OpenWrt v19.07.2: adjust config defaults

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

feeds.conf.default

@@ -1,4 +1,4 @@
-src-git packages https://git.openwrt.org/feed/packages.git^d974cd36735353204fac679cb9febd6c9814c326
-src-git luci https://git.openwrt.org/project/luci.git^35aa5270592f7e837c42aa097f8fbb06faa4017d
-src-git routing https://git.openwrt.org/feed/routing.git^c82ce8d095a87df32bbd3a89e3cf113721d3ae82
+src-git packages https://git.openwrt.org/feed/packages.git^99efce0cd27adfcc53384fba93f37e5ee2e517de
+src-git luci https://git.openwrt.org/project/luci.git^13dd17fca148965d38f0d4e578b19679a7c4daa2
+src-git routing https://git.openwrt.org/feed/routing.git^efa6e5445adda9c6545f551808829ec927cbade8
 src-git telephony https://git.openwrt.org/feed/telephony.git^6f95d6ab3f359ee2ce81c20522700937424d1591

include/kernel-version.mk

@@ -6,9 +6,9 @@ ifdef CONFIG_TESTING_KERNEL
   KERNEL_PATCHVER:=$(KERNEL_TESTING_PATCHVER)
 endif
 
-LINUX_VERSION-4.14 = .162
+LINUX_VERSION-4.14 = .171
 
-LINUX_KERNEL_HASH-4.14.162 = f65170224cd4359ce8b2793b492bd8127abdd0b91350484e001bce13f0c98b4b
+LINUX_KERNEL_HASH-4.14.171 = 4fe02489e4b4a187eccf0ef87df6100534c9d485e76d876b1fa247c7635332a0
 
 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
 sanitize_uri=$(call qstrip,$(subst @,_,$(subst :,_,$(subst .,_,$(subst -,_,$(subst /,_,$(1)))))))

include/version.mk

@@ -26,13 +26,13 @@ PKG_CONFIG_DEPENDS += \
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))
 
 VERSION_NUMBER:=$(call qstrip,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),19.07.0)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),19.07.2)
 
 VERSION_CODE:=$(call qstrip,$(CONFIG_VERSION_CODE))
-VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r10860-a3ffeb413b)
+VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r10947-65030d81f3)
 
 VERSION_REPO:=$(call qstrip,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.openwrt.org/releases/19.07.0)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.openwrt.org/releases/19.07.2)
 
 VERSION_DIST:=$(call qstrip,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),OpenWrt)

package/base-files/image-config.in

@@ -183,7 +183,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "http://downloads.openwrt.org/releases/19.07.0"
+		default "http://downloads.openwrt.org/releases/19.07.2"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:

package/boot/uboot-envtools/files/ar71xx

@@ -85,6 +85,11 @@ dr342|\
 dr531)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0xf800" "0x10000"
 	;;
+gl-ar150|\
+gl-domino|\
+gl-mifi)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x8000" "0x10000"
+	;;
 rambutan)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
 	ubootenv_add_uci_config "/dev/mtd1" "0x100000" "0x20000" "0x20000"

package/boot/uboot-envtools/files/ath79

@@ -32,7 +32,11 @@ yuncore,a782|\
 yuncore,xd4200)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x10000"
 	;;
-netgear,wndr3700)
+glinet,gl-ar150)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x8000" "0x10000"
+	;;
+netgear,wndr3700|\
+netgear,wndr3700-v2)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x10000"
 	;;
 esac

package/kernel/cryptodev-linux/Makefile

@@ -27,7 +27,6 @@ include $(INCLUDE_DIR)/package.mk
 
 define KernelPackage/cryptodev
   SUBMENU:=Cryptographic API modules
-  DEFAULT:=m if ALL
   TITLE:=Driver for cryptographic acceleration
   URL:=http://cryptodev-linux.org/
   VERSION:=$(LINUX_VERSION)+$(PKG_VERSION)-$(BOARD)-$(PKG_RELEASE)

package/kernel/lantiq/ltq-ptm/Makefile

@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ltq-ptm
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=GPL-2.0+

package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c

@@ -336,6 +336,9 @@ static int ptm_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         dma_cache_wback((unsigned long)skb->data, skb->len);
     }
 
+    /* make the skb unowned */
+    skb_orphan(skb);
+
     *(struct sk_buff **)((unsigned int)skb->data - byteoff - sizeof(struct sk_buff *)) = skb;
     /*  write back to physical memory   */
     dma_cache_wback((unsigned long)skb->data - byteoff - sizeof(struct sk_buff *), skb->len + byteoff + sizeof(struct sk_buff *));

package/kernel/mac80211/Makefile

@@ -10,10 +10,10 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=4.19.85-1
+PKG_VERSION:=4.19.98-1
 PKG_RELEASE:=1
-PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v4.19.85/
-PKG_HASH:=6a92df43e8c3e2410638d84dfd18773d667757532dd0a911227c9b7d65aee34d
+PKG_SOURCE_URL:=@KERNEL/linux/kernel/projects/backports/stable/v4.19.98/
+PKG_HASH:=256d77e9cd3918d6a361e029850aba4568e8a00167ab3ed55495a359511c5bd2
 
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/backports-$(PKG_VERSION)

package/kernel/mac80211/patches/ath/930-ath10k_add_tpt_led_trigger.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -8287,6 +8287,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -8297,6 +8297,21 @@ static int ath10k_mac_init_rd(struct ath
  	return 0;
  }
  
@@ -22,7 +22,7 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -8577,6 +8592,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -8581,6 +8596,12 @@ int ath10k_mac_register(struct ath10k *a
  
  	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  

package/kernel/mac80211/patches/ath/972-ath10k_fix-crash-due-to-wrong-handling-of-peer_bw_rxnss_override-parameter.patch

@@ -105,7 +105,7 @@ v9: use SM/MS macros from code.h to simplify shift/mask handling
  }
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -7365,12 +7365,7 @@ ath10k_wmi_peer_assoc_fill_10_4(struct a
+@@ -7378,12 +7378,7 @@ ath10k_wmi_peer_assoc_fill_10_4(struct a
  	struct wmi_10_4_peer_assoc_complete_cmd *cmd = buf;
  
  	ath10k_wmi_peer_assoc_fill_10_2(ar, buf, arg);

package/kernel/mac80211/patches/ath/973-ath10k_fix-band_center_freq-handling-for-VHT160-in-recent-firmwares.patch

@@ -13,7 +13,7 @@ v2: fix trailing whitespace issue and fix some typos within the commit note
  2 files changed, 8 insertions(+), 10 deletions(-)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -4478,13 +4478,6 @@ static struct ieee80211_sta_vht_cap ath1
+@@ -4480,13 +4480,6 @@ static struct ieee80211_sta_vht_cap ath1
  		vht_cap.cap |= val;
  	}
  

package/kernel/mac80211/patches/ath/974-ath10k_add-LED-and-GPIO-controlling-support-for-various-chipsets.patch

@@ -229,7 +229,7 @@ v13:
  	bool p2p;
  
  	struct {
-@@ -1099,6 +1099,13 @@ struct ath10k {
+@@ -1100,6 +1100,13 @@ struct ath10k {
  	} testmode;
  
  	struct {
@@ -475,7 +475,7 @@ v13:
  static const struct wmi_peer_flags_map wmi_tlv_peer_flags_map = {
 --- a/drivers/net/wireless/ath/ath10k/wmi.c
 +++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -7185,6 +7185,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
+@@ -7198,6 +7198,49 @@ ath10k_wmi_op_gen_peer_set_param(struct
  	return skb;
  }
  
@@ -525,7 +525,7 @@ v13:
  static struct sk_buff *
  ath10k_wmi_op_gen_set_psmode(struct ath10k *ar, u32 vdev_id,
  			     enum wmi_sta_ps_mode psmode)
-@@ -8796,6 +8839,9 @@ static const struct wmi_ops wmi_ops = {
+@@ -8809,6 +8852,9 @@ static const struct wmi_ops wmi_ops = {
  	.fw_stats_fill = ath10k_wmi_main_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -535,7 +535,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -8866,6 +8912,8 @@ static const struct wmi_ops wmi_10_1_ops
+@@ -8879,6 +8925,8 @@ static const struct wmi_ops wmi_10_1_ops
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
  	.gen_echo = ath10k_wmi_op_gen_echo,
@@ -544,7 +544,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -8937,6 +8985,8 @@ static const struct wmi_ops wmi_10_2_ops
+@@ -8950,6 +8998,8 @@ static const struct wmi_ops wmi_10_2_ops
  	.gen_delba_send = ath10k_wmi_op_gen_delba_send,
  	.fw_stats_fill = ath10k_wmi_10x_op_fw_stats_fill,
  	.get_vdev_subtype = ath10k_wmi_op_get_vdev_subtype,
@@ -553,7 +553,7 @@ v13:
  	/* .gen_pdev_enable_adaptive_cca not implemented */
  };
  
-@@ -9007,6 +9057,8 @@ static const struct wmi_ops wmi_10_2_4_o
+@@ -9020,6 +9070,8 @@ static const struct wmi_ops wmi_10_2_4_o
  	.gen_pdev_enable_adaptive_cca =
  		ath10k_wmi_op_gen_pdev_enable_adaptive_cca,
  	.get_vdev_subtype = ath10k_wmi_10_2_4_op_get_vdev_subtype,
@@ -562,7 +562,7 @@ v13:
  	/* .gen_bcn_tmpl not implemented */
  	/* .gen_prb_tmpl not implemented */
  	/* .gen_p2p_go_bcn_ie not implemented */
-@@ -9086,6 +9138,8 @@ static const struct wmi_ops wmi_10_4_ops
+@@ -9099,6 +9151,8 @@ static const struct wmi_ops wmi_10_4_ops
  	.gen_pdev_bss_chan_info_req = ath10k_wmi_10_2_op_gen_pdev_bss_chan_info,
  	.gen_echo = ath10k_wmi_op_gen_echo,
  	.gen_pdev_get_tpc_config = ath10k_wmi_10_2_4_op_gen_pdev_get_tpc_config,

package/kernel/mac80211/patches/ath/975-ath10k-use-tpt-trigger-by-default.patch

@@ -16,7 +16,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -1144,6 +1144,10 @@ struct ath10k {
+@@ -1145,6 +1145,10 @@ struct ath10k {
  	struct ath10k_radar_found_info last_radar_info;
  	struct work_struct radar_confirmation_work;
  
@@ -42,7 +42,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  	if (ret)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -8609,7 +8609,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -8613,7 +8613,7 @@ int ath10k_mac_register(struct ath10k *a
  	wiphy_ext_feature_set(ar->hw->wiphy, NL80211_EXT_FEATURE_CQM_RSSI_LIST);
  
  #ifdef CPTCFG_MAC80211_LEDS

package/kernel/mac80211/patches/ath/977-ath10k-add-support-for-configuring-management-packet.patch

@@ -43,7 +43,7 @@ Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
  static int ath10k_mac_get_max_vht_mcs_map(u16 mcs_map, int nss)
  {
  	switch ((mcs_map >> (2 * nss)) & 0x3) {
-@@ -5472,9 +5488,10 @@ static void ath10k_bss_info_changed(stru
+@@ -5482,9 +5498,10 @@ static void ath10k_bss_info_changed(stru
  	struct cfg80211_chan_def def;
  	u32 vdev_param, pdev_param, slottime, preamble;
  	u16 bitrate, hw_value;
@@ -56,7 +56,7 @@ Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
  
  	mutex_lock(&ar->conf_mutex);
  
-@@ -5680,6 +5697,30 @@ static void ath10k_bss_info_changed(stru
+@@ -5690,6 +5707,30 @@ static void ath10k_bss_info_changed(stru
  				    arvif->vdev_id,  ret);
  	}
  

package/kernel/mac80211/patches/ath/978-ath10k-fix-possible-out-of-bound-access-of-ath10k_ra.patch

@@ -26,7 +26,7 @@ Origin: backport, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
  		if (ath10k_rates[i].bitrate == bitrate)
  			return hw_value_prefix | ath10k_rates[i].hw_value;
  	}
-@@ -5703,22 +5703,22 @@ static void ath10k_bss_info_changed(stru
+@@ -5713,22 +5713,22 @@ static void ath10k_bss_info_changed(stru
  			return;
  		}
  

package/kernel/mac80211/patches/ath/979-ath10k-fix-incorrect-multicast-broadcast-rate-settin.patch

@@ -17,7 +17,7 @@ Origin: other, https://patchwork.kernel.org/patch/10723033/
 
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -5488,8 +5488,8 @@ static void ath10k_bss_info_changed(stru
+@@ -5498,8 +5498,8 @@ static void ath10k_bss_info_changed(stru
  	struct cfg80211_chan_def def;
  	u32 vdev_param, pdev_param, slottime, preamble;
  	u16 bitrate, hw_value;
@@ -28,7 +28,7 @@ Origin: other, https://patchwork.kernel.org/patch/10723033/
  	enum nl80211_band band;
  	const struct ieee80211_supported_band *sband;
  
-@@ -5662,7 +5662,11 @@ static void ath10k_bss_info_changed(stru
+@@ -5672,7 +5672,11 @@ static void ath10k_bss_info_changed(stru
  	if (changed & BSS_CHANGED_MCAST_RATE &&
  	    !ath10k_mac_vif_chan(arvif->vif, &def)) {
  		band = def.chan->band;

package/kernel/mac80211/patches/ath/981-ath10k-adjust-tx-power-reduction-for-US-regulatory-d.patch

@@ -29,7 +29,7 @@ Forwarded: no
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
 @@ -988,6 +988,40 @@ static inline int ath10k_vdev_setup_sync
- 	return 0;
+ 	return ar->last_wmi_vdev_start_status;
  }
  
 +static u32 ath10k_get_max_antenna_gain(struct ath10k *ar,

package/kernel/mac80211/patches/brcm/305-v4.20-0001-brcmfmac-remove-set-but-not-used-variables-sfdoff-an.patch

@@ -22,7 +22,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -1474,7 +1474,7 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+@@ -1480,7 +1480,7 @@ static u8 brcmf_sdio_rxglom(struct brcmf
  	struct sk_buff *pfirst, *pnext;
  
  	int errcode;
@@ -31,7 +31,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	struct brcmf_sdio_hdrinfo rd_new;
  
-@@ -1608,7 +1608,6 @@ static u8 brcmf_sdio_rxglom(struct brcmf
+@@ -1614,7 +1614,6 @@ static u8 brcmf_sdio_rxglom(struct brcmf
  
  		/* Remove superframe header, remember offset */
  		skb_pull(pfirst, rd_new.dat_offset);
@@ -39,7 +39,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		num = 0;
  
  		/* Validate all the subframe headers */
-@@ -3416,7 +3415,6 @@ static int brcmf_sdio_bus_preinit(struct
+@@ -3422,7 +3421,6 @@ static int brcmf_sdio_bus_preinit(struct
  	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
  	struct brcmf_sdio *bus = sdiodev->bus;
  	struct brcmf_core *core = bus->sdio_core;
@@ -47,7 +47,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	u32 value;
  	int err;
  
-@@ -3459,7 +3457,6 @@ static int brcmf_sdio_bus_preinit(struct
+@@ -3465,7 +3463,6 @@ static int brcmf_sdio_bus_preinit(struct
  	if (sdiodev->sg_support) {
  		bus->txglom = false;
  		value = 1;

package/kernel/mac80211/patches/brcm/306-v4.20-0001-brcmfmac-reduce-timeout-for-action-frame-scan.patch

@@ -1,67 +0,0 @@
-From edb6d6885bef82d1eac432dbeca9fbf4ec349d7e Mon Sep 17 00:00:00 2001
-From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
-Date: Thu, 27 Sep 2018 14:59:44 +0000
-Subject: [PATCH] brcmfmac: reduce timeout for action frame scan
-
-Finding a common channel to send an action frame out is required for
-some action types. Since a loop with several scan retry is used to find
-the channel, a short wait time could be considered for each attempt.
-This patch reduces the wait time from 1500 to 450 msec for each action
-frame scan.
-
-This patch fixes the WFA p2p certification 5.1.20 failure caused by the
-long action frame send time.
-
-Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
-Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 9 ++++-----
- 1 file changed, 4 insertions(+), 5 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -74,7 +74,7 @@
- #define P2P_AF_MAX_WAIT_TIME		msecs_to_jiffies(2000)
- #define P2P_INVALID_CHANNEL		-1
- #define P2P_CHANNEL_SYNC_RETRY		5
--#define P2P_AF_FRM_SCAN_MAX_WAIT	msecs_to_jiffies(1500)
-+#define P2P_AF_FRM_SCAN_MAX_WAIT	msecs_to_jiffies(450)
- #define P2P_DEFAULT_SLEEP_TIME_VSDB	200
- 
- /* WiFi P2P Public Action Frame OUI Subtypes */
-@@ -1134,7 +1134,6 @@ static s32 brcmf_p2p_af_searching_channe
- {
- 	struct afx_hdl *afx_hdl = &p2p->afx_hdl;
- 	struct brcmf_cfg80211_vif *pri_vif;
--	unsigned long duration;
- 	s32 retry;
- 
- 	brcmf_dbg(TRACE, "Enter\n");
-@@ -1150,7 +1149,6 @@ static s32 brcmf_p2p_af_searching_channe
- 	 * pending action frame tx is cancelled.
- 	 */
- 	retry = 0;
--	duration = msecs_to_jiffies(P2P_AF_FRM_SCAN_MAX_WAIT);
- 	while ((retry < P2P_CHANNEL_SYNC_RETRY) &&
- 	       (afx_hdl->peer_chan == P2P_INVALID_CHANNEL)) {
- 		afx_hdl->is_listen = false;
-@@ -1158,7 +1156,8 @@ static s32 brcmf_p2p_af_searching_channe
- 			  retry);
- 		/* search peer on peer's listen channel */
- 		schedule_work(&afx_hdl->afx_work);
--		wait_for_completion_timeout(&afx_hdl->act_frm_scan, duration);
-+		wait_for_completion_timeout(&afx_hdl->act_frm_scan,
-+					    P2P_AF_FRM_SCAN_MAX_WAIT);
- 		if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) ||
- 		    (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
- 			       &p2p->status)))
-@@ -1171,7 +1170,7 @@ static s32 brcmf_p2p_af_searching_channe
- 			afx_hdl->is_listen = true;
- 			schedule_work(&afx_hdl->afx_work);
- 			wait_for_completion_timeout(&afx_hdl->act_frm_scan,
--						    duration);
-+						    P2P_AF_FRM_SCAN_MAX_WAIT);
- 		}
- 		if ((afx_hdl->peer_chan != P2P_INVALID_CHANNEL) ||
- 		    (!test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,

package/kernel/mac80211/patches/brcm/306-v4.20-0002-brcmfmac-fix-full-timeout-waiting-for-action-frame-o.patch

@@ -1,79 +0,0 @@
-From fbf07000960d9c8a13fdc17c6de0230d681c7543 Mon Sep 17 00:00:00 2001
-From: Chung-Hsien Hsu <stanley.hsu@cypress.com>
-Date: Thu, 27 Sep 2018 14:59:49 +0000
-Subject: [PATCH] brcmfmac: fix full timeout waiting for action frame
- on-channel tx
-
-The driver sends an action frame down and waits for a completion signal
-triggered by the received BRCMF_E_ACTION_FRAME_OFF_CHAN_COMPLETE event
-to continue the process. However, the action frame could be transmitted
-either on the current channel or on an off channel. For the on-channel
-case, only BRCMF_E_ACTION_FRAME_COMPLETE event will be received when
-the frame is transmitted, which make the driver always wait a full
-timeout duration. This patch has the completion signal be triggered by
-receiving the BRCMF_E_ACTION_FRAME_COMPLETE event for the on-channel
-case.
-
-This change fixes WFA p2p certification 5.1.19 failure.
-
-Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
-Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 17 +++++++++++++++--
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h |  2 ++
- 2 files changed, 17 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
-@@ -1457,10 +1457,12 @@ int brcmf_p2p_notify_action_tx_complete(
- 		return 0;
- 
- 	if (e->event_code == BRCMF_E_ACTION_FRAME_COMPLETE) {
--		if (e->status == BRCMF_E_STATUS_SUCCESS)
-+		if (e->status == BRCMF_E_STATUS_SUCCESS) {
- 			set_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED,
- 				&p2p->status);
--		else {
-+			if (!p2p->wait_for_offchan_complete)
-+				complete(&p2p->send_af_done);
-+		} else {
- 			set_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
- 			/* If there is no ack, we don't need to wait for
- 			 * WLC_E_ACTION_FRAME_OFFCHAN_COMPLETE event
-@@ -1511,6 +1513,17 @@ static s32 brcmf_p2p_tx_action_frame(str
- 	p2p->af_sent_channel = le32_to_cpu(af_params->channel);
- 	p2p->af_tx_sent_jiffies = jiffies;
- 
-+	if (test_bit(BRCMF_P2P_STATUS_DISCOVER_LISTEN, &p2p->status) &&
-+	    p2p->af_sent_channel ==
-+	    ieee80211_frequency_to_channel(p2p->remain_on_channel.center_freq))
-+		p2p->wait_for_offchan_complete = false;
-+	else
-+		p2p->wait_for_offchan_complete = true;
-+
-+	brcmf_dbg(TRACE, "Waiting for %s tx completion event\n",
-+		  (p2p->wait_for_offchan_complete) ?
-+		   "off-channel" : "on-channel");
-+
- 	timeout = wait_for_completion_timeout(&p2p->send_af_done,
- 					      P2P_AF_MAX_WAIT_TIME);
- 
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
-@@ -124,6 +124,7 @@ struct afx_hdl {
-  * @gon_req_action: about to send go negotiation requets frame.
-  * @block_gon_req_tx: drop tx go negotiation requets frame.
-  * @p2pdev_dynamically: is p2p device if created by module param or supplicant.
-+ * @wait_for_offchan_complete: wait for off-channel tx completion event.
-  */
- struct brcmf_p2p_info {
- 	struct brcmf_cfg80211_info *cfg;
-@@ -144,6 +145,7 @@ struct brcmf_p2p_info {
- 	bool gon_req_action;
- 	bool block_gon_req_tx;
- 	bool p2pdev_dynamically;
-+	bool wait_for_offchan_complete;
- };
- 
- s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg, bool p2pdev_forced);

package/kernel/mac80211/patches/brcm/320-v5.0-0004-brcmfmac-Set-board_type-used-for-nvram-file-selectio.patch

@@ -67,7 +67,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	fwreq->bus_nr = devinfo->pdev->bus->number;
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4185,6 +4185,7 @@ brcmf_sdio_prepare_fw_request(struct brc
+@@ -4210,6 +4210,7 @@ brcmf_sdio_prepare_fw_request(struct brc
  
  	fwreq->items[BRCMF_SDIO_FW_CODE].type = BRCMF_FW_TYPE_BINARY;
  	fwreq->items[BRCMF_SDIO_FW_NVRAM].type = BRCMF_FW_TYPE_NVRAM;

package/kernel/mac80211/patches/brcm/328-v5.0-0002-brcmfmac-enable-frameburst-mode-in-default-firmware-.patch

@@ -17,7 +17,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6644,6 +6644,12 @@ static s32 brcmf_config_dongle(struct br
+@@ -6654,6 +6654,12 @@ static s32 brcmf_config_dongle(struct br
  
  	brcmf_configure_arp_nd_offload(ifp, true);
  

package/kernel/mac80211/patches/brcm/329-v5.0-0002-brcmfmac-set-F2-watermark-to-256-for-4373.patch

@@ -1,73 +0,0 @@
-From e1a08730eeb0bad4d82c3bc40e74854872de618d Mon Sep 17 00:00:00 2001
-From: Wright Feng <wright.feng@cypress.com>
-Date: Wed, 21 Nov 2018 07:53:44 +0000
-Subject: [PATCH] brcmfmac: set F2 watermark to 256 for 4373
-
-We got SDIO_CRC_ERROR with 4373 on SDR104 when doing bi-directional
-throughput test. Enable watermark to 256 to guarantee the operation
-stability.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Wright Feng <wright.feng@cypress.com>
-Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../broadcom/brcm80211/brcmfmac/sdio.c        | 26 +++++++++++++++++--
- 1 file changed, 24 insertions(+), 2 deletions(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -49,6 +49,10 @@
- #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
- #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
- 
-+/* watermark expressed in number of words */
-+#define DEFAULT_F2_WATERMARK    0x8
-+#define CY_4373_F2_WATERMARK    0x40
-+
- #ifdef DEBUG
- 
- #define BRCMF_TRAP_INFO_SIZE	80
-@@ -138,6 +142,8 @@ struct rte_console {
- /* 1: isolate internal sdio signals, put external pads in tri-state; requires
-  * sdio bus power cycle to clear (rev 9) */
- #define SBSDIO_DEVCTL_PADS_ISO		0x08
-+/* 1: enable F2 Watermark */
-+#define SBSDIO_DEVCTL_F2WM_ENAB		0x10
- /* Force SD->SB reset mapping (rev 11) */
- #define SBSDIO_DEVCTL_SB_RST_CTL	0x30
- /*   Determined by CoreControl bit */
-@@ -4057,6 +4063,7 @@ static void brcmf_sdio_firmware_callback
- 	void *nvram;
- 	u32 nvram_len;
- 	u8 saveclk;
-+	u8 devctl;
- 
- 	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
- 
-@@ -4112,8 +4119,23 @@ static void brcmf_sdio_firmware_callback
- 		brcmf_sdiod_writel(sdiod, core->base + SD_REG(hostintmask),
- 				   bus->hostintmask, NULL);
- 
--
--		brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK, 8, &err);
-+		switch (sdiod->func1->device) {
-+		case SDIO_DEVICE_ID_CYPRESS_4373:
-+			brcmf_dbg(INFO, "set F2 watermark to 0x%x*4 bytes\n",
-+				  CY_4373_F2_WATERMARK);
-+			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
-+					   CY_4373_F2_WATERMARK, &err);
-+			devctl = brcmf_sdiod_readb(sdiod, SBSDIO_DEVICE_CTL,
-+						   &err);
-+			devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
-+			brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
-+					   &err);
-+			break;
-+		default:
-+			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
-+					   DEFAULT_F2_WATERMARK, &err);
-+			break;
-+		}
- 	} else {
- 		/* Disable F2 again */
- 		sdio_disable_func(sdiod->func2);

package/kernel/mac80211/patches/brcm/329-v5.0-0003-brcmfmac-set-SDIO-F1-MesBusyCtrl-for-CYW4373.patch

@@ -1,55 +0,0 @@
-From 58e4bbea0c1d9b5ace11df968c5dc096ce052a73 Mon Sep 17 00:00:00 2001
-From: Madhan Mohan R <MadhanMohan.R@cypress.com>
-Date: Wed, 21 Nov 2018 07:53:45 +0000
-Subject: [PATCH] brcmfmac: set SDIO F1 MesBusyCtrl for CYW4373
-
-Along with F2 watermark (existing) configuration, F1 MesBusyCtrl
-should be enabled & sdio device RX FIFO watermark should be
-configured to avoid overflow errors.
-
-Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Madhan Mohan R <madhanmohan.r@cypress.com>
-Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 3 +++
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h | 9 ++++++++-
- 2 files changed, 11 insertions(+), 1 deletion(-)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
-@@ -4130,6 +4130,9 @@ static void brcmf_sdio_firmware_callback
- 			devctl |= SBSDIO_DEVCTL_F2WM_ENAB;
- 			brcmf_sdiod_writeb(sdiod, SBSDIO_DEVICE_CTL, devctl,
- 					   &err);
-+			brcmf_sdiod_writeb(sdiod, SBSDIO_FUNC1_MESBUSYCTRL,
-+					   CY_4373_F2_WATERMARK |
-+					   SBSDIO_MESBUSYCTRL_ENAB, &err);
- 			break;
- 		default:
- 			brcmf_sdiod_writeb(sdiod, SBSDIO_WATERMARK,
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
-@@ -77,7 +77,7 @@
- #define SBSDIO_GPIO_OUT			0x10006
- /* gpio enable */
- #define SBSDIO_GPIO_EN			0x10007
--/* rev < 7, watermark for sdio device */
-+/* rev < 7, watermark for sdio device TX path */
- #define SBSDIO_WATERMARK		0x10008
- /* control busy signal generation */
- #define SBSDIO_DEVICE_CTL		0x10009
-@@ -104,6 +104,13 @@
- #define SBSDIO_FUNC1_RFRAMEBCHI		0x1001C
- /* MesBusyCtl (rev 11) */
- #define SBSDIO_FUNC1_MESBUSYCTRL	0x1001D
-+/* Watermark for sdio device RX path */
-+#define SBSDIO_MESBUSY_RXFIFO_WM_MASK	0x7F
-+#define SBSDIO_MESBUSY_RXFIFO_WM_SHIFT	0
-+/* Enable busy capability for MES access */
-+#define SBSDIO_MESBUSYCTRL_ENAB		0x80
-+#define SBSDIO_MESBUSYCTRL_ENAB_SHIFT	7
-+
- /* Sdio Core Rev 12 */
- #define SBSDIO_FUNC1_WAKEUPCTRL		0x1001E
- #define SBSDIO_FUNC1_WCTRL_ALPWAIT_MASK		0x1

package/kernel/mac80211/patches/brcm/332-v5.0-0001-brcmfmac-Fix-access-point-mode.patch

@@ -1,41 +0,0 @@
-From 861cb5eb467f5e38dce1aabe4e8db379255bd89b Mon Sep 17 00:00:00 2001
-From: Stefan Wahren <stefan.wahren@i2se.com>
-Date: Wed, 12 Dec 2018 20:20:06 +0100
-Subject: [PATCH] brcmfmac: Fix access point mode
-
-Since commit 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
-the Raspberry Pi 3 A+ (BCM43455) isn't able to operate in AP mode with
-hostapd (device_ap_sme=1 use_monitor=0):
-
-brcmfmac: brcmf_cfg80211_stop_ap: setting AP mode failed -52
-
-So add the missing mgmt_stypes for AP mode to fix this.
-
-Fixes: 1204aa17f3b4 ("brcmfmac: set WIPHY_FLAG_HAVE_AP_SME flag")
-Suggested-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
-Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
-Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
----
- .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c    | 10 ++++++++++
- 1 file changed, 10 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -6314,6 +6314,16 @@ brcmf_txrx_stypes[NUM_NL80211_IFTYPES] =
- 		.tx = 0xffff,
- 		.rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
- 		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
-+	},
-+	[NL80211_IFTYPE_AP] = {
-+		.tx = 0xffff,
-+		.rx = BIT(IEEE80211_STYPE_ASSOC_REQ >> 4) |
-+		      BIT(IEEE80211_STYPE_REASSOC_REQ >> 4) |
-+		      BIT(IEEE80211_STYPE_PROBE_REQ >> 4) |
-+		      BIT(IEEE80211_STYPE_DISASSOC >> 4) |
-+		      BIT(IEEE80211_STYPE_AUTH >> 4) |
-+		      BIT(IEEE80211_STYPE_DEAUTH >> 4) |
-+		      BIT(IEEE80211_STYPE_ACTION >> 4)
- 	}
- };
- 

package/kernel/mac80211/patches/brcm/354-v5.1-brcmfmac-use-bphy_err-in-all-wiphy-related-code.patch

@@ -503,7 +503,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  		goto fail;
  	}
  
-@@ -1353,6 +1356,7 @@ static int brcmf_get_pend_8021x_cnt(stru
+@@ -1358,6 +1361,7 @@ static int brcmf_get_pend_8021x_cnt(stru
  
  int brcmf_netdev_wait_pend8021x(struct brcmf_if *ifp)
  {
@@ -511,7 +511,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	int err;
  
  	err = wait_event_timeout(ifp->pend_8021x_wait,
-@@ -1360,7 +1364,7 @@ int brcmf_netdev_wait_pend8021x(struct b
+@@ -1365,7 +1369,7 @@ int brcmf_netdev_wait_pend8021x(struct b
  				 MAX_WAIT_FOR_8021X_TX);
  
  	if (!err)

package/kernel/mac80211/patches/brcm/384-v5.4-0001-Revert-brcmfmac-fix-NULL-pointer-derefence-during-US.patch

@@ -71,10 +71,10 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
 -	brcmf_proto_detach_pre_delif(drvr);
 -
- 	/* make sure primary interface removed last */
- 	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
- 		brcmf_remove_interface(drvr->iflist[i], false);
-@@ -1346,7 +1344,7 @@ void brcmf_detach(struct device *dev)
+ 	if (drvr->mon_if) {
+ 		brcmf_net_detach(drvr->mon_if->ndev, false);
+ 		drvr->mon_if = NULL;
+@@ -1351,7 +1349,7 @@ void brcmf_detach(struct device *dev)
  
  	brcmf_bus_stop(drvr->bus_if);
  

package/kernel/mac80211/patches/brcm/384-v5.4-0002-brcmfmac-change-the-order-of-things-in-brcmf_detach.patch

@@ -25,7 +25,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1328,25 +1328,26 @@ void brcmf_detach(struct device *dev)
+@@ -1328,12 +1328,11 @@ void brcmf_detach(struct device *dev)
  	unregister_inet6addr_notifier(&drvr->inet6addr_notifier);
  #endif
  
@@ -35,31 +35,36 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
 -		brcmf_p2p_detach(&drvr->config->p2p);
 -
  	brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
--
--	/* make sure primary interface removed last */
++	brcmf_bus_stop(drvr->bus_if);
++
++	brcmf_fweh_detach(drvr);
++	brcmf_proto_detach(drvr);
+ 
+ 	if (drvr->mon_if) {
+ 		brcmf_net_detach(drvr->mon_if->ndev, false);
+@@ -1341,17 +1340,19 @@ void brcmf_detach(struct device *dev)
+ 	}
+ 
+ 	/* make sure primary interface removed last */
 -	for (i = BRCMF_MAX_IFS-1; i > -1; i--)
 -		brcmf_remove_interface(drvr->iflist[i], false);
 -
 -	brcmf_cfg80211_detach(drvr->config);
 -	drvr->config = NULL;
 -
- 	brcmf_bus_stop(drvr->bus_if);
- 
-+	brcmf_fweh_detach(drvr);
- 	brcmf_proto_detach(drvr);
- 
-+	/* make sure primary interface removed last */
+-	brcmf_bus_stop(drvr->bus_if);
 +	for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
 +		if (drvr->iflist[i])
 +			brcmf_del_if(drvr, drvr->iflist[i]->bsscfgidx, false);
 +	}
-+
+ 
+-	brcmf_proto_detach(drvr);
 +	if (drvr->config) {
 +		brcmf_p2p_detach(&drvr->config->p2p);
 +		brcmf_cfg80211_detach(drvr->config);
 +		drvr->config = NULL;
 +	}
-+
+ 
  	bus_if->drvr = NULL;
 +
  	wiphy_free(drvr->wiphy);

package/kernel/mac80211/patches/brcm/392-v5.4-0001-brcmfmac-move-cfg80211_ops-pointer-to-another-struct.patch

@@ -74,7 +74,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  
  	return ret;
  }
-@@ -1374,6 +1375,8 @@ void brcmf_detach(struct device *dev)
+@@ -1379,6 +1380,8 @@ void brcmf_detach(struct device *dev)
  
  	bus_if->drvr = NULL;
  

package/kernel/mac80211/patches/brcm/392-v5.4-0002-brcmfmac-split-brcmf_attach-and-brcmf_detach-functio.patch

@@ -96,7 +96,7 @@ Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  	if (ret != 0) {
  		bphy_err(drvr, "dongle is not responding: err=%d\n", ret);
  		goto fail;
-@@ -1372,6 +1382,15 @@ void brcmf_detach(struct device *dev)
+@@ -1377,6 +1387,15 @@ void brcmf_detach(struct device *dev)
  		brcmf_cfg80211_detach(drvr->config);
  		drvr->config = NULL;
  	}

package/kernel/mac80211/patches/brcm/405-v5.5-brcmfmac-remove-monitor-interface-when-detaching.patch

@@ -1,30 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Mon, 18 Nov 2019 13:35:20 +0100
-Subject: [PATCH 5.5] brcmfmac: remove monitor interface when detaching
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This fixes a minor WARNING in the cfg80211:
-[  130.658034] ------------[ cut here ]------------
-[  130.662805] WARNING: CPU: 1 PID: 610 at net/wireless/core.c:954 wiphy_unregister+0xb4/0x198 [cfg80211]
-
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
----
- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1371,6 +1371,11 @@ void brcmf_detach(struct device *dev)
- 	brcmf_fweh_detach(drvr);
- 	brcmf_proto_detach(drvr);
- 
-+	if (drvr->mon_if) {
-+		brcmf_net_detach(drvr->mon_if->ndev, false);
-+		drvr->mon_if = NULL;
-+	}
-+
- 	/* make sure primary interface removed last */
- 	for (i = BRCMF_MAX_IFS - 1; i > -1; i--) {
- 		if (drvr->iflist[i])

package/kernel/mac80211/patches/brcm/415-v5.6-brcmfmac-Fix-memory-leak-in-brcmf_usbdev_qinit.patch

@@ -0,0 +1,26 @@
+From 4282dc057d750c6a7dd92953564b15c26b54c22c Mon Sep 17 00:00:00 2001
+From: Navid Emamdoost <navid.emamdoost@gmail.com>
+Date: Sat, 14 Dec 2019 19:51:14 -0600
+Subject: [PATCH] brcmfmac: Fix memory leak in brcmf_usbdev_qinit
+
+In the implementation of brcmf_usbdev_qinit() the allocated memory for
+reqs is leaking if usb_alloc_urb() fails. Release reqs in the error
+handling path.
+
+Fixes: 71bb244ba2fd ("brcm80211: fmac: add USB support for bcm43235/6/8 chipsets")
+Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -430,6 +430,7 @@ fail:
+ 			usb_free_urb(req->urb);
+ 		list_del(q->next);
+ 	}
++	kfree(reqs);
+ 	return NULL;
+ 
+ }

package/kernel/mac80211/patches/brcm/416-v5.6-brcmfmac-Keep-OOB-wake-interrupt-disabled-when-it-sh.patch

@@ -0,0 +1,66 @@
+From a32de68edab7b73ded850bcf76cdf6858e92a7e5 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <digetx@gmail.com>
+Date: Sun, 15 Dec 2019 21:42:24 +0300
+Subject: [PATCH] brcmfmac: Keep OOB wake-interrupt disabled when it shouldn't
+ be enabled
+
+NVIDIA Tegra SoCs do not like when OOB wake is enabled and WiFi interface
+is in DOWN state during suspend. This results in a CPU hang on programming
+OOB wake-up state of the GPIO controller during of system's suspend.
+
+The solution is trivial: don't enable wake for the OOB interrupt when it
+should be disabled.
+
+This fixes hang on Tegra20 (Acer A500) and Tegra30 (Nexus 7) devices which
+are using BCM4329 and BCM4330 WiFi chips respectively.
+
+Signed-off-by: Dmitry Osipenko <digetx@gmail.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c  | 10 +++++-----
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.h    |  1 -
+ 2 files changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c
+@@ -120,7 +120,7 @@ int brcmf_sdiod_intr_register(struct brc
+ 			brcmf_err("enable_irq_wake failed %d\n", ret);
+ 			return ret;
+ 		}
+-		sdiodev->irq_wake = true;
++		disable_irq_wake(pdata->oob_irq_nr);
+ 
+ 		sdio_claim_host(sdiodev->func1);
+ 
+@@ -179,10 +179,6 @@ void brcmf_sdiod_intr_unregister(struct
+ 		sdio_release_host(sdiodev->func1);
+ 
+ 		sdiodev->oob_irq_requested = false;
+-		if (sdiodev->irq_wake) {
+-			disable_irq_wake(pdata->oob_irq_nr);
+-			sdiodev->irq_wake = false;
+-		}
+ 		free_irq(pdata->oob_irq_nr, &sdiodev->func1->dev);
+ 		sdiodev->irq_en = false;
+ 		sdiodev->oob_irq_requested = false;
+@@ -1162,6 +1158,10 @@ static int brcmf_ops_sdio_resume(struct
+ 		if (ret)
+ 			brcmf_err("Failed to probe device on resume\n");
+ 	} else {
++		if (sdiodev->wowl_enabled &&
++		    sdiodev->settings->bus.sdio.oob_irq_supported)
++			disable_irq_wake(sdiodev->settings->bus.sdio.oob_irq_nr);
++
+ 		brcmf_sdiod_freezer_off(sdiodev);
+ 	}
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -178,7 +178,6 @@ struct brcmf_sdio_dev {
+ 	bool sd_irq_requested;
+ 	bool irq_en;			/* irq enable flags */
+ 	spinlock_t irq_en_lock;
+-	bool irq_wake;			/* irq wake enable flags */
+ 	bool sg_support;
+ 	uint max_request_size;
+ 	ushort max_segment_count;

package/kernel/mac80211/patches/brcm/417-v5.6-brcmfmac-use-true-false-for-bool-variable.patch

@@ -0,0 +1,27 @@
+From b92c017deda819e45a0f054f6df6b53e645d7fe4 Mon Sep 17 00:00:00 2001
+From: zhengbin <zhengbin13@huawei.com>
+Date: Tue, 24 Dec 2019 22:16:06 +0800
+Subject: [PATCH] brcmfmac: use true,false for bool variable
+
+Fixes coccicheck warning:
+
+drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c:911:2-24: WARNING: Assignment of 0/1 to bool variable
+
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: zhengbin <zhengbin13@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c
+@@ -908,7 +908,7 @@ static u8 brcmf_fws_hdrpush(struct brcmf
+ 	wlh += wlh[1] + 2;
+ 
+ 	if (entry->send_tim_signal) {
+-		entry->send_tim_signal = 0;
++		entry->send_tim_signal = false;
+ 		wlh[0] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP;
+ 		wlh[1] = BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
+ 		wlh[2] = entry->mac_handle;

package/kernel/mac80211/patches/brcm/418-v5.6-brcmfmac-sdio-Fix-OOB-interrupt-initialization-on-br.patch

@@ -0,0 +1,57 @@
+From 8c8e60fb86a90a30721bbd797f58f96b3980dcc1 Mon Sep 17 00:00:00 2001
+From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Date: Thu, 26 Dec 2019 10:20:33 +0100
+Subject: [PATCH] brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362
+
+Commit 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling
+brcmf_bus_started()") changed the initialization order of the brcmfmac
+SDIO driver. Unfortunately since brcmf_sdiod_intr_register() is now
+called before the sdiodev->bus_if initialization, it reads the wrong
+chip ID and fails to initialize the GPIO on brcm43362. Thus the chip
+cannot send interrupts and fails to probe:
+
+[   12.517023] brcmfmac: brcmf_sdio_bus_rxctl: resumed on timeout
+[   12.531214] ieee80211 phy0: brcmf_bus_started: failed: -110
+[   12.536976] ieee80211 phy0: brcmf_attach: dongle is not responding: err=-110
+[   12.566467] brcmfmac: brcmf_sdio_firmware_callback: brcmf_attach failed
+
+Initialize the bus interface earlier to ensure that
+brcmf_sdiod_intr_register() properly sets up the OOB interrupt.
+
+BugLink: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=908438
+Fixes: 262f2b53f679 ("brcmfmac: call brcmf_attach() just before calling brcmf_bus_started()")
+Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../net/wireless/broadcom/brcm80211/brcmfmac/sdio.c  | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -4247,6 +4247,12 @@ static void brcmf_sdio_firmware_callback
+ 	}
+ 
+ 	if (err == 0) {
++		/* Assign bus interface call back */
++		sdiod->bus_if->dev = sdiod->dev;
++		sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
++		sdiod->bus_if->chip = bus->ci->chip;
++		sdiod->bus_if->chiprev = bus->ci->chiprev;
++
+ 		/* Allow full data communication using DPC from now on. */
+ 		brcmf_sdiod_change_state(bus->sdiodev, BRCMF_SDIOD_DATA);
+ 
+@@ -4263,12 +4269,6 @@ static void brcmf_sdio_firmware_callback
+ 
+ 	sdio_release_host(sdiod->func1);
+ 
+-	/* Assign bus interface call back */
+-	sdiod->bus_if->dev = sdiod->dev;
+-	sdiod->bus_if->ops = &brcmf_sdio_bus_ops;
+-	sdiod->bus_if->chip = bus->ci->chip;
+-	sdiod->bus_if->chiprev = bus->ci->chiprev;
+-
+ 	err = brcmf_alloc(sdiod->dev, sdiod->settings);
+ 	if (err) {
+ 		brcmf_err("brcmf_alloc failed\n");

package/kernel/mac80211/patches/brcm/419-v5.6-0001-brcmfmac-simplify-building-interface-combinations.patch

@@ -0,0 +1,103 @@
+From 24332f8068ff6df7f16aefee45d514de1de4de80 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 26 Dec 2019 14:30:49 +0100
+Subject: [PATCH] brcmfmac: simplify building interface combinations
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Move similar/duplicated code out of combination specific code blocks.
+This simplifies code a bit and allows adding more combinations later.
+A list of combinations remains unchanged.
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 43 ++++++-------------
+ 1 file changed, 14 insertions(+), 29 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -6471,12 +6471,13 @@ static int brcmf_setup_ifmodes(struct wi
+ 	struct ieee80211_iface_limit *c0_limits = NULL;
+ 	struct ieee80211_iface_limit *p2p_limits = NULL;
+ 	struct ieee80211_iface_limit *mbss_limits = NULL;
+-	bool mbss, p2p, rsdb;
++	bool mbss, p2p, rsdb, mchan;
+ 	int i, c, n_combos;
+ 
+ 	mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
+ 	p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
+ 	rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB);
++	mchan = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN);
+ 
+ 	n_combos = 1 + !!(p2p && !rsdb) + !!mbss;
+ 	combo = kcalloc(n_combos, sizeof(*combo), GFP_KERNEL);
+@@ -6486,6 +6487,10 @@ static int brcmf_setup_ifmodes(struct wi
+ 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+ 				 BIT(NL80211_IFTYPE_ADHOC) |
+ 				 BIT(NL80211_IFTYPE_AP);
++	if (p2p)
++		wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
++					  BIT(NL80211_IFTYPE_P2P_GO) |
++					  BIT(NL80211_IFTYPE_P2P_DEVICE);
+ 
+ 	c = 0;
+ 	i = 0;
+@@ -6497,48 +6502,28 @@ static int brcmf_setup_ifmodes(struct wi
+ 		c0_limits = kcalloc(2, sizeof(*c0_limits), GFP_KERNEL);
+ 	if (!c0_limits)
+ 		goto err;
+-	if (p2p && rsdb) {
+-		combo[c].num_different_channels = 2;
+-		wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
+-					  BIT(NL80211_IFTYPE_P2P_GO) |
+-					  BIT(NL80211_IFTYPE_P2P_DEVICE);
+-		c0_limits[i].max = 2;
+-		c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
++
++	combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan));
++	c0_limits[i].max = 1 + rsdb;
++	c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
++	if (p2p) {
+ 		c0_limits[i].max = 1;
+ 		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
+-		c0_limits[i].max = 2;
++		c0_limits[i].max = 1 + rsdb;
+ 		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
+ 				       BIT(NL80211_IFTYPE_P2P_GO);
++	}
++	if (p2p && rsdb) {
+ 		c0_limits[i].max = 2;
+ 		c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
+ 		combo[c].max_interfaces = 5;
+ 	} else if (p2p) {
+-		if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MCHAN))
+-			combo[c].num_different_channels = 2;
+-		else
+-			combo[c].num_different_channels = 1;
+-		c0_limits[i].max = 1;
+-		c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
+-		wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
+-					  BIT(NL80211_IFTYPE_P2P_GO) |
+-					  BIT(NL80211_IFTYPE_P2P_DEVICE);
+-		c0_limits[i].max = 1;
+-		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
+-		c0_limits[i].max = 1;
+-		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
+-				       BIT(NL80211_IFTYPE_P2P_GO);
+ 		combo[c].max_interfaces = i;
+ 	} else if (rsdb) {
+-		combo[c].num_different_channels = 2;
+-		c0_limits[i].max = 2;
+-		c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
+ 		c0_limits[i].max = 2;
+ 		c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
+ 		combo[c].max_interfaces = 3;
+ 	} else {
+-		combo[c].num_different_channels = 1;
+-		c0_limits[i].max = 1;
+-		c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
+ 		c0_limits[i].max = 1;
+ 		c0_limits[i++].types = BIT(NL80211_IFTYPE_AP);
+ 		combo[c].max_interfaces = i;

package/kernel/mac80211/patches/brcm/419-v5.6-0002-brcmfmac-add-initial-support-for-monitor-mode.patch

@@ -0,0 +1,345 @@
+From 20f2c5fa3af060401c72e444999470a4cab641cf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
+Date: Thu, 26 Dec 2019 14:30:50 +0100
+Subject: [PATCH] brcmfmac: add initial support for monitor mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Report monitor interface availability using cfg80211 and support it in
+the add_virtual_intf() and del_virtual_intf() callbacks. This new
+feature is conditional and depends on firmware flagging monitor packets.
+Receiving monitor frames is already handled by the brcmf_netif_mon_rx().
+
+Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 112 ++++++++++++++++--
+ .../broadcom/brcm80211/brcmfmac/core.c        |  68 ++++++++++-
+ .../broadcom/brcm80211/brcmfmac/core.h        |   2 +
+ .../broadcom/brcm80211/brcmfmac/feature.c     |   1 +
+ .../broadcom/brcm80211/brcmfmac/feature.h     |   2 +
+ .../broadcom/brcm80211/brcmfmac/fwil.h        |   2 +
+ 6 files changed, 174 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -11,6 +11,7 @@
+ #include <linux/vmalloc.h>
+ #include <net/cfg80211.h>
+ #include <net/netlink.h>
++#include <uapi/linux/if_arp.h>
+ 
+ #include <brcmu_utils.h>
+ #include <defs.h>
+@@ -619,6 +620,82 @@ static bool brcmf_is_ibssmode(struct brc
+ 	return vif->wdev.iftype == NL80211_IFTYPE_ADHOC;
+ }
+ 
++/**
++ * brcmf_mon_add_vif() - create monitor mode virtual interface
++ *
++ * @wiphy: wiphy device of new interface.
++ * @name: name of the new interface.
++ */
++static struct wireless_dev *brcmf_mon_add_vif(struct wiphy *wiphy,
++					      const char *name)
++{
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct brcmf_cfg80211_vif *vif;
++	struct net_device *ndev;
++	struct brcmf_if *ifp;
++	int err;
++
++	if (cfg->pub->mon_if) {
++		err = -EEXIST;
++		goto err_out;
++	}
++
++	vif = brcmf_alloc_vif(cfg, NL80211_IFTYPE_MONITOR);
++	if (IS_ERR(vif)) {
++		err = PTR_ERR(vif);
++		goto err_out;
++	}
++
++	ndev = alloc_netdev(sizeof(*ifp), name, NET_NAME_UNKNOWN, ether_setup);
++	if (!ndev) {
++		err = -ENOMEM;
++		goto err_free_vif;
++	}
++	ndev->type = ARPHRD_IEEE80211_RADIOTAP;
++	ndev->ieee80211_ptr = &vif->wdev;
++	ndev->needs_free_netdev = true;
++	ndev->priv_destructor = brcmf_cfg80211_free_netdev;
++	SET_NETDEV_DEV(ndev, wiphy_dev(cfg->wiphy));
++
++	ifp = netdev_priv(ndev);
++	ifp->vif = vif;
++	ifp->ndev = ndev;
++	ifp->drvr = cfg->pub;
++
++	vif->ifp = ifp;
++	vif->wdev.netdev = ndev;
++
++	err = brcmf_net_mon_attach(ifp);
++	if (err) {
++		brcmf_err("Failed to attach %s device\n", ndev->name);
++		free_netdev(ndev);
++		goto err_free_vif;
++	}
++
++	cfg->pub->mon_if = ifp;
++
++	return &vif->wdev;
++
++err_free_vif:
++	brcmf_free_vif(vif);
++err_out:
++	return ERR_PTR(err);
++}
++
++static int brcmf_mon_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
++{
++	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
++	struct net_device *ndev = wdev->netdev;
++
++	ndev->netdev_ops->ndo_stop(ndev);
++
++	brcmf_net_detach(ndev, true);
++
++	cfg->pub->mon_if = NULL;
++
++	return 0;
++}
++
+ static struct wireless_dev *brcmf_cfg80211_add_iface(struct wiphy *wiphy,
+ 						     const char *name,
+ 						     unsigned char name_assign_type,
+@@ -641,9 +718,10 @@ static struct wireless_dev *brcmf_cfg802
+ 	case NL80211_IFTYPE_STATION:
+ 	case NL80211_IFTYPE_AP_VLAN:
+ 	case NL80211_IFTYPE_WDS:
+-	case NL80211_IFTYPE_MONITOR:
+ 	case NL80211_IFTYPE_MESH_POINT:
+ 		return ERR_PTR(-EOPNOTSUPP);
++	case NL80211_IFTYPE_MONITOR:
++		return brcmf_mon_add_vif(wiphy, name);
+ 	case NL80211_IFTYPE_AP:
+ 		wdev = brcmf_ap_add_vif(wiphy, name, params);
+ 		break;
+@@ -826,9 +904,10 @@ int brcmf_cfg80211_del_iface(struct wiph
+ 	case NL80211_IFTYPE_STATION:
+ 	case NL80211_IFTYPE_AP_VLAN:
+ 	case NL80211_IFTYPE_WDS:
+-	case NL80211_IFTYPE_MONITOR:
+ 	case NL80211_IFTYPE_MESH_POINT:
+ 		return -EOPNOTSUPP;
++	case NL80211_IFTYPE_MONITOR:
++		return brcmf_mon_del_vif(wiphy, wdev);
+ 	case NL80211_IFTYPE_AP:
+ 		return brcmf_cfg80211_del_ap_iface(wiphy, wdev);
+ 	case NL80211_IFTYPE_P2P_CLIENT:
+@@ -6471,9 +6550,10 @@ static int brcmf_setup_ifmodes(struct wi
+ 	struct ieee80211_iface_limit *c0_limits = NULL;
+ 	struct ieee80211_iface_limit *p2p_limits = NULL;
+ 	struct ieee80211_iface_limit *mbss_limits = NULL;
+-	bool mbss, p2p, rsdb, mchan;
+-	int i, c, n_combos;
++	bool mon_flag, mbss, p2p, rsdb, mchan;
++	int i, c, n_combos, n_limits;
+ 
++	mon_flag = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MONITOR_FLAG);
+ 	mbss = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS);
+ 	p2p = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_P2P);
+ 	rsdb = brcmf_feat_is_enabled(ifp, BRCMF_FEAT_RSDB);
+@@ -6487,6 +6567,8 @@ static int brcmf_setup_ifmodes(struct wi
+ 	wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+ 				 BIT(NL80211_IFTYPE_ADHOC) |
+ 				 BIT(NL80211_IFTYPE_AP);
++	if (mon_flag)
++		wiphy->interface_modes |= BIT(NL80211_IFTYPE_MONITOR);
+ 	if (p2p)
+ 		wiphy->interface_modes |= BIT(NL80211_IFTYPE_P2P_CLIENT) |
+ 					  BIT(NL80211_IFTYPE_P2P_GO) |
+@@ -6494,18 +6576,18 @@ static int brcmf_setup_ifmodes(struct wi
+ 
+ 	c = 0;
+ 	i = 0;
+-	if (p2p && rsdb)
+-		c0_limits = kcalloc(4, sizeof(*c0_limits), GFP_KERNEL);
+-	else if (p2p)
+-		c0_limits = kcalloc(3, sizeof(*c0_limits), GFP_KERNEL);
+-	else
+-		c0_limits = kcalloc(2, sizeof(*c0_limits), GFP_KERNEL);
++	n_limits = 1 + mon_flag + (p2p ? 2 : 0) + (rsdb || !p2p);
++	c0_limits = kcalloc(n_limits, sizeof(*c0_limits), GFP_KERNEL);
+ 	if (!c0_limits)
+ 		goto err;
+ 
+ 	combo[c].num_different_channels = 1 + (rsdb || (p2p && mchan));
+ 	c0_limits[i].max = 1 + rsdb;
+ 	c0_limits[i++].types = BIT(NL80211_IFTYPE_STATION);
++	if (mon_flag) {
++		c0_limits[i].max = 1;
++		c0_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
++	}
+ 	if (p2p) {
+ 		c0_limits[i].max = 1;
+ 		c0_limits[i++].types = BIT(NL80211_IFTYPE_P2P_DEVICE);
+@@ -6554,14 +6636,20 @@ static int brcmf_setup_ifmodes(struct wi
+ 	if (mbss) {
+ 		c++;
+ 		i = 0;
+-		mbss_limits = kcalloc(1, sizeof(*mbss_limits), GFP_KERNEL);
++		n_limits = 1 + mon_flag;
++		mbss_limits = kcalloc(n_limits, sizeof(*mbss_limits),
++				      GFP_KERNEL);
+ 		if (!mbss_limits)
+ 			goto err;
+ 		mbss_limits[i].max = 4;
+ 		mbss_limits[i++].types = BIT(NL80211_IFTYPE_AP);
++		if (mon_flag) {
++			mbss_limits[i].max = 1;
++			mbss_limits[i++].types = BIT(NL80211_IFTYPE_MONITOR);
++		}
+ 		combo[c].beacon_int_infra_match = true;
+ 		combo[c].num_different_channels = 1;
+-		combo[c].max_interfaces = 4;
++		combo[c].max_interfaces = 4 + mon_flag;
+ 		combo[c].n_limits = i;
+ 		combo[c].limits = mbss_limits;
+ 	}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -690,7 +690,7 @@ fail:
+ 	return -EBADE;
+ }
+ 
+-static void brcmf_net_detach(struct net_device *ndev, bool rtnl_locked)
++void brcmf_net_detach(struct net_device *ndev, bool rtnl_locked)
+ {
+ 	if (ndev->reg_state == NETREG_REGISTERED) {
+ 		if (rtnl_locked)
+@@ -703,6 +703,72 @@ static void brcmf_net_detach(struct net_
+ 	}
+ }
+ 
++static int brcmf_net_mon_open(struct net_device *ndev)
++{
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++	u32 monitor;
++	int err;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	err = brcmf_fil_cmd_int_get(ifp, BRCMF_C_GET_MONITOR, &monitor);
++	if (err) {
++		bphy_err(drvr, "BRCMF_C_GET_MONITOR error (%d)\n", err);
++		return err;
++	} else if (monitor) {
++		bphy_err(drvr, "Monitor mode is already enabled\n");
++		return -EEXIST;
++	}
++
++	monitor = 3;
++	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_MONITOR, monitor);
++	if (err)
++		bphy_err(drvr, "BRCMF_C_SET_MONITOR error (%d)\n", err);
++
++	return err;
++}
++
++static int brcmf_net_mon_stop(struct net_device *ndev)
++{
++	struct brcmf_if *ifp = netdev_priv(ndev);
++	struct brcmf_pub *drvr = ifp->drvr;
++	u32 monitor;
++	int err;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	monitor = 0;
++	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_MONITOR, monitor);
++	if (err)
++		bphy_err(drvr, "BRCMF_C_SET_MONITOR error (%d)\n", err);
++
++	return err;
++}
++
++static const struct net_device_ops brcmf_netdev_ops_mon = {
++	.ndo_open = brcmf_net_mon_open,
++	.ndo_stop = brcmf_net_mon_stop,
++};
++
++int brcmf_net_mon_attach(struct brcmf_if *ifp)
++{
++	struct brcmf_pub *drvr = ifp->drvr;
++	struct net_device *ndev;
++	int err;
++
++	brcmf_dbg(TRACE, "Enter\n");
++
++	ndev = ifp->ndev;
++	ndev->netdev_ops = &brcmf_netdev_ops_mon;
++
++	err = register_netdevice(ndev);
++	if (err)
++		bphy_err(drvr, "Failed to register %s device\n", ndev->name);
++
++	return err;
++}
++
+ void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on)
+ {
+ 	struct net_device *ndev;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.h
+@@ -210,6 +210,8 @@ void brcmf_txflowblock_if(struct brcmf_i
+ void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success);
+ void brcmf_netif_rx(struct brcmf_if *ifp, struct sk_buff *skb);
+ void brcmf_netif_mon_rx(struct brcmf_if *ifp, struct sk_buff *skb);
++void brcmf_net_detach(struct net_device *ndev, bool rtnl_locked);
++int brcmf_net_mon_attach(struct brcmf_if *ifp);
+ void brcmf_net_setcarrier(struct brcmf_if *ifp, bool on);
+ int __init brcmf_core_init(void);
+ void __exit brcmf_core_exit(void);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.c
+@@ -38,6 +38,7 @@ static const struct brcmf_feat_fwcap brc
+ 	{ BRCMF_FEAT_MCHAN, "mchan" },
+ 	{ BRCMF_FEAT_P2P, "p2p" },
+ 	{ BRCMF_FEAT_MONITOR, "monitor" },
++	{ BRCMF_FEAT_MONITOR_FLAG, "rtap" },
+ 	{ BRCMF_FEAT_MONITOR_FMT_RADIOTAP, "rtap" },
+ 	{ BRCMF_FEAT_DOT11H, "802.11h" }
+ };
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/feature.h
+@@ -23,6 +23,7 @@
+  * GSCAN: enhanced scan offload feature.
+  * FWSUP: Firmware supplicant.
+  * MONITOR: firmware can pass monitor packets to host.
++ * MONITOR_FLAG: firmware flags monitor packets.
+  * MONITOR_FMT_RADIOTAP: firmware provides monitor packets with radiotap header
+  * MONITOR_FMT_HW_RX_HDR: firmware provides monitor packets with hw/ucode header
+  * DOT11H: firmware supports 802.11h
+@@ -43,6 +44,7 @@
+ 	BRCMF_FEAT_DEF(GSCAN) \
+ 	BRCMF_FEAT_DEF(FWSUP) \
+ 	BRCMF_FEAT_DEF(MONITOR) \
++	BRCMF_FEAT_DEF(MONITOR_FLAG) \
+ 	BRCMF_FEAT_DEF(MONITOR_FMT_RADIOTAP) \
+ 	BRCMF_FEAT_DEF(MONITOR_FMT_HW_RX_HDR) \
+ 	BRCMF_FEAT_DEF(DOT11H)
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil.h
+@@ -49,6 +49,8 @@
+ #define BRCMF_C_GET_PM				85
+ #define BRCMF_C_SET_PM				86
+ #define BRCMF_C_GET_REVINFO			98
++#define BRCMF_C_GET_MONITOR			107
++#define BRCMF_C_SET_MONITOR			108
+ #define BRCMF_C_GET_CURR_RATESET		114
+ #define BRCMF_C_GET_AP				117
+ #define BRCMF_C_SET_AP				118

package/kernel/mac80211/patches/brcm/420-v5.6-brcmfmac-Remove-always-false-idx-0-statement.patch

@@ -0,0 +1,24 @@
+From 627b0d094240c38393b2f2d40626c33a8fff6103 Mon Sep 17 00:00:00 2001
+From: yuehaibing <yuehaibing@huawei.com>
+Date: Wed, 8 Jan 2020 21:57:48 +0800
+Subject: [PATCH] brcmfmac: Remove always false 'idx < 0' statement
+
+idx is declared as u32, it will never less than 0.
+
+Signed-off-by: yuehaibing <yuehaibing@huawei.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
+@@ -365,7 +365,7 @@ brcmf_msgbuf_get_pktid(struct device *de
+ 	struct brcmf_msgbuf_pktid *pktid;
+ 	struct sk_buff *skb;
+ 
+-	if (idx < 0 || idx >= pktids->array_size) {
++	if (idx >= pktids->array_size) {
+ 		brcmf_err("Invalid packet id %d (max %d)\n", idx,
+ 			  pktids->array_size);
+ 		return NULL;

package/kernel/mac80211/patches/brcm/860-brcmfmac-register-wiphy-s-during-module_init.patch

@@ -13,7 +13,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1479,6 +1479,7 @@ int __init brcmf_core_init(void)
+@@ -1545,6 +1545,7 @@ int __init brcmf_core_init(void)
  {
  	if (!schedule_work(&brcmf_driver_work))
  		return -EBUSY;

package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch

@@ -10,7 +10,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -628,8 +628,36 @@ static struct wireless_dev *brcmf_cfg802
+@@ -705,8 +705,36 @@ static struct wireless_dev *brcmf_cfg802
  	struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  	struct brcmf_pub *drvr = cfg->pub;
  	struct wireless_dev *wdev;

package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch

@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -2787,6 +2787,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+@@ -2866,6 +2866,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
  	 * preference in cfg struct to apply this to
  	 * FW later while initializing the dongle
  	 */

package/kernel/mac80211/patches/rt2x00/020-cfg80211-add-ratelimited-variants-of-err-and-warn.patch

@@ -25,7 +25,7 @@ Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -6612,6 +6612,11 @@ bool cfg80211_iftype_allowed(struct wiph
+@@ -6627,6 +6627,11 @@ bool cfg80211_iftype_allowed(struct wiph
  #define wiphy_info(wiphy, format, args...)			\
  	dev_info(&(wiphy)->dev, format, ##args)
  

package/kernel/mac80211/patches/subsys/210-ap_scan.patch

@@ -1,6 +1,6 @@
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2238,7 +2238,7 @@ static int ieee80211_scan(struct wiphy *
+@@ -2188,7 +2188,7 @@ static int ieee80211_scan(struct wiphy *
  		 * the  frames sent while scanning on other channel will be
  		 * lost)
  		 */

package/kernel/mac80211/patches/subsys/303-mac80211-minstrel-Enable-STBC-and-LDPC-for-VHT-Rates.patch

@@ -20,16 +20,15 @@ Signed-off-by: Chaitanya TK <chaitanya.mgit@gmail.com>
  #define IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT                  13
 --- a/net/mac80211/rc80211_minstrel_ht.c
 +++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1130,7 +1130,7 @@ minstrel_ht_update_caps(void *priv, stru
+@@ -1136,13 +1136,14 @@ minstrel_ht_update_caps(void *priv, stru
  	struct minstrel_ht_sta_priv *msp = priv_sta;
  	struct minstrel_ht_sta *mi = &msp->ht;
  	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
 -	u16 sta_cap = sta->ht_cap.cap;
 +	u16 ht_cap = sta->ht_cap.cap;
  	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
- 	struct sta_info *sinfo = container_of(sta, struct sta_info, sta);
  	int use_vht;
-@@ -1138,6 +1138,7 @@ minstrel_ht_update_caps(void *priv, stru
+ 	int n_supported = 0;
  	int ack_dur;
  	int stbc;
  	int i;
@@ -37,7 +36,7 @@ Signed-off-by: Chaitanya TK <chaitanya.mgit@gmail.com>
  
  	/* fall back to the old minstrel for legacy stations */
  	if (!sta->ht_cap.ht_supported)
-@@ -1175,16 +1176,24 @@ minstrel_ht_update_caps(void *priv, stru
+@@ -1180,16 +1181,24 @@ minstrel_ht_update_caps(void *priv, stru
  	}
  	mi->sample_tries = 4;
  
@@ -67,7 +66,7 @@ Signed-off-by: Chaitanya TK <chaitanya.mgit@gmail.com>
  	for (i = 0; i < ARRAY_SIZE(mi->groups); i++) {
  		u32 gflags = minstrel_mcs_groups[i].flags;
  		int bw, nss;
-@@ -1197,10 +1206,10 @@ minstrel_ht_update_caps(void *priv, stru
+@@ -1202,10 +1211,10 @@ minstrel_ht_update_caps(void *priv, stru
  
  		if (gflags & IEEE80211_TX_RC_SHORT_GI) {
  			if (gflags & IEEE80211_TX_RC_40_MHZ_WIDTH) {

package/kernel/mac80211/patches/subsys/304-mac80211-minstrel-remove-unnecessary-debugfs-cleanup.patch

@@ -96,7 +96,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
 --- a/net/mac80211/rc80211_minstrel_ht.c
 +++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1393,7 +1393,6 @@ static const struct rate_control_ops mac
+@@ -1397,7 +1397,6 @@ static const struct rate_control_ops mac
  	.free = minstrel_ht_free,
  #ifdef CPTCFG_MAC80211_DEBUGFS
  	.add_sta_debugfs = minstrel_ht_add_sta_debugfs,

package/kernel/mac80211/patches/subsys/305-mac80211-minstrel-merge-with-minstrel_ht-always-enab.patch

@@ -388,7 +388,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  };
  
  static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
-@@ -1146,12 +1142,10 @@ minstrel_ht_update_caps(void *priv, stru
+@@ -1151,12 +1147,10 @@ minstrel_ht_update_caps(void *priv, stru
  
  	BUILD_BUG_ON(ARRAY_SIZE(minstrel_mcs_groups) != MINSTREL_GROUPS_NB);
  
@@ -402,7 +402,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	msp->is_ht = true;
  	memset(mi, 0, sizeof(*mi));
-@@ -1226,10 +1220,9 @@ minstrel_ht_update_caps(void *priv, stru
+@@ -1231,10 +1225,9 @@ minstrel_ht_update_caps(void *priv, stru
  
  		/* HT rate */
  		if (gflags & IEEE80211_TX_RC_MCS) {
@@ -414,7 +414,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			mi->supported[i] = mcs->rx_mask[nss - 1];
  			if (mi->supported[i])
  				n_supported++;
-@@ -1349,16 +1342,88 @@ minstrel_ht_free_sta(void *priv, struct
+@@ -1353,16 +1346,88 @@ minstrel_ht_free_sta(void *priv, struct
  	kfree(msp);
  }
  
@@ -505,7 +505,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  static u32 minstrel_ht_get_expected_throughput(void *priv_sta)
-@@ -1417,14 +1482,14 @@ static void __init init_sample_table(voi
+@@ -1421,14 +1486,14 @@ static void __init init_sample_table(voi
  }
  
  int __init

package/kernel/mac80211/patches/subsys/306-mac80211-minstrel-reduce-minstrel_mcs_groups-size.patch

@@ -118,7 +118,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 -#define CCK_GROUP					\
 +#define CCK_GROUP(_s)					\
  	[MINSTREL_CCK_GROUP] = {			\
- 		.streams = 0,				\
+ 		.streams = 1,				\
  		.flags = 0,				\
 +		.shift = _s,				\
  		.duration = {				\
@@ -218,7 +218,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  };
  
  static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES] __read_mostly;
-@@ -307,7 +310,8 @@ minstrel_ht_get_tp_avg(struct minstrel_h
+@@ -308,7 +311,8 @@ minstrel_ht_get_tp_avg(struct minstrel_h
  	if (group != MINSTREL_CCK_GROUP)
  		nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
  
@@ -228,7 +228,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	/*
  	 * For the throughput calculation, limit the probability value to 90% to
-@@ -755,12 +759,19 @@ minstrel_ht_tx_status(void *priv, struct
+@@ -756,12 +760,19 @@ minstrel_ht_tx_status(void *priv, struct
  		minstrel_ht_update_rates(mp, mi);
  }
  
@@ -249,7 +249,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	unsigned int tx_time, tx_time_rtscts, tx_time_data;
  	unsigned int cw = mp->cw_min;
  	unsigned int ctime = 0;
-@@ -779,8 +790,7 @@ minstrel_calc_retransmit(struct minstrel
+@@ -780,8 +791,7 @@ minstrel_calc_retransmit(struct minstrel
  	mrs->retry_count_rtscts = 2;
  	mrs->retry_updated = true;
  
@@ -259,7 +259,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	/* Contention time for first 2 tries */
  	ctime = (t_slot * cw) >> 1;
-@@ -874,20 +884,24 @@ minstrel_ht_get_max_amsdu_len(struct min
+@@ -875,20 +885,24 @@ minstrel_ht_get_max_amsdu_len(struct min
  	int group = mi->max_prob_rate / MCS_GROUP_RATES;
  	const struct mcs_group *g = &minstrel_mcs_groups[group];
  	int rate = mi->max_prob_rate % MCS_GROUP_RATES;
@@ -286,7 +286,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		return 1600;
  
  	/*
-@@ -895,7 +909,7 @@ minstrel_ht_get_max_amsdu_len(struct min
+@@ -896,7 +910,7 @@ minstrel_ht_get_max_amsdu_len(struct min
  	 * rate success probability is less than 75%, limit A-MSDU to twice the usual
  	 * data packet size
  	 */
@@ -295,7 +295,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	    (minstrel_ht_get_prob_ewma(mi, mi->max_tp_rate[0]) <
  	     MINSTREL_FRAC(75, 100)))
  		return 3200;
-@@ -942,13 +956,6 @@ minstrel_ht_update_rates(struct minstrel
+@@ -943,13 +957,6 @@ minstrel_ht_update_rates(struct minstrel
  	rate_control_set_rates(mp->hw, mi->sta, rates);
  }
  

package/kernel/mac80211/patches/subsys/307-mac80211-minstrel-fix-using-short-preamble-CCK-rates.patch

@@ -1,31 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 10 Feb 2018 13:43:07 +0100
-Subject: [PATCH] mac80211: minstrel: fix using short preamble CCK rates on
- HT clients
-
-mi->supported[MINSTREL_CCK_GROUP] needs to be updated
-
-Fixes: 782dda00ab8e ("mac80211: minstrel_ht: move short preamble check out of get_rate")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -1135,7 +1135,6 @@ minstrel_ht_update_caps(void *priv, stru
- 	struct ieee80211_mcs_info *mcs = &sta->ht_cap.mcs;
- 	u16 ht_cap = sta->ht_cap.cap;
- 	struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
--	struct sta_info *sinfo = container_of(sta, struct sta_info, sta);
- 	int use_vht;
- 	int n_supported = 0;
- 	int ack_dur;
-@@ -1267,8 +1266,7 @@ minstrel_ht_update_caps(void *priv, stru
- 	if (!n_supported)
- 		goto use_legacy;
- 
--	if (test_sta_flag(sinfo, WLAN_STA_SHORT_PREAMBLE))
--		mi->cck_supported_short |= mi->cck_supported_short << 4;
-+	mi->supported[MINSTREL_CCK_GROUP] |= mi->cck_supported_short << 4;
- 
- 	/* create an initial rate table with the lowest supported rates */
- 	minstrel_ht_update_stats(mp, mi);

package/kernel/mac80211/patches/subsys/308-mac80211-minstrel-fix-CCK-rate-group-streams-value.patch

@@ -1,20 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 1 Mar 2018 13:27:54 +0100
-Subject: [PATCH] mac80211: minstrel: fix CCK rate group streams value
-
-Fixes a harmless underflow issue when CCK rates are actively being used
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -131,7 +131,7 @@
- 
- #define CCK_GROUP(_s)					\
- 	[MINSTREL_CCK_GROUP] = {			\
--		.streams = 0,				\
-+		.streams = 1,				\
- 		.flags = 0,				\
- 		.shift = _s,				\
- 		.duration = {				\

package/kernel/mac80211/patches/subsys/309-mac80211-minstrel-fix-sampling-reporting-of-CCK-rate.patch

@@ -1,58 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 1 Mar 2018 13:28:48 +0100
-Subject: [PATCH] mac80211: minstrel: fix sampling/reporting of CCK rates
- in HT mode
-
-Long/short preamble selection cannot be sampled separately, since it
-depends on the BSS state. Because of that, sampling attempts to
-currently not used preamble modes are not counted in the statistics,
-which leads to CCK rates being sampled too often.
-
-Fix statistics accounting for long/short preamble by increasing the
-index where necessary.
-Fix excessive CCK rate sampling by dropping unsupported sample attempts.
-
-This improves throughput on 2.4 GHz channels
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/rc80211_minstrel_ht.c
-+++ b/net/mac80211/rc80211_minstrel_ht.c
-@@ -281,7 +281,8 @@ minstrel_ht_get_stats(struct minstrel_pr
- 				break;
- 
- 		/* short preamble */
--		if (!(mi->supported[group] & BIT(idx)))
-+		if ((mi->supported[group] & BIT(idx + 4)) &&
-+		    (rate->flags & IEEE80211_TX_RC_USE_SHORT_PREAMBLE))
- 			idx += 4;
- 	}
- 	return &mi->groups[group].rates[idx];
-@@ -1080,18 +1081,23 @@ minstrel_ht_get_rate(void *priv, struct
- 		return;
- 
- 	sample_group = &minstrel_mcs_groups[sample_idx / MCS_GROUP_RATES];
-+	sample_idx %= MCS_GROUP_RATES;
-+
-+	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP] &&
-+	    (sample_idx >= 4) != txrc->short_preamble)
-+		return;
-+
- 	info->flags |= IEEE80211_TX_CTL_RATE_CTRL_PROBE;
- 	rate->count = 1;
- 
--	if (sample_idx / MCS_GROUP_RATES == MINSTREL_CCK_GROUP) {
-+	if (sample_group == &minstrel_mcs_groups[MINSTREL_CCK_GROUP]) {
- 		int idx = sample_idx % ARRAY_SIZE(mp->cck_rates);
- 		rate->idx = mp->cck_rates[idx];
- 	} else if (sample_group->flags & IEEE80211_TX_RC_VHT_MCS) {
- 		ieee80211_rate_set_vht(rate, sample_idx % MCS_GROUP_RATES,
- 				       sample_group->streams);
- 	} else {
--		rate->idx = sample_idx % MCS_GROUP_RATES +
--			    (sample_group->streams - 1) * 8;
-+		rate->idx = sample_idx + (sample_group->streams - 1) * 8;
- 	}
- 
- 	rate->flags = sample_group->flags;

package/kernel/mac80211/patches/subsys/322-mac80211-Add-airtime-accounting-and-scheduling-to-TX.patch

@@ -125,7 +125,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
   * The values are not guaranteed to be coherent with regard to each other, i.e.
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1434,6 +1434,9 @@ static int sta_apply_parameters(struct i
+@@ -1390,6 +1390,9 @@ static int sta_apply_parameters(struct i
  	if (ieee80211_vif_is_mesh(&sdata->vif))
  		sta_apply_mesh_params(local, sta, params);
  
@@ -330,7 +330,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  int sta_info_move_state(struct sta_info *sta,
  			enum ieee80211_sta_state new_state)
  {
-@@ -2183,6 +2204,23 @@ void sta_set_sinfo(struct sta_info *sta,
+@@ -2187,6 +2208,23 @@ void sta_set_sinfo(struct sta_info *sta,
  		sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
  	}
  

package/kernel/mac80211/patches/subsys/522-mac80211_configure_antenna_gain.patch

@@ -57,7 +57,7 @@
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -2506,6 +2506,19 @@ static int ieee80211_get_tx_power(struct
+@@ -2456,6 +2456,19 @@ static int ieee80211_get_tx_power(struct
  	return 0;
  }
  
@@ -77,7 +77,7 @@
  static int ieee80211_set_wds_peer(struct wiphy *wiphy, struct net_device *dev,
  				  const u8 *addr)
  {
-@@ -3873,6 +3886,7 @@ const struct cfg80211_ops mac80211_confi
+@@ -3823,6 +3836,7 @@ const struct cfg80211_ops mac80211_confi
  	.set_wiphy_params = ieee80211_set_wiphy_params,
  	.set_tx_power = ieee80211_set_tx_power,
  	.get_tx_power = ieee80211_get_tx_power,

package/libs/libubox/Makefile

@@ -5,9 +5,9 @@ PKG_RELEASE=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/libubox.git
-PKG_MIRROR_HASH:=90511058f49a178a816d520944cddba421f9eb50c319ef1623bed7aa22f94a3a
-PKG_SOURCE_DATE:=2019-12-28
-PKG_SOURCE_VERSION:=cd75136b1342e1e9dabf921be13240c6653640ed
+PKG_MIRROR_HASH:=f3b5c23280016bbe4b825de81cd455507ca817f599c5cd9f888370d9a33f6c9e
+PKG_SOURCE_DATE:=2020-02-27
+PKG_SOURCE_VERSION:=7da66430de3fc235bfc6ebb0b85fb90ea246138d
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=ISC

package/libs/mbedtls/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mbedtls
-PKG_VERSION:=2.16.3
+PKG_VERSION:=2.16.4
 PKG_RELEASE:=1
 PKG_USE_MIPS16:=0
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-gpl.tgz
 PKG_SOURCE_URL:=https://tls.mbed.org/download/
-PKG_HASH:=fd01fe4b289116df7781d05e1ef712b6c98823c5334f4a27404f13a8d066ef6a
+PKG_HASH:=5fdb9c43ab43fd9bcc3631508170b089ede7b86dd655253a93cb0ffeb42309f3
 
 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPL-2.0+

package/libs/mbedtls/patches/200-config.patch

@@ -17,7 +17,7 @@
  
  /**
   * \def MBEDTLS_CIPHER_NULL_CIPHER
-@@ -750,19 +750,19 @@
+@@ -757,19 +757,19 @@
   *
   * Comment macros to disable the curve and functions for it
   */
@@ -46,7 +46,7 @@
  
  /**
   * \def MBEDTLS_ECP_NIST_OPTIM
-@@ -864,7 +864,7 @@
+@@ -871,7 +871,7 @@
   *             See dhm.h for more details.
   *
   */
@@ -55,7 +55,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
-@@ -884,7 +884,7 @@
+@@ -891,7 +891,7 @@
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
   */
@@ -64,7 +64,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
-@@ -909,7 +909,7 @@
+@@ -916,7 +916,7 @@
   *      MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
   *      MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
   */
@@ -73,7 +73,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
-@@ -1043,7 +1043,7 @@
+@@ -1050,7 +1050,7 @@
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
   */
@@ -82,7 +82,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
-@@ -1067,7 +1067,7 @@
+@@ -1074,7 +1074,7 @@
   *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
   */
@@ -91,7 +91,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
-@@ -1171,7 +1171,7 @@
+@@ -1178,7 +1178,7 @@
   * This option is only useful if both MBEDTLS_SHA256_C and
   * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
   */
@@ -100,7 +100,7 @@
  
  /**
   * \def MBEDTLS_ENTROPY_NV_SEED
-@@ -1266,14 +1266,14 @@
+@@ -1273,14 +1273,14 @@
   * Uncomment this macro to disable the use of CRT in RSA.
   *
   */
@@ -117,7 +117,7 @@
  
  /**
   * \def MBEDTLS_SHA256_SMALLER
-@@ -1427,7 +1427,7 @@
+@@ -1434,7 +1434,7 @@
   *          configuration of this extension).
   *
   */
@@ -126,7 +126,7 @@
  
  /**
   * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
-@@ -1602,7 +1602,7 @@
+@@ -1609,7 +1609,7 @@
   *
   * Comment this macro to disable support for SSL session tickets
   */
@@ -135,7 +135,7 @@
  
  /**
   * \def MBEDTLS_SSL_EXPORT_KEYS
-@@ -1632,7 +1632,7 @@
+@@ -1639,7 +1639,7 @@
   *
   * Comment this macro to disable support for truncated HMAC in SSL
   */
@@ -144,7 +144,7 @@
  
  /**
   * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT
-@@ -1691,7 +1691,7 @@
+@@ -1698,7 +1698,7 @@
   *
   * Comment this to disable run-time checking and save ROM space
   */
@@ -153,7 +153,7 @@
  
  /**
   * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
-@@ -2021,7 +2021,7 @@
+@@ -2028,7 +2028,7 @@
   *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
   */
@@ -162,7 +162,7 @@
  
  /**
   * \def MBEDTLS_ARIA_C
-@@ -2087,7 +2087,7 @@
+@@ -2094,7 +2094,7 @@
   * This module enables the AES-CCM ciphersuites, if other requisites are
   * enabled as well.
   */
@@ -171,7 +171,7 @@
  
  /**
   * \def MBEDTLS_CERTS_C
-@@ -2099,7 +2099,7 @@
+@@ -2106,7 +2106,7 @@
   *
   * This module is used for testing (ssl_client/server).
   */
@@ -180,7 +180,7 @@
  
  /**
   * \def MBEDTLS_CHACHA20_C
-@@ -2203,7 +2203,7 @@
+@@ -2214,7 +2214,7 @@
   * \warning   DES is considered a weak cipher and its use constitutes a
   *            security risk. We recommend considering stronger ciphers instead.
   */
@@ -189,7 +189,7 @@
  
  /**
   * \def MBEDTLS_DHM_C
-@@ -2366,7 +2366,7 @@
+@@ -2377,7 +2377,7 @@
   * This module adds support for the Hashed Message Authentication Code
   * (HMAC)-based key derivation function (HKDF).
   */
@@ -198,7 +198,7 @@
  
  /**
   * \def MBEDTLS_HMAC_DRBG_C
-@@ -2676,7 +2676,7 @@
+@@ -2687,7 +2687,7 @@
   *
   * This module enables abstraction of common (libc) functions.
   */
@@ -207,7 +207,7 @@
  
  /**
   * \def MBEDTLS_POLY1305_C
-@@ -2697,7 +2697,7 @@
+@@ -2708,7 +2708,7 @@
   * Caller:  library/md.c
   *
   */
@@ -216,7 +216,7 @@
  
  /**
   * \def MBEDTLS_RSA_C
-@@ -2804,7 +2804,7 @@
+@@ -2815,7 +2815,7 @@
   *
   * Requires: MBEDTLS_CIPHER_C
   */
@@ -225,7 +225,7 @@
  
  /**
   * \def MBEDTLS_SSL_CLI_C
-@@ -2904,7 +2904,7 @@
+@@ -2915,7 +2915,7 @@
   *
   * This module provides run-time version information.
   */
@@ -234,7 +234,7 @@
  
  /**
   * \def MBEDTLS_X509_USE_C
-@@ -3014,7 +3014,7 @@
+@@ -3025,7 +3025,7 @@
   * Module:  library/xtea.c
   * Caller:
   */

package/network/services/hostapd/Makefile

@@ -7,7 +7,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_URL:=http://w1.fi/hostap.git
 PKG_SOURCE_PROTO:=git
@@ -86,9 +86,6 @@ DRIVER_MAKEOPTS= \
 	CONFIG_IEEE80211AC=$(HOSTAPD_IEEE80211AC) \
 	CONFIG_DRIVER_WEXT=$(CONFIG_DRIVER_WEXT_SUPPORT) \
 
-space :=
-space +=
-
 ifneq ($(LOCAL_VARIANT),mini)
   DRIVER_MAKEOPTS += CONFIG_IEEE80211W=$(CONFIG_DRIVER_11W_SUPPORT)
 endif

package/network/services/hostapd/files/hostapd.sh

@@ -704,12 +704,9 @@ wpa_supplicant_prepare_interface() {
 	local ap_scan=
 
 	_w_mode="$mode"
-	_w_modestr=
 
 	[[ "$mode" = adhoc ]] && {
 		ap_scan="ap_scan=2"
-
-		_w_modestr="mode=1"
 	}
 
 	local country_str=
@@ -790,6 +787,7 @@ wpa_supplicant_add_network() {
 	[[ "$_w_mode" = "adhoc" ]] && {
 		append network_data "mode=1" "$N$T"
 		[ -n "$freq" ] && wpa_supplicant_set_fixed_freq "$freq" "$htmode"
+		[ "$noscan" = "1" ] && append network_data "noscan=1" "$N$T"
 
 		scan_ssid="scan_ssid=0"
 
@@ -809,8 +807,6 @@ wpa_supplicant_add_network() {
 		scan_ssid=""
 	}
 
-	[ "$_w_mode" = "adhoc" -o "$_w_mode" = "mesh" ] && append network_data "$_w_modestr" "$N$T"
-
 	[ "$multi_ap" = 1 -a "$_w_mode" = "sta" ] && append network_data "multi_ap_backhaul_sta=1" "$N$T"
 
 	case "$auth_type" in

package/network/services/hostapd/patches/070-driver_nl80211-fix-WMM-queue-mapping-for-regulatory-.patch

@@ -0,0 +1,41 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 23 Jan 2020 13:50:47 +0100
+Subject: [PATCH] driver_nl80211: fix WMM queue mapping for regulatory
+ limit
+
+nl80211 uses a different queue mapping from hostap, so AC indexes need to
+be converted.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1403,6 +1403,12 @@ static void phy_info_freq(struct hostapd
+ 			[NL80211_WMMR_AIFSN] = { .type = NLA_U8 },
+ 			[NL80211_WMMR_TXOP] = { .type = NLA_U16 },
+ 		};
++		static const u8 wmm_map[4] = {
++			[NL80211_AC_BE] = WMM_AC_BE,
++			[NL80211_AC_BK] = WMM_AC_BK,
++			[NL80211_AC_VI] = WMM_AC_VI,
++			[NL80211_AC_VO] = WMM_AC_VO,
++		};
+ 		struct nlattr *nl_wmm;
+ 		struct nlattr *tb_wmm[NL80211_WMMR_MAX + 1];
+ 		int rem_wmm, ac, count = 0;
+@@ -1424,12 +1430,13 @@ static void phy_info_freq(struct hostapd
+ 				return;
+ 			}
+ 			ac = nl_wmm->nla_type;
+-			if (ac < 0 || ac >= WMM_AC_NUM) {
++			if (ac >= ARRAY_SIZE(wmm_map)) {
+ 				wpa_printf(MSG_DEBUG,
+ 					   "nl80211: Invalid AC value %d", ac);
+ 				return;
+ 			}
+ 
++			ac = wmm_map[ac];
+ 			chan->wmm_rules[ac].min_cwmin =
+ 				nla_get_u16(tb_wmm[NL80211_WMMR_CW_MIN]);
+ 			chan->wmm_rules[ac].min_cwmax =

package/network/services/hostapd/patches/071-driver_nl80211-fix-regulatory-limits-for-wmm-cwmin-c.patch

@@ -0,0 +1,47 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 23 Jan 2020 14:10:20 +0100
+Subject: [PATCH] driver_nl80211: fix regulatory limits for wmm cwmin/cwmax
+ values
+
+The internal WMM AC parameters use just the exponent of the CW value, while
+nl80211 reports the full CW value.
+This led to completely bogus CWmin/CWmax values in the WMM IE when a regulatory
+limit was present. Fix this by converting the value to the exponent before
+passing it on
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/src/drivers/driver_nl80211_capa.c
++++ b/src/drivers/driver_nl80211_capa.c
+@@ -1336,6 +1336,18 @@ static void phy_info_vht_capa(struct hos
+ 	}
+ }
+ 
++static inline int cw2ecw(unsigned int cw)
++{
++	int bit;
++
++	if (cw == 0)
++		return 0;
++
++	for (bit = 1; cw != 1; bit++)
++		cw >>= 1;
++
++	return bit;
++}
+ 
+ static void phy_info_freq(struct hostapd_hw_modes *mode,
+ 			  struct hostapd_channel_data *chan,
+@@ -1438,9 +1450,9 @@ static void phy_info_freq(struct hostapd
+ 
+ 			ac = wmm_map[ac];
+ 			chan->wmm_rules[ac].min_cwmin =
+-				nla_get_u16(tb_wmm[NL80211_WMMR_CW_MIN]);
++				cw2ecw(nla_get_u16(tb_wmm[NL80211_WMMR_CW_MIN]));
+ 			chan->wmm_rules[ac].min_cwmax =
+-				nla_get_u16(tb_wmm[NL80211_WMMR_CW_MAX]);
++				cw2ecw(nla_get_u16(tb_wmm[NL80211_WMMR_CW_MAX]));
+ 			chan->wmm_rules[ac].min_aifs =
+ 				nla_get_u8(tb_wmm[NL80211_WMMR_AIFSN]);
+ 			chan->wmm_rules[ac].max_txop =

package/network/services/ppp/Makefile

@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ppp
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/paulusmack/ppp

package/network/services/ppp/patches/700-radius-Prevent-buffer-overflow-in-rc_mksid.patch

@@ -0,0 +1,30 @@
+From 858976b1fc3107f1261aae337831959b511b83c2 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Sat, 4 Jan 2020 12:01:32 +1100
+Subject: [PATCH] radius: Prevent buffer overflow in rc_mksid()
+
+On some systems getpid() can return a value greater than 65535.
+Increase the size of buf[] to allow for this, and use slprintf()
+to make sure we never overflow it.
+
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+---
+ pppd/plugins/radius/util.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pppd/plugins/radius/util.c b/pppd/plugins/radius/util.c
+index 6f976a712951..740131e8377c 100644
+--- a/pppd/plugins/radius/util.c
++++ b/pppd/plugins/radius/util.c
+@@ -73,9 +73,9 @@ void rc_mdelay(int msecs)
+ char *
+ rc_mksid (void)
+ {
+-  static char buf[15];
++  static char buf[32];
+   static unsigned short int cnt = 0;
+-  sprintf (buf, "%08lX%04X%02hX",
++  slprintf(buf, sizeof(buf), "%08lX%04X%02hX",
+ 	   (unsigned long int) time (NULL),
+ 	   (unsigned int) getpid (),
+ 	   cnt & 0xFF);

package/network/services/ppp/patches/701-pppd-Fix-bounds-check-in-EAP-code.patch

@@ -0,0 +1,37 @@
+From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Mon, 3 Feb 2020 15:53:28 +1100
+Subject: [PATCH] pppd: Fix bounds check in EAP code
+
+Given that we have just checked vallen < len, it can never be the case
+that vallen >= len + sizeof(rhostname).  This fixes the check so we
+actually avoid overflowing the rhostname array.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+---
+ pppd/eap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pppd/eap.c b/pppd/eap.c
+index 94407f56a336..1b93db01aebd 100644
+--- a/pppd/eap.c
++++ b/pppd/eap.c
+@@ -1420,7 +1420,7 @@ int len;
+ 		}
+ 
+ 		/* Not so likely to happen. */
+-		if (vallen >= len + sizeof (rhostname)) {
++		if (len - vallen >= sizeof (rhostname)) {
+ 			dbglog("EAP: trimming really long peer name down");
+ 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
+ 			rhostname[sizeof (rhostname) - 1] = '\0';
+@@ -1846,7 +1846,7 @@ int len;
+ 		}
+ 
+ 		/* Not so likely to happen. */
+-		if (vallen >= len + sizeof (rhostname)) {
++		if (len - vallen >= sizeof (rhostname)) {
+ 			dbglog("EAP: trimming really long peer name down");
+ 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
+ 			rhostname[sizeof (rhostname) - 1] = '\0';

package/network/services/ppp/patches/702-pppd-Ignore-received-EAP-messages-when-not-doing-EAP.patch

@@ -0,0 +1,61 @@
+From 8d45443bb5c9372b4c6a362ba2f443d41c5636af Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Mon, 3 Feb 2020 16:31:42 +1100
+Subject: [PATCH] pppd: Ignore received EAP messages when not doing EAP
+
+This adds some basic checks to the subroutines of eap_input to check
+that we have requested or agreed to doing EAP authentication before
+doing any processing on the received packet.  The motivation is to
+make it harder for a malicious peer to disrupt the operation of pppd
+by sending unsolicited EAP packets.  Note that eap_success() already
+has a check that the EAP client state is reasonable, and does nothing
+(apart from possibly printing a debug message) if not.
+
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+---
+ pppd/eap.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/pppd/eap.c b/pppd/eap.c
+index 1b93db01aebd..082e95343120 100644
+--- a/pppd/eap.c
++++ b/pppd/eap.c
+@@ -1328,6 +1328,12 @@ int len;
+ 	int fd;
+ #endif /* USE_SRP */
+ 
++	/*
++	 * Ignore requests if we're not open
++	 */
++	if (esp->es_client.ea_state <= eapClosed)
++		return;
++
+ 	/*
+ 	 * Note: we update es_client.ea_id *only if* a Response
+ 	 * message is being generated.  Otherwise, we leave it the
+@@ -1736,6 +1742,12 @@ int len;
+ 	u_char dig[SHA_DIGESTSIZE];
+ #endif /* USE_SRP */
+ 
++	/*
++	 * Ignore responses if we're not open
++	 */
++	if (esp->es_server.ea_state <= eapClosed)
++		return;
++
+ 	if (esp->es_server.ea_id != id) {
+ 		dbglog("EAP: discarding Response %d; expected ID %d", id,
+ 		    esp->es_server.ea_id);
+@@ -2047,6 +2059,12 @@ u_char *inp;
+ int id;
+ int len;
+ {
++	/*
++	 * Ignore failure messages if we're not open
++	 */
++	if (esp->es_client.ea_state <= eapClosed)
++		return;
++
+ 	if (!eap_client_active(esp)) {
+ 		dbglog("EAP unexpected failure message in state %s (%d)",
+ 		    eap_state_name(esp->es_client.ea_state),

package/network/services/uhttpd/Makefile

@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git
-PKG_SOURCE_DATE:=2019-12-22
-PKG_SOURCE_VERSION:=5f9ae5738372aaa3a6be2f0a278933563d3f191a
-PKG_MIRROR_HASH:=16977c2d7e68f6db3241f874df625af9bd3bafa06fe4499ecb3561c825321e5d
+PKG_SOURCE_DATE:=2020-02-12
+PKG_SOURCE_VERSION:=2ee323c01079248baa9465969df9e25b5fb68cdf
+PKG_MIRROR_HASH:=ebec09286cf5f977cac893931a5a4f27ba891db88d5e44a9b0de9446ae431527
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=ISC
 

package/network/utils/ethtool/Makefile

@@ -23,7 +23,7 @@ PKG_FIXUP:=autoreconf
 PKG_INSTALL:=1
 PKG_BUILD_PARALLEL:=1
 
-PKG_CONFIG_DEPENDS:=ETHTOOL_PRETTY_DUMP
+PKG_CONFIG_DEPENDS:=CONFIG_ETHTOOL_PRETTY_DUMP
 
 include $(INCLUDE_DIR)/package.mk
 

package/system/fstools/Makefile

@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/fstools.git
-PKG_MIRROR_HASH:=7077c90f3938c7316ff7c8c353a178c4de61ef107b08b79209b93916a67c951d
-PKG_SOURCE_DATE:=2020-01-05
-PKG_SOURCE_VERSION:=823faa0f3edb93fac528bc35588cea81f0a77146
+PKG_MIRROR_HASH:=ca3cc1d4a2de3014e63ec1fa223c5250116c6ae5cdc4e41b2053ca7b3c0a3d96
+PKG_SOURCE_DATE:=2020-01-18
+PKG_SOURCE_VERSION:=189b41b6b48786a51eb2b8bc450cb7d560f030f0
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=GPL-2.0

package/system/opkg/Makefile

@@ -14,9 +14,9 @@ PKG_FLAGS:=essential
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://git.openwrt.org/project/opkg-lede.git
-PKG_SOURCE_DATE:=2019-06-14
-PKG_SOURCE_VERSION:=dcbc142e51f5f5f2fb9e4e44657e013d3c36a52b
-PKG_MIRROR_HASH:=fca7e71dd06f0d5ee0af0d0a493d641d4d5d7e403d64c67879a462a020aa2299
+PKG_SOURCE_DATE:=2020-01-25
+PKG_SOURCE_VERSION:=c09fe2098718807ddbca13ee36e3e38801822946
+PKG_MIRROR_HASH:=b2fba519fb3bf2da2e325a33eee951b85c7c1886e48ebaac3892435a71ae33d5
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING

package/system/procd/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=procd
-PKG_RELEASE:=2
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git
-PKG_MIRROR_HASH:=036a42aa87741fa5e587195255c01b6b561bcb7b3858be12e8781949ecb1bda0
-PKG_SOURCE_DATE:=2020-01-04
-PKG_SOURCE_VERSION:=a5af33ce9a16f6aa599f19cc7161e067fab9495d
+PKG_MIRROR_HASH:=fe1329f2320f70249727763739da50555e8b02665ecfc8adb15fb25cd954de5b
+PKG_SOURCE_DATE:=2020-01-24
+PKG_SOURCE_VERSION:=31e4b2dfdbd74f7451abf876dd5d9a674af7adfd
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=GPL-2.0

package/system/ucert/Makefile

@@ -5,9 +5,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ucert.git
-PKG_SOURCE_DATE:=2019-11-29
-PKG_SOURCE_VERSION:=e4bd927cc7c756de5f3005824b63a7a6d827e1ee
-PKG_MIRROR_HASH:=cc6853e861110dd89cc8bd909c5f02150c2c3f9a77de66017393515644a7ac36
+PKG_SOURCE_DATE:=2019-12-19
+PKG_SOURCE_VERSION:=14a279411cff06f9b1363711df4ec3b5db73f042
+PKG_MIRROR_HASH:=797f35138c6e1099a839e768d9e01db022223884d9e0a6d09965e625caf0ae79
 
 CMAKE_INSTALL:=1
 PKG_CHECK_FORMAT_SECURITY:=1

package/system/urngd/Makefile

@@ -4,10 +4,10 @@ PKG_NAME:=urngd
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL=https://git.openwrt.org/project/urngd.git
-PKG_SOURCE_DATE:=2019-06-17
-PKG_SOURCE_VERSION:=c057e177ace7704a3d4e2e1272baaf2e2d21cbed
-PKG_MIRROR_HASH:=6ef24be5da227b36fc63098767cf3de8dccbe5578487ffdbd69c7beeeb76bccd
+PKG_SOURCE_URL=$(PROJECT_GIT)/project/urngd.git
+PKG_SOURCE_DATE:=2020-01-21
+PKG_SOURCE_VERSION:=c7f7b6b65b82eda4675b42d8cd28d76ea7aebf1a
+PKG_MIRROR_HASH:=2d31025b79fe130c579d6c3f4bf4dc12abc43a7319b20a5cdca24ae363ec70f3
 
 PKG_LICENSE:=GPL-2.0 BSD-3-Clause
 PKG_LICENSE_FILES:=

target/linux/apm821xx/patches-4.14/023-0007-crypto-crypto4xx-Fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch

@@ -1,39 +0,0 @@
-From 6e88098ca43a3d80ae86908f7badba683c8a0d84 Mon Sep 17 00:00:00 2001
-From: Corentin Labbe <clabbe@baylibre.com>
-Date: Wed, 23 Jan 2019 11:24:18 +0000
-Subject: [PATCH 07/15] crypto: crypto4xx - Fix wrong
- ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
-
-When building without CONFIG_HW_RANDOM_PPC4XX, I hit the following build failure:
-drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_probe':
-drivers/crypto/amcc/crypto4xx_core.c:1407:20: error: passing argument 1 of 'ppc4xx_trng_probe' from incompatible pointer type [-Werror=incompatible-pointer-types]
-In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
-drivers/crypto/amcc/crypto4xx_trng.h:28:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
-drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_remove':
-drivers/crypto/amcc/crypto4xx_core.c:1434:21: error: passing argument 1 of 'ppc4xx_trng_remove' from incompatible pointer type [-Werror=incompatible-pointer-types]
-In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
-drivers/crypto/amcc/crypto4xx_trng.h:30:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
-
-This patch fix the needed argument of ppc4xx_trng_probe()/ppc4xx_trng_remove() in that case.
-
-Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
-Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
----
- drivers/crypto/amcc/crypto4xx_trng.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/crypto/amcc/crypto4xx_trng.h
-+++ b/drivers/crypto/amcc/crypto4xx_trng.h
-@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_
- void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev);
- #else
- static inline void ppc4xx_trng_probe(
--	struct crypto4xx_device *dev __maybe_unused) { }
-+	struct crypto4xx_core_device *dev __maybe_unused) { }
- static inline void ppc4xx_trng_remove(
--	struct crypto4xx_device *dev __maybe_unused) { }
-+	struct crypto4xx_core_device *dev __maybe_unused) { }
- #endif
- 
- #endif

target/linux/ar71xx/base-files/etc/board.d/01_leds

@@ -724,12 +724,13 @@ rme-eg200)
         ucidef_set_led_default "etactica" "etactica" "eg200:red:etactica" "ignore"
         ;;
 rocket-m-ti)
-	ucidef_set_led_rssi "rssiverylow" "RSSIVERYLOW" "ubnt:green:link1" "wlan0" "1" "100" "0" "13"
-	ucidef_set_led_rssi "rssilow" "RSSILOW" "ubnt:green:link2" "wlan0" "26" "100" "-25" "13"
-	ucidef_set_led_rssi "rssimediumlow" "RSSIMEDIUMLOW" "ubnt:green:link3" "wlan0" "51" "100" "-50" "13"
-	ucidef_set_led_rssi "rssimediumhigh" "RSSIMEDIUMHIGH" "ubnt:green:link4" "wlan0" "76" "100" "-75" "13"
-	ucidef_set_led_rssi "rssihigh" "RSSIHIGH" "ubnt:green:link5" "wlan0" "76" "100" "-75" "13"
-	ucidef_set_led_rssi "rssiveryhigh" "RSSIVERYHIGH" "ubnt:green:link4" "wlan0" "76" "100" "-75" "13"
+	ucidef_set_rssimon "wlan0" "200000" "1"
+	ucidef_set_led_rssi "rssiverylow" "RSSIVERYLOW" "ubnt:green:link1" "wlan0" "1" "100"
+	ucidef_set_led_rssi "rssilow" "RSSILOW" "ubnt:green:link2" "wlan0" "18" "100"
+	ucidef_set_led_rssi "rssimediumlow" "RSSIMEDIUMLOW" "ubnt:green:link3" "wlan0" "34" "100"
+	ucidef_set_led_rssi "rssimediumhigh" "RSSIMEDIUMHIGH" "ubnt:green:link4" "wlan0" "51" "100"
+	ucidef_set_led_rssi "rssihigh" "RSSIHIGH" "ubnt:green:link5" "wlan0" "67" "100"
+	ucidef_set_led_rssi "rssiveryhigh" "RSSIVERYHIGH" "ubnt:green:link6" "wlan0" "84" "100"
 	;;
 rut900)
 	ucidef_set_led_netdev "wan" "WAN" "$board:green:wan" "eth1"

target/linux/ar71xx/image/generic-ubnt.mk

@@ -217,6 +217,7 @@ TARGET_DEVICES += ubnt-rocket-m-xw
 define Device/ubnt-rocket-m-ti
   $(Device/ubnt-xw)
   DEVICE_TITLE := Ubiquiti Rocket M TI
+  DEVICE_PACKAGES += rssileds
   BOARDNAME := UBNT-RM-TI
   UBNT_TYPE := TI
 endef

target/linux/ar71xx/image/generic.mk

@@ -462,7 +462,7 @@ define Device/gl-ar150
   BOARDNAME := GL-AR150
   IMAGE_SIZE := 16000k
   CONSOLE := ttyATH0,115200
-  MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,16000k(firmware),64k(art)ro
+  MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env),16000k(firmware),64k(art)ro
 endef
 TARGET_DEVICES += gl-ar150
 
@@ -516,7 +516,7 @@ define Device/gl-domino
   BOARDNAME := DOMINO
   IMAGE_SIZE := 16000k
   CONSOLE := ttyATH0,115200
-  MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,16000k(firmware),64k(art)ro
+  MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env),16000k(firmware),64k(art)ro
 endef
 TARGET_DEVICES += gl-domino
 
@@ -526,7 +526,7 @@ define Device/gl-mifi
   BOARDNAME := GL-MIFI
   IMAGE_SIZE := 16000k
   CONSOLE := ttyATH0,115200
-  MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,16000k(firmware),64k(art)ro
+  MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env),16000k(firmware),64k(art)ro
 endef
 TARGET_DEVICES += gl-mifi
 

target/linux/ar71xx/image/mikrotik.mk

@@ -55,7 +55,7 @@ TARGET_DEVICES += rb-nor-flash-16M
 define Device/rb-nor-flash-16M-ac
   $(Device/rb-nor-flash-16M)
   DEVICE_TITLE := MikroTik RouterBoard (16 MB SPI NOR, 802.11ac)
-  DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca988x-ct ath10k-firmware-qca9887-ct kmod-usb-ehci
+  DEVICE_PACKAGES += kmod-ath10k-ct-smallbuffers ath10k-firmware-qca988x-ct ath10k-firmware-qca9887-ct kmod-usb-ehci
   SUPPORTED_DEVICES += rb-wapg-5hact2hnd
 endef
 TARGET_DEVICES += rb-nor-flash-16M-ac

target/linux/ar71xx/patches-4.14/450-gpio-nxp-74hc153-gpio-chip-driver.patch

@@ -1,6 +1,6 @@
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
-@@ -1299,4 +1299,12 @@ config GPIO_VIPERBOARD
+@@ -1300,4 +1300,12 @@ config GPIO_VIPERBOARD
  
  endmenu
  

target/linux/ar71xx/patches-4.14/451-gpio-74x164-improve-platform-device-support.patch

@@ -109,7 +109,7 @@
 +#endif
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
-@@ -1251,7 +1251,6 @@ menu "SPI GPIO expanders"
+@@ -1252,7 +1252,6 @@ menu "SPI GPIO expanders"
  
  config GPIO_74X164
  	tristate "74x164 serial-in/parallel-out 8-bits shift register"

target/linux/ar71xx/patches-4.14/452-gpio-add-gpio-latch-driver.patch

@@ -1,6 +1,6 @@
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
-@@ -1306,4 +1306,9 @@ config GPIO_NXP_74HC153
+@@ -1307,4 +1307,9 @@ config GPIO_NXP_74HC153
  	  Platform driver for NXP 74HC153 Dual 4-input Multiplexer. This
  	  provides a GPIO interface supporting input mode only.
  

target/linux/ar71xx/patches-4.14/910-unaligned_access_hacks.patch

@@ -757,7 +757,7 @@
  EXPORT_SYMBOL(xfrm_parse_spi);
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
-@@ -3874,14 +3874,16 @@ static bool tcp_parse_aligned_timestamp(
+@@ -3878,14 +3878,16 @@ static bool tcp_parse_aligned_timestamp(
  {
  	const __be32 *ptr = (const __be32 *)(th + 1);
  
@@ -831,7 +831,7 @@
   * No flags defined yet.
 --- a/net/core/utils.c
 +++ b/net/core/utils.c
-@@ -424,8 +424,14 @@ void inet_proto_csum_replace16(__sum16 *
+@@ -441,8 +441,14 @@ void inet_proto_csum_replace16(__sum16 *
  			       bool pseudohdr)
  {
  	__be32 diff[] = {

target/linux/ath25/patches-4.14/130-watchdog.patch

@@ -212,7 +212,7 @@
 +MODULE_ALIAS("platform:" DRIVER_NAME);
 --- a/drivers/watchdog/Kconfig
 +++ b/drivers/watchdog/Kconfig
-@@ -1646,6 +1646,13 @@ config PIC32_DMT
+@@ -1647,6 +1647,13 @@ config PIC32_DMT
  	  To compile this driver as a loadable module, choose M here.
  	  The module will be called pic32-dmt.
  

target/linux/ath79/base-files/etc/board.d/01_leds

@@ -128,7 +128,9 @@ tplink,archer-c6-v2)
 	;;
 tplink,archer-c25-v1|\
 tplink,tl-wr841-v9|\
+tplink,tl-wr841-v10|\
 tplink,tl-wr841-v11|\
+tplink,tl-wr841-v12|\
 tplink,tl-wr842n-v3)
 	ucidef_set_led_netdev "wan" "WAN" "tp-link:green:wan" "eth1"
 	ucidef_set_led_switch "lan1" "LAN1" "tp-link:green:lan1" "switch0" "0x10"
@@ -148,6 +150,15 @@ tplink,archer-d50-v1)
 	ucidef_set_led_switch "wan_data" "WAN Data" "tp-link:white:internet" "switch0" "0x02" "" "tx rx"
 	ucidef_set_led_switch "wan_link" "WAN Link" "tp-link:white:wan" "switch0" "0x02" "" "link"
 	;;
+tplink,cpe220-v3)
+	ucidef_set_led_netdev "lan0" "LAN0" "tp-link:green:lan0" "eth1"
+	ucidef_set_led_switch "lan1" "LAN1" "tp-link:green:lan1" "switch0" "0x10"
+	ucidef_set_rssimon "wlan0" "200000" "1"
+	ucidef_set_led_rssi "rssilow" "RSSILOW" "tp-link:green:link1" "wlan0" "1" "100"
+	ucidef_set_led_rssi "rssimediumlow" "RSSIMEDIUMLOW" "tp-link:green:link2" "wlan0" "30" "100"
+	ucidef_set_led_rssi "rssimediumhigh" "RSSIMEDIUMHIGH" "tp-link:green:link3" "wlan0" "60" "100"
+	ucidef_set_led_rssi "rssihigh" "RSSIHIGH" "tp-link:green:link4" "wlan0" "80" "100"
+	;;
 tplink,cpe210-v2|\
 tplink,cpe210-v3)
 	ucidef_set_led_netdev "lan" "LAN" "tp-link:green:lan" "eth0"
@@ -189,8 +200,11 @@ tplink,tl-wr842n-v2)
 	;;
 ubnt,bullet-m|\
 ubnt,bullet-m-xw|\
+ubnt,nanostation-loco-m|\
+ubnt,nanostation-loco-m-xw|\
 ubnt,nanostation-m|\
 ubnt,nanostation-m-xw|\
+ubnt,picostation-m|\
 ubnt,rocket-m)
 	ucidef_set_rssimon "wlan0" "200000" "1"
 	ucidef_set_led_rssi "rssilow" "RSSILOW" "ubnt:red:link1" "wlan0" "1" "100"

target/linux/ath79/base-files/etc/board.d/02_network

@@ -38,6 +38,9 @@ ath79_setup_interfaces()
 	ubnt,lap-120|\
 	ubnt,nanobeam-ac|\
 	ubnt,nanostation-ac-loco|\
+	ubnt,nanostation-loco-m|\
+	ubnt,nanostation-loco-m-xw|\
+	ubnt,picostation-m|\
 	ubnt,rocket-m|\
 	ubnt,unifiac-lite|\
 	ubnt,unifiac-lr|\
@@ -75,7 +78,9 @@ ath79_setup_interfaces()
 	tplink,tl-mr3420-v1|\
 	tplink,tl-wr841-v7|\
 	tplink,tl-wr841-v9|\
+	tplink,tl-wr841-v10|\
 	tplink,tl-wr841-v11|\
+	tplink,tl-wr841-v12|\
 	tplink,tl-wr842n-v1|\
 	tplink,tl-wr842n-v3|\
 	ubnt,airrouter)
@@ -89,6 +94,7 @@ ath79_setup_interfaces()
 		;;
 	comfast,cf-e110n-v2|\
 	comfast,cf-e120a-v3|\
+	tplink,cpe220-v3|\
 	ubnt,nanostation-m|\
 	ubnt,routerstation)
 		ucidef_set_interfaces_lan_wan "eth1" "eth0"

target/linux/ath79/base-files/etc/board.d/03_gpio_switches

@@ -27,6 +27,9 @@ tplink,archer-c25-v1)
 	ucidef_add_gpio_switch "led_control" "LED control" "21" "0"
 	ucidef_add_gpio_switch "led_reset" "LED reset" "19" "1"
 	;;
+tplink,cpe220-v3)
+	ucidef_add_gpio_switch "poe_passthrough" "PoE Passthrough" "20"
+	;;
 ubnt,nanostation-ac)
 	ucidef_add_gpio_switch "poe_passthrough" "PoE Passthrough" "3"
 	;;

target/linux/ath79/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom

@@ -173,7 +173,9 @@ case "$FIRMWARE" in
 	tplink,tl-wr842n-v1|\
 	ubnt,airrouter|\
 	ubnt,bullet-m|\
+	ubnt,nanostation-loco-m|\
 	ubnt,nanostation-m|\
+	ubnt,picostation-m|\
 	ubnt,rocket-m)
 		ath9k_eeprom_extract "art" 4096 4096
 		;;

target/linux/ath79/base-files/etc/hotplug.d/ieee80211/00-wifi-migration

@@ -24,11 +24,12 @@ migrate_wifi_path() {
 				;;
 			esac
 		;;
-		"platform/qca955x_wmac")
-			path="platform/ahb/ahb:apb/18100000.wmac"
-			WIFI_PATH_CHANGED=1
-		;;
-		"platform/ar933x_wmac")
+		"platform/ahb/ahb:apb/18100000.wmac"|\
+		"platform/ar933x_wmac"|\
+		"platform/ar934x_wmac"|\
+		"platform/qca953x_wmac"|\
+		"platform/qca955x_wmac"|\
+		"platform/qca956x_wmac")
 			path="platform/ahb/18100000.wmac"
 			WIFI_PATH_CHANGED=1
 		;;

target/linux/ath79/dts/ar7161_netgear_wndr3700.dts

@@ -18,7 +18,6 @@
 	partition@50000 {
 		label = "u-boot-env";
 		reg = <0x050000 0x020000>;
-		read-only;
 	};
 
 	partition@70000 {

target/linux/ath79/dts/ar7161_netgear_wndr3700v2.dts

@@ -18,7 +18,6 @@
 	partition@50000 {
 		label = "u-boot-env";
 		reg = <0x050000 0x020000>;
-		read-only;
 	};
 
 	partition@70000 {

target/linux/ath79/dts/ar7241_ubnt_nanostation-loco-m.dts

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include "ar7241_ubnt_xm_outdoor.dtsi"
+
+/ {
+	compatible = "ubnt,nanostation-loco-m", "ubnt,xm", "qca,ar7241";
+	model = "Ubiquiti Nanostation Loco M";
+};
+
+&eth1 {
+	compatible = "syscon", "simple-mfd";
+};

target/linux/ath79/dts/ar7241_ubnt_picostation-m.dts

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include "ar7241_ubnt_xm_outdoor.dtsi"
+
+/ {
+	compatible = "ubnt,picostation-m", "ubnt,xm", "qca,ar7241";
+	model = "Ubiquiti Picostation M";
+};
+
+&eth1 {
+	compatible = "syscon", "simple-mfd";
+};

target/linux/ath79/dts/ar9341_tplink_tl-wr841-v8.dts

@@ -22,9 +22,6 @@
 		compatible = "gpio-keys-polled";
 		poll-interval = <20>;
 
-		pinctrl-names = "default";
-		pinctrl-0 = <&jtag_disable_pins>;
-
 		reset {
 			label = "Reset";
 			linux,code = <KEY_RESTART>;
@@ -96,7 +93,14 @@
 };
 
 &gpio {
-	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&jtag_disable_pins &pmx_usb_power>;
+};
+
+&pinmux {
+	pmx_usb_power: usb_power {
+		pinctrl-single,bits = <0x4 0x0 0xff>;
+	};
 };
 
 &spi {

target/linux/ath79/dts/ar9341_tplink_tl-wr842n-v2.dts

@@ -22,9 +22,6 @@
 		compatible = "gpio-keys-polled";
 		poll-interval = <20>;
 
-		pinctrl-names = "default";
-		pinctrl-0 = <&jtag_disable_pins>;
-
 		reset {
 			label = "Reset";
 			linux,code = <KEY_RESTART>;
@@ -113,7 +110,14 @@
 };
 
 &gpio {
-	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&jtag_disable_pins &pmx_usb_power>;
+};
+
+&pinmux {
+	pmx_usb_power: usb_power {
+		pinctrl-single,bits = <0x4 0x0 0xff>;
+	};
 };
 
 &spi {

target/linux/ath79/dts/ar9342_ubnt_nanostation-loco-m-xw.dts

@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "ar9342_ubnt_xw.dtsi"
+
+/ {
+	compatible = "ubnt,nanostation-loco-m-xw", "ubnt,xw", "qca,ar9342";
+	model = "Ubiquiti Nanostation Loco M (XW)";
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy-mask = <0x1>;
+
+	phy1: ethernet-phy@1 {
+		reg = <1>;
+		phy-mode = "mii";
+		reset-gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-handle = <&phy1>;
+};

target/linux/ath79/dts/ar9342_ubnt_xw.dtsi

@@ -96,13 +96,13 @@
 				reg = <0x050000 0x760000>;
 			};
 
-			partition@fb0000 {
+			partition@7b0000 {
 				label = "cfg";
 				reg = <0x7b0000 0x040000>;
 				read-only;
 			};
 
-			eeprom: partition@ff0000 {
+			eeprom: partition@7f0000 {
 				label = "EEPROM";
 				reg = <0x7f0000 0x010000>;
 				read-only;

target/linux/ath79/dts/ar9344.dtsi

@@ -31,7 +31,7 @@
 	};
 };
 
-&apb {
+&ahb {
 	pcie: pcie-controller@180c0000 {
 		compatible = "qcom,ar9340-pci", "qcom,ar7240-pci";
 		#address-cells = <3>;

target/linux/ath79/dts/ar934x.dtsi

@@ -38,7 +38,7 @@
 		};
 	};
 
-	ahb {
+	ahb: ahb {
 		compatible = "simple-bus";
 		ranges;
 
@@ -133,18 +133,18 @@
 
 				#reset-cells = <1>;
 			};
+		};
 
-			gmac: gmac@18070000 {
-				compatible = "qca,ar9340-gmac";
-				reg = <0x18070000 0x14>;
-			};
+		gmac: gmac@18070000 {
+			compatible = "qca,ar9340-gmac";
+			reg = <0x18070000 0x14>;
+		};
 
-			wmac: wmac@18100000 {
-				compatible = "qca,ar9340-wmac";
-				reg = <0x18100000 0x20000>;
+		wmac: wmac@18100000 {
+			compatible = "qca,ar9340-wmac";
+			reg = <0x18100000 0x20000>;
 
-				status = "disabled";
-			};
+			status = "disabled";
 		};
 
 		usb: usb@1b000000 {
@@ -181,8 +181,8 @@
 	usb_phy: usb-phy {
 		compatible = "qca,ar9340-usb-phy", "qca,ar7200-usb-phy";
 
-		reset-names = "usb-phy", "usb-suspend-override";
-		resets = <&rst 4>, <&rst 3>;
+		reset-names = "usb-phy-analog", "usb-phy", "usb-suspend-override";
+		resets = <&rst 11>, <&rst 4>, <&rst 3>;
 
 		#phy-cells = <0>;
 

target/linux/ath79/dts/qca9533_tplink_cpe210.dtsi

@@ -1,135 +1,15 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 /dts-v1/;
 
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
+#include "qca9533_tplink_cpexxx.dtsi"
 
-#include "qca953x.dtsi"
-
-/ {
-	chosen {
-		bootargs = "console=ttyS0,115200n8";
+&leds {
+	lan {
+		label = "tp-link:green:lan";
+		gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
 	};
-
-	aliases {
-		led-boot = &system;
-		led-failsafe = &system;
-		led-running = &system;
-		led-upgrade = &system;
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		lan {
-			label = "tp-link:green:lan";
-			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
-		};
-
-		link1 {
-			label = "tp-link:green:link1";
-			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
-		};
-
-		link2 {
-			label = "tp-link:green:link2";
-			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
-		};
-
-		link3 {
-			label = "tp-link:green:link3";
-			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
-		};
-
-		system: link4 {
-			label = "tp-link:green:link4";
-			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
-		};
-	};
-
-	keys {
-		compatible = "gpio-keys-polled";
-		poll-interval = <100>;
-
-		reset_button {
-			label = "Reset button";
-			linux,code = <KEY_RESTART>;
-			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
-		};
-	};
-};
-
-&uart {
-	status = "okay";
-};
-
-&spi {
-	status = "okay";
-	num-cs = <1>;
-
-	flash@0 {
-		#address-cells = <1>;
-		#size-cells = <1>;
-		compatible = "jedec,spi-nor";
-		reg = <0>;
-		spi-max-frequency = <25000000>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			uboot: partition@0 {
-				label = "u-boot";
-				reg = <0x000000 0x020000>;
-				read-only;
-			};
-
-			partition@20000 {
-				label = "partition-table";
-				reg = <0x020000 0x10000>;
-				read-only;
-			};
-
-			info: partition@30000 {
-				label = "info";
-				reg = <0x030000 0x10000>;
-				read-only;
-			};
-
-			partition@40000 {
-				label = "firmware";
-				reg = <0x040000 0x780000>;
-				compatible = "tplink,firmware";
-			};
-
-			config: partition@7c0000 {
-				label = "config";
-				reg = <0x7c0000 0x30000>;
-				read-only;
-			};
-
-			art: partition@7f0000 {
-				label = "art";
-				reg = <0x7f0000 0x10000>;
-				read-only;
-			};
-		};
-	};
-};
-
-&eth0 {
-	status = "okay";
-	phy-handle = <&swphy4>;
-	mtd-mac-address = <&info 0x8>;
 };
 
 &eth1 {
 	compatible = "syscon", "simple-mfd";
 };
-
-&wmac {
-	status = "okay";
-	mtd-cal-data = <&art 0x1000>;
-	mtd-mac-address = <&info 0x8>;
-};

target/linux/ath79/dts/qca9533_tplink_cpe220-v3.dts

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include "qca9533_tplink_cpexxx.dtsi"
+
+/ {
+	compatible = "tplink,cpe220-v3", "qca,qca9533";
+	model = "TP-Link CPE220 v3";
+};
+
+&leds {
+	lan0 {
+		label = "tp-link:green:lan0";
+		gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+	};
+
+	lan1 {
+		label = "tp-link:green:lan1";
+		gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&eth1 {
+	status = "okay";
+
+	mtd-mac-address = <&info 0x8>;
+
+	gmac-config {
+		device = <&gmac>;
+		switch-phy-swap = <0>;
+		switch-only-mode = <1>;
+	};
+};

target/linux/ath79/dts/qca9533_tplink_cpexxx.dtsi

@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "qca953x.dtsi"
+
+/ {
+	chosen {
+		bootargs = "console=ttyS0,115200n8";
+	};
+
+	aliases {
+		led-boot = &led_link4;
+		led-failsafe = &led_link4;
+		led-running = &led_link4;
+		led-upgrade = &led_link4;
+	};
+
+	leds: leds {
+		compatible = "gpio-leds";
+
+		link1 {
+			label = "tp-link:green:link1";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		link2 {
+			label = "tp-link:green:link2";
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+
+		link3 {
+			label = "tp-link:green:link3";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		led_link4: link4 {
+			label = "tp-link:green:link4";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		reset_button {
+			label = "Reset button";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&uart {
+	status = "okay";
+};
+
+&spi {
+	status = "okay";
+
+	num-cs = <1>;
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			uboot: partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x020000>;
+				read-only;
+			};
+
+			partition@20000 {
+				label = "partition-table";
+				reg = <0x020000 0x010000>;
+				read-only;
+			};
+
+			info: partition@30000 {
+				label = "info";
+				reg = <0x030000 0x010000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "firmware";
+				reg = <0x040000 0x780000>;
+				compatible = "tplink,firmware";
+			};
+
+			config: partition@7c0000 {
+				label = "config";
+				reg = <0x7c0000 0x030000>;
+				read-only;
+			};
+
+			art: partition@7f0000 {
+				label = "art";
+				reg = <0x7f0000 0x010000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	mtd-cal-data = <&art 0x1000>;
+	mtd-mac-address = <&info 0x8>;
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-handle = <&swphy4>;
+
+	mtd-mac-address = <&info 0x8>;
+};