diff --git a/include/scan.mk b/include/scan.mk
index aee24cb3e5..5032afa818 100644
--- a/include/scan.mk
+++ b/include/scan.mk
@@ -72,7 +72,7 @@ endif
 
 $(FILELIST): $(OVERRIDELIST)
 	rm -f $(TMP_DIR)/info/.files-$(SCAN_TARGET)-*
-	find -L $(SCAN_DIR) $(SCAN_EXTRA) -mindepth 1 $(if $(SCAN_DEPTH),-maxdepth $(SCAN_DEPTH)) -name Makefile | xargs grep -aHE 'call $(GREP_STRING)' | sed -e 's#^$(SCAN_DIR)/##' -e 's#/Makefile:.*##' | uniq | awk -v of=$(OVERRIDELIST) -f include/scan.awk > $@
+	find -L $(SCAN_DIR) -mindepth 1 $(if $(SCAN_DEPTH),-maxdepth $(SCAN_DEPTH)) $(SCAN_EXTRA) -name Makefile | xargs grep -aHE 'call $(GREP_STRING)' | sed -e 's#^$(SCAN_DIR)/##' -e 's#/Makefile:.*##' | uniq | awk -v of=$(OVERRIDELIST) -f include/scan.awk > $@
 
 $(TMP_DIR)/info/.files-$(SCAN_TARGET).mk: $(FILELIST)
 	( \
diff --git a/package/boot/uboot-envtools/files/ipq40xx b/package/boot/uboot-envtools/files/ipq40xx
index 9a71a622f7..1937f9d1ce 100644
--- a/package/boot/uboot-envtools/files/ipq40xx
+++ b/package/boot/uboot-envtools/files/ipq40xx
@@ -60,6 +60,9 @@ linksys,ea8300|\
 linksys,mr8300)
 	ubootenv_add_uci_config "/dev/mtd7" "0x0" "0x40000" "0x20000"
 	;;
+linksys,whw01-v1)
+	ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x40000" "0x10000"
+	;;
 zyxel,nbg6617)
 	ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x10000" "0x10000"
 	;;
diff --git a/package/boot/uboot-envtools/files/realtek b/package/boot/uboot-envtools/files/realtek
index 99a73a6ab1..af48d27078 100644
--- a/package/boot/uboot-envtools/files/realtek
+++ b/package/boot/uboot-envtools/files/realtek
@@ -17,6 +17,7 @@ zyxel,gs1900-8hp-v2|\
 zyxel,gs1900-10hp|\
 zyxel,gs1900-16|\
 zyxel,gs1900-24-v1|\
+zyxel,gs1900-24e|\
 zyxel,gs1900-24hp-v1|\
 zyxel,gs1900-24hp-v2)
 	idx="$(find_mtd_index u-boot-env)"
diff --git a/package/kernel/ksmbd/Makefile b/package/kernel/ksmbd/Makefile
index 842a22c82a..0f79644552 100644
--- a/package/kernel/ksmbd/Makefile
+++ b/package/kernel/ksmbd/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ksmbd
-PKG_VERSION:=3.4.3
+PKG_VERSION:=3.4.5
 PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/cifsd-team/cifsd/tar.gz/$(PKG_VERSION)?
-PKG_HASH:=a910c55d9e6924775e00504eddd00b49788603af29d0772cb9fb6722c189f628
+PKG_HASH:=2873c8ba1027fc5b04c5f5344804ef1469ad7019a033456c16ca4aa3f2c161f0
 
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=COPYING
diff --git a/package/kernel/ksmbd/patches/02-ipc-reserved-memory.patch b/package/kernel/ksmbd/patches/02-ipc-reserved-memory.patch
deleted file mode 100644
index 478af1e7db..0000000000
--- a/package/kernel/ksmbd/patches/02-ipc-reserved-memory.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-From 41dbda16a0902798e732abc6599de256b9dc3b27 Mon Sep 17 00:00:00 2001
-From: Namjae Jeon <linkinjeon@kernel.org>
-Date: Thu, 6 Jan 2022 10:30:31 +0900
-Subject: ksmbd: add reserved room in ipc request/response
-
-Whenever new parameter is added to smb configuration, It is possible
-to break the execution of the IPC daemon by mismatch size of
-request/response. This patch tries to reserve space in ipc request/response
-in advance to prevent that.
-
-Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
-Signed-off-by: Steve French <stfrench@microsoft.com>
----
- fs/ksmbd/ksmbd_netlink.h | 11 ++++++++++-
- 1 file changed, 10 insertions(+), 1 deletion(-)
-
---- a/ksmbd_netlink.h
-+++ b/ksmbd_netlink.h
-@@ -103,6 +103,7 @@ struct ksmbd_startup_request {
- 					 * we set the SPARSE_FILES bit (0x40).
- 					 */
- 	__u32	sub_auth[3];		/* Subauth value for Security ID */
-+	__u32	reserved[128];		/* Reserved room */
- 	__u32	ifc_list_sz;		/* interfaces list size */
- 	__s8	____payload[];
- };
-@@ -113,7 +114,7 @@ struct ksmbd_startup_request {
-  * IPC request to shutdown ksmbd server.
-  */
- struct ksmbd_shutdown_request {
--	__s32	reserved;
-+	__s32	reserved[16];
- };
- 
- /*
-@@ -122,6 +123,7 @@ struct ksmbd_shutdown_request {
- struct ksmbd_login_request {
- 	__u32	handle;
- 	__s8	account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ]; /* user account name */
-+	__u32	reserved[16];				/* Reserved room */
- };
- 
- /*
-@@ -135,6 +137,7 @@ struct ksmbd_login_response {
- 	__u16	status;
- 	__u16	hash_sz;			/* hash size */
- 	__s8	hash[KSMBD_REQ_MAX_HASH_SZ];	/* password hash */
-+	__u32	reserved[16];			/* Reserved room */
- };
- 
- /*
-@@ -143,6 +146,7 @@ struct ksmbd_login_response {
- struct ksmbd_share_config_request {
- 	__u32	handle;
- 	__s8	share_name[KSMBD_REQ_MAX_SHARE_NAME]; /* share name */
-+	__u32	reserved[16];		/* Reserved room */
- };
- 
- /*
-@@ -157,6 +161,7 @@ struct ksmbd_share_config_response {
- 	__u16	force_directory_mode;
- 	__u16	force_uid;
- 	__u16	force_gid;
-+	__u32	reserved[128];		/* Reserved room */
- 	__u32	veto_list_sz;
- 	__s8	____payload[];
- };
-@@ -187,6 +192,7 @@ struct ksmbd_tree_connect_request {
- 	__s8	account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ];
- 	__s8	share[KSMBD_REQ_MAX_SHARE_NAME];
- 	__s8	peer_addr[64];
-+	__u32	reserved[16];		/* Reserved room */
- };
- 
- /*
-@@ -196,6 +202,7 @@ struct ksmbd_tree_connect_response {
- 	__u32	handle;
- 	__u16	status;
- 	__u16	connection_flags;
-+	__u32	reserved[16];		/* Reserved room */
- };
- 
- /*
-@@ -204,6 +211,7 @@ struct ksmbd_tree_connect_response {
- struct ksmbd_tree_disconnect_request {
- 	__u64	session_id;	/* session id */
- 	__u64	connect_id;	/* tree connection id */
-+	__u32	reserved[16];	/* Reserved room */
- };
- 
- /*
-@@ -212,6 +220,7 @@ struct ksmbd_tree_disconnect_request {
- struct ksmbd_logout_request {
- 	__s8	account[KSMBD_REQ_MAX_ACCOUNT_NAME_SZ]; /* user account name */
- 	__u32	account_flags;
-+	__u32	reserved[16];				/* Reserved room */
- };
- 
- /*
diff --git a/package/kernel/linux/modules/netdevices.mk b/package/kernel/linux/modules/netdevices.mk
index cf2fb19fc7..3bef10e9fb 100644
--- a/package/kernel/linux/modules/netdevices.mk
+++ b/package/kernel/linux/modules/netdevices.mk
@@ -417,6 +417,22 @@ endef
 $(eval $(call KernelPackage,switch-rtl8367b))
 
 
+define KernelPackage/switch-ar8xxx
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Atheros AR8216/8327 switch support
+  DEPENDS:=+kmod-swconfig
+  KCONFIG:=CONFIG_AR8216_PHY
+  FILES:=$(LINUX_DIR)/drivers/net/phy/ar8xxx.ko
+  AUTOLOAD:=$(call AutoLoad,43,ar8xxx,1)
+endef
+
+define KernelPackage/switch-ar8xxx/description
+ Atheros AR8216/8327 switch support
+endef
+
+$(eval $(call KernelPackage,switch-ar8xxx))
+
+
 define KernelPackage/natsemi
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=National Semiconductor DP8381x series
diff --git a/package/kernel/mac80211/patches/subsys/330-mac80211-fix-overflow-issues-in-airtime-fairness-cod.patch b/package/kernel/mac80211/patches/subsys/330-mac80211-fix-overflow-issues-in-airtime-fairness-cod.patch
new file mode 100644
index 0000000000..037ab8e180
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/330-mac80211-fix-overflow-issues-in-airtime-fairness-cod.patch
@@ -0,0 +1,132 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 28 May 2022 16:44:53 +0200
+Subject: [PATCH] mac80211: fix overflow issues in airtime fairness code
+
+The airtime weight calculation overflows with a default weight value of 256
+whenever more than 8ms worth of airtime is reported.
+Bigger weight values impose even smaller limits on maximum airtime values.
+This can mess up airtime based calculations for drivers that don't report
+per-PPDU airtime values, but batch up values instead.
+
+Fix this by reordering multiplications/shifts and by reducing unnecessary
+intermediate precision (which was lost in a later stage anyway).
+
+The new shift value limits the maximum weight to 4096, which should be more
+than enough. Any values bigger than that will be clamped to the upper limit.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1666,50 +1666,34 @@ static inline struct airtime_info *to_ai
+ /* To avoid divisions in the fast path, we keep pre-computed reciprocals for
+  * airtime weight calculations. There are two different weights to keep track
+  * of: The per-station weight and the sum of weights per phy.
+- *
+- * For the per-station weights (kept in airtime_info below), we use 32-bit
+- * reciprocals with a devisor of 2^19. This lets us keep the multiplications and
+- * divisions for the station weights as 32-bit operations at the cost of a bit
+- * of rounding error for high weights; but the choice of divisor keeps rounding
+- * errors <10% for weights <2^15, assuming no more than 8ms of airtime is
+- * reported at a time.
+- *
+- * For the per-phy sum of weights the values can get higher, so we use 64-bit
+- * operations for those with a 32-bit divisor, which should avoid any
+- * significant rounding errors.
++ * The per-sta shift value supports weight values of 1-4096
+  */
+-#define IEEE80211_RECIPROCAL_DIVISOR_64 0x100000000ULL
+-#define IEEE80211_RECIPROCAL_SHIFT_64 32
+-#define IEEE80211_RECIPROCAL_DIVISOR_32 0x80000U
+-#define IEEE80211_RECIPROCAL_SHIFT_32 19
++#define IEEE80211_RECIPROCAL_SHIFT_SUM	24
++#define IEEE80211_RECIPROCAL_SHIFT_STA	12
++#define IEEE80211_WEIGHT_SHIFT		8
+ 
+-static inline void airtime_weight_set(struct airtime_info *air_info, u16 weight)
++static inline void airtime_weight_set(struct airtime_info *air_info, u32 weight)
+ {
++	weight = min_t(u32, weight, BIT(IEEE80211_RECIPROCAL_SHIFT_STA));
+ 	if (air_info->weight == weight)
+ 		return;
+ 
+ 	air_info->weight = weight;
+-	if (weight) {
+-		air_info->weight_reciprocal =
+-			IEEE80211_RECIPROCAL_DIVISOR_32 / weight;
+-	} else {
+-		air_info->weight_reciprocal = 0;
+-	}
++	if (weight)
++		weight = BIT(IEEE80211_RECIPROCAL_SHIFT_STA) / weight;
++	air_info->weight_reciprocal = weight;
+ }
+ 
+ static inline void airtime_weight_sum_set(struct airtime_sched_info *air_sched,
+-					  int weight_sum)
++					  u32 weight_sum)
+ {
+ 	if (air_sched->weight_sum == weight_sum)
+ 		return;
+ 
+ 	air_sched->weight_sum = weight_sum;
+-	if (air_sched->weight_sum) {
+-		air_sched->weight_sum_reciprocal = IEEE80211_RECIPROCAL_DIVISOR_64;
+-		do_div(air_sched->weight_sum_reciprocal, air_sched->weight_sum);
+-	} else {
+-		air_sched->weight_sum_reciprocal = 0;
+-	}
++	if (weight_sum)
++		weight_sum = BIT(IEEE80211_RECIPROCAL_SHIFT_SUM) / weight_sum;
++	air_sched->weight_sum_reciprocal = weight_sum;
+ }
+ 
+ /* A problem when trying to enforce airtime fairness is that we want to divide
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1894,9 +1894,9 @@ void ieee80211_register_airtime(struct i
+ {
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->vif);
+ 	struct ieee80211_local *local = sdata->local;
+-	u64 weight_sum, weight_sum_reciprocal;
+ 	struct airtime_sched_info *air_sched;
+ 	struct airtime_info *air_info;
++	u64 weight_sum_reciprocal;
+ 	u32 airtime = 0;
+ 
+ 	air_sched = &local->airtime[txq->ac];
+@@ -1907,27 +1907,21 @@ void ieee80211_register_airtime(struct i
+ 	if (local->airtime_flags & AIRTIME_USE_RX)
+ 		airtime += rx_airtime;
+ 
+-	/* Weights scale so the unit weight is 256 */
+-	airtime <<= 8;
+-
+ 	spin_lock_bh(&air_sched->lock);
+ 
+ 	air_info->tx_airtime += tx_airtime;
+ 	air_info->rx_airtime += rx_airtime;
+ 
+-	if (air_sched->weight_sum) {
+-		weight_sum = air_sched->weight_sum;
++	if (air_sched->weight_sum)
+ 		weight_sum_reciprocal = air_sched->weight_sum_reciprocal;
+-	} else {
+-		weight_sum = air_info->weight;
++	else
+ 		weight_sum_reciprocal = air_info->weight_reciprocal;
+-	}
+ 
+ 	/* Round the calculation of global vt */
+-	air_sched->v_t += (u64)((airtime + (weight_sum >> 1)) *
+-				weight_sum_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_64;
+-	air_info->v_t += (u32)((airtime + (air_info->weight >> 1)) *
+-			       air_info->weight_reciprocal) >> IEEE80211_RECIPROCAL_SHIFT_32;
++	air_sched->v_t += ((u64)airtime * weight_sum_reciprocal) >>
++			  (IEEE80211_RECIPROCAL_SHIFT_SUM - IEEE80211_WEIGHT_SHIFT);
++	air_info->v_t += (airtime * air_info->weight_reciprocal) >>
++			 (IEEE80211_RECIPROCAL_SHIFT_STA - IEEE80211_WEIGHT_SHIFT);
+ 	ieee80211_resort_txq(&local->hw, txq);
+ 
+ 	spin_unlock_bh(&air_sched->lock);
diff --git a/package/kernel/mac80211/patches/subsys/331-mac80211-rework-the-airtime-fairness-implementation.patch b/package/kernel/mac80211/patches/subsys/331-mac80211-rework-the-airtime-fairness-implementation.patch
new file mode 100644
index 0000000000..39538b122e
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/331-mac80211-rework-the-airtime-fairness-implementation.patch
@@ -0,0 +1,852 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 28 May 2022 16:51:51 +0200
+Subject: [PATCH] mac80211: rework the airtime fairness implementation
+
+The current ATF implementation has a number of issues which have shown up
+during testing. Since it does not take into account the AQL budget of
+pending packets, the implementation might queue up large amounts of packets
+for a single txq until airtime gets reported after tx completion.
+The same then happens to the next txq afterwards. While the end result could
+still be considered fair, the bursty behavior introduces a large amount of
+latency.
+The current code also tries to avoid frequent re-sorting of txq entries in
+order to avoid having to re-balance the rbtree often.
+
+In order to fix these issues, introduce skip lists as a data structure, which
+offer similar lookup/insert/delete times as rbtree, but avoids the need for
+rebalacing by being probabilistic.
+Use this to keep tx entries sorted by virtual time + pending AQL budget and
+re-sort after each ieee80211_return_txq call.
+
+Since multiple txqs share a single air_time struct with a virtual time value,
+switch the active_txqs list to queue up air_time structs instead of queues.
+This helps avoid imbalance between shared txqs by servicing them round robin.
+
+ieee80211_next_txq now only dequeues the first element of active_txqs. To
+make that work for non-AQL or non-ATF drivers as well, add estimated tx
+airtime directly to air_info virtual time if either AQL or ATF is not
+supported.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ create mode 100644 include/linux/skiplist.h
+
+--- /dev/null
++++ b/include/linux/skiplist.h
+@@ -0,0 +1,250 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * A skip list is a probabilistic alternative to balanced trees. Unlike the
++ * red-black tree, it does not require rebalancing.
++ *
++ * This implementation uses only unidirectional next pointers and is optimized
++ * for use in a priority queue where elements are mostly deleted from the front
++ * of the queue.
++ *
++ * When storing up to 2^n elements in a n-level skiplist. lookup and deletion
++ * for the first element happens in O(1) time, other than that, insertion and
++ * deletion takes O(log n) time, assuming that the number of elements for an
++ * n-level list does not exceed 2^n.
++ *
++ * Usage:
++ * DECLARE_SKIPLIST_TYPE(foo, 5) will define the data types for a 5-level list:
++ * struct foo_list: the list data type
++ * struct foo_node: the node data for an element in the list
++ *
++ * DECLARE_SKIPLIST_IMPL(foo, foo_cmp_fn)
++ *
++ * Adds the skip list implementation. It depends on a provided function:
++ * int foo_cmp_fn(struct foo_list *list, struct foo_node *n1, struct foo_node *n2)
++ * This compares two elements given by their node pointers, returning values <0
++ * if n1 is less than n2, =0 and >0 for equal or bigger than respectively.
++ *
++ * This macro implements the following functions:
++ *
++ * void foo_list_init(struct foo_list *list)
++ *	initializes the skip list
++ *
++ * void foo_node_init(struct foo_node *node)
++ *	initializes a node. must be called before adding the node to the list
++ *
++ * struct foo_node *foo_node_next(struct foo_node *node)
++ *	gets the node directly after the provided node, or NULL if it was the last
++ *	element in the list.
++ *
++ * bool foo_is_queued(struct foo_node *node)
++ *	returns true if the node is on a list
++ *
++ * struct foo_node *foo_dequeue(struct foo_list *list)
++ *	deletes and returns the first element of the list (or returns NULL if empty)
++ *
++ * struct foo_node *foo_peek(struct foo_list *list)
++ *	returns the first element of the list
++ *
++ * void foo_insert(struct foo_list *list, struct foo_node *node)
++ *	inserts the node into the list. the node must be initialized and not on a
++ *	list already.
++ *
++ * void foo_delete(struct foo_list *list, struct foo_node *node)
++ *	deletes the node from the list, or does nothing if it's not on the list
++ */
++#ifndef __SKIPLIST_H
++#define __SKIPLIST_H
++
++#include <linux/bits.h>
++#include <linux/minmax.h>
++#include <linux/bug.h>
++#include <linux/prandom.h>
++
++#define SKIPLIST_POISON ((void *)1)
++
++#define DECLARE_SKIPLIST_TYPE(name, levels)				\
++struct name##_node {							\
++	struct name##_node *next[levels];				\
++};									\
++struct name##_list {							\
++	struct name##_node head;					\
++	unsigned int max_level;						\
++	unsigned int count;						\
++};
++
++#define DECLARE_SKIPLIST_IMPL(name, cmp_fn)				\
++static inline void							\
++name##_list_init(struct name##_list *list)				\
++{									\
++	memset(list, 0, sizeof(*list));					\
++}									\
++static inline void							\
++name##_node_init(struct name##_node *node)				\
++{									\
++	node->next[0] = SKIPLIST_POISON;				\
++}									\
++static inline struct name##_node *					\
++name##_node_next(struct name##_node *node)				\
++{									\
++	return node->next[0];						\
++}									\
++static inline bool							\
++name##_is_queued(struct name##_node *node)				\
++{									\
++	return node->next[0] != SKIPLIST_POISON;			\
++}									\
++static inline int							\
++__skiplist_##name##_cmp_impl(void *head, void *n1, void *n2)		\
++{									\
++	return cmp_fn(head, n1, n2);					\
++}									\
++static inline void							\
++__##name##_delete(struct name##_list *list)				\
++{									\
++	list->count--;							\
++	while (list->max_level &&					\
++	       !list->head.next[list->max_level])			\
++		list->max_level--;					\
++}									\
++static inline struct name##_node *					\
++name##_dequeue(struct name##_list *list)				\
++{									\
++	struct name##_node *ret;					\
++	unsigned int max_level = ARRAY_SIZE(list->head.next) - 1;	\
++	ret = (void *)__skiplist_dequeue((void **)&list->head,		\
++					 max_level);			\
++	if (!ret)							\
++		return NULL;						\
++	__##name##_delete(list);					\
++	return ret;							\
++}									\
++static inline struct name##_node *					\
++name##_peek(struct name##_list *list)					\
++{									\
++	return list->head.next[0];					\
++}									\
++static inline void							\
++name##_insert(struct name##_list *list, struct name##_node *node)	\
++{									\
++	int level = __skiplist_level(ARRAY_SIZE(list->head.next) - 1,	\
++				     list->count, prandom_u32());	\
++	level = min_t(int, level, list->max_level + 1);			\
++	__skiplist_insert((void *)&list->head, (void *)node, level,	\
++			  __skiplist_##name##_cmp_impl);		\
++	if (level > list->max_level)					\
++		list->max_level = level;				\
++	list->count++;							\
++}									\
++static inline void							\
++name##_delete(struct name##_list *list, struct name##_node *node)	\
++{									\
++	if (node->next[0] == SKIPLIST_POISON)				\
++	    return;							\
++	__skiplist_delete((void *)&list->head, (void *)node,		\
++			  ARRAY_SIZE(list->head.next) - 1,		\
++			  __skiplist_##name##_cmp_impl);		\
++	__##name##_delete(list);					\
++}
++
++
++typedef int (*__skiplist_cmp_t)(void *head, void *n1, void *n2);
++
++#define __skiplist_cmp(cmp, head, cur, node)				\
++	({								\
++		int cmp_val = cmp(head, cur, node);			\
++		if (!cmp_val)						\
++			cmp_val = (unsigned long)(cur) -		\
++				  (unsigned long)(node);		\
++		cmp_val;						\
++	})
++
++static inline void *
++__skiplist_dequeue(void **list, int max_level)
++{
++	void **node = list[0];
++	unsigned int i;
++
++	if (!node)
++		return NULL;
++
++	list[0] = node[0];
++	for (i = 1; i <= max_level; i++) {
++		if (list[i] != node)
++			break;
++
++		list[i] = node[i];
++	}
++	node[0] = SKIPLIST_POISON;
++
++	return node;
++}
++
++static inline void
++__skiplist_insert(void **list, void **node, int level, __skiplist_cmp_t cmp)
++{
++	void **head = list;
++
++	if (WARN(node[0] != SKIPLIST_POISON, "Insert on already inserted or uninitialized node"))
++	    return;
++	for (; level >= 0; level--) {
++		while (list[level] &&
++		       __skiplist_cmp(cmp, head, list[level], node) < 0)
++			list = list[level];
++
++		node[level] = list[level];
++		list[level] = node;
++	}
++}
++
++
++static inline void
++__skiplist_delete(void **list, void **node, int max_level, __skiplist_cmp_t cmp)
++{
++	void *head = list;
++	int i;
++
++	for (i = max_level; i >= 0; i--) {
++		while (list[i] && list[i] != node &&
++		       __skiplist_cmp(cmp, head, list[i], node) <= 0)
++			list = list[i];
++
++		if (list[i] != node)
++			continue;
++
++		list[i] = node[i];
++	}
++	node[0] = SKIPLIST_POISON;
++}
++
++static inline unsigned int
++__skiplist_level(unsigned int max_level, unsigned int count, unsigned int seed)
++{
++	unsigned int level = 0;
++
++	if (max_level >= 16 && !(seed & GENMASK(15, 0))) {
++		level += 16;
++		seed >>= 16;
++	}
++
++	if (max_level >= 8 && !(seed & GENMASK(7, 0))) {
++		level += 8;
++		seed >>= 8;
++	}
++
++	if (max_level >= 4 && !(seed & GENMASK(3, 0))) {
++		level += 4;
++		seed >>= 4;
++	}
++
++	if (!(seed & GENMASK(1, 0))) {
++		level += 2;
++		seed >>= 2;
++	}
++
++	if (!(seed & BIT(0)))
++		level++;
++
++	return min(level, max_level);
++}
++
++#endif
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -1563,7 +1563,6 @@ static void sta_apply_airtime_params(str
+ 	for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
+ 		struct airtime_sched_info *air_sched = &local->airtime[ac];
+ 		struct airtime_info *air_info = &sta->airtime[ac];
+-		struct txq_info *txqi;
+ 		u8 tid;
+ 
+ 		spin_lock_bh(&air_sched->lock);
+@@ -1575,10 +1574,6 @@ static void sta_apply_airtime_params(str
+ 
+ 			airtime_weight_set(air_info, params->airtime_weight);
+ 
+-			txqi = to_txq_info(sta->sta.txq[tid]);
+-			if (RB_EMPTY_NODE(&txqi->schedule_order))
+-				continue;
+-
+ 			ieee80211_update_airtime_weight(local, air_sched,
+ 							0, true);
+ 		}
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -25,7 +25,8 @@
+ #include <linux/leds.h>
+ #include <linux/idr.h>
+ #include <linux/rhashtable.h>
+-#include <linux/rbtree.h>
++#include <linux/prandom.h>
++#include <linux/skiplist.h>
+ #include <net/ieee80211_radiotap.h>
+ #include <net/cfg80211.h>
+ #include <net/mac80211.h>
+@@ -854,6 +855,7 @@ enum txq_info_flags {
+ 	IEEE80211_TXQ_AMPDU,
+ 	IEEE80211_TXQ_NO_AMSDU,
+ 	IEEE80211_TXQ_STOP_NETIF_TX,
++	IEEE80211_TXQ_FORCE_ACTIVE,
+ };
+ 
+ /**
+@@ -870,7 +872,6 @@ struct txq_info {
+ 	struct fq_tin tin;
+ 	struct codel_vars def_cvars;
+ 	struct codel_stats cstats;
+-	struct rb_node schedule_order;
+ 
+ 	struct sk_buff_head frags;
+ 	unsigned long flags;
+@@ -1185,8 +1186,7 @@ enum mac80211_scan_state {
+  *
+  * @lock: spinlock that protects all the fields in this struct
+  * @active_txqs: rbtree of currently backlogged queues, sorted by virtual time
+- * @schedule_pos: the current position maintained while a driver walks the tree
+- *                with ieee80211_next_txq()
++ * @schedule_pos: last used airtime_info node while a driver walks the tree
+  * @active_list: list of struct airtime_info structs that were active within
+  *               the last AIRTIME_ACTIVE_DURATION (100 ms), used to compute
+  *               weight_sum
+@@ -1207,8 +1207,8 @@ enum mac80211_scan_state {
+  */
+ struct airtime_sched_info {
+ 	spinlock_t lock;
+-	struct rb_root_cached active_txqs;
+-	struct rb_node *schedule_pos;
++	struct airtime_sched_list active_txqs;
++	struct airtime_sched_node *schedule_pos;
+ 	struct list_head active_list;
+ 	u64 last_weight_update;
+ 	u64 last_schedule_activity;
+@@ -1663,6 +1663,20 @@ static inline struct airtime_info *to_ai
+ 	return &sdata->airtime[txq->ac];
+ }
+ 
++static inline int
++airtime_sched_cmp(struct airtime_sched_list *list,
++		  struct airtime_sched_node *n1, struct airtime_sched_node *n2)
++{
++	struct airtime_info *a1, *a2;
++
++	a1 = container_of(n1, struct airtime_info, schedule_order);
++	a2 = container_of(n2, struct airtime_info, schedule_order);
++
++	return a1->v_t_cur - a2->v_t_cur;
++}
++
++DECLARE_SKIPLIST_IMPL(airtime_sched, airtime_sched_cmp);
++
+ /* To avoid divisions in the fast path, we keep pre-computed reciprocals for
+  * airtime weight calculations. There are two different weights to keep track
+  * of: The per-station weight and the sum of weights per phy.
+@@ -1750,6 +1764,7 @@ static inline void init_airtime_info(str
+ 	air_info->aql_limit_high = air_sched->aql_txq_limit_high;
+ 	airtime_weight_set(air_info, IEEE80211_DEFAULT_AIRTIME_WEIGHT);
+ 	INIT_LIST_HEAD(&air_info->list);
++	airtime_sched_node_init(&air_info->schedule_order);
+ }
+ 
+ static inline int ieee80211_bssid_match(const u8 *raddr, const u8 *addr)
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -709,7 +709,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+ 	for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+ 		struct airtime_sched_info *air_sched = &local->airtime[i];
+ 
+-		air_sched->active_txqs = RB_ROOT_CACHED;
++		airtime_sched_list_init(&air_sched->active_txqs);
+ 		INIT_LIST_HEAD(&air_sched->active_list);
+ 		spin_lock_init(&air_sched->lock);
+ 		air_sched->aql_txq_limit_low = IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L;
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -1902,8 +1902,7 @@ void ieee80211_register_airtime(struct i
+ 	air_sched = &local->airtime[txq->ac];
+ 	air_info = to_airtime_info(txq);
+ 
+-	if (local->airtime_flags & AIRTIME_USE_TX)
+-		airtime += tx_airtime;
++	airtime += tx_airtime;
+ 	if (local->airtime_flags & AIRTIME_USE_RX)
+ 		airtime += rx_airtime;
+ 
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -135,11 +135,14 @@ enum ieee80211_agg_stop_reason {
+ #define AIRTIME_USE_TX		BIT(0)
+ #define AIRTIME_USE_RX		BIT(1)
+ 
++DECLARE_SKIPLIST_TYPE(airtime_sched, 5);
+ 
+ struct airtime_info {
++	struct airtime_sched_node schedule_order;
++	struct ieee80211_txq *txq[3];
+ 	u64 rx_airtime;
+ 	u64 tx_airtime;
+-	u64 v_t;
++	u64 v_t, v_t_cur;
+ 	u64 last_scheduled;
+ 	struct list_head list;
+ 	atomic_t aql_tx_pending; /* Estimated airtime for frames pending */
+@@ -147,6 +150,7 @@ struct airtime_info {
+ 	u32 aql_limit_high;
+ 	u32 weight_reciprocal;
+ 	u16 weight;
++	u8 txq_idx;
+ };
+ 
+ void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -19,6 +19,7 @@
+ #include <linux/rcupdate.h>
+ #include <linux/export.h>
+ #include <linux/timekeeping.h>
++#include <linux/prandom.h>
+ #include <net/net_namespace.h>
+ #include <net/ieee80211_radiotap.h>
+ #include <net/cfg80211.h>
+@@ -1476,11 +1477,12 @@ void ieee80211_txq_init(struct ieee80211
+ 			struct sta_info *sta,
+ 			struct txq_info *txqi, int tid)
+ {
++	struct airtime_info *air_info;
++
+ 	fq_tin_init(&txqi->tin);
+ 	codel_vars_init(&txqi->def_cvars);
+ 	codel_stats_init(&txqi->cstats);
+ 	__skb_queue_head_init(&txqi->frags);
+-	RB_CLEAR_NODE(&txqi->schedule_order);
+ 
+ 	txqi->txq.vif = &sdata->vif;
+ 
+@@ -1489,7 +1491,7 @@ void ieee80211_txq_init(struct ieee80211
+ 		txqi->txq.tid = 0;
+ 		txqi->txq.ac = IEEE80211_AC_BE;
+ 
+-		return;
++		goto out;
+ 	}
+ 
+ 	if (tid == IEEE80211_NUM_TIDS) {
+@@ -1511,6 +1513,12 @@ void ieee80211_txq_init(struct ieee80211
+ 	txqi->txq.sta = &sta->sta;
+ 	txqi->txq.tid = tid;
+ 	sta->sta.txq[tid] = &txqi->txq;
++
++out:
++	air_info = to_airtime_info(&txqi->txq);
++	air_info->txq[air_info->txq_idx++] = &txqi->txq;
++	if (air_info->txq_idx == ARRAY_SIZE(air_info->txq))
++		air_info->txq_idx--;
+ }
+ 
+ void ieee80211_txq_purge(struct ieee80211_local *local,
+@@ -3633,6 +3641,8 @@ struct sk_buff *ieee80211_tx_dequeue(str
+ 	struct ieee80211_tx_data tx;
+ 	ieee80211_tx_result r;
+ 	struct ieee80211_vif *vif = txq->vif;
++	u32 airtime;
++	bool ampdu;
+ 
+ 	WARN_ON_ONCE(softirq_count() == 0);
+ 
+@@ -3791,21 +3801,26 @@ begin:
+ encap_out:
+ 	IEEE80211_SKB_CB(skb)->control.vif = vif;
+ 
+-	if (vif &&
+-	    wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
+-		bool ampdu = txq->ac != IEEE80211_AC_VO;
+-		u32 airtime;
+-
+-		airtime = ieee80211_calc_expected_tx_airtime(hw, vif, txq->sta,
+-							     skb->len, ampdu);
+-		if (airtime) {
+-			airtime = ieee80211_info_set_tx_time_est(info, airtime);
+-			ieee80211_sta_update_pending_airtime(local, tx.sta,
+-							     txq->ac,
+-							     airtime,
+-							     false);
+-		}
+-	}
++	if (!vif)
++		return skb;
++
++	ampdu = txq->ac != IEEE80211_AC_VO;
++	airtime = ieee80211_calc_expected_tx_airtime(hw, vif, txq->sta,
++						     skb->len, ampdu);
++	if (!airtime)
++		return skb;
++
++	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL) ||
++	    !wiphy_ext_feature_isset(local->hw.wiphy,
++				     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
++		ieee80211_register_airtime(txq, airtime, 0);
++
++	if (!wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL))
++		return skb;
++
++	airtime = ieee80211_info_set_tx_time_est(info, airtime);
++	ieee80211_sta_update_pending_airtime(local, tx.sta, txq->ac,
++					     airtime, false);
+ 
+ 	return skb;
+ 
+@@ -3816,85 +3831,95 @@ out:
+ }
+ EXPORT_SYMBOL(ieee80211_tx_dequeue);
+ 
++static void
++airtime_info_next_txq_idx(struct airtime_info *air_info)
++{
++	air_info->txq_idx++;
++	if (air_info->txq_idx >= ARRAY_SIZE(air_info->txq) ||
++	    !air_info->txq[air_info->txq_idx])
++		air_info->txq_idx = 0;
++}
++
+ struct ieee80211_txq *ieee80211_next_txq(struct ieee80211_hw *hw, u8 ac)
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct airtime_sched_info *air_sched;
+ 	u64 now = ktime_get_coarse_boottime_ns();
+-	struct ieee80211_txq *ret = NULL;
++	struct airtime_sched_node *node = NULL;
++	struct ieee80211_txq *txq;
+ 	struct airtime_info *air_info;
+ 	struct txq_info *txqi = NULL;
+-	struct rb_node *node;
+-	bool first = false;
++	u8 txq_idx;
+ 
+ 	air_sched = &local->airtime[ac];
+ 	spin_lock_bh(&air_sched->lock);
+ 
+-	node = air_sched->schedule_pos;
+-
+ begin:
+-	if (!node) {
+-		node = rb_first_cached(&air_sched->active_txqs);
+-		first = true;
+-	} else {
+-		node = rb_next(node);
+-	}
++	txq = NULL;
++	if (airtime_sched_peek(&air_sched->active_txqs) ==
++	    air_sched->schedule_pos)
++		goto out;
+ 
++	node = airtime_sched_dequeue(&air_sched->active_txqs);
+ 	if (!node)
+ 		goto out;
+ 
+-	txqi = container_of(node, struct txq_info, schedule_order);
+-	air_info = to_airtime_info(&txqi->txq);
++	air_info = container_of(node, struct airtime_info, schedule_order);
+ 
+-	if (air_info->v_t > air_sched->v_t &&
+-	    (!first || !airtime_catchup_v_t(air_sched, air_info->v_t, now)))
+-		goto out;
+-
+-	if (!ieee80211_txq_airtime_check(hw, &txqi->txq)) {
+-		first = false;
++	airtime_info_next_txq_idx(air_info);
++	txq_idx = air_info->txq_idx;
++	txq = air_info->txq[txq_idx];
++	if (!txq || !ieee80211_txq_airtime_check(hw, txq))
+ 		goto begin;
++
++	while (1) {
++		txqi = to_txq_info(txq);
++		if (test_and_clear_bit(IEEE80211_TXQ_FORCE_ACTIVE, &txqi->flags))
++			break;
++
++		if (txq_has_queue(txq))
++			break;
++
++		airtime_info_next_txq_idx(air_info);
++		txq = air_info->txq[air_info->txq_idx];
++		if (txq_idx == air_info->txq_idx)
++			goto begin;
++	}
++
++	if (air_info->v_t_cur > air_sched->v_t) {
++		if (node == airtime_sched_peek(&air_sched->active_txqs))
++			airtime_catchup_v_t(air_sched, air_info->v_t_cur, now);
+ 	}
+ 
+ 	air_sched->schedule_pos = node;
+ 	air_sched->last_schedule_activity = now;
+-	ret = &txqi->txq;
+ out:
+ 	spin_unlock_bh(&air_sched->lock);
+-	return ret;
++	return txq;
+ }
+ EXPORT_SYMBOL(ieee80211_next_txq);
+ 
+-static void __ieee80211_insert_txq(struct rb_root_cached *root,
++static void __ieee80211_insert_txq(struct ieee80211_local *local,
++				   struct airtime_sched_info *air_sched,
+ 				   struct txq_info *txqi)
+ {
+-	struct rb_node **new = &root->rb_root.rb_node;
+-	struct airtime_info *old_air, *new_air;
+-	struct rb_node *parent = NULL;
+-	struct txq_info *__txqi;
+-	bool leftmost = true;
+-
+-	while (*new) {
+-		parent = *new;
+-		__txqi = rb_entry(parent, struct txq_info, schedule_order);
+-		old_air = to_airtime_info(&__txqi->txq);
+-		new_air = to_airtime_info(&txqi->txq);
++	struct airtime_info *air_info = to_airtime_info(&txqi->txq);
++	u32 aql_time = 0;
+ 
+-		if (new_air->v_t <= old_air->v_t) {
+-			new = &parent->rb_left;
+-		} else {
+-			new = &parent->rb_right;
+-			leftmost = false;
+-		}
++	if (wiphy_ext_feature_isset(local->hw.wiphy, NL80211_EXT_FEATURE_AQL)) {
++	    aql_time = atomic_read(&air_info->aql_tx_pending);
++	    aql_time *= air_info->weight_reciprocal;
++	    aql_time >>= IEEE80211_RECIPROCAL_SHIFT_STA - IEEE80211_WEIGHT_SHIFT;
+ 	}
+ 
+-	rb_link_node(&txqi->schedule_order, parent, new);
+-	rb_insert_color_cached(&txqi->schedule_order, root, leftmost);
++	airtime_sched_delete(&air_sched->active_txqs, &air_info->schedule_order);
++	air_info->v_t_cur = air_info->v_t + aql_time;
++	airtime_sched_insert(&air_sched->active_txqs, &air_info->schedule_order);
+ }
+ 
+ void ieee80211_resort_txq(struct ieee80211_hw *hw,
+ 			  struct ieee80211_txq *txq)
+ {
+-	struct airtime_info *air_info = to_airtime_info(txq);
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct txq_info *txqi = to_txq_info(txq);
+ 	struct airtime_sched_info *air_sched;
+@@ -3902,41 +3927,7 @@ void ieee80211_resort_txq(struct ieee802
+ 	air_sched = &local->airtime[txq->ac];
+ 
+ 	lockdep_assert_held(&air_sched->lock);
+-
+-	if (!RB_EMPTY_NODE(&txqi->schedule_order)) {
+-		struct airtime_info *a_prev = NULL, *a_next = NULL;
+-		struct txq_info *t_prev, *t_next;
+-		struct rb_node *n_prev, *n_next;
+-
+-		/* Erasing a node can cause an expensive rebalancing operation,
+-		 * so we check the previous and next nodes first and only remove
+-		 * and re-insert if the current node is not already in the
+-		 * correct position.
+-		 */
+-		if ((n_prev = rb_prev(&txqi->schedule_order)) != NULL) {
+-			t_prev = container_of(n_prev, struct txq_info,
+-					      schedule_order);
+-			a_prev = to_airtime_info(&t_prev->txq);
+-		}
+-
+-		if ((n_next = rb_next(&txqi->schedule_order)) != NULL) {
+-			t_next = container_of(n_next, struct txq_info,
+-					      schedule_order);
+-			a_next = to_airtime_info(&t_next->txq);
+-		}
+-
+-		if ((!a_prev || a_prev->v_t <= air_info->v_t) &&
+-		    (!a_next || a_next->v_t > air_info->v_t))
+-			return;
+-
+-		if (air_sched->schedule_pos == &txqi->schedule_order)
+-			air_sched->schedule_pos = n_prev;
+-
+-		rb_erase_cached(&txqi->schedule_order,
+-				&air_sched->active_txqs);
+-		RB_CLEAR_NODE(&txqi->schedule_order);
+-		__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
+-	}
++	__ieee80211_insert_txq(local, air_sched, txqi);
+ }
+ 
+ void ieee80211_update_airtime_weight(struct ieee80211_local *local,
+@@ -3985,7 +3976,7 @@ void ieee80211_schedule_txq(struct ieee8
+ 	was_active = airtime_is_active(air_info, now);
+ 	airtime_set_active(air_sched, air_info, now);
+ 
+-	if (!RB_EMPTY_NODE(&txqi->schedule_order))
++	if (airtime_sched_is_queued(&air_info->schedule_order))
+ 		goto out;
+ 
+ 	/* If the station has been inactive for a while, catch up its v_t so it
+@@ -3997,7 +3988,7 @@ void ieee80211_schedule_txq(struct ieee8
+ 		air_info->v_t = air_sched->v_t;
+ 
+ 	ieee80211_update_airtime_weight(local, air_sched, now, !was_active);
+-	__ieee80211_insert_txq(&air_sched->active_txqs, txqi);
++	__ieee80211_insert_txq(local, air_sched, txqi);
+ 
+ out:
+ 	spin_unlock_bh(&air_sched->lock);
+@@ -4023,19 +4014,10 @@ static void __ieee80211_unschedule_txq(s
+ 		ieee80211_update_airtime_weight(local, air_sched, 0, true);
+ 	}
+ 
+-	if (RB_EMPTY_NODE(&txqi->schedule_order))
+-		return;
+-
+-	if (air_sched->schedule_pos == &txqi->schedule_order)
+-		air_sched->schedule_pos = rb_prev(&txqi->schedule_order);
+-
++	airtime_sched_delete(&air_sched->active_txqs, &air_info->schedule_order);
+ 	if (!purge)
+ 		airtime_set_active(air_sched, air_info,
+ 				   ktime_get_coarse_boottime_ns());
+-
+-	rb_erase_cached(&txqi->schedule_order,
+-			&air_sched->active_txqs);
+-	RB_CLEAR_NODE(&txqi->schedule_order);
+ }
+ 
+ void ieee80211_unschedule_txq(struct ieee80211_hw *hw,
+@@ -4055,14 +4037,24 @@ void ieee80211_return_txq(struct ieee802
+ {
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct txq_info *txqi = to_txq_info(txq);
++	struct airtime_sched_info *air_sched;
++	struct airtime_info *air_info;
+ 
+-	spin_lock_bh(&local->airtime[txq->ac].lock);
++	air_sched = &local->airtime[txq->ac];
++	air_info = to_airtime_info(&txqi->txq);
+ 
+-	if (!RB_EMPTY_NODE(&txqi->schedule_order) && !force &&
+-	    !txq_has_queue(txq))
+-		__ieee80211_unschedule_txq(hw, txq, false);
++	if (force)
++		set_bit(IEEE80211_TXQ_FORCE_ACTIVE, &txqi->flags);
+ 
+-	spin_unlock_bh(&local->airtime[txq->ac].lock);
++	spin_lock_bh(&air_sched->lock);
++	if (!ieee80211_txq_airtime_check(hw, &txqi->txq))
++	    airtime_sched_delete(&air_sched->active_txqs,
++				 &air_info->schedule_order);
++	else if (txq_has_queue(txq) || force)
++		__ieee80211_insert_txq(local, air_sched, txqi);
++	else
++		__ieee80211_unschedule_txq(hw, txq, false);
++	spin_unlock_bh(&air_sched->lock);
+ }
+ EXPORT_SYMBOL(ieee80211_return_txq);
+ 
+@@ -4101,46 +4093,48 @@ EXPORT_SYMBOL(ieee80211_txq_airtime_chec
+ bool ieee80211_txq_may_transmit(struct ieee80211_hw *hw,
+ 				struct ieee80211_txq *txq)
+ {
+-	struct txq_info *first_txqi = NULL, *txqi = to_txq_info(txq);
++	struct txq_info *txqi = to_txq_info(txq);
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct airtime_sched_info *air_sched;
++	struct airtime_sched_node *node = NULL;
+ 	struct airtime_info *air_info;
+-	struct rb_node *node = NULL;
+ 	bool ret = false;
++	u32 aql_slack;
+ 	u64 now;
+ 
+-
+ 	if (!ieee80211_txq_airtime_check(hw, txq))
+ 		return false;
+ 
+ 	air_sched = &local->airtime[txq->ac];
+ 	spin_lock_bh(&air_sched->lock);
+ 
+-	if (RB_EMPTY_NODE(&txqi->schedule_order))
+-		goto out;
+-
+ 	now = ktime_get_coarse_boottime_ns();
+ 
+ 	/* Like in ieee80211_next_txq(), make sure the first station in the
+ 	 * scheduling order is eligible for transmission to avoid starvation.
+ 	 */
+-	node = rb_first_cached(&air_sched->active_txqs);
++	node = airtime_sched_peek(&air_sched->active_txqs);
+ 	if (node) {
+-		first_txqi = container_of(node, struct txq_info,
+-					  schedule_order);
+-		air_info = to_airtime_info(&first_txqi->txq);
++		air_info = container_of(node, struct airtime_info,
++					schedule_order);
+ 
+ 		if (air_sched->v_t < air_info->v_t)
+ 			airtime_catchup_v_t(air_sched, air_info->v_t, now);
+ 	}
+ 
+ 	air_info = to_airtime_info(&txqi->txq);
+-	if (air_info->v_t <= air_sched->v_t) {
++	aql_slack = air_info->aql_limit_low;
++	aql_slack *= air_info->weight_reciprocal;
++	aql_slack >>= IEEE80211_RECIPROCAL_SHIFT_STA - IEEE80211_WEIGHT_SHIFT;
++	/*
++	 * add extra slack of aql_limit_low in order to avoid queue
++	 * starvation when bypassing normal scheduling order
++	 */
++	if (air_info->v_t <= air_sched->v_t + aql_slack) {
+ 		air_sched->last_schedule_activity = now;
+ 		ret = true;
+ 	}
+ 
+-out:
+ 	spin_unlock_bh(&air_sched->lock);
+ 	return ret;
+ }
+@@ -4151,9 +4145,7 @@ void ieee80211_txq_schedule_start(struct
+ 	struct ieee80211_local *local = hw_to_local(hw);
+ 	struct airtime_sched_info *air_sched = &local->airtime[ac];
+ 
+-	spin_lock_bh(&air_sched->lock);
+ 	air_sched->schedule_pos = NULL;
+-	spin_unlock_bh(&air_sched->lock);
+ }
+ EXPORT_SYMBOL(ieee80211_txq_schedule_start);
+ 
diff --git a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
index 612b9d66ee..7473f1ab38 100644
--- a/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
+++ b/package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch
@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2845,6 +2845,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2840,6 +2840,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static void ieee80211_rfkill_poll(struct wiphy *wiphy)
  {
  	struct ieee80211_local *local = wiphy_priv(wiphy);
-@@ -4549,6 +4562,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -4544,6 +4557,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,
diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c
index fa325ea6e5..7db3f9e720 100644
--- a/package/network/services/hostapd/src/src/ap/ubus.c
+++ b/package/network/services/hostapd/src/src/ap/ubus.c
@@ -1570,50 +1570,6 @@ hostapd_bss_transition_request(struct ubus_context *ctx, struct ubus_object *obj
 	return hostapd_bss_tr_send(hapd, addr, da_imminent, abridged, da_timer, valid_period,
 				   dialog_token, tb[BSS_TR_NEIGHBORS]);
 }
-
-enum {
-	WNM_DISASSOC_ADDR,
-	WNM_DISASSOC_DURATION,
-	WNM_DISASSOC_NEIGHBORS,
-	WNM_DISASSOC_ABRIDGED,
-	__WNM_DISASSOC_MAX,
-};
-
-static const struct blobmsg_policy wnm_disassoc_policy[__WNM_DISASSOC_MAX] = {
-	[WNM_DISASSOC_ADDR] = { "addr", BLOBMSG_TYPE_STRING },
-	[WNM_DISASSOC_DURATION] { "duration", BLOBMSG_TYPE_INT32 },
-	[WNM_DISASSOC_NEIGHBORS] { "neighbors", BLOBMSG_TYPE_ARRAY },
-	[WNM_DISASSOC_ABRIDGED] { "abridged", BLOBMSG_TYPE_BOOL },
-};
-
-static int
-hostapd_wnm_disassoc_imminent(struct ubus_context *ctx, struct ubus_object *obj,
-			      struct ubus_request_data *ureq, const char *method,
-			      struct blob_attr *msg)
-{
-	struct hostapd_data *hapd = container_of(obj, struct hostapd_data, ubus.obj);
-	struct blob_attr *tb[__WNM_DISASSOC_MAX];
-	struct sta_info *sta;
-	int duration = 10;
-	u8 addr[ETH_ALEN];
-	bool abridged;
-
-	blobmsg_parse(wnm_disassoc_policy, __WNM_DISASSOC_MAX, tb, blob_data(msg), blob_len(msg));
-
-	if (!tb[WNM_DISASSOC_ADDR])
-		return UBUS_STATUS_INVALID_ARGUMENT;
-
-	if (hwaddr_aton(blobmsg_data(tb[WNM_DISASSOC_ADDR]), addr))
-		return UBUS_STATUS_INVALID_ARGUMENT;
-
-	if (tb[WNM_DISASSOC_DURATION])
-		duration = blobmsg_get_u32(tb[WNM_DISASSOC_DURATION]);
-
-	abridged = !!(tb[WNM_DISASSOC_ABRIDGED] && blobmsg_get_bool(tb[WNM_DISASSOC_ABRIDGED]));
-
-	return hostapd_bss_tr_send(hapd, addr, true, abridged, duration, duration,
-				   1, tb[WNM_DISASSOC_NEIGHBORS]);
-}
 #endif
 
 #ifdef CONFIG_AIRTIME_POLICY
@@ -1698,7 +1654,6 @@ static const struct ubus_method bss_methods[] = {
 	UBUS_METHOD("rrm_beacon_req", hostapd_rrm_beacon_req, beacon_req_policy),
 	UBUS_METHOD("link_measurement_req", hostapd_rrm_lm_req, lm_req_policy),
 #ifdef CONFIG_WNM_AP
-	UBUS_METHOD("wnm_disassoc_imminent", hostapd_wnm_disassoc_imminent, wnm_disassoc_policy),
 	UBUS_METHOD("bss_transition_request", hostapd_bss_transition_request, bss_tr_policy),
 #endif
 };
diff --git a/target/linux/ath79/dts/qca9531_glinet_gl-ar300m.dtsi b/target/linux/ath79/dts/qca9531_glinet_gl-ar300m.dtsi
index 47fda91a0c..d64ffa7115 100644
--- a/target/linux/ath79/dts/qca9531_glinet_gl-ar300m.dtsi
+++ b/target/linux/ath79/dts/qca9531_glinet_gl-ar300m.dtsi
@@ -72,9 +72,6 @@
 	i2c: i2c {
 		compatible = "i2c-gpio";
 
-		pinctrl-names = "default";
-		pinctrl-0 = <&enable_gpio17>;
-
 		sda-gpios = <&gpio 17 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
 		scl-gpios = <&gpio 16 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
 	};
@@ -186,6 +183,9 @@
 };
 
 &pinmux {
+	pinctrl-names = "default";
+	pinctrl-0 = <&enable_gpio17>;
+
 	enable_gpio17: pinmux_enable_gpio17 {
 		pinctrl-single,bits = <0x10 0x0000 0xff00>;
 	};
diff --git a/target/linux/ath79/dts/qca9563_zte_mf286.dtsi b/target/linux/ath79/dts/qca9563_zte_mf286.dtsi
index 3013daa470..76dd7b6be6 100644
--- a/target/linux/ath79/dts/qca9563_zte_mf286.dtsi
+++ b/target/linux/ath79/dts/qca9563_zte_mf286.dtsi
@@ -18,6 +18,8 @@
 
 	leds {
 		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&enable_wlan_led_gpio>;
 
 		/* Hidden SMD LED below signal strength LEDs.
 		 * Visible through slits underside of the case,
@@ -28,6 +30,13 @@
 			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
 			default-state = "on";
 		};
+
+		led-1 {
+			function = LED_FUNCTION_WLAN;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
 	};
 
 	keys {
@@ -64,20 +73,6 @@
 	};
 };
 
-&gpio {
-	/* GPIO19 is used as a mask to enable WLAN LED
-	 * in stock firmware, which is controlled directly
-	 * by 5GHz Wi-Fi chip, which currently is inactive
-	 * in OpenWrt
-	 */
-	led-wlan {
-		gpio-hog;
-		gpios = <19 GPIO_ACTIVE_LOW>;
-		output-high;
-		line-name = "led:wlan";
-	};
-};
-
 &spi {
 	status = "okay";
 
@@ -137,6 +132,12 @@
 	};
 };
 
+&pinmux {
+	enable_wlan_led_gpio: pinmux_wlan_led_gpio {
+		pinctrl-single,bits = <0x10 0x0 0xff000000>;
+	};
+};
+
 &wmac {
 	status = "okay";
 };
diff --git a/target/linux/bcm27xx/bcm2710/config-5.15 b/target/linux/bcm27xx/bcm2710/config-5.15
index af6629241b..6243a7419c 100644
--- a/target/linux/bcm27xx/bcm2710/config-5.15
+++ b/target/linux/bcm27xx/bcm2710/config-5.15
@@ -17,6 +17,7 @@ CONFIG_ARCH_WANTS_NO_INSTR=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
 CONFIG_ARM64_CNP=y
+CONFIG_ARM64_CRYPTO=y
 CONFIG_ARM64_EPAN=y
 CONFIG_ARM64_ERRATUM_819472=y
 CONFIG_ARM64_ERRATUM_824069=y
@@ -122,9 +123,13 @@ CONFIG_CPU_IDLE_GOV_MENU=y
 CONFIG_CPU_PM=y
 CONFIG_CPU_RMAP=y
 CONFIG_CRC16=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_BS=y
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRYPTD=y
 CONFIG_CRYPTO_CTS=y
 CONFIG_CRYPTO_DRBG=y
 CONFIG_CRYPTO_DRBG_HMAC=y
@@ -138,7 +143,10 @@ CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_RNG_DEFAULT=y
 CONFIG_CRYPTO_SEQIV=y
 CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
 CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA512_ARM64=y
+CONFIG_CRYPTO_SIMD=y
 CONFIG_CRYPTO_XTS=y
 CONFIG_DCACHE_WORD_ACCESS=y
 CONFIG_DEBUG_BUGVERBOSE=y
diff --git a/target/linux/bcm27xx/bcm2711/config-5.15 b/target/linux/bcm27xx/bcm2711/config-5.15
index af0496e0f8..abb3b6dbc9 100644
--- a/target/linux/bcm27xx/bcm2711/config-5.15
+++ b/target/linux/bcm27xx/bcm2711/config-5.15
@@ -17,6 +17,7 @@ CONFIG_ARCH_WANTS_NO_INSTR=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
 CONFIG_ARM64_CNP=y
+CONFIG_ARM64_CRYPTO=y
 CONFIG_ARM64_EPAN=y
 CONFIG_ARM64_ERRATUM_819472=y
 CONFIG_ARM64_ERRATUM_824069=y
@@ -126,9 +127,13 @@ CONFIG_CPU_IDLE_GOV_MENU=y
 CONFIG_CPU_PM=y
 CONFIG_CPU_RMAP=y
 CONFIG_CRC16=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_BS=y
+CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
 CONFIG_CRYPTO_CBC=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_CRYPTD=y
 CONFIG_CRYPTO_CTS=y
 CONFIG_CRYPTO_DRBG=y
 CONFIG_CRYPTO_DRBG_HMAC=y
@@ -142,7 +147,10 @@ CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_RNG_DEFAULT=y
 CONFIG_CRYPTO_SEQIV=y
 CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
 CONFIG_CRYPTO_SHA512=y
+CONFIG_CRYPTO_SHA512_ARM64=y
+CONFIG_CRYPTO_SIMD=y
 CONFIG_CRYPTO_XTS=y
 CONFIG_DCACHE_WORD_ACCESS=y
 CONFIG_DEBUG_BUGVERBOSE=y
diff --git a/target/linux/bcm4908/config-5.10 b/target/linux/bcm4908/config-5.10
index 0959249c13..7ded9598d2 100644
--- a/target/linux/bcm4908/config-5.10
+++ b/target/linux/bcm4908/config-5.10
@@ -14,6 +14,7 @@ CONFIG_ARCH_STACKWALK=y
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CRYPTO=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PA_BITS=48
 CONFIG_ARM64_PA_BITS_48=y
@@ -47,10 +48,17 @@ CONFIG_COMMON_CLK=y
 # CONFIG_COMPAT_32BIT_TIME is not set
 CONFIG_CPU_RMAP=y
 CONFIG_CRC16=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_CRYPTD=y
 CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
 CONFIG_CRYPTO_HASH_INFO=y
 CONFIG_CRYPTO_LZO=y
 CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_SIMD=y
 CONFIG_CRYPTO_ZSTD=y
 CONFIG_DCACHE_WORD_ACCESS=y
 CONFIG_DMA_DIRECT_REMAP=y
diff --git a/target/linux/generic/hack-5.10/700-swconfig_switch_drivers.patch b/target/linux/generic/hack-5.10/700-swconfig_switch_drivers.patch
index b90e1fc441..48be440025 100644
--- a/target/linux/generic/hack-5.10/700-swconfig_switch_drivers.patch
+++ b/target/linux/generic/hack-5.10/700-swconfig_switch_drivers.patch
@@ -36,7 +36,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +	  Support for FC is very limited.
 +
 +config AR8216_PHY
-+	tristate "Driver for Atheros AR8216 switches"
++	tristate "Driver for Atheros AR8216/8327 switches"
 +	select SWCONFIG
 +	select ETHERNET_PACKET_MANGLE
 +
@@ -95,13 +95,15 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  config AMD_PHY
 --- a/drivers/net/phy/Makefile
 +++ b/drivers/net/phy/Makefile
-@@ -24,6 +24,19 @@ libphy-$(CONFIG_LED_TRIGGER_PHY)	+= phy_
+@@ -24,6 +24,21 @@ libphy-$(CONFIG_LED_TRIGGER_PHY)	+= phy_
  obj-$(CONFIG_PHYLINK)		+= phylink.o
  obj-$(CONFIG_PHYLIB)		+= libphy.o
  
 +obj-$(CONFIG_SWCONFIG)		+= swconfig.o
 +obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
-+obj-$(CONFIG_AR8216_PHY)	+= ar8216.o ar8327.o
++obj-$(CONFIG_AR8216_PHY)	+= ar8xxx.o
++ar8xxx-y			+= ar8216.o
++ar8xxx-y			+= ar8327.o
 +obj-$(CONFIG_SWCONFIG_B53)	+= b53/
 +obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
 +obj-$(CONFIG_PSB6970_PHY)	+= psb6970.o
diff --git a/target/linux/generic/hack-5.15/700-swconfig_switch_drivers.patch b/target/linux/generic/hack-5.15/700-swconfig_switch_drivers.patch
index 560937a7c1..48be440025 100644
--- a/target/linux/generic/hack-5.15/700-swconfig_switch_drivers.patch
+++ b/target/linux/generic/hack-5.15/700-swconfig_switch_drivers.patch
@@ -36,8 +36,9 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +	  Support for FC is very limited.
 +
 +config AR8216_PHY
-+	tristate "Driver for Atheros AR8216 switches"
++	tristate "Driver for Atheros AR8216/8327 switches"
 +	select SWCONFIG
++	select ETHERNET_PACKET_MANGLE
 +
 +config AR8216_PHY_LEDS
 +	bool "Atheros AR8216 switch LED support"
@@ -52,7 +53,6 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +config PSB6970_PHY
 +	tristate "Lantiq XWAY Tantos (PSB6970) Ethernet switch"
 +	select SWCONFIG
-+	select ETHERNET_PACKET_MANGLE
 +
 +config RTL8306_PHY
 +	tristate "Driver for Realtek RTL8306S switches"
@@ -95,13 +95,15 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  config AMD_PHY
 --- a/drivers/net/phy/Makefile
 +++ b/drivers/net/phy/Makefile
-@@ -24,6 +24,19 @@ libphy-$(CONFIG_LED_TRIGGER_PHY)	+= phy_
+@@ -24,6 +24,21 @@ libphy-$(CONFIG_LED_TRIGGER_PHY)	+= phy_
  obj-$(CONFIG_PHYLINK)		+= phylink.o
  obj-$(CONFIG_PHYLIB)		+= libphy.o
  
 +obj-$(CONFIG_SWCONFIG)		+= swconfig.o
 +obj-$(CONFIG_ADM6996_PHY)	+= adm6996.o
-+obj-$(CONFIG_AR8216_PHY)	+= ar8216.o ar8327.o
++obj-$(CONFIG_AR8216_PHY)	+= ar8xxx.o
++ar8xxx-y			+= ar8216.o
++ar8xxx-y			+= ar8327.o
 +obj-$(CONFIG_SWCONFIG_B53)	+= b53/
 +obj-$(CONFIG_IP17XX_PHY)	+= ip17xx.o
 +obj-$(CONFIG_PSB6970_PHY)	+= psb6970.o
diff --git a/target/linux/generic/pending-5.10/444-mtd-nand-rawnand-add-support-for-Toshiba-TC58NVG0S3H.patch b/target/linux/generic/pending-5.10/444-mtd-nand-rawnand-add-support-for-Toshiba-TC58NVG0S3H.patch
index 54df828875..f644c4a73e 100644
--- a/target/linux/generic/pending-5.10/444-mtd-nand-rawnand-add-support-for-Toshiba-TC58NVG0S3H.patch
+++ b/target/linux/generic/pending-5.10/444-mtd-nand-rawnand-add-support-for-Toshiba-TC58NVG0S3H.patch
@@ -13,6 +13,7 @@ has 128 bytes OOB. This adds a static NAND ID entry to correct this.
 Tested on FRITZ!Box 7530 flashed with OpenWrt.
 
 Signed-off-by: Andreas Böhler <dev@aboehler.at>
+(changed id_len to 8)
 ---
  drivers/mtd/nand/raw/nand_ids.c | 3 +++
  1 file changed, 3 insertions(+)
@@ -27,7 +28,7 @@ index 6e41902be35f..d64adbd1ce6b 100644
  		  SZ_2K, SZ_128, SZ_128K, 0, 8, 64, NAND_ECC_INFO(1, SZ_512), },
 +	{"TC58NVG0S3HTA00 1G 3.3V 8-bit",
 +		{ .id = {0x98, 0xf1, 0x80, 0x15} },
-+		  SZ_2K, SZ_128, SZ_128K, 0, 4, 128, NAND_ECC_INFO(8, SZ_512), },
++		  SZ_2K, SZ_128, SZ_128K, 0, 8, 128, NAND_ECC_INFO(8, SZ_512), },
  	{"TC58NVG2S0F 4G 3.3V 8-bit",
  		{ .id = {0x98, 0xdc, 0x90, 0x26, 0x76, 0x15, 0x01, 0x08} },
  		  SZ_4K, SZ_512, SZ_256K, 0, 8, 224, NAND_ECC_INFO(4, SZ_512) },
diff --git a/target/linux/generic/pending-5.15/444-mtd-nand-rawnand-add-support-for-Toshiba-TC58NVG0S3H.patch b/target/linux/generic/pending-5.15/444-mtd-nand-rawnand-add-support-for-Toshiba-TC58NVG0S3H.patch
index 27c863b992..bafdaccd25 100644
--- a/target/linux/generic/pending-5.15/444-mtd-nand-rawnand-add-support-for-Toshiba-TC58NVG0S3H.patch
+++ b/target/linux/generic/pending-5.15/444-mtd-nand-rawnand-add-support-for-Toshiba-TC58NVG0S3H.patch
@@ -13,6 +13,7 @@ has 128 bytes OOB. This adds a static NAND ID entry to correct this.
 Tested on FRITZ!Box 7530 flashed with OpenWrt.
 
 Signed-off-by: Andreas Böhler <dev@aboehler.at>
+(changed id_len to 8)
 ---
  drivers/mtd/nand/raw/nand_ids.c | 3 +++
  1 file changed, 3 insertions(+)
@@ -25,7 +26,7 @@ Signed-off-by: Andreas Böhler <dev@aboehler.at>
  		  SZ_2K, SZ_128, SZ_128K, 0, 8, 64, NAND_ECC_INFO(1, SZ_512), },
 +	{"TC58NVG0S3HTA00 1G 3.3V 8-bit",
 +		{ .id = {0x98, 0xf1, 0x80, 0x15} },
-+		  SZ_2K, SZ_128, SZ_128K, 0, 4, 128, NAND_ECC_INFO(8, SZ_512), },
++		  SZ_2K, SZ_128, SZ_128K, 0, 8, 128, NAND_ECC_INFO(8, SZ_512), },
  	{"TC58NVG2S0F 4G 3.3V 8-bit",
  		{ .id = {0x98, 0xdc, 0x90, 0x26, 0x76, 0x15, 0x01, 0x08} },
  		  SZ_4K, SZ_512, SZ_256K, 0, 8, 224, NAND_ECC_INFO(4, SZ_512) },
diff --git a/target/linux/generic/pending-5.15/760-net-dsa-mv88e6xxx-fix-vlan-setup.patch b/target/linux/generic/pending-5.15/760-net-dsa-mv88e6xxx-fix-vlan-setup.patch
deleted file mode 100644
index 0c9604e5a9..0000000000
--- a/target/linux/generic/pending-5.15/760-net-dsa-mv88e6xxx-fix-vlan-setup.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From a1b291f3f6c80a6c5ccad7283fc472d77a2a4763 Mon Sep 17 00:00:00 2001
-From: Russell King <rmk+kernel@armlinux.org.uk>
-Date: Sun, 22 Dec 2019 12:40:11 +0000
-Subject: [PATCH] net: dsa: mv88e6xxx: fix vlan setup
-
-Provide an option that drivers can set to indicate they want to receive
-vlan configuration even when vlan filtering is disabled. This is safe
-for Marvell DSA bridges, which do not look up ingress traffic in the
-VTU if the port is in 8021Q disabled state. Whether this change is
-suitable for all DSA bridges is not known.
-
-Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
-Signed-off-by: DENG Qingfang <dqfext@gmail.com>
----
- drivers/net/dsa/mv88e6xxx/chip.c |  1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/net/dsa/mv88e6xxx/chip.c
-+++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -3193,6 +3193,7 @@ static int mv88e6xxx_setup(struct dsa_sw
- 
- 	chip->ds = ds;
- 	ds->slave_mii_bus = mv88e6xxx_default_mdio_bus(chip);
-+	ds->configure_vlan_while_not_filtering = true;
- 
- 	/* Since virtual bridges are mapped in the PVT, the number we support
- 	 * depends on the physical switch topology. We need to let DSA figure
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
index f41b5ce7a8..c8f5e713b3 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@@ -82,7 +82,8 @@ ipq40xx_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0u@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1"
 		;;
-	avm,fritzrepeater-3000)
+	avm,fritzrepeater-3000|\
+	linksys,whw01-v1)
 		ucidef_add_switch "switch0" \
 			"0u@eth0" "4:lan:1" "5:lan:2"
 		;;
diff --git a/target/linux/ipq40xx/base-files/etc/init.d/bootcount b/target/linux/ipq40xx/base-files/etc/init.d/bootcount
index 9abfbddc43..367ccfcd0c 100755
--- a/target/linux/ipq40xx/base-files/etc/init.d/bootcount
+++ b/target/linux/ipq40xx/base-files/etc/init.d/bootcount
@@ -10,7 +10,8 @@ boot() {
 		;;
 	linksys,ea6350v3|\
 	linksys,ea8300|\
-	linksys,mr8300)
+	linksys,mr8300|\
+	linksys,whw01-v1)
 		mtd resetbc s_env || true
 		;;
 	netgear,wac510)
diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
index aa2d60d564..276682313d 100644
--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
@@ -163,7 +163,8 @@ platform_do_upgrade() {
 		;;
 	linksys,ea6350v3 |\
 	linksys,ea8300 |\
-	linksys,mr8300)
+	linksys,mr8300 |\
+	linksys,whw01-v1)
 		platform_do_upgrade_linksys "$1"
 		;;
 	meraki,mr33)
diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-whw01-v1.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-whw01-v1.dts
new file mode 100644
index 0000000000..6f244132ea
--- /dev/null
+++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4018-whw01-v1.dts
@@ -0,0 +1,330 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qcom-ipq4019.dtsi"
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Linksys WHW01 v1";
+	compatible = "linksys,whw01-v1";
+
+	aliases {
+		serial0 = &blsp1_uart1;
+		led-boot = &led_system_blue;
+		led-running = &led_system_blue;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=/dev/ubiblock0_0";
+	};
+
+	soc {
+		keys {
+			compatible = "gpio-keys";
+
+			reset {
+				label = "reset";
+				gpios = <&tlmm 63 GPIO_ACTIVE_LOW>;
+				linux,code = <KEY_RESTART>;
+			};
+		};
+
+		ess-psgmii@98000 {
+			status = "okay";
+		};
+
+		ess_tcsr@1953000 {
+			status = "okay";
+		};
+
+		ess-switch@c000000 {
+			status = "okay";
+		};
+
+		edma@c080000 {
+			status = "okay";
+		};
+	};
+};
+
+&blsp_dma {
+	status = "okay";
+};
+
+&blsp1_i2c3 {
+	status = "okay";
+	pinctrl-0 = <&i2c_0_pins>;
+	pinctrl-1 = <&i2c_0_pins>;
+	pinctrl-names = "i2c_active", "i2c_sleep";
+
+	leds@62 {
+		compatible = "nxp,pca9633";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x62>;
+
+		/* RGB? */
+		led@0 {
+			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led_system_blue: led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
+			linux,default-trigger = "default-on";
+		};
+	};
+};
+
+&blsp1_spi1 {
+	status = "okay";
+	pinctrl-0 = <&spi_0_pins>;
+	pinctrl-names = "default";
+	cs-gpios = <&tlmm 54 GPIO_ACTIVE_HIGH>, <&tlmm 4 GPIO_ACTIVE_HIGH>;
+
+	nor@0 {
+		reg = <0>;
+		compatible = "jedec,spi-nor";
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:SBL1";
+				reg = <0x0 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "0:MIBIB";
+				reg = <0x40000 0x20000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "0:QSEE";
+				reg = <0x60000 0x60000>;
+				read-only;
+			};
+
+			partition@c0000 {
+				label = "0:CDT";
+				reg = <0xc0000 0x10000>;
+				read-only;
+			};
+
+			partition@d0000 {
+				label = "APPSBL";
+				reg = <0xd0000 0xa0000>;
+				read-only;
+			};
+
+			partition@170000 {
+				label = "0:ART";
+				reg = <0x170000 0x10000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				precal_art_1000: precal@1000 {
+					reg = <0x1000 0x2f20>;
+				};
+
+				precal_art_5000: precal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			partition@180000 {
+				label = "u_env";
+				reg = <0x180000 0x40000>;
+			};
+
+			partition@1c0000 {
+				label = "s_env";
+				reg = <0x1c0000 0x20000>;
+			};
+
+			partition@1e0000 {
+				label = "devinfo";
+				reg = <0x1e0000 0x20000>;
+				read-only;
+			};
+		};
+	};
+
+	nand@1 {
+		reg = <1>;
+		compatible = "spi-nand";
+		spi-max-frequency = <24000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "kernel";
+				reg = <0x0000000 0x5000000>;
+			};
+
+			partition@600000 {
+				label = "rootfs";
+				reg = <0x0600000 0x4a00000>;
+			};
+
+			partition@5000000 {
+				label = "alt_kernel";
+				reg = <0x5000000 0x5000000>;
+			};
+
+			partition@5600000 {
+				label = "alt_rootfs";
+				reg = <0x5600000 0x4a00000>;
+			};
+
+			partition@a000000 {
+				label = "sysdiag";
+				reg = <0xa000000 0x0200000>;
+				read-only;
+			};
+
+			partition@a200000 {
+				label = "syscfg";
+				reg = <0xa200000 0x5e00000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&blsp1_uart1 {
+	pinctrl-0 = <&serial_pins>;
+	pinctrl-names = "default";
+	status = "okay";
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	phy-reset-gpio = <&tlmm 62 GPIO_ACTIVE_HIGH>;
+};
+
+&tlmm {
+	mdio_pins: mdio_pinmux {
+		mux_mdio {
+			pins = "gpio53";
+			function = "mdio";
+			bias-pull-up;
+		};
+
+		mux_mdc {
+			pins = "gpio52";
+			function = "mdc";
+			bias-pull-up;
+		};
+	};
+
+	serial_pins: serial_pinmux {
+		mux {
+			pins = "gpio60", "gpio61";
+			function = "blsp_uart0";
+			bias-disable;
+		};
+	};
+
+	spi_0_pins: spi_0_pinmux {
+		pinmux {
+			function = "blsp_spi0";
+			pins = "gpio55", "gpio56", "gpio57";
+		};
+
+		pinmux_cs {
+			function = "gpio";
+			pins = "gpio54", "gpio4";
+		};
+
+		pinconf {
+			pins = "gpio55", "gpio56", "gpio57";
+			drive-strength = <12>;
+			bias-disable;
+		};
+
+		pinconf_cs {
+			pins = "gpio54", "gpio4";
+			drive-strength = <2>;
+			bias-disable;
+			output-high;
+		};
+	};
+
+	i2c_0_pins: i2c_0_pinmux {
+		mux {
+			function = "blsp_i2c0";
+			pins = "gpio58", "gpio59";
+			bias-disable;
+		};
+	};
+
+	reset_pinmux {
+		mux {
+			pins = "gpio63";
+			bias-pull-up;
+		};
+	};
+};
+
+&usb2 {
+	status = "okay";
+};
+
+&usb2_hs_phy {
+	status = "okay";
+};
+
+&usb3 {
+	status = "okay";
+};
+
+&usb3_hs_phy {
+	status = "okay";
+};
+
+&usb3_ss_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi0 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "linksys-whw01-v1";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_1000>;
+};
+
+&wifi1 {
+	status = "okay";
+	qcom,ath10k-calibration-variant = "linksys-whw01-v1";
+	nvmem-cell-names = "pre-calibration";
+	nvmem-cells = <&precal_art_5000>;
+};
diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
index 44880d157c..0ddff52ef8 100644
--- a/target/linux/ipq40xx/image/generic.mk
+++ b/target/linux/ipq40xx/image/generic.mk
@@ -662,6 +662,25 @@ define Device/linksys_mr8300
 endef
 TARGET_DEVICES += linksys_mr8300
 
+define Device/linksys_whw01-v1
+	$(call Device/FitzImage)
+	DEVICE_VENDOR := Linksys
+	DEVICE_MODEL := WHW01
+	DEVICE_VARIANT := v1
+	KERNEL_SIZE := 6144k
+	IMAGE_SIZE := 28704512  # 28032k minus linksys signature (256-bytes).
+	SOC := qcom-ipq4018
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	UBINIZE_OPTS := -E 5    # EOD marks to "hide" factory sig at EOF
+	IMAGES += factory.bin
+	IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
+		append-ubi | linksys-image type=WHW01 | pad-to $$$$(PAGESIZE) | \
+		check-size
+	DEVICE_PACKAGES := uboot-envtools kmod-leds-pca963x
+endef
+TARGET_DEVICES += linksys_whw01-v1
+
 define Device/luma_wrtq-329acn
 	$(call Device/FitImage)
 	DEVICE_VENDOR := Luma Home
diff --git a/target/linux/ipq40xx/patches-5.10/901-arm-boot-add-dts-files.patch b/target/linux/ipq40xx/patches-5.10/901-arm-boot-add-dts-files.patch
index a6a082a2c8..99ea2e423e 100644
--- a/target/linux/ipq40xx/patches-5.10/901-arm-boot-add-dts-files.patch
+++ b/target/linux/ipq40xx/patches-5.10/901-arm-boot-add-dts-files.patch
@@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
 
 --- a/arch/arm/boot/dts/Makefile
 +++ b/arch/arm/boot/dts/Makefile
-@@ -903,11 +903,76 @@ dtb-$(CONFIG_ARCH_QCOM) += \
+@@ -903,11 +903,77 @@ dtb-$(CONFIG_ARCH_QCOM) += \
  	qcom-apq8074-dragonboard.dtb \
  	qcom-apq8084-ifc6540.dtb \
  	qcom-apq8084-mtp.dtb \
@@ -40,6 +40,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
 +	qcom-ipq4018-rt-ac58u.dtb \
 +	qcom-ipq4018-rutx10.dtb \
 +	qcom-ipq4018-wac510.dtb \
++	qcom-ipq4018-whw01-v1.dtb \
 +	qcom-ipq4018-wre6606.dtb \
 +	qcom-ipq4018-wrtq-329acn.dtb \
  	qcom-ipq4019-ap.dk01.1-c1.dtb \
diff --git a/target/linux/ipq40xx/patches-5.15/901-arm-boot-add-dts-files.patch b/target/linux/ipq40xx/patches-5.15/901-arm-boot-add-dts-files.patch
index af1c695c26..f9b3c513bb 100644
--- a/target/linux/ipq40xx/patches-5.15/901-arm-boot-add-dts-files.patch
+++ b/target/linux/ipq40xx/patches-5.15/901-arm-boot-add-dts-files.patch
@@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
 
 --- a/arch/arm/boot/dts/Makefile
 +++ b/arch/arm/boot/dts/Makefile
-@@ -951,11 +951,75 @@ dtb-$(CONFIG_ARCH_QCOM) += \
+@@ -951,11 +951,76 @@ dtb-$(CONFIG_ARCH_QCOM) += \
  	qcom-ipq4018-ap120c-ac.dtb \
  	qcom-ipq4018-ap120c-ac-bit.dtb \
  	qcom-ipq4018-jalapeno.dtb \
@@ -39,6 +39,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
 +	qcom-ipq4018-rt-ac58u.dtb \
 +	qcom-ipq4018-rutx10.dtb \
 +	qcom-ipq4018-wac510.dtb \
++	qcom-ipq4018-whw01-v1.dtb \
 +	qcom-ipq4018-wre6606.dtb \
 +	qcom-ipq4018-wrtq-329acn.dtb \
  	qcom-ipq4019-ap.dk01.1-c1.dtb \
diff --git a/target/linux/layerscape/armv8_64b/config-5.10 b/target/linux/layerscape/armv8_64b/config-5.10
index a43025651a..b5f9335995 100644
--- a/target/linux/layerscape/armv8_64b/config-5.10
+++ b/target/linux/layerscape/armv8_64b/config-5.10
@@ -18,6 +18,7 @@ CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
 CONFIG_ARM64_CNP=y
+CONFIG_ARM64_CRYPTO=y
 CONFIG_ARM64_ERRATUM_1165522=y
 CONFIG_ARM64_ERRATUM_1286807=y
 CONFIG_ARM64_ERRATUM_819472=y
@@ -158,11 +159,17 @@ CONFIG_CRC_ITU_T=y
 CONFIG_CRC_T10DIF=y
 CONFIG_CROSS_MEMORY_ATTACH=y
 # CONFIG_CROS_EC is not set
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_CRYPTO_AUTHENC=y
 CONFIG_CRYPTO_BLAKE2B=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_CRCT10DIF=y
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=y
+CONFIG_CRYPTO_CRYPTD=y
 CONFIG_CRYPTO_DEFLATE=y
 CONFIG_CRYPTO_DES=y
 CONFIG_CRYPTO_DEV_FSL_CAAM=y
@@ -181,6 +188,7 @@ CONFIG_CRYPTO_DEV_FSL_CAAM_RNG_API=y
 CONFIG_CRYPTO_DEV_FSL_DPAA2_CAAM=y
 CONFIG_CRYPTO_ECB=y
 CONFIG_CRYPTO_ENGINE=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
 CONFIG_CRYPTO_HASH_INFO=y
 CONFIG_CRYPTO_HW=y
 CONFIG_CRYPTO_LIB_DES=y
@@ -190,6 +198,9 @@ CONFIG_CRYPTO_RNG=y
 CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_RSA=y
 CONFIG_CRYPTO_SHA256=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SIMD=y
 CONFIG_CRYPTO_XTS=y
 CONFIG_CRYPTO_XXHASH=y
 CONFIG_CRYPTO_ZSTD=y
diff --git a/target/linux/mvebu/cortexa53/config-5.10 b/target/linux/mvebu/cortexa53/config-5.10
index a47d66c669..c96c0cb82c 100644
--- a/target/linux/mvebu/cortexa53/config-5.10
+++ b/target/linux/mvebu/cortexa53/config-5.10
@@ -9,6 +9,7 @@ CONFIG_ARCH_SPARSEMEM_DEFAULT=y
 CONFIG_ARCH_STACKWALK=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CRYPTO=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PA_BITS=48
 CONFIG_ARM64_PA_BITS_48=y
@@ -18,8 +19,8 @@ CONFIG_ARM64_TAGGED_ADDR_ABI=y
 CONFIG_ARM64_VA_BITS=39
 CONFIG_ARM64_VA_BITS_39=y
 CONFIG_ARMADA_37XX_CLK=y
-CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_ARMADA_37XX_RWTM_MBOX=y
+CONFIG_ARMADA_37XX_WATCHDOG=y
 CONFIG_ARMADA_AP806_SYSCON=y
 CONFIG_ARMADA_AP_CP_HELPER=y
 CONFIG_ARMADA_CP110_SYSCON=y
@@ -33,6 +34,17 @@ CONFIG_ARM_GIC_V3_ITS_PCI=y
 CONFIG_ARM_PSCI_FW=y
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA512_ARM64=y
+CONFIG_CRYPTO_SHA512_ARM64_CE=y
+CONFIG_CRYPTO_ZSTD=y
 CONFIG_DMA_DIRECT_REMAP=y
 # CONFIG_FLATMEM_MANUAL is not set
 CONFIG_FRAME_POINTER=y
@@ -44,6 +56,7 @@ CONFIG_HOLES_IN_ZONE=y
 CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
 CONFIG_MAILBOX=y
 # CONFIG_MAILBOX_TEST is not set
+CONFIG_MDIO_DEVRES=y
 CONFIG_MFD_SYSCON=y
 CONFIG_MMC_SDHCI_XENON=y
 CONFIG_MODULES_USE_ELF_RELA=y
@@ -80,4 +93,7 @@ CONFIG_THREAD_INFO_IN_TASK=y
 CONFIG_TURRIS_MOX_RWTM=y
 CONFIG_UNMAP_KERNEL_AT_EL0=y
 CONFIG_VMAP_STACK=y
+CONFIG_XXHASH=y
 CONFIG_ZONE_DMA32=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/mvebu/cortexa72/config-5.10 b/target/linux/mvebu/cortexa72/config-5.10
index 8d1ec7a283..c437b8b4f7 100644
--- a/target/linux/mvebu/cortexa72/config-5.10
+++ b/target/linux/mvebu/cortexa72/config-5.10
@@ -10,6 +10,7 @@ CONFIG_ARCH_SPARSEMEM_DEFAULT=y
 CONFIG_ARCH_STACKWALK=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CRYPTO=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PA_BITS=48
 CONFIG_ARM64_PA_BITS_48=y
@@ -20,6 +21,7 @@ CONFIG_ARM64_VA_BITS=39
 CONFIG_ARM64_VA_BITS_39=y
 CONFIG_ARMADA_37XX_CLK=y
 CONFIG_ARMADA_AP806_SYSCON=y
+CONFIG_ARMADA_AP_CPU_CLK=y
 CONFIG_ARMADA_AP_CP_HELPER=y
 CONFIG_ARMADA_CP110_SYSCON=y
 CONFIG_ARM_AMBA=y
@@ -32,6 +34,16 @@ CONFIG_ARM_GIC_V3_ITS_PCI=y
 CONFIG_ARM_PSCI_FW=y
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SHA256_ARM64=y
+CONFIG_CRYPTO_SHA2_ARM64_CE=y
+CONFIG_CRYPTO_SHA512_ARM64=y
+CONFIG_CRYPTO_SHA512_ARM64_CE=y
 CONFIG_CRYPTO_ZSTD=y
 CONFIG_DMA_DIRECT_REMAP=y
 # CONFIG_FLATMEM_MANUAL is not set
@@ -43,10 +55,11 @@ CONFIG_GENERIC_PINCONF=y
 CONFIG_HOLES_IN_ZONE=y
 CONFIG_HW_RANDOM_OMAP=y
 CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
-CONFIG_LEDS_IS31FL319X=y
 CONFIG_LEDS_IEI_WT61P803_PUZZLE=y
+CONFIG_LEDS_IS31FL319X=y
 CONFIG_MARVELL_10G_PHY=y
 CONFIG_MDIO_DEVRES=y
+CONFIG_MFD_CORE=y
 CONFIG_MFD_IEI_WT61P803_PUZZLE=y
 CONFIG_MFD_SYSCON=y
 CONFIG_MMC_SDHCI_XENON=y
diff --git a/target/linux/octeontx/config-5.10 b/target/linux/octeontx/config-5.10
index 6c87abf5b6..a3e00cfdb3 100644
--- a/target/linux/octeontx/config-5.10
+++ b/target/linux/octeontx/config-5.10
@@ -102,6 +102,7 @@ CONFIG_CRYPTO_ANSI_CPRNG=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
 CONFIG_CRYPTO_CRCT10DIF=y
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=y
 CONFIG_CRYPTO_CRYPTD=y
 CONFIG_CRYPTO_DRBG=y
 CONFIG_CRYPTO_DRBG_HMAC=y
diff --git a/target/linux/realtek/dts-5.10/rtl8382_zyxel_gs1900-24e.dts b/target/linux/realtek/dts-5.10/rtl8382_zyxel_gs1900-24e.dts
new file mode 100644
index 0000000000..3d00034a3b
--- /dev/null
+++ b/target/linux/realtek/dts-5.10/rtl8382_zyxel_gs1900-24e.dts
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-24e", "realtek,rtl838x-soc";
+	model = "ZyXEL GS1900-24E";
+};
+
+&mdio {
+	EXTERNAL_PHY(0)
+	EXTERNAL_PHY(1)
+	EXTERNAL_PHY(2)
+	EXTERNAL_PHY(3)
+	EXTERNAL_PHY(4)
+	EXTERNAL_PHY(5)
+	EXTERNAL_PHY(6)
+	EXTERNAL_PHY(7)
+
+	EXTERNAL_PHY(16)
+	EXTERNAL_PHY(17)
+	EXTERNAL_PHY(18)
+	EXTERNAL_PHY(19)
+	EXTERNAL_PHY(20)
+	EXTERNAL_PHY(21)
+	EXTERNAL_PHY(22)
+	EXTERNAL_PHY(23)
+};
+
+&switch0 {
+	ports {
+		SWITCH_PORT(1, 1, qsgmii)
+		SWITCH_PORT(0, 2, qsgmii)
+		SWITCH_PORT(3, 3, qsgmii)
+		SWITCH_PORT(2, 4, qsgmii)
+		SWITCH_PORT(5, 5, qsgmii)
+		SWITCH_PORT(4, 6, qsgmii)
+		SWITCH_PORT(7, 7, qsgmii)
+		SWITCH_PORT(6, 8, qsgmii)
+
+		SWITCH_PORT(9, 9, internal)
+		SWITCH_PORT(8, 10, internal)
+		SWITCH_PORT(11, 11, internal)
+		SWITCH_PORT(10, 12, internal)
+		SWITCH_PORT(13, 13, internal)
+		SWITCH_PORT(12, 14, internal)
+		SWITCH_PORT(15, 15, internal)
+		SWITCH_PORT(14, 16, internal)
+
+		SWITCH_PORT(17, 17, qsgmii)
+		SWITCH_PORT(16, 18, qsgmii)
+		SWITCH_PORT(19, 19, qsgmii)
+		SWITCH_PORT(18, 20, qsgmii)
+		SWITCH_PORT(21, 21, qsgmii)
+		SWITCH_PORT(20, 22, qsgmii)
+		SWITCH_PORT(23, 23, qsgmii)
+		SWITCH_PORT(22, 24, qsgmii)
+	};
+};
+
+&gpio1 {
+	/delete-node/ poe_enable;
+};
diff --git a/target/linux/realtek/image/rtl838x.mk b/target/linux/realtek/image/rtl838x.mk
index e17dc8c62d..289e37db16 100644
--- a/target/linux/realtek/image/rtl838x.mk
+++ b/target/linux/realtek/image/rtl838x.mk
@@ -153,6 +153,14 @@ define Device/zyxel_gs1900-24-v1
 endef
 TARGET_DEVICES += zyxel_gs1900-24-v1
 
+define Device/zyxel_gs1900-24e
+  $(Device/zyxel_gs1900)
+  SOC := rtl8382
+  DEVICE_MODEL := GS1900-24E
+  ZYXEL_VERS := AAHK
+endef
+TARGET_DEVICES += zyxel_gs1900-24e
+
 define Device/zyxel_gs1900-24hp-v1
   $(Device/zyxel_gs1900)
   SOC := rtl8382
diff --git a/target/linux/sunxi/cortexa53/config-5.10 b/target/linux/sunxi/cortexa53/config-5.10
index 95b81b5e40..1f7d95ded5 100644
--- a/target/linux/sunxi/cortexa53/config-5.10
+++ b/target/linux/sunxi/cortexa53/config-5.10
@@ -8,6 +8,7 @@ CONFIG_ARCH_SPARSEMEM_DEFAULT=y
 CONFIG_ARCH_STACKWALK=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CRYPTO=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PA_BITS=48
 CONFIG_ARM64_PA_BITS_48=y
@@ -28,6 +29,15 @@ CONFIG_ARM_SMMU_V3=y
 # CONFIG_ARM_SMMU_V3_SVA is not set
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SIMD=y
 CONFIG_DMA_DIRECT_REMAP=y
 CONFIG_DWMAC_SUN8I=y
 CONFIG_EEPROM_AT24=y
diff --git a/target/linux/sunxi/cortexa53/config-5.15 b/target/linux/sunxi/cortexa53/config-5.15
index 4678c065ce..7a15b495ad 100644
--- a/target/linux/sunxi/cortexa53/config-5.15
+++ b/target/linux/sunxi/cortexa53/config-5.15
@@ -1,38 +1,46 @@
 CONFIG_64BIT=y
+CONFIG_ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE=y
 CONFIG_ARCH_MMAP_RND_BITS=18
 CONFIG_ARCH_MMAP_RND_BITS_MAX=24
 CONFIG_ARCH_MMAP_RND_BITS_MIN=18
 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11
 CONFIG_ARCH_PROC_KCORE_TEXT=y
-CONFIG_ARCH_SPARSEMEM_DEFAULT=y
 CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_WANTS_NO_INSTR=y
 CONFIG_ARM64=y
 CONFIG_ARM64_4K_PAGES=y
+CONFIG_ARM64_CRYPTO=y
+CONFIG_ARM64_LD_HAS_FIX_ERRATUM_843419=y
 CONFIG_ARM64_PAGE_SHIFT=12
 CONFIG_ARM64_PA_BITS=48
 CONFIG_ARM64_PA_BITS_48=y
 CONFIG_ARM64_TAGGED_ADDR_ABI=y
 CONFIG_ARM64_VA_BITS=39
 CONFIG_ARM64_VA_BITS_39=y
-CONFIG_ARM64_WORKAROUND_REPEAT_TLBI=y
-CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT=y
 CONFIG_ARM_AMBA=y
 CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y
 CONFIG_ARM_GIC_V3=y
 CONFIG_ARM_GIC_V3_ITS=y
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
+CONFIG_CRYPTO_AES_ARM64=y
+CONFIG_CRYPTO_AES_ARM64_CE=y
+CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
+CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
+CONFIG_CRYPTO_CRCT10DIF_ARM64_CE=y
+CONFIG_CRYPTO_CRYPTD=y
+CONFIG_CRYPTO_GHASH_ARM64_CE=y
+CONFIG_CRYPTO_SHA1_ARM64_CE=y
+CONFIG_CRYPTO_SIMD=y
 CONFIG_DMA_DIRECT_REMAP=y
 CONFIG_DWMAC_SUN8I=y
 CONFIG_EEPROM_AT24=y
-# CONFIG_FLATMEM_MANUAL is not set
 CONFIG_FRAME_POINTER=y
 CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
-CONFIG_GENERIC_CPU_VULNERABILITIES=y
 CONFIG_GENERIC_CSUM=y
+CONFIG_GENERIC_FIND_FIRST_BIT=y
 CONFIG_GENERIC_MSI_IRQ=y
 CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
-CONFIG_HOLES_IN_ZONE=y
 CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
 CONFIG_MDIO_BUS_MUX=y
 CONFIG_MICREL_PHY=y
@@ -41,6 +49,7 @@ CONFIG_MUSB_PIO_ONLY=y
 CONFIG_NEED_SG_DMA_LENGTH=y
 CONFIG_NOP_USB_XCEIV=y
 CONFIG_NO_IOPORT_MAP=y
+CONFIG_NVMEM_SYSFS=y
 CONFIG_PARTITION_PERCPU=y
 CONFIG_PHY_SUN50I_USB3=y
 CONFIG_PINCTRL_SUN50I_A100=y
@@ -53,12 +62,10 @@ CONFIG_PINCTRL_SUN50I_H6_R=y
 CONFIG_QUEUED_RWLOCKS=y
 CONFIG_QUEUED_SPINLOCKS=y
 CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
-CONFIG_RTC_DRV_SUN6I=y
 # CONFIG_SND_SUN50I_CODEC_ANALOG is not set
 CONFIG_SOUND_OSS_CORE_PRECLAIM=y
 CONFIG_SPARSEMEM=y
 CONFIG_SPARSEMEM_EXTREME=y
-CONFIG_SPARSEMEM_MANUAL=y
 CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
 CONFIG_SUN50I_A100_CCU=y
@@ -66,6 +73,7 @@ CONFIG_SUN50I_A100_R_CCU=y
 CONFIG_SUN50I_A64_CCU=y
 CONFIG_SUN50I_DE2_BUS=y
 CONFIG_SUN50I_ERRATUM_UNKNOWN1=y
+# CONFIG_SUN50I_H616_CCU is not set
 CONFIG_SUN50I_H6_CCU=y
 CONFIG_SUN50I_H6_R_CCU=y
 CONFIG_SYSCTL_EXCEPTION_TRACE=y
diff --git a/tools/mkimage/patches/100-increase-tmpfile-name-length-limit.patch b/tools/mkimage/patches/100-increase-tmpfile-name-length-limit.patch
new file mode 100644
index 0000000000..d375f40f61
--- /dev/null
+++ b/tools/mkimage/patches/100-increase-tmpfile-name-length-limit.patch
@@ -0,0 +1,11 @@
+--- a/tools/mkimage.h
++++ b/tools/mkimage.h
+@@ -42,7 +42,7 @@ static inline ulong map_to_sysmem(void *
+ }
+ 
+ #define MKIMAGE_TMPFILE_SUFFIX		".tmp"
+-#define MKIMAGE_MAX_TMPFILE_LEN		256
++#define MKIMAGE_MAX_TMPFILE_LEN		1024
+ #define MKIMAGE_DEFAULT_DTC_OPTIONS	"-I dts -O dtb -p 500"
+ #define MKIMAGE_MAX_DTC_CMDLINE_LEN	2 * MKIMAGE_MAX_TMPFILE_LEN + 35
+