diff --git a/config/kernel/linux-rk3399-default.config b/config/kernel/linux-rk3399-default.config
index ded7dd71d0..16eb4b22cb 100644
--- a/config/kernel/linux-rk3399-default.config
+++ b/config/kernel/linux-rk3399-default.config
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/arm64 4.4.112 Kernel Configuration
+# Linux/arm64 4.4.115 Kernel Configuration
 #
 CONFIG_ARM64=y
 CONFIG_64BIT=y
@@ -975,6 +975,7 @@ CONFIG_RFKILL_GPIO=m
 # CONFIG_NFC is not set
 # CONFIG_LWTUNNEL is not set
 CONFIG_HAVE_BPF_JIT=y
+CONFIG_HAVE_EBPF_JIT=y
 
 #
 # Device Drivers
@@ -1594,6 +1595,7 @@ CONFIG_RTL8187_LEDS=y
 # CONFIG_IWL4965 is not set
 # CONFIG_IWL3945 is not set
 # CONFIG_LIBERTAS is not set
+CONFIG_RTL8812AU=m
 # CONFIG_HERMES is not set
 # CONFIG_P54_COMMON is not set
 CONFIG_RT2X00=m
diff --git a/config/sources/rk3399.conf b/config/sources/rk3399.conf
index 70e039db5d..075beacbbe 100644
--- a/config/sources/rk3399.conf
+++ b/config/sources/rk3399.conf
@@ -5,7 +5,7 @@ OFFSET=16
 BOOTSCRIPT='boot-rk3328.cmd:boot.cmd'
 BOOTENV_FILE='rk3399-default.txt'
 
-UBOOT_TARGET_MAP=";;idbloader.bin uboot.img"
+UBOOT_TARGET_MAP=";;idbloader.bin uboot.img trust.bin"
 UBOOT_USE_GCC='> 7.0'
 
 BOOTSOURCE='https://github.com/hardkernel/u-boot'
@@ -17,11 +17,12 @@ HAS_UUID_SUPPORT=yes
 BOOTDELAY=0
 OVERLAY_PREFIX='rk3328'
 
-#ATFSOURCE='https://github.com/ayufan-rock64/arm-trusted-firmware'
-#ATFDIR='arm-trusted-firmware-rk3328'
-#ATFBRANCH='branch:rockchip'
-#ATF_USE_GCC='> 6.3'
-#ATF_TARGET_MAP='PLAT=rk3399 DEBUG=1 bl31;;trust.bin'
+ATFSOURCE='https://github.com/ayufan-rock64/arm-trusted-firmware'
+ATFDIR='arm-trusted-firmware-rk3328'
+ATFBRANCH='branch:rockchip'
+ATF_USE_GCC='> 6.3'
+ATF_TARGET_MAP='PLAT=rk3399 DEBUG=1 bl31;;trust.bin'
+
 
 case $BRANCH in
 	default)
@@ -62,14 +63,14 @@ uboot_custom_postprocess()
 	#
 	#Below is what works with BOOTBRANCH='branch:release'
 	#
-	dd if=$SRC/cache/sources/rkbin-tools/rk33/rk3399_ddr_800MHz_v1.08.bin of=$tempfile bs=4 skip=1
-	tools/mkimage -n rk3328 -T rksd -d $tempfile idbloader.bin
+	#dd if=$SRC/cache/sources/rkbin-tools/rk33/rk3399_ddr_800MHz_v1.08.bin of=$tempfile bs=4 skip=1
+	#tools/mkimage -n rk3399 -T rksd -d $tempfile idbloader.bin
 
 	# Below is the way it is supposed to work according to Rockchip documentation,
 	# and how it does work with the mainline-master branch.  No 4-byte skip.
 	#
-	# tools/mkimage -n rk3328 -T rksd -d $SRC/cache/sources/rkbin-tools/rk33/rk3328_ddr_786MHz_v1.06.bin idbloader.bin
-	#
+
+	tools/mkimage -n rk3399 -T rksd -d $SRC/cache/sources/rkbin-tools/rk33/rk3399_ddr_800MHz_v1.08.bin idbloader.bin
 
 	cat $SRC/cache/sources/rkbin-tools/rk33/rk3399_miniloader_v1.06.bin >> idbloader.bin
 
@@ -79,7 +80,7 @@ uboot_custom_postprocess()
 	# https://github.com/rockchip-linux/build/commit/fff8f5a2d91fd11f8c4f6d605cac704d28baab4d
 	#
 
-	loaderimage --pack --uboot ./u-boot-dtb.bin uboot.img 0x200000
+	loaderimage --pack --uboot ./u-boot-dtb.bin uboot.img
 }
 
 atf_custom_postprocess()
@@ -87,7 +88,7 @@ atf_custom_postprocess()
 	# remove bl31.bin which can be 4+GiB in size and thus may fill the tmpfs mount
 	rm -f build/rk322xh/debug/bl31.bin
 	# ATF
-	#trust_merger trust.ini
+	trust_merger trust.ini
 }
 
 family_tweaks()
diff --git a/patch/atf/atf-rk3399/add-trust-ini.patch b/patch/atf/atf-rk3399/add-trust-ini.patch
new file mode 100644
index 0000000000..528ec55708
--- /dev/null
+++ b/patch/atf/atf-rk3399/add-trust-ini.patch
@@ -0,0 +1,21 @@
+diff --git a/trust.ini b/trust.ini
+new file mode 100644
+index 0000000..4af021a
+--- /dev/null
++++ b/trust.ini
+@@ -0,0 +1,15 @@
++[VERSION]
++MAJOR=1
++MINOR=0
++[BL30_OPTION]
++SEC=0
++[BL31_OPTION]
++SEC=1
++PATH=./build/rk3399/debug/bl31/bl31.elf
++ADDR=0x10000
++[BL32_OPTION]
++SEC=0
++[BL33_OPTION]
++SEC=0
++[OUTPUT]
++PATH=trust.bin