OpenWrt v22.03.2: adjust config defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

Makefile

@@ -14,7 +14,7 @@ $(if $(findstring $(space),$(TOPDIR)),$(error ERROR: The path to the OpenWrt dir
 
 world:
 
-DISTRO_PKG_CONFIG:=$(shell $(TOPDIR)/scripts/command_all.sh pkg-config | grep -E '\/usr' | head -n 1)
+DISTRO_PKG_CONFIG:=$(shell $(TOPDIR)/scripts/command_all.sh pkg-config | grep '/usr' | head -n 1)
 export PATH:=$(TOPDIR)/staging_dir/host/bin:$(PATH)
 
 ifneq ($(OPENWRT_BUILD),1)

config/Config-build.in

@@ -58,6 +58,10 @@ menu "Global build settings"
 		bool "Enable signature checking in opkg"
 		default SIGNED_PACKAGES
 
+	config DOWNLOAD_CHECK_CERTIFICATE
+		bool "Enable TLS certificate verification during package download"
+		default y
+
 	comment "General build options"
 
 	config TESTING_KERNEL
@@ -160,7 +164,6 @@ menu "Global build settings"
 
 	choice
 		prompt "Binary stripping method"
-		default USE_STRIP   if EXTERNAL_TOOLCHAIN
 		default USE_STRIP   if USE_GLIBC
 		default USE_SSTRIP
 		help

config/Config-kernel.in

@@ -422,6 +422,11 @@ config KERNEL_KPROBE_EVENTS
 	bool
 	default y if KERNEL_KPROBES
 
+config KERNEL_BPF_KPROBE_OVERRIDE
+	bool
+	depends on KERNEL_KPROBES
+	default n
+
 config KERNEL_AIO
 	bool "Compile the kernel with asynchronous IO support"
 	default y if !SMALL_FLASH

feeds.conf.default

@@ -1,4 +1,4 @@
-src-git-full packages https://git.openwrt.org/feed/packages.git^72abf7e9f4cd6bbb9098ded9e9a0fe28e515d47f
-src-git-full luci https://git.openwrt.org/project/luci.git^69231a7d62a3b809fc5972071e691fb02730a10e
-src-git-full routing https://git.openwrt.org/feed/routing.git^1ccc4e435175e6ba5ac60e626e1e95eb25c5757b
+src-git-full packages https://git.openwrt.org/feed/packages.git^dba8a0102e5965cad58a871335002e9c964b6719
+src-git-full luci https://git.openwrt.org/project/luci.git^96ec0cd3ccfe954f13fd5a337efdd70374dde03f
+src-git-full routing https://git.openwrt.org/feed/routing.git^85028704f688a6768d3f10d5d3c10a799a121e0d
 src-git-full telephony https://git.openwrt.org/feed/telephony.git^1d2031a5c82816483c51bca15649e2957fbe2bc2

include/image.mk

@@ -524,7 +524,7 @@ endif
 define Device/Build/compile
   $$(_COMPILE_TARGET): $(KDIR)/$(1)
   $(eval $(call Device/Export,$(KDIR)/$(1)))
-  $(KDIR)/$(1):
+  $(KDIR)/$(1): FORCE
 	$$(call concat_cmd,$(COMPILE/$(1)))
 
 endef

include/kernel-5.10

@@ -1,2 +1,2 @@
-LINUX_VERSION-5.10 = .134
-LINUX_KERNEL_HASH-5.10.134 = ec3513acdf033dd8f8ac2545cd1bb826b0669e151185e5f70408a5c9fe273269
+LINUX_VERSION-5.10 = .146
+LINUX_KERNEL_HASH-5.10.146 = 7bbd97f3278eadb73c19a1ca8c1a655c60afcee9f487b910063cdd15e9ee6dc1

include/netfilter.mk

@@ -223,11 +223,6 @@ $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_CONNTRACK_IRC, $(P_XT)nf_connt
 $(eval $(call nf_add,NF_NATHELPER_EXTRA,CONFIG_NF_NAT_IRC, $(P_XT)nf_nat_irc))
 
 
-# ulog
-
-$(eval $(call nf_add,IPT_ULOG,CONFIG_IP_NF_TARGET_ULOG, $(P_V4)ipt_ULOG))
-
-
 # nflog
 
 $(eval $(call nf_add,IPT_NFLOG,CONFIG_NETFILTER_XT_TARGET_NFLOG, $(P_XT)xt_NFLOG))
@@ -314,7 +309,6 @@ $(eval $(call nf_add,EBTABLES_IP4,CONFIG_BRIDGE_EBT_SNAT, $(P_EBT)ebt_snat))
 
 # watchers
 $(eval $(call nf_add,EBTABLES_WATCHERS,CONFIG_BRIDGE_EBT_LOG, $(P_EBT)ebt_log))
-$(eval $(call nf_add,EBTABLES_WATCHERS,CONFIG_BRIDGE_EBT_ULOG, $(P_EBT)ebt_ulog))
 $(eval $(call nf_add,EBTABLES_WATCHERS,CONFIG_BRIDGE_EBT_NFLOG, $(P_EBT)ebt_nflog))
 $(eval $(call nf_add,EBTABLES_WATCHERS,CONFIG_BRIDGE_EBT_NFQUEUE, $(P_EBT)ebt_nfqueue))
 
@@ -340,12 +334,7 @@ $(eval $(if $(NF_KMOD),$(call nf_add,NFT_BRIDGE,CONFIG_NF_CONNTRACK_BRIDGE, $(P_
 
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_NAT, $(P_XT)nft_nat),))
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_NAT, $(P_XT)nft_chain_nat),))
-$(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_REDIR_IPV4, $(P_V4)nft_redir_ipv4),))
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_MASQ, $(P_XT)nft_masq),))
-$(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT,CONFIG_NFT_MASQ_IPV4, $(P_V4)nft_masq_ipv4),))
-
-$(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT6,CONFIG_NFT_REDIR_IPV6, $(P_V6)nft_redir_ipv6),))
-$(eval $(if $(NF_KMOD),$(call nf_add,NFT_NAT6,CONFIG_NFT_MASQ_IPV6, $(P_V6)nft_masq_ipv6),))
 
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_FIB,CONFIG_NFT_FIB, $(P_XT)nft_fib),))
 $(eval $(if $(NF_KMOD),$(call nf_add,NFT_FIB,CONFIG_NFT_FIB_INET, $(P_XT)nft_fib_inet),))
@@ -386,7 +375,6 @@ IPT_BUILTIN += $(IPT_NAT6-y)
 IPT_BUILTIN += $(IPT_NAT_EXTRA-y)
 IPT_BUILTIN += $(NF_NATHELPER-y)
 IPT_BUILTIN += $(NF_NATHELPER_EXTRA-y)
-IPT_BUILTIN += $(IPT_ULOG-y)
 IPT_BUILTIN += $(IPT_TPROXY-y)
 IPT_BUILTIN += $(NFNETLINK-y)
 IPT_BUILTIN += $(NFNETLINK_LOG-y)

include/prereq-build.mk

@@ -162,20 +162,22 @@ $(eval $(call SetupHostCommand,perl,Please install Perl 5.x, \
 $(eval $(call CleanupPython2))
 
 $(eval $(call SetupHostCommand,python,Please install Python >= 3.6, \
+	python3.11 -V 2>&1 | grep 'Python 3', \
 	python3.10 -V 2>&1 | grep 'Python 3', \
 	python3.9 -V 2>&1 | grep 'Python 3', \
 	python3.8 -V 2>&1 | grep 'Python 3', \
 	python3.7 -V 2>&1 | grep 'Python 3', \
 	python3.6 -V 2>&1 | grep 'Python 3', \
-	python3 -V 2>&1 | grep -E 'Python 3\.([6-9]|10)\.?'))
+	python3 -V 2>&1 | grep -E 'Python 3\.([6-9]|[0-9][0-9])\.?'))
 
 $(eval $(call SetupHostCommand,python3,Please install Python >= 3.6, \
+	python3.11 -V 2>&1 | grep 'Python 3', \
 	python3.10 -V 2>&1 | grep 'Python 3', \
 	python3.9 -V 2>&1 | grep 'Python 3', \
 	python3.8 -V 2>&1 | grep 'Python 3', \
 	python3.7 -V 2>&1 | grep 'Python 3', \
 	python3.6 -V 2>&1 | grep 'Python 3', \
-	python3 -V 2>&1 | grep -E 'Python 3\.([6-9]|10)\.?'))
+	python3 -V 2>&1 | grep -E 'Python 3\.([6-9]|[0-9][0-9])\.?'))
 
 $(eval $(call TestHostCommand,python3-distutils, \
 	Please install the Python3 distutils module, \
@@ -200,7 +202,10 @@ $(STAGING_DIR_HOST)/bin/mkhash: $(SCRIPT_DIR)/mkhash.c
 	mkdir -p $(dir $@)
 	$(CC) -O2 -I$(TOPDIR)/tools/include -o $@ $<
 
-prereq: $(STAGING_DIR_HOST)/bin/mkhash
+$(STAGING_DIR_HOST)/bin/xxd: $(SCRIPT_DIR)/xxdi.pl
+	$(LN) $< $@
+
+prereq: $(STAGING_DIR_HOST)/bin/mkhash $(STAGING_DIR_HOST)/bin/xxd
 
 # Install ldconfig stub
 $(eval $(call TestHostCommand,ldconfig-stub,Failed to install stub, \

include/target.mk

@@ -68,7 +68,7 @@ endif
 
 target_conf=$(subst .,_,$(subst -,_,$(subst /,_,$(1))))
 ifeq ($(DUMP),)
-  PLATFORM_DIR:=$(TOPDIR)/target/linux/$(BOARD)
+  PLATFORM_DIR:=$(firstword $(wildcard $(TOPDIR)/target/linux/feeds/$(BOARD) $(TOPDIR)/target/linux/$(BOARD)))
   SUBTARGET:=$(strip $(foreach subdir,$(patsubst $(PLATFORM_DIR)/%/target.mk,%,$(wildcard $(PLATFORM_DIR)/*/target.mk)),$(if $(CONFIG_TARGET_$(call target_conf,$(BOARD)_$(subdir))),$(subdir))))
 else
   PLATFORM_DIR:=${CURDIR}

include/version.mk

@@ -23,13 +23,13 @@ PKG_CONFIG_DEPENDS += \
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))
 
 VERSION_NUMBER:=$(call qstrip,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),22.03.0-rc6)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),22.03.2)
 
 VERSION_CODE:=$(call qstrip,$(CONFIG_VERSION_CODE))
-VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r19590-042d558536)
+VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r19803-9a599fee93)
 
 VERSION_REPO:=$(call qstrip,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/releases/22.03.0-rc6)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/releases/22.03.2)
 
 VERSION_DIST:=$(call qstrip,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),OpenWrt)

package/base-files/files/lib/functions/system.sh

@@ -79,6 +79,37 @@ mtd_get_mac_ascii() {
 	[ -n "$mac_dirty" ] && macaddr_canonicalize "$mac_dirty"
 }
 
+mtd_get_mac_encrypted_arcadyan() {
+	local iv="00000000000000000000000000000000"
+	local key="2A4B303D7644395C3B2B7053553C5200"
+	local mac_dirty
+	local mtdname="$1"
+	local part
+	local size
+
+	part=$(find_mtd_part "$mtdname")
+	if [ -z "$part" ]; then
+		echo "mtd_get_mac_encrypted_arcadyan: partition $mtdname not found!" >&2
+		return
+	fi
+
+	# Config decryption and getting mac. Trying uencrypt and openssl utils.
+	size=$((0x$(dd if=$part skip=9 bs=1 count=4 2>/dev/null | hexdump -v -e '1/4 "%08x"')))
+	if [[ -f  "/usr/bin/uencrypt" ]]; then
+		mac_dirty=$(dd if=$part bs=1 count=$size skip=$((0x100)) 2>/dev/null | \
+			uencrypt -d -n -k $key -i $iv | grep mac | cut -c 5-)
+	elif [[ -f  "/usr/bin/openssl" ]]; then
+		mac_dirty=$(dd if=$part bs=1 count=$size skip=$((0x100)) 2>/dev/null | \
+			openssl aes-128-cbc -d -nopad -K $key -iv $iv | grep mac | cut -c 5-)
+	else
+		echo "mtd_get_mac_encrypted_arcadyan: Neither uencrypt nor openssl was found!" >&2
+		return
+	fi
+
+	# "canonicalize" mac
+	[ -n "$mac_dirty" ] && macaddr_canonicalize "$mac_dirty"
+}
+
 mtd_get_mac_text() {
 	local mtdname=$1
 	local offset=$(($2))

package/base-files/image-config.in

@@ -183,7 +183,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "https://downloads.openwrt.org/releases/22.03.0-rc6"
+		default "https://downloads.openwrt.org/releases/22.03.2"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:

package/boot/arm-trusted-firmware-mediatek/patches/120-mt7622-bl2_boot_snand-skip-bad-blocks.patch

@@ -0,0 +1,40 @@
+--- a/plat/mediatek/mt7622/bl2_boot_snand.c
++++ b/plat/mediatek/mt7622/bl2_boot_snand.c
+@@ -21,6 +21,10 @@
+ #define FIP_BASE			0x80000
+ #define FIP_SIZE			0x200000
+ 
++#ifndef NMBM
++#define SNAND_MAX_BAD_BLOCK		3
++#endif
++
+ struct snfi_gpio_mux_info {
+ 	const uint32_t *pins;
+ 	uint32_t count;
+@@ -45,12 +49,26 @@ static size_t snand_read_range(int lba,
+ 	size_t sizeremain = size, chunksize;
+ 	uint64_t off = lba * cinfo.pagesize;
+ 	uint8_t *ptr = (uint8_t *)buf;
++	struct mtk_snand_chip_info info;
++	unsigned int bad_blocks = 0;
+ 	int ret = 0;
+ 
+ 	if (!snf)
+ 		return 0;
+ 
++	ret = mtk_snand_get_chip_info(snf, &info);
++	if (ret)
++		return 0;
++
+ 	while (sizeremain) {
++		while (mtk_snand_block_isbad(snf, off)) {
++			if (bad_blocks > SNAND_MAX_BAD_BLOCK)
++				return size - sizeremain;
++
++			off += info.blocksize;
++			++bad_blocks;
++		}
++
+ 		chunksize = cinfo.pagesize;
+ 		if (chunksize > sizeremain)
+ 			chunksize = sizeremain;

package/boot/at91bootstrap/Makefile

@@ -136,12 +136,6 @@ define AT91Bootstrap/sama5d27_som1_eksd_uboot
   BUILD_DEVICES:=microchip_sama5d27-som1-ek
 endef
 
-define AT91Bootstrap/sama5d27_som1_eksd1_uboot
-  TITLE:=AT91Bootstrap for SAMA5D27 SOM1 Ek (SDcard1)
-  BUILD_SUBTARGET:=sama5
-  BUILD_DEVICES:=microchip_sama5d27-som1-ek
-endef
-
 define AT91Bootstrap/sama5d27_som1_ekqspi_uboot
   TITLE:=AT91Bootstrap for SAMA5D27 SOM1 Ek (QSPI Flash)
   BUILD_SUBTARGET:=sama5
@@ -193,7 +187,7 @@ AT91BOOTSTRAP_TARGETS := \
 	sama5d4_xplainednf_uboot_secure \
 	sama5d4_xplaineddf_uboot_secure \
 	sama5d4_xplainedsd_uboot_secure \
-	sama5d27_som1_eksd1_uboot \
+	sama5d27_som1_eksd_uboot \
 	sama5d27_som1_ekqspi_uboot \
 	sama5d27_wlsom1_eksd_uboot \
 	sama5d27_wlsom1_ekdf_qspi_uboot \

package/boot/uboot-at91/Makefile

@@ -107,8 +107,8 @@ define U-Boot/sama5d4_xplained_nandflash
   BUILD_DEVICES:=microchip_sama5d3-xplained
 endef
 
-define U-Boot/sama5d27_som1_ek_mmc1
-  NAME:=SAMA5D27 SOM1 Ek (SDCard1)
+define U-Boot/sama5d27_som1_ek_mmc
+  NAME:=SAMA5D27 SOM1 Ek (SDCard0)
   BUILD_SUBTARGET:=sama5
   BUILD_DEVICES:=microchip_sama5d27-som1-ek
 endef
@@ -163,7 +163,7 @@ UBOOT_TARGETS := \
 	sama5d4_xplained_mmc \
 	sama5d4_xplained_spiflash \
 	sama5d4_xplained_nandflash\
-	sama5d27_som1_ek_mmc1 \
+	sama5d27_som1_ek_mmc \
 	sama5d27_som1_ek_qspiflash \
 	sama5d27_wlsom1_ek_mmc \
 	sama5d27_wlsom1_ek_qspiflash \

package/boot/uboot-envtools/files/mediatek_mt7622

@@ -39,7 +39,7 @@ ruijie,rg-ew3200gx-pro)
 	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x20000" "0x20000"
 	;;
 ubnt,unifi-6-lr-ubootmod)
-	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x4000" "0x10000"
+	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x4000" "0x1000"
 	;;
 xiaomi,redmi-router-ax6s)
 	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x10000" "0x40000"

package/boot/uboot-envtools/files/ramips

@@ -35,10 +35,7 @@ buffalo,wsr-1166dhp|\
 buffalo,wsr-600dhp|\
 mediatek,linkit-smart-7688|\
 samknows,whitebox-v8|\
-xiaomi,mi-router-3g-v2|\
-xiaomi,mi-router-4a-gigabit|\
 xiaomi,mi-router-4c|\
-xiaomi,miwifi-3c|\
 xiaomi,miwifi-nano|\
 zbtlink,zbt-wg2626|\
 zte,mf283plus)
@@ -50,7 +47,8 @@ ravpower,rp-wd03)
 	[ -n "$idx" ] && \
 		ubootenv_add_uci_config "/dev/mtd$idx" "0x4000" "0x1000" "0x1000"
 	;;
-jcg,q20)
+jcg,q20|\
+netgear,wax202)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
 	;;
 beeline,smartbox-flash|\
@@ -60,12 +58,22 @@ linksys,ea7300-v2|\
 linksys,ea7500-v2|\
 linksys,ea8100-v1|\
 linksys,ea8100-v2|\
+mts,wg430223)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000" "0x20000"
+	;;
+xiaomi,mi-router-3g-v2|\
+xiaomi,mi-router-4a-gigabit|\
+xiaomi,miwifi-3c)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000" "0x10000"
+	ubootenv_add_uci_sys_config "/dev/mtd2" "0x0" "0x4000" "0x10000"
+	;;
 xiaomi,mi-router-3g|\
 xiaomi,mi-router-3-pro|\
 xiaomi,mi-router-4|\
 xiaomi,mi-router-ac2100|\
 xiaomi,redmi-router-ac2100)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000" "0x20000"
+	ubootenv_add_uci_sys_config "/dev/mtd2" "0x0" "0x4000" "0x20000"
 	;;
 zyxel,nr7101)
 	idx="$(find_mtd_index Config)"
@@ -81,6 +89,6 @@ xiaomi,mi-router-cr6609)
 esac
 
 config_load ubootenv
-config_foreach ubootenv_add_app_config ubootenv
+config_foreach ubootenv_add_app_config
 
 exit 0

package/boot/uboot-mediatek/001-mtk-0100-arm-dts-mt7622-remove-default-pinctrl-of-uart0.patch

@@ -0,0 +1,45 @@
+From a3ba6adb70c91ec3b9312c3a025faa44acd39cfa Mon Sep 17 00:00:00 2001
+From: Weijie Gao <weijie.gao@mediatek.com>
+Date: Wed, 13 Jul 2022 11:16:39 +0800
+Subject: [PATCH] arm: dts: mt7622: remove default pinctrl of uart0
+
+Currently u-boot running on mt7622 will print an warning log at beginning:
+> serial_mtk serial@11002000: pinctrl_select_state_full: uclass_get_device_by_phandle_id: err=-19
+
+It turns out that the pinctrl uclass can't work properly in board_f stage.
+
+Since the uart0 is the default UART device used by bootrom, and will be
+initialized in both bootrom and tf-a bl2. It's ok not to setup pinctrl for
+uart0 in u-boot.
+
+This patch removes the default pinctrl of uart0 to suppress the unwanted
+warning.
+
+Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
+---
+ arch/arm/dts/mt7622-bananapi-bpi-r64.dts | 2 --
+ arch/arm/dts/mt7622-rfb.dts              | 2 --
+ 2 files changed, 4 deletions(-)
+
+--- a/arch/arm/dts/mt7622-bananapi-bpi-r64.dts
++++ b/arch/arm/dts/mt7622-bananapi-bpi-r64.dts
+@@ -182,8 +182,6 @@
+ };
+ 
+ &uart0 {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&uart0_pins>;
+ 	status = "okay";
+ };
+ 
+--- a/arch/arm/dts/mt7622-rfb.dts
++++ b/arch/arm/dts/mt7622-rfb.dts
+@@ -189,8 +189,6 @@
+ };
+ 
+ &uart0 {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&uart0_pins>;
+ 	status = "okay";
+ };
+ 

package/boot/uboot-mediatek/patches/002-0011-arm-dts-mt7622-force-high-speed-mode-for-uart.patch

@@ -0,0 +1,26 @@
+From 79786aa175010dde78f95970939e8efadd7a3295 Mon Sep 17 00:00:00 2001
+From: Weijie Gao <weijie.gao@mediatek.com>
+Date: Wed, 31 Aug 2022 19:04:34 +0800
+Subject: [PATCH 11/32] arm: dts: mt7622: force high-speed mode for uart
+
+The input clock for uart is too slow (25MHz) which introduces frequent data
+error on both receiving and transmitting even if the baudrate is 115200.
+
+Using high-speed can significantly solve this issue.
+
+Reviewed-by: Simon Glass <sjg@chromium.org>
+Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
+---
+ arch/arm/dts/mt7622.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm/dts/mt7622.dtsi
++++ b/arch/arm/dts/mt7622.dtsi
+@@ -191,6 +191,7 @@
+ 		status = "disabled";
+ 		assigned-clocks = <&topckgen CLK_TOP_AXI_SEL>;
+ 		assigned-clock-parents = <&topckgen CLK_TOP_SYSPLL1_D2>;
++		mediatek,force-highspeed;
+ 	};
+ 
+ 	mmc0: mmc@11230000 {

package/boot/uboot-mediatek/patches/060-bootm-fix-typo-imape_comp-image_comp.patch

@@ -0,0 +1,48 @@
+From 22832a0a15227e3fcc364b356247d8aeb9ce45b3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 27 Aug 2022 04:05:31 +0100
+Subject: [PATCH 1/2] bootm: fix typo imape_comp -> image_comp
+
+Chage variable name 'imape_comp' to the supposedly intended name
+'image_comp'.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ boot/bootm.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/boot/bootm.c
++++ b/boot/bootm.c
+@@ -973,7 +973,7 @@ static int bootm_host_load_image(const v
+ 	int noffset;
+ 	ulong load_end;
+ 	uint8_t image_type;
+-	uint8_t imape_comp;
++	uint8_t image_comp;
+ 	void *load_buf;
+ 	int ret;
+ 
+@@ -991,20 +991,20 @@ static int bootm_host_load_image(const v
+ 		return -EINVAL;
+ 	}
+ 
+-	if (fit_image_get_comp(fit, noffset, &imape_comp)) {
++	if (fit_image_get_comp(fit, noffset, &image_comp)) {
+ 		puts("Can't get image compression!\n");
+ 		return -EINVAL;
+ 	}
+ 
+ 	/* Allow the image to expand by a factor of 4, should be safe */
+ 	load_buf = malloc((1 << 20) + len * 4);
+-	ret = image_decomp(imape_comp, 0, data, image_type, load_buf,
++	ret = image_decomp(image_comp, 0, data, image_type, load_buf,
+ 			   (void *)data, len, CONFIG_SYS_BOOTM_LEN,
+ 			   &load_end);
+ 	free(load_buf);
+ 
+ 	if (ret) {
+-		ret = handle_decomp_error(imape_comp, load_end - 0, ret);
++		ret = handle_decomp_error(image_comp, load_end - 0, ret);
+ 		if (ret != BOOTM_ERR_UNIMPLEMENTED)
+ 			return ret;
+ 	}

package/boot/uboot-mediatek/patches/061-image-fit-don-t-set-compression-if-it-can-t-be-read.patch

@@ -0,0 +1,71 @@
+From b2c109c012ca946baebbb23e7f4301f6eee4c6f3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Mon, 15 Aug 2022 12:15:50 +0200
+Subject: [PATCH 2/2] image-fit: don't set compression if it can't be read
+
+fit_image_get_comp() should not set value -1 in case it can't read
+the compression node. Instead, leave the value untouched in that case
+as it can be absent and a default value previously defined by the
+caller of fit_image_get_comp() should be used.
+
+As a result the warning message
+WARNING: 'compression' nodes for ramdisks are deprecated, please fix your .its file!
+no longer shows if the compression node is actually absent.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ boot/bootm.c     | 6 ++----
+ boot/image-fit.c | 3 +--
+ cmd/ximg.c       | 7 ++-----
+ 3 files changed, 5 insertions(+), 11 deletions(-)
+
+--- a/boot/bootm.c
++++ b/boot/bootm.c
+@@ -991,10 +991,8 @@ static int bootm_host_load_image(const v
+ 		return -EINVAL;
+ 	}
+ 
+-	if (fit_image_get_comp(fit, noffset, &image_comp)) {
+-		puts("Can't get image compression!\n");
+-		return -EINVAL;
+-	}
++	if (fit_image_get_comp(fit, noffset, &image_comp))
++		image_comp = IH_COMP_NONE;
+ 
+ 	/* Allow the image to expand by a factor of 4, should be safe */
+ 	load_buf = malloc((1 << 20) + len * 4);
+--- a/boot/image-fit.c
++++ b/boot/image-fit.c
+@@ -476,7 +476,7 @@ void fit_print_contents(const void *fit)
+ void fit_image_print(const void *fit, int image_noffset, const char *p)
+ {
+ 	char *desc;
+-	uint8_t type, arch, os, comp;
++	uint8_t type, arch, os, comp = IH_COMP_NONE;
+ 	size_t size;
+ 	ulong load, entry;
+ 	const void *data;
+@@ -793,7 +793,6 @@ int fit_image_get_comp(const void *fit,
+ 	data = fdt_getprop(fit, noffset, FIT_COMP_PROP, &len);
+ 	if (data == NULL) {
+ 		fit_get_debug(fit, noffset, FIT_COMP_PROP, len);
+-		*comp = -1;
+ 		return -1;
+ 	}
+ 
+--- a/cmd/ximg.c
++++ b/cmd/ximg.c
+@@ -171,11 +171,8 @@ do_imgextract(struct cmd_tbl *cmdtp, int
+ 			return 1;
+ 		}
+ 
+-		if (fit_image_get_comp(fit_hdr, noffset, &comp)) {
+-			puts("Could not find script subimage "
+-				"compression type\n");
+-			return 1;
+-		}
++		if (fit_image_get_comp(fit_hdr, noffset, &comp))
++			comp = IH_COMP_NONE;
+ 
+ 		data = (ulong)fit_data;
+ 		len = (ulong)fit_len;

package/boot/uboot-mediatek/patches/200-cmd-add-imsz-and-imszb.patch

@@ -68,7 +68,7 @@
  {
 --- a/boot/image-fit.c
 +++ b/boot/image-fit.c
-@@ -1993,6 +1993,51 @@ static const char *fit_get_image_type_pr
+@@ -1992,6 +1992,51 @@ static const char *fit_get_image_type_pr
  	return "unknown";
  }
  

package/boot/uboot-mediatek/patches/280-image-fdt-save-name-of-FIT-configuration-in-chosen-node.patch

@@ -41,11 +41,9 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  boot/image-fdt.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
-diff --git a/boot/image-fdt.c b/boot/image-fdt.c
-index 692a9ad3e4..4017bc94a6 100644
 --- a/boot/image-fdt.c
 +++ b/boot/image-fdt.c
-@@ -601,6 +601,12 @@ int image_setup_libfdt(bootm_headers_t *images, void *blob,
+@@ -601,6 +601,12 @@ int image_setup_libfdt(bootm_headers_t *
  		goto err;
  	}
  

package/boot/uboot-mediatek/patches/404-add-bananapi_bpi-r64_defconfigs.patch

@@ -643,7 +643,7 @@
 +boot_write_bl2=mtd erase bl2 && mtd write spi-nand0 $loadaddr 0x0 0x20000 && mtd write spi-nand0 $loadaddr 0x20000 0x20000 && mtd write spi-nand0 $loadaddr 0x40000 0x20000 && mtd write spi-nand0 $loadaddr 0x60000 0x20000
 +boot_write_fip=mtd erase fip && mtd write fip $loadaddr
 +check_ubi=ubi part ubi || run ubi_format
-+reset_factory=ubi part ubi ; ubi write 0x0 ubootenv 0x0 ; ubi write 0x0 ubootenv2 0x0 ; ubi remove rootfs_data
++reset_factory=mw $loadaddr 0x0 0x100000 ; ubi part ubi ; ubi write $loadaddr ubootenv 0x100000 ; ubi write $loadaddr ubootenv2 0x100000 ; ubi remove rootfs_data
 +ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
 +ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
 +ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs

package/boot/uboot-mediatek/patches/410-add-linksys-e8450.patch

@@ -139,7 +139,7 @@
 +CONFIG_USB_STORAGE=y
 --- /dev/null
 +++ b/arch/arm/dts/mt7622-linksys-e8450-ubi.dts
-@@ -0,0 +1,195 @@
+@@ -0,0 +1,193 @@
 +// SPDX-License-Identifier: GPL-2.0
 +/*
 + * Copyright (c) 2019 MediaTek Inc.
@@ -302,8 +302,6 @@
 +};
 +
 +&uart0 {
-+	pinctrl-names = "default";
-+	pinctrl-0 = <&uart0_pins>;
 +	status = "okay";
 +};
 +
@@ -392,7 +390,7 @@
 +boot_write_bl2=mtd erase bl2 && mtd write spi-nand0 $loadaddr 0x0 0x20000 && mtd write spi-nand0 $loadaddr 0x20000 0x20000 && mtd write spi-nand0 $loadaddr 0x40000 0x20000 && mtd write spi-nand0 $loadaddr 0x60000 0x20000
 +boot_write_fip=mtd erase fip && mtd write fip $loadaddr
 +check_ubi=ubi part ubi || run ubi_format
-+reset_factory=ubi part ubi ; ubi write 0x0 ubootenv 0x0 ; ubi write 0x0 ubootenv2 0x0 ; ubi remove rootfs_data
++reset_factory=mw $loadaddr 0x0 0x100000 ; ubi part ubi ; ubi write $loadaddr ubootenv 0x100000 ; ubi write $loadaddr ubootenv2 0x100000 ; ubi remove rootfs_data
 +ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
 +ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
 +ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs

package/boot/uboot-mediatek/patches/412-add-ubnt-unifi-6-lr.patch

@@ -1,6 +1,6 @@
 --- /dev/null
 +++ b/configs/mt7622_ubnt_unifi-6-lr_defconfig
-@@ -0,0 +1,141 @@
+@@ -0,0 +1,142 @@
 +CONFIG_ARM=y
 +CONFIG_POSITION_INDEPENDENT=y
 +CONFIG_ARCH_MEDIATEK=y
@@ -142,9 +142,10 @@
 +CONFIG_SPI_FLASH_SST=y
 +CONFIG_SPI_FLASH_WINBOND=y
 +CONFIG_SPI_FLASH_XMC=y
++CONFIG_SPI_FLASH_USE_4K_SECTORS=y
 --- /dev/null
 +++ b/arch/arm/dts/mt7622-ubnt-unifi-6-lr.dts
-@@ -0,0 +1,202 @@
+@@ -0,0 +1,187 @@
 +// SPDX-License-Identifier: GPL-2.0
 +/*
 + * Copyright (c) 2019 MediaTek Inc.
@@ -283,19 +284,6 @@
 +	};
 +};
 +
-+&snfi {
-+	pinctrl-names = "default", "snfi";
-+	pinctrl-0 = <&snor_pins>;
-+	pinctrl-1 = <&snfi_pins>;
-+	status = "okay";
-+
-+	spi-flash@0 {
-+		compatible = "jedec,spi-nor";
-+		reg = <0>;
-+		u-boot,dm-pre-reloc;
-+	};
-+};
-+
 +&snor {
 +	pinctrl-names = "default";
 +	pinctrl-0 = <&snor_pins>;
@@ -311,8 +299,6 @@
 +};
 +
 +&uart0 {
-+	pinctrl-names = "default";
-+	pinctrl-0 = <&uart0_pins>;
 +	status = "okay";
 +};
 +
@@ -366,10 +352,10 @@
 +loadaddr=0x48000000
 +bootcmd=if pstore check ; then run boot_recovery ; else run boot_nor ; fi
 +bootdelay=0
-+bootfile=openwrt-mediatek-mt7622-ubnt_unifi-6-lr-ubootmod-initramfs-recovery.itb
-+bootfile_bl2=openwrt-mediatek-mt7622-ubnt_unifi-6-lr-ubootmod-preloader.bin
-+bootfile_fip=openwrt-mediatek-mt7622-ubnt_unifi-6-lr-ubootmod-bl31-uboot.fip
-+bootfile_upg=openwrt-mediatek-mt7622-ubnt_unifi-6-lr-ubootmod-squashfs-sysupgrade.itb
++bootfile=openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-ubootmod-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-ubootmod-preloader.bin
++bootfile_fip=openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-ubootmod-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-mt7622-ubnt_unifi-6-lr-v1-ubootmod-squashfs-sysupgrade.itb
 +bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
 +bootmenu_default=0
 +bootmenu_delay=0
@@ -403,7 +389,7 @@
 +reset_factory=mtd erase nor0 0xc0000 0x10000 && reset
 +nor_read_production=mtd read nor0 $loadaddr 0x1000000 0x1000 && imsz $loadaddr image_size && mtd read nor0 $loadaddr 0x1000000 $image_size
 +nor_read_recovery=mtd read nor0 $loadaddr 0x120000 0x1000 && imsz $loadaddr image_size && mtd read nor0 $loadaddr 0x120000 $image_size
-+nor_pad_size=imsz $loadaddr image_size ; setexpr image_eb $image_size / 0x1000 ; setexpr tmp1 image_size % 0x1000 ; test 0x$tmp1 -gt 0 && setexpr image_eb $image_eb + 1 ; setexpr image_eb $image_eb * 0x1000
++nor_pad_size=imsz $loadaddr image_size ; setexpr image_eb 0x$image_size / 0x1000 ; setexpr tmp1 0x$image_size % 0x1000 ; test 0x$tmp1 -gt 0 && setexpr image_eb 0x$image_eb + 1 ; setexpr image_eb 0x$image_eb * 0x1000
 +nor_write_production=run nor_pad_size ; test 0x$image_eb -le 0x3000000 && mtd erase nor0 0x1000000 0x$image_eb && mtd write nor0 $loadaddr 0x1000000 $filesize
 +nor_write_recovery=run nor_pad_size ; test 0x$image_eb -le 0xee0000 && mtd erase nor0 0x120000 0x$image_eb && mtd write nor0 $loadaddr 0x120000 $filesize
 +_init_env=setenv _init_env ; saveenv

package/boot/uboot-mvebu/Makefile

@@ -8,10 +8,10 @@
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
-PKG_VERSION:=2022.04
+PKG_VERSION:=2022.07
 PKG_RELEASE:=$(AUTORELEASE)
 
-PKG_HASH:=68e065413926778e276ec3abd28bb32fa82abaa4a6898d570c1f48fbdb08bcd0
+PKG_HASH:=92b08eb49c24da14c1adbf70a71ae8f37cc53eeb4230e859ad8b6733d13dcf5e
 
 include $(INCLUDE_DIR)/u-boot.mk
 include $(INCLUDE_DIR)/package.mk

package/boot/uboot-mvebu/patches/0001-tools-termios_linux.h-Fix-compilation-on-non-glibc-s.patch

@@ -0,0 +1,44 @@
+From 82a6da13c3a113eefdb378ff53635f32a6184d6f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 8 Sep 2022 16:59:36 +0200
+Subject: [PATCH] tools: termios_linux.h: Fix compilation on non-glibc systems
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+TCGETS2 is defined in header file asm/ioctls.h provided by linux kernel.
+On glib systems it is automatically included by some other glibc include
+header file and therefore TCGETS2 is present in termios_linux.h when
+linux kernel provides it.
+
+On non-glibc systems (e.g. musl) asm/ioctls.h is not automatically included
+which results in the strange error that BOTHER is supported, TCGETS2 not
+defined and struct termios does not provide c_ispeed member.
+
+    tools/kwboot.c: In function 'kwboot_tty_change_baudrate':
+    tools/kwboot.c:662:6: error: 'struct termios' has no member named 'c_ospeed'
+      662 |   tio.c_ospeed = tio.c_ispeed = baudrate;
+          |      ^
+
+Fix this issue by explicitly including asm/ioctls.h file which provides
+TCGETS2 macro (if supported on selected architecture) to not depending on
+glibc auto-include behavior and because termios_linux.h requires it.
+
+With this change it is possible compile kwboot with musl libc.
+
+Reported-by: Michal Vasilek <michal.vasilek@nic.cz>
+Signed-off-by: Pali Rohár <pali@kernel.org>
+---
+ tools/termios_linux.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/termios_linux.h
++++ b/tools/termios_linux.h
+@@ -29,6 +29,7 @@
+ #include <errno.h>
+ #include <sys/ioctl.h>
+ #include <sys/types.h>
++#include <asm/ioctls.h>
+ #include <asm/termbits.h>
+ 
+ #if defined(BOTHER) && defined(TCGETS2)

package/boot/uboot-mvebu/patches/0002-tools-mkimage-fix-build-with-LibreSSL.patch

@@ -0,0 +1,28 @@
+From aed6107ae96870cd190b23d6da34a7e616799ed3 Mon Sep 17 00:00:00 2001
+From: Michal Vasilek <michal.vasilek@nic.cz>
+Date: Fri, 22 Jul 2022 19:55:53 +0200
+Subject: [PATCH 1/2] tools: mkimage: fix build with LibreSSL
+
+RSA_get0_* functions are not available in LibreSSL
+
+Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
+Reviewed-by: Simon Glass <sjg@chromium.org>
+---
+ tools/sunxi_toc0.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/tools/sunxi_toc0.c
++++ b/tools/sunxi_toc0.c
+@@ -34,6 +34,12 @@
+ #define pr_warn(fmt, args...)	fprintf(stderr, pr_fmt(fmt), "warning", ##args)
+ #define pr_info(fmt, args...)	fprintf(stderr, pr_fmt(fmt), "info", ##args)
+ 
++#if defined(LIBRESSL_VERSION_NUMBER)
++#define RSA_get0_n(key) (key)->n
++#define RSA_get0_e(key) (key)->e
++#define RSA_get0_d(key) (key)->d
++#endif
++
+ struct __packed toc0_key_item {
+ 	__le32  vendor_id;
+ 	__le32  key0_n_len;

package/boot/uboot-mvebu/patches/0003-tools-mkimage-fix-build-with-recent-LibreSSL.patch

@@ -0,0 +1,27 @@
+From 16b94d211b18ae0204c4f850fdf23573b19170ec Mon Sep 17 00:00:00 2001
+From: Mark Kettenis <kettenis@openbsd.org>
+Date: Mon, 29 Aug 2022 13:34:01 +0200
+Subject: [PATCH 2/2] tools: mkimage: fix build with recent LibreSSL
+
+LibreSSL 3.5.0 and later (also shipped as part of OpenBSD 7.1 and
+and later) have an opaque RSA object and do provide the
+RSA_get0_* functions that OpenSSL provides.
+
+Fixes: 2ecc354b8e46 ("tools: mkimage: fix build with LibreSSL")
+Signed-off-by: Mark Kettenis <kettenis@openbsd.org>
+Reviewed-by: Jonathan Gray <jsg@jsg.id.au>
+---
+ tools/sunxi_toc0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/sunxi_toc0.c
++++ b/tools/sunxi_toc0.c
+@@ -34,7 +34,7 @@
+ #define pr_warn(fmt, args...)	fprintf(stderr, pr_fmt(fmt), "warning", ##args)
+ #define pr_info(fmt, args...)	fprintf(stderr, pr_fmt(fmt), "info", ##args)
+ 
+-#if defined(LIBRESSL_VERSION_NUMBER)
++#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x3050000fL
+ #define RSA_get0_n(key) (key)->n
+ #define RSA_get0_e(key) (key)->e
+ #define RSA_get0_d(key) (key)->d

package/boot/uboot-mvebu/patches/100-fix-build.patch

@@ -0,0 +1,20 @@
+The build fails on a sunxi tool:
+
+/usr/bin/ld: tools/sunxi_toc0.o: in function `toc0_set_header':
+sunxi_toc0.c:(.text+0x363): undefined reference to `RSA_get0_d'
+
+The missing function was added in libressl v3.5.0. We don't
+really care, so just cut it out for now.
+
+--- a/tools/Makefile
++++ b/tools/Makefile
+@@ -96,8 +96,7 @@ AES_OBJS-$(CONFIG_TOOLS_LIBCRYPTO) := $(
+ 
+ # Cryptographic helpers and image types that depend on openssl/libcrypto
+ LIBCRYPTO_OBJS-$(CONFIG_TOOLS_LIBCRYPTO) := \
+-			lib/fdt-libcrypto.o \
+-			sunxi_toc0.o
++			lib/fdt-libcrypto.o
+ 
+ ROCKCHIP_OBS = lib/rc4.o rkcommon.o rkimage.o rksd.o rkspi.o
+ 

package/boot/uboot-mvebu/patches/103-arm-mvebu-clearfog_defconfig-enable-setexpr-command.patch

@@ -1,31 +0,0 @@
-From 40a67a9403deafdac05564b7350af49a71e12373 Mon Sep 17 00:00:00 2001
-From: Josef Schlehofer <pepe.schlehofer@gmail.com>
-Date: Fri, 29 Apr 2022 17:34:53 +0200
-Subject: [PATCH] arm: mvebu: clearfog_defconfig: enable setexpr command
-
-This command is useful in U-boot scripts and it is being used by
-OpenWrt bootscript for this board [1]. Otherwise shell scripting
-commands are enabled by default in cmd/Kconfig.
-
-[1] https://github.com/openwrt/openwrt/blob/852126680e21edc71c0c66561ae5a6d7479dcc67/target/linux/mvebu/image/clearfog.bootscript#L7
-
-[2] https://source.denx.de/u-boot/u-boot/-/blob/e95afa56753cebcd20a5114b6d121f281b789006/cmd/Kconfig#L1504
-
-Fixes: 0299c90f396c5b2971a4bac596339f4b03661c27 ("arm: mvebu: Add
-SolidRun ClearFog Armada 38x initial support")
-
-Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
----
- configs/clearfog_defconfig | 1 -
- 1 file changed, 1 deletion(-)
-
---- a/configs/clearfog_defconfig
-+++ b/configs/clearfog_defconfig
-@@ -35,7 +35,6 @@ CONFIG_CMD_MMC=y
- CONFIG_CMD_PCI=y
- CONFIG_CMD_SPI=y
- CONFIG_CMD_USB=y
--# CONFIG_CMD_SETEXPR is not set
- CONFIG_CMD_TFTPPUT=y
- CONFIG_CMD_CACHE=y
- CONFIG_CMD_TIME=y

package/firmware/intel-microcode/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=intel-microcode
-PKG_VERSION:=20220510
+PKG_VERSION:=20220809
 PKG_RELEASE:=1
 
 PKG_SOURCE:=intel-microcode_3.$(PKG_VERSION).1.tar.xz
 PKG_SOURCE_URL:=@DEBIAN/pool/non-free/i/intel-microcode/
-PKG_HASH:=49752447c1b905dd130699cdef09fb2bba47b6f413d27787c98a5569273e283e
+PKG_HASH:=4cf6c3638bb52d9d45c1916af866fd0929628a6f459daac3edfd369149e9c665
 PKG_BUILD_DIR:=$(BUILD_DIR)/intel-microcode-3.$(PKG_VERSION).1
 
 PKG_BUILD_DEPENDS:=iucode-tool/host

package/firmware/wireless-regdb/Makefile

@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wireless-regdb
-PKG_VERSION:=2022.06.06
+PKG_VERSION:=2022.08.12
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/wireless-regdb/
-PKG_HASH:=ac00f97efecce5046ed069d1d93f3365fdf994c7c7854a8fc50831e959537230
+PKG_HASH:=59c8f7d17966db71b27f90e735ee8f5b42ca3527694a8c5e6e9b56bd379c3b84
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 

package/kernel/linux/Makefile

@@ -12,7 +12,9 @@ PKG_NAME:=kernel
 PKG_FLAGS:=hold
 
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/packages
-SCAN_DEPS=modules/*.mk $(TOPDIR)/target/linux/*/modules.mk $(TOPDIR)/include/netfilter.mk
+SUBTARGETS = $(sort $(filter-out feeds,$(notdir $(wildcard $(TOPDIR)/target/linux/* $(TOPDIR)/target/linux/feeds/*))))
+SUBTARGET_MODULES = $(foreach t,$(SUBTARGETS),$(firstword $(wildcard $(TOPDIR)/target/linux/feeds/$(t)/modules.mk $(TOPDIR)/target/linux/$(t)/modules.mk)))
+SCAN_DEPS=modules/*.mk $(SUBTARGET_MODULES) $(TOPDIR)/include/netfilter.mk
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=
@@ -63,4 +65,4 @@ endef
 $(eval $(if $(DUMP),,$(call BuildPackage,kernel)))
 
 include $(sort $(wildcard ./modules/*.mk))
--include $(TOPDIR)/target/linux/*/modules.mk
+-include $(SUBTARGET_MODULES)

package/kernel/linux/files/sysctl-nf-conntrack.conf

@@ -3,7 +3,6 @@
 
 net.netfilter.nf_conntrack_acct=1
 net.netfilter.nf_conntrack_checksum=0
-net.netfilter.nf_conntrack_max=16384
 net.netfilter.nf_conntrack_tcp_timeout_established=7440
 net.netfilter.nf_conntrack_udp_timeout=60
 net.netfilter.nf_conntrack_udp_timeout_stream=180

package/kernel/linux/modules/crypto.mk

@@ -237,6 +237,18 @@ endef
 $(eval $(call KernelPackage,crypto-echainiv))
 
 
+define KernelPackage/crypto-essiv
+  TITLE:=ESSIV support for block encryption
+  DEPENDS:=+kmod-crypto-authenc
+  KCONFIG:=CONFIG_CRYPTO_ESSIV
+  FILES:= $(LINUX_DIR)/crypto/essiv.ko
+  AUTOLOAD:=$(call AutoLoad,10,essiv)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-essiv))
+
+
 define KernelPackage/crypto-fcrypt
   TITLE:=FCRYPT cipher CryptoAPI module
   KCONFIG:=CONFIG_CRYPTO_FCRYPT
@@ -619,7 +631,8 @@ define KernelPackage/crypto-md5
   DEPENDS:=+kmod-crypto-hash
   KCONFIG:= \
 	CONFIG_CRYPTO_MD5 \
-	CONFIG_CRYPTO_MD5_OCTEON
+	CONFIG_CRYPTO_MD5_OCTEON \
+	CONFIG_CRYPTO_MD5_PPC
   FILES:=$(LINUX_DIR)/crypto/md5.ko
   AUTOLOAD:=$(call AutoLoad,09,md5)
   $(call AddDepends/crypto)
@@ -630,6 +643,11 @@ define KernelPackage/crypto-md5/octeon
   AUTOLOAD+=$(call AutoLoad,09,octeon-md5)
 endef
 
+define KernelPackage/crypto-md5/mpc85xx
+  FILES+=$(LINUX_DIR)/arch/powerpc/crypto/md5-ppc.ko
+  AUTOLOAD+=$(call AutoLoad,09,md5-ppc)
+endef
+
 $(eval $(call KernelPackage,crypto-md5))
 
 
@@ -829,6 +847,7 @@ define KernelPackage/crypto-sha1
 	CONFIG_CRYPTO_SHA1_ARM \
 	CONFIG_CRYPTO_SHA1_ARM_NEON \
 	CONFIG_CRYPTO_SHA1_OCTEON \
+	CONFIG_CRYPTO_SHA1_PPC_SPE \
 	CONFIG_CRYPTO_SHA1_SSSE3
   FILES:=$(LINUX_DIR)/crypto/sha1_generic.ko
   AUTOLOAD:=$(call AutoLoad,09,sha1_generic)
@@ -857,6 +876,11 @@ endef
 
 KernelPackage/crypto-sha1/tegra=$(KernelPakcage/crypto-sha1/arm)
 
+define KernelPackage/crypto-sha1/mpc85xx
+  FILES+=$(LINUX_DIR)/arch/powerpc/crypto/sha1-ppc-spe.ko
+  AUTOLOAD+=$(call AutoLoad,09,sha1-ppc-spe)
+endef
+
 define KernelPackage/crypto-sha1/x86/64
   FILES+=$(LINUX_DIR)/arch/x86/crypto/sha1-ssse3.ko
   AUTOLOAD+=$(call AutoLoad,09,sha1-ssse3)
@@ -871,6 +895,7 @@ define KernelPackage/crypto-sha256
   KCONFIG:= \
 	CONFIG_CRYPTO_SHA256 \
 	CONFIG_CRYPTO_SHA256_OCTEON \
+	CONFIG_CRYPTO_SHA256_PPC_SPE \
 	CONFIG_CRYPTO_SHA256_SSSE3
   FILES:= \
 	$(LINUX_DIR)/crypto/sha256_generic.ko \
@@ -884,6 +909,11 @@ define KernelPackage/crypto-sha256/octeon
   AUTOLOAD+=$(call AutoLoad,09,octeon-sha256)
 endef
 
+define KernelPackage/crypto-sha256/mpc85xx
+  FILES+=$(LINUX_DIR)/arch/powerpc/crypto/sha256-ppc-spe.ko
+  AUTOLOAD+=$(call AutoLoad,09,sha256-ppc-spe)
+endef
+
 define KernelPackage/crypto-sha256/x86/64
   FILES+=$(LINUX_DIR)/arch/x86/crypto/sha256-ssse3.ko
   AUTOLOAD+=$(call AutoLoad,09,sha256-ssse3)

package/kernel/linux/modules/netdevices.mk

@@ -225,6 +225,23 @@ endef
 $(eval $(call KernelPackage,phylib-broadcom))
 
 
+define KernelPackage/phy-ax88796b
+   SUBMENU:=$(NETWORK_DEVICES_MENU)
+   TITLE:=Asix PHY driver
+   KCONFIG:=CONFIG_AX88796B_PHY
+   DEPENDS:=+kmod-libphy
+   FILES:=$(LINUX_DIR)/drivers/net/phy/ax88796b.ko
+   AUTOLOAD:=$(call AutoProbe,ax88796b)
+endef
+
+define KernelPackage/phy-ax88796b/description
+   Currently supports the Asix Electronics PHY found in the X-Surf 100
+   AX88796B package.
+endef
+
+$(eval $(call KernelPackage,phy-ax88796b))
+
+
 define KernelPackage/phy-broadcom
    SUBMENU:=$(NETWORK_DEVICES_MENU)
    TITLE:=Broadcom Ethernet PHY driver
@@ -275,6 +292,22 @@ endef
 $(eval $(call KernelPackage,phy-realtek))
 
 
+define KernelPackage/phy-smsc
+   SUBMENU:=$(NETWORK_DEVICES_MENU)
+   TITLE:=SMSC PHY driver
+   KCONFIG:=CONFIG_SMSC_PHY
+   DEPENDS:=+kmod-libphy
+   FILES:=$(LINUX_DIR)/drivers/net/phy/smsc.ko
+   AUTOLOAD:=$(call AutoProbe,smsc)
+endef
+
+define KernelPackage/phy-smsc/description
+   Currently supports the LAN83C185, LAN8187 and LAN8700 PHYs
+endef
+
+$(eval $(call KernelPackage,phy-smsc))
+
+
 define KernelPackage/swconfig
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=switch configuration API

package/kernel/linux/modules/netfilter.mk

@@ -350,6 +350,7 @@ IPSET_MODULES:= \
 	ipset/ip_set_bitmap_ipmac \
 	ipset/ip_set_bitmap_port \
 	ipset/ip_set_hash_ip \
+	ipset/ip_set_hash_ipmac \
 	ipset/ip_set_hash_ipmark \
 	ipset/ip_set_hash_ipport \
 	ipset/ip_set_hash_ipportip \
@@ -608,23 +609,6 @@ endef
 $(eval $(call KernelPackage,nf-nathelper-extra))
 
 
-define KernelPackage/ipt-ulog
-  TITLE:=Module for user-space packet logging
-  KCONFIG:=$(KCONFIG_IPT_ULOG)
-  FILES:=$(foreach mod,$(IPT_ULOG-m),$(LINUX_DIR)/net/$(mod).ko)
-  AUTOLOAD:=$(call AutoProbe,$(notdir $(IPT_ULOG-m)))
-  $(call AddDepends/ipt)
-endef
-
-define KernelPackage/ipt-ulog/description
- Netfilter (IPv4) module for user-space packet logging
- Includes:
- - ULOG
-endef
-
-$(eval $(call KernelPackage,ipt-ulog))
-
-
 define KernelPackage/ipt-nflog
   TITLE:=Module for user-space packet logging
   KCONFIG:=$(KCONFIG_IPT_NFLOG)
@@ -1186,17 +1170,6 @@ endef
 $(eval $(call KernelPackage,nft-offload))
 
 
-define KernelPackage/nft-nat6
-  SUBMENU:=$(NF_MENU)
-  TITLE:=Netfilter nf_tables IPv6-NAT support
-  DEPENDS:=+kmod-nft-nat +kmod-nf-nat6
-  FILES:=$(foreach mod,$(NFT_NAT6-m),$(LINUX_DIR)/net/$(mod).ko)
-  AUTOLOAD:=$(call AutoProbe,$(notdir $(NFT_NAT6-m)))
-  KCONFIG:=$(KCONFIG_NFT_NAT6)
-endef
-
-$(eval $(call KernelPackage,nft-nat6))
-
 define KernelPackage/nft-netdev
   SUBMENU:=$(NF_MENU)
   TITLE:=Netfilter nf_tables netdev support

package/kernel/linux/modules/netsupport.mk

@@ -738,12 +738,8 @@ endef
 $(eval $(call KernelPackage,mppe))
 
 
-SCHED_MODULES = $(patsubst $(LINUX_DIR)/net/sched/%.ko,%,$(wildcard $(LINUX_DIR)/net/sched/*.ko))
-SCHED_MODULES_CORE = sch_ingress sch_fq_codel sch_hfsc sch_htb sch_tbf cls_basic cls_fw cls_route cls_flow cls_tcindex cls_u32 em_u32 act_gact act_mirred act_skbedit cls_matchall
-SCHED_MODULES_FILTER = $(SCHED_MODULES_CORE) act_connmark act_ctinfo sch_cake sch_netem sch_mqprio em_ipset cls_bpf cls_flower act_bpf act_vlan
-SCHED_MODULES_EXTRA = $(filter-out $(SCHED_MODULES_FILTER),$(SCHED_MODULES))
-SCHED_FILES = $(patsubst %,$(LINUX_DIR)/net/sched/%.ko,$(filter $(SCHED_MODULES_CORE),$(SCHED_MODULES)))
-SCHED_FILES_EXTRA = $(patsubst %,$(LINUX_DIR)/net/sched/%.ko,$(SCHED_MODULES_EXTRA))
+SCHED_MODULES_CORE = sch_ingress sch_hfsc sch_htb sch_tbf cls_basic cls_fw cls_route cls_flow cls_tcindex cls_u32 em_u32 act_gact act_mirred act_skbedit cls_matchall
+SCHED_FILES_CORE = $(foreach mod,$(SCHED_MODULES_CORE),$(LINUX_DIR)/net/sched/$(mod).ko)
 
 define KernelPackage/sched-core
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
@@ -754,7 +750,6 @@ define KernelPackage/sched-core
 	CONFIG_NET_SCH_HTB \
 	CONFIG_NET_SCH_TBF \
 	CONFIG_NET_SCH_INGRESS \
-	CONFIG_NET_SCH_FQ_CODEL \
 	CONFIG_NET_CLS=y \
 	CONFIG_NET_CLS_ACT=y \
 	CONFIG_NET_CLS_BASIC \
@@ -769,7 +764,7 @@ define KernelPackage/sched-core
 	CONFIG_NET_CLS_MATCHALL \
 	CONFIG_NET_EMATCH=y \
 	CONFIG_NET_EMATCH_U32
-  FILES:=$(SCHED_FILES)
+  FILES:=$(SCHED_FILES_CORE)
   AUTOLOAD:=$(call AutoLoad,70, $(SCHED_MODULES_CORE))
 endef
 
@@ -901,14 +896,16 @@ endef
 $(eval $(call KernelPackage,bpf-test))
 
 
+SCHED_MODULES_EXTRA = sch_codel sch_dsmark sch_gred sch_multiq sch_prio sch_red sch_sfq sch_teql sch_fq sch_pie act_police act_ipt act_pedit act_simple act_csum em_cmp em_nbyte em_meta em_text
+SCHED_FILES_EXTRA = $(foreach mod,$(SCHED_MODULES_EXTRA),$(LINUX_DIR)/net/sched/$(mod).ko)
+
 define KernelPackage/sched
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=Extra traffic schedulers
-  DEPENDS:=+kmod-sched-core +kmod-ipt-core +kmod-lib-crc32c
+  DEPENDS:=+kmod-sched-core +kmod-ipt-core +kmod-lib-crc32c +kmod-lib-textsearch
   KCONFIG:= \
 	CONFIG_NET_SCH_CODEL \
 	CONFIG_NET_SCH_DSMARK \
-	CONFIG_NET_SCH_FIFO \
 	CONFIG_NET_SCH_GRED \
 	CONFIG_NET_SCH_MULTIQ \
 	CONFIG_NET_SCH_PRIO \

package/kernel/linux/modules/usb.mk

@@ -1138,7 +1138,7 @@ $(eval $(call KernelPackage,usb-net-aqc111))
 
 define KernelPackage/usb-net-asix
   TITLE:=Kernel module for USB-to-Ethernet Asix convertors
-  DEPENDS:=+kmod-libphy
+  DEPENDS:=+kmod-libphy +kmod-phy-ax88796b
   KCONFIG:=CONFIG_USB_NET_AX8817X
   FILES:=$(LINUX_DIR)/drivers/$(USBNET_DIR)/asix.ko
   AUTOLOAD:=$(call AutoProbe,asix)
@@ -1266,7 +1266,7 @@ $(eval $(call KernelPackage,usb-net-smsc75xx))
 
 define KernelPackage/usb-net-smsc95xx
   TITLE:=SMSC LAN95XX based USB 2.0 10/100 ethernet devices
-  DEPENDS:=+LINUX_5_10:kmod-libphy
+  DEPENDS:=+LINUX_5_10:kmod-libphy +kmod-phy-smsc
   KCONFIG:=CONFIG_USB_NET_SMSC95XX
   FILES:=$(LINUX_DIR)/drivers/$(USBNET_DIR)/smsc95xx.ko
   AUTOLOAD:=$(call AutoProbe,smsc95xx)

package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh

@@ -413,9 +413,9 @@ mac80211_hostapd_setup_base() {
 			he_spr_non_srg_obss_pd_max_offset:1 \
 			he_bss_color
 
-		he_phy_cap=$(iw phy "$phy" info | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
+		he_phy_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE PHY Capabilities/ { print $2 }' | head -1)
 		he_phy_cap=${he_phy_cap:2}
-		he_mac_cap=$(iw phy "$phy" info | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
+		he_mac_cap=$(iw phy "$phy" info | sed -n '/HE Iftypes: AP/,$p' | awk -F "[()]" '/HE MAC Capabilities/ { print $2 }' | head -1)
 		he_mac_cap=${he_mac_cap:2}
 
 		append base_cfg "ieee80211ax=1" "$N"

package/kernel/mac80211/patches/rt2x00/001-rt2x00-define-RF5592-in-init_eeprom-routine.patch

@@ -0,0 +1,52 @@
+From patchwork Sat Sep 17 20:26:27 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979242
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:26:27 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 01/16] rt2x00: define RF5592 in init_eeprom routine
+Message-ID: 
+ <d7eccb2c7b8ec4cd360fa2007796abffc35abb0d.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Fix incorrect RF value encoded in EEPROM on devices with Ralink Rt5592
+PCIe radio (a single chip 2T2R 802.11abgn solution).
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -9435,6 +9435,8 @@ static int rt2800_init_eeprom(struct rt2
+ 		rf = RF3853;
+ 	else if (rt2x00_rt(rt2x00dev, RT5350))
+ 		rf = RF5350;
++	else if (rt2x00_rt(rt2x00dev, RT5592))
++		rf = RF5592;
+ 	else
+ 		rf = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
+ 

package/kernel/mac80211/patches/rt2x00/002-rt2x00-add-throughput-LED-trigger.patch

@@ -0,0 +1,76 @@
+From patchwork Sat Sep 17 20:26:40 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979243
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:26:40 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 02/16] rt2x00: add throughput LED trigger
+Message-ID: 
+ <73f5ba4134e621462a26186449400cf0c1ac1730.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: David Bauer <mail@david-bauer.net>
+
+This adds a (currently missing) throughput LED trigger for the rt2x00
+driver. Previously, LED triggers had to be assigned to the netdev, which
+was limited to a single VAP.
+
+Tested-by: Christoph Krapp <achterin@googlemail.com>
+Signed-off-by: David Bauer <mail@david-bauer.net>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+@@ -1093,6 +1093,19 @@ static void rt2x00lib_remove_hw(struct r
+ 	kfree(rt2x00dev->spec.channels_info);
+ }
+ 
++static const struct ieee80211_tpt_blink rt2x00_tpt_blink[] = {
++	{ .throughput = 0 * 1024, .blink_time = 334 },
++	{ .throughput = 1 * 1024, .blink_time = 260 },
++	{ .throughput = 2 * 1024, .blink_time = 220 },
++	{ .throughput = 5 * 1024, .blink_time = 190 },
++	{ .throughput = 10 * 1024, .blink_time = 170 },
++	{ .throughput = 25 * 1024, .blink_time = 150 },
++	{ .throughput = 54 * 1024, .blink_time = 130 },
++	{ .throughput = 120 * 1024, .blink_time = 110 },
++	{ .throughput = 265 * 1024, .blink_time = 80 },
++	{ .throughput = 586 * 1024, .blink_time = 50 },
++};
++
+ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ 	struct hw_mode_spec *spec = &rt2x00dev->spec;
+@@ -1174,6 +1187,11 @@ static int rt2x00lib_probe_hw(struct rt2
+ 
+ #undef RT2X00_TASKLET_INIT
+ 
++	ieee80211_create_tpt_led_trigger(rt2x00dev->hw,
++					 IEEE80211_TPT_LEDTRIG_FL_RADIO,
++					 rt2x00_tpt_blink,
++					 ARRAY_SIZE(rt2x00_tpt_blink));
++
+ 	/*
+ 	 * Register HW.
+ 	 */

package/kernel/mac80211/patches/rt2x00/002-rt2x00-define-RF5592-in-init_eeprom-routine.patch

@@ -1,51 +0,0 @@
-From patchwork Thu Dec 27 14:05:26 2018
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 8bit
-X-Patchwork-Submitter: Tom Psyborg <pozega.tomislav@gmail.com>
-X-Patchwork-Id: 10743707
-X-Patchwork-Delegate: kvalo@adurom.com
-From: =?utf-8?q?Tomislav_Po=C5=BEega?= <pozega.tomislav@gmail.com>
-To: linux-wireless@vger.kernel.org
-Cc: kvalo@codeaurora.org, hauke@hauke-m.de, nbd@nbd.name,
-        john@phrozen.org, sgruszka@redhat.com, daniel@makrotopia.org
-Subject: [PATCH 2/2] rt2x00: define RF5592 in init_eeprom routine
-Date: Thu, 27 Dec 2018 15:05:26 +0100
-Message-Id: <1545919526-4074-2-git-send-email-pozega.tomislav@gmail.com>
-X-Mailer: git-send-email 1.7.0.4
-In-Reply-To: <1545919526-4074-1-git-send-email-pozega.tomislav@gmail.com>
-References: <1545919526-4074-1-git-send-email-pozega.tomislav@gmail.com>
-MIME-Version: 1.0
-Sender: linux-wireless-owner@vger.kernel.org
-Precedence: bulk
-List-ID: <linux-wireless.vger.kernel.org>
-X-Mailing-List: linux-wireless@vger.kernel.org
-X-Virus-Scanned: ClamAV using ClamSMTP
-
-This patch fixes following crash on Linksys EA2750 during 5GHz wifi
-init:
-
-[    7.955153] rt2800pci 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
-[    7.962259] rt2800pci 0000:01:00.0: loaded eeprom from mtd device "Factory"
-[    7.969435] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5592, rev 0222 detected
-[    7.977348] ieee80211 phy0: rt2800_init_eeprom: Error - Invalid RF chipset 0x0000 detected
-[    7.985793] ieee80211 phy0: rt2x00lib_probe_dev: Error - Failed to allocate device
-[    7.993569] CPU 0 Unable to handle kernel paging request at virtual address 00000024, epc == 800c8f54, ra == 80249ff8
-[    8.004408] Oops[#1]:
-
-Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
- 1 files changed, 2 insertions(+), 0 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9435,6 +9435,8 @@ static int rt2800_init_eeprom(struct rt2
- 		rf = RF3853;
- 	else if (rt2x00_rt(rt2x00dev, RT5350))
- 		rf = RF5350;
-+	else if (rt2x00_rt(rt2x00dev, RT5592))
-+		rf = RF5592;
- 	else
- 		rf = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
- 

package/kernel/mac80211/patches/rt2x00/003-rt2x00-add-support-for-external-PA-on-MT7620.patch

@@ -1,22 +1,42 @@
-From 9782a7f7488443568fa4d6088b73c9aff7eb8510 Mon Sep 17 00:00:00 2001
+From patchwork Sat Sep 17 20:26:55 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979244
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:26:55 +0100
 From: Daniel Golle <daniel@makrotopia.org>
-Date: Wed, 19 Apr 2017 16:14:53 +0200
-Subject: [PATCH] rt2x00: add support for external PA on MT7620
-To: Stanislaw Gruszka <sgruszka@redhat.com>
-Cc: Helmut Schaa <helmut.schaa@googlemail.com>,
-    linux-wireless@vger.kernel.org,
-    Kalle Valo <kvalo@codeaurora.org>
-Content-Type: text/plain; charset="UTF-8"
-Content-Transfer-Encoding: quoted-printable
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 03/16] rt2x00: add support for external PA on MT7620
+Message-ID: 
+ <af2c68ff831816a86fc39b0c10911c129a1f03dc.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
 
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
-Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
+Implement support for external PA connected to MT7620A.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
 [pozega.tomislav@gmail.com: use chanreg and dccal helpers.]
-
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
 ---
- drivers/net/wireless/ralink/rt2x00/rt2800.h    |  1 +
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 70 +++++++++++++++++++++++++-
- 2 files changed, 70 insertions(+), 1 deletion(-)
+ drivers/net/wireless/ralink/rt2x00/rt2800.h   |  1 +
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 52 ++++++++++++++++++-
+ 2 files changed, 52 insertions(+), 1 deletion(-)
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
@@ -24,21 +44,19 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
  #define EEPROM_NIC_CONF2_RX_STREAM	FIELD16(0x000f)
  #define EEPROM_NIC_CONF2_TX_STREAM	FIELD16(0x00f0)
  #define EEPROM_NIC_CONF2_CRYSTAL	FIELD16(0x0600)
-+#define EEPROM_NIC_CONF2_EXTERNAL_PA	FIELD16(0xc000)
++#define EEPROM_NIC_CONF2_EXTERNAL_PA	FIELD16(0x8000)
  
  /*
   * EEPROM LNA
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4369,6 +4369,45 @@ static void rt2800_config_channel(struct
+@@ -4368,6 +4368,43 @@ static void rt2800_config_channel(struct
  		rt2800_iq_calibrate(rt2x00dev, rf->channel);
  	}
  
 +	if (rt2x00_rt(rt2x00dev, RT6352)) {
 +		if (test_bit(CAPABILITY_EXTERNAL_PA_TX0,
 +			     &rt2x00dev->cap_flags)) {
-+			rt2x00_warn(rt2x00dev, "Using incomplete support for " \
-+					       "external PA\n");
 +			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
 +			reg |= 0x00000101;
 +			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
@@ -76,7 +94,7 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
  	bbp = rt2800_bbp_read(rt2x00dev, 4);
  	rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
  	rt2800_bbp_write(rt2x00dev, 4, bbp);
-@@ -9578,7 +9617,8 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9566,7 +9603,8 @@ static int rt2800_init_eeprom(struct rt2
  	 */
  	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1);
  
@@ -86,19 +104,19 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
  		if (rt2x00_get_field16(eeprom,
  		    EEPROM_NIC_CONF1_EXTERNAL_TX0_PA_3352))
  		    __set_bit(CAPABILITY_EXTERNAL_PA_TX0,
-@@ -9589,6 +9629,18 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9577,6 +9615,18 @@ static int rt2800_init_eeprom(struct rt2
  			      &rt2x00dev->cap_flags);
  	}
  
 +	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF2);
 +
 +	if (rt2x00_rt(rt2x00dev, RT6352) && eeprom != 0 && eeprom != 0xffff) {
-+		if (rt2x00_get_field16(eeprom,
-+		    EEPROM_NIC_CONF2_EXTERNAL_PA)) {
-+		    __set_bit(CAPABILITY_EXTERNAL_PA_TX0,
-+			      &rt2x00dev->cap_flags);
-+		    __set_bit(CAPABILITY_EXTERNAL_PA_TX1,
-+			      &rt2x00dev->cap_flags);
++		if (!rt2x00_get_field16(eeprom,
++					EEPROM_NIC_CONF2_EXTERNAL_PA)) {
++			__clear_bit(CAPABILITY_EXTERNAL_PA_TX0,
++				    &rt2x00dev->cap_flags);
++			__clear_bit(CAPABILITY_EXTERNAL_PA_TX1,
++				    &rt2x00dev->cap_flags);
 +		}
 +	}
 +

package/kernel/mac80211/patches/rt2x00/004-rt2x00-move-up-and-reuse-busy-wait-functions.patch

@@ -0,0 +1,178 @@
+From patchwork Sat Sep 17 20:27:10 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979245
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:27:10 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 04/16] rt2x00: move up and reuse busy wait functions
+Message-ID: 
+ <3fdb9dc15e76a9f9c1948b4a3a1308a7a5677bb8.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Move bbp_ready and rf_ready busy wait functions up in the code so they
+can more easily be used. Allow specifying register mask in rf_ready
+function which is useful for calibration routines which will be added
+in follow-up commits.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 99 +++++++++----------
+ 1 file changed, 46 insertions(+), 53 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -2143,6 +2143,48 @@ void rt2800_config_erp(struct rt2x00_dev
+ }
+ EXPORT_SYMBOL_GPL(rt2800_config_erp);
+ 
++static int rt2800_wait_bbp_rf_ready(struct rt2x00_dev *rt2x00dev,
++				    const struct rt2x00_field32 mask)
++{
++	unsigned int i;
++	u32 reg;
++
++	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
++		reg = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (!rt2x00_get_field32(reg, mask))
++			return 0;
++
++		udelay(REGISTER_BUSY_DELAY);
++	}
++
++	rt2x00_err(rt2x00dev, "BBP/RF register access failed, aborting\n");
++	return -EACCES;
++}
++
++static int rt2800_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
++{
++	unsigned int i;
++	u8 value;
++
++	/*
++	 * BBP was enabled after firmware was loaded,
++	 * but we need to reactivate it now.
++	 */
++	rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
++	rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
++	msleep(1);
++
++	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
++		value = rt2800_bbp_read(rt2x00dev, 0);
++		if ((value != 0xff) && (value != 0x00))
++			return 0;
++		udelay(REGISTER_BUSY_DELAY);
++	}
++
++	rt2x00_err(rt2x00dev, "BBP register access failed, aborting\n");
++	return -EACCES;
++}
++
+ static void rt2800_config_3572bt_ant(struct rt2x00_dev *rt2x00dev)
+ {
+ 	u32 reg;
+@@ -3799,10 +3841,9 @@ static void rt2800_config_alc(struct rt2
+ 			      struct ieee80211_channel *chan,
+ 			      int power_level) {
+ 	u16 eeprom, target_power, max_power;
+-	u32 mac_sys_ctrl, mac_status;
++	u32 mac_sys_ctrl;
+ 	u32 reg;
+ 	u8 bbp;
+-	int i;
+ 
+ 	/* hardware unit is 0.5dBm, limited to 23.5dBm */
+ 	power_level *= 2;
+@@ -3838,16 +3879,8 @@ static void rt2800_config_alc(struct rt2
+ 	/* Disable Tx/Rx */
+ 	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0);
+ 	/* Check MAC Tx/Rx idle */
+-	for (i = 0; i < 10000; i++) {
+-		mac_status = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
+-		if (mac_status & 0x3)
+-			usleep_range(50, 200);
+-		else
+-			break;
+-	}
+-
+-	if (i == 10000)
+-		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
++		rt2x00_warn(rt2x00dev, "RF busy while configuring ALC\n");
+ 
+ 	if (chan->center_freq > 2457) {
+ 		bbp = rt2800_bbp_read(rt2x00dev, 30);
+@@ -6249,46 +6282,6 @@ static int rt2800_init_registers(struct
+ 	return 0;
+ }
+ 
+-static int rt2800_wait_bbp_rf_ready(struct rt2x00_dev *rt2x00dev)
+-{
+-	unsigned int i;
+-	u32 reg;
+-
+-	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+-		reg = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
+-		if (!rt2x00_get_field32(reg, MAC_STATUS_CFG_BBP_RF_BUSY))
+-			return 0;
+-
+-		udelay(REGISTER_BUSY_DELAY);
+-	}
+-
+-	rt2x00_err(rt2x00dev, "BBP/RF register access failed, aborting\n");
+-	return -EACCES;
+-}
+-
+-static int rt2800_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
+-{
+-	unsigned int i;
+-	u8 value;
+-
+-	/*
+-	 * BBP was enabled after firmware was loaded,
+-	 * but we need to reactivate it now.
+-	 */
+-	rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+-	rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+-	msleep(1);
+-
+-	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+-		value = rt2800_bbp_read(rt2x00dev, 0);
+-		if ((value != 0xff) && (value != 0x00))
+-			return 0;
+-		udelay(REGISTER_BUSY_DELAY);
+-	}
+-
+-	rt2x00_err(rt2x00dev, "BBP register access failed, aborting\n");
+-	return -EACCES;
+-}
+ 
+ static void rt2800_bbp4_mac_if_ctrl(struct rt2x00_dev *rt2x00dev)
+ {
+@@ -9110,7 +9103,7 @@ int rt2800_enable_radio(struct rt2x00_de
+ 	/*
+ 	 * Wait BBP/RF to wake up.
+ 	 */
+-	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev)))
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
+ 		return -EIO;
+ 
+ 	/*

package/kernel/mac80211/patches/rt2x00/005-rt2x00-add-RF-self-TXDC-calibration-for-MT7620.patch

@@ -1,6 +1,48 @@
+From patchwork Sat Sep 17 20:27:26 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979246
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:27:26 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 05/16] rt2x00: add RF self TXDC calibration for MT7620
+Message-ID: 
+ <dbb6e5a0c12d6101477bd09e83253091d21512c9.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Add TX self calibration based on mtk driver.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+v2: use ++i instead of i = i + 1 in loops
+
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 48 +++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8438,6 +8438,56 @@ static void rt2800_init_rfcsr_5592(struc
+@@ -8428,6 +8428,53 @@ static void rt2800_init_rfcsr_5592(struc
  	rt2800_led_open_drain_enable(rt2x00dev);
  }
  
@@ -10,7 +52,6 @@
 +	u32 mac0518, mac051c, mac0528, mac052c;
 +	u8 i;
 +
-+	rt2x00_info(rt2x00dev, "RF Tx self calibration start\n");
 +	mac0518 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
 +	mac051c = rt2800_register_read(rt2x00dev, RF_BYPASS0);
 +	mac0528 = rt2800_register_read(rt2x00dev, RF_CONTROL2);
@@ -27,19 +68,19 @@
 +	rfb7r1_org = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
 +
 +	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, 0x4);
-+	for (i = 0; i < 100; i = i + 1) {
-+		udelay(50);
++	for (i = 0; i < 100; ++i) {
++		usleep_range(50, 100);
 +		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 1);
-+		if((rfvalue & 0x04) != 0x4)
++		if ((rfvalue & 0x04) != 0x4)
 +			break;
 +	}
 +	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, rfb5r1_org);
 +
 +	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, 0x4);
-+	for (i = 0; i < 100; i = i + 1) {
-+		udelay(50);
++	for (i = 0; i < 100; ++i) {
++		usleep_range(50, 100);
 +		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
-+		if((rfvalue & 0x04) != 0x4)
++		if ((rfvalue & 0x04) != 0x4)
 +			break;
 +	}
 +	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, rfb7r1_org);
@@ -50,14 +91,12 @@
 +	rt2800_register_write(rt2x00dev, RF_BYPASS0, mac051c);
 +	rt2800_register_write(rt2x00dev, RF_CONTROL2, mac0528);
 +	rt2800_register_write(rt2x00dev, RF_BYPASS2, mac052c);
-+
-+	rt2x00_info(rt2x00dev, "RF Tx self calibration end\n");
 +}
 +
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9045,6 +9095,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9035,6 +9082,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
  

package/kernel/mac80211/patches/rt2x00/006-rt2x00-add-r-calibration-for-MT7620.patch

@@ -1,14 +1,68 @@
+From patchwork Sat Sep 17 20:27:41 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979247
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:27:41 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 06/16] rt2x00: add r calibration for MT7620
+Message-ID: 
+ <e0c34f233089bec4eb73826bc4f512166ee25934.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Add r calibration code as found in mtk driver.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+v2: use rt2800_wait_bbp_rf_ready()
+
+ drivers/net/wireless/ralink/rt2x00/rt2800.h   |   2 +
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 133 ++++++++++++++++++
+ 2 files changed, 135 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+@@ -1016,6 +1016,8 @@
+  */
+ #define MAC_STATUS_CFG			0x1200
+ #define MAC_STATUS_CFG_BBP_RF_BUSY	FIELD32(0x00000003)
++#define MAC_STATUS_CFG_BBP_RF_BUSY_TX	FIELD32(0x00000001)
++#define MAC_STATUS_CFG_BBP_RF_BUSY_RX	FIELD32(0x00000002)
+ 
+ /*
+  * PWR_PIN_CFG:
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8488,6 +8488,155 @@ static void rt2800_rf_self_txdc_cal(stru
- 	rt2x00_info(rt2x00dev, "RF Tx self calibration end\n");
+@@ -8475,6 +8475,138 @@ static void rt2800_rf_self_txdc_cal(stru
+ 	rt2800_register_write(rt2x00dev, RF_BYPASS2, mac052c);
  }
  
 +static int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2)
 +{
-+	int calcode;
-+	calcode = ((d2 - d1) * 1000) / 43;
-+	if ((calcode%10) >= 5)
++	int calcode = ((d2 - d1) * 1000) / 43;
++
++	if ((calcode % 10) >= 5)
 +		calcode += 10;
 +	calcode = (calcode / 10);
 +
@@ -28,8 +82,7 @@
 +	char d1 = 0, d2 = 0;
 +	u8 rfvalue;
 +	u32 MAC_RF_BYPASS0, MAC_RF_CONTROL0, MAC_PWR_PIN_CFG;
-+	u32 maccfg, macstatus;
-+	int i;
++	u32 maccfg;
 +
 +	saverfb0r1 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
 +	saverfb0r34 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 34);
@@ -53,30 +106,14 @@
 +	maccfg &= (~0x04);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
 +
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x1)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	if (i == 10000)
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_TX)))
 +		rt2x00_warn(rt2x00dev, "Wait MAC Tx Status to MAX !!!\n");
 +
 +	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	maccfg &= (~0x04);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
 +
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x2)
-+			udelay(50);
-+		else
-+			break;
-+		}
-+
-+	if (i == 10000)
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_RX)))
 +		rt2x00_warn(rt2x00dev, "Wait MAC Rx Status to MAX !!!\n");
 +
 +	rfvalue = (MAC_RF_BYPASS0 | 0x3004);
@@ -98,7 +135,7 @@
 +
 +	rt2800_bbp_write(rt2x00dev, 47, 0x04);
 +	rt2800_bbp_write(rt2x00dev, 22, 0x80);
-+	udelay(100);
++	usleep_range(100, 200);
 +	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
 +	if (bytevalue > 128)
 +		d1 = bytevalue - 256;
@@ -108,7 +145,7 @@
 +	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x01);
 +
 +	rt2800_bbp_write(rt2x00dev, 22, 0x80);
-+	udelay(100);
++	usleep_range(100, 200);
 +	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
 +	if (bytevalue > 128)
 +		d2 = bytevalue - 256;
@@ -156,7 +193,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9095,6 +9244,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9082,6 +9214,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
  

package/kernel/mac80211/patches/rt2x00/007-rt2x00-add-RXDCOC-calibration-for-MT7620.patch

@@ -1,13 +1,54 @@
+From patchwork Sat Sep 17 20:27:56 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979248
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:27:56 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 07/16] rt2x00: add RXDCOC calibration for MT7620
+Message-ID: 
+ <850b30f652e88de30d79e968af4eb47aa5bc2511.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Add RXDCOC calibration code from mtk driver.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+[fixed typo reported by Serge Vasilugin <vasilugin@yandex.ru>]
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 60 +++++++++++++++++++
+ 1 file changed, 60 insertions(+)
+
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8637,6 +8637,70 @@ static void rt2800_r_calibration(struct
+@@ -8607,6 +8607,65 @@ static void rt2800_r_calibration(struct
  	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, MAC_PWR_PIN_CFG);
  }
  
 +static void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev)
 +{
 +	u8 bbpreg = 0;
-+	u32 macvalue = 0, macvalue1 = 0;
++	u32 macvalue = 0;
 +	u8 saverfb0r2, saverfb5r4, saverfb7r4, rfvalue;
 +	int i;
 +
@@ -24,15 +65,10 @@
 +	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x8);
 +
-+	for (i = 0; i < 10000; i++) {
-+		macvalue1 = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue1 & 0x1)
-+			udelay(50);
-+		else
-+			break;
-+	}
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_TX)))
++		rt2x00_warn(rt2x00dev, "RF TX busy in RX RXDCOC calibration\n");
 +
-+	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 0);
++	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
 +	saverfb7r4 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
 +	saverfb5r4 = saverfb5r4 & (~0x40);
 +	saverfb7r4 = saverfb7r4 & (~0x40);
@@ -49,9 +85,9 @@
 +
 +	for (i = 0; i < 10000; i++) {
 +		bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+		if ((bbpreg & 0x40)==0)
++		if ((bbpreg & 0x40) == 0)
 +			break;
-+		udelay(50);
++		usleep_range(50, 100);
 +	}
 +
 +	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
@@ -71,7 +107,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9246,6 +9310,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9216,6 +9275,7 @@ static void rt2800_init_rfcsr_6352(struc
  
  	rt2800_r_calibration(rt2x00dev);
  	rt2800_rf_self_txdc_cal(rt2x00dev);

package/kernel/mac80211/patches/rt2x00/008-rt2x00-add-RXIQ-calibration-for-MT7620.patch

@@ -1,17 +1,62 @@
+From patchwork Sat Sep 17 20:28:10 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979249
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:28:10 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 08/16] rt2x00: add RXIQ calibration for MT7620
+Message-ID: 
+ <033a39a697d51f6df258acea4c33608e0944fe4c.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Add RXIQ calibration found in mtk driver. With old openwrt builds this
+gets us ~8Mbps more of RX bandwidth (test with iPA/eLNA layout).
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+v2: use rt2800_wait_bbp_rf_ready(), fix indentation
+
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 375 ++++++++++++++++++
+ 1 file changed, 375 insertions(+)
+
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8701,6 +8701,384 @@ static void rt2800_rxdcoc_calibration(st
+@@ -8666,6 +8666,380 @@ static void rt2800_rxdcoc_calibration(st
  	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, saverfb0r2);
  }
  
-+static u32 rt2800_do_sqrt_accumulation(u32 si) {
++static u32 rt2800_do_sqrt_accumulation(u32 si)
++{
 +	u32 root, root_pre, bit;
 +	char i;
++
 +	bit = 1 << 15;
 +	root = 0;
 +	for (i = 15; i >= 0; i = i - 1) {
 +		root_pre = root + bit;
-+		if ((root_pre*root_pre) <= si)
++		if ((root_pre * root_pre) <= si)
 +			root = root_pre;
 +		bit = bit >> 1;
 +	}
@@ -19,7 +64,8 @@
 +	return root;
 +}
 +
-+static void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev) {
++static void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev)
++{
 +	u8 rfb0r1, rfb0r2, rfb0r42;
 +	u8 rfb4r0, rfb4r19;
 +	u8 rfb5r3, rfb5r4, rfb5r17, rfb5r18, rfb5r19, rfb5r20;
@@ -43,8 +89,8 @@
 +	u32 orig_RF_BYPASS1 = 0;
 +	u32 orig_RF_CONTROL3 = 0;
 +	u32 orig_RF_BYPASS3 = 0;
-+	u32 macstatus, bbpval1 = 0;
-+	u8 rf_vga_table[] = {0x20, 0x21, 0x22, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f};
++	u32 bbpval1 = 0;
++	static const u8 rf_vga_table[] = {0x20, 0x21, 0x22, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f};
 +
 +	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	orig_RF_CONTROL0 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
@@ -59,16 +105,8 @@
 +
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x0);
 +
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x3)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	if (i == 10000)
-+		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
++		rt2x00_warn(rt2x00dev, "Timeout waiting for MAC status in RXIQ calibration\n");
 +
 +	bbpval = bbp4 & (~0x18);
 +	bbpval = bbp4 | 0x00;
@@ -165,7 +203,7 @@
 +			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
 +			udelay(1);
 +
-+			bbpval = bbp1 & (~ 0x18);
++			bbpval = bbp1 & (~0x18);
 +			bbpval = bbpval | 0x00;
 +			rt2800_bbp_write(rt2x00dev, 1, bbpval);
 +
@@ -184,132 +222,133 @@
 +			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002006);
 +			udelay(1);
 +
-+			bbpval = bbp1 & (~ 0x18);
++			bbpval = bbp1 & (~0x18);
 +			bbpval = bbpval | 0x08;
 +			rt2800_bbp_write(rt2x00dev, 1, bbpval);
 +
 +			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x01);
 +		}
-+		udelay(500);
++		usleep_range(500, 1500);
 +
 +		vga_idx = 0;
-+			while (vga_idx < 11) {
-+				rt2800_rfcsr_write_dccal(rt2x00dev, 3, rf_vga_table[vga_idx]);
-+				rt2800_rfcsr_write_dccal(rt2x00dev, 4, rf_vga_table[vga_idx]);
++		while (vga_idx < 11) {
++			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rf_vga_table[vga_idx]);
++			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rf_vga_table[vga_idx]);
 +
-+				rt2800_bbp_dcoc_write(rt2x00dev, 0, 0x93);
++			rt2800_bbp_dcoc_write(rt2x00dev, 0, 0x93);
 +
-+				for (i = 0; i < 10000; i++) {
-+					bbpval = rt2800_bbp_read(rt2x00dev, 159);
-+					if ((bbpval & 0xff) == 0x93)
-+						udelay(50);
-+					else
-+						break;
-+					}
-+
-+				if ((bbpval & 0xff) == 0x93) {
-+					rt2x00_warn(rt2x00dev, "Fatal Error: Calibration doesn't finish");
-+					goto restore_value;
-+				}
-+
-+				for (i = 0; i < 5; i++) {
-+					u32 bbptemp = 0;
-+					u8 value = 0;
-+					int result = 0;
-+
-+					rt2800_bbp_write(rt2x00dev, 158, 0x1e);
-+					rt2800_bbp_write(rt2x00dev, 159, i);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x22);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 24);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x21);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 16);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x20);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 8);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x1f);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + value;
-+
-+					if ((i < 2) && (bbptemp & 0x800000))
-+						result = (bbptemp & 0xffffff) - 0x1000000;
-+					else if (i == 4)
-+						result = bbptemp;
-+					else
-+						result = bbptemp;
-+
-+					if (i == 0)
-+						mi = result/4096;
-+					else if (i == 1)
-+						mq = result/4096;
-+					else if (i == 2)
-+						si = bbptemp/4096;
-+					else if (i == 3)
-+						sq = bbptemp/4096;
-+					else
-+						riq = result/4096;
-+				}
-+
-+				bbpval1 = si - mi*mi;
-+				rt2x00_dbg(rt2x00dev, "RXIQ si=%d, sq=%d, riq=%d, bbpval %d, vga_idx %d", si, sq, riq, bbpval1, vga_idx);
-+
-+				if (bbpval1 >= (100*100))
-+					break;
-+
-+				if (bbpval1 <= 100)
-+					vga_idx = vga_idx + 9;
-+				else if (bbpval1 <= 158)
-+					vga_idx = vga_idx + 8;
-+				else if (bbpval1 <= 251)
-+					vga_idx = vga_idx + 7;
-+				else if (bbpval1 <= 398)
-+					vga_idx = vga_idx + 6;
-+				else if (bbpval1 <= 630)
-+					vga_idx = vga_idx + 5;
-+				else if (bbpval1 <= 1000)
-+					vga_idx = vga_idx + 4;
-+				else if (bbpval1 <= 1584)
-+					vga_idx = vga_idx + 3;
-+				else if (bbpval1 <= 2511)
-+					vga_idx = vga_idx + 2;
++			for (i = 0; i < 10000; i++) {
++				bbpval = rt2800_bbp_read(rt2x00dev, 159);
++				if ((bbpval & 0xff) == 0x93)
++					usleep_range(50, 100);
 +				else
-+					vga_idx = vga_idx + 1;
++					break;
++				}
++
++			if ((bbpval & 0xff) == 0x93) {
++				rt2x00_warn(rt2x00dev, "Fatal Error: Calibration doesn't finish");
++				goto restore_value;
++			}
++			for (i = 0; i < 5; i++) {
++				u32 bbptemp = 0;
++				u8 value = 0;
++				int result = 0;
++
++				rt2800_bbp_write(rt2x00dev, 158, 0x1e);
++				rt2800_bbp_write(rt2x00dev, 159, i);
++				rt2800_bbp_write(rt2x00dev, 158, 0x22);
++				value = rt2800_bbp_read(rt2x00dev, 159);
++				bbptemp = bbptemp + (value << 24);
++				rt2800_bbp_write(rt2x00dev, 158, 0x21);
++				value = rt2800_bbp_read(rt2x00dev, 159);
++				bbptemp = bbptemp + (value << 16);
++				rt2800_bbp_write(rt2x00dev, 158, 0x20);
++				value = rt2800_bbp_read(rt2x00dev, 159);
++				bbptemp = bbptemp + (value << 8);
++				rt2800_bbp_write(rt2x00dev, 158, 0x1f);
++				value = rt2800_bbp_read(rt2x00dev, 159);
++				bbptemp = bbptemp + value;
++
++				if (i < 2 && (bbptemp & 0x800000))
++					result = (bbptemp & 0xffffff) - 0x1000000;
++				else if (i == 4)
++					result = bbptemp;
++				else
++					result = bbptemp;
++
++				if (i == 0)
++					mi = result / 4096;
++				else if (i == 1)
++					mq = result / 4096;
++				else if (i == 2)
++					si = bbptemp / 4096;
++				else if (i == 3)
++					sq = bbptemp / 4096;
++				else
++					riq = result / 4096;
 +			}
 +
-+		sigma_i = rt2800_do_sqrt_accumulation(100*(si - mi*mi));
-+		sigma_q = rt2800_do_sqrt_accumulation(100*(sq - mq*mq));
-+		r_iq = 10*(riq-(mi*mq));
++			bbpval1 = si - mi * mi;
++			rt2x00_dbg(rt2x00dev,
++				   "RXIQ si=%d, sq=%d, riq=%d, bbpval %d, vga_idx %d",
++				   si, sq, riq, bbpval1, vga_idx);
++
++			if (bbpval1 >= (100 * 100))
++				break;
++
++			if (bbpval1 <= 100)
++				vga_idx = vga_idx + 9;
++			else if (bbpval1 <= 158)
++				vga_idx = vga_idx + 8;
++			else if (bbpval1 <= 251)
++				vga_idx = vga_idx + 7;
++			else if (bbpval1 <= 398)
++				vga_idx = vga_idx + 6;
++			else if (bbpval1 <= 630)
++				vga_idx = vga_idx + 5;
++			else if (bbpval1 <= 1000)
++				vga_idx = vga_idx + 4;
++			else if (bbpval1 <= 1584)
++				vga_idx = vga_idx + 3;
++			else if (bbpval1 <= 2511)
++				vga_idx = vga_idx + 2;
++			else
++				vga_idx = vga_idx + 1;
++		}
++
++		sigma_i = rt2800_do_sqrt_accumulation(100 * (si - mi * mi));
++		sigma_q = rt2800_do_sqrt_accumulation(100 * (sq - mq * mq));
++		r_iq = 10 * (riq - (mi * mq));
 +
 +		rt2x00_dbg(rt2x00dev, "Sigma_i=%d, Sigma_q=%d, R_iq=%d", sigma_i, sigma_q, r_iq);
 +
-+		if (((sigma_i <= 1400 ) && (sigma_i >= 1000))
-+			&& ((sigma_i - sigma_q) <= 112)
-+			&& ((sigma_i - sigma_q) >= -112)
-+			&& ((mi <= 32) && (mi >= -32))
-+			&& ((mq <= 32) && (mq >= -32))) {
-+				r_iq = 10*(riq-(mi*mq));
-+				rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
++		if (sigma_i <= 1400 && sigma_i >= 1000 &&
++		    (sigma_i - sigma_q) <= 112 &&
++		    (sigma_i - sigma_q) >= -112 &&
++		    mi <= 32 && mi >= -32 &&
++		    mq <= 32 && mq >= -32) {
++			r_iq = 10 * (riq - (mi * mq));
++			rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n",
++				   sigma_i, sigma_q, r_iq);
 +
-+				g_rx = (1000 * sigma_q) / sigma_i;
-+				g_imb = ((-2) * 128 * (1000 - g_rx)) / (1000 + g_rx);
-+				ph_rx = (r_iq * 2292) / (sigma_i * sigma_q);
-+				rt2x00_info(rt2x00dev, "RXIQ G_imb=%d, Ph_rx=%d\n", g_imb, ph_rx);
++			g_rx = (1000 * sigma_q) / sigma_i;
++			g_imb = ((-2) * 128 * (1000 - g_rx)) / (1000 + g_rx);
++			ph_rx = (r_iq * 2292) / (sigma_i * sigma_q);
 +
-+				if ((ph_rx > 20) || (ph_rx < -20)) {
-+					ph_rx = 0;
-+					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
-+				}
-+
-+				if ((g_imb > 12) || (g_imb < -12)) {
-+					g_imb = 0;
-+					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
-+				}
++			if (ph_rx > 20 || ph_rx < -20) {
++				ph_rx = 0;
++				rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
 +			}
-+		else {
++
++			if (g_imb > 12 || g_imb < -12) {
++				g_imb = 0;
++				rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
++			}
++		} else {
 +			g_imb = 0;
 +			ph_rx = 0;
-+			rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
++			rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n",
++				   sigma_i, sigma_q, r_iq);
 +			rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
 +		}
 +
@@ -385,7 +424,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9313,6 +9691,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9278,6 +9652,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rxdcoc_calibration(rt2x00dev);
  	rt2800_bw_filter_calibration(rt2x00dev, true);
  	rt2800_bw_filter_calibration(rt2x00dev, false);

package/kernel/mac80211/patches/rt2x00/009-rt2x00-don-t-run-Rt5592-IQ-calibration-on-MT7620.patch

@@ -0,0 +1,52 @@
+From patchwork Sat Sep 17 20:28:29 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979250
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:28:29 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 09/16] rt2x00: don't run Rt5592 IQ calibration on MT7620
+Message-ID: 
+ <31a1c34ddbd296b82f38c18c9ae7339059215fdc.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+The function rt2800_iq_calibrate is intended for Rt5592 only.
+Don't call it for MT7620 which has it's own calibration functions.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+v2: test for RT5592 instead of !RT6352
+
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -4398,7 +4398,8 @@ static void rt2800_config_channel(struct
+ 		reg = (rf->channel <= 14 ? 0x1c : 0x24) + 2*rt2x00dev->lna_gain;
+ 		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+ 
+-		rt2800_iq_calibrate(rt2x00dev, rf->channel);
++		if (rt2x00_rt(rt2x00dev, RT5592))
++			rt2800_iq_calibrate(rt2x00dev, rf->channel);
+ 	}
+ 
+ 	if (rt2x00_rt(rt2x00dev, RT6352)) {

package/kernel/mac80211/patches/rt2x00/010-rt2x00-add-TX-LOFT-calibration-for-MT7620.patch

@@ -1,10 +1,56 @@
+From patchwork Sat Sep 17 20:28:43 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979251
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:28:43 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 10/16] rt2x00: add TX LOFT calibration for MT7620
+Message-ID: 
+ <d9295a9138a1f552b648aacb84e1419d38f5c896.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Add TX LOFT calibration from mtk driver.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+v2: use helper functions, make tables static const, remove useless
+    debug prints
+v3: don't export function not used anywhere else
+Reported-by: kernel test robot <lkp@intel.com>
+
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 902 ++++++++++++++++++
+ .../net/wireless/ralink/rt2x00/rt2800lib.h    |  10 +
+ 2 files changed, 912 insertions(+)
+
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9079,6 +9079,943 @@ restore_value:
+@@ -9041,6 +9041,907 @@ restore_value:
  	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
  }
  
-+static void rt2800_rf_configstore(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_reg_record[][13], u8 chain)
++static void rt2800_rf_configstore(struct rt2x00_dev *rt2x00dev,
++				  struct rf_reg_pair rf_reg_record[][13], u8 chain)
 +{
 +	u8 rfvalue = 0;
 +
@@ -116,13 +162,11 @@
 +		rf_reg_record[CHAIN_1][12].value = rfvalue;
 +	} else {
 +		rt2x00_warn(rt2x00dev, "Unknown chain = %u\n", chain);
-+		return;
 +	}
-+
-+	return;
 +}
 +
-+static void rt2800_rf_configrecover(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_record[][13])
++static void rt2800_rf_configrecover(struct rt2x00_dev *rt2x00dev,
++				    struct rf_reg_pair rf_record[][13])
 +{
 +	u8 chain_index = 0, record_index = 0;
 +	u8 bank = 0, rf_register = 0, value = 0;
@@ -133,11 +177,10 @@
 +			rf_register = rf_record[chain_index][record_index].reg;
 +			value = rf_record[chain_index][record_index].value;
 +			rt2800_rfcsr_write_bank(rt2x00dev, bank, rf_register, value);
-+			rt2x00_dbg(rt2x00dev, "bank: %d, rf_register: %d, value: %x\n", bank, rf_register, value);
++			rt2x00_dbg(rt2x00dev, "bank: %d, rf_register: %d, value: %x\n",
++				   bank, rf_register, value);
 +		}
 +	}
-+
-+	return;
 +}
 +
 +static void rt2800_setbbptonegenerator(struct rt2x00_dev *rt2x00dev)
@@ -155,15 +198,13 @@
 +	rt2800_bbp_write(rt2x00dev, 159, 0x3F);
 +
 +	rt2800_bbp_write(rt2x00dev, 244, 0x40);
-+
-+	return;
 +}
 +
 +static u32 rt2800_do_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx, u8 read_neg)
 +{
 +	u32 macvalue = 0;
 +	int fftout_i = 0, fftout_q = 0;
-+	u32 ptmp=0, pint = 0;
++	u32 ptmp = 0, pint = 0;
 +	u8 bbp = 0;
 +	u8 tidxi;
 +
@@ -173,7 +214,7 @@
 +	bbp = 0x9b;
 +
 +	while (bbp == 0x9b) {
-+		udelay(10);
++		usleep_range(10, 50);
 +		bbp = rt2800_bbp_read(rt2x00dev, 159);
 +		bbp = bbp & 0xff;
 +	}
@@ -218,10 +259,11 @@
 +	return pint;
 +}
 +
-+static u32 rt2800_read_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx) {
++static u32 rt2800_read_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx)
++{
 +	u32 macvalue = 0;
 +	int fftout_i = 0, fftout_q = 0;
-+	u32 ptmp=0, pint = 0;
++	u32 ptmp = 0, pint = 0;
 +
 +	rt2800_bbp_write(rt2x00dev, 158, 0xBA);
 +	rt2800_bbp_write(rt2x00dev, 159, tidx);
@@ -237,7 +279,6 @@
 +	ptmp = (fftout_i * fftout_i);
 +	ptmp = ptmp + (fftout_q * fftout_q);
 +	pint = ptmp;
-+	rt2x00_info(rt2x00dev, "I = %d,  Q = %d, power = %x\n", fftout_i, fftout_q, pint);
 +
 +	return pint;
 +}
@@ -251,18 +292,17 @@
 +	rt2800_bbp_write(rt2x00dev, 159, bbp);
 +
 +	if (ch_idx == 0)
-+		bbp = (iorq == 0) ? 0xb1: 0xb2;
++		bbp = (iorq == 0) ? 0xb1 : 0xb2;
 +	else
-+		bbp = (iorq == 0) ? 0xb8: 0xb9;
++		bbp = (iorq == 0) ? 0xb8 : 0xb9;
 +
 +	rt2800_bbp_write(rt2x00dev, 158, bbp);
 +	bbp = dc;
 +	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	return;
 +}
 +
-+static void rt2800_loft_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 alc_idx, u8 dc_result[][RF_ALC_NUM][2])
++static void rt2800_loft_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx,
++			       u8 alc_idx, u8 dc_result[][RF_ALC_NUM][2])
 +{
 +	u32 p0 = 0, p1 = 0, pf = 0;
 +	char idx0 = 0, idx1 = 0;
@@ -276,8 +316,6 @@
 +
 +	for (bidx = 5; bidx >= 0; bidx--) {
 +		for (iorq = 0; iorq <= 1; iorq++) {
-+			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
-+
 +			if (idxf[iorq] == 0x20) {
 +				idx0 = 0x20;
 +				p0 = pf;
@@ -288,16 +326,17 @@
 +				p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
 +			}
 +
-+			idx1 = idxf[iorq] + ((bidx == 5) ? 0 : ibit);
++			idx1 = idxf[iorq] + (bidx == 5 ? 0 : ibit);
 +			idx1 = idx1 & 0x3F;
 +			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idx1);
 +			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
 +
-+			rt2x00_dbg(rt2x00dev, "alc=%u, IorQ=%u, idx_final=%2x\n", alc_idx, iorq, idxf[iorq]);
-+			rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pf=%x, idx_0=%x, idx_1=%x, ibit=%x !\n", p0, p1, pf, idx0, idx1, ibit);
++			rt2x00_dbg(rt2x00dev, "alc=%u, IorQ=%u, idx_final=%2x\n",
++				   alc_idx, iorq, idxf[iorq]);
++			rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pf=%x, idx_0=%x, idx_1=%x, ibit=%x\n",
++				   p0, p1, pf, idx0, idx1, ibit);
 +
-+			if ((bidx != 5) && (pf <= p0) && (pf < p1)) {
-+				pf = pf;
++			if (bidx != 5 && pf <= p0 && pf < p1) {
 +				idxf[iorq] = idxf[iorq];
 +			} else if (p0 < p1) {
 +				pf = p0;
@@ -306,17 +345,15 @@
 +				pf = p1;
 +				idxf[iorq] = idx1 & 0x3F;
 +			}
-+			rt2x00_dbg(rt2x00dev, "IorQ=%u, idx_final[%u]:%x, pf:%8x\n", iorq, iorq, idxf[iorq], pf);
++			rt2x00_dbg(rt2x00dev, "IorQ=%u, idx_final[%u]:%x, pf:%8x\n",
++				   iorq, iorq, idxf[iorq], pf);
 +
 +			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idxf[iorq]);
-+
 +		}
 +		ibit = ibit >> 1;
 +	}
 +	dc_result[ch_idx][alc_idx][0] = idxf[0];
 +	dc_result[ch_idx][alc_idx][1] = idxf[1];
-+
-+	return;
 +}
 +
 +static void rt2800_iq_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 *ges, u8 *pes)
@@ -334,26 +371,25 @@
 +	u8 bbp = 0;
 +	char bidx;
 +
-+	rt2x00_info(rt2x00dev, "IQCalibration Start!\n");
 +	for (bidx = 5; bidx >= 1; bidx--) {
 +		for (gop = 0; gop < 2; gop++) {
-+			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
-+
-+			if ((gop == 1) || (bidx < 4)) {
++			if (gop == 1 || bidx < 4) {
 +				if (gop == 0)
 +					iq_err = gerr;
 +				else
 +					iq_err = perr;
 +
 +				first_search = (gop == 0) ? (bidx == 3) : (bidx == 5);
-+				touch_neg_max = (gop) ? ((iq_err & 0x0F) == 0x08) : ((iq_err & 0x3F) == 0x20);
++				touch_neg_max = (gop) ? ((iq_err & 0x0F) == 0x08) :
++							((iq_err & 0x3F) == 0x20);
 +
 +				if (touch_neg_max) {
 +					p0 = pf;
 +					idx0 = iq_err;
 +				} else {
 +					idx0 = iq_err - ibit;
-+					bbp = (ch_idx == 0) ? ((gop == 0) ? 0x28 : 0x29): ((gop == 0) ? 0x46 : 0x47);
++					bbp = (ch_idx == 0) ? ((gop == 0) ? 0x28 : 0x29) :
++							      ((gop == 0) ? 0x46 : 0x47);
 +
 +					rt2800_bbp_write(rt2x00dev, 158, bbp);
 +					rt2800_bbp_write(rt2x00dev, 159, idx0);
@@ -364,26 +400,30 @@
 +				idx1 = iq_err + (first_search ? 0 : ibit);
 +				idx1 = (gop == 0) ? (idx1 & 0x0F) : (idx1 & 0x3F);
 +
-+				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
++				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 :
++				      (gop == 0) ? 0x46 : 0x47;
 +
 +				rt2800_bbp_write(rt2x00dev, 158, bbp);
 +				rt2800_bbp_write(rt2x00dev, 159, idx1);
 +
 +				p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
 +
-+				rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pwer_final=%x, idx0=%x, idx1=%x, iq_err=%x, gop=%d, ibit=%x !\n", p0, p1, pf, idx0, idx1, iq_err, gop, ibit);
++				rt2x00_dbg(rt2x00dev,
++					   "p0=%x, p1=%x, pwer_final=%x, idx0=%x, idx1=%x, iq_err=%x, gop=%d, ibit=%x\n",
++					   p0, p1, pf, idx0, idx1, iq_err, gop, ibit);
 +
-+				if ((!first_search) && (pf <= p0) && (pf < p1)) {
-+					pf = pf;
-+				} else if (p0 < p1) {
-+					pf = p0;
-+					iq_err = idx0;
-+				} else {
-+					pf = p1;
-+					iq_err = idx1;
++				if (!(!first_search && pf <= p0 && pf < p1)) {
++					if (p0 < p1) {
++						pf = p0;
++						iq_err = idx0;
++					} else {
++						pf = p1;
++						iq_err = idx1;
++					}
 +				}
 +
-+				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
++				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 :
++						      (gop == 0) ? 0x46 : 0x47;
 +
 +				rt2800_bbp_write(rt2x00dev, 158, bbp);
 +				rt2800_bbp_write(rt2x00dev, 159, iq_err);
@@ -393,8 +433,8 @@
 +				else
 +					perr = iq_err;
 +
-+				rt2x00_dbg(rt2x00dev, "IQCalibration pf=%8x (%2x, %2x) !\n", pf, gerr & 0x0F, perr & 0x3F);
-+
++				rt2x00_dbg(rt2x00dev, "IQCalibration pf=%8x (%2x, %2x) !\n",
++					   pf, gerr & 0x0F, perr & 0x3F);
 +			}
 +		}
 +
@@ -423,25 +463,21 @@
 +			rt2800_bbp_write(rt2x00dev, 159, pef & 0x3F);
 +
 +			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
-+			if ((gef == gsta) && (pef == psta)) {
++			if (gef == gsta && pef == psta) {
++				pf = p1;
++				gerr = gef;
++				perr = pef;
++			} else if (pf > p1) {
 +				pf = p1;
 +				gerr = gef;
 +				perr = pef;
 +			}
-+			else if (pf > p1){
-+				pf = p1;
-+				gerr = gef;
-+				perr = pef;
-+			}
-+			rt2x00_dbg(rt2x00dev, "Fine IQCalibration p1=%8x pf=%8x (%2x, %2x) !\n", p1, pf, gef & 0x0F, pef & 0x3F);
++			rt2x00_dbg(rt2x00dev, "Fine IQCalibration p1=%8x pf=%8x (%2x, %2x) !\n",
++				   p1, pf, gef & 0x0F, pef & 0x3F);
 +		}
 +
 +	ges[ch_idx] = gerr & 0x0F;
 +	pes[ch_idx] = perr & 0x3F;
-+
-+	rt2x00_info(rt2x00dev, "IQCalibration Done! CH = %u, (gain=%2x, phase=%2x)\n", ch_idx, gerr & 0x0F, perr & 0x3F);
-+
-+	return;
 +}
 +
 +static void rt2800_rf_aux_tx0_loopback(struct rt2x00_dev *rt2x00dev)
@@ -478,9 +514,9 @@
 +	rt2800_rfcsr_write_bank(rt2x00dev, 7, 20, 0x20);
 +}
 +
-+void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev)
++static void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev)
 +{
-+	rf_reg_pair rf_store[CHAIN_NUM][13];
++	struct rf_reg_pair rf_store[CHAIN_NUM][13];
 +	u32 macorg1 = 0;
 +	u32 macorg2 = 0;
 +	u32 macorg3 = 0;
@@ -489,7 +525,7 @@
 +	u32 orig528 = 0;
 +	u32 orig52c = 0;
 +
-+	u32 savemacsysctrl = 0, mtxcycle = 0;
++	u32 savemacsysctrl = 0;
 +	u32 macvalue = 0;
 +	u32 mac13b8 = 0;
 +	u32 p0 = 0, p1 = 0;
@@ -498,11 +534,8 @@
 +	u8 rfvalue;
 +	u8 loft_dc_search_result[CHAIN_NUM][RF_ALC_NUM][2];
 +	u8 ger[CHAIN_NUM], per[CHAIN_NUM];
-+	u8 rf_gain[] = {0x00, 0x01, 0x02, 0x04, 0x08, 0x0c};
-+	u8 rfvga_gain_table[] = {0x24, 0x25, 0x26, 0x27, 0x28, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3F};
 +
 +	u8 vga_gain[] = {14, 14};
-+	u8 bbp_2324gain[] = {0x16, 0x14, 0x12, 0x10, 0x0c, 0x08};
 +	u8 bbp = 0, ch_idx = 0, rf_alc_idx = 0, idx = 0;
 +	u8 bbpr30, rfb0r39, rfb0r42;
 +	u8 bbpr1;
@@ -510,6 +543,11 @@
 +	u8 bbpr241, bbpr242;
 +	u8 count_step;
 +
++	static const u8 rf_gain[] = {0x00, 0x01, 0x02, 0x04, 0x08, 0x0c};
++	static const u8 rfvga_gain_table[] = {0x24, 0x25, 0x26, 0x27, 0x28, 0x2c, 0x2d, 0x2e, 0x2f, 0x30,
++					      0x31, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3F};
++	static const u8 bbp_2324gain[] = {0x16, 0x14, 0x12, 0x10, 0x0c, 0x08};
++
 +	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
 +	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
@@ -524,29 +562,18 @@
 +	macvalue &= (~0x04);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
 +
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x01)
-+			udelay(50);
-+		else
-+			break;
-+	}
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_TX)))
++		rt2x00_warn(rt2x00dev, "RF TX busy in LOFT IQ calibration\n");
 +
 +	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	macvalue &= (~0x08);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
 +
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x02)
-+			udelay(50);
-+		else
-+			break;
-+	}
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_RX)))
++		rt2x00_warn(rt2x00dev, "RF RX busy in LOFT IQ calibration\n");
 +
-+	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
++	for (ch_idx = 0; ch_idx < 2; ch_idx++)
 +		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
-+	}
 +
 +	bbpr30 = rt2800_bbp_read(rt2x00dev, 30);
 +	rfb0r39 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 39);
@@ -561,7 +588,7 @@
 +
 +	rt2800_setbbptonegenerator(rt2x00dev);
 +
-+	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
++	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
 +		rt2800_bbp_write(rt2x00dev, 23, 0x00);
 +		rt2800_bbp_write(rt2x00dev, 24, 0x00);
 +		rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00);
@@ -571,18 +598,17 @@
 +		rt2800_register_write(rt2x00dev, 0x13b8, 0x10);
 +		udelay(1);
 +
-+		if (ch_idx == 0) {
++		if (ch_idx == 0)
 +			rt2800_rf_aux_tx0_loopback(rt2x00dev);
-+		} else {
++		else
 +			rt2800_rf_aux_tx1_loopback(rt2x00dev);
-+		}
++
 +		udelay(1);
 +
-+		if (ch_idx == 0) {
++		if (ch_idx == 0)
 +			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001004);
-+		} else {
++		else
 +			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002004);
-+		}
 +
 +		rt2800_bbp_write(rt2x00dev, 158, 0x05);
 +		rt2800_bbp_write(rt2x00dev, 159, 0x00);
@@ -608,7 +634,8 @@
 +
 +			if (rf_alc_idx == 0) {
 +				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x21);
-+				for (;vga_gain[ch_idx] > 0;vga_gain[ch_idx] = vga_gain[ch_idx] - 2) {
++				for (; vga_gain[ch_idx] > 0;
++				     vga_gain[ch_idx] = vga_gain[ch_idx] - 2) {
 +					rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
 +					rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
 +					rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
@@ -618,19 +645,19 @@
 +					rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x21);
 +					p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
 +					rt2x00_dbg(rt2x00dev, "LOFT AGC %d %d\n", p0, p1);
-+					if ((p0 < 7000*7000) && (p1 < (7000*7000))) {
++					if ((p0 < 7000 * 7000) && (p1 < (7000 * 7000)))
 +						break;
-+					}
 +				}
 +
 +				rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x00);
 +				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x00);
 +
-+				rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]);
++				rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n", vga_gain[ch_idx],
++					   rfvga_gain_table[vga_gain[ch_idx]]);
 +
 +				if (vga_gain[ch_idx] < 0)
 +					vga_gain[ch_idx] = 0;
-+		 	}
++			}
 +
 +			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
 +
@@ -644,7 +671,7 @@
 +	for (rf_alc_idx = 0; rf_alc_idx < 3; rf_alc_idx++) {
 +		for (idx = 0; idx < 4; idx++) {
 +			rt2800_bbp_write(rt2x00dev, 158, 0xB0);
-+			bbp = (idx<<2) + rf_alc_idx;
++			bbp = (idx << 2) + rf_alc_idx;
 +			rt2800_bbp_write(rt2x00dev, 159, bbp);
 +			rt2x00_dbg(rt2x00dev, " ALC %2x,", bbp);
 +
@@ -705,8 +732,6 @@
 +	rt2800_register_write(rt2x00dev, RF_BYPASS2, orig52c);
 +	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
 +
-+	rt2x00_info(rt2x00dev, "LOFT Calibration Done!\n");
-+
 +	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
 +	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
@@ -723,24 +748,16 @@
 +	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	macvalue &= (~0x04);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x01)
-+			udelay(50);
-+		else
-+			break;
-+	}
++
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_TX)))
++		rt2x00_warn(rt2x00dev, "RF TX busy in LOFT IQ calibration\n");
 +
 +	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	macvalue &= (~0x08);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x02)
-+			udelay(50);
-+		else
-+			break;
-+	}
++
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_RX)))
++		rt2x00_warn(rt2x00dev, "RF RX busy in LOFT IQ calibration\n");
 +
 +	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
 +		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x00000101);
@@ -776,9 +793,8 @@
 +
 +	rt2800_register_write(rt2x00dev, 0x13b8, 0x00000010);
 +
-+	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
++	for (ch_idx = 0; ch_idx < 2; ch_idx++)
 +		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
-+	}
 +
 +	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x3B);
 +	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x3B);
@@ -788,7 +804,7 @@
 +	rt2800_bbp_write(rt2x00dev, 158, 0xB0);
 +	rt2800_bbp_write(rt2x00dev, 159, 0x80);
 +
-+	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
++	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
 +		rt2800_bbp_write(rt2x00dev, 23, 0x00);
 +		rt2800_bbp_write(rt2x00dev, 24, 0x00);
 +
@@ -831,7 +847,7 @@
 +			count_step = 2;
 +		}
 +
-+		for (;vga_gain[ch_idx] < 19; vga_gain[ch_idx]=(vga_gain[ch_idx] + count_step)) {
++		for (; vga_gain[ch_idx] < 19; vga_gain[ch_idx] = (vga_gain[ch_idx] + count_step)) {
 +			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
 +			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
 +			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
@@ -840,37 +856,35 @@
 +			rt2800_bbp_write(rt2x00dev, 158, bbp);
 +			rt2800_bbp_write(rt2x00dev, 159, 0x00);
 +			p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags))
 +				p0_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
-+			}
 +
 +			bbp = (ch_idx == 0) ? 0x29 : 0x47;
 +			rt2800_bbp_write(rt2x00dev, 158, bbp);
 +			rt2800_bbp_write(rt2x00dev, 159, 0x21);
 +			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags)) {
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags))
 +				p1_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
-+			}
 +
 +			rt2x00_dbg(rt2x00dev, "IQ AGC %d %d\n", p0, p1);
 +
 +			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
 +				rt2x00_dbg(rt2x00dev, "IQ AGC IDX 10 %d %d\n", p0_idx10, p1_idx10);
-+				if ((p0_idx10 > 7000*7000) || (p1_idx10 > 7000*7000)) {
-+					if (vga_gain[ch_idx]!=0)
-+						vga_gain[ch_idx] = vga_gain[ch_idx]-1;
++				if ((p0_idx10 > 7000 * 7000) || (p1_idx10 > 7000 * 7000)) {
++					if (vga_gain[ch_idx] != 0)
++						vga_gain[ch_idx] = vga_gain[ch_idx] - 1;
 +					break;
 +				}
 +			}
 +
-+			if ((p0 > 2500*2500) || (p1 > 2500*2500)) {
++			if ((p0 > 2500 * 2500) || (p1 > 2500 * 2500))
 +				break;
-+			}
 +		}
 +
 +		if (vga_gain[ch_idx] > 18)
 +			vga_gain[ch_idx] = 18;
-+		rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]);
++		rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n", vga_gain[ch_idx],
++			   rfvga_gain_table[vga_gain[ch_idx]]);
 +
 +		bbp = (ch_idx == 0) ? 0x29 : 0x47;
 +		rt2800_bbp_write(rt2x00dev, 158, bbp);
@@ -915,9 +929,8 @@
 +	rt2800_rfcsr_write_bank(rt2x00dev, 0, 39, rfb0r39);
 +	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfb0r42);
 +
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags))
 +		rt2800_bbp_write(rt2x00dev, 4, bbpr4);
-+	}
 +
 +	rt2800_bbp_write(rt2x00dev, 21, 0x01);
 +	udelay(1);
@@ -935,16 +948,12 @@
 +	rt2800_register_write(rt2x00dev, RF_BYPASS3, macorg5);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
 +	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
-+
-+	rt2x00_info(rt2x00dev, "TX IQ Calibration Done!\n");
-+
-+	return;
 +}
 +
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9691,6 +10628,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9653,6 +10554,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rxdcoc_calibration(rt2x00dev);
  	rt2800_bw_filter_calibration(rt2x00dev, true);
  	rt2800_bw_filter_calibration(rt2x00dev, false);
@@ -963,11 +972,11 @@
 +#define RF_ALC_NUM	6
 +#define CHAIN_NUM	2
 +
-+typedef struct rf_reg_pair {
++struct rf_reg_pair {
 +	u8 bank;
 +	u8 reg;
 +	u8 value;
-+} rf_reg_pair;
++};
  
  /* RT2800 driver data structure */
  struct rt2800_drv_data {

package/kernel/mac80211/patches/rt2x00/011-rt2x00-move-helper-functions-up-in-file.patch

@@ -0,0 +1,94 @@
+From patchwork Sat Sep 17 20:28:58 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979252
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:28:58 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 11/16] rt2x00: move helper functions up in file
+Message-ID: 
+ <c27baa8efd5c29e2bcb2432925d9cdc5c913a125.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Move register access helper functions up to the head of the file so
+they can be used in all functions.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 40 +++++++++----------
+ 1 file changed, 20 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -198,6 +198,26 @@ static void rt2800_rfcsr_write_dccal(str
+ 	rt2800_rfcsr_write_bank(rt2x00dev, 7, reg, value);
+ }
+ 
++static void rt2800_bbp_dcoc_write(struct rt2x00_dev *rt2x00dev,
++				  const u8 reg, const u8 value)
++{
++	rt2800_bbp_write(rt2x00dev, 158, reg);
++	rt2800_bbp_write(rt2x00dev, 159, value);
++}
++
++static u8 rt2800_bbp_dcoc_read(struct rt2x00_dev *rt2x00dev, const u8 reg)
++{
++	rt2800_bbp_write(rt2x00dev, 158, reg);
++	return rt2800_bbp_read(rt2x00dev, 159);
++}
++
++static void rt2800_bbp_glrt_write(struct rt2x00_dev *rt2x00dev,
++				  const u8 reg, const u8 value)
++{
++	rt2800_bbp_write(rt2x00dev, 195, reg);
++	rt2800_bbp_write(rt2x00dev, 196, value);
++}
++
+ static u8 rt2800_rfcsr_read(struct rt2x00_dev *rt2x00dev,
+ 			    const unsigned int word)
+ {
+@@ -6947,26 +6967,6 @@ static void rt2800_init_bbp_5592(struct
+ 		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+ }
+ 
+-static void rt2800_bbp_glrt_write(struct rt2x00_dev *rt2x00dev,
+-				  const u8 reg, const u8 value)
+-{
+-	rt2800_bbp_write(rt2x00dev, 195, reg);
+-	rt2800_bbp_write(rt2x00dev, 196, value);
+-}
+-
+-static void rt2800_bbp_dcoc_write(struct rt2x00_dev *rt2x00dev,
+-				  const u8 reg, const u8 value)
+-{
+-	rt2800_bbp_write(rt2x00dev, 158, reg);
+-	rt2800_bbp_write(rt2x00dev, 159, value);
+-}
+-
+-static u8 rt2800_bbp_dcoc_read(struct rt2x00_dev *rt2x00dev, const u8 reg)
+-{
+-	rt2800_bbp_write(rt2x00dev, 158, reg);
+-	return rt2800_bbp_read(rt2x00dev, 159);
+-}
+-
+ static void rt2800_init_bbp_6352(struct rt2x00_dev *rt2x00dev)
+ {
+ 	u8 bbp;

package/kernel/mac80211/patches/rt2x00/012-rt2x00-fix-HT20-HT40-bandwidth-switch-on-MT7620.patch

@@ -0,0 +1,56 @@
+From patchwork Sat Sep 17 20:29:13 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979253
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:29:13 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 12/16] rt2x00: fix HT20/HT40 bandwidth switch on MT7620
+Message-ID: 
+ <1664d89ba149f7b0bcec18b2a2abaedf49654507.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Add missing configuration of the channel bandwidth filter to the
+channel setup function for MT7620.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3855,6 +3855,14 @@ static void rt2800_config_channel_rf7620
+ 		rfcsr |= tx_agc_fc;
+ 		rt2800_rfcsr_write_bank(rt2x00dev, 7, 59, rfcsr);
+ 	}
++
++	if (conf_is_ht40(conf)) {
++		rt2800_bbp_glrt_write(rt2x00dev, 141, 0x10);
++		rt2800_bbp_glrt_write(rt2x00dev, 157, 0x2f);
++	} else {
++		rt2800_bbp_glrt_write(rt2x00dev, 141, 0x1a);
++		rt2800_bbp_glrt_write(rt2x00dev, 157, 0x40);
++	}
+ }
+ 
+ static void rt2800_config_alc(struct rt2x00_dev *rt2x00dev,

package/kernel/mac80211/patches/rt2x00/013-rt2x00-set-correct-TX_SW_CFG1-MAC-register-for-MT7620.patch

@@ -0,0 +1,52 @@
+From patchwork Sat Sep 17 20:29:26 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979254
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:29:26 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 13/16] rt2x00: set correct TX_SW_CFG1 MAC register for
+ MT7620
+Message-ID: 
+ <4be38975ce600a34249e12d09a3cb758c6e71071.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Set correct TX_SW_CFG1 MAC register as it is done also in v3 of the
+vendor driver[1].
+
+[1]: https://gitlab.com/dm38/padavan-ng/-/blob/master/trunk/proprietary/rt_wifi/rtpci/3.0.X.X/mt76x2/chips/rt6352.c#L531
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5966,7 +5966,7 @@ static int rt2800_init_registers(struct
+ 		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
+ 	} else if (rt2x00_rt(rt2x00dev, RT6352)) {
+ 		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
+-		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
++		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
+ 		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+ 		rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
+ 		rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);

package/kernel/mac80211/patches/rt2x00/014-rt2x00-set-VGC-gain-for-both-chains-of-MT7620.patch

@@ -0,0 +1,50 @@
+From patchwork Sat Sep 17 20:29:40 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979255
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:29:40 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 14/16] rt2x00: set VGC gain for both chains of MT7620
+Message-ID: 
+ <29e161397e5c9d9399da0fe87d44458aa2b90a78.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Set bbp66 for all chains of the MT7620.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5743,7 +5743,8 @@ static inline void rt2800_set_vgc(struct
+ 	if (qual->vgc_level != vgc_level) {
+ 		if (rt2x00_rt(rt2x00dev, RT3572) ||
+ 		    rt2x00_rt(rt2x00dev, RT3593) ||
+-		    rt2x00_rt(rt2x00dev, RT3883)) {
++		    rt2x00_rt(rt2x00dev, RT3883) ||
++		    rt2x00_rt(rt2x00dev, RT6352)) {
+ 			rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
+ 						       vgc_level);
+ 		} else if (rt2x00_rt(rt2x00dev, RT5592)) {

package/kernel/mac80211/patches/rt2x00/015-rt2x00-set-SoC-wmac-clock-register.patch

@@ -0,0 +1,70 @@
+From patchwork Sat Sep 17 20:29:55 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979256
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:29:55 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 15/16] rt2x00: set SoC wmac clock register
+Message-ID: 
+ <3e275d259f476f597dab91a9c395015ef3fe3284.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Instead of using the default value 33 (pci), set US_CYC_CNT init based
+on Programming guide:
+If available, set chipset bus clock with fallback to cpu clock/3.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 21 +++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -6229,6 +6229,27 @@ static int rt2800_init_registers(struct
+ 		reg = rt2800_register_read(rt2x00dev, US_CYC_CNT);
+ 		rt2x00_set_field32(&reg, US_CYC_CNT_CLOCK_CYCLE, 125);
+ 		rt2800_register_write(rt2x00dev, US_CYC_CNT, reg);
++	} else if (rt2x00_is_soc(rt2x00dev)) {
++		struct clk *clk = clk_get_sys("bus", NULL);
++		int rate;
++
++		if (IS_ERR(clk)) {
++			clk = clk_get_sys("cpu", NULL);
++
++			if (IS_ERR(clk)) {
++				rate = 125;
++			} else {
++				rate = clk_get_rate(clk) / 3000000;
++				clk_put(clk);
++			}
++		} else {
++			rate = clk_get_rate(clk) / 1000000;
++			clk_put(clk);
++		}
++
++		reg = rt2800_register_read(rt2x00dev, US_CYC_CNT);
++		rt2x00_set_field32(&reg, US_CYC_CNT_CLOCK_CYCLE, rate);
++		rt2800_register_write(rt2x00dev, US_CYC_CNT, reg);
+ 	}
+ 
+ 	reg = rt2800_register_read(rt2x00dev, HT_FBK_CFG0);

package/kernel/mac80211/patches/rt2x00/016-rt2x00-correctly-set-BBP-register-86-for-MT7620.patch

@@ -0,0 +1,79 @@
+From patchwork Sat Sep 17 20:30:09 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979257
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id E9118ECAAA1
+	for <linux-wireless@archiver.kernel.org>;
+ Sat, 17 Sep 2022 20:30:22 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S229639AbiIQUaV (ORCPT
+        <rfc822;linux-wireless@archiver.kernel.org>);
+        Sat, 17 Sep 2022 16:30:21 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53912 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S229628AbiIQUaT (ORCPT
+        <rfc822;linux-wireless@vger.kernel.org>);
+        Sat, 17 Sep 2022 16:30:19 -0400
+Received: from fudo.makrotopia.org (fudo.makrotopia.org
+ [IPv6:2a07:2ec0:3002::71])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1AEA822B27
+        for <linux-wireless@vger.kernel.org>;
+ Sat, 17 Sep 2022 13:30:16 -0700 (PDT)
+Received: from local
+        by fudo.makrotopia.org with esmtpsa
+ (TLS1.3:TLS_AES_256_GCM_SHA384:256)
+         (Exim 4.96)
+        (envelope-from <daniel@makrotopia.org>)
+        id 1oZeS7-0003ra-0k;
+        Sat, 17 Sep 2022 22:30:15 +0200
+Date: Sat, 17 Sep 2022 21:30:09 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 16/16] rt2x00: correctly set BBP register 86 for MT7620
+Message-ID: 
+ <257267247ee4fa7ebc6a5d0c4948b3f8119c0d77.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Instead of 0 set the correct value for BBP register 86 for MT7620.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -4225,7 +4225,10 @@ static void rt2800_config_channel(struct
+ 		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+-		rt2800_bbp_write(rt2x00dev, 86, 0);
++		if (rt2x00_rt(rt2x00dev, RT6352))
++			rt2800_bbp_write(rt2x00dev, 86, 0x38);
++		else
++			rt2800_bbp_write(rt2x00dev, 86, 0);
+ 	}
+ 
+ 	if (rf->channel <= 14) {

package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch

@@ -48,7 +48,7 @@
  obj-$(CPTCFG_RT2X00_LIB_MMIO)		+= rt2x00mmio.o
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -37,6 +37,8 @@ struct rt2800_drv_data {
+@@ -47,6 +47,8 @@ struct rt2800_drv_data {
  	struct ieee80211_sta *wcid_to_sta[STA_IDS_SIZE];
  };
  
@@ -57,7 +57,7 @@
  struct rt2800_ops {
  	u32 (*register_read)(struct rt2x00_dev *rt2x00dev,
  			      const unsigned int offset);
-@@ -135,6 +137,15 @@ static inline int rt2800_read_eeprom(str
+@@ -145,6 +147,15 @@ static inline int rt2800_read_eeprom(str
  {
  	const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
  
@@ -127,7 +127,7 @@
  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1401,6 +1401,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+@@ -1419,6 +1419,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
  	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
  	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
  
@@ -138,7 +138,7 @@
  	/*
  	 * Let the driver probe the device to detect the capabilities.
  	 */
-@@ -1541,6 +1545,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
+@@ -1559,6 +1563,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
  	 * Free the driver data.
  	 */
  	kfree(rt2x00dev->drv_data);
@@ -193,7 +193,7 @@
 +	if (pdata && pdata->eeprom_file_name)
 +		return pdata->eeprom_file_name;
 +
-+	return NULL
++	return NULL;
 +}
 +
 +static int rt2x00lib_request_eeprom_file(struct rt2x00_dev *rt2x00dev)

package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch

@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2x00lib.h"
-@@ -34,11 +35,21 @@ static const char *
+@@ -34,10 +35,20 @@ static const char *
  rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
  	struct rt2x00_platform_data *pdata = rt2x00dev->dev->platform_data;
@@ -20,14 +20,12 @@
  	if (pdata && pdata->eeprom_file_name)
  		return pdata->eeprom_file_name;
  
--	return NULL
 +#ifdef CONFIG_OF
 +	np = rt2x00dev->dev->of_node;
 +	if (np && of_property_read_string(np, "ralink,eeprom", &eep) == 0)
 +	    return eep;
 +#endif
 +
-+	return NULL;
+ 	return NULL;
  }
  
- static int rt2x00lib_request_eeprom_file(struct rt2x00_dev *rt2x00dev)

package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch

@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -9549,6 +9550,17 @@ static int rt2800_init_eeprom(struct rt2
+@@ -11131,6 +11132,17 @@ static int rt2800_init_eeprom(struct rt2
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
  

package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1340,7 +1340,7 @@ static inline void rt2x00lib_set_if_comb
+@@ -1358,7 +1358,7 @@ static inline void rt2x00lib_set_if_comb
  	 */
  	if_limit = &rt2x00dev->if_limits_ap;
  	if_limit->max = rt2x00dev->ops->max_ap_intf;

package/kernel/mac80211/patches/rt2x00/612-rt2x00-led-tpt-trigger-support.patch

@@ -1,44 +0,0 @@
-From: David Bauer <mail@david-bauer.net>
-Date: Mon, 16 Dec 2019 20:47:06 +0100
-Subject: [PATCH] rt2x00: add throughput LED trigger
-
-This adds a (currently missing) throughput LED trigger for the rt2x00
-driver. Previously, LED triggers had to be assigned to the netdev, which
-was limited to a single VAP.
-
-Signed-off-by: David Bauer <mail@david-bauer.net>
-Tested-by: Christoph Krapp <achterin@googlemail.com>
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1125,6 +1125,19 @@ static void rt2x00lib_remove_hw(struct r
- 	kfree(rt2x00dev->spec.channels_info);
- }
- 
-+static const struct ieee80211_tpt_blink rt2x00_tpt_blink[] = {
-+	{ .throughput = 0 * 1024, .blink_time = 334 },
-+	{ .throughput = 1 * 1024, .blink_time = 260 },
-+	{ .throughput = 2 * 1024, .blink_time = 220 },
-+	{ .throughput = 5 * 1024, .blink_time = 190 },
-+	{ .throughput = 10 * 1024, .blink_time = 170 },
-+	{ .throughput = 25 * 1024, .blink_time = 150 },
-+	{ .throughput = 54 * 1024, .blink_time = 130 },
-+	{ .throughput = 120 * 1024, .blink_time = 110 },
-+	{ .throughput = 265 * 1024, .blink_time = 80 },
-+	{ .throughput = 586 * 1024, .blink_time = 50 },
-+};
-+
- static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
- {
- 	struct hw_mode_spec *spec = &rt2x00dev->spec;
-@@ -1206,6 +1219,10 @@ static int rt2x00lib_probe_hw(struct rt2
- 
- #undef RT2X00_TASKLET_INIT
- 
-+	ieee80211_create_tpt_led_trigger(rt2x00dev->hw,
-+		IEEE80211_TPT_LEDTRIG_FL_RADIO, rt2x00_tpt_blink,
-+		ARRAY_SIZE(rt2x00_tpt_blink));
-+
- 	/*
- 	 * Register HW.
- 	 */

package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch

@@ -0,0 +1,161 @@
+From 0fce1109f894ec7fcd72cb098843a1eff786716a Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 16 Sep 2022 20:49:42 +0100
+Subject: [PATCH 16/16] rt2x00: import support for external LNA on MT7620
+To: linux-wireless@vger.kernel.org,
+    Stanislaw Gruszka <stf_xl@wp.pl>,
+    Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+    David S. Miller <davem@davemloft.net>,
+    Eric Dumazet <edumazet@google.com>,
+    Jakub Kicinski <kuba@kernel.org>,
+    Paolo Abeni <pabeni@redhat.com>,
+    Johannes Berg <johannes.berg@intel.com>
+
+In order to carry out calibration on boards with ePA or eLNA the PA pin
+needs to be switch to GPIO mode on MT7620. Implement that by selecting
+pinctrl state "pa_gpio" which should be defined for MT7620 boards with
+eLNA or ePA beside the "default" state.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 58 +++++++++++++++++++
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h   |  5 ++
+ .../net/wireless/ralink/rt2x00/rt2x00soc.c    | 15 +++++
+ 3 files changed, 78 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -304,6 +304,24 @@ static void rt2800_rf_write(struct rt2x0
+ 	mutex_unlock(&rt2x00dev->csr_mutex);
+ }
+ 
++void rt6352_enable_pa_pin(struct rt2x00_dev *rt2x00dev, int enable)
++{
++	if (!rt2x00dev->pinctrl)
++		return;
++
++	if (enable) {
++		if (!rt2x00dev->pins_default)
++			return;
++
++		pinctrl_select_state(rt2x00dev->pinctrl, rt2x00dev->pins_default);
++	} else {
++		if (!rt2x00dev->pins_pa_gpio)
++			return;
++
++		pinctrl_select_state(rt2x00dev->pinctrl, rt2x00dev->pins_pa_gpio);
++	}
++}
++
+ static const unsigned int rt2800_eeprom_map[EEPROM_WORD_COUNT] = {
+ 	[EEPROM_CHIP_ID]		= 0x0000,
+ 	[EEPROM_VERSION]		= 0x0001,
+@@ -4469,6 +4487,29 @@ static void rt2800_config_channel(struct
+ 			rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN,
+ 					      0x6C6C6B6C);
+ 		}
++
++		if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++			reg |= 0x00000101;
++			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
++
++			reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++			reg |= 0x00000101;
++			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
++
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
++			rt2800_bbp_write(rt2x00dev, 75, 0x68);
++			rt2800_bbp_write(rt2x00dev, 76, 0x4C);
++			rt2800_bbp_write(rt2x00dev, 79, 0x1C);
++			rt2800_bbp_write(rt2x00dev, 80, 0x0C);
++			rt2800_bbp_write(rt2x00dev, 82, 0xB6);
++			/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in
++			 * config channel function in dependence of channel and
++			 * HT20/HT40 so don't touch it
++			 */
++		}
+ 	}
+ 
+ 	bbp = rt2800_bbp_read(rt2x00dev, 4);
+@@ -10583,6 +10624,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+ 
++	rt6352_enable_pa_pin(rt2x00dev, 0);
+ 	rt2800_r_calibration(rt2x00dev);
+ 	rt2800_rf_self_txdc_cal(rt2x00dev);
+ 	rt2800_rxdcoc_calibration(rt2x00dev);
+@@ -10590,6 +10632,22 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
+ 	rt2800_loft_iq_calibration(rt2x00dev);
+ 	rt2800_rxiq_calibration(rt2x00dev);
++	rt6352_enable_pa_pin(rt2x00dev, 1);
++
++	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
++		rt2800_bbp_write(rt2x00dev, 75, 0x68);
++		rt2800_bbp_write(rt2x00dev, 76, 0x4C);
++		rt2800_bbp_write(rt2x00dev, 79, 0x1C);
++		rt2800_bbp_write(rt2x00dev, 80, 0x0C);
++		rt2800_bbp_write(rt2x00dev, 82, 0xB6);
++		/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in config
++		 * channel function in dependence of channel and HT20/HT40,
++		 * so don't touch them here.
++		 */
++	}
+ }
+ 
+ static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -28,6 +28,7 @@
+ #include <linux/average.h>
+ #include <linux/usb.h>
+ #include <linux/clk.h>
++#include <linux/pinctrl/consumer.h>
+ #include <linux/rt2x00_platform.h>
+ 
+ #include <net/mac80211.h>
+@@ -1029,6 +1030,11 @@ struct rt2x00_dev {
+ 
+ 	/* Clock for System On Chip devices. */
+ 	struct clk *clk;
++
++	/* pinctrl and states for System On Chip devices with PA/LNA. */
++	struct pinctrl *pinctrl;
++	struct pinctrl_state *pins_default;
++	struct pinctrl_state *pins_pa_gpio;
+ };
+ 
+ struct rt2x00_bar_list_entry {
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
+@@ -97,6 +97,21 @@ int rt2x00soc_probe(struct platform_devi
+ 	if (retval)
+ 		goto exit_free_reg;
+ 
++	rt2x00dev->pinctrl = devm_pinctrl_get(&pdev->dev);
++	if (IS_ERR(rt2x00dev->pinctrl)) {
++		rt2x00dev->pinctrl = NULL;
++		rt2x00dev->pins_default = NULL;
++		rt2x00dev->pins_pa_gpio = NULL;
++	} else {
++		rt2x00dev->pins_default = pinctrl_lookup_state(rt2x00dev->pinctrl, "default");
++		if (IS_ERR(rt2x00dev->pins_default))
++			rt2x00dev->pins_default = NULL;
++
++		rt2x00dev->pins_pa_gpio = pinctrl_lookup_state(rt2x00dev->pinctrl, "pa_gpio");
++		if (IS_ERR(rt2x00dev->pins_pa_gpio))
++			rt2x00dev->pins_pa_gpio = NULL;
++	}
++
+ 	return 0;
+ 
+ exit_free_reg:

package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -1042,6 +1042,11 @@
+@@ -1044,6 +1044,11 @@
  #define MIMO_PS_CFG_RX_STBY_POL		FIELD32(0x00000010)
  #define MIMO_PS_CFG_RX_RX_STBY0		FIELD32(0x00000020)
  
@@ -14,7 +14,7 @@
   */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3698,14 +3698,16 @@ static void rt2800_config_channel_rf7620
+@@ -3778,14 +3778,16 @@ static void rt2800_config_channel_rf7620
  	rt2x00_set_field8(&rfcsr, RFCSR19_K, rf->rf4);
  	rt2800_rfcsr_write(rt2x00dev, 19, rfcsr);
  
@@ -39,7 +39,7 @@
  
  	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
  	rt2x00_set_field8(&rfcsr, RFCSR1_TX2_EN_MT7620,
-@@ -3739,18 +3741,23 @@ static void rt2800_config_channel_rf7620
+@@ -3819,18 +3821,23 @@ static void rt2800_config_channel_rf7620
  		rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x20);
  	}
  
@@ -73,9 +73,9 @@
  
  	if (!test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags)) {
  		if (conf_is_ht40(conf)) {
-@@ -3850,25 +3857,29 @@ static void rt2800_config_alc(struct rt2
- 	if (i == 10000)
- 		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
+@@ -3929,25 +3936,29 @@ static void rt2800_config_alc(struct rt2
+ 	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
+ 		rt2x00_warn(rt2x00dev, "RF busy while configuring ALC\n");
  
 -	if (chan->center_freq > 2457) {
 -		bbp = rt2800_bbp_read(rt2x00dev, 30);
@@ -121,12 +121,12 @@
  	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, mac_sys_ctrl);
  
  	rt2800_vco_calibration(rt2x00dev);
-@@ -5906,18 +5917,33 @@ static int rt2800_init_registers(struct
+@@ -6011,18 +6022,33 @@ static int rt2800_init_registers(struct
  	} else if (rt2x00_rt(rt2x00dev, RT5350)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
  	} else if (rt2x00_rt(rt2x00dev, RT6352)) {
 -		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
--		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
+-		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
 -		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
 -		rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
 -		rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
@@ -150,7 +150,7 @@
 +					      0x00550055);
 +		} else {
 +			rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
-+			rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
++			rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
 +			rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
 +			rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
 +			rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
@@ -167,7 +167,7 @@
  		reg = rt2800_register_read(rt2x00dev, TX_ALC_CFG_1);
  		rt2x00_set_field32(&reg, TX_ALC_CFG_1_ROS_BUSY_EN, 0);
  		rt2800_register_write(rt2x00dev, TX_ALC_CFG_1, reg);
-@@ -7061,14 +7087,16 @@ static void rt2800_init_bbp_6352(struct
+@@ -7127,14 +7153,16 @@ static void rt2800_init_bbp_6352(struct
  	rt2800_bbp_write(rt2x00dev, 188, 0x00);
  	rt2800_bbp_write(rt2x00dev, 189, 0x00);
  
@@ -192,7 +192,7 @@
  
  	/* BBP for G band GLRT function (BBP_128 ~ BBP_221) */
  	rt2800_bbp_glrt_write(rt2x00dev, 0, 0x00);
-@@ -10407,31 +10435,36 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10408,31 +10436,36 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write(rt2x00dev, 42, 0x5B);
  	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
  
@@ -254,7 +254,7 @@
  
  	/* Initialize RF channel register to default value */
  	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x03);
-@@ -10497,63 +10530,71 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10498,63 +10531,71 @@ static void rt2800_init_rfcsr_6352(struc
  
  	rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0xC5);
  
@@ -383,7 +383,7 @@
  
  	/* Initialize RF DC calibration register to default value */
  	rt2800_rfcsr_write_dccal(rt2x00dev, 0, 0x47);
-@@ -10616,12 +10657,17 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10617,12 +10658,17 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 62, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 63, 0x00);
  
@@ -404,5 +404,5 @@
 +		rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
 +	}
  
+ 	rt6352_enable_pa_pin(rt2x00dev, 0);
  	rt2800_r_calibration(rt2x00dev);
- 	rt2800_rf_self_txdc_cal(rt2x00dev);

package/kernel/mac80211/patches/subsys/328-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch

@@ -0,0 +1,38 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 26 Mar 2022 23:58:35 +0100
+Subject: [PATCH] mac80211: do not wake queues on a vif that is being stopped
+
+When a vif is being removed and sdata->bss is cleared, __ieee80211_wake_txqs
+can still be called on it, which crashes as soon as sdata->bss is being
+dereferenced.
+To fix this properly, check for SDATA_STATE_RUNNING before waking queues,
+and take the fq lock when setting it (to ensure that __ieee80211_wake_txqs
+observes the change when running on a different CPU
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -377,7 +377,9 @@ static void ieee80211_do_stop(struct iee
+ 	bool cancel_scan;
+ 	struct cfg80211_nan_func *func;
+ 
++	spin_lock_bh(&local->fq.lock);
+ 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
++	spin_unlock_bh(&local->fq.lock);
+ 
+ 	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+ 	if (cancel_scan)
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -301,6 +301,9 @@ static void __ieee80211_wake_txqs(struct
+ 	local_bh_disable();
+ 	spin_lock(&fq->lock);
+ 
++	if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
++		goto out;
++
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP)
+ 		ps = &sdata->bss->ps;
+ 

package/kernel/mac80211/patches/subsys/340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch

@@ -0,0 +1,46 @@
+From aa40d5a43526cca9439a2b45fcfdcd016594dece Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sun, 17 Jul 2022 21:21:52 +0900
+Subject: [PATCH] wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+lockdep complains use of uninitialized spinlock at ieee80211_do_stop() [1],
+for commit f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif
+that is being stopped") guards clear_bit() using fq.lock even before
+fq_init() from ieee80211_txq_setup_flows() initializes this spinlock.
+
+According to discussion [2], Toke was not happy with expanding usage of
+fq.lock. Since __ieee80211_wake_txqs() is called under RCU read lock, we
+can instead use synchronize_rcu() for flushing ieee80211_wake_txqs().
+
+Link: https://syzkaller.appspot.com/bug?extid=eceab52db7c4b961e9d6 [1]
+Link: https://lkml.kernel.org/r/874k0zowh2.fsf@toke.dk [2]
+Reported-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Fixes: f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
+Tested-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
+Acked-by: Toke Høiland-Jørgensen <toke@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/9cc9b81d-75a3-3925-b612-9d0ad3cab82b@I-love.SAKURA.ne.jp
+[ pick up commit 3598cb6e1862 ("wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()") from -next]
+Link: https://lore.kernel.org/all/87o7xcq6qt.fsf@kernel.org/
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ net/mac80211/iface.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -377,9 +377,8 @@ static void ieee80211_do_stop(struct iee
+ 	bool cancel_scan;
+ 	struct cfg80211_nan_func *func;
+ 
+-	spin_lock_bh(&local->fq.lock);
+ 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+-	spin_unlock_bh(&local->fq.lock);
++	synchronize_rcu(); /* flush _ieee80211_wake_txqs() */
+ 
+ 	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+ 	if (cancel_scan)

package/kernel/mac80211/patches/subsys/341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch

@@ -0,0 +1,40 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Thu, 15 Sep 2022 14:41:20 +0200
+Subject: [PATCH] mac80211: Fix deadlock: Don't start TX while holding
+ fq->lock
+
+ieee80211_txq_purge() calls fq_tin_reset() and
+ieee80211_purge_tx_queue(); Both are then calling
+ieee80211_free_txskb(). Which can decide to TX the skb again.
+
+There are at least two ways to get a deadlock:
+
+1) When we have a TDLS teardown packet queued in either tin or frags
+   ieee80211_tdls_td_tx_handle() will call ieee80211_subif_start_xmit()
+   while we still hold fq->lock. ieee80211_txq_enqueue() will thus
+   deadlock.
+
+2) A variant of the above happens if aggregation is up and running:
+   In that case ieee80211_iface_work() will deadlock with the original
+   task: The original tasks already holds fq->lock and tries to get
+   sta->lock after kicking off ieee80211_iface_work(). But the worker
+   can get sta->lock prior to the original task and will then spin for
+   fq->lock.
+
+Avoid these deadlocks by not sending out any skbs when called via
+ieee80211_free_txskb().
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+---
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -698,7 +698,7 @@ static void ieee80211_report_used_skb(st
+ 
+ 		if (!sdata) {
+ 			skb->dev = NULL;
+-		} else {
++		} else if (!dropped) {
+ 			unsigned int hdr_size =
+ 				ieee80211_hdrlen(hdr->frame_control);
+ 

package/kernel/mac80211/patches/subsys/342-mac80211-Ensure-vif-queues-are-operational-after-sta.patch

@@ -0,0 +1,47 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Thu, 15 Sep 2022 15:09:46 +0200
+Subject: [PATCH] mac80211: Ensure vif queues are operational after start
+
+Make sure local->queue_stop_reasons and vif.txqs_stopped stay in sync.
+
+When a new vif is created the queues may end up in an inconsistent state
+and be inoperable:
+Communication not using iTXQ will work, allowing to e.g. complete the
+association. But the 4-way handshake will time out. The sta will not
+send out any skbs queued in iTXQs.
+
+All normal attempts to start the queues will fail when reaching this
+state.
+local->queue_stop_reasons will have marked all queues as operational but
+vif.txqs_stopped will still be set, creating an inconsistent internal
+state.
+
+In reality this seems to be race between the mac80211 function
+ieee80211_do_open() setting SDATA_STATE_RUNNING and the wake_txqs_tasklet:
+Depending on the driver and the timing the queues may end up to be
+operational or not.
+
+Cc: stable@vger.kernel.org
+Fixes: f856373e2f31 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+---
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -301,14 +301,14 @@ static void __ieee80211_wake_txqs(struct
+ 	local_bh_disable();
+ 	spin_lock(&fq->lock);
+ 
++	sdata->vif.txqs_stopped[ac] = false;
++
+ 	if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
+ 		goto out;
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP)
+ 		ps = &sdata->bss->ps;
+ 
+-	sdata->vif.txqs_stopped[ac] = false;
+-
+ 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
+ 		if (sdata != sta->sdata)
+ 			continue;

package/kernel/mac80211/patches/subsys/346-mac80211-mesh-clean-up-rx_bcn_presp-API.patch

@@ -0,0 +1,110 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 20 Sep 2021 15:40:07 +0200
+Subject: [PATCH] mac80211: mesh: clean up rx_bcn_presp API
+
+commit a5b983c6073140b624f64e79fea6d33c3e4315a0 upstream.
+
+We currently pass the entire elements to the rx_bcn_presp()
+method, but only need mesh_config. Additionally, we use the
+length of the elements to calculate back the entire frame's
+length, but that's confusing - just pass the length of the
+frame instead.
+
+Link: https://lore.kernel.org/r/20210920154009.a18ed3d2da6c.I1824b773a0fbae4453e1433c184678ca14e8df45@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -645,10 +645,9 @@ struct ieee80211_if_ocb {
+  */
+ struct ieee802_11_elems;
+ struct ieee80211_mesh_sync_ops {
+-	void (*rx_bcn_presp)(struct ieee80211_sub_if_data *sdata,
+-			     u16 stype,
+-			     struct ieee80211_mgmt *mgmt,
+-			     struct ieee802_11_elems *elems,
++	void (*rx_bcn_presp)(struct ieee80211_sub_if_data *sdata, u16 stype,
++			     struct ieee80211_mgmt *mgmt, unsigned int len,
++			     const struct ieee80211_meshconf_ie *mesh_cfg,
+ 			     struct ieee80211_rx_status *rx_status);
+ 
+ 	/* should be called with beacon_data under RCU read lock */
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -1354,8 +1354,8 @@ static void ieee80211_mesh_rx_bcn_presp(
+ 	}
+ 
+ 	if (ifmsh->sync_ops)
+-		ifmsh->sync_ops->rx_bcn_presp(sdata,
+-			stype, mgmt, &elems, rx_status);
++		ifmsh->sync_ops->rx_bcn_presp(sdata, stype, mgmt, len,
++					      elems.mesh_config, rx_status);
+ }
+ 
+ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata)
+--- a/net/mac80211/mesh_sync.c
++++ b/net/mac80211/mesh_sync.c
+@@ -3,6 +3,7 @@
+  * Copyright 2011-2012, Pavel Zubarev <pavel.zubarev@gmail.com>
+  * Copyright 2011-2012, Marco Porsch <marco.porsch@s2005.tu-chemnitz.de>
+  * Copyright 2011-2012, cozybit Inc.
++ * Copyright (C) 2021 Intel Corporation
+  */
+ 
+ #include "ieee80211_i.h"
+@@ -35,12 +36,12 @@ struct sync_method {
+ /**
+  * mesh_peer_tbtt_adjusting - check if an mp is currently adjusting its TBTT
+  *
+- * @ie: information elements of a management frame from the mesh peer
++ * @cfg: mesh config element from the mesh peer (or %NULL)
+  */
+-static bool mesh_peer_tbtt_adjusting(struct ieee802_11_elems *ie)
++static bool mesh_peer_tbtt_adjusting(const struct ieee80211_meshconf_ie *cfg)
+ {
+-	return (ie->mesh_config->meshconf_cap &
+-			IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING) != 0;
++	return cfg &&
++	       (cfg->meshconf_cap & IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING);
+ }
+ 
+ void mesh_sync_adjust_tsf(struct ieee80211_sub_if_data *sdata)
+@@ -76,11 +77,11 @@ void mesh_sync_adjust_tsf(struct ieee802
+ 	}
+ }
+ 
+-static void mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
+-				   u16 stype,
+-				   struct ieee80211_mgmt *mgmt,
+-				   struct ieee802_11_elems *elems,
+-				   struct ieee80211_rx_status *rx_status)
++static void
++mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata, u16 stype,
++			      struct ieee80211_mgmt *mgmt, unsigned int len,
++			      const struct ieee80211_meshconf_ie *mesh_cfg,
++			      struct ieee80211_rx_status *rx_status)
+ {
+ 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+ 	struct ieee80211_local *local = sdata->local;
+@@ -101,10 +102,7 @@ static void mesh_sync_offset_rx_bcn_pres
+ 	 */
+ 	if (ieee80211_have_rx_timestamp(rx_status))
+ 		t_r = ieee80211_calculate_rx_timestamp(local, rx_status,
+-						       24 + 12 +
+-						       elems->total_len +
+-						       FCS_LEN,
+-						       24);
++						       len + FCS_LEN, 24);
+ 	else
+ 		t_r = drv_get_tsf(local, sdata);
+ 
+@@ -119,7 +117,7 @@ static void mesh_sync_offset_rx_bcn_pres
+ 	 * dot11MeshNbrOffsetMaxNeighbor non-peer non-MBSS neighbors
+ 	 */
+ 
+-	if (elems->mesh_config && mesh_peer_tbtt_adjusting(elems)) {
++	if (mesh_peer_tbtt_adjusting(mesh_cfg)) {
+ 		msync_dbg(sdata, "STA %pM : is adjusting TBTT\n",
+ 			  sta->sta.addr);
+ 		goto no_sync;

package/kernel/mac80211/patches/subsys/347-mac80211-move-CRC-into-struct-ieee802_11_elems.patch

@@ -0,0 +1,82 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 20 Sep 2021 15:40:08 +0200
+Subject: [PATCH] mac80211: move CRC into struct ieee802_11_elems
+
+commit c6e37ed498f958254b5459253199e816b6bfc52f upstream.
+
+We're currently returning this value, but to prepare for
+returning the allocated structure, move it into there.
+
+Link: https://lore.kernel.org/r/20210920154009.479b8ebf999d.If0d4ba75ee38998dc3eeae25058aa748efcb2fc9@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1530,6 +1530,7 @@ struct ieee80211_csa_ie {
+ struct ieee802_11_elems {
+ 	const u8 *ie_start;
+ 	size_t total_len;
++	u32 crc;
+ 
+ 	/* pointers to IEs */
+ 	const struct ieee80211_tdls_lnkie *lnk_id;
+@@ -2089,10 +2090,10 @@ static inline void ieee80211_tx_skb(stru
+ 	ieee80211_tx_skb_tid(sdata, skb, 7);
+ }
+ 
+-u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+-			       struct ieee802_11_elems *elems,
+-			       u64 filter, u32 crc, u8 *transmitter_bssid,
+-			       u8 *bss_bssid);
++void ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
++				struct ieee802_11_elems *elems,
++				u64 filter, u32 crc, u8 *transmitter_bssid,
++				u8 *bss_bssid);
+ static inline void ieee802_11_parse_elems(const u8 *start, size_t len,
+ 					  bool action,
+ 					  struct ieee802_11_elems *elems,
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4102,10 +4102,11 @@ static void ieee80211_rx_mgmt_beacon(str
+ 	 */
+ 	if (!ieee80211_is_s1g_beacon(hdr->frame_control))
+ 		ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
+-	ncrc = ieee802_11_parse_elems_crc(variable,
+-					  len - baselen, false, &elems,
+-					  care_about_ies, ncrc,
+-					  mgmt->bssid, bssid);
++	ieee802_11_parse_elems_crc(variable,
++				   len - baselen, false, &elems,
++				   care_about_ies, ncrc,
++				   mgmt->bssid, bssid);
++	ncrc = elems.crc;
+ 
+ 	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
+ 	    ieee80211_check_tim(elems.tim, elems.tim_len, bss_conf->aid)) {
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1469,10 +1469,10 @@ static size_t ieee802_11_find_bssid_prof
+ 	return found ? profile_len : 0;
+ }
+ 
+-u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+-			       struct ieee802_11_elems *elems,
+-			       u64 filter, u32 crc, u8 *transmitter_bssid,
+-			       u8 *bss_bssid)
++void ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
++				struct ieee802_11_elems *elems,
++				u64 filter, u32 crc, u8 *transmitter_bssid,
++				u8 *bss_bssid)
+ {
+ 	const struct element *non_inherit = NULL;
+ 	u8 *nontransmitted_profile;
+@@ -1524,7 +1524,7 @@ u32 ieee802_11_parse_elems_crc(const u8
+ 
+ 	kfree(nontransmitted_profile);
+ 
+-	return crc;
++	elems->crc = crc;
+ }
+ 
+ void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,

package/kernel/mac80211/patches/subsys/348-mac80211-mlme-find-auth-challenge-directly.patch

@@ -0,0 +1,80 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 20 Sep 2021 15:40:09 +0200
+Subject: [PATCH] mac80211: mlme: find auth challenge directly
+
+commit 49a765d6785e99157ff5091cc37485732496864e upstream.
+
+There's no need to parse all elements etc. just to find the
+authentication challenge - use cfg80211_find_elem() instead.
+This also allows us to remove WLAN_EID_CHALLENGE handling
+from the element parsing entirely.
+
+Link: https://lore.kernel.org/r/20210920154009.45f9b3a15722.Ice3159ffad03a007d6154cbf1fb3a8c48489e86f@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1540,7 +1540,6 @@ struct ieee802_11_elems {
+ 	const u8 *supp_rates;
+ 	const u8 *ds_params;
+ 	const struct ieee80211_tim_ie *tim;
+-	const u8 *challenge;
+ 	const u8 *rsn;
+ 	const u8 *rsnx;
+ 	const u8 *erp_info;
+@@ -1594,7 +1593,6 @@ struct ieee802_11_elems {
+ 	u8 ssid_len;
+ 	u8 supp_rates_len;
+ 	u8 tim_len;
+-	u8 challenge_len;
+ 	u8 rsn_len;
+ 	u8 rsnx_len;
+ 	u8 ext_supp_rates_len;
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2889,17 +2889,17 @@ static void ieee80211_auth_challenge(str
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
++	const struct element *challenge;
+ 	u8 *pos;
+-	struct ieee802_11_elems elems;
+ 	u32 tx_flags = 0;
+ 	struct ieee80211_prep_tx_info info = {
+ 		.subtype = IEEE80211_STYPE_AUTH,
+ 	};
+ 
+ 	pos = mgmt->u.auth.variable;
+-	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
+-			       mgmt->bssid, auth_data->bss->bssid);
+-	if (!elems.challenge)
++	challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
++				       len - (pos - (u8 *)mgmt));
++	if (!challenge)
+ 		return;
+ 	auth_data->expected_transaction = 4;
+ 	drv_mgd_prepare_tx(sdata->local, sdata, &info);
+@@ -2907,7 +2907,8 @@ static void ieee80211_auth_challenge(str
+ 		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+ 			   IEEE80211_TX_INTFL_MLME_CONN_TX;
+ 	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
+-			    elems.challenge - 2, elems.challenge_len + 2,
++			    (void *)challenge,
++			    challenge->datalen + sizeof(*challenge),
+ 			    auth_data->bss->bssid, auth_data->bss->bssid,
+ 			    auth_data->key, auth_data->key_len,
+ 			    auth_data->key_idx, tx_flags);
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1120,10 +1120,6 @@ _ieee802_11_parse_elems_crc(const u8 *st
+ 			} else
+ 				elem_parse_failed = true;
+ 			break;
+-		case WLAN_EID_CHALLENGE:
+-			elems->challenge = pos;
+-			elems->challenge_len = elen;
+-			break;
+ 		case WLAN_EID_VENDOR_SPECIFIC:
+ 			if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
+ 			    pos[2] == 0xf2) {

package/kernel/mac80211/patches/subsys/350-mac80211-fix-memory-leaks-with-element-parsing.patch

@@ -0,0 +1,115 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 1 Oct 2021 21:11:08 +0200
+Subject: [PATCH] mac80211: fix memory leaks with element parsing
+
+commit 8223ac199a3849257e86ec27865dc63f034b1cf1 upstream.
+
+My previous commit 5d24828d05f3 ("mac80211: always allocate
+struct ieee802_11_elems") had a few bugs and leaked the new
+allocated struct in a few error cases, fix that.
+
+Fixes: 5d24828d05f3 ("mac80211: always allocate struct ieee802_11_elems")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://lore.kernel.org/r/20211001211108.9839928e42e0.Ib81ca187d3d3af7ed1bfeac2e00d08a4637c8025@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -499,13 +499,14 @@ void ieee80211_process_addba_request(str
+ 		elems = ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable,
+ 					       ies_len, true, mgmt->bssid, NULL);
+ 		if (!elems || elems->parse_error)
+-			return;
++			goto free;
+ 	}
+ 
+ 	__ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
+ 					start_seq_num, ba_policy, tid,
+ 					buf_size, true, false,
+ 					elems ? elems->addba_ext_ie : NULL);
++free:
+ 	kfree(elems);
+ }
+ 
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -1659,11 +1659,11 @@ void ieee80211_ibss_rx_queued_mgmt(struc
+ 				mgmt->u.action.u.chan_switch.variable,
+ 				ies_len, true, mgmt->bssid, NULL);
+ 
+-			if (!elems || elems->parse_error)
+-				break;
+-
+-			ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt, skb->len,
+-							rx_status, elems);
++			if (elems && !elems->parse_error)
++				ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt,
++								skb->len,
++								rx_status,
++								elems);
+ 			kfree(elems);
+ 			break;
+ 		}
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3374,8 +3374,10 @@ static bool ieee80211_assoc_success(stru
+ 			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
+ 					  GFP_ATOMIC);
+ 		rcu_read_unlock();
+-		if (!bss_ies)
+-			return false;
++		if (!bss_ies) {
++			ret = false;
++			goto out;
++		}
+ 
+ 		bss_elems = ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
+ 						   false, mgmt->bssid,
+@@ -4358,13 +4360,11 @@ void ieee80211_sta_rx_queued_mgmt(struct
+ 					mgmt->u.action.u.chan_switch.variable,
+ 					ies_len, true, mgmt->bssid, NULL);
+ 
+-			if (!elems || elems->parse_error)
+-				break;
+-
+-			ieee80211_sta_process_chanswitch(sdata,
+-						 rx_status->mactime,
+-						 rx_status->device_timestamp,
+-						 elems, false);
++			if (elems && !elems->parse_error)
++				ieee80211_sta_process_chanswitch(sdata,
++								 rx_status->mactime,
++								 rx_status->device_timestamp,
++								 elems, false);
+ 			kfree(elems);
+ 		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
+ 			struct ieee802_11_elems *elems;
+@@ -4384,17 +4384,17 @@ void ieee80211_sta_rx_queued_mgmt(struct
+ 					mgmt->u.action.u.ext_chan_switch.variable,
+ 					ies_len, true, mgmt->bssid, NULL);
+ 
+-			if (!elems || elems->parse_error)
+-				break;
++			if (elems && !elems->parse_error) {
++				/* for the handling code pretend it was an IE */
++				elems->ext_chansw_ie =
++					&mgmt->u.action.u.ext_chan_switch.data;
++
++				ieee80211_sta_process_chanswitch(sdata,
++								 rx_status->mactime,
++								 rx_status->device_timestamp,
++								 elems, false);
++			}
+ 
+-			/* for the handling code pretend this was also an IE */
+-			elems->ext_chansw_ie =
+-				&mgmt->u.action.u.ext_chan_switch.data;
+-
+-			ieee80211_sta_process_chanswitch(sdata,
+-						 rx_status->mactime,
+-						 rx_status->device_timestamp,
+-						 elems, false);
+ 			kfree(elems);
+ 		}
+ 		break;

package/kernel/mac80211/patches/subsys/351-wifi-cfg80211-fix-u8-overflow-in-cfg80211_update_not.patch

@@ -0,0 +1,41 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 28 Sep 2022 21:56:15 +0200
+Subject: [PATCH] wifi: cfg80211: fix u8 overflow in
+ cfg80211_update_notlisted_nontrans()
+
+commit aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d upstream.
+
+In the copy code of the elements, we do the following calculation
+to reach the end of the MBSSID element:
+
+	/* copy the IEs after MBSSID */
+	cpy_len = mbssid[1] + 2;
+
+This looks fine, however, cpy_len is a u8, the same as mbssid[1],
+so the addition of two can overflow. In this case the subsequent
+memcpy() will overflow the allocated buffer, since it copies 256
+bytes too much due to the way the allocation and memcpy() sizes
+are calculated.
+
+Fix this by using size_t for the cpy_len variable.
+
+This fixes CVE-2022-41674.
+
+Reported-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
+Tested-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -2238,7 +2238,7 @@ cfg80211_update_notlisted_nontrans(struc
+ 	size_t new_ie_len;
+ 	struct cfg80211_bss_ies *new_ies;
+ 	const struct cfg80211_bss_ies *old;
+-	u8 cpy_len;
++	size_t cpy_len;
+ 
+ 	lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
+ 

package/kernel/mac80211/patches/subsys/352-wifi-cfg80211-mac80211-reject-bad-MBSSID-elements.patch

@@ -0,0 +1,47 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 28 Sep 2022 22:01:37 +0200
+Subject: [PATCH] wifi: cfg80211/mac80211: reject bad MBSSID elements
+
+commit 8f033d2becc24aa6bfd2a5c104407963560caabc upstream
+
+Per spec, the maximum value for the MaxBSSID ('n') indicator is 8,
+and the minimum is 1 since a multiple BSSID set with just one BSSID
+doesn't make sense (the # of BSSIDs is limited by 2^n).
+
+Limit this in the parsing in both cfg80211 and mac80211, rejecting
+any elements with an invalid value.
+
+This fixes potentially bad shifts in the processing of these inside
+the cfg80211_gen_new_bssid() function later.
+
+I found this during the investigation of CVE-2022-41674 fixed by the
+previous patch.
+
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Fixes: 78ac51f81532 ("mac80211: support multi-bssid")
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1413,6 +1413,8 @@ static size_t ieee802_11_find_bssid_prof
+ 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {
+ 		if (elem->datalen < 2)
+ 			continue;
++		if (elem->data[0] < 1 || elem->data[0] > 8)
++			continue;
+ 
+ 		for_each_element(sub, elem->data + 1, elem->datalen - 1) {
+ 			u8 new_bssid[ETH_ALEN];
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -2103,6 +2103,8 @@ static void cfg80211_parse_mbssid_data(s
+ 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) {
+ 		if (elem->datalen < 4)
+ 			continue;
++		if (elem->data[0] < 1 || (int)elem->data[0] > 8)
++			continue;
+ 		for_each_element(sub, elem->data + 1, elem->datalen - 1) {
+ 			u8 profile_len;
+ 

package/kernel/mac80211/patches/subsys/353-wifi-mac80211-fix-MBSSID-parsing-use-after-free.patch

@@ -0,0 +1,94 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 28 Sep 2022 22:07:15 +0200
+Subject: [PATCH] wifi: mac80211: fix MBSSID parsing use-after-free
+
+commit ff05d4b45dd89b922578dac497dcabf57cf771c6
+
+When we parse a multi-BSSID element, we might point some
+element pointers into the allocated nontransmitted_profile.
+However, we free this before returning, causing UAF when the
+relevant pointers in the parsed elements are accessed.
+
+Fix this by not allocating the scratch buffer separately but
+as part of the returned structure instead, that way, there
+are no lifetime issues with it.
+
+The scratch buffer introduction as part of the returned data
+here is taken from MLO feature work done by Ilan.
+
+This fixes CVE-2022-42719.
+
+Fixes: 5023b14cf4df ("mac80211: support profile split between elements")
+Co-developed-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1611,6 +1611,14 @@ struct ieee802_11_elems {
+ 
+ 	/* whether a parse error occurred while retrieving these elements */
+ 	bool parse_error;
++
++	/*
++	 * scratch buffer that can be used for various element parsing related
++	 * tasks, e.g., element de-fragmentation etc.
++	 */
++	size_t scratch_len;
++	u8 *scratch_pos;
++	u8 scratch[];
+ };
+ 
+ static inline struct ieee80211_local *hw_to_local(
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1478,24 +1478,25 @@ struct ieee802_11_elems *ieee802_11_pars
+ 	u8 *nontransmitted_profile;
+ 	int nontransmitted_profile_len = 0;
+ 
+-	elems = kzalloc(sizeof(*elems), GFP_ATOMIC);
++	elems = kzalloc(sizeof(*elems) + len, GFP_ATOMIC);
+ 	if (!elems)
+ 		return NULL;
+ 	elems->ie_start = start;
+ 	elems->total_len = len;
+ 
+-	nontransmitted_profile = kmalloc(len, GFP_ATOMIC);
+-	if (nontransmitted_profile) {
+-		nontransmitted_profile_len =
+-			ieee802_11_find_bssid_profile(start, len, elems,
+-						      transmitter_bssid,
+-						      bss_bssid,
+-						      nontransmitted_profile);
+-		non_inherit =
+-			cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
+-					       nontransmitted_profile,
+-					       nontransmitted_profile_len);
+-	}
++	elems->scratch_len = len;
++	elems->scratch_pos = elems->scratch;
++
++	nontransmitted_profile = elems->scratch_pos;
++	nontransmitted_profile_len =
++		ieee802_11_find_bssid_profile(start, len, elems,
++					      transmitter_bssid,
++					      bss_bssid,
++					      nontransmitted_profile);
++	non_inherit =
++		cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
++				       nontransmitted_profile,
++				       nontransmitted_profile_len);
+ 
+ 	crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
+ 					  crc, non_inherit);
+@@ -1524,8 +1525,6 @@ struct ieee802_11_elems *ieee802_11_pars
+ 	    offsetofend(struct ieee80211_bssid_index, dtim_count))
+ 		elems->dtim_count = elems->bssid_index->dtim_count;
+ 
+-	kfree(nontransmitted_profile);
+-
+ 	elems->crc = crc;
+ 
+ 	return elems;

package/kernel/mac80211/patches/subsys/354-wifi-cfg80211-ensure-length-byte-is-present-before-a.patch

@@ -0,0 +1,41 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 29 Sep 2022 21:50:44 +0200
+Subject: [PATCH] wifi: cfg80211: ensure length byte is present before
+ access
+
+commit 567e14e39e8f8c6997a1378bc3be615afca86063 upstream.
+
+When iterating the elements here, ensure the length byte is
+present before checking it to see if the entire element will
+fit into the buffer.
+
+Longer term, we should rewrite this code using the type-safe
+element iteration macros that check all of this.
+
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Reported-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -304,7 +304,8 @@ static size_t cfg80211_gen_new_ie(const
+ 	tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
+ 	tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
+ 
+-	while (tmp_old + tmp_old[1] + 2 - ie <= ielen) {
++	while (tmp_old + 2 - ie <= ielen &&
++	       tmp_old + tmp_old[1] + 2 - ie <= ielen) {
+ 		if (tmp_old[0] == 0) {
+ 			tmp_old++;
+ 			continue;
+@@ -364,7 +365,8 @@ static size_t cfg80211_gen_new_ie(const
+ 	 * copied to new ie, skip ssid, capability, bssid-index ie
+ 	 */
+ 	tmp_new = sub_copy;
+-	while (tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
++	while (tmp_new + 2 - sub_copy <= subie_len &&
++	       tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
+ 		if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
+ 		      tmp_new[0] == WLAN_EID_SSID)) {
+ 			memcpy(pos, tmp_new, tmp_new[1] + 2);

package/kernel/mac80211/patches/subsys/355-wifi-cfg80211-fix-BSS-refcounting-bugs.patch

@@ -0,0 +1,87 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 30 Sep 2022 23:44:23 +0200
+Subject: [PATCH] wifi: cfg80211: fix BSS refcounting bugs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 0b7808818cb9df6680f98996b8e9a439fa7bcc2f upstream.
+
+There are multiple refcounting bugs related to multi-BSSID:
+ - In bss_ref_get(), if the BSS has a hidden_beacon_bss, then
+   the bss pointer is overwritten before checking for the
+   transmitted BSS, which is clearly wrong. Fix this by using
+   the bss_from_pub() macro.
+
+ - In cfg80211_bss_update() we copy the transmitted_bss pointer
+   from tmp into new, but then if we release new, we'll unref
+   it erroneously. We already set the pointer and ref it, but
+   need to NULL it since it was copied from the tmp data.
+
+ - In cfg80211_inform_single_bss_data(), if adding to the non-
+   transmitted list fails, we unlink the BSS and yet still we
+   return it, but this results in returning an entry without
+   a reference. We shouldn't return it anyway if it was broken
+   enough to not get added there.
+
+This fixes CVE-2022-42720.
+
+Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Fixes: a3584f56de1c ("cfg80211: Properly track transmitting and non-transmitting BSS")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -143,18 +143,12 @@ static inline void bss_ref_get(struct cf
+ 	lockdep_assert_held(&rdev->bss_lock);
+ 
+ 	bss->refcount++;
+-	if (bss->pub.hidden_beacon_bss) {
+-		bss = container_of(bss->pub.hidden_beacon_bss,
+-				   struct cfg80211_internal_bss,
+-				   pub);
+-		bss->refcount++;
+-	}
+-	if (bss->pub.transmitted_bss) {
+-		bss = container_of(bss->pub.transmitted_bss,
+-				   struct cfg80211_internal_bss,
+-				   pub);
+-		bss->refcount++;
+-	}
++
++	if (bss->pub.hidden_beacon_bss)
++		bss_from_pub(bss->pub.hidden_beacon_bss)->refcount++;
++
++	if (bss->pub.transmitted_bss)
++		bss_from_pub(bss->pub.transmitted_bss)->refcount++;
+ }
+ 
+ static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
+@@ -1743,6 +1737,8 @@ cfg80211_bss_update(struct cfg80211_regi
+ 		new->refcount = 1;
+ 		INIT_LIST_HEAD(&new->hidden_list);
+ 		INIT_LIST_HEAD(&new->pub.nontrans_list);
++		/* we'll set this later if it was non-NULL */
++		new->pub.transmitted_bss = NULL;
+ 
+ 		if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
+ 			hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
+@@ -1983,10 +1979,15 @@ cfg80211_inform_single_bss_data(struct w
+ 		spin_lock_bh(&rdev->bss_lock);
+ 		if (cfg80211_add_nontrans_list(non_tx_data->tx_bss,
+ 					       &res->pub)) {
+-			if (__cfg80211_unlink_bss(rdev, res))
++			if (__cfg80211_unlink_bss(rdev, res)) {
+ 				rdev->bss_generation++;
++				res = NULL;
++			}
+ 		}
+ 		spin_unlock_bh(&rdev->bss_lock);
++
++		if (!res)
++			return NULL;
+ 	}
+ 
+ 	trace_cfg80211_return_bss(&res->pub);

package/kernel/mac80211/patches/subsys/356-wifi-cfg80211-avoid-nontransmitted-BSS-list-corrupti.patch

@@ -0,0 +1,48 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Sat, 1 Oct 2022 00:01:44 +0200
+Subject: [PATCH] wifi: cfg80211: avoid nontransmitted BSS list
+ corruption
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit bcca852027e5878aec911a347407ecc88d6fff7f upstream.
+
+If a non-transmitted BSS shares enough information (both
+SSID and BSSID!) with another non-transmitted BSS of a
+different AP, then we can find and update it, and then
+try to add it to the non-transmitted BSS list. We do a
+search for it on the transmitted BSS, but if it's not
+there (but belongs to another transmitted BSS), the list
+gets corrupted.
+
+Since this is an erroneous situation, simply fail the
+list insertion in this case and free the non-transmitted
+BSS.
+
+This fixes CVE-2022-42721.
+
+Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -425,6 +425,15 @@ cfg80211_add_nontrans_list(struct cfg802
+ 
+ 	rcu_read_unlock();
+ 
++	/*
++	 * This is a bit weird - it's not on the list, but already on another
++	 * one! The only way that could happen is if there's some BSSID/SSID
++	 * shared by multiple APs in their multi-BSSID profiles, potentially
++	 * with hidden SSID mixed in ... ignore it.
++	 */
++	if (!list_empty(&nontrans_bss->nontrans_list))
++		return -EINVAL;
++
+ 	/* add to the list */
+ 	list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
+ 	return 0;

package/kernel/mac80211/patches/subsys/357-wifi-mac80211_hwsim-avoid-mac80211-warning-on-bad-ra.patch

@@ -0,0 +1,31 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 5 Oct 2022 15:10:09 +0200
+Subject: [PATCH] wifi: mac80211_hwsim: avoid mac80211 warning on bad
+ rate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 1833b6f46d7e2830251a063935ab464256defe22 upstream.
+
+If the tool on the other side (e.g. wmediumd) gets confused
+about the rate, we hit a warning in mac80211. Silence that
+by effectively duplicating the check here and dropping the
+frame silently (in mac80211 it's dropped with the warning).
+
+Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3760,6 +3760,8 @@ static int hwsim_cloned_frame_received_n
+ 
+ 	rx_status.band = channel->band;
+ 	rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
++	if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
++		goto out;
+ 	rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
+ 
+ 	hdr = (void *)skb->data;

package/kernel/mac80211/patches/subsys/358-wifi-mac80211-fix-crash-in-beacon-protection-for-P2P.patch

@@ -0,0 +1,52 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 5 Oct 2022 21:24:10 +0200
+Subject: [PATCH] wifi: mac80211: fix crash in beacon protection for
+ P2P-device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit b2d03cabe2b2e150ff5a381731ea0355459be09f upstream.
+
+If beacon protection is active but the beacon cannot be
+decrypted or is otherwise malformed, we call the cfg80211
+API to report this to userspace, but that uses a netdev
+pointer, which isn't present for P2P-Device. Fix this to
+call it only conditionally to ensure cfg80211 won't crash
+in the case of P2P-Device.
+
+This fixes CVE-2022-42722.
+
+Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Fixes: 9eaf183af741 ("mac80211: Report beacon protection failures to user space")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1986,10 +1986,11 @@ ieee80211_rx_h_decrypt(struct ieee80211_
+ 
+ 		if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
+ 		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
+-		    NUM_DEFAULT_BEACON_KEYS) {
+-			cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
+-						     skb->data,
+-						     skb->len);
++				   NUM_DEFAULT_BEACON_KEYS) {
++			if (rx->sdata->dev)
++				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
++							     skb->data,
++							     skb->len);
+ 			return RX_DROP_MONITOR; /* unexpected BIP keyidx */
+ 		}
+ 
+@@ -2137,7 +2138,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_
+ 	/* either the frame has been decrypted or will be dropped */
+ 	status->flag |= RX_FLAG_DECRYPTED;
+ 
+-	if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE))
++	if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE &&
++		     rx->sdata->dev))
+ 		cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
+ 					     skb->data, skb->len);
+ 

package/kernel/mac80211/patches/subsys/359-wifi-cfg80211-update-hidden-BSSes-to-avoid-WARN_ON.patch

@@ -0,0 +1,85 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 5 Oct 2022 23:11:43 +0200
+Subject: [PATCH] wifi: cfg80211: update hidden BSSes to avoid WARN_ON
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit c90b93b5b782891ebfda49d4e5da36632fefd5d1 upstream.
+
+When updating beacon elements in a non-transmitted BSS,
+also update the hidden sub-entries to the same beacon
+elements, so that a future update through other paths
+won't trigger a WARN_ON().
+
+The warning is triggered because the beacon elements in
+the hidden BSSes that are children of the BSS should
+always be the same as in the parent.
+
+Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -1609,6 +1609,23 @@ struct cfg80211_non_tx_bss {
+ 	u8 bssid_index;
+ };
+ 
++static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known,
++					 const struct cfg80211_bss_ies *new_ies,
++					 const struct cfg80211_bss_ies *old_ies)
++{
++	struct cfg80211_internal_bss *bss;
++
++	/* Assign beacon IEs to all sub entries */
++	list_for_each_entry(bss, &known->hidden_list, hidden_list) {
++		const struct cfg80211_bss_ies *ies;
++
++		ies = rcu_access_pointer(bss->pub.beacon_ies);
++		WARN_ON(ies != old_ies);
++
++		rcu_assign_pointer(bss->pub.beacon_ies, new_ies);
++	}
++}
++
+ static bool
+ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
+ 			  struct cfg80211_internal_bss *known,
+@@ -1632,7 +1649,6 @@ cfg80211_update_known_bss(struct cfg8021
+ 			kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
+ 	} else if (rcu_access_pointer(new->pub.beacon_ies)) {
+ 		const struct cfg80211_bss_ies *old;
+-		struct cfg80211_internal_bss *bss;
+ 
+ 		if (known->pub.hidden_beacon_bss &&
+ 		    !list_empty(&known->hidden_list)) {
+@@ -1660,16 +1676,7 @@ cfg80211_update_known_bss(struct cfg8021
+ 		if (old == rcu_access_pointer(known->pub.ies))
+ 			rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
+ 
+-		/* Assign beacon IEs to all sub entries */
+-		list_for_each_entry(bss, &known->hidden_list, hidden_list) {
+-			const struct cfg80211_bss_ies *ies;
+-
+-			ies = rcu_access_pointer(bss->pub.beacon_ies);
+-			WARN_ON(ies != old);
+-
+-			rcu_assign_pointer(bss->pub.beacon_ies,
+-					   new->pub.beacon_ies);
+-		}
++		cfg80211_update_hidden_bsses(known, new->pub.beacon_ies, old);
+ 
+ 		if (old)
+ 			kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
+@@ -2319,6 +2326,8 @@ cfg80211_update_notlisted_nontrans(struc
+ 	} else {
+ 		old = rcu_access_pointer(nontrans_bss->beacon_ies);
+ 		rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies);
++		cfg80211_update_hidden_bsses(bss_from_pub(nontrans_bss),
++					     new_ies, old);
+ 		rcu_assign_pointer(nontrans_bss->ies, new_ies);
+ 		if (old)
+ 			kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);

package/kernel/mac80211/patches/subsys/360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch

@@ -0,0 +1,77 @@
+From 4db561ae4a90c2d0e15996634567559e292dc9e5 Mon Sep 17 00:00:00 2001
+From: Ahmed Zaki <anzaki@gmail.com>
+Date: Sat, 2 Oct 2021 08:53:29 -0600
+Subject: [PATCH] mac80211: fix a memory leak where sta_info is not freed
+
+commit 8f9dcc29566626f683843ccac6113a12208315ca upstream.
+
+The following is from a system that went OOM due to a memory leak:
+
+wlan0: Allocated STA 74:83:c2:64:0b:87
+wlan0: Allocated STA 74:83:c2:64:0b:87
+wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_add_sta)
+wlan0: Adding new IBSS station 74:83:c2:64:0b:87
+wlan0: moving STA 74:83:c2:64:0b:87 to state 2
+wlan0: moving STA 74:83:c2:64:0b:87 to state 3
+wlan0: Inserted STA 74:83:c2:64:0b:87
+wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_work)
+wlan0: Adding new IBSS station 74:83:c2:64:0b:87
+wlan0: moving STA 74:83:c2:64:0b:87 to state 2
+wlan0: moving STA 74:83:c2:64:0b:87 to state 3
+.
+.
+wlan0: expiring inactive not authorized STA 74:83:c2:64:0b:87
+wlan0: moving STA 74:83:c2:64:0b:87 to state 2
+wlan0: moving STA 74:83:c2:64:0b:87 to state 1
+wlan0: Removed STA 74:83:c2:64:0b:87
+wlan0: Destroyed STA 74:83:c2:64:0b:87
+
+The ieee80211_ibss_finish_sta() is called twice on the same STA from 2
+different locations. On the second attempt, the allocated STA is not
+destroyed creating a kernel memory leak.
+
+This is happening because sta_info_insert_finish() does not call
+sta_info_free() the second time when the STA already exists (returns
+-EEXIST). Note that the caller sta_info_insert_rcu() assumes STA is
+destroyed upon errors.
+
+Same fix is applied to -ENOMEM.
+
+Signed-off-by: Ahmed Zaki <anzaki@gmail.com>
+Link: https://lore.kernel.org/r/20211002145329.3125293-1-anzaki@gmail.com
+[change the error path label to use the existing code]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Viacheslav Sablin <sablin@ispras.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/sta_info.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -646,13 +646,13 @@ static int sta_info_insert_finish(struct
+ 	/* check if STA exists already */
+ 	if (sta_info_get_bss(sdata, sta->sta.addr)) {
+ 		err = -EEXIST;
+-		goto out_err;
++		goto out_cleanup;
+ 	}
+ 
+ 	sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL);
+ 	if (!sinfo) {
+ 		err = -ENOMEM;
+-		goto out_err;
++		goto out_cleanup;
+ 	}
+ 
+ 	local->num_sta++;
+@@ -708,8 +708,8 @@ static int sta_info_insert_finish(struct
+  out_drop_sta:
+ 	local->num_sta--;
+ 	synchronize_net();
++ out_cleanup:
+ 	cleanup_single_sta(sta);
+- out_err:
+ 	mutex_unlock(&local->sta_mtx);
+ 	kfree(sinfo);
+ 	rcu_read_lock();

package/kernel/mac80211/patches/subsys/361-wifi-mac80211-Don-t-finalize-CSA-in-IBSS-mode-if-sta.patch

@@ -0,0 +1,47 @@
+From 552ba102a6898630a7d16887f29e606d6fabe508 Mon Sep 17 00:00:00 2001
+From: Siddh Raman Pant <code@siddh.me>
+Date: Sun, 14 Aug 2022 20:45:12 +0530
+Subject: [PATCH] wifi: mac80211: Don't finalize CSA in IBSS mode if state is
+ disconnected
+
+commit 15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0 upstream.
+
+When we are not connected to a channel, sending channel "switch"
+announcement doesn't make any sense.
+
+The BSS list is empty in that case. This causes the for loop in
+cfg80211_get_bss() to be bypassed, so the function returns NULL
+(check line 1424 of net/wireless/scan.c), causing the WARN_ON()
+in ieee80211_ibss_csa_beacon() to get triggered (check line 500
+of net/mac80211/ibss.c), which was consequently reported on the
+syzkaller dashboard.
+
+Thus, check if we have an existing connection before generating
+the CSA beacon in ieee80211_ibss_finish_csa().
+
+Cc: stable@vger.kernel.org
+Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode")
+Link: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6
+Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
+Signed-off-by: Siddh Raman Pant <code@siddh.me>
+Tested-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20220814151512.9985-1-code@siddh.me
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/ibss.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -534,6 +534,10 @@ int ieee80211_ibss_finish_csa(struct iee
+ 
+ 	sdata_assert_lock(sdata);
+ 
++	/* When not connected/joined, sending CSA doesn't make sense. */
++	if (ifibss->state != IEEE80211_IBSS_MLME_JOINED)
++		return -ENOLINK;
++
+ 	/* update cfg80211 bss information with the new channel */
+ 	if (!is_zero_ether_addr(ifibss->bssid)) {
+ 		cbss = cfg80211_get_bss(sdata->local->hw.wiphy,

package/kernel/mac80211/patches/subsys/362-wifi-mac80211-Fix-UAF-in-ieee80211_scan_rx.patch

@@ -0,0 +1,55 @@
+From 5d20c6f932f2758078d0454729129c894fe353e7 Mon Sep 17 00:00:00 2001
+From: Siddh Raman Pant <code@siddh.me>
+Date: Sat, 20 Aug 2022 01:33:40 +0530
+Subject: [PATCH] wifi: mac80211: Fix UAF in ieee80211_scan_rx()
+
+commit 60deb9f10eec5c6a20252ed36238b55d8b614a2c upstream.
+
+ieee80211_scan_rx() tries to access scan_req->flags after a
+null check, but a UAF is observed when the scan is completed
+and __ieee80211_scan_completed() executes, which then calls
+cfg80211_scan_done() leading to the freeing of scan_req.
+
+Since scan_req is rcu_dereference()'d, prevent the racing in
+__ieee80211_scan_completed() by ensuring that from mac80211's
+POV it is no longer accessed from an RCU read critical section
+before we call cfg80211_scan_done().
+
+Cc: stable@vger.kernel.org
+Link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d
+Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com
+Suggested-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Siddh Raman Pant <code@siddh.me>
+Link: https://lore.kernel.org/r/20220819200340.34826-1-code@siddh.me
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/scan.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -465,16 +465,19 @@ static void __ieee80211_scan_completed(s
+ 	scan_req = rcu_dereference_protected(local->scan_req,
+ 					     lockdep_is_held(&local->mtx));
+ 
+-	if (scan_req != local->int_scan_req) {
+-		local->scan_info.aborted = aborted;
+-		cfg80211_scan_done(scan_req, &local->scan_info);
+-	}
+ 	RCU_INIT_POINTER(local->scan_req, NULL);
+ 	RCU_INIT_POINTER(local->scan_sdata, NULL);
+ 
+ 	local->scanning = 0;
+ 	local->scan_chandef.chan = NULL;
+ 
++	synchronize_rcu();
++
++	if (scan_req != local->int_scan_req) {
++		local->scan_info.aborted = aborted;
++		cfg80211_scan_done(scan_req, &local->scan_info);
++	}
++
+ 	/* Set power back to normal operating levels. */
+ 	ieee80211_hw_config(local, 0);
+ 

package/kernel/mt76/Makefile

@@ -8,9 +8,9 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2022-07-03
-PKG_SOURCE_VERSION:=93e3fce916c62d06892d41bf00d0f4c2926c9a0b
-PKG_MIRROR_HASH:=ad966e7aa81301f0601ceb7aae2ecb471c452f5d8366f701add807152fd08971
+PKG_SOURCE_DATE:=2022-09-06
+PKG_SOURCE_VERSION:=d70546462b7b51ebc2bcdd5c534fdf3465be62a4
+PKG_MIRROR_HASH:=3d6b68d70a78c0072ed10ab2548344b6b3a70ad99e4edc258fafa16886f4abf9
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_USE_NINJA:=0

package/libs/libmnl/patches/001-fix_build.patch

@@ -0,0 +1,11 @@
+--- a/doxygen/Makefile.am
++++ b/doxygen/Makefile.am
+@@ -21,7 +21,7 @@ doxyfile.stamp: $(doc_srcs) Makefile.am
+ # The command has to be a single line so the functions work
+ # and so `make` gives all lines to `bash -c`
+ # (hence ";\" at the end of every line but the last).
+-	/bin/bash -p -c 'declare -A renamed_page;\
++	bash -p -c 'declare -A renamed_page;\
+ main(){ set -e; cd man/man3; rm -f _*;\
+   count_real_pages;\
+   rename_real_pages;\

package/libs/mbedtls/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mbedtls
-PKG_VERSION:=2.28.0
+PKG_VERSION:=2.28.1
 PKG_RELEASE:=$(AUTORELEASE)
 PKG_USE_MIPS16:=0
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/ARMmbed/mbedtls/tar.gz/v$(PKG_VERSION)?
-PKG_HASH:=6519579b836ed78cc549375c7c18b111df5717e86ca0eeff4cb64b2674f424cc
+PKG_HASH:=6797a7b6483ef589deeab8d33d401ed235d7be25eeecda1be8ddfed406d40ff4
 
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=gpl-2.0.txt

package/libs/mbedtls/patches/100-fix-compile.patch

@@ -0,0 +1,22 @@
+Fix a compile problem introduced in commit 331c3421d1f0 ("Address review comments")
+
+Bug report: https://github.com/Mbed-TLS/mbedtls/issues/6243
+
+--- a/programs/ssl/ssl_server2.c
++++ b/programs/ssl/ssl_server2.c
+@@ -2511,7 +2511,6 @@ int main( int argc, char *argv[] )
+         }
+         key_cert_init2 = 2;
+ #endif /* MBEDTLS_ECDSA_C */
+-    }
+ 
+ #if defined(MBEDTLS_USE_PSA_CRYPTO)
+     if( opt.key_opaque != 0 )
+@@ -2540,6 +2539,7 @@ int main( int argc, char *argv[] )
+     }
+ #endif /* MBEDTLS_USE_PSA_CRYPTO */
+ #endif /* MBEDTLS_CERTS_C */
++    }
+ 
+     mbedtls_printf( " ok (key types: %s - %s)\n", mbedtls_pk_get_name( &pkey ), mbedtls_pk_get_name( &pkey2 ) );
+ #endif /* MBEDTLS_X509_CRT_PARSE_C */

package/libs/mbedtls/patches/200-config.patch

@@ -1,6 +1,6 @@
 --- a/include/mbedtls/config.h
 +++ b/include/mbedtls/config.h
-@@ -665,14 +665,14 @@
+@@ -670,14 +670,14 @@
   *
   * Enable Output Feedback mode (OFB) for symmetric ciphers.
   */
@@ -17,7 +17,7 @@
  
  /**
   * \def MBEDTLS_CIPHER_NULL_CIPHER
-@@ -790,20 +790,20 @@
+@@ -795,20 +795,20 @@
   * Comment macros to disable the curve and functions for it
   */
  /* Short Weierstrass curves (supporting ECP, ECDH, ECDSA) */
@@ -47,7 +47,7 @@
  
  /**
   * \def MBEDTLS_ECP_NIST_OPTIM
-@@ -956,7 +956,7 @@
+@@ -961,7 +961,7 @@
   *             See dhm.h for more details.
   *
   */
@@ -56,7 +56,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
-@@ -976,7 +976,7 @@
+@@ -981,7 +981,7 @@
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
   */
@@ -65,7 +65,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
-@@ -1001,7 +1001,7 @@
+@@ -1006,7 +1006,7 @@
   *      MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
   *      MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
   */
@@ -74,7 +74,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
-@@ -1135,7 +1135,7 @@
+@@ -1140,7 +1140,7 @@
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
   */
@@ -83,7 +83,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
-@@ -1159,7 +1159,7 @@
+@@ -1164,7 +1164,7 @@
   *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
   */
@@ -92,7 +92,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
-@@ -1263,7 +1263,7 @@
+@@ -1268,7 +1268,7 @@
   * This option is only useful if both MBEDTLS_SHA256_C and
   * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
   */
@@ -101,7 +101,7 @@
  
  /**
   * \def MBEDTLS_ENTROPY_NV_SEED
-@@ -1478,14 +1478,14 @@
+@@ -1483,14 +1483,14 @@
   * Uncomment this macro to disable the use of CRT in RSA.
   *
   */
@@ -118,7 +118,7 @@
  
  /**
   * \def MBEDTLS_SHA256_SMALLER
-@@ -1756,7 +1756,7 @@
+@@ -1761,7 +1761,7 @@
   *          configuration of this extension).
   *
   */
@@ -127,7 +127,7 @@
  
  /**
   * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
-@@ -2017,7 +2017,7 @@
+@@ -2022,7 +2022,7 @@
   *
   * Comment this macro to disable support for truncated HMAC in SSL
   */
@@ -136,7 +136,7 @@
  
  /**
   * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT
-@@ -2185,7 +2185,7 @@
+@@ -2201,7 +2201,7 @@
   *
   * Comment this to disable run-time checking and save ROM space
   */
@@ -145,7 +145,7 @@
  
  /**
   * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
-@@ -2534,7 +2534,7 @@
+@@ -2550,7 +2550,7 @@
   *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
   */
@@ -154,7 +154,7 @@
  
  /**
   * \def MBEDTLS_ARIA_C
-@@ -2600,7 +2600,7 @@
+@@ -2616,7 +2616,7 @@
   * This module enables the AES-CCM ciphersuites, if other requisites are
   * enabled as well.
   */
@@ -163,7 +163,7 @@
  
  /**
   * \def MBEDTLS_CERTS_C
-@@ -2612,7 +2612,7 @@
+@@ -2628,7 +2628,7 @@
   *
   * This module is used for testing (ssl_client/server).
   */
@@ -172,7 +172,7 @@
  
  /**
   * \def MBEDTLS_CHACHA20_C
-@@ -2725,7 +2725,7 @@
+@@ -2741,7 +2741,7 @@
   * \warning   DES is considered a weak cipher and its use constitutes a
   *            security risk. We recommend considering stronger ciphers instead.
   */
@@ -181,7 +181,7 @@
  
  /**
   * \def MBEDTLS_DHM_C
-@@ -2890,7 +2890,7 @@
+@@ -2906,7 +2906,7 @@
   * This module adds support for the Hashed Message Authentication Code
   * (HMAC)-based key derivation function (HKDF).
   */
@@ -190,7 +190,7 @@
  
  /**
   * \def MBEDTLS_HMAC_DRBG_C
-@@ -3203,7 +3203,7 @@
+@@ -3219,7 +3219,7 @@
   *
   * This module enables abstraction of common (libc) functions.
   */
@@ -199,7 +199,7 @@
  
  /**
   * \def MBEDTLS_POLY1305_C
-@@ -3279,7 +3279,7 @@
+@@ -3295,7 +3295,7 @@
   * Caller:  library/md.c
   *
   */
@@ -208,7 +208,7 @@
  
  /**
   * \def MBEDTLS_RSA_C
-@@ -3486,7 +3486,7 @@
+@@ -3506,7 +3506,7 @@
   *
   * This module provides run-time version information.
   */
@@ -217,12 +217,12 @@
  
  /**
   * \def MBEDTLS_X509_USE_C
-@@ -3596,7 +3596,7 @@
+@@ -3616,7 +3616,7 @@
   * Module:  library/xtea.c
   * Caller:
   */
 -#define MBEDTLS_XTEA_C
 +//#define MBEDTLS_XTEA_C
  
- /* \} name SECTION: mbed TLS modules */
+ /** \} name SECTION: mbed TLS modules */
  

package/libs/ustream-ssl/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ustream-ssl
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ustream-ssl.git

package/libs/wolfssl/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wolfssl
-PKG_VERSION:=5.4.0-stable
+PKG_VERSION:=5.5.1-stable
 PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_VERSION)
-PKG_HASH:=dc36cc19dad197253e5c2ecaa490c7eef579ad448706e55d73d79396e814098b
+PKG_HASH:=97339e6956c90e7c881ba5c748dd04f7c30e5dbe0c06da765418c51375a6dee3
 
 PKG_FIXUP:=libtool libtool-abiver
 PKG_INSTALL:=1

package/libs/wolfssl/patches/100-disable-hardening-check.patch

@@ -1,6 +1,6 @@
 --- a/wolfssl/wolfcrypt/settings.h
 +++ b/wolfssl/wolfcrypt/settings.h
-@@ -2442,7 +2442,7 @@ extern void uITRON4_free(void *p) ;
+@@ -2454,7 +2454,7 @@ extern void uITRON4_free(void *p) ;
  #endif
  
  /* warning for not using harden build options (default with ./configure) */

package/libs/wolfssl/patches/101-update-sp_rand_prime-s-preprocessor-gating-to-match.patch

@@ -1,23 +0,0 @@
-From dc92ec2aa9cb76b782bdba3fc5203267ebf39994 Mon Sep 17 00:00:00 2001
-From: Kareem <kareem@wolfssl.com>
-Date: Fri, 22 Jul 2022 11:07:46 -0700
-Subject: [PATCH] Update sp_rand_prime's preprocessor gating to match
- wolfSSL_BN_generate_prime_ex's.
-
----
- wolfcrypt/src/sp_int.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/wolfcrypt/src/sp_int.c
-+++ b/wolfcrypt/src/sp_int.c
-@@ -15647,8 +15647,8 @@ int sp_radix_size(sp_int* a, int radix,
-  * Prime number generation and checking.
-  ***************************************/
- 
--#if defined(WOLFSSL_KEY_GEN) && (!defined(NO_DH) || !defined(NO_DSA)) && \
--    !defined(WC_NO_RNG)
-+#if defined(WOLFSSL_KEY_GEN) && (!defined(NO_RSA) || !defined(NO_DH) || \
-+    !defined(NO_DSA)) && !defined(WC_NO_RNG)
- /* Generate a random prime for RSA only.
-  *
-  * @param  [out]  r     SP integer to hold result.

package/libs/wolfssl/patches/200-ecc-rng.patch

@@ -11,7 +11,7 @@ RNG regardless of the built settings for wolfssl.
 
 --- a/wolfcrypt/src/ecc.c
 +++ b/wolfcrypt/src/ecc.c
-@@ -12288,21 +12288,21 @@ void wc_ecc_fp_free(void)
+@@ -12505,21 +12505,21 @@ void wc_ecc_fp_free(void)
  
  #endif /* FP_ECC */
  
@@ -37,7 +37,7 @@ RNG regardless of the built settings for wolfssl.
  
 --- a/wolfssl/wolfcrypt/ecc.h
 +++ b/wolfssl/wolfcrypt/ecc.h
-@@ -650,10 +650,8 @@ WOLFSSL_API
+@@ -656,10 +656,8 @@ WOLFSSL_ABI WOLFSSL_API
  void wc_ecc_fp_free(void);
  WOLFSSL_LOCAL
  void wc_ecc_fp_init(void);

package/libs/zlib/Makefile

@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zlib
 PKG_VERSION:=1.2.11
-PKG_RELEASE:=4
+PKG_RELEASE:=6
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@SF/libpng http://www.zlib.net

package/libs/zlib/patches/006-fix-CVE-2022-37434.patch

@@ -0,0 +1,32 @@
+From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001
+From: Mark Adler <fork@madler.net>
+Date: Sat, 30 Jul 2022 15:51:11 -0700
+Subject: [PATCH] Fix a bug when getting a gzip header extra field with
+ inflate().
+
+If the extra field was larger than the space the user provided with
+inflateGetHeader(), and if multiple calls of inflate() delivered
+the extra header data, then there could be a buffer overflow of the
+provided space. This commit assures that provided space is not
+exceeded.
+---
+ inflate.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/inflate.c b/inflate.c
+index 7be8c6366..7a7289749 100644
+--- a/inflate.c
++++ b/inflate.c
+@@ -763,9 +763,10 @@ int flush;
+                 copy = state->length;
+                 if (copy > have) copy = have;
+                 if (copy) {
++                    len = state->head->extra_len - state->length;
+                     if (state->head != Z_NULL &&
+-                        state->head->extra != Z_NULL) {
+-                        len = state->head->extra_len - state->length;
++                        state->head->extra != Z_NULL &&
++                        len < state->head->extra_max) {
+                         zmemcpy(state->head->extra + len, next,
+                                 len + copy > state->head->extra_max ?
+                                 state->head->extra_max - len : copy);