diff --git a/target/linux/generic/backport-6.1/864-v6.6-bus-mhi-host-allow-MHI-client-drivers-to-provide-the.patch b/target/linux/generic/backport-6.1/864-v6.6-bus-mhi-host-allow-MHI-client-drivers-to-provide-the.patch
new file mode 100644
index 0000000000..a04b19b157
--- /dev/null
+++ b/target/linux/generic/backport-6.1/864-v6.6-bus-mhi-host-allow-MHI-client-drivers-to-provide-the.patch
@@ -0,0 +1,142 @@
+From: Kalle Valo <quic_kvalo@quicinc.com>
+Date: Thu, 27 Jul 2023 13:04:28 +0300
+Subject: [PATCH] bus: mhi: host: allow MHI client drivers to provide the
+ firmware via a pointer
+
+Currently MHI loads the firmware image from the path provided by client
+devices. ath11k needs to support firmware image embedded along with meta
+data (named as firmware-2.bin). So allow the client driver to request the
+firmware file from user space on it's own and provide the firmware image
+data and size to MHI via a pointer struct mhi_controller::fw_data.
+
+This is an optional feature, if fw_data is NULL MHI load the firmware using
+the name from struct mhi_controller::fw_image string as before.
+
+Tested with ath11k and WCN6855 hw2.0.
+
+Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
+Link: https://lore.kernel.org/r/20230727100430.3603551-2-kvalo@kernel.org
+[mani: wrapped commit message to 75 columns]
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+---
+
+--- a/drivers/bus/mhi/host/boot.c
++++ b/drivers/bus/mhi/host/boot.c
+@@ -367,12 +367,10 @@ error_alloc_mhi_buf:
+ }
+ 
+ static void mhi_firmware_copy(struct mhi_controller *mhi_cntrl,
+-			      const struct firmware *firmware,
++			      const u8 *buf, size_t remainder,
+ 			      struct image_info *img_info)
+ {
+-	size_t remainder = firmware->size;
+ 	size_t to_cpy;
+-	const u8 *buf = firmware->data;
+ 	struct mhi_buf *mhi_buf = img_info->mhi_buf;
+ 	struct bhi_vec_entry *bhi_vec = img_info->bhi_vec;
+ 
+@@ -395,9 +393,10 @@ void mhi_fw_load_handler(struct mhi_cont
+ 	struct device *dev = &mhi_cntrl->mhi_dev->dev;
+ 	enum mhi_pm_state new_state;
+ 	const char *fw_name;
++	const u8 *fw_data;
+ 	void *buf;
+ 	dma_addr_t dma_addr;
+-	size_t size;
++	size_t size, fw_sz;
+ 	int i, ret;
+ 
+ 	if (MHI_PM_IN_ERROR_STATE(mhi_cntrl->pm_state)) {
+@@ -427,6 +426,20 @@ void mhi_fw_load_handler(struct mhi_cont
+ 	fw_name = (mhi_cntrl->ee == MHI_EE_EDL) ?
+ 		mhi_cntrl->edl_image : mhi_cntrl->fw_image;
+ 
++	/* check if the driver has already provided the firmware data */
++	if (!fw_name && mhi_cntrl->fbc_download &&
++	    mhi_cntrl->fw_data && mhi_cntrl->fw_sz) {
++		if (!mhi_cntrl->sbl_size) {
++			dev_err(dev, "fw_data provided but no sbl_size\n");
++			goto error_fw_load;
++		}
++
++		size = mhi_cntrl->sbl_size;
++		fw_data = mhi_cntrl->fw_data;
++		fw_sz = mhi_cntrl->fw_sz;
++		goto skip_req_fw;
++	}
++
+ 	if (!fw_name || (mhi_cntrl->fbc_download && (!mhi_cntrl->sbl_size ||
+ 						     !mhi_cntrl->seg_len))) {
+ 		dev_err(dev,
+@@ -446,6 +459,10 @@ void mhi_fw_load_handler(struct mhi_cont
+ 	if (size > firmware->size)
+ 		size = firmware->size;
+ 
++	fw_data = firmware->data;
++	fw_sz = firmware->size;
++
++skip_req_fw:
+ 	buf = dma_alloc_coherent(mhi_cntrl->cntrl_dev, size, &dma_addr,
+ 				 GFP_KERNEL);
+ 	if (!buf) {
+@@ -454,7 +471,7 @@ void mhi_fw_load_handler(struct mhi_cont
+ 	}
+ 
+ 	/* Download image using BHI */
+-	memcpy(buf, firmware->data, size);
++	memcpy(buf, fw_data, size);
+ 	ret = mhi_fw_load_bhi(mhi_cntrl, dma_addr, size);
+ 	dma_free_coherent(mhi_cntrl->cntrl_dev, size, buf, dma_addr);
+ 
+@@ -466,7 +483,7 @@ void mhi_fw_load_handler(struct mhi_cont
+ 	}
+ 
+ 	/* Wait for ready since EDL image was loaded */
+-	if (fw_name == mhi_cntrl->edl_image) {
++	if (fw_name && fw_name == mhi_cntrl->edl_image) {
+ 		release_firmware(firmware);
+ 		goto fw_load_ready_state;
+ 	}
+@@ -480,15 +497,14 @@ void mhi_fw_load_handler(struct mhi_cont
+ 	 * device transitioning into MHI READY state
+ 	 */
+ 	if (mhi_cntrl->fbc_download) {
+-		ret = mhi_alloc_bhie_table(mhi_cntrl, &mhi_cntrl->fbc_image,
+-					   firmware->size);
++		ret = mhi_alloc_bhie_table(mhi_cntrl, &mhi_cntrl->fbc_image, fw_sz);
+ 		if (ret) {
+ 			release_firmware(firmware);
+ 			goto error_fw_load;
+ 		}
+ 
+ 		/* Load the firmware into BHIE vec table */
+-		mhi_firmware_copy(mhi_cntrl, firmware, mhi_cntrl->fbc_image);
++		mhi_firmware_copy(mhi_cntrl, fw_data, fw_sz, mhi_cntrl->fbc_image);
+ 	}
+ 
+ 	release_firmware(firmware);
+--- a/include/linux/mhi.h
++++ b/include/linux/mhi.h
+@@ -301,6 +301,10 @@ struct mhi_controller_config {
+  * @iova_start: IOMMU starting address for data (required)
+  * @iova_stop: IOMMU stop address for data (required)
+  * @fw_image: Firmware image name for normal booting (optional)
++ * @fw_data: Firmware image data content for normal booting, used only
++ *           if fw_image is NULL and fbc_download is true (optional)
++ * @fw_sz: Firmware image data size for normal booting, used only if fw_image
++ *         is NULL and fbc_download is true (optional)
+  * @edl_image: Firmware image name for emergency download mode (optional)
+  * @rddm_size: RAM dump size that host should allocate for debugging purpose
+  * @sbl_size: SBL image size downloaded through BHIe (optional)
+@@ -387,6 +391,8 @@ struct mhi_controller {
+ 	dma_addr_t iova_start;
+ 	dma_addr_t iova_stop;
+ 	const char *fw_image;
++	const u8 *fw_data;
++	size_t fw_sz;
+ 	const char *edl_image;
+ 	size_t rddm_size;
+ 	size_t sbl_size;