LEDE v17.01.4: adjust config defaults

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

feeds.conf.default

@@ -1,4 +1,4 @@
-src-git packages https://git.lede-project.org/feed/packages.git^21b2e3eb761ea79bf3a8d2b6368435887960f5c2
-src-git luci https://git.lede-project.org/project/luci.git^079f65a628a4c4179578c043d2905efea93bb167
+src-git packages https://git.lede-project.org/feed/packages.git^cd5c448758f30868770b9ebf8b656c1a4211a240
+src-git luci https://git.lede-project.org/project/luci.git^d3f0685d63c1291359dc5dd089c82fa1e150e0c6
 src-git routing https://git.lede-project.org/feed/routing.git^d11075cd40a88602bf4ba2b275f72100ddcb4767
 src-git telephony https://git.lede-project.org/feed/telephony.git^ac6415e61f147a6892fd2785337aec93ddc68fa9

include/host-build.mk

@@ -77,6 +77,10 @@ HOST_MAKE_FLAGS =
 
 HOST_CONFIGURE_CMD = $(BASH) ./configure
 
+ifeq ($(HOST_OS),Darwin)
+  HOST_CONFIG_SITE:=$(INCLUDE_DIR)/site/darwin
+endif
+
 define Host/Configure/Default
 	$(if $(HOST_CONFIGURE_PARALLEL),+)(cd $(HOST_BUILD_DIR)/$(3); \
 		if [ -x configure ]; then \
@@ -127,6 +131,7 @@ define Host/Exports/Default
   $(1) : export PKG_CONFIG_PATH=$$(STAGING_DIR_HOST)/lib/pkgconfig:$$(HOST_BUILD_PREFIX)/lib/pkgconfig
   $(1) : export PKG_CONFIG_LIBDIR=$$(HOST_BUILD_PREFIX)/lib/pkgconfig
   $(1) : export CCACHE_DIR:=$(STAGING_DIR_HOST)/ccache
+  $(if $(HOST_CONFIG_SITE),$(1) : export CONFIG_SITE:=$(HOST_CONFIG_SITE))
   $(if $(IS_PACKAGE_BUILD),$(1) : export PATH=$$(TARGET_PATH_PKG))
 endef
 Host/Exports=$(Host/Exports/Default)

include/kernel-version.mk

@@ -3,10 +3,10 @@
 LINUX_RELEASE?=1
 
 LINUX_VERSION-3.18 = .43
-LINUX_VERSION-4.4 = .89
+LINUX_VERSION-4.4 = .92
 
 LINUX_KERNEL_HASH-3.18.43 = 1236e8123a6ce537d5029232560966feed054ae31776fe8481dd7d18cdd5492c
-LINUX_KERNEL_HASH-4.4.89 = a81d1b1306e4fddee5d6f7219090a616073b02f4069e44522a9c0454b17f2b67
+LINUX_KERNEL_HASH-4.4.92 = 53f8cd8b024444df0f242f8e6ab5147b0b009d7a30e8b2ed3854e8d17937460d
 
 ifdef KERNEL_PATCHVER
   LINUX_VERSION:=$(KERNEL_PATCHVER)$(strip $(LINUX_VERSION-$(KERNEL_PATCHVER)))

include/site/darwin

@@ -0,0 +1,2 @@
+ac_cv_func_futimens=no
+ac_cv_func_utimensat=no

include/version.mk

@@ -31,16 +31,16 @@ qstrip_escape=$(subst ','\'',$(call qstrip,$(1)))
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))
 
 VERSION_NUMBER:=$(call qstrip_escape,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),17.01.3)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),17.01.4)
 
 VERSION_CODE:=$(call qstrip_escape,$(CONFIG_VERSION_CODE))
-VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r3533-d0bf257c46)
+VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r3560-79f57e422d)
 
 VERSION_NICK:=$(call qstrip_escape,$(CONFIG_VERSION_NICK))
 VERSION_NICK:=$(if $(VERSION_NICK),$(VERSION_NICK),$(RELEASE))
 
 VERSION_REPO:=$(call qstrip_escape,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.lede-project.org/releases/17.01.3)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.lede-project.org/releases/17.01.4)
 
 VERSION_DIST:=$(call qstrip_escape,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),LEDE)

package/base-files/image-config.in

@@ -190,7 +190,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "http://downloads.lede-project.org/releases/17.01.3"
+		default "http://downloads.lede-project.org/releases/17.01.4"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:

package/kernel/mac80211/files/regdb.txt

@@ -85,12 +85,20 @@ country AT: DFS-ETSI
 	# 60 GHz band channels 1-4, ref: Etsi En 302 567
 	(57000 - 66000 @ 2160), (40)
 
+# Source:
+# https://www.legislation.gov.au/Details/F2016C00432
+# Both DFS-ETSI and DFS-FCC are acceptable per AS/NZS 4268 Appendix B.
+# The EIRP for DFS bands can be increased by 3dB if TPC is implemented.
+# In order to allow 80MHz operation between 5650-5730MHz the upper boundary
+# of this more restrictive band has been shifted up by 5MHz from 5725MHz.
 country AU: DFS-ETSI
-	(2402 - 2482 @ 40), (20)
-	(5170 - 5250 @ 80), (17), AUTO-BW
-	(5250 - 5330 @ 80), (24), DFS, AUTO-BW
-	(5490 - 5710 @ 160), (24), DFS
-	(5735 - 5835 @ 80), (30)
+	(2400 - 2483.5 @ 40), (36)
+	(5150 - 5250 @ 80), (23), NO-OUTDOOR, AUTO-BW
+	(5250 - 5350 @ 80), (20), NO-OUTDOOR, AUTO-BW, DFS
+	(5470 - 5600 @ 80), (27), DFS
+	(5650 - 5730 @ 80), (27), DFS
+	(5730 - 5850 @ 80), (36)
+	(57000 - 66000 @ 2160), (43), NO-OUTDOOR
 
 country AW: DFS-ETSI
 	(2402 - 2482 @ 40), (20)
@@ -230,9 +238,9 @@ country BZ: DFS-JP
 
 country CA: DFS-FCC
 	(2402 - 2472 @ 40), (30)
-	(5170 - 5250 @ 80), (17), AUTO-BW
-	(5250 - 5330 @ 80), (24), DFS, AUTO-BW
-	(5490 - 5600 @ 80), (24), DFS
+	(5150 - 5250 @ 80), (23), AUTO-BW
+	(5250 - 5350 @ 80), (24), DFS, AUTO-BW
+	(5470 - 5600 @ 80), (24), DFS
 	(5650 - 5730 @ 80), (24), DFS
 	(5735 - 5835 @ 80), (30)
 
@@ -580,11 +588,10 @@ country IL: DFS-ETSI
 	(5150 - 5250 @ 80), (200 mW), NO-OUTDOOR, AUTO-BW
 	(5250 - 5350 @ 80), (200 mW), NO-OUTDOOR, DFS, AUTO-BW
 
-country IN: DFS-JP
+country IN:
 	(2402 - 2482 @ 40), (20)
-	(5170 - 5250 @ 80), (20), AUTO-BW
-	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
-	(5735 - 5835 @ 80), (20)
+	(5150 - 5350 @ 160), (23)
+	(5725 - 5875 @ 80), (23)
 
 country IR: DFS-JP
 	(2402 - 2482 @ 40), (20)

package/kernel/mac80211/patches/326-brcmfmac-add-length-check-in-brcmf_cfg80211_escan_ha.patch

@@ -0,0 +1,63 @@
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Tue, 12 Sep 2017 10:47:53 +0200
+Subject: [PATCH] brcmfmac: add length check in brcmf_cfg80211_escan_handler()
+
+Upon handling the firmware notification for scans the length was
+checked properly and may result in corrupting kernel heap memory
+due to buffer overruns. This fix addresses CVE-2017-0786.
+
+Cc: stable@vger.kernel.org # v4.0.x
+Cc: Kevin Cernekee <cernekee@chromium.org>
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3088,6 +3088,7 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
+ 	s32 status;
+ 	struct brcmf_escan_result_le *escan_result_le;
++	u32 escan_buflen;
+ 	struct brcmf_bss_info_le *bss_info_le;
+ 	struct brcmf_bss_info_le *bss = NULL;
+ 	u32 bi_length;
+@@ -3104,11 +3105,23 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 
+ 	if (status == BRCMF_E_STATUS_PARTIAL) {
+ 		brcmf_dbg(SCAN, "ESCAN Partial result\n");
++		if (e->datalen < sizeof(*escan_result_le)) {
++			brcmf_err("invalid event data length\n");
++			goto exit;
++		}
+ 		escan_result_le = (struct brcmf_escan_result_le *) data;
+ 		if (!escan_result_le) {
+ 			brcmf_err("Invalid escan result (NULL pointer)\n");
+ 			goto exit;
+ 		}
++		escan_buflen = le32_to_cpu(escan_result_le->buflen);
++		if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
++		    escan_buflen > e->datalen ||
++		    escan_buflen < sizeof(*escan_result_le)) {
++			brcmf_err("Invalid escan buffer length: %d\n",
++				  escan_buflen);
++			goto exit;
++		}
+ 		if (le16_to_cpu(escan_result_le->bss_count) != 1) {
+ 			brcmf_err("Invalid bss_count %d: ignoring\n",
+ 				  escan_result_le->bss_count);
+@@ -3125,9 +3138,8 @@ brcmf_cfg80211_escan_handler(struct brcm
+ 		}
+ 
+ 		bi_length = le32_to_cpu(bss_info_le->length);
+-		if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
+-					WL_ESCAN_RESULTS_FIXED_SIZE)) {
+-			brcmf_err("Invalid bss_info length %d: ignoring\n",
++		if (bi_length != escan_buflen -	WL_ESCAN_RESULTS_FIXED_SIZE) {
++			brcmf_err("Ignoring invalid bss_info length: %d\n",
+ 				  bi_length);
+ 			goto exit;
+ 		}

package/kernel/mac80211/patches/327-mac80211-accept-key-reinstall-without-changing-anyth.patch

@@ -0,0 +1,81 @@
+From fdf7cb4185b60c68e1a75e61691c4afdc15dea0e Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 5 Sep 2017 14:54:54 +0200
+Subject: [PATCH] mac80211: accept key reinstall without changing anything
+
+When a key is reinstalled we can reset the replay counters
+etc. which can lead to nonce reuse and/or replay detection
+being impossible, breaking security properties, as described
+in the "KRACK attacks".
+
+In particular, CVE-2017-13080 applies to GTK rekeying that
+happened in firmware while the host is in D3, with the second
+part of the attack being done after the host wakes up. In
+this case, the wpa_supplicant mitigation isn't sufficient
+since wpa_supplicant doesn't know the GTK material.
+
+In case this happens, simply silently accept the new key
+coming from userspace but don't take any action on it since
+it's the same key; this keeps the PN replay counters intact.
+
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/mac80211/key.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+diff --git a/net/mac80211/key.c b/net/mac80211/key.c
+index a98fc2b5e0dc..ae995c8480db 100644
+--- a/net/mac80211/key.c
++++ b/net/mac80211/key.c
+@@ -4,7 +4,7 @@
+  * Copyright 2006-2007	Jiri Benc <jbenc@suse.cz>
+  * Copyright 2007-2008	Johannes Berg <johannes@sipsolutions.net>
+  * Copyright 2013-2014  Intel Mobile Communications GmbH
+- * Copyright 2015	Intel Deutschland GmbH
++ * Copyright 2015-2017	Intel Deutschland GmbH
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License version 2 as
+@@ -620,9 +620,6 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ 
+ 	pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
+ 	idx = key->conf.keyidx;
+-	key->local = sdata->local;
+-	key->sdata = sdata;
+-	key->sta = sta;
+ 
+ 	mutex_lock(&sdata->local->key_mtx);
+ 
+@@ -633,6 +630,21 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ 	else
+ 		old_key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
+ 
++	/*
++	 * Silently accept key re-installation without really installing the
++	 * new version of the key to avoid nonce reuse or replay issues.
++	 */
++	if (old_key && key->conf.keylen == old_key->conf.keylen &&
++	    !memcmp(key->conf.key, old_key->conf.key, key->conf.keylen)) {
++		ieee80211_key_free_unused(key);
++		ret = 0;
++		goto out;
++	}
++
++	key->local = sdata->local;
++	key->sdata = sdata;
++	key->sta = sta;
++
+ 	increment_tailroom_need_count(sdata);
+ 
+ 	ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
+@@ -648,6 +660,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
+ 		ret = 0;
+ 	}
+ 
++ out:
+ 	mutex_unlock(&sdata->local->key_mtx);
+ 
+ 	return ret;
+-- 
+2.13.6
+

package/kernel/mt76/Makefile

@@ -1,16 +1,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mt76
-PKG_RELEASE=2
+PKG_RELEASE=1
 
 PKG_LICENSE:=GPLv2
 PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2017-01-31
-PKG_SOURCE_VERSION:=3c8caafc5e150db79f714b958a51cee8f242f309
-PKG_MIRROR_HASH:=c03c166466cb7ea825e52cd085511045e3847d927ba2bde2b8fb46595a3ed13a
+PKG_SOURCE_DATE:=2017-10-12
+PKG_SOURCE_VERSION:=1be430fc8ae486e61f51f76925b30d6ff64c37dd
+PKG_MIRROR_HASH:=992e3d86d493b976ec23fb4f1179a72c3e34199c6ec5a93f37069555c9b19d9c
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_BUILD_PARALLEL:=1

package/network/services/hostapd/Makefile

@@ -7,7 +7,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_RELEASE:=4
+PKG_RELEASE:=6
 
 PKG_SOURCE_URL:=http://w1.fi/hostap.git
 PKG_SOURCE_PROTO:=git

package/network/services/hostapd/files/hostapd.sh

@@ -139,6 +139,7 @@ hostapd_common_add_bss_config() {
 	config_add_int \
 		wep_rekey eap_reauth_period \
 		wpa_group_rekey wpa_pair_rekey wpa_master_rekey
+	config_add_boolean wpa_disable_eapol_key_retries
 
 	config_add_boolean rsn_preauth auth_cache
 	config_add_int ieee80211w
@@ -203,6 +204,7 @@ hostapd_set_bss_options() {
 
 	json_get_vars \
 		wep_rekey wpa_group_rekey wpa_pair_rekey wpa_master_rekey \
+		wpa_disable_eapol_key_retries \
 		maxassoc max_inactivity disassoc_low_ack isolate auth_cache \
 		wps_pushbutton wps_label ext_registrar wps_pbc_in_m1 wps_ap_setup_locked \
 		wps_independent wps_device_type wps_device_name wps_manufacturer wps_pin \
@@ -218,6 +220,7 @@ hostapd_set_bss_options() {
 	set_default hidden 0
 	set_default wmm 1
 	set_default uapsd 1
+	set_default wpa_disable_eapol_key_retries 0
 	set_default eapol_version 0
 	set_default acct_port 1813
 
@@ -399,6 +402,8 @@ hostapd_set_bss_options() {
 			done
 		fi
 
+		append bss_conf "wpa_disable_eapol_key_retries=$wpa_disable_eapol_key_retries" "$N"
+
 		hostapd_append_wpa_key_mgmt
 		[ -n "$wpa_key_mgmt" ] && append bss_conf "wpa_key_mgmt=$wpa_key_mgmt" "$N"
 	fi

package/network/services/hostapd/patches/005-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch

@@ -0,0 +1,154 @@
+From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
+Date: Fri, 14 Jul 2017 15:15:35 +0200
+Subject: [PATCH] hostapd: Avoid key reinstallation in FT handshake
+
+Do not reinstall TK to the driver during Reassociation Response frame
+processing if the first attempt of setting the TK succeeded. This avoids
+issues related to clearing the TX/RX PN that could result in reusing
+same PN values for transmitted frames (e.g., due to CCM nonce reuse and
+also hitting replay protection on the receiver) and accepting replayed
+frames on RX side.
+
+This issue was introduced by the commit
+0e84c25434e6a1f283c7b4e62e483729085b78d2 ('FT: Fix PTK configuration in
+authenticator') which allowed wpa_ft_install_ptk() to be called multiple
+times with the same PTK. While the second configuration attempt is
+needed with some drivers, it must be done only if the first attempt
+failed.
+
+Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
+---
+
+--- a/src/ap/ieee802_11.c
++++ b/src/ap/ieee802_11.c
+@@ -2154,6 +2154,7 @@ static int add_associated_sta(struct hos
+ {
+ 	struct ieee80211_ht_capabilities ht_cap;
+ 	struct ieee80211_vht_capabilities vht_cap;
++	int set = 1;
+ 
+ 	/*
+ 	 * Remove the STA entry to ensure the STA PS state gets cleared and
+@@ -2161,9 +2162,18 @@ static int add_associated_sta(struct hos
+ 	 * FT-over-the-DS, where a station re-associates back to the same AP but
+ 	 * skips the authentication flow, or if working with a driver that
+ 	 * does not support full AP client state.
++	 *
++	 * Skip this if the STA has already completed FT reassociation and the
++	 * TK has been configured since the TX/RX PN must not be reset to 0 for
++	 * the same key.
+ 	 */
+-	if (!sta->added_unassoc)
++	if (!sta->added_unassoc &&
++	    (!(sta->flags & WLAN_STA_AUTHORIZED) ||
++	     !wpa_auth_sta_ft_tk_already_set(sta->wpa_sm))) {
+ 		hostapd_drv_sta_remove(hapd, sta->addr);
++		wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
++		set = 0;
++	}
+ 
+ #ifdef CONFIG_IEEE80211N
+ 	if (sta->flags & WLAN_STA_HT)
+@@ -2186,11 +2196,11 @@ static int add_associated_sta(struct hos
+ 			    sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
+ 			    sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
+ 			    sta->vht_opmode, sta->p2p_ie ? 1 : 0,
+-			    sta->added_unassoc)) {
++			    set)) {
+ 		hostapd_logger(hapd, sta->addr,
+ 			       HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
+ 			       "Could not %s STA to kernel driver",
+-			       sta->added_unassoc ? "set" : "add");
++			       set ? "set" : "add");
+ 
+ 		if (sta->added_unassoc) {
+ 			hostapd_drv_sta_remove(hapd, sta->addr);
+--- a/src/ap/wpa_auth.c
++++ b/src/ap/wpa_auth.c
+@@ -1751,6 +1751,9 @@ int wpa_auth_sm_event(struct wpa_state_m
+ #else /* CONFIG_IEEE80211R_AP */
+ 		break;
+ #endif /* CONFIG_IEEE80211R_AP */
++	case WPA_DRV_STA_REMOVED:
++		sm->tk_already_set = FALSE;
++		return 0;
+ 	}
+ 
+ #ifdef CONFIG_IEEE80211R_AP
+@@ -3725,6 +3728,14 @@ int wpa_auth_sta_wpa_version(struct wpa_
+ }
+ 
+ 
++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm)
++{
++	if (!sm || !wpa_key_mgmt_ft(sm->wpa_key_mgmt))
++		return 0;
++	return sm->tk_already_set;
++}
++
++
+ int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
+ 			     struct rsn_pmksa_cache_entry *entry)
+ {
+--- a/src/ap/wpa_auth_ft.c
++++ b/src/ap/wpa_auth_ft.c
+@@ -794,6 +794,14 @@ void wpa_ft_install_ptk(struct wpa_state
+ 		return;
+ 	}
+ 
++	if (sm->tk_already_set) {
++		/* Must avoid TK reconfiguration to prevent clearing of TX/RX
++		 * PN in the driver */
++		wpa_printf(MSG_DEBUG,
++			   "FT: Do not re-install same PTK to the driver");
++		return;
++	}
++
+ 	/* FIX: add STA entry to kernel/driver here? The set_key will fail
+ 	 * most likely without this.. At the moment, STA entry is added only
+ 	 * after association has been completed. This function will be called
+@@ -806,6 +814,7 @@ void wpa_ft_install_ptk(struct wpa_state
+ 
+ 	/* FIX: MLME-SetProtection.Request(TA, Tx_Rx) */
+ 	sm->pairwise_set = TRUE;
++	sm->tk_already_set = TRUE;
+ }
+ 
+ 
+@@ -1002,6 +1011,7 @@ static int wpa_ft_process_auth_req(struc
+ 
+ 	sm->pairwise = pairwise;
+ 	sm->PTK_valid = TRUE;
++	sm->tk_already_set = FALSE;
+ 	wpa_ft_install_ptk(sm);
+ 
+ 	buflen = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
+--- a/src/ap/wpa_auth.h
++++ b/src/ap/wpa_auth.h
+@@ -268,7 +268,7 @@ void wpa_receive(struct wpa_authenticato
+ 		 u8 *data, size_t data_len);
+ enum wpa_event {
+ 	WPA_AUTH, WPA_ASSOC, WPA_DISASSOC, WPA_DEAUTH, WPA_REAUTH,
+-	WPA_REAUTH_EAPOL, WPA_ASSOC_FT
++	WPA_REAUTH_EAPOL, WPA_ASSOC_FT, WPA_DRV_STA_REMOVED
+ };
+ void wpa_remove_ptk(struct wpa_state_machine *sm);
+ int wpa_auth_sm_event(struct wpa_state_machine *sm, enum wpa_event event);
+@@ -281,6 +281,7 @@ int wpa_auth_pairwise_set(struct wpa_sta
+ int wpa_auth_get_pairwise(struct wpa_state_machine *sm);
+ int wpa_auth_sta_key_mgmt(struct wpa_state_machine *sm);
+ int wpa_auth_sta_wpa_version(struct wpa_state_machine *sm);
++int wpa_auth_sta_ft_tk_already_set(struct wpa_state_machine *sm);
+ int wpa_auth_sta_clear_pmksa(struct wpa_state_machine *sm,
+ 			     struct rsn_pmksa_cache_entry *entry);
+ struct rsn_pmksa_cache_entry *
+--- a/src/ap/wpa_auth_i.h
++++ b/src/ap/wpa_auth_i.h
+@@ -65,6 +65,7 @@ struct wpa_state_machine {
+ 	struct wpa_ptk PTK;
+ 	Boolean PTK_valid;
+ 	Boolean pairwise_set;
++	Boolean tk_already_set;
+ 	int keycount;
+ 	Boolean Pair;
+ 	struct wpa_key_replay_counter {

package/network/services/hostapd/patches/006-Prevent-reinstallation-of-an-already-in-use-group-ke.patch

@@ -0,0 +1,244 @@
+From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
+Date: Wed, 12 Jul 2017 16:03:24 +0200
+Subject: [PATCH] Prevent reinstallation of an already in-use group key
+
+Track the current GTK and IGTK that is in use and when receiving a
+(possibly retransmitted) Group Message 1 or WNM-Sleep Mode Response, do
+not install the given key if it is already in use. This prevents an
+attacker from trying to trick the client into resetting or lowering the
+sequence counter associated to the group key.
+
+Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
+---
+
+--- a/src/common/wpa_common.h
++++ b/src/common/wpa_common.h
+@@ -207,6 +207,17 @@ struct wpa_ptk {
+ 	size_t tk_len;
+ };
+ 
++struct wpa_gtk {
++	u8 gtk[WPA_GTK_MAX_LEN];
++	size_t gtk_len;
++};
++
++#ifdef CONFIG_IEEE80211W
++struct wpa_igtk {
++	u8 igtk[WPA_IGTK_MAX_LEN];
++	size_t igtk_len;
++};
++#endif /* CONFIG_IEEE80211W */
+ 
+ /* WPA IE version 1
+  * 00-50-f2:1 (OUI:OUI type)
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -785,6 +785,15 @@ static int wpa_supplicant_install_gtk(st
+ 	const u8 *_gtk = gd->gtk;
+ 	u8 gtk_buf[32];
+ 
++	/* Detect possible key reinstallation */
++	if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
++	    os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
++		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
++			"WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
++			gd->keyidx, gd->tx, gd->gtk_len);
++		return 0;
++	}
++
+ 	wpa_hexdump_key(MSG_DEBUG, "WPA: Group Key", gd->gtk, gd->gtk_len);
+ 	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+ 		"WPA: Installing GTK to the driver (keyidx=%d tx=%d len=%d)",
+@@ -819,6 +828,9 @@ static int wpa_supplicant_install_gtk(st
+ 	}
+ 	os_memset(gtk_buf, 0, sizeof(gtk_buf));
+ 
++	sm->gtk.gtk_len = gd->gtk_len;
++	os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
++
+ 	return 0;
+ }
+ 
+@@ -925,6 +937,48 @@ static int wpa_supplicant_pairwise_gtk(s
+ }
+ 
+ 
++#ifdef CONFIG_IEEE80211W
++static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
++				       const struct wpa_igtk_kde *igtk)
++{
++	size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
++	u16 keyidx = WPA_GET_LE16(igtk->keyid);
++
++	/* Detect possible key reinstallation */
++	if (sm->igtk.igtk_len == len &&
++	    os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
++		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
++			"WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
++			keyidx);
++		return  0;
++	}
++
++	wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
++		"WPA: IGTK keyid %d pn %02x%02x%02x%02x%02x%02x",
++		keyidx, MAC2STR(igtk->pn));
++	wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK", igtk->igtk, len);
++	if (keyidx > 4095) {
++		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
++			"WPA: Invalid IGTK KeyID %d", keyidx);
++		return -1;
++	}
++	if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
++			   broadcast_ether_addr,
++			   keyidx, 0, igtk->pn, sizeof(igtk->pn),
++			   igtk->igtk, len) < 0) {
++		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
++			"WPA: Failed to configure IGTK to the driver");
++		return -1;
++	}
++
++	sm->igtk.igtk_len = len;
++	os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
++
++	return 0;
++}
++#endif /* CONFIG_IEEE80211W */
++
++
+ static int ieee80211w_set_keys(struct wpa_sm *sm,
+ 			       struct wpa_eapol_ie_parse *ie)
+ {
+@@ -935,30 +989,14 @@ static int ieee80211w_set_keys(struct wp
+ 	if (ie->igtk) {
+ 		size_t len;
+ 		const struct wpa_igtk_kde *igtk;
+-		u16 keyidx;
++
+ 		len = wpa_cipher_key_len(sm->mgmt_group_cipher);
+ 		if (ie->igtk_len != WPA_IGTK_KDE_PREFIX_LEN + len)
+ 			return -1;
++
+ 		igtk = (const struct wpa_igtk_kde *) ie->igtk;
+-		keyidx = WPA_GET_LE16(igtk->keyid);
+-		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG, "WPA: IGTK keyid %d "
+-			"pn %02x%02x%02x%02x%02x%02x",
+-			keyidx, MAC2STR(igtk->pn));
+-		wpa_hexdump_key(MSG_DEBUG, "WPA: IGTK",
+-				igtk->igtk, len);
+-		if (keyidx > 4095) {
+-			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
+-				"WPA: Invalid IGTK KeyID %d", keyidx);
++		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
+ 			return -1;
+-		}
+-		if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
+-				   broadcast_ether_addr,
+-				   keyidx, 0, igtk->pn, sizeof(igtk->pn),
+-				   igtk->igtk, len) < 0) {
+-			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
+-				"WPA: Failed to configure IGTK to the driver");
+-			return -1;
+-		}
+ 	}
+ 
+ 	return 0;
+@@ -2451,7 +2489,7 @@ void wpa_sm_deinit(struct wpa_sm *sm)
+  */
+ void wpa_sm_notify_assoc(struct wpa_sm *sm, const u8 *bssid)
+ {
+-	int clear_ptk = 1;
++	int clear_keys = 1;
+ 
+ 	if (sm == NULL)
+ 		return;
+@@ -2477,7 +2515,7 @@ void wpa_sm_notify_assoc(struct wpa_sm *
+ 		/* Prepare for the next transition */
+ 		wpa_ft_prepare_auth_request(sm, NULL);
+ 
+-		clear_ptk = 0;
++		clear_keys = 0;
+ 	}
+ #endif /* CONFIG_IEEE80211R */
+ #ifdef CONFIG_FILS
+@@ -2487,11 +2525,11 @@ void wpa_sm_notify_assoc(struct wpa_sm *
+ 		 * AUTHENTICATED state to get the EAPOL port Authorized.
+ 		 */
+ 		wpa_supplicant_key_neg_complete(sm, sm->bssid, 1);
+-		clear_ptk = 0;
++		clear_keys = 0;
+ 	}
+ #endif /* CONFIG_FILS */
+ 
+-	if (clear_ptk) {
++	if (clear_keys) {
+ 		/*
+ 		 * IEEE 802.11, 8.4.10: Delete PTK SA on (re)association if
+ 		 * this is not part of a Fast BSS Transition.
+@@ -2501,6 +2539,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *
+ 		os_memset(&sm->ptk, 0, sizeof(sm->ptk));
+ 		sm->tptk_set = 0;
+ 		os_memset(&sm->tptk, 0, sizeof(sm->tptk));
++		os_memset(&sm->gtk, 0, sizeof(sm->gtk));
++#ifdef CONFIG_IEEE80211W
++		os_memset(&sm->igtk, 0, sizeof(sm->igtk));
++#endif /* CONFIG_IEEE80211W */
+ 	}
+ 
+ #ifdef CONFIG_TDLS
+@@ -3052,6 +3094,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
+ 	os_memset(sm->pmk, 0, sizeof(sm->pmk));
+ 	os_memset(&sm->ptk, 0, sizeof(sm->ptk));
+ 	os_memset(&sm->tptk, 0, sizeof(sm->tptk));
++	os_memset(&sm->gtk, 0, sizeof(sm->gtk));
++#ifdef CONFIG_IEEE80211W
++	os_memset(&sm->igtk, 0, sizeof(sm->igtk));
++#endif /* CONFIG_IEEE80211W */
+ #ifdef CONFIG_IEEE80211R
+ 	os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
+ 	os_memset(sm->pmk_r0, 0, sizeof(sm->pmk_r0));
+@@ -3124,29 +3170,11 @@ int wpa_wnmsleep_install_key(struct wpa_
+ 		os_memset(&gd, 0, sizeof(gd));
+ #ifdef CONFIG_IEEE80211W
+ 	} else if (subelem_id == WNM_SLEEP_SUBELEM_IGTK) {
+-		struct wpa_igtk_kde igd;
+-		u16 keyidx;
++		const struct wpa_igtk_kde *igtk;
+ 
+-		os_memset(&igd, 0, sizeof(igd));
+-		keylen = wpa_cipher_key_len(sm->mgmt_group_cipher);
+-		os_memcpy(igd.keyid, buf + 2, 2);
+-		os_memcpy(igd.pn, buf + 4, 6);
+-
+-		keyidx = WPA_GET_LE16(igd.keyid);
+-		os_memcpy(igd.igtk, buf + 10, keylen);
+-
+-		wpa_hexdump_key(MSG_DEBUG, "Install IGTK (WNM SLEEP)",
+-				igd.igtk, keylen);
+-		if (wpa_sm_set_key(sm, wpa_cipher_to_alg(sm->mgmt_group_cipher),
+-				   broadcast_ether_addr,
+-				   keyidx, 0, igd.pn, sizeof(igd.pn),
+-				   igd.igtk, keylen) < 0) {
+-			wpa_printf(MSG_DEBUG, "Failed to install the IGTK in "
+-				   "WNM mode");
+-			os_memset(&igd, 0, sizeof(igd));
++		igtk = (const struct wpa_igtk_kde *) (buf + 2);
++		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
+ 			return -1;
+-		}
+-		os_memset(&igd, 0, sizeof(igd));
+ #endif /* CONFIG_IEEE80211W */
+ 	} else {
+ 		wpa_printf(MSG_DEBUG, "Unknown element id");
+--- a/src/rsn_supp/wpa_i.h
++++ b/src/rsn_supp/wpa_i.h
+@@ -31,6 +31,10 @@ struct wpa_sm {
+ 	u8 rx_replay_counter[WPA_REPLAY_COUNTER_LEN];
+ 	int rx_replay_counter_set;
+ 	u8 request_counter[WPA_REPLAY_COUNTER_LEN];
++	struct wpa_gtk gtk;
++#ifdef CONFIG_IEEE80211W
++	struct wpa_igtk igtk;
++#endif /* CONFIG_IEEE80211W */
+ 
+ 	struct eapol_sm *eapol; /* EAPOL state machine from upper level code */
+ 

package/network/services/hostapd/patches/007-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch

@@ -0,0 +1,173 @@
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 1 Oct 2017 12:12:24 +0300
+Subject: [PATCH] Extend protection of GTK/IGTK reinstallation of WNM-Sleep
+ Mode cases
+
+This extends the protection to track last configured GTK/IGTK value
+separately from EAPOL-Key frames and WNM-Sleep Mode frames to cover a
+corner case where these two different mechanisms may get used when the
+GTK/IGTK has changed and tracking a single value is not sufficient to
+detect a possible key reconfiguration.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -780,14 +780,17 @@ struct wpa_gtk_data {
+ 
+ static int wpa_supplicant_install_gtk(struct wpa_sm *sm,
+ 				      const struct wpa_gtk_data *gd,
+-				      const u8 *key_rsc)
++				      const u8 *key_rsc, int wnm_sleep)
+ {
+ 	const u8 *_gtk = gd->gtk;
+ 	u8 gtk_buf[32];
+ 
+ 	/* Detect possible key reinstallation */
+-	if (sm->gtk.gtk_len == (size_t) gd->gtk_len &&
+-	    os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) {
++	if ((sm->gtk.gtk_len == (size_t) gd->gtk_len &&
++	     os_memcmp(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len) == 0) ||
++	    (sm->gtk_wnm_sleep.gtk_len == (size_t) gd->gtk_len &&
++	     os_memcmp(sm->gtk_wnm_sleep.gtk, gd->gtk,
++		       sm->gtk_wnm_sleep.gtk_len) == 0)) {
+ 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+ 			"WPA: Not reinstalling already in-use GTK to the driver (keyidx=%d tx=%d len=%d)",
+ 			gd->keyidx, gd->tx, gd->gtk_len);
+@@ -828,8 +831,14 @@ static int wpa_supplicant_install_gtk(st
+ 	}
+ 	os_memset(gtk_buf, 0, sizeof(gtk_buf));
+ 
+-	sm->gtk.gtk_len = gd->gtk_len;
+-	os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
++	if (wnm_sleep) {
++		sm->gtk_wnm_sleep.gtk_len = gd->gtk_len;
++		os_memcpy(sm->gtk_wnm_sleep.gtk, gd->gtk,
++			  sm->gtk_wnm_sleep.gtk_len);
++	} else {
++		sm->gtk.gtk_len = gd->gtk_len;
++		os_memcpy(sm->gtk.gtk, gd->gtk, sm->gtk.gtk_len);
++	}
+ 
+ 	return 0;
+ }
+@@ -923,7 +932,7 @@ static int wpa_supplicant_pairwise_gtk(s
+ 	    (wpa_supplicant_check_group_cipher(sm, sm->group_cipher,
+ 					       gtk_len, gtk_len,
+ 					       &gd.key_rsc_len, &gd.alg) ||
+-	     wpa_supplicant_install_gtk(sm, &gd, key_rsc))) {
++	     wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0))) {
+ 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+ 			"RSN: Failed to install GTK");
+ 		os_memset(&gd, 0, sizeof(gd));
+@@ -939,14 +948,18 @@ static int wpa_supplicant_pairwise_gtk(s
+ 
+ #ifdef CONFIG_IEEE80211W
+ static int wpa_supplicant_install_igtk(struct wpa_sm *sm,
+-				       const struct wpa_igtk_kde *igtk)
++				       const struct wpa_igtk_kde *igtk,
++				       int wnm_sleep)
+ {
+ 	size_t len = wpa_cipher_key_len(sm->mgmt_group_cipher);
+ 	u16 keyidx = WPA_GET_LE16(igtk->keyid);
+ 
+ 	/* Detect possible key reinstallation */
+-	if (sm->igtk.igtk_len == len &&
+-	    os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) {
++	if ((sm->igtk.igtk_len == len &&
++	     os_memcmp(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len) == 0) ||
++	    (sm->igtk_wnm_sleep.igtk_len == len &&
++	     os_memcmp(sm->igtk_wnm_sleep.igtk, igtk->igtk,
++		       sm->igtk_wnm_sleep.igtk_len) == 0)) {
+ 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+ 			"WPA: Not reinstalling already in-use IGTK to the driver (keyidx=%d)",
+ 			keyidx);
+@@ -971,8 +984,14 @@ static int wpa_supplicant_install_igtk(s
+ 		return -1;
+ 	}
+ 
+-	sm->igtk.igtk_len = len;
+-	os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
++	if (wnm_sleep) {
++		sm->igtk_wnm_sleep.igtk_len = len;
++		os_memcpy(sm->igtk_wnm_sleep.igtk, igtk->igtk,
++			  sm->igtk_wnm_sleep.igtk_len);
++	} else {
++		sm->igtk.igtk_len = len;
++		os_memcpy(sm->igtk.igtk, igtk->igtk, sm->igtk.igtk_len);
++	}
+ 
+ 	return 0;
+ }
+@@ -995,7 +1014,7 @@ static int ieee80211w_set_keys(struct wp
+ 			return -1;
+ 
+ 		igtk = (const struct wpa_igtk_kde *) ie->igtk;
+-		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
++		if (wpa_supplicant_install_igtk(sm, igtk, 0) < 0)
+ 			return -1;
+ 	}
+ 
+@@ -1641,7 +1660,7 @@ static void wpa_supplicant_process_1_of_
+ 	if (wpa_supplicant_rsc_relaxation(sm, key->key_rsc))
+ 		key_rsc = null_rsc;
+ 
+-	if (wpa_supplicant_install_gtk(sm, &gd, key_rsc) ||
++	if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 0) ||
+ 	    wpa_supplicant_send_2_of_2(sm, key, ver, key_info) < 0)
+ 		goto failed;
+ 	os_memset(&gd, 0, sizeof(gd));
+@@ -2540,8 +2559,10 @@ void wpa_sm_notify_assoc(struct wpa_sm *
+ 		sm->tptk_set = 0;
+ 		os_memset(&sm->tptk, 0, sizeof(sm->tptk));
+ 		os_memset(&sm->gtk, 0, sizeof(sm->gtk));
++		os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
+ #ifdef CONFIG_IEEE80211W
+ 		os_memset(&sm->igtk, 0, sizeof(sm->igtk));
++		os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
+ #endif /* CONFIG_IEEE80211W */
+ 	}
+ 
+@@ -3095,8 +3116,10 @@ void wpa_sm_drop_sa(struct wpa_sm *sm)
+ 	os_memset(&sm->ptk, 0, sizeof(sm->ptk));
+ 	os_memset(&sm->tptk, 0, sizeof(sm->tptk));
+ 	os_memset(&sm->gtk, 0, sizeof(sm->gtk));
++	os_memset(&sm->gtk_wnm_sleep, 0, sizeof(sm->gtk_wnm_sleep));
+ #ifdef CONFIG_IEEE80211W
+ 	os_memset(&sm->igtk, 0, sizeof(sm->igtk));
++	os_memset(&sm->igtk_wnm_sleep, 0, sizeof(sm->igtk_wnm_sleep));
+ #endif /* CONFIG_IEEE80211W */
+ #ifdef CONFIG_IEEE80211R
+ 	os_memset(sm->xxkey, 0, sizeof(sm->xxkey));
+@@ -3161,7 +3184,7 @@ int wpa_wnmsleep_install_key(struct wpa_
+ 
+ 		wpa_hexdump_key(MSG_DEBUG, "Install GTK (WNM SLEEP)",
+ 				gd.gtk, gd.gtk_len);
+-		if (wpa_supplicant_install_gtk(sm, &gd, key_rsc)) {
++		if (wpa_supplicant_install_gtk(sm, &gd, key_rsc, 1)) {
+ 			os_memset(&gd, 0, sizeof(gd));
+ 			wpa_printf(MSG_DEBUG, "Failed to install the GTK in "
+ 				   "WNM mode");
+@@ -3173,7 +3196,7 @@ int wpa_wnmsleep_install_key(struct wpa_
+ 		const struct wpa_igtk_kde *igtk;
+ 
+ 		igtk = (const struct wpa_igtk_kde *) (buf + 2);
+-		if (wpa_supplicant_install_igtk(sm, igtk) < 0)
++		if (wpa_supplicant_install_igtk(sm, igtk, 1) < 0)
+ 			return -1;
+ #endif /* CONFIG_IEEE80211W */
+ 	} else {
+--- a/src/rsn_supp/wpa_i.h
++++ b/src/rsn_supp/wpa_i.h
+@@ -32,8 +32,10 @@ struct wpa_sm {
+ 	int rx_replay_counter_set;
+ 	u8 request_counter[WPA_REPLAY_COUNTER_LEN];
+ 	struct wpa_gtk gtk;
++	struct wpa_gtk gtk_wnm_sleep;
+ #ifdef CONFIG_IEEE80211W
+ 	struct wpa_igtk igtk;
++	struct wpa_igtk igtk_wnm_sleep;
+ #endif /* CONFIG_IEEE80211W */
+ 
+ 	struct eapol_sm *eapol; /* EAPOL state machine from upper level code */

package/network/services/hostapd/patches/008-Prevent-installation-of-an-all-zero-TK.patch

@@ -0,0 +1,65 @@
+From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
+Date: Fri, 29 Sep 2017 04:22:51 +0200
+Subject: [PATCH] Prevent installation of an all-zero TK
+
+Properly track whether a PTK has already been installed to the driver
+and the TK part cleared from memory. This prevents an attacker from
+trying to trick the client into installing an all-zero TK.
+
+This fixes the earlier fix in commit
+ad00d64e7d8827b3cebd665a0ceb08adabf15e1e ('Fix TK configuration to the
+driver in EAPOL-Key 3/4 retry case') which did not take into account
+possibility of an extra message 1/4 showing up between retries of
+message 3/4.
+
+Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
+---
+
+--- a/src/common/wpa_common.h
++++ b/src/common/wpa_common.h
+@@ -205,6 +205,7 @@ struct wpa_ptk {
+ 	size_t kck_len;
+ 	size_t kek_len;
+ 	size_t tk_len;
++	int installed; /* 1 if key has already been installed to driver */
+ };
+ 
+ struct wpa_gtk {
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -581,7 +581,6 @@ static void wpa_supplicant_process_1_of_
+ 		os_memset(buf, 0, sizeof(buf));
+ 	}
+ 	sm->tptk_set = 1;
+-	sm->tk_to_set = 1;
+ 
+ 	kde = sm->assoc_wpa_ie;
+ 	kde_len = sm->assoc_wpa_ie_len;
+@@ -686,7 +685,7 @@ static int wpa_supplicant_install_ptk(st
+ 	enum wpa_alg alg;
+ 	const u8 *key_rsc;
+ 
+-	if (!sm->tk_to_set) {
++	if (sm->ptk.installed) {
+ 		wpa_dbg(sm->ctx->msg_ctx, MSG_DEBUG,
+ 			"WPA: Do not re-install same PTK to the driver");
+ 		return 0;
+@@ -730,7 +729,7 @@ static int wpa_supplicant_install_ptk(st
+ 
+ 	/* TK is not needed anymore in supplicant */
+ 	os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
+-	sm->tk_to_set = 0;
++	sm->ptk.installed = 1;
+ 
+ 	if (sm->wpa_ptk_rekey) {
+ 		eloop_cancel_timeout(wpa_sm_rekey_ptk, sm, NULL);
+--- a/src/rsn_supp/wpa_i.h
++++ b/src/rsn_supp/wpa_i.h
+@@ -24,7 +24,6 @@ struct wpa_sm {
+ 	struct wpa_ptk ptk, tptk;
+ 	int ptk_set, tptk_set;
+ 	unsigned int msg_3_of_4_ok:1;
+-	unsigned int tk_to_set:1;
+ 	u8 snonce[WPA_NONCE_LEN];
+ 	u8 anonce[WPA_NONCE_LEN]; /* ANonce from the last 1/4 msg */
+ 	int renew_snonce;

package/network/services/hostapd/patches/009-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch

@@ -0,0 +1,56 @@
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 1 Oct 2017 12:32:57 +0300
+Subject: [PATCH] Fix PTK rekeying to generate a new ANonce
+
+The Authenticator state machine path for PTK rekeying ended up bypassing
+the AUTHENTICATION2 state where a new ANonce is generated when going
+directly to the PTKSTART state since there is no need to try to
+determine the PMK again in such a case. This is far from ideal since the
+new PTK would depend on a new nonce only from the supplicant.
+
+Fix this by generating a new ANonce when moving to the PTKSTART state
+for the purpose of starting new 4-way handshake to rekey PTK.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+
+--- a/src/ap/wpa_auth.c
++++ b/src/ap/wpa_auth.c
+@@ -1912,6 +1912,21 @@ SM_STATE(WPA_PTK, AUTHENTICATION2)
+ }
+ 
+ 
++static int wpa_auth_sm_ptk_update(struct wpa_state_machine *sm)
++{
++	if (random_get_bytes(sm->ANonce, WPA_NONCE_LEN)) {
++		wpa_printf(MSG_ERROR,
++			   "WPA: Failed to get random data for ANonce");
++		sm->Disconnect = TRUE;
++		return -1;
++	}
++	wpa_hexdump(MSG_DEBUG, "WPA: Assign new ANonce", sm->ANonce,
++		    WPA_NONCE_LEN);
++	sm->TimeoutCtr = 0;
++	return 0;
++}
++
++
+ SM_STATE(WPA_PTK, INITPMK)
+ {
+ 	u8 msk[2 * PMK_LEN];
+@@ -2932,9 +2947,12 @@ SM_STEP(WPA_PTK)
+ 		SM_ENTER(WPA_PTK, AUTHENTICATION);
+ 	else if (sm->ReAuthenticationRequest)
+ 		SM_ENTER(WPA_PTK, AUTHENTICATION2);
+-	else if (sm->PTKRequest)
+-		SM_ENTER(WPA_PTK, PTKSTART);
+-	else switch (sm->wpa_ptk_state) {
++	else if (sm->PTKRequest) {
++		if (wpa_auth_sm_ptk_update(sm) < 0)
++			SM_ENTER(WPA_PTK, DISCONNECTED);
++		else
++			SM_ENTER(WPA_PTK, PTKSTART);
++	} else switch (sm->wpa_ptk_state) {
+ 	case WPA_PTK_INITIALIZE:
+ 		break;
+ 	case WPA_PTK_DISCONNECT:

package/network/services/hostapd/patches/010-TDLS-Reject-TPK-TK-reconfiguration.patch

@@ -0,0 +1,124 @@
+From: Jouni Malinen <j@w1.fi>
+Date: Fri, 22 Sep 2017 11:03:15 +0300
+Subject: [PATCH] TDLS: Reject TPK-TK reconfiguration
+
+Do not try to reconfigure the same TPK-TK to the driver after it has
+been successfully configured. This is an explicit check to avoid issues
+related to resetting the TX/RX packet number. There was already a check
+for this for TPK M2 (retries of that message are ignored completely), so
+that behavior does not get modified.
+
+For TPK M3, the TPK-TK could have been reconfigured, but that was
+followed by immediate teardown of the link due to an issue in updating
+the STA entry. Furthermore, for TDLS with any real security (i.e.,
+ignoring open/WEP), the TPK message exchange is protected on the AP path
+and simple replay attacks are not feasible.
+
+As an additional corner case, make sure the local nonce gets updated if
+the peer uses a very unlikely "random nonce" of all zeros.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+
+--- a/src/rsn_supp/tdls.c
++++ b/src/rsn_supp/tdls.c
+@@ -112,6 +112,7 @@ struct wpa_tdls_peer {
+ 		u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
+ 	} tpk;
+ 	int tpk_set;
++	int tk_set; /* TPK-TK configured to the driver */
+ 	int tpk_success;
+ 	int tpk_in_progress;
+ 
+@@ -192,6 +193,20 @@ static int wpa_tdls_set_key(struct wpa_s
+ 	u8 rsc[6];
+ 	enum wpa_alg alg;
+ 
++	if (peer->tk_set) {
++		/*
++		 * This same TPK-TK has already been configured to the driver
++		 * and this new configuration attempt (likely due to an
++		 * unexpected retransmitted frame) would result in clearing
++		 * the TX/RX sequence number which can break security, so must
++		 * not allow that to happen.
++		 */
++		wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR
++			   " has already been configured to the driver - do not reconfigure",
++			   MAC2STR(peer->addr));
++		return -1;
++	}
++
+ 	os_memset(rsc, 0, 6);
+ 
+ 	switch (peer->cipher) {
+@@ -209,12 +224,15 @@ static int wpa_tdls_set_key(struct wpa_s
+ 		return -1;
+ 	}
+ 
++	wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR,
++		   MAC2STR(peer->addr));
+ 	if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1,
+ 			   rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) {
+ 		wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
+ 			   "driver");
+ 		return -1;
+ 	}
++	peer->tk_set = 1;
+ 	return 0;
+ }
+ 
+@@ -696,7 +714,7 @@ static void wpa_tdls_peer_clear(struct w
+ 	peer->cipher = 0;
+ 	peer->qos_info = 0;
+ 	peer->wmm_capable = 0;
+-	peer->tpk_set = peer->tpk_success = 0;
++	peer->tk_set = peer->tpk_set = peer->tpk_success = 0;
+ 	peer->chan_switch_enabled = 0;
+ 	os_memset(&peer->tpk, 0, sizeof(peer->tpk));
+ 	os_memset(peer->inonce, 0, WPA_NONCE_LEN);
+@@ -1159,6 +1177,7 @@ skip_rsnie:
+ 		wpa_tdls_peer_free(sm, peer);
+ 		return -1;
+ 	}
++	peer->tk_set = 0; /* A new nonce results in a new TK */
+ 	wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
+ 		    peer->inonce, WPA_NONCE_LEN);
+ 	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
+@@ -1751,6 +1770,19 @@ static int wpa_tdls_addset_peer(struct w
+ }
+ 
+ 
++static int tdls_nonce_set(const u8 *nonce)
++{
++	int i;
++
++	for (i = 0; i < WPA_NONCE_LEN; i++) {
++		if (nonce[i])
++			return 1;
++	}
++
++	return 0;
++}
++
++
+ static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
+ 				   const u8 *buf, size_t len)
+ {
+@@ -2004,7 +2036,8 @@ skip_rsn:
+ 	peer->rsnie_i_len = kde.rsn_ie_len;
+ 	peer->cipher = cipher;
+ 
+-	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
++	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 ||
++	    !tdls_nonce_set(peer->inonce)) {
+ 		/*
+ 		 * There is no point in updating the RNonce for every obtained
+ 		 * TPK M1 frame (e.g., retransmission due to timeout) with the
+@@ -2020,6 +2053,7 @@ skip_rsn:
+ 				"TDLS: Failed to get random data for responder nonce");
+ 			goto error;
+ 		}
++		peer->tk_set = 0; /* A new nonce results in a new TK */
+ 	}
+ 
+ #if 0

package/network/services/hostapd/patches/011-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch

@@ -0,0 +1,35 @@
+From: Jouni Malinen <j@w1.fi>
+Date: Fri, 22 Sep 2017 11:25:02 +0300
+Subject: [PATCH] WNM: Ignore WNM-Sleep Mode Response without pending
+ request
+
+Commit 03ed0a52393710be6bdae657d1b36efa146520e5 ('WNM: Ignore WNM-Sleep
+Mode Response if WNM-Sleep Mode has not been used') started ignoring the
+response when no WNM-Sleep Mode Request had been used during the
+association. This can be made tighter by clearing the used flag when
+successfully processing a response. This adds an additional layer of
+protection against unexpected retransmissions of the response frame.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+
+--- a/wpa_supplicant/wnm_sta.c
++++ b/wpa_supplicant/wnm_sta.c
+@@ -260,7 +260,7 @@ static void ieee802_11_rx_wnmsleep_resp(
+ 
+ 	if (!wpa_s->wnmsleep_used) {
+ 		wpa_printf(MSG_DEBUG,
+-			   "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode has not been used in this association");
++			   "WNM: Ignore WNM-Sleep Mode Response frame since WNM-Sleep Mode operation has not been requested");
+ 		return;
+ 	}
+ 
+@@ -299,6 +299,8 @@ static void ieee802_11_rx_wnmsleep_resp(
+ 		return;
+ 	}
+ 
++	wpa_s->wnmsleep_used = 0;
++
+ 	if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
+ 	    wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
+ 		wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "

package/network/services/hostapd/patches/012-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch

@@ -0,0 +1,68 @@
+From: Jouni Malinen <j@w1.fi>
+Date: Fri, 22 Sep 2017 12:06:37 +0300
+Subject: [PATCH] FT: Do not allow multiple Reassociation Response frames
+
+The driver is expected to not report a second association event without
+the station having explicitly request a new association. As such, this
+case should not be reachable. However, since reconfiguring the same
+pairwise or group keys to the driver could result in nonce reuse issues,
+be extra careful here and do an additional state check to avoid this
+even if the local driver ends up somehow accepting an unexpected
+Reassociation Response frame.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -2568,6 +2568,9 @@ void wpa_sm_notify_assoc(struct wpa_sm *
+ #ifdef CONFIG_TDLS
+ 	wpa_tdls_assoc(sm);
+ #endif /* CONFIG_TDLS */
++#ifdef CONFIG_IEEE80211R
++	sm->ft_reassoc_completed = 0;
++#endif /* CONFIG_IEEE80211R */
+ 
+ #ifdef CONFIG_P2P
+ 	os_memset(sm->p2p_ip_addr, 0, sizeof(sm->p2p_ip_addr));
+--- a/src/rsn_supp/wpa_ft.c
++++ b/src/rsn_supp/wpa_ft.c
+@@ -153,6 +153,7 @@ static u8 * wpa_ft_gen_req_ies(struct wp
+ 	u16 capab;
+ 
+ 	sm->ft_completed = 0;
++	sm->ft_reassoc_completed = 0;
+ 
+ 	buf_len = 2 + sizeof(struct rsn_mdie) + 2 + sizeof(struct rsn_ftie) +
+ 		2 + sm->r0kh_id_len + ric_ies_len + 100;
+@@ -681,6 +682,11 @@ int wpa_ft_validate_reassoc_resp(struct
+ 		return -1;
+ 	}
+ 
++	if (sm->ft_reassoc_completed) {
++		wpa_printf(MSG_DEBUG, "FT: Reassociation has already been completed for this FT protocol instance - ignore unexpected retransmission");
++		return 0;
++	}
++
+ 	if (wpa_ft_parse_ies(ies, ies_len, &parse) < 0) {
+ 		wpa_printf(MSG_DEBUG, "FT: Failed to parse IEs");
+ 		return -1;
+@@ -781,6 +787,8 @@ int wpa_ft_validate_reassoc_resp(struct
+ 		return -1;
+ 	}
+ 
++	sm->ft_reassoc_completed = 1;
++
+ 	if (wpa_ft_process_gtk_subelem(sm, parse.gtk, parse.gtk_len) < 0)
+ 		return -1;
+ 
+--- a/src/rsn_supp/wpa_i.h
++++ b/src/rsn_supp/wpa_i.h
+@@ -128,6 +128,7 @@ struct wpa_sm {
+ 	size_t r0kh_id_len;
+ 	u8 r1kh_id[FT_R1KH_ID_LEN];
+ 	int ft_completed;
++	int ft_reassoc_completed;
+ 	int over_the_ds_in_progress;
+ 	u8 target_ap[ETH_ALEN]; /* over-the-DS target AP */
+ 	int set_ptk_after_assoc;

package/network/services/hostapd/patches/013-Add-hostapd-options-wpa_group_update_count-and-wpa_p.patch

@@ -0,0 +1,305 @@
+From 41f140d38617e1fd3fa88c1667c1bce0cad79224 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?G=C3=BCnther=20Kelleter?= <guenther.kelleter@devolo.de>
+Date: Thu, 5 Jan 2017 17:00:33 +0100
+Subject: [PATCH] Add hostapd options wpa_group_update_count and
+ wpa_pairwise_update_count
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+wpa_group_update_count and wpa_pairwise_update_count can now be used to
+set the GTK and PTK rekey retry limits (dot11RSNAConfigGroupUpdateCount
+and dot11RSNAConfigPairwiseUpdateCount). Defaults set to current
+hardcoded value (4).
+
+Some stations may suffer from frequent deauthentications due to GTK
+rekey failures: EAPOL 1/2 frame is not answered during the total timeout
+period of currently ~3.5 seconds. For example, a Galaxy S6 with Android
+6.0.1 appears to go into power save mode for up to 5 seconds. Increasing
+wpa_group_update_count to 6 fixed this issue.
+
+Signed-off-by: Günther Kelleter <guenther.kelleter@devolo.de>
+---
+ hostapd/config_file.c     | 22 ++++++++++++++++++++++
+ hostapd/hostapd.conf      | 11 +++++++++++
+ src/ap/ap_config.c        |  2 ++
+ src/ap/ap_config.h        |  2 ++
+ src/ap/wpa_auth.c         | 37 ++++++++++++++++++-------------------
+ src/ap/wpa_auth.h         |  2 ++
+ src/ap/wpa_auth_glue.c    |  2 ++
+ src/ap/wpa_auth_i.h       |  4 ++--
+ wpa_supplicant/ibss_rsn.c |  2 ++
+ wpa_supplicant/mesh_rsn.c |  2 ++
+ 10 files changed, 65 insertions(+), 21 deletions(-)
+
+diff --git a/hostapd/config_file.c b/hostapd/config_file.c
+index 8cfa198c3..02693a5b1 100644
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2489,6 +2489,28 @@ static int hostapd_config_fill(struct hostapd_config *conf,
+ 		bss->wpa_gmk_rekey = atoi(pos);
+ 	} else if (os_strcmp(buf, "wpa_ptk_rekey") == 0) {
+ 		bss->wpa_ptk_rekey = atoi(pos);
++	} else if (os_strcmp(buf, "wpa_group_update_count") == 0) {
++		char *endp;
++		unsigned long val = strtoul(pos, &endp, 0);
++
++		if (*endp || val < 1 || val > (u32) -1) {
++			wpa_printf(MSG_ERROR,
++				   "Line %d: Invalid wpa_group_update_count=%lu; allowed range 1..4294967295",
++				   line, val);
++			return 1;
++		}
++		bss->wpa_group_update_count = (u32) val;
++	} else if (os_strcmp(buf, "wpa_pairwise_update_count") == 0) {
++		char *endp;
++		unsigned long val = strtoul(pos, &endp, 0);
++
++		if (*endp || val < 1 || val > (u32) -1) {
++			wpa_printf(MSG_ERROR,
++				   "Line %d: Invalid wpa_pairwise_update_count=%lu; allowed range 1..4294967295",
++				   line, val);
++			return 1;
++		}
++		bss->wpa_pairwise_update_count = (u32) val;
+ 	} else if (os_strcmp(buf, "wpa_passphrase") == 0) {
+ 		int len = os_strlen(pos);
+ 		if (len < 8 || len > 63) {
+diff --git a/hostapd/hostapd.conf b/hostapd/hostapd.conf
+index 314f3842b..1fb1bd987 100644
+--- a/hostapd/hostapd.conf
++++ b/hostapd/hostapd.conf
+@@ -1221,6 +1221,11 @@ own_ip_addr=127.0.0.1
+ # (dot11RSNAConfigGroupRekeyStrict)
+ #wpa_strict_rekey=1
+ 
++# The number of times EAPOL-Key Message 1/2 in the RSN Group Key Handshake is
++#retried per GTK Handshake attempt. (dot11RSNAConfigGroupUpdateCount)
++# Range 1..4294967295; default: 4
++#wpa_group_update_count=4
++
+ # Time interval for rekeying GMK (master key used internally to generate GTKs
+ # (in seconds).
+ #wpa_gmk_rekey=86400
+@@ -1229,6 +1234,12 @@ own_ip_addr=127.0.0.1
+ # PTK to mitigate some attacks against TKIP deficiencies.
+ #wpa_ptk_rekey=600
+ 
++# The number of times EAPOL-Key Message 1/4 and Message 3/4 in the RSN 4-Way
++# Handshake are retried per 4-Way Handshake attempt.
++# (dot11RSNAConfigPairwiseUpdateCount)
++# Range 1..4294967295; default: 4
++#wpa_pairwise_update_count=4
++
+ # Enable IEEE 802.11i/RSN/WPA2 pre-authentication. This is used to speed up
+ # roaming be pre-authenticating IEEE 802.1X/EAP part of the full RSN
+ # authentication and key handshake before actually associating with a new AP.
+diff --git a/src/ap/ap_config.c b/src/ap/ap_config.c
+index c2b80ad97..9abcab7fb 100644
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -56,6 +56,8 @@ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ 
+ 	bss->wpa_group_rekey = 600;
+ 	bss->wpa_gmk_rekey = 86400;
++	bss->wpa_group_update_count = 4;
++	bss->wpa_pairwise_update_count = 4;
+ 	bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
+ 	bss->wpa_pairwise = WPA_CIPHER_TKIP;
+ 	bss->wpa_group = WPA_CIPHER_TKIP;
+diff --git a/src/ap/ap_config.h b/src/ap/ap_config.h
+index 31b1e7762..7495dc96f 100644
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -330,6 +330,8 @@ struct hostapd_bss_config {
+ 	int wpa_strict_rekey;
+ 	int wpa_gmk_rekey;
+ 	int wpa_ptk_rekey;
++	u32 wpa_group_update_count;
++	u32 wpa_pairwise_update_count;
+ 	int rsn_pairwise;
+ 	int rsn_preauth;
+ 	char *rsn_preauth_interfaces;
+diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
+index 0bd901fbf..8c082f426 100644
+--- a/src/ap/wpa_auth.c
++++ b/src/ap/wpa_auth.c
+@@ -60,8 +60,6 @@ static void wpa_group_put(struct wpa_authenticator *wpa_auth,
+ 			  struct wpa_group *group);
+ static u8 * ieee80211w_kde_add(struct wpa_state_machine *sm, u8 *pos);
+ 
+-static const u32 dot11RSNAConfigGroupUpdateCount = 4;
+-static const u32 dot11RSNAConfigPairwiseUpdateCount = 4;
+ static const u32 eapol_key_timeout_first = 100; /* ms */
+ static const u32 eapol_key_timeout_subseq = 1000; /* ms */
+ static const u32 eapol_key_timeout_first_group = 500; /* ms */
+@@ -1623,7 +1621,7 @@ static void wpa_send_eapol(struct wpa_authenticator *wpa_auth,
+ {
+ 	int timeout_ms;
+ 	int pairwise = key_info & WPA_KEY_INFO_KEY_TYPE;
+-	int ctr;
++	u32 ctr;
+ 
+ 	if (sm == NULL)
+ 		return;
+@@ -1640,7 +1638,7 @@ static void wpa_send_eapol(struct wpa_authenticator *wpa_auth,
+ 	if (pairwise && ctr == 1 && !(key_info & WPA_KEY_INFO_MIC))
+ 		sm->pending_1_of_4_timeout = 1;
+ 	wpa_printf(MSG_DEBUG, "WPA: Use EAPOL-Key timeout of %u ms (retry "
+-		   "counter %d)", timeout_ms, ctr);
++		   "counter %u)", timeout_ms, ctr);
+ 	eloop_register_timeout(timeout_ms / 1000, (timeout_ms % 1000) * 1000,
+ 			       wpa_send_eapol_timeout, wpa_auth, sm);
+ }
+@@ -2002,7 +2000,7 @@ SM_STATE(WPA_PTK, PTKSTART)
+ 	sm->alt_snonce_valid = FALSE;
+ 
+ 	sm->TimeoutCtr++;
+-	if (sm->TimeoutCtr > (int) dot11RSNAConfigPairwiseUpdateCount) {
++	if (sm->TimeoutCtr > sm->wpa_auth->conf.wpa_pairwise_update_count) {
+ 		/* No point in sending the EAPOL-Key - we will disconnect
+ 		 * immediately following this. */
+ 		return;
+@@ -2693,7 +2691,7 @@ SM_STATE(WPA_PTK, PTKINITNEGOTIATING)
+ 	sm->TimeoutEvt = FALSE;
+ 
+ 	sm->TimeoutCtr++;
+-	if (sm->TimeoutCtr > (int) dot11RSNAConfigPairwiseUpdateCount) {
++	if (sm->TimeoutCtr > sm->wpa_auth->conf.wpa_pairwise_update_count) {
+ 		/* No point in sending the EAPOL-Key - we will disconnect
+ 		 * immediately following this. */
+ 		return;
+@@ -2988,11 +2986,12 @@ SM_STEP(WPA_PTK)
+ 		    sm->EAPOLKeyPairwise)
+ 			SM_ENTER(WPA_PTK, PTKCALCNEGOTIATING);
+ 		else if (sm->TimeoutCtr >
+-			 (int) dot11RSNAConfigPairwiseUpdateCount) {
++			 sm->wpa_auth->conf.wpa_pairwise_update_count) {
+ 			wpa_auth->dot11RSNA4WayHandshakeFailures++;
+-			wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
+-					 "PTKSTART: Retry limit %d reached",
+-					 dot11RSNAConfigPairwiseUpdateCount);
++			wpa_auth_vlogger(
++				sm->wpa_auth, sm->addr, LOGGER_DEBUG,
++				"PTKSTART: Retry limit %u reached",
++				sm->wpa_auth->conf.wpa_pairwise_update_count);
+ 			SM_ENTER(WPA_PTK, DISCONNECT);
+ 		} else if (sm->TimeoutEvt)
+ 			SM_ENTER(WPA_PTK, PTKSTART);
+@@ -3016,12 +3015,12 @@ SM_STEP(WPA_PTK)
+ 			 sm->EAPOLKeyPairwise && sm->MICVerified)
+ 			SM_ENTER(WPA_PTK, PTKINITDONE);
+ 		else if (sm->TimeoutCtr >
+-			 (int) dot11RSNAConfigPairwiseUpdateCount) {
++			 sm->wpa_auth->conf.wpa_pairwise_update_count) {
+ 			wpa_auth->dot11RSNA4WayHandshakeFailures++;
+-			wpa_auth_vlogger(sm->wpa_auth, sm->addr, LOGGER_DEBUG,
+-					 "PTKINITNEGOTIATING: Retry limit %d "
+-					 "reached",
+-					 dot11RSNAConfigPairwiseUpdateCount);
++			wpa_auth_vlogger(
++				sm->wpa_auth, sm->addr, LOGGER_DEBUG,
++				"PTKINITNEGOTIATING: Retry limit %u reached",
++				sm->wpa_auth->conf.wpa_pairwise_update_count);
+ 			SM_ENTER(WPA_PTK, DISCONNECT);
+ 		} else if (sm->TimeoutEvt)
+ 			SM_ENTER(WPA_PTK, PTKINITNEGOTIATING);
+@@ -3056,7 +3055,7 @@ SM_STATE(WPA_PTK_GROUP, REKEYNEGOTIATING)
+ 	SM_ENTRY_MA(WPA_PTK_GROUP, REKEYNEGOTIATING, wpa_ptk_group);
+ 
+ 	sm->GTimeoutCtr++;
+-	if (sm->GTimeoutCtr > (int) dot11RSNAConfigGroupUpdateCount) {
++	if (sm->GTimeoutCtr > sm->wpa_auth->conf.wpa_group_update_count) {
+ 		/* No point in sending the EAPOL-Key - we will disconnect
+ 		 * immediately following this. */
+ 		return;
+@@ -3154,7 +3153,7 @@ SM_STEP(WPA_PTK_GROUP)
+ 		    !sm->EAPOLKeyPairwise && sm->MICVerified)
+ 			SM_ENTER(WPA_PTK_GROUP, REKEYESTABLISHED);
+ 		else if (sm->GTimeoutCtr >
+-			 (int) dot11RSNAConfigGroupUpdateCount)
++			 sm->wpa_auth->conf.wpa_group_update_count)
+ 			SM_ENTER(WPA_PTK_GROUP, KEYERROR);
+ 		else if (sm->TimeoutEvt)
+ 			SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING);
+@@ -3614,8 +3613,8 @@ int wpa_get_mib(struct wpa_authenticator *wpa_auth, char *buf, size_t buflen)
+ 		"dot11RSNAConfigNumberOfGTKSAReplayCounters=0\n",
+ 		RSN_VERSION,
+ 		!!wpa_auth->conf.wpa_strict_rekey,
+-		dot11RSNAConfigGroupUpdateCount,
+-		dot11RSNAConfigPairwiseUpdateCount,
++		wpa_auth->conf.wpa_group_update_count,
++		wpa_auth->conf.wpa_pairwise_update_count,
+ 		wpa_cipher_key_len(wpa_auth->conf.wpa_group) * 8,
+ 		dot11RSNAConfigPMKLifetime,
+ 		dot11RSNAConfigPMKReauthThreshold,
+diff --git a/src/ap/wpa_auth.h b/src/ap/wpa_auth.h
+index 9cbe3889b..0920a169d 100644
+--- a/src/ap/wpa_auth.h
++++ b/src/ap/wpa_auth.h
+@@ -144,6 +144,8 @@ struct wpa_auth_config {
+ 	int wpa_strict_rekey;
+ 	int wpa_gmk_rekey;
+ 	int wpa_ptk_rekey;
++	u32 wpa_group_update_count;
++	u32 wpa_pairwise_update_count;
+ 	int rsn_pairwise;
+ 	int rsn_preauth;
+ 	int eapol_version;
+diff --git a/src/ap/wpa_auth_glue.c b/src/ap/wpa_auth_glue.c
+index 22518a1f1..394f77a66 100644
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -41,6 +41,8 @@ static void hostapd_wpa_auth_conf(struct hostapd_bss_config *conf,
+ 	wconf->wpa_strict_rekey = conf->wpa_strict_rekey;
+ 	wconf->wpa_gmk_rekey = conf->wpa_gmk_rekey;
+ 	wconf->wpa_ptk_rekey = conf->wpa_ptk_rekey;
++	wconf->wpa_group_update_count = conf->wpa_group_update_count;
++	wconf->wpa_pairwise_update_count = conf->wpa_pairwise_update_count;
+ 	wconf->rsn_pairwise = conf->rsn_pairwise;
+ 	wconf->rsn_preauth = conf->rsn_preauth;
+ 	wconf->eapol_version = conf->eapol_version;
+diff --git a/src/ap/wpa_auth_i.h b/src/ap/wpa_auth_i.h
+index 065a624ad..cda2c5065 100644
+--- a/src/ap/wpa_auth_i.h
++++ b/src/ap/wpa_auth_i.h
+@@ -48,8 +48,8 @@ struct wpa_state_machine {
+ 	Boolean AuthenticationRequest;
+ 	Boolean ReAuthenticationRequest;
+ 	Boolean Disconnect;
+-	int TimeoutCtr;
+-	int GTimeoutCtr;
++	u32 TimeoutCtr;
++	u32 GTimeoutCtr;
+ 	Boolean TimeoutEvt;
+ 	Boolean EAPOLKeyReceived;
+ 	Boolean EAPOLKeyPairwise;
+diff --git a/wpa_supplicant/ibss_rsn.c b/wpa_supplicant/ibss_rsn.c
+index 521a692ba..954061ae4 100644
+--- a/wpa_supplicant/ibss_rsn.c
++++ b/wpa_supplicant/ibss_rsn.c
+@@ -428,6 +428,8 @@ static int ibss_rsn_auth_init_group(struct ibss_rsn *ibss_rsn,
+ 	conf.wpa_group = WPA_CIPHER_CCMP;
+ 	conf.eapol_version = 2;
+ 	conf.wpa_group_rekey = ssid->group_rekey ? ssid->group_rekey : 600;
++	conf.wpa_group_update_count = 4;
++	conf.wpa_pairwise_update_count = 4;
+ 
+ 	ibss_rsn->auth_group = wpa_init(own_addr, &conf, &cb, ibss_rsn);
+ 	if (ibss_rsn->auth_group == NULL) {
+diff --git a/wpa_supplicant/mesh_rsn.c b/wpa_supplicant/mesh_rsn.c
+index 33040f30b..628382cbf 100644
+--- a/wpa_supplicant/mesh_rsn.c
++++ b/wpa_supplicant/mesh_rsn.c
+@@ -158,6 +158,8 @@ static int __mesh_rsn_auth_init(struct mesh_rsn *rsn, const u8 *addr,
+ 	conf.wpa_group = rsn->group_cipher;
+ 	conf.eapol_version = 0;
+ 	conf.wpa_group_rekey = -1;
++	conf.wpa_group_update_count = 4;
++	conf.wpa_pairwise_update_count = 4;
+ #ifdef CONFIG_IEEE80211W
+ 	conf.ieee80211w = ieee80211w;
+ 	if (ieee80211w != NO_MGMT_FRAME_PROTECTION)
+-- 
+2.13.6
+

package/network/services/hostapd/patches/014-WPA-Extra-defense-against-PTK-reinstalls-in-4-way-ha.patch

@@ -0,0 +1,34 @@
+From a00e946c1c9a1f9cc65c72900d2a444ceb1f872e Mon Sep 17 00:00:00 2001
+From: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
+Date: Thu, 5 Oct 2017 23:53:01 +0200
+Subject: [PATCH] WPA: Extra defense against PTK reinstalls in 4-way handshake
+
+Currently, reinstallations of the PTK are prevented by (1) assuring the
+same TPTK is only set once as the PTK, and (2) that one particular PTK
+is only installed once. This patch makes it more explicit that point (1)
+is required to prevent key reinstallations. At the same time, this patch
+hardens wpa_supplicant such that future changes do not accidentally
+break this property.
+
+Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
+---
+ src/rsn_supp/wpa.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -1728,6 +1728,14 @@ static int wpa_supplicant_verify_eapol_k
+ 			sm->ptk_set = 1;
+ 			os_memcpy(&sm->ptk, &sm->tptk, sizeof(sm->ptk));
+ 			os_memset(&sm->tptk, 0, sizeof(sm->tptk));
++			/*
++			 * This assures the same TPTK in sm->tptk can never be
++			 * copied twice to sm->pkt as the new PTK. In
++			 * combination with the installed flag in the wpa_ptk
++			 * struct, this assures the same PTK is only installed
++			 * once.
++			 */
++			sm->renew_snonce = 1;
+ 		}
+ 	}
+ 

package/network/services/hostapd/patches/015-Clear-PMK-length-and-check-for-this-when-deriving-PT.patch

@@ -0,0 +1,53 @@
+From b488a12948751f57871f09baa345e59b23959a41 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Sun, 8 Oct 2017 13:18:02 +0300
+Subject: [PATCH] Clear PMK length and check for this when deriving PTK
+
+Instead of setting the default PMK length for the cleared PMK, set the
+length to 0 and explicitly check for this when deriving PTK to avoid
+unexpected key derivation with an all-zeroes key should it be possible
+to somehow trigger PTK derivation to happen before PMK derivation.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/common/wpa_common.c | 5 +++++
+ src/rsn_supp/wpa.c      | 7 ++++---
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+--- a/src/common/wpa_common.c
++++ b/src/common/wpa_common.c
+@@ -225,6 +225,11 @@ int wpa_pmk_to_ptk(const u8 *pmk, size_t
+ 	u8 tmp[WPA_KCK_MAX_LEN + WPA_KEK_MAX_LEN + WPA_TK_MAX_LEN];
+ 	size_t ptk_len;
+ 
++	if (pmk_len == 0) {
++		wpa_printf(MSG_ERROR, "WPA: No PMK set for PT derivation");
++		return -1;
++	}
++
+ 	if (os_memcmp(addr1, addr2, ETH_ALEN) < 0) {
+ 		os_memcpy(data, addr1, ETH_ALEN);
+ 		os_memcpy(data + ETH_ALEN, addr2, ETH_ALEN);
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -584,7 +584,8 @@ static void wpa_supplicant_process_1_of_
+ 	/* Calculate PTK which will be stored as a temporary PTK until it has
+ 	 * been verified when processing message 3/4. */
+ 	ptk = &sm->tptk;
+-	wpa_derive_ptk(sm, src_addr, key, ptk);
++	if (wpa_derive_ptk(sm, src_addr, key, ptk) < 0)
++		goto failed;
+ 	if (sm->pairwise_cipher == WPA_CIPHER_TKIP) {
+ 		u8 buf[8];
+ 		/* Supplicant: swap tx/rx Mic keys */
+@@ -2705,8 +2706,8 @@ void wpa_sm_set_pmk_from_pmksa(struct wp
+ 		sm->pmk_len = sm->cur_pmksa->pmk_len;
+ 		os_memcpy(sm->pmk, sm->cur_pmksa->pmk, sm->pmk_len);
+ 	} else {
+-		sm->pmk_len = PMK_LEN;
+-		os_memset(sm->pmk, 0, PMK_LEN);
++		sm->pmk_len = 0;
++		os_memset(sm->pmk, 0, PMK_LEN_MAX);
+ 	}
+ }
+ 

package/network/services/hostapd/patches/016-Optional-AP-side-workaround-for-key-reinstallation-a.patch

@@ -0,0 +1,221 @@
+From 6f234c1e2ee1ede29f2412b7012b3345ed8e52d3 Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Mon, 16 Oct 2017 18:37:43 +0300
+Subject: [PATCH] Optional AP side workaround for key reinstallation attacks
+
+This adds a new hostapd configuration parameter
+wpa_disable_eapol_key_retries=1 that can be used to disable
+retransmission of EAPOL-Key frames that are used to install
+keys (EAPOL-Key message 3/4 and group message 1/2). This is
+similar to setting wpa_group_update_count=1 and
+wpa_pairwise_update_count=1, but with no impact to message 1/4
+retries and with extended timeout for messages 4/4 and group
+message 2/2 to avoid causing issues with stations that may use
+aggressive power saving have very long time in replying to the
+EAPOL-Key messages.
+
+This option can be used to work around key reinstallation attacks
+on the station (supplicant) side in cases those station devices
+cannot be updated for some reason. By removing the
+retransmissions the attacker cannot cause key reinstallation with
+a delayed frame transmission. This is related to the station side
+vulnerabilities CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
+CVE-2017-13080, and CVE-2017-13081.
+
+This workaround might cause interoperability issues and reduced
+robustness of key negotiation especially in environments with
+heavy traffic load due to the number of attempts to perform the
+key exchange is reduced significantly. As such, this workaround
+is disabled by default (unless overridden in build
+configuration). To enable this, set the parameter to 1.
+
+It is also possible to enable this in the build by default by
+adding the following to the build configuration:
+
+CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ hostapd/config_file.c  |  2 ++
+ hostapd/defconfig      |  4 ++++
+ hostapd/hostapd.conf   | 24 ++++++++++++++++++++++++
+ src/ap/ap_config.c     |  6 ++++++
+ src/ap/ap_config.h     |  1 +
+ src/ap/wpa_auth.c      | 22 ++++++++++++++++++++--
+ src/ap/wpa_auth.h      |  1 +
+ src/ap/wpa_auth_glue.c |  2 ++
+ 8 files changed, 60 insertions(+), 2 deletions(-)
+
+--- a/hostapd/config_file.c
++++ b/hostapd/config_file.c
+@@ -2515,6 +2515,8 @@ static int hostapd_config_fill(struct ho
+ 			return 1;
+ 		}
+ 		bss->wpa_pairwise_update_count = (u32) val;
++	} else if (os_strcmp(buf, "wpa_disable_eapol_key_retries") == 0) {
++		bss->wpa_disable_eapol_key_retries = atoi(pos);
+ 	} else if (os_strcmp(buf, "wpa_passphrase") == 0) {
+ 		int len = os_strlen(pos);
+ 		if (len < 8 || len > 63) {
+--- a/hostapd/defconfig
++++ b/hostapd/defconfig
+@@ -355,3 +355,7 @@ CONFIG_IPV6=y
+ # Include internal line edit mode in hostapd_cli. This can be used to provide
+ # limited command line editing and history support.
+ #CONFIG_WPA_CLI_EDIT=y
++
++# Override default value for the wpa_disable_eapol_key_retries configuration
++# parameter. See that parameter in hostapd.conf for more details.
++#CFLAGS += -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=1
+--- a/hostapd/hostapd.conf
++++ b/hostapd/hostapd.conf
+@@ -1240,6 +1240,30 @@ own_ip_addr=127.0.0.1
+ # Range 1..4294967295; default: 4
+ #wpa_pairwise_update_count=4
+ 
++# Workaround for key reinstallation attacks
++#
++# This parameter can be used to disable retransmission of EAPOL-Key frames that
++# are used to install keys (EAPOL-Key message 3/4 and group message 1/2). This
++# is similar to setting wpa_group_update_count=1 and
++# wpa_pairwise_update_count=1, but with no impact to message 1/4 and with
++# extended timeout on the response to avoid causing issues with stations that
++# may use aggressive power saving have very long time in replying to the
++# EAPOL-Key messages.
++#
++# This option can be used to work around key reinstallation attacks on the
++# station (supplicant) side in cases those station devices cannot be updated
++# for some reason. By removing the retransmissions the attacker cannot cause
++# key reinstallation with a delayed frame transmission. This is related to the
++# station side vulnerabilities CVE-2017-13077, CVE-2017-13078, CVE-2017-13079,
++# CVE-2017-13080, and CVE-2017-13081.
++#
++# This workaround might cause interoperability issues and reduced robustness of
++# key negotiation especially in environments with heavy traffic load due to the
++# number of attempts to perform the key exchange is reduced significantly. As
++# such, this workaround is disabled by default (unless overridden in build
++# configuration). To enable this, set the parameter to 1.
++#wpa_disable_eapol_key_retries=1
++
+ # Enable IEEE 802.11i/RSN/WPA2 pre-authentication. This is used to speed up
+ # roaming be pre-authenticating IEEE 802.1X/EAP part of the full RSN
+ # authentication and key handshake before actually associating with a new AP.
+--- a/src/ap/ap_config.c
++++ b/src/ap/ap_config.c
+@@ -36,6 +36,10 @@ static void hostapd_config_free_vlan(str
+ }
+ 
+ 
++#ifndef DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES
++#define DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES 0
++#endif /* DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES */
++
+ void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
+ {
+ 	dl_list_init(&bss->anqp_elem);
+@@ -57,6 +61,8 @@ void hostapd_config_defaults_bss(struct
+ 	bss->wpa_gmk_rekey = 86400;
+ 	bss->wpa_group_update_count = 4;
+ 	bss->wpa_pairwise_update_count = 4;
++	bss->wpa_disable_eapol_key_retries =
++		DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES;
+ 	bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
+ 	bss->wpa_pairwise = WPA_CIPHER_TKIP;
+ 	bss->wpa_group = WPA_CIPHER_TKIP;
+--- a/src/ap/ap_config.h
++++ b/src/ap/ap_config.h
+@@ -332,6 +332,7 @@ struct hostapd_bss_config {
+ 	int wpa_ptk_rekey;
+ 	u32 wpa_group_update_count;
+ 	u32 wpa_pairwise_update_count;
++	int wpa_disable_eapol_key_retries;
+ 	int rsn_pairwise;
+ 	int rsn_preauth;
+ 	char *rsn_preauth_interfaces;
+--- a/src/ap/wpa_auth.c
++++ b/src/ap/wpa_auth.c
+@@ -63,6 +63,7 @@ static u8 * ieee80211w_kde_add(struct wp
+ static const u32 eapol_key_timeout_first = 100; /* ms */
+ static const u32 eapol_key_timeout_subseq = 1000; /* ms */
+ static const u32 eapol_key_timeout_first_group = 500; /* ms */
++static const u32 eapol_key_timeout_no_retrans = 4000; /* ms */
+ 
+ /* TODO: make these configurable */
+ static const int dot11RSNAConfigPMKLifetime = 43200;
+@@ -1629,6 +1630,9 @@ static void wpa_send_eapol(struct wpa_au
+ 			eapol_key_timeout_first_group;
+ 	else
+ 		timeout_ms = eapol_key_timeout_subseq;
++	if (wpa_auth->conf.wpa_disable_eapol_key_retries &&
++	    (!pairwise || (key_info & WPA_KEY_INFO_MIC)))
++		timeout_ms = eapol_key_timeout_no_retrans;
+ 	if (pairwise && ctr == 1 && !(key_info & WPA_KEY_INFO_MIC))
+ 		sm->pending_1_of_4_timeout = 1;
+ 	wpa_printf(MSG_DEBUG, "WPA: Use EAPOL-Key timeout of %u ms (retry "
+@@ -2700,6 +2704,11 @@ SM_STATE(WPA_PTK, PTKINITNEGOTIATING)
+ 	sm->TimeoutEvt = FALSE;
+ 
+ 	sm->TimeoutCtr++;
++	if (sm->wpa_auth->conf.wpa_disable_eapol_key_retries &&
++	    sm->TimeoutCtr > 1) {
++		/* Do not allow retransmission of EAPOL-Key msg 3/4 */
++		return;
++	}
+ 	if (sm->TimeoutCtr > sm->wpa_auth->conf.wpa_pairwise_update_count) {
+ 		/* No point in sending the EAPOL-Key - we will disconnect
+ 		 * immediately following this. */
+@@ -3027,7 +3036,9 @@ SM_STEP(WPA_PTK)
+ 			 sm->EAPOLKeyPairwise && sm->MICVerified)
+ 			SM_ENTER(WPA_PTK, PTKINITDONE);
+ 		else if (sm->TimeoutCtr >
+-			 sm->wpa_auth->conf.wpa_pairwise_update_count) {
++			 sm->wpa_auth->conf.wpa_pairwise_update_count ||
++			 (sm->wpa_auth->conf.wpa_disable_eapol_key_retries &&
++			  sm->TimeoutCtr > 1)) {
+ 			wpa_auth->dot11RSNA4WayHandshakeFailures++;
+ 			wpa_auth_vlogger(
+ 				sm->wpa_auth, sm->addr, LOGGER_DEBUG,
+@@ -3067,6 +3078,11 @@ SM_STATE(WPA_PTK_GROUP, REKEYNEGOTIATING
+ 	SM_ENTRY_MA(WPA_PTK_GROUP, REKEYNEGOTIATING, wpa_ptk_group);
+ 
+ 	sm->GTimeoutCtr++;
++	if (sm->wpa_auth->conf.wpa_disable_eapol_key_retries &&
++	    sm->GTimeoutCtr > 1) {
++		/* Do not allow retransmission of EAPOL-Key group msg 1/2 */
++		return;
++	}
+ 	if (sm->GTimeoutCtr > sm->wpa_auth->conf.wpa_group_update_count) {
+ 		/* No point in sending the EAPOL-Key - we will disconnect
+ 		 * immediately following this. */
+@@ -3165,7 +3181,9 @@ SM_STEP(WPA_PTK_GROUP)
+ 		    !sm->EAPOLKeyPairwise && sm->MICVerified)
+ 			SM_ENTER(WPA_PTK_GROUP, REKEYESTABLISHED);
+ 		else if (sm->GTimeoutCtr >
+-			 sm->wpa_auth->conf.wpa_group_update_count)
++			 sm->wpa_auth->conf.wpa_group_update_count ||
++			 (sm->wpa_auth->conf.wpa_disable_eapol_key_retries &&
++			  sm->GTimeoutCtr > 1))
+ 			SM_ENTER(WPA_PTK_GROUP, KEYERROR);
+ 		else if (sm->TimeoutEvt)
+ 			SM_ENTER(WPA_PTK_GROUP, REKEYNEGOTIATING);
+--- a/src/ap/wpa_auth.h
++++ b/src/ap/wpa_auth.h
+@@ -146,6 +146,7 @@ struct wpa_auth_config {
+ 	int wpa_ptk_rekey;
+ 	u32 wpa_group_update_count;
+ 	u32 wpa_pairwise_update_count;
++	int wpa_disable_eapol_key_retries;
+ 	int rsn_pairwise;
+ 	int rsn_preauth;
+ 	int eapol_version;
+--- a/src/ap/wpa_auth_glue.c
++++ b/src/ap/wpa_auth_glue.c
+@@ -42,6 +42,8 @@ static void hostapd_wpa_auth_conf(struct
+ 	wconf->wpa_gmk_rekey = conf->wpa_gmk_rekey;
+ 	wconf->wpa_ptk_rekey = conf->wpa_ptk_rekey;
+ 	wconf->wpa_group_update_count = conf->wpa_group_update_count;
++	wconf->wpa_disable_eapol_key_retries =
++		conf->wpa_disable_eapol_key_retries;
+ 	wconf->wpa_pairwise_update_count = conf->wpa_pairwise_update_count;
+ 	wconf->rsn_pairwise = conf->rsn_pairwise;
+ 	wconf->rsn_preauth = conf->rsn_preauth;

package/network/services/hostapd/patches/017-Additional-consistentcy-checks-for-PTK-component-len.patch

@@ -0,0 +1,92 @@
+From a6ea665300919d6a3af22b1f4237203647fda93a Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Tue, 17 Oct 2017 00:01:11 +0300
+Subject: [PATCH] Additional consistentcy checks for PTK component lengths
+
+Verify that TK, KCK, and KEK lengths are set to consistent values within
+struct wpa_ptk before using them in supplicant. This is an additional
+layer of protection against unexpected states.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/common/wpa_common.c |  6 ++++++
+ src/rsn_supp/wpa.c      | 26 ++++++++++++++++++++------
+ 2 files changed, 26 insertions(+), 6 deletions(-)
+
+--- a/src/common/wpa_common.c
++++ b/src/common/wpa_common.c
+@@ -93,6 +93,12 @@ int wpa_eapol_key_mic(const u8 *key, siz
+ {
+ 	u8 hash[SHA384_MAC_LEN];
+ 
++	if (key_len == 0) {
++		wpa_printf(MSG_DEBUG,
++			   "WPA: KCK not set - cannot calculate MIC");
++		return -1;
++	}
++
+ 	switch (ver) {
+ #ifndef CONFIG_FIPS
+ 	case WPA_KEY_INFO_TYPE_HMAC_MD5_RC4:
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -710,6 +710,11 @@ static int wpa_supplicant_install_ptk(st
+ 
+ 	alg = wpa_cipher_to_alg(sm->pairwise_cipher);
+ 	keylen = wpa_cipher_key_len(sm->pairwise_cipher);
++	if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
++		wpa_printf(MSG_DEBUG, "WPA: TK length mismatch: %d != %lu",
++			   keylen, (long unsigned int) sm->ptk.tk_len);
++		return -1;
++	}
+ 	rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
+ 
+ 	if (sm->proto == WPA_PROTO_RSN || sm->proto == WPA_PROTO_OSEN) {
+@@ -730,6 +735,7 @@ static int wpa_supplicant_install_ptk(st
+ 
+ 	/* TK is not needed anymore in supplicant */
+ 	os_memset(sm->ptk.tk, 0, WPA_TK_MAX_LEN);
++	sm->ptk.tk_len = 0;
+ 	sm->ptk.installed = 1;
+ 
+ 	if (sm->wpa_ptk_rekey) {
+@@ -1699,9 +1705,10 @@ static int wpa_supplicant_verify_eapol_k
+ 	os_memcpy(mic, key + 1, mic_len);
+ 	if (sm->tptk_set) {
+ 		os_memset(key + 1, 0, mic_len);
+-		wpa_eapol_key_mic(sm->tptk.kck, sm->tptk.kck_len, sm->key_mgmt,
+-				  ver, buf, len, (u8 *) (key + 1));
+-		if (os_memcmp_const(mic, key + 1, mic_len) != 0) {
++		if (wpa_eapol_key_mic(sm->tptk.kck, sm->tptk.kck_len,
++				      sm->key_mgmt,
++				      ver, buf, len, (u8 *) (key + 1)) < 0 ||
++		    os_memcmp_const(mic, key + 1, mic_len) != 0) {
+ 			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
+ 				"WPA: Invalid EAPOL-Key MIC "
+ 				"when using TPTK - ignoring TPTK");
+@@ -1724,9 +1731,10 @@ static int wpa_supplicant_verify_eapol_k
+ 
+ 	if (!ok && sm->ptk_set) {
+ 		os_memset(key + 1, 0, mic_len);
+-		wpa_eapol_key_mic(sm->ptk.kck, sm->ptk.kck_len, sm->key_mgmt,
+-				  ver, buf, len, (u8 *) (key + 1));
+-		if (os_memcmp_const(mic, key + 1, mic_len) != 0) {
++		if (wpa_eapol_key_mic(sm->ptk.kck, sm->ptk.kck_len,
++				      sm->key_mgmt,
++				      ver, buf, len, (u8 *) (key + 1)) < 0 ||
++		    os_memcmp_const(mic, key + 1, mic_len) != 0) {
+ 			wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
+ 				"WPA: Invalid EAPOL-Key MIC - "
+ 				"dropping packet");
+@@ -3689,6 +3697,11 @@ int fils_process_assoc_resp(struct wpa_s
+ 
+ 	alg = wpa_cipher_to_alg(sm->pairwise_cipher);
+ 	keylen = wpa_cipher_key_len(sm->pairwise_cipher);
++	if (keylen <= 0 || (unsigned int) keylen != sm->ptk.tk_len) {
++		wpa_printf(MSG_DEBUG, "FILS: TK length mismatch: %u != %lu",
++			   keylen, (long unsigned int) sm->ptk.tk_len);
++		goto fail;
++	}
+ 	rsclen = wpa_cipher_rsc_len(sm->pairwise_cipher);
+ 	wpa_hexdump_key(MSG_DEBUG, "FILS: Set TK to driver",
+ 			sm->ptk.tk, keylen);

package/network/services/hostapd/patches/018-Clear-BSSID-information-in-supplicant-state-machine-.patch

@@ -0,0 +1,25 @@
+From c0fe5f125a9d4a6564e1f4956ccc3809bf2fd69d Mon Sep 17 00:00:00 2001
+From: Jouni Malinen <j@w1.fi>
+Date: Tue, 17 Oct 2017 01:15:24 +0300
+Subject: [PATCH] Clear BSSID information in supplicant state machine on
+ disconnection
+
+This fixes a corner case where RSN pre-authentication candidate from
+scan results was ignored if the station was associated with that BSS
+just before running the new scan for the connection.
+
+Signed-off-by: Jouni Malinen <j@w1.fi>
+---
+ src/rsn_supp/wpa.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/rsn_supp/wpa.c
++++ b/src/rsn_supp/wpa.c
+@@ -2662,6 +2662,7 @@ void wpa_sm_notify_disassoc(struct wpa_s
+ 	wpa_sm_drop_sa(sm);
+ 
+ 	sm->msg_3_of_4_ok = 0;
++	os_memset(sm->bssid, 0, ETH_ALEN);
+ }
+ 
+ 

package/network/services/hostapd/patches/380-disable_ctrl_iface_mib.patch

@@ -129,7 +129,7 @@
  static void ieee802_1x_wnm_notif_send(void *eloop_ctx, void *timeout_ctx)
 --- a/src/ap/wpa_auth.c
 +++ b/src/ap/wpa_auth.c
-@@ -3544,6 +3544,7 @@ static const char * wpa_bool_txt(int val
+@@ -3565,6 +3565,7 @@ static const char * wpa_bool_txt(int val
  	return val ? "TRUE" : "FALSE";
  }
  
@@ -137,7 +137,7 @@
  
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
-@@ -3688,7 +3689,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
+@@ -3709,7 +3710,7 @@ int wpa_get_mib_sta(struct wpa_state_mac
  
  	return len;
  }
@@ -148,7 +148,7 @@
  {
 --- a/src/rsn_supp/wpa.c
 +++ b/src/rsn_supp/wpa.c
-@@ -2252,6 +2252,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
+@@ -2308,6 +2308,8 @@ static u32 wpa_key_mgmt_suite(struct wpa
  }
  
  
@@ -157,7 +157,7 @@
  #define RSN_SUITE "%02x-%02x-%02x-%d"
  #define RSN_SUITE_ARG(s) \
  ((s) >> 24) & 0xff, ((s) >> 16) & 0xff, ((s) >> 8) & 0xff, (s) & 0xff
-@@ -2335,6 +2337,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
+@@ -2391,6 +2393,7 @@ int wpa_sm_get_mib(struct wpa_sm *sm, ch
  
  	return (int) len;
  }

package/network/services/hostapd/patches/600-ubus_support.patch

@@ -121,7 +121,7 @@
  	if (res == HOSTAPD_ACL_PENDING) {
  		wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
  			   " waiting for an external authentication",
-@@ -2391,7 +2405,7 @@ static u16 send_assoc_resp(struct hostap
+@@ -2401,7 +2415,7 @@ static u16 send_assoc_resp(struct hostap
  
  static void handle_assoc(struct hostapd_data *hapd,
  			 const struct ieee80211_mgmt *mgmt, size_t len,
@@ -130,7 +130,7 @@
  {
  	u16 capab_info, listen_interval, seq_ctrl, fc;
  	u16 resp = WLAN_STATUS_SUCCESS, reply_res;
-@@ -2399,6 +2413,11 @@ static void handle_assoc(struct hostapd_
+@@ -2409,6 +2423,11 @@ static void handle_assoc(struct hostapd_
  	int left, i;
  	struct sta_info *sta;
  	u8 *tmp = NULL;
@@ -142,7 +142,7 @@
  
  	if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
  				      sizeof(mgmt->u.assoc_req))) {
-@@ -2518,6 +2537,13 @@ static void handle_assoc(struct hostapd_
+@@ -2528,6 +2547,13 @@ static void handle_assoc(struct hostapd_
  	}
  #endif /* CONFIG_MBO */
  
@@ -156,7 +156,7 @@
  	/*
  	 * sta->capability is used in check_assoc_ies() for RRM enabled
  	 * capability element.
-@@ -3025,7 +3051,7 @@ int ieee802_11_mgmt(struct hostapd_data
+@@ -3035,7 +3061,7 @@ int ieee802_11_mgmt(struct hostapd_data
  
  
  	if (stype == WLAN_FC_STYPE_PROBE_REQ) {
@@ -165,7 +165,7 @@
  		return 1;
  	}
  
-@@ -3043,17 +3069,17 @@ int ieee802_11_mgmt(struct hostapd_data
+@@ -3053,17 +3079,17 @@ int ieee802_11_mgmt(struct hostapd_data
  	switch (stype) {
  	case WLAN_FC_STYPE_AUTH:
  		wpa_printf(MSG_DEBUG, "mgmt::auth");

package/network/services/wireguard/Makefile

@@ -0,0 +1,116 @@
+#
+# Copyright (C) 2016-2017 Jason A. Donenfeld <Jason@zx2c4.com>
+# Copyright (C) 2016 Baptiste Jonglez <openwrt@bitsofnetworks.org>
+# Copyright (C) 2016-2017 Dan Luedtke <mail@danrl.com>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+PKG_NAME:=wireguard
+
+PKG_VERSION:=0.0.20171017
+PKG_RELEASE:=1
+
+PKG_SOURCE:=WireGuard-$(PKG_VERSION).tar.xz
+PKG_SOURCE_URL:=https://git.zx2c4.com/WireGuard/snapshot/
+PKG_HASH:=57b79a62874d9b99659a744513d4f6f9d88cb772deaa99e485b6fed3004a35cd
+
+PKG_LICENSE:=GPL-2.0 Apache-2.0
+PKG_LICENSE_FILES:=COPYING
+
+PKG_BUILD_DIR:=$(BUILD_DIR)/WireGuard-$(PKG_VERSION)
+PKG_BUILD_PARALLEL:=1
+PKG_USE_MIPS16:=0
+
+# WireGuard's makefile needs this to know where to build the kernel module
+export KERNELDIR:=$(LINUX_DIR)
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/wireguard/Default
+  SECTION:=net
+  CATEGORY:=Network
+  SUBMENU:=VPN
+  URL:=https://www.wireguard.com
+  MAINTAINER:=Baptiste Jonglez <openwrt@bitsofnetworks.org>, \
+              Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>, \
+              Dan Luedtke <mail@danrl.com>, \
+              Jason A. Donenfeld <Jason@zx2c4.com>
+endef
+
+define Package/wireguard/Default/description
+  WireGuard is a novel VPN that runs inside the Linux Kernel and utilizes
+  state-of-the-art cryptography. It aims to be faster, simpler, leaner, and
+  more useful than IPSec, while avoiding the massive headache. It intends to
+  be considerably more performant than OpenVPN.  WireGuard is designed as a
+  general purpose VPN for running on embedded interfaces and super computers
+  alike, fit for many different circumstances. It uses UDP.
+endef
+
+define Package/wireguard
+  $(call Package/wireguard/Default)
+  TITLE:=WireGuard meta-package
+  DEPENDS:=+wireguard-tools +kmod-wireguard
+endef
+
+include $(INCLUDE_DIR)/kernel-defaults.mk
+include $(INCLUDE_DIR)/package-defaults.mk
+
+# Used by Build/Compile/Default
+MAKE_PATH:=src/tools
+
+define Build/Compile
+	$(MAKE) $(KERNEL_MAKEOPTS) M="$(PKG_BUILD_DIR)/src" modules
+	$(call Build/Compile/Default)
+endef
+
+define Package/wireguard/install
+  true
+endef
+
+define Package/wireguard/description
+  $(call Package/wireguard/Default/description)
+endef
+
+define Package/wireguard-tools
+  $(call Package/wireguard/Default)
+  TITLE:=WireGuard userspace control program (wg)
+  DEPENDS:=+libmnl +ip
+endef
+
+define Package/wireguard-tools/description
+  $(call Package/wireguard/Default/description)
+
+  This package provides the userspace control program for WireGuard,
+  `wg(8)`, and a netifd protocol helper.
+endef
+
+define Package/wireguard-tools/install
+	$(INSTALL_DIR) $(1)/usr/bin/
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/tools/wg $(1)/usr/bin/
+	$(INSTALL_DIR) $(1)/lib/netifd/proto/
+	$(INSTALL_BIN) ./files/wireguard.sh $(1)/lib/netifd/proto/
+endef
+
+define KernelPackage/wireguard
+  SECTION:=kernel
+  CATEGORY:=Kernel modules
+  SUBMENU:=Network Support
+  TITLE:=WireGuard kernel module
+  DEPENDS:=+IPV6:kmod-udptunnel6 +kmod-udptunnel4
+  FILES:= $(PKG_BUILD_DIR)/src/wireguard.$(LINUX_KMOD_SUFFIX)
+  AUTOLOAD:=$(call AutoProbe,wireguard)
+endef
+
+define KernelPackage/wireguard/description
+  $(call Package/wireguard/Default/description)
+
+  This package provides the kernel module for WireGuard.
+endef
+
+$(eval $(call BuildPackage,wireguard))
+$(eval $(call BuildPackage,wireguard-tools))
+$(eval $(call KernelPackage,wireguard))

package/network/services/wireguard/files/wireguard.sh

@@ -0,0 +1,192 @@
+#!/bin/sh
+# Copyright 2016-2017 Dan Luedtke <mail@danrl.com>
+# Licensed to the public under the Apache License 2.0.
+
+
+WG=/usr/bin/wg
+if [ ! -x $WG ]; then
+  logger -t "wireguard" "error: missing wireguard-tools (${WG})"
+  exit 0
+fi
+
+
+[ -n "$INCLUDE_ONLY" ] || {
+  . /lib/functions.sh
+  . ../netifd-proto.sh
+  init_proto "$@"
+}
+
+
+proto_wireguard_init_config() {
+  proto_config_add_string "private_key"
+  proto_config_add_int    "listen_port"
+  proto_config_add_int    "mtu"
+  proto_config_add_string "fwmark"
+  available=1
+  no_proto_task=1
+}
+
+
+proto_wireguard_setup_peer() {
+  local peer_config="$1"
+
+  local public_key
+  local preshared_key
+  local allowed_ips
+  local route_allowed_ips
+  local endpoint_host
+  local endpoint_port
+  local persistent_keepalive
+
+  config_get      public_key           "${peer_config}" "public_key"
+  config_get      preshared_key        "${peer_config}" "preshared_key"
+  config_get      allowed_ips          "${peer_config}" "allowed_ips"
+  config_get_bool route_allowed_ips    "${peer_config}" "route_allowed_ips" 0
+  config_get      endpoint_host        "${peer_config}" "endpoint_host"
+  config_get      endpoint_port        "${peer_config}" "endpoint_port"
+  config_get      persistent_keepalive "${peer_config}" "persistent_keepalive"
+
+  # peer configuration
+  echo "[Peer]"                                         >> "${wg_cfg}"
+  echo "PublicKey=${public_key}"                        >> "${wg_cfg}"
+  if [ "${preshared_key}" ]; then
+    echo "PresharedKey=${preshared_key}"                >> "${wg_cfg}"
+  fi
+  for allowed_ip in $allowed_ips; do
+    echo "AllowedIPs=${allowed_ip}"                     >> "${wg_cfg}"
+  done
+  if [ "${endpoint_host}" ]; then
+    case "${endpoint_host}" in
+      *:*)
+        endpoint="[${endpoint_host}]"
+      ;;
+      *)
+        endpoint="${endpoint_host}"
+      ;;
+    esac
+    if [ "${endpoint_port}" ]; then
+      endpoint="${endpoint}:${endpoint_port}"
+    else
+      endpoint="${endpoint}:51820"
+    fi
+    echo "Endpoint=${endpoint}"                         >> "${wg_cfg}"
+  fi
+  if [ "${persistent_keepalive}" ]; then
+    echo "PersistentKeepalive=${persistent_keepalive}"  >> "${wg_cfg}"
+  fi
+
+  # add routes for allowed ips
+  if [ ${route_allowed_ips} -ne 0 ]; then
+    for allowed_ip in ${allowed_ips}; do
+      case "${allowed_ip}" in
+        *:*/*)
+          proto_add_ipv6_route "${allowed_ip%%/*}" "${allowed_ip##*/}"
+        ;;
+        *.*/*)
+          proto_add_ipv4_route "${allowed_ip%%/*}" "${allowed_ip##*/}"
+        ;;
+        *:*)
+          proto_add_ipv6_route "${allowed_ip%%/*}" "128"
+        ;;
+        *.*)
+          proto_add_ipv4_route "${allowed_ip%%/*}" "32"
+        ;;
+      esac
+    done
+  fi
+}
+
+
+proto_wireguard_setup() {
+  local config="$1"
+  local wg_dir="/tmp/wireguard"
+  local wg_cfg="${wg_dir}/${config}"
+
+  local private_key
+  local listen_port
+  local mtu
+
+  # load configuration
+  config_load network
+  config_get private_key   "${config}" "private_key"
+  config_get listen_port   "${config}" "listen_port"
+  config_get addresses     "${config}" "addresses"
+  config_get mtu           "${config}" "mtu"
+  config_get fwmark        "${config}" "fwmark"
+
+  # create interface
+  ip link del dev "${config}" 2>/dev/null
+  ip link add dev "${config}" type wireguard
+
+  if [ "${mtu}" ]; then
+    ip link set mtu "${mtu}" dev "${config}"
+  fi
+
+  proto_init_update "${config}" 1
+
+  # generate configuration file
+  umask 077
+  mkdir -p "${wg_dir}"
+  echo "[Interface]"                     >  "${wg_cfg}"
+  echo "PrivateKey=${private_key}"       >> "${wg_cfg}"
+  if [ "${listen_port}" ]; then
+    echo "ListenPort=${listen_port}"     >> "${wg_cfg}"
+  fi
+  if [ "${fwmark}" ]; then
+    echo "FwMark=${fwmark}" >> "${wg_cfg}"
+  fi
+  config_foreach proto_wireguard_setup_peer "wireguard_${config}"
+
+  # apply configuration file
+  ${WG} setconf ${config} "${wg_cfg}"
+  WG_RETURN=$?
+
+  # delete configuration file
+  rm -f "${wg_cfg}"
+
+  # check status
+  if [ ${WG_RETURN} -ne 0 ]; then
+    sleep 5
+    proto_setup_failed "${config}"
+    exit 1
+  fi
+
+  # add ip addresses
+  for address in ${addresses}; do
+    case "${address}" in
+      *:*/*)
+        proto_add_ipv6_address "${address%%/*}" "${address##*/}"
+      ;;
+      *.*/*)
+        proto_add_ipv4_address "${address%%/*}" "${address##*/}"
+      ;;
+      *:*)
+        proto_add_ipv6_address "${address%%/*}" "128"
+      ;;
+      *.*)
+        proto_add_ipv4_address "${address%%/*}" "32"
+      ;;
+    esac
+  done
+
+  # endpoint dependency
+  wg show "${config}" endpoints | \
+    sed -E 's/\[?([0-9.:a-f]+)\]?:([0-9]+)/\1 \2/' | \
+    while IFS=$'\t ' read -r key address port; do
+    [ -n "${port}" ] || continue
+    proto_add_host_dependency "${config}" "${address}"
+  done
+
+  proto_send_update "${config}"
+}
+
+
+proto_wireguard_teardown() {
+  local config="$1"
+  ip link del dev "${config}" >/dev/null 2>&1
+}
+
+
+[ -n "$INCLUDE_ONLY" ] || {
+  add_protocol wireguard
+}

target/linux/ar71xx/image/tp-link.mk

@@ -944,6 +944,7 @@ endef
 define Device/tl-wa850re-v1
     $(Device/tplink-4mlzma)
     DEVICE_TITLE := TP-LINK TL-WA850RE
+    DEVICE_PACKAGES := rssileds
     BOARDNAME := TL-WA850RE
     DEVICE_PROFILE := TLWA850
     TPLINK_HWID := 0x08500001

target/linux/bcm53xx/patches-4.4/049-v4.14-0003-ARM-dts-BCM53573-Add-Broadcom-BCM947189ACDBMR-board-.patch

@@ -0,0 +1,135 @@
+From 092ccf0415c720a1e9458a46fe75f77574027a55 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Tue, 18 Jul 2017 12:37:37 -0700
+Subject: [PATCH] ARM: dts: BCM53573: Add Broadcom BCM947189ACDBMR board
+ support
+
+Adds support for the Broadcom reference board BCM947189ACDMBR which
+features the following:
+
+* 128MB of DRAM
+* External MoCA support through a Broadcom BCM6802 chip
+* 1x external Gigabit PHY through the external BCM6802
+* 1x USB 2.0 port
+* 1x PCIE slot
+* Few configurable buttons and LEDs
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/Makefile            |  3 +-
+ arch/arm/boot/dts/bcm947189acdbmr.dts | 97 +++++++++++++++++++++++++++++++++++
+ 2 files changed, 99 insertions(+), 1 deletion(-)
+ create mode 100644 arch/arm/boot/dts/bcm947189acdbmr.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -93,7 +93,8 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm953012hr.dtb \
+ 	bcm953012k.dtb
+ dtb-$(CONFIG_ARCH_BCM_53573) += \
+-	bcm47189-tenda-ac9.dtb
++	bcm47189-tenda-ac9.dtb \
++	bcm947189acdbmr.dtb
+ dtb-$(CONFIG_ARCH_BCM_63XX) += \
+ 	bcm963138dvt.dtb
+ dtb-$(CONFIG_ARCH_BCM_CYGNUS) += \
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm947189acdbmr.dts
+@@ -0,0 +1,97 @@
++/*
++ * Copyright (C) 2017 Broadcom
++ * Author: Florian Fainelli <f.fainelli@gmail.com>
++ *
++ * Licensed under the ISC license.
++ */
++
++/dts-v1/;
++
++#include "bcm53573.dtsi"
++
++/ {
++	compatible = "brcm,bcm947189acdbmr", "brcm,bcm47189", "brcm,bcm53573";
++	model = "Broadcom BCM947189ACDBMR";
++
++	chosen {
++		bootargs = "console=ttyS0,115200 earlycon";
++	};
++
++	memory {
++		reg = <0x00000000 0x08000000>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		wps {
++			label = "bcm53xx:blue:wps";
++			gpios = <&chipcommon 10 GPIO_ACTIVE_HIGH>;
++		};
++
++		5ghz {
++			label = "bcm53xx:blue:5ghz";
++			gpios = <&chipcommon 11 GPIO_ACTIVE_HIGH>;
++		};
++
++		2ghz {
++			label = "bcm53xx:blue:2ghz";
++			gpios = <&chipcommon 12 GPIO_ACTIVE_HIGH>;
++		};
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		restart {
++			label = "Reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&chipcommon 7 GPIO_ACTIVE_HIGH>;
++		};
++
++		wps {
++			label = "WPS";
++			linux,code = <KEY_WPS_BUTTON>;
++			gpios = <&chipcommon 9 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	spi {
++		compatible = "spi-gpio";
++		num-chipselects = <1>;
++		gpio-sck = <&chipcommon 21 0>;
++		gpio-miso = <&chipcommon 22 0>;
++		gpio-mosi = <&chipcommon 23 0>;
++		cs-gpios = <&chipcommon 24 0>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		/* External BCM6802 MoCA chip is connected */
++	};
++};
++
++&pcie0 {
++	ranges = <0x00000000 0 0 0 0 0x00100000>;
++	#address-cells = <3>;
++	#size-cells = <2>;
++
++	bridge@0,0,0 {
++		reg = <0x0000 0 0 0 0>;
++		ranges = <0x00000000 0 0 0 0 0 0 0x00100000>;
++		#address-cells = <3>;
++		#size-cells = <2>;
++
++		wifi@0,1,0 {
++			reg = <0x0000 0 0 0 0>;
++			ranges = <0x00000000 0 0 0 0x00100000>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++		};
++	};
++};
++
++&usb2 {
++	vcc-gpio = <&chipcommon 8 GPIO_ACTIVE_HIGH>;
++};

target/linux/bcm53xx/patches-4.4/049-v4.14-0004-ARM-BCM53573-Specify-ports-for-USB-LED-for-Tenda-AC9.patch

@@ -0,0 +1,58 @@
+From 0173b2cd6948b5b96ac4e8dbc3bcb4dd0b45c296 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 17 Aug 2017 11:05:14 +0200
+Subject: [PATCH] ARM: BCM53573: Specify ports for USB LED for Tenda AC9
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This uses trigger-sources documented in commit 80dc6e1cd85fc ("dt-bindings:
+leds: document new trigger-sources property") to specify USB ports. Such an
+information can be used by operating system to setup LEDs behavior.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm47189-tenda-ac9.dts | 2 ++
+ arch/arm/boot/dts/bcm53573.dtsi          | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+--- a/arch/arm/boot/dts/bcm47189-tenda-ac9.dts
++++ b/arch/arm/boot/dts/bcm47189-tenda-ac9.dts
+@@ -26,6 +26,8 @@
+ 		usb {
+ 			label = "bcm53xx:blue:usb";
+ 			gpios = <&chipcommon 1 GPIO_ACTIVE_HIGH>;
++			trigger-sources = <&ohci_port1>, <&ehci_port1>;
++			linux,default-trigger = "usbport";
+ 		};
+ 
+ 		wps {
+--- a/arch/arm/boot/dts/bcm53573.dtsi
++++ b/arch/arm/boot/dts/bcm53573.dtsi
+@@ -138,10 +138,12 @@
+ 
+ 				ehci_port1: port@1 {
+ 					reg = <1>;
++					#trigger-source-cells = <0>;
+ 				};
+ 
+ 				ehci_port2: port@2 {
+ 					reg = <2>;
++					#trigger-source-cells = <0>;
+ 				};
+ 			};
+ 
+@@ -158,10 +160,12 @@
+ 
+ 				ohci_port1: port@1 {
+ 					reg = <1>;
++					#trigger-source-cells = <0>;
+ 				};
+ 
+ 				ohci_port2: port@2 {
+ 					reg = <2>;
++					#trigger-source-cells = <0>;
+ 				};
+ 			};
+ 		};

target/linux/bcm53xx/patches-4.4/049-v4.15-0001-ARM-dts-BCM5301X-Specify-USB-ports-for-USB-LED-of-Lu.patch

@@ -0,0 +1,30 @@
+From 2460266f21f140936e627f28f28d1a4f30887ae9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Fri, 6 Oct 2017 10:52:35 +0200
+Subject: [PATCH] ARM: dts: BCM5301X: Specify USB ports for USB LED of Luxul
+ XWR-1200
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This info can be used by operating system to setup LED behavior.
+
+Reported-by: Dan Haab <dhaab@luxul.com>
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/bcm47081-luxul-xwr-1200.dts | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/bcm47081-luxul-xwr-1200.dts
++++ b/arch/arm/boot/dts/bcm47081-luxul-xwr-1200.dts
+@@ -57,7 +57,8 @@
+ 		usb {
+ 			label = "bcm53xx:green:usb";
+ 			gpios = <&chipcommon 8 GPIO_ACTIVE_LOW>;
+-			linux,default-trigger = "none";
++			trigger-sources = <&ohci_port2>, <&ehci_port2>;
++			linux,default-trigger = "usbport";
+ 		};
+ 
+ 		status {

target/linux/bcm53xx/patches-4.4/049-v4.15-0002-ARM-dts-BCM5301X-Add-DT-for-Luxul-XBR-4500.patch

@@ -0,0 +1,96 @@
+From 1f4b0d5596d2e3ea8e953d578ab8444ce860d35d Mon Sep 17 00:00:00 2001
+From: Dan Haab <dhaab@luxul.com>
+Date: Mon, 9 Oct 2017 09:46:22 -0600
+Subject: [PATCH] ARM: dts: BCM5301X: Add DT for Luxul XBR-4500
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is BCM47094 (AKA BCM4709C0) based router with ports-on-the-front
+board design.
+
+Signed-off-by: Dan Haab <dhaab@luxul.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/Makefile                    |  1 +
+ arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts | 63 +++++++++++++++++++++++++++
+ 2 files changed, 64 insertions(+)
+ create mode 100644 arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -85,6 +85,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm4709-tplink-archer-c9-v1.dtb \
+ 	bcm47094-dlink-dir-885l.dtb \
+ 	bcm47094-linksys-panamera.dtb \
++	bcm47094-luxul-xbr-4500.dtb \
+ 	bcm47094-luxul-xwr-3100.dtb \
+ 	bcm47094-netgear-r8500.dtb \
+ 	bcm94708.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts
+@@ -0,0 +1,63 @@
++/*
++ * Copyright (C) 2017 Luxul Inc.
++ *
++ * Licensed under the ISC license.
++ */
++
++/dts-v1/;
++
++#include "bcm4708.dtsi"
++#include "bcm5301x-nand-cs0-bch8.dtsi"
++
++/ {
++	compatible = "luxul,xbr-4500-v1", "brcm,bcm47094", "brcm,bcm4708";
++	model = "Luxul XBR-4500 V1";
++
++	chosen {
++		bootargs = "earlycon";
++	};
++
++	memory {
++		reg = <0x00000000 0x08000000
++		       0x88000000 0x18000000>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		status {
++			label = "bcm53xx:green:status";
++			gpios = <&chipcommon 20 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "timer";
++		};
++
++		usb3 {
++			label = "bcm53xx:green:usb3";
++			gpios = <&chipcommon 19 GPIO_ACTIVE_HIGH>;
++			trigger-sources = <&ohci_port1>, <&ehci_port1>,
++				<&xhci_port1>;
++			linux,default-trigger = "usbport";
++		};
++
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		restart {
++			label = "Reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&usb3 {
++	vcc-gpio = <&chipcommon 18 GPIO_ACTIVE_HIGH>;
++};
++
++&spi_nor {
++	status = "okay";
++};

target/linux/bcm53xx/patches-4.4/049-v4.15-0003-ARM-dts-BCM5301X-Add-DT-for-Luxul-ABR-4500.patch

@@ -0,0 +1,96 @@
+From 65f78c4c41a9b9a7637e1dda2d5e41cf26ea971c Mon Sep 17 00:00:00 2001
+From: Dan Haab <dhaab@luxul.com>
+Date: Mon, 9 Oct 2017 09:46:23 -0600
+Subject: [PATCH] ARM: dts: BCM5301X: Add DT for Luxul ABR-4500
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is BCM47094 (AKA BCM4709C0) based router with rear-facing ports
+board design.
+
+Signed-off-by: Dan Haab <dhaab@luxul.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/Makefile                    |  1 +
+ arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts | 63 +++++++++++++++++++++++++++
+ 2 files changed, 64 insertions(+)
+ create mode 100644 arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -85,6 +85,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm4709-tplink-archer-c9-v1.dtb \
+ 	bcm47094-dlink-dir-885l.dtb \
+ 	bcm47094-linksys-panamera.dtb \
++	bcm47094-luxul-abr-4500.dtb \
+ 	bcm47094-luxul-xbr-4500.dtb \
+ 	bcm47094-luxul-xwr-3100.dtb \
+ 	bcm47094-netgear-r8500.dtb \
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts
+@@ -0,0 +1,63 @@
++/*
++ * Copyright (C) 2017 Luxul Inc.
++ *
++ * Licensed under the ISC license.
++ */
++
++/dts-v1/;
++
++#include "bcm4708.dtsi"
++#include "bcm5301x-nand-cs0-bch8.dtsi"
++
++/ {
++	compatible = "luxul,abr-4500-v1", "brcm,bcm47094", "brcm,bcm4708";
++	model = "Luxul ABR-4500 V1";
++
++	chosen {
++		bootargs = "earlycon";
++	};
++
++	memory {
++		reg = <0x00000000 0x08000000
++		       0x88000000 0x18000000>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		status {
++			label = "bcm53xx:green:status";
++			gpios = <&chipcommon 20 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "timer";
++		};
++
++		usb3 {
++			label = "bcm53xx:green:usb3";
++			gpios = <&chipcommon 19 GPIO_ACTIVE_LOW>;
++			trigger-sources = <&ohci_port1>, <&ehci_port1>,
++				<&xhci_port1>;
++			linux,default-trigger = "usbport";
++		};
++
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		restart {
++			label = "Reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&chipcommon 17 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&usb3 {
++	vcc-gpio = <&chipcommon 18 GPIO_ACTIVE_HIGH>;
++};
++
++&spi_nor {
++	status = "okay";
++};

target/linux/bcm53xx/patches-4.4/049-v4.15-0004-ARM-dts-BCM53573-Add-DT-for-Luxul-XAP-810.patch

@@ -0,0 +1,120 @@
+From 0aa052ce1c3340850a7e5980b6d24b3ea5779591 Mon Sep 17 00:00:00 2001
+From: Dan Haab <dhaab@luxul.com>
+Date: Mon, 9 Oct 2017 09:46:59 -0600
+Subject: [PATCH] ARM: dts: BCM53573: Add DT for Luxul XAP-810
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is BCM53573 WiSoC based access point with an extra BCM43217 chipset
+used for 2.4 GHz.
+
+Signed-off-by: Dan Haab <dhaab@luxul.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/Makefile                   |  1 +
+ arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 87 ++++++++++++++++++++++++++++
+ 2 files changed, 88 insertions(+)
+ create mode 100644 arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -95,6 +95,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm953012hr.dtb \
+ 	bcm953012k.dtb
+ dtb-$(CONFIG_ARCH_BCM_53573) += \
++	bcm47189-luxul-xap-810.dtb \
+ 	bcm47189-tenda-ac9.dtb \
+ 	bcm947189acdbmr.dtb
+ dtb-$(CONFIG_ARCH_BCM_63XX) += \
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
+@@ -0,0 +1,87 @@
++/*
++ * Copyright 2017 Luxul Inc.
++ *
++ * Licensed under the ISC license.
++ */
++
++/dts-v1/;
++
++#include "bcm53573.dtsi"
++
++/ {
++	compatible = "luxul,xap-810-v1", "brcm,bcm47189", "brcm,bcm53573";
++	model = "Luxul XAP-810 V1";
++
++	chosen {
++		bootargs = "earlycon";
++	};
++
++	memory {
++		reg = <0x00000000 0x08000000>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		5ghz {
++			label = "bcm53xx:blue:5ghz";
++			gpios = <&chipcommon 11 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "default-off";
++		};
++
++		system {
++			label = "bcm53xx:green:system";
++			gpios = <&chipcommon 15 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "timer";
++		};
++	};
++
++	pcie0_leds {
++		compatible = "gpio-leds";
++
++		2ghz {
++			label = "bcm53xx:blue:2ghz";
++			gpios = <&pcie0_chipcommon 3 GPIO_ACTIVE_HIGH>;
++			linux,default-trigger = "default-off";
++		};
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		restart {
++			label = "Reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&pcie0 {
++	ranges = <0x00000000 0 0 0 0 0x00100000>;
++	#address-cells = <3>;
++	#size-cells = <2>;
++
++	bridge@0,0,0 {
++		reg = <0x0000 0 0 0 0>;
++		ranges = <0x00000000 0 0 0 0 0 0 0x00100000>;
++		#address-cells = <3>;
++		#size-cells = <2>;
++
++		wifi@0,1,0 {
++			reg = <0x0000 0 0 0 0>;
++			ranges = <0x00000000 0 0 0 0x00100000>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			pcie0_chipcommon: chipcommon@0 {
++				reg = <0 0x1000>;
++
++				gpio-controller;
++				#gpio-cells = <2>;
++			};
++		};
++	};
++};

target/linux/bcm53xx/patches-4.4/049-v4.15-0005-ARM-dts-BCM53573-Add-DT-for-Luxul-XAP-1440.patch

@@ -0,0 +1,83 @@
+From 7030ea600d560026b91726f2eb79c856b813afa9 Mon Sep 17 00:00:00 2001
+From: Dan Haab <dhaab@luxul.com>
+Date: Mon, 9 Oct 2017 09:47:00 -0600
+Subject: [PATCH] ARM: dts: BCM53573: Add DT for Luxul XAP-1440
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This is BCM53573 WiSoC based outdoor access point with an extra BCM43217
+chipset used for 2.4 GHz.
+
+Signed-off-by: Dan Haab <dhaab@luxul.com>
+Acked-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+---
+ arch/arm/boot/dts/Makefile                    |  1 +
+ arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 50 +++++++++++++++++++++++++++
+ 2 files changed, 51 insertions(+)
+ create mode 100644 arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
+
+--- a/arch/arm/boot/dts/Makefile
++++ b/arch/arm/boot/dts/Makefile
+@@ -95,6 +95,7 @@ dtb-$(CONFIG_ARCH_BCM_5301X) += \
+ 	bcm953012hr.dtb \
+ 	bcm953012k.dtb
+ dtb-$(CONFIG_ARCH_BCM_53573) += \
++	bcm47189-luxul-xap-1440.dtb \
+ 	bcm47189-luxul-xap-810.dtb \
+ 	bcm47189-tenda-ac9.dtb \
+ 	bcm947189acdbmr.dtb
+--- /dev/null
++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
+@@ -0,0 +1,50 @@
++/*
++ * Copyright 2017 Luxul Inc.
++ *
++ * Licensed under the ISC license.
++ */
++
++/dts-v1/;
++
++#include "bcm53573.dtsi"
++
++/ {
++	compatible = "luxul,xap-1440-v1", "brcm,bcm47189", "brcm,bcm53573";
++	model = "Luxul XAP-1440 V1";
++
++	chosen {
++		bootargs = "earlycon";
++	};
++
++	memory {
++		reg = <0x00000000 0x08000000>;
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		wlan {
++			label = "bcm53xx:blue:wlan";
++			gpios = <&chipcommon 10 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "default-off";
++		};
++
++		system {
++			label = "bcm53xx:green:system";
++			gpios = <&chipcommon 11 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "timer";
++		};
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		restart {
++			label = "Reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&chipcommon 7 GPIO_ACTIVE_LOW>;
++		};
++	};
++};

target/linux/bcm53xx/patches-4.4/320-ARM-dts-BCM5301X-Add-serial-to-the-bootargs.patch

@@ -23,4 +23,48 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 +		bootargs = "console=ttyS0,115200 earlycon";
  	};
  
+ 	memory {
+--- a/arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts
++++ b/arch/arm/boot/dts/bcm47094-luxul-abr-4500.dts
+@@ -14,7 +14,7 @@
+ 	model = "Luxul ABR-4500 V1";
+ 
+ 	chosen {
+-		bootargs = "earlycon";
++		bootargs = "console=ttyS0,115200 earlycon";
+ 	};
+ 
+ 	memory {
+--- a/arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts
++++ b/arch/arm/boot/dts/bcm47094-luxul-xbr-4500.dts
+@@ -14,7 +14,7 @@
+ 	model = "Luxul XBR-4500 V1";
+ 
+ 	chosen {
+-		bootargs = "earlycon";
++		bootargs = "console=ttyS0,115200 earlycon";
+ 	};
+ 
+ 	memory {
+--- a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
+@@ -13,7 +13,7 @@
+ 	model = "Luxul XAP-1440 V1";
+ 
+ 	chosen {
+-		bootargs = "earlycon";
++		bootargs = "console=ttyS0,115200 earlycon";
+ 	};
+ 
+ 	memory {
+--- a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
++++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
+@@ -13,7 +13,7 @@
+ 	model = "Luxul XAP-810 V1";
+ 
+ 	chosen {
+-		bootargs = "earlycon";
++		bootargs = "console=ttyS0,115200 earlycon";
+ 	};
+ 
  	memory {

target/linux/brcm2708/patches-4.4/0527-Support-for-Blokas-Labs-pisound-board.patch

@@ -19,8 +19,8 @@ Subject: [PATCH] Support for Blokas Labs pisound board
 
 --- a/Documentation/devicetree/bindings/vendor-prefixes.txt
 +++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
-@@ -33,6 +33,7 @@ auo	AU Optronics Corporation
- avago	Avago Technologies
+@@ -34,6 +34,7 @@ avago	Avago Technologies
+ avia	avia semiconductor
  avic	Shanghai AVIC Optoelectronics Co., Ltd.
  axis	Axis Communications AB
 +blokaslabs	Vilniaus Blokas UAB

target/linux/cns3xxx/patches-4.4/200-broadcom_phy_reinit.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/phy/broadcom.c
 +++ b/drivers/net/phy/broadcom.c
-@@ -414,6 +414,11 @@ static int bcm5481_config_aneg(struct ph
+@@ -420,6 +420,11 @@ static int bcm5481_config_aneg(struct ph
  		/* Write bits 14:0. */
  		reg |= (1 << 15);
  		phy_write(phydev, 0x18, reg);

target/linux/generic/patches-4.4/073-v4.15-0001-net-bgmac-enable-master-mode-for-BCM54210E-and-B5021.patch

@@ -0,0 +1,50 @@
+From 12acd136913ccdf394eeb2bc8686ff5505368119 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 12 Oct 2017 10:21:26 +0200
+Subject: [PATCH] net: bgmac: enable master mode for BCM54210E and B50212E PHYs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+There are 4 very similar PHYs:
+0x600d84a1: BCM54210E (rev B0)
+0x600d84a2: BCM54210E (rev B1)
+0x600d84a5: B50212E (rev B0)
+0x600d84a6: B50212E (rev B1)
+that need setting master mode manually. It's because they run in slave
+mode by default with Automatic Slave/Master configuration disabled which
+can lead to unreliable connection with massive ping loss.
+
+So far it was reported for a board with BCM47189 SoC and B50212E B1 PHY
+connected to the bgmac supported ethernet device. Telling PHY driver to
+setup PHY properly solves this issue.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/broadcom/bgmac-bcma.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
++++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
+@@ -159,13 +159,19 @@ static int bgmac_probe(struct bcma_devic
+ 
+ 	if (!bgmac_is_bcm4707_family(core) &&
+ 	    !(ci->id == BCMA_CHIP_ID_BCM53573 && core->core_unit == 1)) {
++		struct phy_device *phydev;
++
+ 		mii_bus = bcma_mdio_mii_register(bgmac);
+ 		if (IS_ERR(mii_bus)) {
+ 			err = PTR_ERR(mii_bus);
+ 			goto err;
+ 		}
+-
+ 		bgmac->mii_bus = mii_bus;
++
++		phydev = bgmac->mii_bus->phy_map[bgmac->phyaddr];
++		if (ci->id == BCMA_CHIP_ID_BCM53573 && phydev &&
++		    (phydev->drv->phy_id & phydev->drv->phy_id_mask) == PHY_ID_BCM54210E)
++			phydev->dev_flags |= PHY_BRCM_EN_MASTER_MODE;
+ 	}
+ 
+ 	if (core->bus->hosttype == BCMA_HOSTTYPE_PCI) {

target/linux/generic/patches-4.4/078-0003-net-phy-cherry-pick-Broadcom-drivers-updates-from-v4.patch

@@ -1,6 +1,5 @@
 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Subject: [PATCH 1/2] net: phy: cherry-pick Broadcom drivers updates from
- v4.10-rc1
+Subject: [PATCH] net: phy: cherry-pick Broadcom drivers updates from v4.10
 
 Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
 ---

target/linux/generic/patches-4.4/078-0004-net-phy-cherry-pick-Broadcom-drivers-updates-from-v4.patch

@@ -1,3 +1,12 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Subject: [PATCH] net: phy: cherry-pick Broadcom drivers updates from v4.11
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
 --- a/drivers/net/phy/broadcom.c
 +++ b/drivers/net/phy/broadcom.c
 @@ -30,6 +30,50 @@ MODULE_DESCRIPTION("Broadcom PHY driver"

target/linux/generic/patches-4.4/078-0006-net-phy-cherry-pick-Broadcom-drivers-updates-from-v4.patch

@@ -0,0 +1,37 @@
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Subject: [PATCH] net: phy: cherry-pick Broadcom drivers updates from v4.15
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This includes following upstream commits:
+2355a6546a05 net: phy: broadcom: support new device flag for setting master mode
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+---
+
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -43,6 +43,12 @@ static int bcm54210e_config_init(struct
+ 	val &= ~BCM54810_SHD_CLK_CTL_GTXCLK_EN;
+ 	bcm_phy_write_shadow(phydev, BCM54810_SHD_CLK_CTL, val);
+ 
++	if (phydev->dev_flags & PHY_BRCM_EN_MASTER_MODE) {
++		val = phy_read(phydev, MII_CTRL1000);
++		val |= CTL1000_AS_MASTER | CTL1000_ENABLE_MASTER;
++		phy_write(phydev, MII_CTRL1000, val);
++	}
++
+ 	return 0;
+ }
+ 
+--- a/include/linux/brcmphy.h
++++ b/include/linux/brcmphy.h
+@@ -55,6 +55,7 @@
+ #define PHY_BRCM_EXT_IBND_TX_ENABLE	0x00002000
+ #define PHY_BRCM_CLEAR_RGMII_MODE	0x00004000
+ #define PHY_BRCM_DIS_TXCRXC_NOENRGY	0x00008000
++#define PHY_BRCM_EN_MASTER_MODE		0x00010000
+ 
+ /* Broadcom BCM7xxx specific workarounds */
+ #define PHY_BRCM_7XXX_REV(x)		(((x) >> 8) & 0xff)

target/linux/generic/patches-4.4/680-NET-skip-GRO-for-foreign-MAC-addresses.patch

@@ -17,7 +17,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -4256,6 +4256,9 @@ static enum gro_result dev_gro_receive(s
+@@ -4259,6 +4259,9 @@ static enum gro_result dev_gro_receive(s
  	enum gro_result ret;
  	int grow;
  
@@ -27,7 +27,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!(skb->dev->features & NETIF_F_GRO))
  		goto normal;
  
-@@ -5422,6 +5425,48 @@ static void __netdev_adjacent_dev_unlink
+@@ -5425,6 +5428,48 @@ static void __netdev_adjacent_dev_unlink
  					   &upper_dev->adj_list.lower);
  }
  
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int __netdev_upper_dev_link(struct net_device *dev,
  				   struct net_device *upper_dev, bool master,
  				   void *private)
-@@ -5493,6 +5538,7 @@ static int __netdev_upper_dev_link(struc
+@@ -5496,6 +5541,7 @@ static int __netdev_upper_dev_link(struc
  			goto rollback_lower_mesh;
  	}
  
@@ -84,7 +84,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
  				      &changeupper_info.info);
  	return 0;
-@@ -5619,6 +5665,7 @@ void netdev_upper_dev_unlink(struct net_
+@@ -5622,6 +5668,7 @@ void netdev_upper_dev_unlink(struct net_
  	list_for_each_entry(i, &upper_dev->all_adj_list.upper, list)
  		__netdev_adjacent_dev_unlink(dev, i->dev, i->ref_nr);
  
@@ -92,7 +92,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	call_netdevice_notifiers_info(NETDEV_CHANGEUPPER, dev,
  				      &changeupper_info.info);
  }
-@@ -6159,6 +6206,7 @@ int dev_set_mac_address(struct net_devic
+@@ -6162,6 +6209,7 @@ int dev_set_mac_address(struct net_devic
  	if (err)
  		return err;
  	dev->addr_assign_type = NET_ADDR_SET;

target/linux/generic/patches-4.4/721-phy_packets.patch

@@ -86,7 +86,7 @@
  	help
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -2743,10 +2743,20 @@ static int xmit_one(struct sk_buff *skb,
+@@ -2746,10 +2746,20 @@ static int xmit_one(struct sk_buff *skb,
  	if (!list_empty(&ptype_all) || !list_empty(&dev->ptype_all))
  		dev_queue_xmit_nit(skb, dev);
  

target/linux/generic/patches-4.4/773-bgmac-add-srab-switch.patch

@@ -78,7 +78,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  struct bgmac *bgmac_alloc(struct device *dev);
 --- a/drivers/net/ethernet/broadcom/bgmac-bcma.c
 +++ b/drivers/net/ethernet/broadcom/bgmac-bcma.c
-@@ -230,6 +230,7 @@ static int bgmac_probe(struct bcma_devic
+@@ -236,6 +236,7 @@ static int bgmac_probe(struct bcma_devic
  		bgmac->feature_flags |= BGMAC_FEAT_CLKCTLST;
  		bgmac->feature_flags |= BGMAC_FEAT_NO_RESET;
  		bgmac->feature_flags |= BGMAC_FEAT_FORCE_SPEED_2500;

target/linux/oxnas/patches-4.4/250-add-plxtech-vendor-prefix.patch

@@ -1,6 +1,6 @@
 --- a/Documentation/devicetree/bindings/vendor-prefixes.txt
 +++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
-@@ -174,6 +174,7 @@ picochip	Picochip Ltd
+@@ -175,6 +175,7 @@ picochip	Picochip Ltd
  plathome	Plat'Home Co., Ltd.
  plda	PLDA
  pixcir  PIXCIR MICROELECTRONICS Co., Ltd

target/linux/ramips/dts/ArcherC20i.dts

@@ -147,7 +147,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&radio 32768>;
-			mediatek,2ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/ArcherC50.dts

@@ -181,7 +181,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&radio 32768>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 			mtd-mac-address = <&rom 0xf100>;
 			mtd-mac-address-increment = <(-1)>;
 		};

target/linux/ramips/dts/ArcherMR200.dts

@@ -188,7 +188,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&radio 32768>;
-			mediatek,2ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/DIR-860L-B1.dts

@@ -116,7 +116,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&radio 0x2000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -125,7 +125,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&radio 0>;
-			mediatek,5ghz = <0>;
+			ieee80211-freq-limit = <2400000 2500000>;
 		};
 	};
 };

target/linux/ramips/dts/FIREWRT.dts

@@ -93,7 +93,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -102,7 +102,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
+			ieee80211-freq-limit = <2400000 2500000>;
 		};
 	};
 };

target/linux/ramips/dts/GL-MT750.dts

@@ -143,7 +143,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/MAC1200RV2.dts

@@ -87,7 +87,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&art 0x1000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 };

target/linux/ramips/dts/MIWIFI-MINI.dts

@@ -134,7 +134,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 };

target/linux/ramips/dts/MZK-750DHP.dts

@@ -122,7 +122,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/MZK-EX750NP.dts

@@ -143,7 +143,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/Newifi-D1.dts

@@ -117,7 +117,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -126,7 +126,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/PBR-M1.dts

@@ -149,7 +149,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -158,7 +158,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/PSG1208.dts

@@ -103,7 +103,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 };

target/linux/ramips/dts/PSG1218.dts

@@ -109,7 +109,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 };

target/linux/ramips/dts/RE6500.dts

@@ -103,7 +103,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -112,7 +112,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,5ghz = <0>;
+			ieee80211-freq-limit = <2400000 2500000>;
 		};
 	};
 };

target/linux/ramips/dts/SAP-G3200U3.dts

@@ -95,7 +95,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -104,7 +104,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
+			ieee80211-freq-limit = <2400000 2500000>;
 		};
 	};
 };

target/linux/ramips/dts/SK-WB8.dts

@@ -92,7 +92,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -101,7 +101,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/W2914NSV2.dtsi

@@ -72,20 +72,19 @@
 	status = "okay";
 
 	pcie0 {
-		wifi@14c3,7662 {
-			compatible = "pci14c3,7662";
+		wifi@14c3,7603 {
+			compatible = "pci14c3,7603";
 			reg = <0x0000 0 0 0 0>;
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
 		};
 	};
 
 	pcie1 {
-		wifi@14c3,7603 {
-			compatible = "pci14c3,7603";
+		wifi@14c3,7662 {
+			compatible = "pci14c3,7662";
 			reg = <0x0000 0 0 0 0>;
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 };

target/linux/ramips/dts/WF-2881.dts

@@ -85,7 +85,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -94,7 +94,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
+			ieee80211-freq-limit = <2400000 2500000>;
 		};
 	};
 };

target/linux/ramips/dts/WHR-1166D.dts

@@ -165,7 +165,7 @@
 			compatible = "pci0,0";
 			reg = <0x0000 0 0 0 0>;
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 };

target/linux/ramips/dts/WITI.dts

@@ -89,7 +89,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 			mtd-mac-address = <&factory 0xe000>;
 		};
 	};
@@ -99,7 +99,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
+			ieee80211-freq-limit = <2400000 2500000>;
 			mtd-mac-address = <&factory 0xe000>;
 		};
 	};

target/linux/ramips/dts/WL-WN575A3.dts

@@ -77,7 +77,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 };

target/linux/ramips/dts/WNDR3700V5.dts

@@ -111,7 +111,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -120,7 +120,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/WSR-1166.dts

@@ -170,7 +170,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -179,7 +179,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/WSR-600.dts

@@ -173,7 +173,6 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
 		};
 	};
 };

target/linux/ramips/dts/Y1.dtsi

@@ -84,7 +84,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 };

target/linux/ramips/dts/ZBT-APE522II.dts

@@ -124,7 +124,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 };

target/linux/ramips/dts/ZBT-WG2626.dts

@@ -93,7 +93,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 
@@ -102,7 +102,7 @@
 			reg = <0x0000 0 0 0 0>;
 			device_type = "pci";
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
+			ieee80211-freq-limit = <2400000 2500000>;
 		};
 	};
 };

target/linux/ramips/dts/ZBT-WG3526.dtsi

@@ -88,7 +88,6 @@
 			compatible = "pci14c3,7603";
 			reg = <0x0000 0 0 0 0>;
 			mediatek,mtd-eeprom = <&factory 0x0000>;
-			mediatek,5ghz = <0>;
 		};
 	};
 
@@ -97,7 +96,7 @@
 			compatible = "pci14c3,7662";
 			reg = <0x0000 0 0 0 0>;
 			mediatek,mtd-eeprom = <&factory 0x8000>;
-			mediatek,2ghz = <0>;
+			ieee80211-freq-limit = <5000000 6000000>;
 		};
 	};
 };

target/linux/ramips/dts/mt7628an.dtsi

@@ -474,6 +474,5 @@
 		status = "disabled";
 
 		mediatek,mtd-eeprom = <&factory 0x0000>;
-		mediatek,5ghz = <0>;
 	};
 };

target/linux/ramips/image/mt7620.mk

@@ -38,7 +38,7 @@ define Device/ArcherC20i
   KERNEL := $(KERNEL_DTB)
   KERNEL_INITRAMFS := $(KERNEL_DTB) | tplink-header ArcherC20i -c
   IMAGE/factory.bin := append-kernel | tplink-header ArcherC20i -j
-  IMAGE/sysupgrade.bin := append-kernel | tplink-header ArcherC20i -j | append-metadata
+  IMAGE/sysupgrade.bin := append-kernel | tplink-header ArcherC20i -j -s | append-metadata
   IMAGES += factory.bin
   DEVICE_TITLE := TP-Link ArcherC20i
 endef
@@ -50,7 +50,7 @@ define Device/ArcherC50
   KERNEL := $(KERNEL_DTB)
   KERNEL_INITRAMFS := $(KERNEL_DTB) | tplink-header ArcherC50 -c
   IMAGE/factory.bin := append-kernel | tplink-header ArcherC50 -j
-  IMAGE/sysupgrade.bin := append-kernel | tplink-header ArcherC50 -j | append-metadata
+  IMAGE/sysupgrade.bin := append-kernel | tplink-header ArcherC50 -j -s | append-metadata
   IMAGES += factory.bin
   DEVICE_TITLE := TP-Link ArcherC50
 endef
@@ -61,7 +61,7 @@ define Device/ArcherMR200
   SUPPORTED_DEVICES := mr200
   KERNEL := $(KERNEL_DTB)
   KERNEL_INITRAMFS := $(KERNEL_DTB) | tplink-header ArcherMR200 -c
-  IMAGE/sysupgrade.bin := append-kernel | tplink-header ArcherMR200 -j | append-metadata
+  IMAGE/sysupgrade.bin := append-kernel | tplink-header ArcherMR200 -j -s | append-metadata
   DEVICE_PACKAGES := kmod-usb2 kmod-usb-net kmod-usb-net-rndis kmod-usb-serial kmod-usb-serial-option adb
   DEVICE_TITLE := TP-Link ArcherMR200
 endef

target/linux/ramips/patches-4.4/0039-mtd-add-mt7621-nand-support.patch

@@ -2667,7 +2667,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +}
 +
 +static int
-+mtk_nand_write_page_hwecc(struct mtd_info *mtd, struct nand_chip *chip, const uint8_t * buf, int oob_required)
++mtk_nand_write_page_hwecc(struct mtd_info *mtd, struct nand_chip *chip, const uint8_t * buf, int oob_required, int page)
 +{
 +	mtk_nand_write_buf(mtd, buf, mtd->writesize);
 +	mtk_nand_write_buf(mtd, chip->oob_poi, mtd->oobsize);
@@ -3344,7 +3344,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +	data |= ((0x2<<18) |(0x2<<16));
 +	DRV_WriteReg32(RALINK_SYSCTL_BASE+0x60, data);
 +
-+	hw = &mt7621_nand_hw,
++	hw = &mt7621_nand_hw;
 +	BUG_ON(!hw);
 +	/* Allocate memory for the device structure (and zero it) */
 +	host = kzalloc(sizeof(struct mtk_nand_host), GFP_KERNEL);

target/linux/x86/64/config-default

@@ -5,7 +5,7 @@ CONFIG_ACPI_BATTERY=y
 # CONFIG_ACPI_BGRT is not set
 CONFIG_ACPI_BUTTON=y
 # CONFIG_ACPI_CMPC is not set
-# CONFIG_ACPI_CONTAINER is not set
+CONFIG_ACPI_CONTAINER=y
 CONFIG_ACPI_CPU_FREQ_PSS=y
 # CONFIG_ACPI_CUSTOM_DSDT is not set
 # CONFIG_ACPI_DEBUG is not set
@@ -13,6 +13,7 @@ CONFIG_ACPI_CPU_FREQ_PSS=y
 # CONFIG_ACPI_DOCK is not set
 # CONFIG_ACPI_EC_DEBUGFS is not set
 CONFIG_ACPI_FAN=y
+CONFIG_ACPI_HOTPLUG_CPU=y
 CONFIG_ACPI_HOTPLUG_IOAPIC=y
 # CONFIG_ACPI_INITRD_TABLE_OVERRIDE is not set
 CONFIG_ACPI_LEGACY_TABLES_LOOKUP=y
@@ -30,7 +31,6 @@ CONFIG_ACPI_THERMAL=y
 # CONFIG_ACPI_WMI is not set
 CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig"
 CONFIG_ARCH_DMA_ADDR_T_64BIT=y
-CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y
 CONFIG_ARCH_HAS_PMEM_API=y
 CONFIG_ARCH_HWEIGHT_CFLAGS="-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11"
@@ -47,13 +47,17 @@ CONFIG_BACKLIGHT_CLASS_DEVICE=y
 CONFIG_BACKLIGHT_GENERIC=y
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 CONFIG_BLK_DEV_INTEGRITY=y
+# CONFIG_BOOTPARAM_HOTPLUG_CPU0 is not set
 CONFIG_CALGARY_IOMMU=y
 CONFIG_CALGARY_IOMMU_ENABLED_BY_DEFAULT=y
 CONFIG_CONNECTOR=y
 CONFIG_CPU_RMAP=y
 CONFIG_CRC_T10DIF=y
-CONFIG_CRYPTO_AES_X86_64=y
+CONFIG_CRYPTO_ABLK_HELPER=y
+CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_AES_NI_INTEL=y
+CONFIG_CRYPTO_AES_X86_64=y
 # CONFIG_CRYPTO_BLOWFISH_X86_64 is not set
 # CONFIG_CRYPTO_CAMELLIA_AESNI_AVX2_X86_64 is not set
 # CONFIG_CRYPTO_CAMELLIA_AESNI_AVX_X86_64 is not set
@@ -63,7 +67,14 @@ CONFIG_CRYPTO_AES_NI_INTEL=y
 # CONFIG_CRYPTO_CHACHA20_X86_64 is not set
 CONFIG_CRYPTO_CRCT10DIF=y
 # CONFIG_CRYPTO_CRCT10DIF_PCLMUL is not set
+CONFIG_CRYPTO_CRYPTD=y
 # CONFIG_CRYPTO_DES3_EDE_X86_64 is not set
+CONFIG_CRYPTO_GF128MUL=y
+CONFIG_CRYPTO_GLUE_HELPER_X86=y
+CONFIG_CRYPTO_LRW=y
+CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
+CONFIG_CRYPTO_NULL2=y
 # CONFIG_CRYPTO_POLY1305_X86_64 is not set
 # CONFIG_CRYPTO_SALSA20_X86_64 is not set
 # CONFIG_CRYPTO_SERPENT_AVX2_X86_64 is not set
@@ -77,6 +88,8 @@ CONFIG_CRYPTO_CRCT10DIF=y
 # CONFIG_CRYPTO_TWOFISH_AVX_X86_64 is not set
 # CONFIG_CRYPTO_TWOFISH_X86_64 is not set
 # CONFIG_CRYPTO_TWOFISH_X86_64_3WAY is not set
+CONFIG_CRYPTO_XTS=y
+# CONFIG_DEBUG_HOTPLUG_CPU0 is not set
 # CONFIG_EARLY_PRINTK_EFI is not set
 CONFIG_EFI=y
 CONFIG_EFIVAR_FS=m
@@ -93,9 +106,14 @@ CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_IMAGEBLIT=y
 CONFIG_FB_CMDLINE=y
+CONFIG_FB_DEFERRED_IO=y
 # CONFIG_FB_EFI is not set
 CONFIG_FB_HYPERV=y
 CONFIG_FB_MODE_HELPERS=y
+CONFIG_FB_SYS_COPYAREA=y
+CONFIG_FB_SYS_FILLRECT=y
+CONFIG_FB_SYS_FOPS=y
+CONFIG_FB_SYS_IMAGEBLIT=y
 CONFIG_FB_TILEBLITTING=y
 # CONFIG_FB_VESA is not set
 # CONFIG_FONTS is not set
@@ -105,13 +123,16 @@ CONFIG_FONT_SUPPORT=y
 CONFIG_FRAMEBUFFER_CONSOLE=y
 # CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set
 # CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set
+CONFIG_FREEZER=y
 CONFIG_GART_IOMMU=y
 CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
 CONFIG_GENERIC_CPU=y
 CONFIG_GENERIC_PENDING_IRQ=y
 CONFIG_GPIOLIB=y
 # CONFIG_GPIO_104_IDIO_16 is not set
+CONFIG_GPIO_ACPI=y
 # CONFIG_GPIO_AMDPT is not set
+CONFIG_GPIO_DEVRES=y
 # CONFIG_GPIO_F7188X is not set
 # CONFIG_GPIO_INTEL_MID is not set
 # CONFIG_GPIO_IT87 is not set
@@ -130,10 +151,12 @@ CONFIG_HAVE_IRQ_EXIT_ON_IRQ_STACK=y
 CONFIG_HAVE_LIVEPATCH=y
 CONFIG_HAVE_MEMORY_PRESENT=y
 CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y
+CONFIG_HIBERNATE_CALLBACKS=y
 CONFIG_HID=y
 CONFIG_HID_BATTERY_STRENGTH=y
 CONFIG_HID_GENERIC=y
 CONFIG_HID_HYPERV_MOUSE=y
+CONFIG_HOTPLUG_CPU=y
 CONFIG_HOTPLUG_PCI=y
 CONFIG_HOTPLUG_PCI_ACPI=y
 # CONFIG_HOTPLUG_PCI_ACPI_IBM is not set
@@ -144,6 +167,9 @@ CONFIG_HPET=y
 CONFIG_HPET_MMAP=y
 # CONFIG_HP_ACCEL is not set
 CONFIG_HVC_DRIVER=y
+CONFIG_HVC_IRQ=y
+CONFIG_HVC_XEN=y
+CONFIG_HVC_XEN_FRONTEND=y
 CONFIG_HW_RANDOM_AMD=y
 CONFIG_HW_RANDOM_INTEL=y
 CONFIG_HW_RANDOM_VIRTIO=y
@@ -157,6 +183,7 @@ CONFIG_HYPERV_UTILS=y
 # CONFIG_I7300_IDLE is not set
 # CONFIG_IA32_EMULATION is not set
 CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
+CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y
 # CONFIG_INTEL_IPS is not set
 # CONFIG_INTEL_MENLOW is not set
 # CONFIG_INTEL_MIC_BUS is not set
@@ -189,6 +216,7 @@ CONFIG_MMC_SDHCI_PCI=y
 # CONFIG_MMC_SDHCI_PLTFM is not set
 # CONFIG_MMC_TIFM_SD is not set
 # CONFIG_MMC_WBSD is not set
+CONFIG_MMU_NOTIFIER=y
 CONFIG_MODULES_USE_ELF_RELA=y
 # CONFIG_MPSC is not set
 CONFIG_MUTEX_SPIN_ON_OWNER=y
@@ -197,6 +225,7 @@ CONFIG_NET_FLOW_LIMIT=y
 CONFIG_NR_CPUS=8
 # CONFIG_NUMA is not set
 CONFIG_OUTPUT_FORMAT="elf64-x86-64"
+CONFIG_PADATA=y
 CONFIG_PARAVIRT=y
 CONFIG_PARAVIRT_CLOCK=y
 # CONFIG_PARAVIRT_DEBUG is not set
@@ -204,19 +233,24 @@ CONFIG_PARAVIRT_SPINLOCKS=y
 # CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
 CONFIG_PATA_AMD=y
 CONFIG_PATA_ATIIXP=y
-CONFIG_PATA_LEGACY=y
 CONFIG_PATA_MPIIX=y
 CONFIG_PATA_OLDPIIX=y
 CONFIG_PATA_PLATFORM=y
 CONFIG_PATA_VIA=y
 CONFIG_PCIEAER=y
 CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_PME=y
 CONFIG_PCI_BUS_ADDR_T_64BIT=y
 # CONFIG_PCI_MMCONFIG is not set
+CONFIG_PCI_XEN=y
 CONFIG_PGTABLE_LEVELS=4
 CONFIG_PHYSICAL_ALIGN=0x1000000
 CONFIG_PHYS_ADDR_T_64BIT=y
+CONFIG_PM=y
 # CONFIG_PMIC_OPREGION is not set
+# CONFIG_PM_DEBUG is not set
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
 CONFIG_PNP=y
 CONFIG_PNPACPI=y
 CONFIG_PNP_DEBUG_MESSAGES=y
@@ -247,6 +281,8 @@ CONFIG_SPARSEMEM_MANUAL=y
 CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
 # CONFIG_SURFACE_PRO3_BUTTON is not set
 CONFIG_SWIOTLB=y
+CONFIG_SWIOTLB_XEN=y
+CONFIG_SYS_HYPERVISOR=y
 # CONFIG_THUNDER_NIC_BGX is not set
 # CONFIG_THUNDER_NIC_PF is not set
 # CONFIG_THUNDER_NIC_VF is not set
@@ -285,6 +321,7 @@ CONFIG_VMWARE_VMCI=y
 CONFIG_VMWARE_VMCI_VSOCKETS=y
 CONFIG_VMXNET3=y
 CONFIG_VSOCKETS=y
+CONFIG_VT_CONSOLE_SLEEP=y
 CONFIG_WATCHDOG_CORE=y
 CONFIG_X86_64=y
 CONFIG_X86_64_SMP=y
@@ -308,5 +345,37 @@ CONFIG_X86_TSC=y
 # CONFIG_X86_VSYSCALL_EMULATION is not set
 CONFIG_X86_X2APIC=y
 # CONFIG_X86_X32 is not set
+CONFIG_XEN=y
+CONFIG_XENFS=y
+CONFIG_XEN_512GB=y
+CONFIG_XEN_ACPI=y
+CONFIG_XEN_ACPI_PROCESSOR=y
+CONFIG_XEN_AUTO_XLATE=y
+# CONFIG_XEN_BACKEND is not set
+CONFIG_XEN_BALLOON=y
+CONFIG_XEN_BLKDEV_FRONTEND=y
+CONFIG_XEN_COMPAT_XENFS=y
+CONFIG_XEN_DEBUG_FS=y
+CONFIG_XEN_DEV_EVTCHN=y
+CONFIG_XEN_DOM0=y
+CONFIG_XEN_EFI=y
+CONFIG_XEN_FBDEV_FRONTEND=y
+CONFIG_XEN_GNTDEV=y
+CONFIG_XEN_GRANT_DEV_ALLOC=y
+CONFIG_XEN_HAVE_PVMMU=y
+CONFIG_XEN_HAVE_VPMU=y
+# CONFIG_XEN_MCE_LOG is not set
+CONFIG_XEN_NETDEV_FRONTEND=y
+CONFIG_XEN_PCIDEV_FRONTEND=y
+CONFIG_XEN_PRIVCMD=y
+CONFIG_XEN_PVH=y
+CONFIG_XEN_PVHVM=y
+CONFIG_XEN_SAVE_RESTORE=y
+CONFIG_XEN_SCRUB_PAGES=y
+CONFIG_XEN_SCSI_FRONTEND=y
+CONFIG_XEN_SYMS=y
+CONFIG_XEN_SYS_HYPERVISOR=y
+CONFIG_XEN_WDT=y
+CONFIG_XEN_XENBUS_FRONTEND=y
 CONFIG_XPS=y
 CONFIG_ZONE_DMA32=y

target/linux/x86/generic/config-default

@@ -42,6 +42,7 @@ CONFIG_AGP_INTEL=y
 # CONFIG_AGP_SWORKS is not set
 # CONFIG_AGP_VIA is not set
 # CONFIG_APM is not set
+CONFIG_ARCH_DMA_ADDR_T_64BIT=y
 CONFIG_ARCH_ENABLE_SPLIT_PMD_PTLOCK=y
 CONFIG_ARCH_MIGHT_HAVE_ACPI_PDC=y
 CONFIG_ARCH_PHYS_ADDR_T_64BIT=y
@@ -165,7 +166,8 @@ CONFIG_HDMI=y
 CONFIG_HIBERNATE_CALLBACKS=y
 CONFIG_HID=y
 CONFIG_HID_BATTERY_STRENGTH=y
-# CONFIG_HIGHMEM64G is not set
+# CONFIG_HIGHMEM4G is not set
+CONFIG_HIGHMEM64G=y
 CONFIG_HOTPLUG_CPU=y
 CONFIG_HPET=y
 CONFIG_HPET_MMAP=y
@@ -258,7 +260,6 @@ CONFIG_PARAVIRT_SPINLOCKS=y
 # CONFIG_PARAVIRT_TIME_ACCOUNTING is not set
 CONFIG_PATA_AMD=y
 CONFIG_PATA_ATIIXP=y
-CONFIG_PATA_LEGACY=y
 CONFIG_PATA_MPIIX=y
 CONFIG_PATA_OLDPIIX=y
 CONFIG_PATA_PLATFORM=y
@@ -267,6 +268,7 @@ CONFIG_PATA_VIA=y
 CONFIG_PCIEAER=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCIE_PME=y
+CONFIG_PCI_BUS_ADDR_T_64BIT=y
 CONFIG_PCI_MMCONFIG=y
 CONFIG_PCI_XEN=y
 # CONFIG_PCWATCHDOG is not set

toolchain/gcc/patches/5.4.0/030-macos-header-fix-backport.patch

@@ -0,0 +1,10 @@
+--- a/gcc/system.h
++++ b/gcc/system.h
+@@ -216,6 +216,7 @@ extern int errno;
+ 
+ #ifdef __cplusplus
+ # include <algorithm>
++# include <map>
+ # include <cstring>
+ # include <utility>
+ #endif

toolchain/gdb/Makefile

@@ -17,11 +17,11 @@ PKG_HASH:=6a91f86cc487c1548d3f5d4f29f7226d2019c0db8a63633aeabd5914a340f3f9
 GDB_DIR:=binutils-$(PKG_NAME)-$(PKG_VERSION)
 PATCH_DIR:=./patches-arc
 else
-PKG_VERSION:=7.12.1
+PKG_VERSION:=8.0.1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/gdb
-PKG_HASH:=4607680b973d3ec92c30ad029f1b7dbde3876869e6b3a117d8a7e90081113186
+PKG_HASH:=3dbd5f93e36ba2815ad0efab030dcd0c7b211d7b353a40a53f4c02d7d56295e3
 GDB_DIR:=$(PKG_NAME)-$(PKG_VERSION)
 endif
 

toolchain/gdb/patches/110-no_testsuite.patch

@@ -1,6 +1,6 @@
 --- a/gdb/configure
 +++ b/gdb/configure
-@@ -874,8 +874,7 @@ MAKEINFOFLAGS
+@@ -869,8 +869,7 @@ MAKEINFOFLAGS
  YACC
  YFLAGS
  XMKMF'
@@ -10,7 +10,7 @@
  multi-ice
  gdbserver'
  
-@@ -5617,7 +5616,7 @@ $as_echo "$with_auto_load_safe_path" >&6
+@@ -6473,7 +6472,7 @@ $as_echo "$with_auto_load_safe_path" >&6
  
  
  

toolchain/gdb/patches/120-fix-compile-flag-mismatch.patch

@@ -1,6 +1,6 @@
 --- a/gdb/gdbserver/configure
 +++ b/gdb/gdbserver/configure
-@@ -2476,7 +2476,7 @@ $as_echo "$as_me: error: \`$ac_var' was
+@@ -2469,7 +2469,7 @@ $as_echo "$as_me: error: \`$ac_var' was 
        ac_cache_corrupted=: ;;
      ,);;
      *)

tools/cmake/patches/010-backport-macos-fix.patch

@@ -0,0 +1,15 @@
+--- a/Source/kwsys/kwsysPlatformTestsCXX.cxx
++++ b/Source/kwsys/kwsysPlatformTestsCXX.cxx
+@@ -265,6 +265,12 @@ int main()
+ #ifdef TEST_KWSYS_CXX_HAS_UTIMENSAT
+ #include <fcntl.h>
+ #include <sys/stat.h>
++#if defined(__APPLE__)
++#include <AvailabilityMacros.h>
++#if MAC_OS_X_VERSION_MIN_REQUIRED < 101300
++#error "utimensat not available on macOS < 10.13"
++#endif
++#endif
+ int main()
+ {
+   struct timespec times[2] = { { 0, UTIME_OMIT }, { 0, UTIME_NOW } };

version

@@ -1 +1 @@
-r3533-d0bf257c46
+r3560-79f57e422d

version.date

@@ -1 +1 @@
-1507028607
+1508262380