diff --git a/include/kernel-5.15 b/include/kernel-5.15
index f31669f8c0..82d1c5a7bc 100644
--- a/include/kernel-5.15
+++ b/include/kernel-5.15
@@ -1,2 +1,2 @@
-LINUX_VERSION-5.15 = .88
-LINUX_KERNEL_HASH-5.15.88 = 417539fdd96a3af97ef9ad2b51ca13967cb922f53970563b60290b935a81a181
+LINUX_VERSION-5.15 = .89
+LINUX_KERNEL_HASH-5.15.89 = e7311b874e014bb6d37c051319bd6a4a4e3d05a1c32546522deabbfd2d752fe8
diff --git a/include/trusted-firmware-a.mk b/include/trusted-firmware-a.mk
index 082ada269c..0c0118e092 100644
--- a/include/trusted-firmware-a.mk
+++ b/include/trusted-firmware-a.mk
@@ -81,7 +81,7 @@ define Build/Compile/Trusted-Firmware-A
 		$(if $(DTC),DTC="$(DTC)") \
 		PLAT=$(PLAT) \
 		BUILD_STRING="OpenWrt v$(PKG_VERSION)-$(PKG_RELEASE) ($(VARIANT))" \
-		$(if $(CONFIG_BINUTILS_VERSION_2_39),LDFLAGS="-no-warn-rwx-segments") \
+		$(if $(CONFIG_BINUTILS_VERSION_2_37)$(CONFIG_BINUTILS_VERSION_2_38),,LDFLAGS="-no-warn-rwx-segments") \
 		$(TFA_MAKE_FLAGS)
 endef
 
diff --git a/package/base-files/files/lib/upgrade/common.sh b/package/base-files/files/lib/upgrade/common.sh
index 5af061f6a4..53b8865a57 100644
--- a/package/base-files/files/lib/upgrade/common.sh
+++ b/package/base-files/files/lib/upgrade/common.sh
@@ -127,6 +127,33 @@ get_magic_fat32() {
 	(get_image "$@" | dd bs=1 count=5 skip=82) 2>/dev/null
 }
 
+identify_magic_long() {
+	local magic=$1
+	case "$magic" in
+		"55424923")
+			echo "ubi"
+			;;
+		"31181006")
+			echo "ubifs"
+			;;
+		"68737173")
+			echo "squashfs"
+			;;
+		"d00dfeed")
+			echo "fit"
+			;;
+		"4349"*)
+			echo "combined"
+			;;
+		"1f8b"*)
+			echo "gzip"
+			;;
+		*)
+			echo "unknown $magic"
+			;;
+	esac
+}
+
 part_magic_efi() {
 	local magic=$(get_magic_gpt "$@")
 	[ "$magic" = "EFI PART" ]
diff --git a/package/base-files/files/lib/upgrade/emmc.sh b/package/base-files/files/lib/upgrade/emmc.sh
index c3b02864aa..49cffe1c65 100644
--- a/package/base-files/files/lib/upgrade/emmc.sh
+++ b/package/base-files/files/lib/upgrade/emmc.sh
@@ -58,7 +58,7 @@ emmc_copy_config() {
 }
 
 emmc_do_upgrade() {
-	local file_type=$(identify $1)
+	local file_type=$(identify_magic_long "$(get_magic_long "$1")")
 
 	case "$file_type" in
 		"fit")  emmc_upgrade_fit $1;;
diff --git a/package/base-files/files/lib/upgrade/nand.sh b/package/base-files/files/lib/upgrade/nand.sh
index a8e3cab0b8..a1dbd6e266 100644
--- a/package/base-files/files/lib/upgrade/nand.sh
+++ b/package/base-files/files/lib/upgrade/nand.sh
@@ -65,40 +65,12 @@ get_magic_long_tar() {
 	(tar xO${3}f "$1" "$2" | dd bs=4 count=1 | hexdump -v -n 4 -e '1/1 "%02x"') 2> /dev/null
 }
 
-identify_magic() {
-	local magic=$1
-	case "$magic" in
-		"55424923")
-			echo "ubi"
-			;;
-		"31181006")
-			echo "ubifs"
-			;;
-		"68737173")
-			echo "squashfs"
-			;;
-		"d00dfeed")
-			echo "fit"
-			;;
-		"4349"*)
-			echo "combined"
-			;;
-		"1f8b"*)
-			echo "gzip"
-			;;
-		*)
-			echo "unknown $magic"
-			;;
-	esac
-}
-
-
 identify() {
-	identify_magic $(nand_get_magic_long "$@")
+	identify_magic_long $(nand_get_magic_long "$@")
 }
 
 identify_tar() {
-	identify_magic $(get_magic_long_tar "$@")
+	identify_magic_long $(get_magic_long_tar "$@")
 }
 
 identify_if_gzip() {
diff --git a/package/libs/openssl/patches/010-padlock.patch b/package/libs/openssl/patches/010-padlock.patch
new file mode 100644
index 0000000000..e859295cd6
--- /dev/null
+++ b/package/libs/openssl/patches/010-padlock.patch
@@ -0,0 +1,52 @@
+From 2bcf8e69bd92e33d84c48e7d108d3d46b22f8a6d Mon Sep 17 00:00:00 2001
+From: ValdikSS <iam@valdikss.org.ru>
+Date: Wed, 18 Jan 2023 20:14:48 +0300
+Subject: [PATCH] Padlock: fix byte swapping assembly for AES-192 and 256
+
+Byte swapping code incorrectly uses the number of AES rounds to swap expanded
+AES key, while swapping only a single dword in a loop, resulting in swapped
+key and partially swapped expanded keys, breaking AES encryption and
+decryption on VIA Padlock hardware.
+
+This commit correctly sets the number of swapping loops to be done.
+
+Fixes #20073
+
+CLA: trivial
+
+Reviewed-by: Hugo Landau <hlandau@openssl.org>
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/20077)
+
+(cherry picked from commit 7331e7ef79fe4499d81cc92249e9c97e9ff9291a)
+---
+ engines/asm/e_padlock-x86.pl    | 2 ++
+ engines/asm/e_padlock-x86_64.pl | 2 ++
+ 2 files changed, 4 insertions(+)
+
+diff --git a/engines/asm/e_padlock-x86.pl b/engines/asm/e_padlock-x86.pl
+index 5b097ce3ef9b..07f7000fd38a 100644
+--- a/engines/asm/e_padlock-x86.pl
++++ b/engines/asm/e_padlock-x86.pl
+@@ -116,6 +116,8 @@
+ &function_begin_B("padlock_key_bswap");
+ 	&mov	("edx",&wparam(0));
+ 	&mov	("ecx",&DWP(240,"edx"));
++	&inc	("ecx");
++	&shl	("ecx",2);
+ &set_label("bswap_loop");
+ 	&mov	("eax",&DWP(0,"edx"));
+ 	&bswap	("eax");
+diff --git a/engines/asm/e_padlock-x86_64.pl b/engines/asm/e_padlock-x86_64.pl
+index 09b0aaa48dfe..dfd2ae656375 100644
+--- a/engines/asm/e_padlock-x86_64.pl
++++ b/engines/asm/e_padlock-x86_64.pl
+@@ -92,6 +92,8 @@
+ .align	16
+ padlock_key_bswap:
+ 	mov	240($arg1),%edx
++	inc	%edx
++	shl	\$2,%edx
+ .Lbswap_loop:
+ 	mov	($arg1),%eax
+ 	bswap	%eax
diff --git a/package/network/services/dnsmasq/files/dhcp.conf b/package/network/services/dnsmasq/files/dhcp.conf
index 698d17d202..58e9e076b3 100644
--- a/package/network/services/dnsmasq/files/dhcp.conf
+++ b/package/network/services/dnsmasq/files/dhcp.conf
@@ -10,6 +10,7 @@ config dnsmasq
 	option domain	'lan'
 	option expandhosts	1
 	option nonegcache	0
+	option cachesize	1000
 	option authoritative	1
 	option readethers	1
 	option leasefile	'/tmp/dhcp.leases'
diff --git a/package/network/utils/iwinfo/Makefile b/package/network/utils/iwinfo/Makefile
index 9d562fbaf9..bf258ef455 100644
--- a/package/network/utils/iwinfo/Makefile
+++ b/package/network/utils/iwinfo/Makefile
@@ -11,13 +11,13 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/iwinfo.git
-PKG_SOURCE_DATE:=2023-01-06
-PKG_SOURCE_VERSION:=c7b420a2f33c6f1034c3e2191eba0cb0374af7b6
-PKG_MIRROR_HASH:=c5d188b2c7aa0fe987ffba8330c956670047ebf5be9a217ef647549c65002cd6
+PKG_SOURCE_DATE:=2023-01-23
+PKG_SOURCE_VERSION:=1e4e709d6f26cc38411ca189bab04f857b444ef3
+PKG_MIRROR_HASH:=851ca5c724f01260770ac7f4c98bc4f32b03fde635d06c797896ff2c4658c753
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=GPL-2.0
 
-IWINFO_ABI_VERSION:=20210430
+IWINFO_ABI_VERSION:=20230121
 
 include $(INCLUDE_DIR)/package.mk
 
diff --git a/package/network/utils/rssileds/Makefile b/package/network/utils/rssileds/Makefile
index 2282d8c5b1..5adc25e8d8 100644
--- a/package/network/utils/rssileds/Makefile
+++ b/package/network/utils/rssileds/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rssileds
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 PKG_LICNESE:=GPL-2.0+
 
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/system/fstools/Makefile b/package/system/fstools/Makefile
index f716f26c05..8a17f16945 100644
--- a/package/system/fstools/Makefile
+++ b/package/system/fstools/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=fstools
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/fstools.git
-PKG_MIRROR_HASH:=28be14a1e28fc62e80681e1b5e7f2435692ee326b66afcc1f3d158764df686d5
-PKG_SOURCE_DATE:=2022-11-10
-PKG_SOURCE_VERSION:=3affe9ea5098c8bb90111ce97d50ad976ef0c034
+PKG_MIRROR_HASH:=edda9151c73c1adfe369f5e315347344727a540ad57d3e2b41b9f57f9d4313fe
+PKG_SOURCE_DATE:=2023-01-22
+PKG_SOURCE_VERSION:=1ea5855e980cd88766dd9f615e78e7dd6edfbb74
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=GPL-2.0
diff --git a/package/system/rpcd/Makefile b/package/system/rpcd/Makefile
index ab4589f88c..70d61fa9ad 100644
--- a/package/system/rpcd/Makefile
+++ b/package/system/rpcd/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rpcd
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/rpcd.git
-PKG_MIRROR_HASH:=87dab115512070d3ab566ebe47859bad3c148986271cdb2ac05a0952be262519
-PKG_SOURCE_DATE:=2022-12-15
-PKG_SOURCE_VERSION:=7de4820c87437033f6b7716018f3bfa60a3f7b12
+PKG_MIRROR_HASH:=7038ab08dc67f7440effbf04ab2f083915c819f758ab16b0fbdf846bd3b87773
+PKG_SOURCE_DATE:=2023-01-21
+PKG_SOURCE_VERSION:=c0df2a7af7d6284f4a446de15d0dab17124d9448
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 
 PKG_LICENSE:=ISC
@@ -103,5 +103,5 @@ endef
 $(eval $(call BuildPackage,rpcd))
 $(eval $(call BuildPlugin,file,,Provides ubus calls for file and directory operations.))
 $(eval $(call BuildPlugin,rpcsys,,Provides ubus calls for sysupgrade and password changing.))
-$(eval $(call BuildPlugin,iwinfo,+libiwinfo,Provides ubus calls for accessing iwinfo data.,libiwinfo (>= 2022-12-15)))
+$(eval $(call BuildPlugin,iwinfo,+libiwinfo,Provides ubus calls for accessing iwinfo data.,libiwinfo (>= 2023-01-21)))
 $(eval $(call BuildPlugin,ucode,+libucode,Allows implementing plugins using ucode scripts.))
diff --git a/package/utils/ucode/Makefile b/package/utils/ucode/Makefile
index 228403e041..3913fd2aa4 100644
--- a/package/utils/ucode/Makefile
+++ b/package/utils/ucode/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/jow-/ucode.git
-PKG_SOURCE_DATE:=2023-01-07
-PKG_SOURCE_VERSION:=1e4d20932646f90523d21ea358c72901e3ee689e
-PKG_MIRROR_HASH:=8c43b9a0a80c3de92961caad65c934bd3989e6f7f9389f676d91e2e926c9e4a6
+PKG_SOURCE_DATE:=2023-01-09
+PKG_SOURCE_VERSION:=8dad974baa4696fcba85837fa70cde8b68dd7c12
+PKG_MIRROR_HASH:=91494352ac298ac2735d62355837a1f18e366999c9e940613e6fa3265edc0364
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=ISC
 
diff --git a/target/linux/generic/backport-5.15/020-v6.1-05-mm-multigenerational-lru-mm_struct-list.patch b/target/linux/generic/backport-5.15/020-v6.1-05-mm-multigenerational-lru-mm_struct-list.patch
index e0b95cb76b..5b5cbe721e 100644
--- a/target/linux/generic/backport-5.15/020-v6.1-05-mm-multigenerational-lru-mm_struct-list.patch
+++ b/target/linux/generic/backport-5.15/020-v6.1-05-mm-multigenerational-lru-mm_struct-list.patch
@@ -329,7 +329,7 @@ Change-Id: I25d9eda8c6bdc7c3653b9f210a159d6c247c81e8
  	/* forking complete and child started to run, tell ptracer */
 --- a/kernel/sched/core.c
 +++ b/kernel/sched/core.c
-@@ -4978,6 +4978,7 @@ context_switch(struct rq *rq, struct tas
+@@ -5007,6 +5007,7 @@ context_switch(struct rq *rq, struct tas
  		 * finish_task_switch()'s mmdrop().
  		 */
  		switch_mm_irqs_off(prev->active_mm, next->mm, next);
diff --git a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h
index dff1f28c81..517ff7414f 100644
--- a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h
+++ b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.h
@@ -95,8 +95,14 @@ bbt_nand_read(u32 page, unsigned char *dat, int dat_len,
 		.datbuf = dat,
 		.len = dat_len,
 	};
+	int ret;
 
-	return bmtd._read_oob(bmtd.mtd, page << bmtd.pg_shift, &ops);
+	ret = bmtd._read_oob(bmtd.mtd, page << bmtd.pg_shift, &ops);
+	if (ret < 0)
+		return ret;
+	if (ret)
+		pr_info("%s: %d bitflips\n", __func__, ret);
+	return 0;
 }
 
 static inline int bbt_nand_erase(u16 block)
diff --git a/target/linux/generic/hack-5.15/904-debloat_dma_buf.patch b/target/linux/generic/hack-5.15/904-debloat_dma_buf.patch
index 302c0007f2..beb1e31d93 100644
--- a/target/linux/generic/hack-5.15/904-debloat_dma_buf.patch
+++ b/target/linux/generic/hack-5.15/904-debloat_dma_buf.patch
@@ -72,7 +72,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +MODULE_LICENSE("GPL");
 --- a/kernel/sched/core.c
 +++ b/kernel/sched/core.c
-@@ -4184,6 +4184,7 @@ int wake_up_state(struct task_struct *p,
+@@ -4213,6 +4213,7 @@ int wake_up_state(struct task_struct *p,
  {
  	return try_to_wake_up(p, state, 0);
  }
diff --git a/target/linux/ipq806x/Makefile b/target/linux/ipq806x/Makefile
index 88dde56507..8c08026d2c 100644
--- a/target/linux/ipq806x/Makefile
+++ b/target/linux/ipq806x/Makefile
@@ -5,10 +5,10 @@ include $(TOPDIR)/rules.mk
 ARCH:=arm
 BOARD:=ipq806x
 BOARDNAME:=Qualcomm Atheros IPQ806X
-FEATURES:=squashfs nand fpu ramdisk
+FEATURES:=squashfs fpu ramdisk
 CPU_TYPE:=cortex-a15
 CPU_SUBTYPE:=neon-vfpv4
-SUBTARGETS:=generic
+SUBTARGETS:=generic chromium
 
 KERNEL_PATCHVER:=5.15
 
diff --git a/target/linux/ipq806x/base-files/etc/board.d/02_network b/target/linux/ipq806x/base-files/etc/board.d/02_network
index dbff854731..f38876b69f 100644
--- a/target/linux/ipq806x/base-files/etc/board.d/02_network
+++ b/target/linux/ipq806x/base-files/etc/board.d/02_network
@@ -79,6 +79,12 @@ tplink,ad7200)
 	ucidef_add_switch "switch0" \
 		"2:lan:1" "3:lan:2" "4:lan:3" "5:lan:4" "6@eth1" "1:wan" "0@eth0"
 	;;
+asus,onhub |\
+tplink,onhub)
+	ucidef_set_interfaces_lan_wan "eth1" "eth0"
+	ucidef_add_switch "switch0" \
+		"1:lan" "6@eth1" "2:wan" "0@eth0"
+	;;
 ubnt,unifi-ac-hd)
 	ucidef_set_interface_lan "eth0 eth1"
 	;;
diff --git a/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index 398ddf9a29..a0e2e9d123 100644
--- a/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -6,9 +6,32 @@
 
 board=$(board_name)
 
+dt_base64_extract() {
+	local target_dir="/sys$DEVPATH"
+	local source="$target_dir/../../of_node/qcom,ath10k-calibration-data-base64"
+
+	[ -e "$source" ] || caldata_die "cannot find base64 calibration data: $source"
+	[ -d "$target_dir" ] || \
+		caldata_die "no sysfs dir to write: $target"
+
+	echo 1 > "$target_dir/loading"
+	base64decode.uc "$source" > "$target_dir/data"
+	if [ $? != 0 ]; then
+		echo 1 > "$target_dir/loading"
+		caldata_die \
+			"failed to write calibration data to $target_dir/data"
+	else
+		echo 0 > "$target_dir/loading"
+	fi
+}
+
 case "$FIRMWARE" in
 "ath10k/cal-pci-0000:01:00.0.bin")
 	case "$board" in
+	asus,onhub |\
+	tplink,onhub)
+		dt_base64_extract
+		;;
 	meraki,mr52)
 		CI_UBIPART=art
 		caldata_extract_ubi "ART" 0x1000 0x844
@@ -35,6 +58,14 @@ case "$FIRMWARE" in
 		;;
 	esac
 	;;
+"ath10k/cal-pci-0001:01:00.0.bin")
+	case "$board" in
+	asus,onhub |\
+	tplink,onhub)
+		dt_base64_extract
+		;;
+	esac
+	;;
 "ath10k/pre-cal-pci-0001:01:00.0.bin")
 	case $board in
 	asrock,g10)
@@ -61,6 +92,10 @@ case "$FIRMWARE" in
 	;;
 "ath10k/cal-pci-0002:01:00.0.bin")
 	case "$board" in
+	asus,onhub |\
+	tplink,onhub)
+		dt_base64_extract
+		;;
 	meraki,mr42)
 		CI_UBIPART=art
 		caldata_extract_ubi "ART" 0x9000 0x844
diff --git a/target/linux/ipq806x/base-files/lib/upgrade/platform.sh b/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
index f9e592f4bd..67ceaab24f 100644
--- a/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
@@ -57,6 +57,15 @@ platform_do_upgrade() {
 		MTD_CONFIG_ARGS="-s 0x200000"
 		default_do_upgrade "$1"
 		;;
+	asus,onhub |\
+	tplink,onhub)
+		export_bootdevice
+		export_partdevice CI_ROOTDEV 0
+		CI_KERNPART="kernel"
+		CI_ROOTPART="rootfs"
+		CI_DATAPART="rootfs_data"
+		emmc_do_upgrade "$1"
+		;;
 	tplink,vr2600v)
 		MTD_CONFIG_ARGS="-s 0x200000"
 		default_do_upgrade "$1"
@@ -69,3 +78,13 @@ platform_do_upgrade() {
 		;;
 	esac
 }
+
+platform_copy_config() {
+	case "${board_name}" in
+	asus,onhub |\
+	tplink,onhub)
+		emmc_copy_config
+		;;
+	esac
+	return 0
+}
diff --git a/target/linux/ipq806x/base-files/usr/bin/base64decode.uc b/target/linux/ipq806x/base-files/usr/bin/base64decode.uc
new file mode 100755
index 0000000000..7dcf30986c
--- /dev/null
+++ b/target/linux/ipq806x/base-files/usr/bin/base64decode.uc
@@ -0,0 +1,23 @@
+#!/usr/bin/ucode
+
+import { stdin, open, error } from 'fs';
+
+if (length(ARGV) == 0 && stdin.isatty()) {
+	warn("usage: b64decode [stdin|path]\n");
+	exit(1);
+}
+
+let fp = stdin;
+let source = ARGV[0];
+
+if (source) {
+	fp = open(source);
+	if (!fp) {
+		warn('b64decode: unable to open ${source}: ${error()}\n');
+		exit(1);
+	}
+}
+
+print(b64dec(fp.read("all")));
+fp.close();
+exit(0);
diff --git a/target/linux/ipq806x/chromium/config-default b/target/linux/ipq806x/chromium/config-default
new file mode 100644
index 0000000000..d7db9f7db3
--- /dev/null
+++ b/target/linux/ipq806x/chromium/config-default
@@ -0,0 +1,13 @@
+CONFIG_BLK_DEV_SD=y
+CONFIG_LEDS_LP5523=y
+CONFIG_LEDS_LP55XX_COMMON=y
+CONFIG_PHY_QCOM_IPQ806X_USB=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+CONFIG_SG_POOL=y
+CONFIG_USB_DWC3=y
+CONFIG_USB_DWC3_HOST=y
+CONFIG_USB_DWC3_QCOM=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_PLATFORM=y
diff --git a/target/linux/ipq806x/chromium/target.mk b/target/linux/ipq806x/chromium/target.mk
new file mode 100644
index 0000000000..3983a9281a
--- /dev/null
+++ b/target/linux/ipq806x/chromium/target.mk
@@ -0,0 +1,2 @@
+BOARDNAME:=Google Chromium
+FEATURES += emmc boot-part rootfs-part
diff --git a/target/linux/ipq806x/config-5.15 b/target/linux/ipq806x/config-5.15
index 72017e7528..0bd6dde11c 100644
--- a/target/linux/ipq806x/config-5.15
+++ b/target/linux/ipq806x/config-5.15
@@ -34,13 +34,14 @@ CONFIG_ARM_CPU_SUSPEND=y
 # CONFIG_ARM_CPU_TOPOLOGY is not set
 CONFIG_ARM_GIC=y
 CONFIG_ARM_HAS_SG_CHAIN=y
+# CONFIG_ARM_IPQ806X_FAB_DEVFREQ is not set
+# CONFIG_ARM_KRAIT_CACHE_DEVFREQ is not set
 CONFIG_ARM_L1_CACHE_SHIFT=6
 CONFIG_ARM_L1_CACHE_SHIFT_6=y
 CONFIG_ARM_MODULE_PLTS=y
 CONFIG_ARM_PATCH_IDIV=y
 CONFIG_ARM_PATCH_PHYS_VIRT=y
 # CONFIG_ARM_QCOM_CPUFREQ_HW is not set
-CONFIG_ARM_QCOM_CPUFREQ_KRAIT=y
 CONFIG_ARM_QCOM_CPUFREQ_NVMEM=y
 CONFIG_ARM_QCOM_SPM_CPUIDLE=y
 # CONFIG_ARM_SMMU is not set
@@ -98,13 +99,11 @@ CONFIG_CRC16=y
 # CONFIG_CRC32_SARWATE is not set
 CONFIG_CRC32_SLICEBY8=y
 CONFIG_CRC8=y
-CONFIG_CRYPTO_BLAKE2S=y
 CONFIG_CRYPTO_DEFLATE=y
 CONFIG_CRYPTO_DEV_QCOM_RNG=y
 CONFIG_CRYPTO_DRBG=y
 CONFIG_CRYPTO_DRBG_HMAC=y
 CONFIG_CRYPTO_DRBG_MENU=y
-CONFIG_CRYPTO_GF128MUL=y
 CONFIG_CRYPTO_HASH_INFO=y
 CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_HW=y
@@ -112,7 +111,6 @@ CONFIG_CRYPTO_JITTERENTROPY=y
 CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
 CONFIG_CRYPTO_LIB_SHA256=y
 CONFIG_CRYPTO_LZO=y
-CONFIG_CRYPTO_NULL2=y
 CONFIG_CRYPTO_RNG=y
 CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_SHA256=y
@@ -127,8 +125,6 @@ CONFIG_DEVFREQ_GOV_PASSIVE=y
 # CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND is not set
 # CONFIG_DEVFREQ_GOV_USERSPACE is not set
 # CONFIG_DEVFREQ_THERMAL is not set
-# CONFIG_ARM_KRAIT_CACHE_DEVFREQ is not set
-# CONFIG_ARM_IPQ806X_FAB_DEVFREQ is not set
 CONFIG_DMADEVICES=y
 CONFIG_DMA_ENGINE=y
 CONFIG_DMA_OF=y
@@ -143,6 +139,7 @@ CONFIG_DWMAC_IPQ806X=y
 CONFIG_DYNAMIC_DEBUG=y
 CONFIG_EDAC_ATOMIC_SCRUB=y
 CONFIG_EDAC_SUPPORT=y
+CONFIG_ETHERNET_PACKET_MANGLE=y
 CONFIG_FIXED_PHY=y
 CONFIG_FIX_EARLYCON_MEM=y
 CONFIG_FWNODE_MDIO=y
@@ -152,10 +149,12 @@ CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_GENERIC_EARLY_IOREMAP=y
 CONFIG_GENERIC_GETTIMEOFDAY=y
 CONFIG_GENERIC_IDLE_POLL_SETUP=y
 CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
 CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
 CONFIG_GENERIC_IRQ_SHOW=y
 CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
@@ -173,6 +172,7 @@ CONFIG_GENERIC_STRNCPY_FROM_USER=y
 CONFIG_GENERIC_STRNLEN_USER=y
 CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GENERIC_VDSO_32=y
+CONFIG_GLOB=y
 CONFIG_GPIOLIB_IRQCHIP=y
 CONFIG_GPIO_CDEV=y
 CONFIG_GRO_CELLS=y
@@ -185,6 +185,7 @@ CONFIG_HAS_IOPORT_MAP=y
 CONFIG_HAVE_SMP=y
 CONFIG_HIGHMEM=y
 # CONFIG_HIGHPTE is not set
+CONFIG_HOTPLUG_CPU=y
 CONFIG_HWMON=y
 CONFIG_HWSPINLOCK=y
 CONFIG_HWSPINLOCK_QCOM=y
@@ -214,12 +215,12 @@ CONFIG_IRQ_FASTEOI_HIERARCHY_HANDLERS=y
 CONFIG_IRQ_FORCED_THREADING=y
 CONFIG_IRQ_WORK=y
 CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
 CONFIG_KPSS_XCC=y
 CONFIG_KRAITCC=y
 CONFIG_KRAIT_CLOCKS=y
 CONFIG_KRAIT_L2_ACCESSORS=y
 CONFIG_LIBFDT=y
-CONFIG_LLD_VERSION=0
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
 CONFIG_LZO_COMPRESS=y
@@ -300,6 +301,7 @@ CONFIG_NR_CPUS=2
 CONFIG_NVMEM=y
 CONFIG_NVMEM_QCOM_QFPROM=y
 # CONFIG_NVMEM_SPMI_SDAM is not set
+CONFIG_NVMEM_SYSFS=y
 CONFIG_OF=y
 CONFIG_OF_ADDRESS=y
 CONFIG_OF_EARLY_FLATTREE=y
@@ -308,7 +310,6 @@ CONFIG_OF_GPIO=y
 CONFIG_OF_IRQ=y
 CONFIG_OF_KOBJ=y
 CONFIG_OF_MDIO=y
-CONFIG_OF_NET=y
 CONFIG_OLD_SIGACTION=y
 CONFIG_OLD_SIGSUSPEND3=y
 CONFIG_PADATA=y
@@ -397,7 +398,7 @@ CONFIG_QCOM_SCM=y
 # CONFIG_QCOM_SCM_DOWNLOAD_MODE_DEFAULT is not set
 CONFIG_QCOM_SMEM=y
 # CONFIG_QCOM_SMSM is not set
-# CONFIG_QCOM_SOCINFO is not set
+CONFIG_QCOM_SOCINFO=y
 CONFIG_QCOM_TCSR=y
 CONFIG_QCOM_TSENS=y
 CONFIG_QCOM_WDT=y
@@ -452,6 +453,7 @@ CONFIG_SMP_ON_UP=y
 # CONFIG_SM_VIDEOCC_8150 is not set
 # CONFIG_SM_VIDEOCC_8250 is not set
 CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BUS=y
 CONFIG_SPARSE_IRQ=y
 CONFIG_SPI=y
 CONFIG_SPI_MASTER=y
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-asus-onhub.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-asus-onhub.dts
new file mode 100644
index 0000000000..5b60ddb04b
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-asus-onhub.dts
@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2014 The ChromiumOS Authors
+ */
+
+#include "qcom-ipq8064-onhub.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/soc/qcom,gsbi.h>
+
+/ {
+	model = "ASUS OnHub";
+	compatible = "asus,onhub", "google,arkham", "qcom,ipq8064";
+
+	chosen {
+		bootargs-append = " rootwait";
+	};
+};
+
+&qcom_pinmux {
+	ap3223_pins: ap3223_pinmux {
+		pins = "gpio22";
+		function = "gpio";
+		bias-none;
+	};
+
+	i2c7_pins: i2c7_pinmux {
+		mux {
+			pins = "gpio8", "gpio9";
+			function = "gsbi7";
+		};
+		data {
+			pins = "gpio8";
+			bias-disable;
+		};
+		clk {
+			pins = "gpio9";
+			bias-disable;
+		};
+	};
+};
+
+&gsbi7 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi7_i2c {
+	status = "okay";
+	clock-frequency = <100000>;
+	pinctrl-0 = <&i2c7_pins>;
+	pinctrl-names = "default";
+
+	ap3223@1c {
+		compatible = "dynaimage,ap3223";
+		reg = <0x1c>;
+
+		pinctrl-0 = <&ap3223_pins>;
+		pinctrl-names = "default";
+
+		int-gpio = <&qcom_pinmux 22 GPIO_ACTIVE_LOW>;
+	};
+
+	led-controller@32 {
+		compatible = "national,lp5523";
+		reg = <0x32>;
+		clock-mode = /bits/ 8 <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@4 {
+			reg = <4>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0xfa>;
+			max-cur = /bits/ 8 <0xff>;
+		};
+
+		led@5 {
+			reg = <5>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status";
+			led-cur = /bits/ 8 <0xfa>;
+			max-cur = /bits/ 8 <0xff>;
+		};
+
+		led@8 {
+			reg = <8>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status";
+			led-cur = /bits/ 8 <0xfa>;
+			max-cur = /bits/ 8 <0xff>;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-onhub.dtsi b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-onhub.dtsi
new file mode 100644
index 0000000000..25ba71da00
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-onhub.dtsi
@@ -0,0 +1,463 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2014 The ChromiumOS Authors
+ */
+
+#include "qcom-ipq8064-smb208.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/soc/qcom,tcsr.h>
+
+/ {
+	aliases {
+		ethernet0 = &gmac0;
+		ethernet1 = &gmac2;
+		mdio-gpio0 = &mdio;
+		serial0 = &gsbi4_serial;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		rsvd@41200000 {
+			reg = <0x41200000 0x300000>;
+			no-map;
+		};
+	};
+
+	mdio: mdio {
+		compatible = "virtual,mdio-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH>,
+			<&qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
+		pinctrl-0 = <&mdio_pins>;
+		pinctrl-names = "default";
+
+		phy0: ethernet-phy@0 {
+			reg = <0>;
+			qca,ar8327-initvals = <
+				0x00004 0x7600000   /* PAD0_MODE */
+				0x00008 0x1000000   /* PAD5_MODE */
+				0x0000c 0x80        /* PAD6_MODE */
+				0x000e4 0xaa545     /* MAC_POWER_SEL */
+				0x000e0 0xc74164de  /* SGMII_CTRL */
+				0x0007c 0x4e        /* PORT0_STATUS */
+				0x00094 0x4e        /* PORT6_STATUS */
+				>;
+		};
+
+		phy1: ethernet-phy@1 {
+			reg = <1>;
+		};
+	};
+
+	soc {
+		rng@1a500000 {
+			status = "disabled";
+		};
+
+		sound {
+			compatible = "google,storm-audio";
+			qcom,model = "ipq806x-storm";
+			cpu = <&lpass>;
+			codec = <&max98357a>;
+		};
+
+		lpass: lpass@28100000 {
+			status = "okay";
+			pinctrl-names = "default", "idle";
+			pinctrl-0 = <&mi2s_default>;
+			pinctrl-1 = <&mi2s_idle>;
+		};
+
+		max98357a: max98357a {
+			compatible = "maxim,max98357a";
+			#sound-dai-cells = <1>;
+			pinctrl-names = "default";
+			pinctrl-0 = <&sdmode_pins>;
+			sdmode-gpios = <&qcom_pinmux 25 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&qcom_pinmux {
+	rgmii0_pins: rgmii0_pins {
+		mux {
+			pins = "gpio2", "gpio66";
+			drive-strength = <8>;
+			bias-disable;
+		};
+	};
+	mi2s_pins {
+		mi2s_default: mi2s_default {
+			dout {
+				pins = "gpio32";
+				function = "mi2s";
+				drive-strength = <16>;
+				bias-disable;
+			};
+			sync {
+				pins = "gpio27";
+				function = "mi2s";
+				drive-strength = <16>;
+				bias-disable;
+			};
+			clk {
+				pins = "gpio28";
+				function = "mi2s";
+				drive-strength = <16>;
+				bias-disable;
+			};
+		};
+		mi2s_idle: mi2s_idle {
+			dout {
+				pins = "gpio32";
+				function = "mi2s";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+			sync {
+				pins = "gpio27";
+				function = "mi2s";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+			clk {
+				pins = "gpio28";
+				function = "mi2s";
+				drive-strength = <2>;
+				bias-pull-down;
+			};
+		};
+	};
+
+	mdio_pins: mdio_pins {
+		mux {
+			pins = "gpio0", "gpio1";
+			function = "gpio";
+			drive-strength = <8>;
+			bias-disable;
+		};
+		rst {
+			pins = "gpio26";
+			output-low;
+		};
+	};
+
+	sdmode_pins: sdmode_pinmux {
+		pins = "gpio25";
+		function = "gpio";
+		drive-strength = <16>;
+		bias-disable;
+	};
+
+	sdcc1_pins: sdcc1_pinmux {
+		mux {
+			pins = "gpio38", "gpio39", "gpio40",
+			       "gpio41", "gpio42", "gpio43",
+			       "gpio44", "gpio45", "gpio46",
+			       "gpio47";
+			function = "sdc1";
+		};
+		cmd {
+			pins = "gpio45";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+		data {
+			pins = "gpio38", "gpio39", "gpio40",
+			       "gpio41", "gpio43", "gpio44",
+			       "gpio46", "gpio47";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+		clk {
+			pins = "gpio42";
+			drive-strength = <16>;
+			bias-pull-down;
+		};
+	};
+
+	i2c1_pins: i2c1_pinmux {
+		pins = "gpio53", "gpio54";
+		function = "gsbi1";
+		bias-disable;
+	};
+
+	rpm_i2c_pinmux: rpm_i2c_pinmux {
+		mux {
+			pins = "gpio12", "gpio13";
+			function = "gsbi4";
+			drive-strength = <12>;
+			bias-disable;
+		};
+	};
+
+	spi_pins: spi_pins {
+		mux {
+			pins = "gpio18", "gpio19", "gpio21";
+			function = "gsbi5";
+			bias-pull-down;
+			/delete-property/ bias-none;
+			/delete-property/ drive-strength;
+		};
+		data {
+			pins = "gpio18", "gpio19";
+			drive-strength = <10>;
+		};
+		cs {
+			pins = "gpio20";
+			drive-strength = <10>;
+			bias-pull-up;
+		};
+		clk {
+			pins = "gpio21";
+			drive-strength = <12>;
+		};
+	};
+
+	fw_pinmux {
+		wp {
+			pins = "gpio17";
+			output-low;
+		};
+		recovery {
+			pins = "gpio16";
+			bias-none;
+		};
+		developer {
+			pins = "gpio15";
+			bias-none;
+		};
+	};
+
+	spi6_pins: spi6_pins {
+		mux {
+			pins = "gpio55", "gpio56", "gpio58";
+			function = "gsbi6";
+			bias-pull-down;
+		};
+		data {
+			pins = "gpio55", "gpio56";
+			drive-strength = <10>;
+		};
+		cs {
+			pins = "gpio57";
+			drive-strength = <10>;
+			bias-pull-up;
+			output-high;
+		};
+		clk {
+			pins = "gpio58";
+			drive-strength = <12>;
+		};
+	};
+};
+
+&gmac0 {
+	status = "okay";
+	phy-mode = "rgmii";
+	qcom,id = <0>;
+	phy-handle = <&phy1>;
+
+	pinctrl-0 = <&rgmii0_pins>;
+	pinctrl-names = "default";
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gmac2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	qcom,id = <2>;
+	phy-handle = <&phy0>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&gsbi1 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi1_i2c {
+	status = "okay";
+
+	clock-frequency = <100000>;
+
+	pinctrl-0 = <&i2c1_pins>;
+	pinctrl-names = "default";
+
+	tpm@20 {
+		compatible = "infineon,slb9645tt";
+		reg = <0x20>;
+		powered-while-suspended;
+	};
+};
+
+&gsbi4 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi4_serial {
+	status = "okay";
+};
+
+&gsbi5 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_SPI>;
+
+	spi4: spi@1a280000 {
+		status = "okay";
+		spi-max-frequency = <50000000>;
+		pinctrl-0 = <&spi_pins>;
+		pinctrl-names = "default";
+
+		cs-gpios = <&qcom_pinmux 20 0>;
+
+		flash: flash@0 {
+			compatible = "jedec,spi-nor";
+			spi-max-frequency = <50000000>;
+			reg = <0>;
+		};
+	};
+};
+
+&gsbi6 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_SPI>;
+};
+
+&gsbi6_spi {
+	status = "okay";
+	spi-max-frequency = <25000000>;
+
+	pinctrl-0 = <&spi6_pins>;
+	pinctrl-names = "default";
+
+	cs-gpios = <&qcom_pinmux 57 GPIO_ACTIVE_HIGH>;
+
+	dmas = <&adm_dma 8 0xb>,
+	       <&adm_dma 7 0x14>;
+	dma-names = "rx", "tx";
+
+	/*
+	 * This "spidev" was included in the manufacturer device tree. I suspect
+	 * it's the (unused) Zigbee radio -- SiliconLabs EM3581 Zigbee? There's
+	 * no driver or binding for this at the moment.
+	 */
+	spidev@0 {
+		compatible = "spidev";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	pcie@0 {
+		reg = <0 0 0 0 0>;
+		#interrupt-cells = <1>;
+		#size-cells = <2>;
+		#address-cells = <3>;
+		device_type = "pci";
+
+		ath10k@0,0 {
+			reg = <0 0 0 0 0>;
+			device_type = "pci";
+			qcom,ath10k-sa-gpio = <2 3 4 0>;
+			qcom,ath10k-sa-gpio-func = <5 5 5 0>;
+		};
+	};
+};
+
+&pcie1 {
+	status = "okay";
+
+	pcie@0 {
+		reg = <0 0 0 0 0>;
+		#interrupt-cells = <1>;
+		#size-cells = <2>;
+		#address-cells = <3>;
+		device_type = "pci";
+
+		ath10k@0,0 {
+			reg = <0 0 0 0 0>;
+			device_type = "pci";
+			qcom,ath10k-sa-gpio = <2 3 4 0>;
+			qcom,ath10k-sa-gpio-func = <5 5 5 0>;
+		};
+	};
+};
+
+&pcie2 {
+	status = "okay";
+
+	pcie@0 {
+		reg = <0 0 0 0 0>;
+		#interrupt-cells = <1>;
+		#size-cells = <2>;
+		#address-cells = <3>;
+		device_type = "pci";
+
+		ath10k@0,0 {
+			reg = <0 0 0 0 0>;
+			device_type = "pci";
+		};
+	};
+};
+
+&rpm {
+	pinctrl-0 = <&rpm_i2c_pinmux>;
+	pinctrl-names = "default";
+};
+
+&sdcc1 {
+	status = "okay";
+	pinctrl-0 = <&sdcc1_pins>;
+	pinctrl-names = "default";
+	/delete-property/ mmc-ddr-1_8v;
+};
+
+&tcsr {
+	compatible = "qcom,tcsr-ipq8064", "qcom,tcsr", "syscon";
+	qcom,usb-ctrl-select = <TCSR_USB_SELECT_USB3_DUAL>;
+};
+
+&hs_phy_0 {
+	status = "okay";
+};
+
+&ss_phy_0 {
+	status = "okay";
+};
+
+&usb3_0 {
+	status = "okay";
+};
+
+&hs_phy_1 {
+	status = "okay";
+};
+
+&ss_phy_1 {
+	status = "okay";
+};
+
+&usb3_1 {
+	status = "okay";
+};
diff --git a/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-tplink-onhub.dts b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-tplink-onhub.dts
new file mode 100644
index 0000000000..6dd39f0d95
--- /dev/null
+++ b/target/linux/ipq806x/files-5.15/arch/arm/boot/dts/qcom-ipq8064-tplink-onhub.dts
@@ -0,0 +1,213 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright 2014 The ChromiumOS Authors
+ */
+
+#include "qcom-ipq8064-onhub.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/soc/qcom,gsbi.h>
+
+/ {
+	model = "TP-Link OnHub";
+	compatible = "tplink,onhub", "google,whirlwind-sp5", "qcom,ipq8064";
+
+	chosen {
+		bootargs-append = " rootwait";
+	};
+};
+
+&qcom_pinmux {
+	i2c7_pins: i2c7_pinmux {
+		mux {
+			pins = "gpio8", "gpio9";
+			function = "gsbi7";
+		};
+		data {
+			pins = "gpio8";
+			bias-disable;
+		};
+		clk {
+			pins = "gpio9";
+			bias-disable;
+		};
+	};
+};
+
+&gsbi7 {
+	status = "okay";
+	qcom,mode = <GSBI_PROT_I2C_UART>;
+};
+
+&gsbi7_i2c {
+	status = "okay";
+	clock-frequency = <100000>;
+	pinctrl-0 = <&i2c7_pins>;
+	pinctrl-names = "default";
+
+	led-controller@32 {
+		compatible = "national,lp5523";
+		reg = <0x32>;
+		clock-mode = /bits/ 8 <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@0 {
+			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-0";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-0";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-0";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@3 {
+			reg = <3>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-1";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@4 {
+			reg = <4>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-1";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@5 {
+			reg = <5>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-1";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@6 {
+			reg = <6>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-2";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@7 {
+			reg = <7>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-2";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@8 {
+			reg = <8>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-2";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+	};
+
+	led-controller@33 {
+		compatible = "national,lp5523";
+		reg = <0x33>;
+		clock-mode = /bits/ 8 <1>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		led@0 {
+			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-3";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-3";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-3";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@3 {
+			reg = <3>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-4";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@4 {
+			reg = <4>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-4";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@5 {
+			reg = <5>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-4";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@6 {
+			reg = <6>;
+			color = <LED_COLOR_ID_RED>;
+			chan-name = "red:status-5";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@7 {
+			reg = <7>;
+			color = <LED_COLOR_ID_GREEN>;
+			chan-name = "green:status-5";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+
+		led@8 {
+			reg = <8>;
+			color = <LED_COLOR_ID_BLUE>;
+			chan-name = "blue:status-5";
+			linux,default-trigger = "default-on";
+			led-cur = /bits/ 8 <0x64>;
+			max-cur = /bits/ 8 <0x78>;
+		};
+	};
+};
diff --git a/target/linux/ipq806x/generic/target.mk b/target/linux/ipq806x/generic/target.mk
index f5cb1fb19b..4de636f0e0 100644
--- a/target/linux/ipq806x/generic/target.mk
+++ b/target/linux/ipq806x/generic/target.mk
@@ -1 +1,2 @@
 BOARDNAME:=Generic
+FEATURES += nand
diff --git a/target/linux/ipq806x/image/Makefile b/target/linux/ipq806x/image/Makefile
index f4f829b35c..8c1fc88010 100644
--- a/target/linux/ipq806x/image/Makefile
+++ b/target/linux/ipq806x/image/Makefile
@@ -5,7 +5,6 @@ include $(INCLUDE_DIR)/image.mk
 
 define Device/Default
 	PROFILES := Default
-	KERNEL_DEPENDS = $$(wildcard $(DTS_DIR)/$$(DEVICE_DTS).dts)
 	KERNEL_LOADADDR = 0x42208000
 	DEVICE_DTS = $$(SOC)-$(lastword $(subst _, ,$(1)))
 	DEVICE_DTS_CONFIG := config@1
@@ -22,13 +21,13 @@ endef
 
 define Device/FitImage
 	KERNEL_SUFFIX := -fit-uImage.itb
-	KERNEL = kernel-bin | gzip | fit gzip $$(DTS_DIR)/$$(DEVICE_DTS).dtb
+	KERNEL = kernel-bin | gzip | fit gzip $$(KDIR)/image-$$(DEVICE_DTS).dtb
 	KERNEL_NAME := Image
 endef
 
 define Device/FitImageLzma
 	KERNEL_SUFFIX := -fit-uImage.itb
-	KERNEL = kernel-bin | lzma | fit lzma $$(DTS_DIR)/$$(DEVICE_DTS).dtb
+	KERNEL = kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(DEVICE_DTS).dtb
 	KERNEL_NAME := Image
 endef
 
diff --git a/target/linux/ipq806x/image/chromium.mk b/target/linux/ipq806x/image/chromium.mk
new file mode 100644
index 0000000000..16af6b95ba
--- /dev/null
+++ b/target/linux/ipq806x/image/chromium.mk
@@ -0,0 +1,58 @@
+define Build/cros-gpt
+	cp $@ $@.tmp 2>/dev/null || true
+	ptgen -o $@.tmp -g \
+		-T cros_kernel	-N kernel -p $(CONFIG_TARGET_KERNEL_PARTSIZE)m \
+				-N rootfs -p $(CONFIG_TARGET_ROOTFS_PARTSIZE)m \
+				-N rootfs_data -p \
+				$$((3687-$(CONFIG_TARGET_ROOTFS_PARTSIZE)-\
+				         $(CONFIG_TARGET_KERNEL_PARTSIZE)))m
+	cat $@.tmp >> $@
+	rm $@.tmp
+endef
+
+define Build/append-kernel-part
+	dd if=$(IMAGE_KERNEL) bs=$(CONFIG_TARGET_KERNEL_PARTSIZE)M conv=sync >> $@
+endef
+
+# NB: Chrome OS bootloaders replace the '%U' in command lines with the UUID of
+# the kernel partition it chooses to boot from. This gives a flexible way to
+# consistently build and sign kernels that always use the subsequent
+# (PARTNROFF=1) partition as their rootfs.
+define Build/cros-vboot
+	$(STAGING_DIR_HOST)/bin/cros-vbutil \
+		-k $@ -c "root=PARTUUID=%U/PARTNROFF=1" -o $@.new
+	@mv $@.new $@
+endef
+
+define Device/OnhubImage
+	KERNEL_LOADADDR = 0x44208000
+	SOC := qcom-ipq8064
+	KERNEL_SUFFIX := -fit-zImage.itb.vboot
+	KERNEL_NAME := zImage
+	KERNEL = kernel-bin | fit none $$(KDIR)/image-$$(DEVICE_DTS).dtb | cros-vboot
+	IMAGES := factory.bin sysupgrade.bin
+	IMAGE/factory.bin := cros-gpt | append-kernel-part | append-rootfs
+	IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+	DEVICE_PACKAGES := ath10k-firmware-qca988x-ct e2fsprogs kmod-fs-ext4 losetup \
+			   partx-utils mkf2fs kmod-fs-f2fs \
+			   ucode kmod-google-firmware kmod-tpm-i2c-infineon \
+			   kmod-sound-soc-ipq8064-storm kmod-usb-storage
+endef
+
+define Device/asus_onhub
+	$(call Device/OnhubImage)
+	DEVICE_VENDOR := ASUS
+	DEVICE_MODEL := OnHub SRT-AC1900
+	DEVICE_DTS := $$(SOC)-asus-onhub
+	BOARD_NAME := asus-onhub
+endef
+TARGET_DEVICES += asus_onhub
+
+define Device/tplink_onhub
+	$(call Device/OnhubImage)
+	DEVICE_VENDOR := TP-Link
+	DEVICE_MODEL := OnHub AC1900 Cloud Router
+	DEVICE_DTS := $$(SOC)-tplink-onhub
+	BOARD_NAME := tplink-onhub
+endef
+TARGET_DEVICES += tplink_onhub
diff --git a/target/linux/ipq806x/modules.mk b/target/linux/ipq806x/modules.mk
index 605504b0c3..a2b844d0f0 100644
--- a/target/linux/ipq806x/modules.mk
+++ b/target/linux/ipq806x/modules.mk
@@ -14,3 +14,32 @@ define KernelPackage/phy-qcom-ipq806x-usb/description
 endef
 
 $(eval $(call KernelPackage,phy-qcom-ipq806x-usb))
+
+
+define KernelPackage/sound-soc-ipq8064-storm
+  TITLE:=Qualcomm IPQ8064 SoC support for Google Storm
+  DEPENDS:=@TARGET_ipq806x +kmod-sound-soc-core
+  KCONFIG:=\
+	CONFIG_IPQ_LCC_806X \
+	CONFIG_SND_SOC_QCOM \
+	CONFIG_SND_SOC_STORM \
+	CONFIG_SND_SOC_APQ8016_SBC=n \
+	CONFIG_SND_SOC_SC7180=n
+  FILES:=\
+	$(LINUX_DIR)/drivers/clk/qcom/lcc-ipq806x.ko \
+	$(LINUX_DIR)/sound/soc/codecs/snd-soc-max98357a.ko \
+	$(LINUX_DIR)/sound/soc/qcom/snd-soc-lpass-cpu.ko \
+	$(LINUX_DIR)/sound/soc/qcom/snd-soc-lpass-ipq806x.ko \
+	$(LINUX_DIR)/sound/soc/qcom/snd-soc-lpass-platform.ko \
+	$(LINUX_DIR)/sound/soc/qcom/snd-soc-storm.ko
+  AUTOLOAD:=$(call AutoProbe,lcc-ipq806x \
+	snd-soc-max98357a snd-soc-lpass-ipq806x snd-soc-storm)
+  $(call AddDepends/sound)
+endef
+
+define KernelPackage/sound-soc-ipq8064-storm/description
+ Provides sound support for the Google Storm platform, with a Qualcomm IPQ8064
+ SoC.
+endef
+
+$(eval $(call KernelPackage,sound-soc-ipq8064-storm))
diff --git a/target/linux/ipq806x/patches-5.10/0069-arm-boot-add-dts-files.patch b/target/linux/ipq806x/patches-5.10/0069-arm-boot-add-dts-files.patch
deleted file mode 100644
index 4c42f40e3d..0000000000
--- a/target/linux/ipq806x/patches-5.10/0069-arm-boot-add-dts-files.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 8f68331e14dff9a101f2d0e1d6bec84a031f27ee Mon Sep 17 00:00:00 2001
-From: John Crispin <john@phrozen.org>
-Date: Thu, 9 Mar 2017 11:03:18 +0100
-Subject: [PATCH 69/69] arm: boot: add dts files
-
-Signed-off-by: John Crispin <john@phrozen.org>
----
- arch/arm/boot/dts/Makefile | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
---- a/arch/arm/boot/dts/Makefile
-+++ b/arch/arm/boot/dts/Makefile
-@@ -909,8 +909,30 @@ dtb-$(CONFIG_ARCH_QCOM) += \
- 	qcom-ipq4019-ap.dk04.1-c3.dtb \
- 	qcom-ipq4019-ap.dk07.1-c1.dtb \
- 	qcom-ipq4019-ap.dk07.1-c2.dtb \
-+	qcom-ipq8062-wg2600hp3.dtb \
- 	qcom-ipq8064-ap148.dtb \
- 	qcom-ipq8064-rb3011.dtb \
-+	qcom-ipq8064-c2600.dtb \
-+	qcom-ipq8064-d7800.dtb \
-+	qcom-ipq8064-db149.dtb \
-+	qcom-ipq8064-ap161.dtb \
-+	qcom-ipq8064-ea7500-v1.dtb \
-+	qcom-ipq8064-ea8500.dtb \
-+	qcom-ipq8064-g10.dtb \
-+	qcom-ipq8064-r7500.dtb \
-+	qcom-ipq8064-r7500v2.dtb \
-+	qcom-ipq8064-unifi-ac-hd.dtb \
-+	qcom-ipq8064-wg2600hp.dtb \
-+	qcom-ipq8064-wpq864.dtb \
-+	qcom-ipq8064-wxr-2533dhp.dtb \
-+	qcom-ipq8065-nbg6817.dtb \
-+	qcom-ipq8065-r7800.dtb \
-+	qcom-ipq8065-rt4230w-rev6.dtb \
-+	qcom-ipq8065-tr4400-v2.dtb \
-+	qcom-ipq8065-xr500.dtb \
-+	qcom-ipq8068-ecw5410.dtb \
-+	qcom-ipq8068-mr42.dtb \
-+	qcom-ipq8068-mr52.dtb \
- 	qcom-msm8660-surf.dtb \
- 	qcom-msm8960-cdp.dtb \
- 	qcom-msm8974-fairphone-fp2.dtb \
diff --git a/target/linux/ipq806x/patches-5.15/0069-arm-boot-add-dts-files.patch b/target/linux/ipq806x/patches-5.15/0069-arm-boot-add-dts-files.patch
deleted file mode 100644
index 698df248fb..0000000000
--- a/target/linux/ipq806x/patches-5.15/0069-arm-boot-add-dts-files.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 8f68331e14dff9a101f2d0e1d6bec84a031f27ee Mon Sep 17 00:00:00 2001
-From: John Crispin <john@phrozen.org>
-Date: Thu, 9 Mar 2017 11:03:18 +0100
-Subject: [PATCH 69/69] arm: boot: add dts files
-
-Signed-off-by: John Crispin <john@phrozen.org>
----
- arch/arm/boot/dts/Makefile | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
---- a/arch/arm/boot/dts/Makefile
-+++ b/arch/arm/boot/dts/Makefile
-@@ -957,8 +957,30 @@ dtb-$(CONFIG_ARCH_QCOM) += \
- 	qcom-ipq4019-ap.dk04.1-c3.dtb \
- 	qcom-ipq4019-ap.dk07.1-c1.dtb \
- 	qcom-ipq4019-ap.dk07.1-c2.dtb \
-+	qcom-ipq8062-wg2600hp3.dtb \
- 	qcom-ipq8064-ap148.dtb \
- 	qcom-ipq8064-rb3011.dtb \
-+	qcom-ipq8064-c2600.dtb \
-+	qcom-ipq8064-d7800.dtb \
-+	qcom-ipq8064-db149.dtb \
-+	qcom-ipq8064-ap161.dtb \
-+	qcom-ipq8064-ea7500-v1.dtb \
-+	qcom-ipq8064-ea8500.dtb \
-+	qcom-ipq8064-g10.dtb \
-+	qcom-ipq8064-r7500.dtb \
-+	qcom-ipq8064-r7500v2.dtb \
-+	qcom-ipq8064-unifi-ac-hd.dtb \
-+	qcom-ipq8064-wg2600hp.dtb \
-+	qcom-ipq8064-wpq864.dtb \
-+	qcom-ipq8064-wxr-2533dhp.dtb \
-+	qcom-ipq8065-nbg6817.dtb \
-+	qcom-ipq8065-r7800.dtb \
-+	qcom-ipq8065-rt4230w-rev6.dtb \
-+	qcom-ipq8065-tr4400-v2.dtb \
-+	qcom-ipq8065-xr500.dtb \
-+	qcom-ipq8068-ecw5410.dtb \
-+	qcom-ipq8068-mr42.dtb \
-+	qcom-ipq8068-mr52.dtb \
- 	qcom-msm8226-samsung-s3ve3g.dtb \
- 	qcom-msm8660-surf.dtb \
- 	qcom-msm8960-cdp.dtb \
diff --git a/target/linux/mvebu/image/cortexa9.mk b/target/linux/mvebu/image/cortexa9.mk
index b03e843128..1412e78010 100644
--- a/target/linux/mvebu/image/cortexa9.mk
+++ b/target/linux/mvebu/image/cortexa9.mk
@@ -101,7 +101,7 @@ define Device/kobol_helios4
   IMAGES := sdcard.img.gz
   IMAGE/sdcard.img.gz := boot-scr | boot-img-ext4 | sdcard-img-ext4 | gzip | append-metadata
   SOC := armada-388
-  UBOOT := helios4-u-boot-spl.kwb
+  UBOOT := helios4-u-boot-with-spl.kwb
   BOOT_SCRIPT := clearfog
 endef
 TARGET_DEVICES += kobol_helios4
@@ -278,7 +278,7 @@ define Device/solidrun_clearfog-base-a1
   IMAGES := sdcard.img.gz
   IMAGE/sdcard.img.gz := boot-scr | boot-img-ext4 | sdcard-img-ext4 | gzip | append-metadata
   DEVICE_DTS := armada-388-clearfog-base armada-388-clearfog-pro
-  UBOOT := clearfog-u-boot-spl.kwb
+  UBOOT := clearfog-u-boot-with-spl.kwb
   BOOT_SCRIPT := clearfog
   SUPPORTED_DEVICES += armada-388-clearfog-base
   DEVICE_COMPAT_VERSION := 1.1
@@ -296,7 +296,7 @@ define Device/solidrun_clearfog-pro-a1
   IMAGES := sdcard.img.gz
   IMAGE/sdcard.img.gz := boot-scr | boot-img-ext4 | sdcard-img-ext4 | gzip | append-metadata
   DEVICE_DTS := armada-388-clearfog-pro armada-388-clearfog-base
-  UBOOT := clearfog-u-boot-spl.kwb
+  UBOOT := clearfog-u-boot-with-spl.kwb
   BOOT_SCRIPT := clearfog
   SUPPORTED_DEVICES += armada-388-clearfog armada-388-clearfog-pro
 endef
diff --git a/target/linux/omap/config-5.15 b/target/linux/omap/config-5.15
index 7b0dd7c908..888345c75a 100644
--- a/target/linux/omap/config-5.15
+++ b/target/linux/omap/config-5.15
@@ -25,7 +25,9 @@ CONFIG_ARM=y
 CONFIG_ARM_APPENDED_DTB=y
 CONFIG_ARM_ATAG_DTB_COMPAT=y
 CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_ARM_CPUIDLE=y
 CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_CRYPTO=y
 CONFIG_ARM_ERRATA_430973=y
 CONFIG_ARM_ERRATA_720789=y
 CONFIG_ARM_ERRATA_754322=y
@@ -81,6 +83,7 @@ CONFIG_CMA_SIZE_SEL_MBYTES=y
 # CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
 # CONFIG_CMA_SYSFS is not set
 CONFIG_CMDLINE="root=/dev/mmcblk0p2 rootwait console=ttyO2,115200"
+CONFIG_CMDLINE_FROM_BOOTLOADER=y
 CONFIG_COMMON_CLK=y
 # CONFIG_COMMON_CLK_PALMAS is not set
 # CONFIG_COMMON_CLK_TI_ADPLL is not set
@@ -113,6 +116,7 @@ CONFIG_CPU_HAS_ASID=y
 CONFIG_CPU_IDLE=y
 CONFIG_CPU_IDLE_GOV_LADDER=y
 CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
 CONFIG_CPU_PABRT_V7=y
 CONFIG_CPU_PM=y
 CONFIG_CPU_RMAP=y
@@ -127,11 +131,15 @@ CONFIG_CRC7=y
 CONFIG_CRC_CCITT=y
 CONFIG_CRC_ITU_T=y
 CONFIG_CRC_T10DIF=y
-CONFIG_CRYPTO_BLAKE2S=y
+CONFIG_CRYPTO_AES_ARM=y
+CONFIG_CRYPTO_AES_ARM_BS=y
+CONFIG_CRYPTO_ARCH_HAVE_LIB_CHACHA=y
 CONFIG_CRYPTO_CBC=y
+CONFIG_CRYPTO_CHACHA20_NEON=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_CRCT10DIF=y
+CONFIG_CRYPTO_CRYPTD=y
 CONFIG_CRYPTO_DEFLATE=y
 CONFIG_CRYPTO_DES=y
 CONFIG_CRYPTO_DEV_OMAP=y
@@ -143,6 +151,7 @@ CONFIG_CRYPTO_DRBG_HMAC=y
 CONFIG_CRYPTO_DRBG_MENU=y
 CONFIG_CRYPTO_ECB=y
 CONFIG_CRYPTO_ENGINE=y
+CONFIG_CRYPTO_GHASH_ARM_CE=y
 CONFIG_CRYPTO_HASH_INFO=y
 CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_HW=y
@@ -157,8 +166,13 @@ CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_RNG_DEFAULT=y
 CONFIG_CRYPTO_SEQIV=y
 CONFIG_CRYPTO_SHA1=y
+CONFIG_CRYPTO_SHA1_ARM=y
+CONFIG_CRYPTO_SHA1_ARM_NEON=y
 CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM=y
 CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA512_ARM=y
+CONFIG_CRYPTO_SIMD=y
 CONFIG_CRYPTO_ZSTD=y
 CONFIG_DCACHE_WORD_ACCESS=y
 CONFIG_DDR=y
@@ -195,6 +209,7 @@ CONFIG_DRM_SIMPLE_BRIDGE=y
 CONFIG_DRM_TI_TFP410=y
 CONFIG_DRM_TI_TPD12S015=y
 CONFIG_DTC=y
+CONFIG_DT_IDLE_STATES=y
 CONFIG_EDAC_ATOMIC_SCRUB=y
 CONFIG_EDAC_SUPPORT=y
 CONFIG_EEPROM_93CX6=y
@@ -317,9 +332,11 @@ CONFIG_LZO_COMPRESS=y
 CONFIG_LZO_DECOMPRESS=y
 CONFIG_MACH_OMAP_GENERIC=y
 CONFIG_MAGIC_SYSRQ=y
+CONFIG_MDIO_BITBANG=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
+# CONFIG_MDIO_GPIO is not set
 CONFIG_MEMFD_CREATE=y
 CONFIG_MEMORY=y
 CONFIG_MEMORY_ISOLATION=y
diff --git a/target/linux/ramips/dts/mt7621_tplink_er605-v2.dts b/target/linux/ramips/dts/mt7621_tplink_er605-v2.dts
index 3381e598bd..04935e3e99 100644
--- a/target/linux/ramips/dts/mt7621_tplink_er605-v2.dts
+++ b/target/linux/ramips/dts/mt7621_tplink_er605-v2.dts
@@ -12,6 +12,9 @@
 
 	chosen {
 		bootargs = "console=ttyS0,115200 noinitrd";
+		// Override bootargs because u-boot passes wrong root parameter.
+		// Instead allow kernel determine root automatically by looking for rootfs volume
+		bootargs-override = "console=ttyS0,115200 noinitrd ubi.mtd=3,2048";
 	};
 
 	aliases {
diff --git a/target/linux/realtek/files-5.10/drivers/clocksource/timer-rtl-otto.c b/target/linux/realtek/files-5.10/drivers/clocksource/timer-rtl-otto.c
index 14e28e50f4..c096d8742b 100644
--- a/target/linux/realtek/files-5.10/drivers/clocksource/timer-rtl-otto.c
+++ b/target/linux/realtek/files-5.10/drivers/clocksource/timer-rtl-otto.c
@@ -244,7 +244,7 @@ static int rttm_cpu_starting(unsigned int cpu)
 
 	RTTM_DEBUG(to->of_base.base);
 	to->clkevt.cpumask = cpumask_of(cpu);
-	irq_set_affinity(to->of_irq.irq, to->clkevt.cpumask);
+	irq_force_affinity(to->of_irq.irq, to->clkevt.cpumask);
 	clockevents_config_and_register(&to->clkevt, RTTM_TICKS_PER_SEC,
 					RTTM_MIN_DELTA, RTTM_MAX_DELTA);
 	rttm_enable_irq(to->of_base.base);
diff --git a/target/linux/realtek/files-5.15/drivers/clocksource/timer-rtl-otto.c b/target/linux/realtek/files-5.15/drivers/clocksource/timer-rtl-otto.c
index 14e28e50f4..c096d8742b 100644
--- a/target/linux/realtek/files-5.15/drivers/clocksource/timer-rtl-otto.c
+++ b/target/linux/realtek/files-5.15/drivers/clocksource/timer-rtl-otto.c
@@ -244,7 +244,7 @@ static int rttm_cpu_starting(unsigned int cpu)
 
 	RTTM_DEBUG(to->of_base.base);
 	to->clkevt.cpumask = cpumask_of(cpu);
-	irq_set_affinity(to->of_irq.irq, to->clkevt.cpumask);
+	irq_force_affinity(to->of_irq.irq, to->clkevt.cpumask);
 	clockevents_config_and_register(&to->clkevt, RTTM_TICKS_PER_SEC,
 					RTTM_MIN_DELTA, RTTM_MAX_DELTA);
 	rttm_enable_irq(to->of_base.base);
diff --git a/toolchain/binutils/Config.in b/toolchain/binutils/Config.in
index 7fe797a5aa..dbcaf4afce 100644
--- a/toolchain/binutils/Config.in
+++ b/toolchain/binutils/Config.in
@@ -17,6 +17,10 @@ choice
 	config BINUTILS_USE_VERSION_2_39
 		bool "Binutils 2.39"
 		select BINUTILS_VERSION_2_39
+
+	config BINUTILS_USE_VERSION_2_40
+		bool "Binutils 2.40"
+		select BINUTILS_VERSION_2_40
 endchoice
 
 config EXTRA_BINUTILS_CONFIG_OPTIONS
diff --git a/toolchain/binutils/Config.version b/toolchain/binutils/Config.version
index eac97877fc..479a8459fe 100644
--- a/toolchain/binutils/Config.version
+++ b/toolchain/binutils/Config.version
@@ -9,8 +9,12 @@ config BINUTILS_VERSION_2_39
 	default y if !TOOLCHAINOPTS
 	bool
 
+config BINUTILS_VERSION_2_40
+	bool
+
 config BINUTILS_VERSION
 	string
 	default "2.37"			if BINUTILS_VERSION_2_37
 	default "2.38"			if BINUTILS_VERSION_2_38
 	default "2.39"			if BINUTILS_VERSION_2_39
+	default "2.40"			if BINUTILS_VERSION_2_40
diff --git a/toolchain/binutils/Makefile b/toolchain/binutils/Makefile
index 2903f8a791..cf65e83e6f 100644
--- a/toolchain/binutils/Makefile
+++ b/toolchain/binutils/Makefile
@@ -15,22 +15,6 @@ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 
 TAR_OPTIONS += --exclude='*.rej'
 
-ifeq ($(PKG_VERSION),2.32)
-  PKG_HASH:=0ab6c55dd86a92ed561972ba15b9b70a8b9f75557f896446c82e8b36e473ee04
-endif
-
-ifeq ($(PKG_VERSION),2.34)
-  PKG_HASH:=f00b0e8803dc9bab1e2165bd568528135be734df3fabf8d0161828cd56028952
-endif
-
-ifeq ($(PKG_VERSION),2.35.2)
-  PKG_HASH:=dcd5b0416e7b0a9b24bed76cd8c6c132526805761863150a26d016415b8bdc7b
-endif
-
-ifeq ($(PKG_VERSION),2.36.1)
-  PKG_HASH:=e81d9edf373f193af428a0f256674aea62a9d74dfe93f65192d4eae030b0f3b0
-endif
-
 ifeq ($(PKG_VERSION),2.37)
   PKG_HASH:=820d9724f020a3e69cb337893a0b63c2db161dadcb0e06fc11dc29eb1e84a32c
 endif
@@ -43,6 +27,10 @@ ifeq ($(PKG_VERSION),2.39)
   PKG_HASH:=645c25f563b8adc0a81dbd6a41cffbf4d37083a382e02d5d3df4f65c09516d00
 endif
 
+ifeq ($(PKG_VERSION),2.40)
+  PKG_HASH:=0f8a4c272d7f17f369ded10a4aca28b8e304828e95526da482b0ccc4dfc9d8e1
+endif
+
 HOST_BUILD_PARALLEL:=1
 
 PATCH_DIR:=./patches/$(PKG_VERSION)
diff --git a/toolchain/binutils/patches/2.40/300-001_ld_makefile_patch.patch b/toolchain/binutils/patches/2.40/300-001_ld_makefile_patch.patch
new file mode 100644
index 0000000000..2dafd92a01
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/300-001_ld_makefile_patch.patch
@@ -0,0 +1,22 @@
+--- a/ld/Makefile.am
++++ b/ld/Makefile.am
+@@ -50,7 +50,7 @@ AM_CFLAGS = $(WARN_CFLAGS) $(ELF_CLFAGS)
+ # We put the scripts in the directory $(scriptdir)/ldscripts.
+ # We can't put the scripts in $(datadir) because the SEARCH_DIR
+ # directives need to be different for native and cross linkers.
+-scriptdir = $(tooldir)/lib
++scriptdir = $(libdir)
+ 
+ EMUL = @EMUL@
+ EMULATION_OFILES = @EMULATION_OFILES@
+--- a/ld/Makefile.in
++++ b/ld/Makefile.in
+@@ -573,7 +573,7 @@ AM_CFLAGS = $(WARN_CFLAGS) $(ELF_CLFAGS)
+ # We put the scripts in the directory $(scriptdir)/ldscripts.
+ # We can't put the scripts in $(datadir) because the SEARCH_DIR
+ # directives need to be different for native and cross linkers.
+-scriptdir = $(tooldir)/lib
++scriptdir = $(libdir)
+ BASEDIR = $(srcdir)/..
+ BFDDIR = $(BASEDIR)/bfd
+ INCDIR = $(BASEDIR)/include
diff --git a/toolchain/binutils/patches/2.40/400-mips_no_dynamic_linking_sym.patch b/toolchain/binutils/patches/2.40/400-mips_no_dynamic_linking_sym.patch
new file mode 100644
index 0000000000..aeb5a993a6
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/400-mips_no_dynamic_linking_sym.patch
@@ -0,0 +1,18 @@
+--- a/bfd/elfxx-mips.c
++++ b/bfd/elfxx-mips.c
+@@ -8119,6 +8119,7 @@ _bfd_mips_elf_create_dynamic_sections (b
+ 
+       name = SGI_COMPAT (abfd) ? "_DYNAMIC_LINK" : "_DYNAMIC_LINKING";
+       bh = NULL;
++      if (0) {
+       if (!(_bfd_generic_link_add_one_symbol
+ 	    (info, abfd, name, BSF_GLOBAL, bfd_abs_section_ptr, 0,
+ 	     NULL, false, get_elf_backend_data (abfd)->collect, &bh)))
+@@ -8131,6 +8132,7 @@ _bfd_mips_elf_create_dynamic_sections (b
+ 
+       if (! bfd_elf_link_record_dynamic_symbol (info, h))
+ 	return false;
++      }
+ 
+       if (! mips_elf_hash_table (info)->use_rld_obj_head)
+ 	{
diff --git a/toolchain/binutils/patches/2.40/500-Change-default-emulation-for-mips64-linux.patch b/toolchain/binutils/patches/2.40/500-Change-default-emulation-for-mips64-linux.patch
new file mode 100644
index 0000000000..14a18a1d80
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/500-Change-default-emulation-for-mips64-linux.patch
@@ -0,0 +1,38 @@
+--- a/bfd/config.bfd
++++ b/bfd/config.bfd
+@@ -944,12 +944,12 @@ case "${targ}" in
+     targ_selvecs="mips_elf32_le_vec mips_elf64_be_vec mips_elf64_le_vec mips_ecoff_be_vec mips_ecoff_le_vec"
+     ;;
+   mips64*el-*-linux*)
+-    targ_defvec=mips_elf32_ntrad_le_vec
+-    targ_selvecs="mips_elf32_ntrad_be_vec mips_elf32_trad_le_vec mips_elf32_trad_be_vec mips_elf64_trad_le_vec mips_elf64_trad_be_vec"
++    targ_defvec=mips_elf64_trad_le_vec
++    targ_selvecs="mips_elf32_ntrad_le_vec mips_elf32_ntrad_be_vec mips_elf32_trad_le_vec mips_elf32_trad_be_vec mips_elf64_trad_be_vec"
+     ;;
+   mips64*-*-linux*)
+-    targ_defvec=mips_elf32_ntrad_be_vec
+-    targ_selvecs="mips_elf32_ntrad_le_vec mips_elf32_trad_be_vec mips_elf32_trad_le_vec mips_elf64_trad_be_vec mips_elf64_trad_le_vec"
++    targ_defvec=mips_elf64_trad_be_vec
++    targ_selvecs="mips_elf32_ntrad_be_vec mips_elf32_ntrad_le_vec mips_elf32_trad_be_vec mips_elf32_trad_le_vec mips_elf64_trad_le_vec"
+     ;;
+   mips*el-*-linux*)
+     targ_defvec=mips_elf32_trad_le_vec
+--- a/ld/configure.tgt
++++ b/ld/configure.tgt
+@@ -585,12 +585,12 @@ mips*-*-vxworks*)	targ_emul=elf32ebmipvx
+ 			;;
+ mips*-*-windiss)	targ_emul=elf32mipswindiss
+ 			;;
+-mips64*el-*-linux-*)	targ_emul=elf32ltsmipn32
+-			targ_extra_emuls="elf32btsmipn32 elf32ltsmip elf32btsmip elf64ltsmip elf64btsmip"
++mips64*el-*-linux-*)	targ_emul=elf64ltsmip
++			targ_extra_emuls="elf32btsmipn32 elf32ltsmipn32 elf32ltsmip elf32btsmip elf64btsmip"
+ 			targ_extra_libpath=$targ_extra_emuls
+ 			;;
+-mips64*-*-linux-*)	targ_emul=elf32btsmipn32
+-			targ_extra_emuls="elf32ltsmipn32 elf32btsmip elf32ltsmip elf64btsmip elf64ltsmip"
++mips64*-*-linux-*)	targ_emul=elf64btsmip
++			targ_extra_emuls="elf32btsmipn32 elf32ltsmipn32 elf32btsmip elf32ltsmip elf64ltsmip"
+ 			targ_extra_libpath=$targ_extra_emuls
+ 			;;
+ mips*el-*-linux-*)	targ_emul=elf32ltsmip
diff --git a/toolchain/musl/patches/800-mips_pie_debug.patch b/toolchain/musl/patches/800-mips_pie_debug.patch
new file mode 100644
index 0000000000..80fe15e841
--- /dev/null
+++ b/toolchain/musl/patches/800-mips_pie_debug.patch
@@ -0,0 +1,61 @@
+Fix DT_DEBUG handling on MIPS in musl libc.
+With this change gdb will load the symbol files for shared libraries on MIPS too.
+
+This patch was taken from this thread: https://www.openwall.com/lists/musl/2022/01/09/4
+
+--- a/arch/mips/reloc.h
++++ b/arch/mips/reloc.h
+@@ -29,6 +29,7 @@
+ 
+ #define NEED_MIPS_GOT_RELOCS 1
+ #define DT_DEBUG_INDIRECT DT_MIPS_RLD_MAP
++#define DT_DEBUG_INDIRECT_REL DT_MIPS_RLD_MAP_REL
+ #define ARCH_SYM_REJECT_UND(s) (!((s)->st_other & STO_MIPS_PLT))
+ 
+ #define CRTJMP(pc,sp) __asm__ __volatile__( \
+--- a/arch/mips64/reloc.h
++++ b/arch/mips64/reloc.h
+@@ -38,6 +38,7 @@
+ 
+ #define NEED_MIPS_GOT_RELOCS 1
+ #define DT_DEBUG_INDIRECT DT_MIPS_RLD_MAP
++#define DT_DEBUG_INDIRECT_REL DT_MIPS_RLD_MAP_REL
+ #define ARCH_SYM_REJECT_UND(s) (!((s)->st_other & STO_MIPS_PLT))
+ 
+ #define CRTJMP(pc,sp) __asm__ __volatile__( \
+--- a/arch/mipsn32/reloc.h
++++ b/arch/mipsn32/reloc.h
+@@ -29,6 +29,7 @@
+ 
+ #define NEED_MIPS_GOT_RELOCS 1
+ #define DT_DEBUG_INDIRECT DT_MIPS_RLD_MAP
++#define DT_DEBUG_INDIRECT_REL DT_MIPS_RLD_MAP_REL
+ #define ARCH_SYM_REJECT_UND(s) (!((s)->st_other & STO_MIPS_PLT))
+ 
+ #define CRTJMP(pc,sp) __asm__ __volatile__( \
+--- a/ldso/dynlink.c
++++ b/ldso/dynlink.c
+@@ -1923,6 +1923,10 @@ void __dls3(size_t *sp, size_t *auxv)
+ 			size_t *ptr = (size_t *) app.dynv[i+1];
+ 			*ptr = (size_t)&debug;
+ 		}
++		if (app.dynv[i]==DT_DEBUG_INDIRECT_REL) {
++			size_t *ptr = (size_t *)((size_t)&app.dynv[i] + app.dynv[i+1]);
++			*ptr = (size_t)&debug;
++		}
+ 	}
+ 
+ 	/* This must be done before final relocations, since it calls
+--- a/src/internal/dynlink.h
++++ b/src/internal/dynlink.h
+@@ -92,6 +92,10 @@ struct fdpic_dummy_loadmap {
+ #define DT_DEBUG_INDIRECT 0
+ #endif
+ 
++#ifndef DT_DEBUG_INDIRECT_REL
++#define DT_DEBUG_INDIRECT_REL 0
++#endif
++
+ #define AUX_CNT 32
+ #define DYN_CNT 32
+