SROM8_FEM_TSSIPOS_SHIFT);
+	SPEX(fem.ghz5.extpa_gain, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_EXTPA_GAIN,
+	     SSB_SROM8_FEM_EXTPA_GAIN_SHIFT);
+	SPEX(fem.ghz5.pdet_range, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_PDET_RANGE,
+	     SSB_SROM8_FEM_PDET_RANGE_SHIFT);
+	SPEX(fem.ghz5.tr_iso, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_TR_ISO,
+	     SSB_SROM8_FEM_TR_ISO_SHIFT);
+	SPEX(fem.ghz5.antswlut, SSB_SPROM8_FEM5G, SSB_SROM8_FEM_ANTSWLUT,
+	     SSB_SROM8_FEM_ANTSWLUT_SHIFT);
+
+	SPEX(ant_available_a, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_A,
+	     SSB_SPROM8_ANTAVAIL_A_SHIFT);
+	SPEX(ant_available_bg, SSB_SPROM8_ANTAVAIL, SSB_SPROM8_ANTAVAIL_BG,
+	     SSB_SPROM8_ANTAVAIL_BG_SHIFT);
+	SPEX(maxpwr_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_MAXP_BG_MASK, 0);
+	SPEX(itssi_bg, SSB_SPROM8_MAXP_BG, SSB_SPROM8_ITSSI_BG,
+	     SSB_SPROM8_ITSSI_BG_SHIFT);
+	SPEX(maxpwr_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_MAXP_A_MASK, 0);
+	SPEX(itssi_a, SSB_SPROM8_MAXP_A, SSB_SPROM8_ITSSI_A,
+	     SSB_SPROM8_ITSSI_A_SHIFT);
+	SPEX(maxpwr_ah, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AH_MASK, 0);
+	SPEX(maxpwr_al, SSB_SPROM8_MAXP_AHL, SSB_SPROM8_MAXP_AL_MASK,
+	     SSB_SPROM8_MAXP_AL_SHIFT);
+	SPEX(gpio0, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P0, 0);
+	SPEX(gpio1, SSB_SPROM8_GPIOA, SSB_SPROM8_GPIOA_P1,
+	     SSB_SPROM8_GPIOA_P1_SHIFT);
+	SPEX(gpio2, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P2, 0);
+	SPEX(gpio3, SSB_SPROM8_GPIOB, SSB_SPROM8_GPIOB_P3,
+	     SSB_SPROM8_GPIOB_P3_SHIFT);
+	SPEX(tri2g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI2G, 0);
+	SPEX(tri5g, SSB_SPROM8_TRI25G, SSB_SPROM8_TRI5G,
+	     SSB_SPROM8_TRI5G_SHIFT);
+	SPEX(tri5gl, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GL, 0);
+	SPEX(tri5gh, SSB_SPROM8_TRI5GHL, SSB_SPROM8_TRI5GH,
+	     SSB_SPROM8_TRI5GH_SHIFT);
+	SPEX(rxpo2g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO2G,
+	     SSB_SPROM8_RXPO2G_SHIFT);
+	SPEX(rxpo5g, SSB_SPROM8_RXPO, SSB_SPROM8_RXPO5G,
+	     SSB_SPROM8_RXPO5G_SHIFT);
+	SPEX(rssismf2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMF2G, 0);
+	SPEX(rssismc2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISMC2G,
+	     SSB_SPROM8_RSSISMC2G_SHIFT);
+	SPEX(rssisav2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_RSSISAV2G,
+	     SSB_SPROM8_RSSISAV2G_SHIFT);
+	SPEX(bxa2g, SSB_SPROM8_RSSIPARM2G, SSB_SPROM8_BXA2G,
+	     SSB_SPROM8_BXA2G_SHIFT);
+	SPEX(rssismf5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMF5G, 0);
+	SPEX(rssismc5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISMC5G,
+	     SSB_SPROM8_RSSISMC5G_SHIFT);
+	SPEX(rssisav5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_RSSISAV5G,
+	     SSB_SPROM8_RSSISAV5G_SHIFT);
+	SPEX(bxa5g, SSB_SPROM8_RSSIPARM5G, SSB_SPROM8_BXA5G,
+	     SSB_SPROM8_BXA5G_SHIFT);
+
+	SPEX(pa0b0, SSB_SPROM8_PA0B0, ~0, 0);
+	SPEX(pa0b1, SSB_SPROM8_PA0B1, ~0, 0);
+	SPEX(pa0b2, SSB_SPROM8_PA0B2, ~0, 0);
+	SPEX(pa1b0, SSB_SPROM8_PA1B0, ~0, 0);
+	SPEX(pa1b1, SSB_SPROM8_PA1B1, ~0, 0);
+	SPEX(pa1b2, SSB_SPROM8_PA1B2, ~0, 0);
+	SPEX(pa1lob0, SSB_SPROM8_PA1LOB0, ~0, 0);
+	SPEX(pa1lob1, SSB_SPROM8_PA1LOB1, ~0, 0);
+	SPEX(pa1lob2, SSB_SPROM8_PA1LOB2, ~0, 0);
+	SPEX(pa1hib0, SSB_SPROM8_PA1HIB0, ~0, 0);
+	SPEX(pa1hib1, SSB_SPROM8_PA1HIB1, ~0, 0);
+	SPEX(pa1hib2, SSB_SPROM8_PA1HIB2, ~0, 0);
+	SPEX(cck2gpo, SSB_SPROM8_CCK2GPO, ~0, 0);
+	SPEX32(ofdm2gpo, SSB_SPROM8_OFDM2GPO, ~0, 0);
+	SPEX32(ofdm5glpo, SSB_SPROM8_OFDM5GLPO, ~0, 0);
+	SPEX32(ofdm5gpo, SSB_SPROM8_OFDM5GPO, ~0, 0);
+	SPEX32(ofdm5ghpo, SSB_SPROM8_OFDM5GHPO, ~0, 0);
+
+	/* Extract the antenna gain values. */
+	out->antenna_gain.a0 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN01,
+						     SSB_SPROM8_AGAIN0,
+						     SSB_SPROM8_AGAIN0_SHIFT);
+	out->antenna_gain.a1 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN01,
+						     SSB_SPROM8_AGAIN1,
+						     SSB_SPROM8_AGAIN1_SHIFT);
+	out->antenna_gain.a2 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN23,
+						     SSB_SPROM8_AGAIN2,
+						     SSB_SPROM8_AGAIN2_SHIFT);
+	out->antenna_gain.a3 = sprom_extract_antgain(in,
+						     SSB_SPROM8_AGAIN23,
+						     SSB_SPROM8_AGAIN3,
+						     SSB_SPROM8_AGAIN3_SHIFT);
 
 	SPEX(leddc_on_time, SSB_SPROM8_LEDDC, SSB_SPROM8_LEDDC_ON,
 	     SSB_SPROM8_LEDDC_ON_SHIFT);
@@ -545,9 +351,6 @@ static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
 	SPEX(temps_hysteresis, SSB_SPROM8_TEMPDELTA,
 	     SSB_SPROM8_TEMPDELTA_HYSTERESIS,
 	     SSB_SPROM8_TEMPDELTA_HYSTERESIS_SHIFT);
-	sprom_extract_r458(out, in);
-
-	/* TODO - get remaining rev 8 stuff needed */
 }
 
 static int sprom_extract(struct bcma_fbs *priv, const u16 *in, u16 size)
@@ -557,35 +360,15 @@ static int sprom_extract(struct bcma_fbs *priv, const u16 *in, u16 size)
 	memset(out, 0, sizeof(*out));
 
 	out->revision = in[size - 1] & 0x00FF;
-	memset(out->et0mac, 0xFF, 6);
-	memset(out->et1mac, 0xFF, 6);
-
-	switch (out->revision) {
-	case 1:
-	case 2:
-	case 3:
-		sprom_extract_r123(out, in);
-		break;
-	case 4:
-	case 5:
-		sprom_extract_r45(out, in);
-		break;
-	case 8:
-		sprom_extract_r8(out, in);
-		break;
-	default:
+	if (out->revision < 8 || out->revision > 11) {
 		dev_warn(priv->dev,
 			 "Unsupported SPROM revision %d detected."
-			 " Will extract v1\n",
+			 " Will extract v8\n",
 			 out->revision);
-		out->revision = 1;
-		sprom_extract_r123(out, in);
+		out->revision = 8;
 	}
 
-	if (out->boardflags_lo == 0xFFFF)
-		out->boardflags_lo = 0;  /* per specs */
-	if (out->boardflags_hi == 0xFFFF)
-		out->boardflags_hi = 0;  /* per specs */
+	sprom_extract_r8(out, in);
 
 	return 0;
 }
@@ -624,8 +407,8 @@ static void bcma_fbs_fixup(struct bcma_fbs *priv, u16 *sprom)
 	}
 }
 
-static int sprom_override_devid(struct bcma_fbs *priv, struct ssb_sprom *out,
-				const u16 *in)
+static bool sprom_override_devid(struct bcma_fbs *priv, struct ssb_sprom *out,
+				 const u16 *in)
 {
 	SPEX(dev_id, 0x0060, 0xFFFF, 0);
 	return !!out->dev_id;
@@ -668,7 +451,7 @@ static void bcma_fbs_set(struct bcma_fbs *priv, struct device_node *node)
 		sprom->itssi_bg = 0x00;
 		sprom->boardflags_lo = 0x2848;
 		sprom->boardflags_hi = 0x0000;
-		priv->devid_override = 0;
+		priv->devid_override = false;
 
 		dev_warn(priv->dev, "using basic SPROM\n");
 	} else {
@@ -694,6 +477,7 @@ static int bcma_fbs_probe(struct platform_device *pdev)
 	struct device_node *node = dev->of_node;
 	struct bcma_fbs *priv;
 	unsigned long flags;
+	u8 mac[ETH_ALEN];
 
 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
@@ -706,18 +490,18 @@ static int bcma_fbs_probe(struct platform_device *pdev)
 	of_property_read_u32(node, "pci-bus", &priv->pci_bus);
 	of_property_read_u32(node, "pci-dev", &priv->pci_dev);
 
-	of_get_mac_address(node, priv->mac);
-	if (is_valid_ether_addr(priv->mac)) {
-		dev_info(dev, "mtd mac %pM\n", priv->mac);
+	of_get_mac_address(node, mac);
+	if (is_valid_ether_addr(mac)) {
+		dev_info(dev, "mtd mac %pM\n", mac);
 	} else {
-		random_ether_addr(priv->mac);
-		dev_info(dev, "random mac %pM\n", priv->mac);
+		random_ether_addr(mac);
+		dev_info(dev, "random mac %pM\n", mac);
 	}
 
-	memcpy(priv->sprom.il0mac, priv->mac, ETH_ALEN);
- 	memcpy(priv->sprom.et0mac, priv->mac, ETH_ALEN);
- 	memcpy(priv->sprom.et1mac, priv->mac, ETH_ALEN);
-	memcpy(priv->sprom.et2mac, priv->mac, ETH_ALEN);
+	memcpy(priv->sprom.il0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et1mac, mac, ETH_ALEN);
+	memcpy(priv->sprom.et2mac, mac, ETH_ALEN);
 
 	spin_lock_irqsave(&bcma_fbs_lock, flags);
 	list_add(&priv->list, &bcma_fbs_list);
diff --git a/target/linux/generic/files/drivers/ssb/fallback-sprom.c b/target/linux/generic/files/drivers/ssb/fallback-sprom.c
index 93001d20d7a..26f0fd2f036 100644
--- a/target/linux/generic/files/drivers/ssb/fallback-sprom.c
+++ b/target/linux/generic/files/drivers/ssb/fallback-sprom.c
@@ -48,8 +48,7 @@ struct ssb_fbs {
 	struct ssb_sprom sprom;
 	u32 pci_bus;
 	u32 pci_dev;
-	u8 mac[ETH_ALEN];
-	int devid_override;
+	bool devid_override;
 };
 
 static DEFINE_SPINLOCK(ssb_fbs_lock);
@@ -57,9 +56,14 @@ static struct list_head ssb_fbs_list = LIST_HEAD_INIT(ssb_fbs_list);
 
 int ssb_get_fallback_sprom(struct ssb_bus *bus, struct ssb_sprom *out)
 {
-	const u32 pci_bus = bus->host_pci->bus->number;
-	const u32 pci_dev = PCI_SLOT(bus->host_pci->devfn);
 	struct ssb_fbs *pos;
+	u32 pci_bus, pci_dev;
+
+	if (bus->bustype != SSB_BUSTYPE_PCI)
+		return -ENOENT;
+
+	pci_bus = bus->host_pci->bus->number;
+	pci_dev = PCI_SLOT(bus->host_pci->devfn);
 
 	list_for_each_entry(pos, &ssb_fbs_list, list) {
 		if (pos->pci_bus != pci_bus ||
@@ -119,16 +123,6 @@ static void sprom_extract_r23(struct ssb_sprom *out, const u16 *in)
 
 static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
 {
-	u16 loc[3];
-
-	if (out->revision == 3)			/* rev 3 moved MAC */
-		loc[0] = SSB_SPROM3_IL0MAC;
-	else {
-		loc[0] = SSB_SPROM1_IL0MAC;
-		loc[1] = SSB_SPROM1_ET0MAC;
-		loc[2] = SSB_SPROM1_ET1MAC;
-	}
-
 	SPEX(et0phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0A, 0);
 	SPEX(et1phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1A,
 	     SSB_SPROM1_ETHPHY_ET1A_SHIFT);
@@ -557,8 +551,6 @@ static int sprom_extract(struct ssb_fbs *priv, const u16 *in, u16 size)
 	memset(out, 0, sizeof(*out));
 
 	out->revision = in[size - 1] & 0x00FF;
-	memset(out->et0mac, 0xFF, 6);
-	memset(out->et1mac, 0xFF, 6);
 
 	switch (out->revision) {
 	case 1:
@@ -624,8 +616,8 @@ static void ssb_fbs_fixup(struct ssb_fbs *priv, u16 *sprom)
 	}
 }
 
-static int sprom_override_devid(struct ssb_fbs *priv, struct ssb_sprom *out,
-				const u16 *in)
+static bool sprom_override_devid(struct ssb_fbs *priv, struct ssb_sprom *out,
+				 const u16 *in)
 {
 	SPEX(dev_id, SSB_SPROM1_PID, 0xFFFF, 0);
 	return !!out->dev_id;
@@ -668,7 +660,7 @@ static int ssb_fbs_set(struct ssb_fbs *priv, struct device_node *node)
 		sprom->itssi_bg = 0x00;
 		sprom->boardflags_lo = 0x2848;
 		sprom->boardflags_hi = 0x0000;
-		priv->devid_override = 0;
+		priv->devid_override = false;
 
 		dev_warn(priv->dev, "using basic SPROM\n");
 	} else {
@@ -696,6 +688,7 @@ static int ssb_fbs_probe(struct platform_device *pdev)
 	struct device_node *node = dev->of_node;
 	struct ssb_fbs *priv;
 	unsigned long flags;
+	u8 mac[ETH_ALEN];
 
 	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
 	if (!priv)
@@ -708,18 +701,18 @@ static int ssb_fbs_probe(struct platform_device *pdev)
 	of_property_read_u32(node, "pci-bus", &priv->pci_bus);
 	of_property_read_u32(node, "pci-dev", &priv->pci_dev);
 
-	of_get_mac_address(node, priv->mac);
-	if (is_valid_ether_addr(priv->mac)) {
-		dev_info(dev, "mtd mac %pM\n", priv->mac);
+	of_get_mac_address(node, mac);
+	if (is_valid_ether_addr(mac)) {
+		dev_info(dev, "mtd mac %pM\n", mac);
 	} else {
-		random_ether_addr(priv->mac);
-		dev_info(dev, "random mac %pM\n", priv->mac);
+		random_ether_addr(mac);
+		dev_info(dev, "random mac %pM\n", mac);
 	}
 
-	memcpy(priv->sprom.il0mac, priv->mac, ETH_ALEN);
- 	memcpy(priv->sprom.et0mac, priv->mac, ETH_ALEN);
- 	memcpy(priv->sprom.et1mac, priv->mac, ETH_ALEN);
-	memcpy(priv->sprom.et2mac, priv->mac, ETH_ALEN);
+	memcpy(priv->sprom.il0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et0mac, mac, ETH_ALEN);
+ 	memcpy(priv->sprom.et1mac, mac, ETH_ALEN);
+	memcpy(priv->sprom.et2mac, mac, ETH_ALEN);
 
 	spin_lock_irqsave(&ssb_fbs_lock, flags);
 	list_add(&priv->list, &ssb_fbs_list);
diff --git a/target/linux/generic/pending-5.15/726-net-phy-realtek-make-sure-paged-read-is-protected-by.patch b/target/linux/generic/pending-5.15/726-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
new file mode 100644
index 00000000000..31f0622327b
--- /dev/null
+++ b/target/linux/generic/pending-5.15/726-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
@@ -0,0 +1,35 @@
+From 4dd2cc9b91ecb25f278a2c55e07e6455e9000e6b Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 01:21:14 +0100
+Subject: [PATCH] net: phy: realtek: make sure paged read is protected by mutex
+
+As we cannot rely on phy_read_paged function before the PHY is
+identified, the paged read in rtlgen_supports_2_5gbps needs to be open
+coded as it is being called by the match_phy_device function, ie. before
+.read_page and .write_page have been populated.
+
+Make sure it is also protected by the MDIO bus mutex and use
+rtl821x_write_page instead of 3 individually locked MDIO bus operations.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -727,9 +727,11 @@ static bool rtlgen_supports_2_5gbps(stru
+ {
+ 	int val;
+ 
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0xa61);
+-	val = phy_read(phydev, 0x13);
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0);
++	mutex_lock(&phydev->mdio.bus->mdio_lock);
++	rtl821x_write_page(phydev, 0xa61);
++	val = __phy_read(phydev, 0x13);
++	rtl821x_write_page(phydev, 0);
++	mutex_unlock(&phydev->mdio.bus->mdio_lock);
+ 
+ 	return val >= 0 && val & RTL_SUPPORTS_2500FULL;
+ }
diff --git a/target/linux/generic/pending-5.15/726-net-phy-realtek-use-phy_read_paged-instead-of-open-c.patch b/target/linux/generic/pending-5.15/726-net-phy-realtek-use-phy_read_paged-instead-of-open-c.patch
deleted file mode 100644
index 250436ff393..00000000000
--- a/target/linux/generic/pending-5.15/726-net-phy-realtek-use-phy_read_paged-instead-of-open-c.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 934cdd67e7cf71f97a2a8aea2892e540af47dcdf Mon Sep 17 00:00:00 2001
-From: Daniel Golle <daniel@makrotopia.org>
-Date: Sat, 22 Apr 2023 01:21:14 +0100
-Subject: [PATCH 1/3] net: phy: realtek: use phy_read_paged instead of open
- coding
-
-Instead of open coding a paged read, use the phy_read_paged function
-in rtlgen_supports_2_5gbps.
-
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
----
- drivers/net/phy/realtek.c | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
---- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -727,9 +727,7 @@ static bool rtlgen_supports_2_5gbps(stru
- {
- 	int val;
- 
--	phy_write(phydev, RTL821x_PAGE_SELECT, 0xa61);
--	val = phy_read(phydev, 0x13);
--	phy_write(phydev, RTL821x_PAGE_SELECT, 0);
-+	val = phy_read_paged(phydev, 0xa61, 0x13);
- 
- 	return val >= 0 && val & RTL_SUPPORTS_2500FULL;
- }
diff --git a/target/linux/generic/pending-5.15/729-net-phy-realtek-introduce-rtl822x_probe.patch b/target/linux/generic/pending-5.15/729-net-phy-realtek-introduce-rtl822x_probe.patch
index 4496d6cedf9..87102d38187 100644
--- a/target/linux/generic/pending-5.15/729-net-phy-realtek-introduce-rtl822x_probe.patch
+++ b/target/linux/generic/pending-5.15/729-net-phy-realtek-introduce-rtl822x_probe.patch
@@ -24,7 +24,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  #define RTL8366RB_POWER_SAVE			0x15
  #define RTL8366RB_POWER_SAVE_ON			BIT(12)
  
-@@ -736,6 +740,25 @@ static int rtl8226_match_phy_device(stru
+@@ -740,6 +744,25 @@ static int rtl8226_match_phy_device(stru
  	       rtlgen_supports_2_5gbps(phydev);
  }
  
@@ -50,7 +50,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  static int rtlgen_resume(struct phy_device *phydev)
  {
  	int ret = genphy_resume(phydev);
-@@ -1009,6 +1032,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1013,6 +1036,7 @@ static struct phy_driver realtek_drvs[]
  		.match_phy_device = rtl8226_match_phy_device,
  		.get_features	= rtl822x_get_features,
  		.config_aneg	= rtl822x_config_aneg,
@@ -58,7 +58,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		.read_status	= rtl822x_read_status,
  		.suspend	= genphy_suspend,
  		.resume		= rtlgen_resume,
-@@ -1022,6 +1046,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1026,6 +1050,7 @@ static struct phy_driver realtek_drvs[]
  		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
  		.get_features	= rtl822x_get_features,
  		.config_aneg	= rtl822x_config_aneg,
@@ -66,7 +66,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		.read_status	= rtl822x_read_status,
  		.suspend	= genphy_suspend,
  		.resume		= rtlgen_resume,
-@@ -1035,6 +1060,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1039,6 +1064,7 @@ static struct phy_driver realtek_drvs[]
  		.name           = "RTL8226-CG 2.5Gbps PHY",
  		.get_features   = rtl822x_get_features,
  		.config_aneg    = rtl822x_config_aneg,
@@ -74,7 +74,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		.read_status    = rtl822x_read_status,
  		.suspend        = genphy_suspend,
  		.resume         = rtlgen_resume,
-@@ -1046,6 +1072,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1050,6 +1076,7 @@ static struct phy_driver realtek_drvs[]
  		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
  		.get_features   = rtl822x_get_features,
  		.config_aneg    = rtl822x_config_aneg,
@@ -82,7 +82,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		.read_status    = rtl822x_read_status,
  		.suspend        = genphy_suspend,
  		.resume         = rtlgen_resume,
-@@ -1058,6 +1085,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1062,6 +1089,7 @@ static struct phy_driver realtek_drvs[]
  		.get_features   = rtl822x_get_features,
  		.config_init    = rtl8221b_config_init,
  		.config_aneg    = rtl822x_config_aneg,
@@ -90,7 +90,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		.read_status    = rtl822x_read_status,
  		.suspend        = genphy_suspend,
  		.resume         = rtlgen_resume,
-@@ -1070,6 +1098,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1074,6 +1102,7 @@ static struct phy_driver realtek_drvs[]
  		.get_features   = rtl822x_get_features,
  		.config_aneg    = rtl822x_config_aneg,
  		.config_init    = rtl8221b_config_init,
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/01_leds b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
index 3ba130cc909..1ba5d2b1a77 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/01_leds
+++ b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
@@ -53,7 +53,7 @@ engenius,ens620ext)
 	ucidef_set_led_netdev "lan2" "LAN2" "green:lan2" "eth1"
 	;;
 glinet,gl-ap1300)
-	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth1"
+	ucidef_set_led_netdev "wan" "WAN" "white:wan" "wan"
 	;;
 glinet,gl-b1300 |\
 mikrotik,lhgg-60ad)
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
index 7c9c2f08278..2e0e8d33cd6 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@@ -32,6 +32,7 @@ ipq40xx_setup_interfaces()
 	asus,map-ac2200|\
 	cilab,meshpoint-one|\
 	edgecore,ecw5211|\
+	glinet,gl-ap1300|\
 	glinet,gl-b2200|\
 	google,wifi|\
 	linksys,whw03v2|\
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-ap1300.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-ap1300.dts
index 41ed66e5950..6f5d4d8a578 100644
--- a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-ap1300.dts
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-gl-ap1300.dts
@@ -14,7 +14,6 @@
 		led-failsafe = &led_power;
 		led-running = &led_power;
 		led-upgrade = &led_power;
-		label-mac-device = &gmac0;
 	};
 
 	memory {
@@ -92,13 +91,13 @@
 		compatible = "gpio-leds";
 
 		led_power: power {
-			label = "green:power";
+			label = "white:power";
 			gpios = <&tlmm 2 GPIO_ACTIVE_HIGH>;
 			default-state = "on";
 		};
 
 		wan {
-			label = "green:wan";
+			label = "white:wan";
 			gpios = <&tlmm 3 GPIO_ACTIVE_HIGH>;
 		};
 	};
@@ -180,6 +179,14 @@
 				#address-cells = <1>;
 				#size-cells = <1>;
 
+				macaddr_art_0: mac-address@0 {
+					reg = <0x0 0x6>;
+				};
+
+				macaddr_art_6: mac-address@6 {
+					reg = <0x6 0x6>;
+				};
+
 				precal_art_1000: precal@1000 {
 					reg = <0x1000 0x2f20>;
 				};
@@ -256,6 +263,30 @@
 	status = "okay";
 };
 
+&gmac {
+	status = "okay";
+};
+
+&switch {
+	status = "okay";
+};
+
+&swport4 {
+	status = "okay";
+	label = "lan";
+
+	nvmem-cells = <&macaddr_art_0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&swport5 {
+	status = "okay";
+	label = "wan";
+
+	nvmem-cells = <&macaddr_art_6>;
+	nvmem-cell-names = "mac-address";
+};
+
 &wifi0 {
 	status = "okay";
 	nvmem-cell-names = "pre-calibration";
diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
index 2f0ca927f01..8fa4f4175a2 100644
--- a/target/linux/ipq40xx/image/generic.mk
+++ b/target/linux/ipq40xx/image/generic.mk
@@ -590,8 +590,7 @@ define Device/glinet_gl-ap1300
 	KERNEL_INSTALL := 1
 	DEVICE_PACKAGES := ipq-wifi-glinet_gl-ap1300 kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
 endef
-# Missing DSA Setup
-#TARGET_DEVICES += glinet_gl-ap1300
+TARGET_DEVICES += glinet_gl-ap1300
 
 define Device/glinet_gl-b1300
 	$(call Device/FitzImage)
diff --git a/target/linux/ramips/dts/mt7621_cudy_x6.dts b/target/linux/ramips/dts/mt7621_cudy_x6.dts
index 6cff9c25f3e..5d5bb5150cc 100644
--- a/target/linux/ramips/dts/mt7621_cudy_x6.dts
+++ b/target/linux/ramips/dts/mt7621_cudy_x6.dts
@@ -11,9 +11,9 @@
 
 	aliases {
 		led-boot = &led_internet_blue;
-		led-failsafe = &led_internet_blue;
+		led-failsafe = &led_internet_red;
 		led-running = &led_internet_blue;
-		led-upgrade = &led_internet_blue;
+		led-upgrade = &led_internet_red;
 		label-mac-device = &gmac0;
 	};
 
@@ -45,7 +45,7 @@
 			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
 		};
 
-		internet_red {
+		led_internet_red: internet_red {
 			label = "red:internet";
 			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
 		};
@@ -102,10 +102,18 @@
 				read-only;
 			};
 
-			bdinfo: partition@1ff0000 {
+			partition@1ff0000 {
 				label = "bdinfo";
 				reg = <0x1ff0000 0x10000>;
 				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_bdinfo_de00: macaddr@de00 {
+					reg = <0xde00 0x6>;
+				};
 			};
 		};
 	};
@@ -121,6 +129,9 @@
 		reg = <0x0000 0 0 0 0>;
 		mediatek,mtd-eeprom = <&factory 0x0000>;
 		mediatek,disable-radar-background;
+
+		nvmem-cells = <&macaddr_bdinfo_de00>;
+		nvmem-cell-names = "mac-address";
 	};
 };
 
@@ -175,13 +186,3 @@
 		function = "gpio";
 	};
 };
-
-&bdinfo {
-	compatible = "nvmem-cells";
-	#address-cells = <1>;
-	#size-cells = <1>;
-
-	macaddr_bdinfo_de00: macaddr@de00 {
-		reg = <0xde00 0x6>;
-	};
-};
diff --git a/target/linux/ramips/dts/mt7621_dlink_dap-x1860-a1.dts b/target/linux/ramips/dts/mt7621_dlink_dap-x1860-a1.dts
index 1aa3f7c91b7..818d2d8c413 100644
--- a/target/linux/ramips/dts/mt7621_dlink_dap-x1860-a1.dts
+++ b/target/linux/ramips/dts/mt7621_dlink_dap-x1860-a1.dts
@@ -15,9 +15,9 @@
 
 	aliases {
 		label-mac-device = &gmac0;
-		led-boot = &led_power_orange;
+		led-boot = &led_power_green;
 		led-failsafe = &led_power_red;
-		led-running = &led_power_orange;
+		led-running = &led_power_green;
 		led-upgrade = &led_power_red;
 	};
 
@@ -40,15 +40,20 @@
 	leds {
 		compatible = "gpio-leds";
 
+		led_power_green: power_green {
+			label = "green:power";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
 		led_power_red: power_red {
 			label = "red:power";
 			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
 		};
 
-		led_power_orange: power_orange {
+		power_orange {
 			label = "orange:power";
 			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
-			default-state = "on";
 		};
 
 		rssihigh {
diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index d46d84e6ce7..df89877c9a2 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -527,6 +527,7 @@ define Device/cudy_x6
   DEVICE_MODEL := X6
   UIMAGE_NAME := R13
   DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
+  SUPPORTED_DEVICES += R13
 endef
 TARGET_DEVICES += cudy_x6
 
diff --git a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
index 30a10423ad5..b6337f397b8 100644
--- a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@@ -28,8 +28,9 @@ case "$board" in
 		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $hw_mac_addr > /sys${DEVPATH}/macaddress
 		;;
 	cudy,x6)
-		hw_mac_addr="$(mtd_get_mac_binary factory 0x4)"
-		macaddr_add $hw_mac_addr "$PHYNBR" > /sys${DEVPATH}/macaddress
+		hw_mac_addr="$(mtd_get_mac_binary bdinfo 0xde00)"
+		[ "$PHYNBR" = "1" ] && \
+		macaddr_setbit_la "$(macaddr_add $hw_mac_addr 0x100000)" > /sys${DEVPATH}/macaddress
 		;;
 	dlink,dap-x1860-a1)
 		hw_mac_addr="$(mtd_get_mac_binary factory 0x4)"