OpenWrt v22.03.2: adjust config defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

Makefile

@@ -14,7 +14,7 @@ $(if $(findstring $(space),$(TOPDIR)),$(error ERROR: The path to the OpenWrt dir
 
 world:
 
-DISTRO_PKG_CONFIG:=$(shell $(TOPDIR)/scripts/command_all.sh pkg-config | grep -E '\/usr' | head -n 1)
+DISTRO_PKG_CONFIG:=$(shell $(TOPDIR)/scripts/command_all.sh pkg-config | grep '/usr' | head -n 1)
 export PATH:=$(TOPDIR)/staging_dir/host/bin:$(PATH)
 
 ifneq ($(OPENWRT_BUILD),1)

config/Config-build.in

@@ -58,6 +58,10 @@ menu "Global build settings"
 		bool "Enable signature checking in opkg"
 		default SIGNED_PACKAGES
 
+	config DOWNLOAD_CHECK_CERTIFICATE
+		bool "Enable TLS certificate verification during package download"
+		default y
+
 	comment "General build options"
 
 	config TESTING_KERNEL
@@ -160,7 +164,6 @@ menu "Global build settings"
 
 	choice
 		prompt "Binary stripping method"
-		default USE_STRIP   if EXTERNAL_TOOLCHAIN
 		default USE_STRIP   if USE_GLIBC
 		default USE_SSTRIP
 		help

config/Config-kernel.in

@@ -422,6 +422,11 @@ config KERNEL_KPROBE_EVENTS
 	bool
 	default y if KERNEL_KPROBES
 
+config KERNEL_BPF_KPROBE_OVERRIDE
+	bool
+	depends on KERNEL_KPROBES
+	default n
+
 config KERNEL_AIO
 	bool "Compile the kernel with asynchronous IO support"
 	default y if !SMALL_FLASH

feeds.conf.default

@@ -1,4 +1,4 @@
-src-git-full packages https://git.openwrt.org/feed/packages.git^426ccd2e0cf56394017d32b864cd66a570852706
-src-git-full luci https://git.openwrt.org/project/luci.git^487e58a0a61f8d2396893bd9fa6695269b1fd1d3
-src-git-full routing https://git.openwrt.org/feed/routing.git^8872359011eee64981804f7ed42d5d6b54add6d8
+src-git-full packages https://git.openwrt.org/feed/packages.git^dba8a0102e5965cad58a871335002e9c964b6719
+src-git-full luci https://git.openwrt.org/project/luci.git^96ec0cd3ccfe954f13fd5a337efdd70374dde03f
+src-git-full routing https://git.openwrt.org/feed/routing.git^85028704f688a6768d3f10d5d3c10a799a121e0d
 src-git-full telephony https://git.openwrt.org/feed/telephony.git^1d2031a5c82816483c51bca15649e2957fbe2bc2

include/image.mk

@@ -524,7 +524,7 @@ endif
 define Device/Build/compile
   $$(_COMPILE_TARGET): $(KDIR)/$(1)
   $(eval $(call Device/Export,$(KDIR)/$(1)))
-  $(KDIR)/$(1):
+  $(KDIR)/$(1): FORCE
 	$$(call concat_cmd,$(COMPILE/$(1)))
 
 endef

include/kernel-5.10

@@ -1,2 +1,2 @@
-LINUX_VERSION-5.10 = .138
-LINUX_KERNEL_HASH-5.10.138 = 29a003bb8e0e3a45942f703370fb0b3460e6fdcbbad37424423c9cf831ab5ba8
+LINUX_VERSION-5.10 = .146
+LINUX_KERNEL_HASH-5.10.146 = 7bbd97f3278eadb73c19a1ca8c1a655c60afcee9f487b910063cdd15e9ee6dc1

include/prereq-build.mk

@@ -202,7 +202,10 @@ $(STAGING_DIR_HOST)/bin/mkhash: $(SCRIPT_DIR)/mkhash.c
 	mkdir -p $(dir $@)
 	$(CC) -O2 -I$(TOPDIR)/tools/include -o $@ $<
 
-prereq: $(STAGING_DIR_HOST)/bin/mkhash
+$(STAGING_DIR_HOST)/bin/xxd: $(SCRIPT_DIR)/xxdi.pl
+	$(LN) $< $@
+
+prereq: $(STAGING_DIR_HOST)/bin/mkhash $(STAGING_DIR_HOST)/bin/xxd
 
 # Install ldconfig stub
 $(eval $(call TestHostCommand,ldconfig-stub,Failed to install stub, \

include/target.mk

@@ -68,7 +68,7 @@ endif
 
 target_conf=$(subst .,_,$(subst -,_,$(subst /,_,$(1))))
 ifeq ($(DUMP),)
-  PLATFORM_DIR:=$(TOPDIR)/target/linux/$(BOARD)
+  PLATFORM_DIR:=$(firstword $(wildcard $(TOPDIR)/target/linux/feeds/$(BOARD) $(TOPDIR)/target/linux/$(BOARD)))
   SUBTARGET:=$(strip $(foreach subdir,$(patsubst $(PLATFORM_DIR)/%/target.mk,%,$(wildcard $(PLATFORM_DIR)/*/target.mk)),$(if $(CONFIG_TARGET_$(call target_conf,$(BOARD)_$(subdir))),$(subdir))))
 else
   PLATFORM_DIR:=${CURDIR}

include/version.mk

@@ -23,13 +23,13 @@ PKG_CONFIG_DEPENDS += \
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))
 
 VERSION_NUMBER:=$(call qstrip,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),22.03.0)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),22.03.2)
 
 VERSION_CODE:=$(call qstrip,$(CONFIG_VERSION_CODE))
-VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r19685-512e76967f)
+VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r19803-9a599fee93)
 
 VERSION_REPO:=$(call qstrip,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/releases/22.03.0)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/releases/22.03.2)
 
 VERSION_DIST:=$(call qstrip,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),OpenWrt)

package/base-files/image-config.in

@@ -183,7 +183,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "https://downloads.openwrt.org/releases/22.03.0"
+		default "https://downloads.openwrt.org/releases/22.03.2"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:

package/boot/uboot-envtools/files/ramips

@@ -89,6 +89,6 @@ xiaomi,mi-router-cr6609)
 esac
 
 config_load ubootenv
-config_foreach ubootenv_add_app_config ubootenv
+config_foreach ubootenv_add_app_config
 
 exit 0

package/boot/uboot-mvebu/patches/0001-tools-termios_linux.h-Fix-compilation-on-non-glibc-s.patch

@@ -0,0 +1,44 @@
+From 82a6da13c3a113eefdb378ff53635f32a6184d6f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pali=20Roh=C3=A1r?= <pali@kernel.org>
+Date: Thu, 8 Sep 2022 16:59:36 +0200
+Subject: [PATCH] tools: termios_linux.h: Fix compilation on non-glibc systems
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+TCGETS2 is defined in header file asm/ioctls.h provided by linux kernel.
+On glib systems it is automatically included by some other glibc include
+header file and therefore TCGETS2 is present in termios_linux.h when
+linux kernel provides it.
+
+On non-glibc systems (e.g. musl) asm/ioctls.h is not automatically included
+which results in the strange error that BOTHER is supported, TCGETS2 not
+defined and struct termios does not provide c_ispeed member.
+
+    tools/kwboot.c: In function 'kwboot_tty_change_baudrate':
+    tools/kwboot.c:662:6: error: 'struct termios' has no member named 'c_ospeed'
+      662 |   tio.c_ospeed = tio.c_ispeed = baudrate;
+          |      ^
+
+Fix this issue by explicitly including asm/ioctls.h file which provides
+TCGETS2 macro (if supported on selected architecture) to not depending on
+glibc auto-include behavior and because termios_linux.h requires it.
+
+With this change it is possible compile kwboot with musl libc.
+
+Reported-by: Michal Vasilek <michal.vasilek@nic.cz>
+Signed-off-by: Pali Rohár <pali@kernel.org>
+---
+ tools/termios_linux.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/tools/termios_linux.h
++++ b/tools/termios_linux.h
+@@ -29,6 +29,7 @@
+ #include <errno.h>
+ #include <sys/ioctl.h>
+ #include <sys/types.h>
++#include <asm/ioctls.h>
+ #include <asm/termbits.h>
+ 
+ #if defined(BOTHER) && defined(TCGETS2)

package/boot/uboot-mvebu/patches/0002-tools-mkimage-fix-build-with-LibreSSL.patch

@@ -0,0 +1,28 @@
+From aed6107ae96870cd190b23d6da34a7e616799ed3 Mon Sep 17 00:00:00 2001
+From: Michal Vasilek <michal.vasilek@nic.cz>
+Date: Fri, 22 Jul 2022 19:55:53 +0200
+Subject: [PATCH 1/2] tools: mkimage: fix build with LibreSSL
+
+RSA_get0_* functions are not available in LibreSSL
+
+Signed-off-by: Michal Vasilek <michal.vasilek@nic.cz>
+Reviewed-by: Simon Glass <sjg@chromium.org>
+---
+ tools/sunxi_toc0.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/tools/sunxi_toc0.c
++++ b/tools/sunxi_toc0.c
+@@ -34,6 +34,12 @@
+ #define pr_warn(fmt, args...)	fprintf(stderr, pr_fmt(fmt), "warning", ##args)
+ #define pr_info(fmt, args...)	fprintf(stderr, pr_fmt(fmt), "info", ##args)
+ 
++#if defined(LIBRESSL_VERSION_NUMBER)
++#define RSA_get0_n(key) (key)->n
++#define RSA_get0_e(key) (key)->e
++#define RSA_get0_d(key) (key)->d
++#endif
++
+ struct __packed toc0_key_item {
+ 	__le32  vendor_id;
+ 	__le32  key0_n_len;

package/boot/uboot-mvebu/patches/0003-tools-mkimage-fix-build-with-recent-LibreSSL.patch

@@ -0,0 +1,27 @@
+From 16b94d211b18ae0204c4f850fdf23573b19170ec Mon Sep 17 00:00:00 2001
+From: Mark Kettenis <kettenis@openbsd.org>
+Date: Mon, 29 Aug 2022 13:34:01 +0200
+Subject: [PATCH 2/2] tools: mkimage: fix build with recent LibreSSL
+
+LibreSSL 3.5.0 and later (also shipped as part of OpenBSD 7.1 and
+and later) have an opaque RSA object and do provide the
+RSA_get0_* functions that OpenSSL provides.
+
+Fixes: 2ecc354b8e46 ("tools: mkimage: fix build with LibreSSL")
+Signed-off-by: Mark Kettenis <kettenis@openbsd.org>
+Reviewed-by: Jonathan Gray <jsg@jsg.id.au>
+---
+ tools/sunxi_toc0.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/sunxi_toc0.c
++++ b/tools/sunxi_toc0.c
+@@ -34,7 +34,7 @@
+ #define pr_warn(fmt, args...)	fprintf(stderr, pr_fmt(fmt), "warning", ##args)
+ #define pr_info(fmt, args...)	fprintf(stderr, pr_fmt(fmt), "info", ##args)
+ 
+-#if defined(LIBRESSL_VERSION_NUMBER)
++#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x3050000fL
+ #define RSA_get0_n(key) (key)->n
+ #define RSA_get0_e(key) (key)->e
+ #define RSA_get0_d(key) (key)->d

package/firmware/intel-microcode/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=intel-microcode
-PKG_VERSION:=20220510
+PKG_VERSION:=20220809
 PKG_RELEASE:=1
 
 PKG_SOURCE:=intel-microcode_3.$(PKG_VERSION).1.tar.xz
 PKG_SOURCE_URL:=@DEBIAN/pool/non-free/i/intel-microcode/
-PKG_HASH:=49752447c1b905dd130699cdef09fb2bba47b6f413d27787c98a5569273e283e
+PKG_HASH:=4cf6c3638bb52d9d45c1916af866fd0929628a6f459daac3edfd369149e9c665
 PKG_BUILD_DIR:=$(BUILD_DIR)/intel-microcode-3.$(PKG_VERSION).1
 
 PKG_BUILD_DEPENDS:=iucode-tool/host

package/firmware/wireless-regdb/Makefile

@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wireless-regdb
-PKG_VERSION:=2022.06.06
+PKG_VERSION:=2022.08.12
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/wireless-regdb/
-PKG_HASH:=ac00f97efecce5046ed069d1d93f3365fdf994c7c7854a8fc50831e959537230
+PKG_HASH:=59c8f7d17966db71b27f90e735ee8f5b42ca3527694a8c5e6e9b56bd379c3b84
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 

package/kernel/linux/Makefile

@@ -12,7 +12,9 @@ PKG_NAME:=kernel
 PKG_FLAGS:=hold
 
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/packages
-SCAN_DEPS=modules/*.mk $(TOPDIR)/target/linux/*/modules.mk $(TOPDIR)/include/netfilter.mk
+SUBTARGETS = $(sort $(filter-out feeds,$(notdir $(wildcard $(TOPDIR)/target/linux/* $(TOPDIR)/target/linux/feeds/*))))
+SUBTARGET_MODULES = $(foreach t,$(SUBTARGETS),$(firstword $(wildcard $(TOPDIR)/target/linux/feeds/$(t)/modules.mk $(TOPDIR)/target/linux/$(t)/modules.mk)))
+SCAN_DEPS=modules/*.mk $(SUBTARGET_MODULES) $(TOPDIR)/include/netfilter.mk
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=
@@ -63,4 +65,4 @@ endef
 $(eval $(if $(DUMP),,$(call BuildPackage,kernel)))
 
 include $(sort $(wildcard ./modules/*.mk))
--include $(TOPDIR)/target/linux/*/modules.mk
+-include $(SUBTARGET_MODULES)

package/kernel/linux/modules/crypto.mk

@@ -237,6 +237,18 @@ endef
 $(eval $(call KernelPackage,crypto-echainiv))
 
 
+define KernelPackage/crypto-essiv
+  TITLE:=ESSIV support for block encryption
+  DEPENDS:=+kmod-crypto-authenc
+  KCONFIG:=CONFIG_CRYPTO_ESSIV
+  FILES:= $(LINUX_DIR)/crypto/essiv.ko
+  AUTOLOAD:=$(call AutoLoad,10,essiv)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-essiv))
+
+
 define KernelPackage/crypto-fcrypt
   TITLE:=FCRYPT cipher CryptoAPI module
   KCONFIG:=CONFIG_CRYPTO_FCRYPT
@@ -619,7 +631,8 @@ define KernelPackage/crypto-md5
   DEPENDS:=+kmod-crypto-hash
   KCONFIG:= \
 	CONFIG_CRYPTO_MD5 \
-	CONFIG_CRYPTO_MD5_OCTEON
+	CONFIG_CRYPTO_MD5_OCTEON \
+	CONFIG_CRYPTO_MD5_PPC
   FILES:=$(LINUX_DIR)/crypto/md5.ko
   AUTOLOAD:=$(call AutoLoad,09,md5)
   $(call AddDepends/crypto)
@@ -630,6 +643,11 @@ define KernelPackage/crypto-md5/octeon
   AUTOLOAD+=$(call AutoLoad,09,octeon-md5)
 endef
 
+define KernelPackage/crypto-md5/mpc85xx
+  FILES+=$(LINUX_DIR)/arch/powerpc/crypto/md5-ppc.ko
+  AUTOLOAD+=$(call AutoLoad,09,md5-ppc)
+endef
+
 $(eval $(call KernelPackage,crypto-md5))
 
 
@@ -829,6 +847,7 @@ define KernelPackage/crypto-sha1
 	CONFIG_CRYPTO_SHA1_ARM \
 	CONFIG_CRYPTO_SHA1_ARM_NEON \
 	CONFIG_CRYPTO_SHA1_OCTEON \
+	CONFIG_CRYPTO_SHA1_PPC_SPE \
 	CONFIG_CRYPTO_SHA1_SSSE3
   FILES:=$(LINUX_DIR)/crypto/sha1_generic.ko
   AUTOLOAD:=$(call AutoLoad,09,sha1_generic)
@@ -857,6 +876,11 @@ endef
 
 KernelPackage/crypto-sha1/tegra=$(KernelPakcage/crypto-sha1/arm)
 
+define KernelPackage/crypto-sha1/mpc85xx
+  FILES+=$(LINUX_DIR)/arch/powerpc/crypto/sha1-ppc-spe.ko
+  AUTOLOAD+=$(call AutoLoad,09,sha1-ppc-spe)
+endef
+
 define KernelPackage/crypto-sha1/x86/64
   FILES+=$(LINUX_DIR)/arch/x86/crypto/sha1-ssse3.ko
   AUTOLOAD+=$(call AutoLoad,09,sha1-ssse3)
@@ -871,6 +895,7 @@ define KernelPackage/crypto-sha256
   KCONFIG:= \
 	CONFIG_CRYPTO_SHA256 \
 	CONFIG_CRYPTO_SHA256_OCTEON \
+	CONFIG_CRYPTO_SHA256_PPC_SPE \
 	CONFIG_CRYPTO_SHA256_SSSE3
   FILES:= \
 	$(LINUX_DIR)/crypto/sha256_generic.ko \
@@ -884,6 +909,11 @@ define KernelPackage/crypto-sha256/octeon
   AUTOLOAD+=$(call AutoLoad,09,octeon-sha256)
 endef
 
+define KernelPackage/crypto-sha256/mpc85xx
+  FILES+=$(LINUX_DIR)/arch/powerpc/crypto/sha256-ppc-spe.ko
+  AUTOLOAD+=$(call AutoLoad,09,sha256-ppc-spe)
+endef
+
 define KernelPackage/crypto-sha256/x86/64
   FILES+=$(LINUX_DIR)/arch/x86/crypto/sha256-ssse3.ko
   AUTOLOAD+=$(call AutoLoad,09,sha256-ssse3)

package/kernel/mac80211/patches/rt2x00/001-rt2x00-define-RF5592-in-init_eeprom-routine.patch

@@ -0,0 +1,52 @@
+From patchwork Sat Sep 17 20:26:27 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979242
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:26:27 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 01/16] rt2x00: define RF5592 in init_eeprom routine
+Message-ID: 
+ <d7eccb2c7b8ec4cd360fa2007796abffc35abb0d.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Fix incorrect RF value encoded in EEPROM on devices with Ralink Rt5592
+PCIe radio (a single chip 2T2R 802.11abgn solution).
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -9435,6 +9435,8 @@ static int rt2800_init_eeprom(struct rt2
+ 		rf = RF3853;
+ 	else if (rt2x00_rt(rt2x00dev, RT5350))
+ 		rf = RF5350;
++	else if (rt2x00_rt(rt2x00dev, RT5592))
++		rf = RF5592;
+ 	else
+ 		rf = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
+ 

package/kernel/mac80211/patches/rt2x00/002-rt2x00-add-throughput-LED-trigger.patch

@@ -0,0 +1,76 @@
+From patchwork Sat Sep 17 20:26:40 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979243
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:26:40 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 02/16] rt2x00: add throughput LED trigger
+Message-ID: 
+ <73f5ba4134e621462a26186449400cf0c1ac1730.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: David Bauer <mail@david-bauer.net>
+
+This adds a (currently missing) throughput LED trigger for the rt2x00
+driver. Previously, LED triggers had to be assigned to the netdev, which
+was limited to a single VAP.
+
+Tested-by: Christoph Krapp <achterin@googlemail.com>
+Signed-off-by: David Bauer <mail@david-bauer.net>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
+@@ -1093,6 +1093,19 @@ static void rt2x00lib_remove_hw(struct r
+ 	kfree(rt2x00dev->spec.channels_info);
+ }
+ 
++static const struct ieee80211_tpt_blink rt2x00_tpt_blink[] = {
++	{ .throughput = 0 * 1024, .blink_time = 334 },
++	{ .throughput = 1 * 1024, .blink_time = 260 },
++	{ .throughput = 2 * 1024, .blink_time = 220 },
++	{ .throughput = 5 * 1024, .blink_time = 190 },
++	{ .throughput = 10 * 1024, .blink_time = 170 },
++	{ .throughput = 25 * 1024, .blink_time = 150 },
++	{ .throughput = 54 * 1024, .blink_time = 130 },
++	{ .throughput = 120 * 1024, .blink_time = 110 },
++	{ .throughput = 265 * 1024, .blink_time = 80 },
++	{ .throughput = 586 * 1024, .blink_time = 50 },
++};
++
+ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
+ {
+ 	struct hw_mode_spec *spec = &rt2x00dev->spec;
+@@ -1174,6 +1187,11 @@ static int rt2x00lib_probe_hw(struct rt2
+ 
+ #undef RT2X00_TASKLET_INIT
+ 
++	ieee80211_create_tpt_led_trigger(rt2x00dev->hw,
++					 IEEE80211_TPT_LEDTRIG_FL_RADIO,
++					 rt2x00_tpt_blink,
++					 ARRAY_SIZE(rt2x00_tpt_blink));
++
+ 	/*
+ 	 * Register HW.
+ 	 */

package/kernel/mac80211/patches/rt2x00/002-rt2x00-define-RF5592-in-init_eeprom-routine.patch

@@ -1,51 +0,0 @@
-From patchwork Thu Dec 27 14:05:26 2018
-Content-Type: text/plain; charset="utf-8"
-MIME-Version: 1.0
-Content-Transfer-Encoding: 8bit
-X-Patchwork-Submitter: Tom Psyborg <pozega.tomislav@gmail.com>
-X-Patchwork-Id: 10743707
-X-Patchwork-Delegate: kvalo@adurom.com
-From: =?utf-8?q?Tomislav_Po=C5=BEega?= <pozega.tomislav@gmail.com>
-To: linux-wireless@vger.kernel.org
-Cc: kvalo@codeaurora.org, hauke@hauke-m.de, nbd@nbd.name,
-        john@phrozen.org, sgruszka@redhat.com, daniel@makrotopia.org
-Subject: [PATCH 2/2] rt2x00: define RF5592 in init_eeprom routine
-Date: Thu, 27 Dec 2018 15:05:26 +0100
-Message-Id: <1545919526-4074-2-git-send-email-pozega.tomislav@gmail.com>
-X-Mailer: git-send-email 1.7.0.4
-In-Reply-To: <1545919526-4074-1-git-send-email-pozega.tomislav@gmail.com>
-References: <1545919526-4074-1-git-send-email-pozega.tomislav@gmail.com>
-MIME-Version: 1.0
-Sender: linux-wireless-owner@vger.kernel.org
-Precedence: bulk
-List-ID: <linux-wireless.vger.kernel.org>
-X-Mailing-List: linux-wireless@vger.kernel.org
-X-Virus-Scanned: ClamAV using ClamSMTP
-
-This patch fixes following crash on Linksys EA2750 during 5GHz wifi
-init:
-
-[    7.955153] rt2800pci 0000:01:00.0: card - bus=0x1, slot = 0x0 irq=4
-[    7.962259] rt2800pci 0000:01:00.0: loaded eeprom from mtd device "Factory"
-[    7.969435] ieee80211 phy0: rt2x00_set_rt: Info - RT chipset 5592, rev 0222 detected
-[    7.977348] ieee80211 phy0: rt2800_init_eeprom: Error - Invalid RF chipset 0x0000 detected
-[    7.985793] ieee80211 phy0: rt2x00lib_probe_dev: Error - Failed to allocate device
-[    7.993569] CPU 0 Unable to handle kernel paging request at virtual address 00000024, epc == 800c8f54, ra == 80249ff8
-[    8.004408] Oops[#1]:
-
-Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
----
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c |    2 ++
- 1 files changed, 2 insertions(+), 0 deletions(-)
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9435,6 +9435,8 @@ static int rt2800_init_eeprom(struct rt2
- 		rf = RF3853;
- 	else if (rt2x00_rt(rt2x00dev, RT5350))
- 		rf = RF5350;
-+	else if (rt2x00_rt(rt2x00dev, RT5592))
-+		rf = RF5592;
- 	else
- 		rf = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RF_TYPE);
- 

package/kernel/mac80211/patches/rt2x00/003-rt2x00-add-support-for-external-PA-on-MT7620.patch

@@ -1,22 +1,42 @@
-From 9782a7f7488443568fa4d6088b73c9aff7eb8510 Mon Sep 17 00:00:00 2001
+From patchwork Sat Sep 17 20:26:55 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979244
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:26:55 +0100
 From: Daniel Golle <daniel@makrotopia.org>
-Date: Wed, 19 Apr 2017 16:14:53 +0200
-Subject: [PATCH] rt2x00: add support for external PA on MT7620
-To: Stanislaw Gruszka <sgruszka@redhat.com>
-Cc: Helmut Schaa <helmut.schaa@googlemail.com>,
-    linux-wireless@vger.kernel.org,
-    Kalle Valo <kvalo@codeaurora.org>
-Content-Type: text/plain; charset="UTF-8"
-Content-Transfer-Encoding: quoted-printable
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 03/16] rt2x00: add support for external PA on MT7620
+Message-ID: 
+ <af2c68ff831816a86fc39b0c10911c129a1f03dc.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
 
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
-Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
+Implement support for external PA connected to MT7620A.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
 [pozega.tomislav@gmail.com: use chanreg and dccal helpers.]
-
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
 ---
- drivers/net/wireless/ralink/rt2x00/rt2800.h    |  1 +
- drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 70 +++++++++++++++++++++++++-
- 2 files changed, 70 insertions(+), 1 deletion(-)
+ drivers/net/wireless/ralink/rt2x00/rt2800.h   |  1 +
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 52 ++++++++++++++++++-
+ 2 files changed, 52 insertions(+), 1 deletion(-)
 
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
@@ -24,21 +44,19 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
  #define EEPROM_NIC_CONF2_RX_STREAM	FIELD16(0x000f)
  #define EEPROM_NIC_CONF2_TX_STREAM	FIELD16(0x00f0)
  #define EEPROM_NIC_CONF2_CRYSTAL	FIELD16(0x0600)
-+#define EEPROM_NIC_CONF2_EXTERNAL_PA	FIELD16(0xc000)
++#define EEPROM_NIC_CONF2_EXTERNAL_PA	FIELD16(0x8000)
  
  /*
   * EEPROM LNA
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -4369,6 +4369,45 @@ static void rt2800_config_channel(struct
+@@ -4368,6 +4368,43 @@ static void rt2800_config_channel(struct
  		rt2800_iq_calibrate(rt2x00dev, rf->channel);
  	}
  
 +	if (rt2x00_rt(rt2x00dev, RT6352)) {
 +		if (test_bit(CAPABILITY_EXTERNAL_PA_TX0,
 +			     &rt2x00dev->cap_flags)) {
-+			rt2x00_warn(rt2x00dev, "Using incomplete support for " \
-+					       "external PA\n");
 +			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
 +			reg |= 0x00000101;
 +			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
@@ -76,7 +94,7 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
  	bbp = rt2800_bbp_read(rt2x00dev, 4);
  	rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
  	rt2800_bbp_write(rt2x00dev, 4, bbp);
-@@ -9578,7 +9617,8 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9566,7 +9603,8 @@ static int rt2800_init_eeprom(struct rt2
  	 */
  	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1);
  
@@ -86,19 +104,19 @@ Signed-off-by: Tomislav Po=C5=BEega <pozega.tomislav@gmail.com>
  		if (rt2x00_get_field16(eeprom,
  		    EEPROM_NIC_CONF1_EXTERNAL_TX0_PA_3352))
  		    __set_bit(CAPABILITY_EXTERNAL_PA_TX0,
-@@ -9589,6 +9629,18 @@ static int rt2800_init_eeprom(struct rt2
+@@ -9577,6 +9615,18 @@ static int rt2800_init_eeprom(struct rt2
  			      &rt2x00dev->cap_flags);
  	}
  
 +	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF2);
 +
 +	if (rt2x00_rt(rt2x00dev, RT6352) && eeprom != 0 && eeprom != 0xffff) {
-+		if (rt2x00_get_field16(eeprom,
-+		    EEPROM_NIC_CONF2_EXTERNAL_PA)) {
-+		    __set_bit(CAPABILITY_EXTERNAL_PA_TX0,
-+			      &rt2x00dev->cap_flags);
-+		    __set_bit(CAPABILITY_EXTERNAL_PA_TX1,
-+			      &rt2x00dev->cap_flags);
++		if (!rt2x00_get_field16(eeprom,
++					EEPROM_NIC_CONF2_EXTERNAL_PA)) {
++			__clear_bit(CAPABILITY_EXTERNAL_PA_TX0,
++				    &rt2x00dev->cap_flags);
++			__clear_bit(CAPABILITY_EXTERNAL_PA_TX1,
++				    &rt2x00dev->cap_flags);
 +		}
 +	}
 +

package/kernel/mac80211/patches/rt2x00/004-rt2x00-move-up-and-reuse-busy-wait-functions.patch

@@ -0,0 +1,178 @@
+From patchwork Sat Sep 17 20:27:10 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979245
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:27:10 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 04/16] rt2x00: move up and reuse busy wait functions
+Message-ID: 
+ <3fdb9dc15e76a9f9c1948b4a3a1308a7a5677bb8.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Move bbp_ready and rf_ready busy wait functions up in the code so they
+can more easily be used. Allow specifying register mask in rf_ready
+function which is useful for calibration routines which will be added
+in follow-up commits.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 99 +++++++++----------
+ 1 file changed, 46 insertions(+), 53 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -2143,6 +2143,48 @@ void rt2800_config_erp(struct rt2x00_dev
+ }
+ EXPORT_SYMBOL_GPL(rt2800_config_erp);
+ 
++static int rt2800_wait_bbp_rf_ready(struct rt2x00_dev *rt2x00dev,
++				    const struct rt2x00_field32 mask)
++{
++	unsigned int i;
++	u32 reg;
++
++	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
++		reg = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
++		if (!rt2x00_get_field32(reg, mask))
++			return 0;
++
++		udelay(REGISTER_BUSY_DELAY);
++	}
++
++	rt2x00_err(rt2x00dev, "BBP/RF register access failed, aborting\n");
++	return -EACCES;
++}
++
++static int rt2800_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
++{
++	unsigned int i;
++	u8 value;
++
++	/*
++	 * BBP was enabled after firmware was loaded,
++	 * but we need to reactivate it now.
++	 */
++	rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
++	rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
++	msleep(1);
++
++	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
++		value = rt2800_bbp_read(rt2x00dev, 0);
++		if ((value != 0xff) && (value != 0x00))
++			return 0;
++		udelay(REGISTER_BUSY_DELAY);
++	}
++
++	rt2x00_err(rt2x00dev, "BBP register access failed, aborting\n");
++	return -EACCES;
++}
++
+ static void rt2800_config_3572bt_ant(struct rt2x00_dev *rt2x00dev)
+ {
+ 	u32 reg;
+@@ -3799,10 +3841,9 @@ static void rt2800_config_alc(struct rt2
+ 			      struct ieee80211_channel *chan,
+ 			      int power_level) {
+ 	u16 eeprom, target_power, max_power;
+-	u32 mac_sys_ctrl, mac_status;
++	u32 mac_sys_ctrl;
+ 	u32 reg;
+ 	u8 bbp;
+-	int i;
+ 
+ 	/* hardware unit is 0.5dBm, limited to 23.5dBm */
+ 	power_level *= 2;
+@@ -3838,16 +3879,8 @@ static void rt2800_config_alc(struct rt2
+ 	/* Disable Tx/Rx */
+ 	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0);
+ 	/* Check MAC Tx/Rx idle */
+-	for (i = 0; i < 10000; i++) {
+-		mac_status = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
+-		if (mac_status & 0x3)
+-			usleep_range(50, 200);
+-		else
+-			break;
+-	}
+-
+-	if (i == 10000)
+-		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
++		rt2x00_warn(rt2x00dev, "RF busy while configuring ALC\n");
+ 
+ 	if (chan->center_freq > 2457) {
+ 		bbp = rt2800_bbp_read(rt2x00dev, 30);
+@@ -6249,46 +6282,6 @@ static int rt2800_init_registers(struct
+ 	return 0;
+ }
+ 
+-static int rt2800_wait_bbp_rf_ready(struct rt2x00_dev *rt2x00dev)
+-{
+-	unsigned int i;
+-	u32 reg;
+-
+-	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+-		reg = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
+-		if (!rt2x00_get_field32(reg, MAC_STATUS_CFG_BBP_RF_BUSY))
+-			return 0;
+-
+-		udelay(REGISTER_BUSY_DELAY);
+-	}
+-
+-	rt2x00_err(rt2x00dev, "BBP/RF register access failed, aborting\n");
+-	return -EACCES;
+-}
+-
+-static int rt2800_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
+-{
+-	unsigned int i;
+-	u8 value;
+-
+-	/*
+-	 * BBP was enabled after firmware was loaded,
+-	 * but we need to reactivate it now.
+-	 */
+-	rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+-	rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+-	msleep(1);
+-
+-	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
+-		value = rt2800_bbp_read(rt2x00dev, 0);
+-		if ((value != 0xff) && (value != 0x00))
+-			return 0;
+-		udelay(REGISTER_BUSY_DELAY);
+-	}
+-
+-	rt2x00_err(rt2x00dev, "BBP register access failed, aborting\n");
+-	return -EACCES;
+-}
+ 
+ static void rt2800_bbp4_mac_if_ctrl(struct rt2x00_dev *rt2x00dev)
+ {
+@@ -9110,7 +9103,7 @@ int rt2800_enable_radio(struct rt2x00_de
+ 	/*
+ 	 * Wait BBP/RF to wake up.
+ 	 */
+-	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev)))
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
+ 		return -EIO;
+ 
+ 	/*

package/kernel/mac80211/patches/rt2x00/005-rt2x00-add-RF-self-TXDC-calibration-for-MT7620.patch

@@ -1,6 +1,48 @@
+From patchwork Sat Sep 17 20:27:26 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979246
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:27:26 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 05/16] rt2x00: add RF self TXDC calibration for MT7620
+Message-ID: 
+ <dbb6e5a0c12d6101477bd09e83253091d21512c9.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Add TX self calibration based on mtk driver.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+v2: use ++i instead of i = i + 1 in loops
+
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 48 +++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8438,6 +8438,56 @@ static void rt2800_init_rfcsr_5592(struc
+@@ -8428,6 +8428,53 @@ static void rt2800_init_rfcsr_5592(struc
  	rt2800_led_open_drain_enable(rt2x00dev);
  }
  
@@ -10,7 +52,6 @@
 +	u32 mac0518, mac051c, mac0528, mac052c;
 +	u8 i;
 +
-+	rt2x00_info(rt2x00dev, "RF Tx self calibration start\n");
 +	mac0518 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
 +	mac051c = rt2800_register_read(rt2x00dev, RF_BYPASS0);
 +	mac0528 = rt2800_register_read(rt2x00dev, RF_CONTROL2);
@@ -27,19 +68,19 @@
 +	rfb7r1_org = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
 +
 +	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, 0x4);
-+	for (i = 0; i < 100; i = i + 1) {
-+		udelay(50);
++	for (i = 0; i < 100; ++i) {
++		usleep_range(50, 100);
 +		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 5, 1);
-+		if((rfvalue & 0x04) != 0x4)
++		if ((rfvalue & 0x04) != 0x4)
 +			break;
 +	}
 +	rt2800_rfcsr_write_bank(rt2x00dev, 5, 1, rfb5r1_org);
 +
 +	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, 0x4);
-+	for (i = 0; i < 100; i = i + 1) {
-+		udelay(50);
++	for (i = 0; i < 100; ++i) {
++		usleep_range(50, 100);
 +		rfvalue = rt2800_rfcsr_read_bank(rt2x00dev, 7, 1);
-+		if((rfvalue & 0x04) != 0x4)
++		if ((rfvalue & 0x04) != 0x4)
 +			break;
 +	}
 +	rt2800_rfcsr_write_bank(rt2x00dev, 7, 1, rfb7r1_org);
@@ -50,14 +91,12 @@
 +	rt2800_register_write(rt2x00dev, RF_BYPASS0, mac051c);
 +	rt2800_register_write(rt2x00dev, RF_CONTROL2, mac0528);
 +	rt2800_register_write(rt2x00dev, RF_BYPASS2, mac052c);
-+
-+	rt2x00_info(rt2x00dev, "RF Tx self calibration end\n");
 +}
 +
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9045,6 +9095,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9035,6 +9082,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
  

package/kernel/mac80211/patches/rt2x00/006-rt2x00-add-r-calibration-for-MT7620.patch

@@ -1,14 +1,68 @@
+From patchwork Sat Sep 17 20:27:41 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979247
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:27:41 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 06/16] rt2x00: add r calibration for MT7620
+Message-ID: 
+ <e0c34f233089bec4eb73826bc4f512166ee25934.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Add r calibration code as found in mtk driver.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+v2: use rt2800_wait_bbp_rf_ready()
+
+ drivers/net/wireless/ralink/rt2x00/rt2800.h   |   2 +
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 133 ++++++++++++++++++
+ 2 files changed, 135 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+@@ -1016,6 +1016,8 @@
+  */
+ #define MAC_STATUS_CFG			0x1200
+ #define MAC_STATUS_CFG_BBP_RF_BUSY	FIELD32(0x00000003)
++#define MAC_STATUS_CFG_BBP_RF_BUSY_TX	FIELD32(0x00000001)
++#define MAC_STATUS_CFG_BBP_RF_BUSY_RX	FIELD32(0x00000002)
+ 
+ /*
+  * PWR_PIN_CFG:
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8488,6 +8488,155 @@ static void rt2800_rf_self_txdc_cal(stru
- 	rt2x00_info(rt2x00dev, "RF Tx self calibration end\n");
+@@ -8475,6 +8475,138 @@ static void rt2800_rf_self_txdc_cal(stru
+ 	rt2800_register_write(rt2x00dev, RF_BYPASS2, mac052c);
  }
  
 +static int rt2800_calcrcalibrationcode(struct rt2x00_dev *rt2x00dev, int d1, int d2)
 +{
-+	int calcode;
-+	calcode = ((d2 - d1) * 1000) / 43;
-+	if ((calcode%10) >= 5)
++	int calcode = ((d2 - d1) * 1000) / 43;
++
++	if ((calcode % 10) >= 5)
 +		calcode += 10;
 +	calcode = (calcode / 10);
 +
@@ -28,8 +82,7 @@
 +	char d1 = 0, d2 = 0;
 +	u8 rfvalue;
 +	u32 MAC_RF_BYPASS0, MAC_RF_CONTROL0, MAC_PWR_PIN_CFG;
-+	u32 maccfg, macstatus;
-+	int i;
++	u32 maccfg;
 +
 +	saverfb0r1 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 1);
 +	saverfb0r34 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 34);
@@ -53,30 +106,14 @@
 +	maccfg &= (~0x04);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
 +
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x1)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	if (i == 10000)
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_TX)))
 +		rt2x00_warn(rt2x00dev, "Wait MAC Tx Status to MAX !!!\n");
 +
 +	maccfg = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	maccfg &= (~0x04);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, maccfg);
 +
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x2)
-+			udelay(50);
-+		else
-+			break;
-+		}
-+
-+	if (i == 10000)
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_RX)))
 +		rt2x00_warn(rt2x00dev, "Wait MAC Rx Status to MAX !!!\n");
 +
 +	rfvalue = (MAC_RF_BYPASS0 | 0x3004);
@@ -98,7 +135,7 @@
 +
 +	rt2800_bbp_write(rt2x00dev, 47, 0x04);
 +	rt2800_bbp_write(rt2x00dev, 22, 0x80);
-+	udelay(100);
++	usleep_range(100, 200);
 +	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
 +	if (bytevalue > 128)
 +		d1 = bytevalue - 256;
@@ -108,7 +145,7 @@
 +	rt2800_rfcsr_write_bank(rt2x00dev, 0, 35, 0x01);
 +
 +	rt2800_bbp_write(rt2x00dev, 22, 0x80);
-+	udelay(100);
++	usleep_range(100, 200);
 +	bytevalue = rt2800_bbp_read(rt2x00dev, 49);
 +	if (bytevalue > 128)
 +		d2 = bytevalue - 256;
@@ -156,7 +193,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9095,6 +9244,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9082,6 +9214,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
  

package/kernel/mac80211/patches/rt2x00/007-rt2x00-add-RXDCOC-calibration-for-MT7620.patch

@@ -1,13 +1,54 @@
+From patchwork Sat Sep 17 20:27:56 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979248
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:27:56 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 07/16] rt2x00: add RXDCOC calibration for MT7620
+Message-ID: 
+ <850b30f652e88de30d79e968af4eb47aa5bc2511.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Add RXDCOC calibration code from mtk driver.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+[fixed typo reported by Serge Vasilugin <vasilugin@yandex.ru>]
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 60 +++++++++++++++++++
+ 1 file changed, 60 insertions(+)
+
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8637,6 +8637,70 @@ static void rt2800_r_calibration(struct
+@@ -8607,6 +8607,65 @@ static void rt2800_r_calibration(struct
  	rt2800_register_write(rt2x00dev, PWR_PIN_CFG, MAC_PWR_PIN_CFG);
  }
  
 +static void rt2800_rxdcoc_calibration(struct rt2x00_dev *rt2x00dev)
 +{
 +	u8 bbpreg = 0;
-+	u32 macvalue = 0, macvalue1 = 0;
++	u32 macvalue = 0;
 +	u8 saverfb0r2, saverfb5r4, saverfb7r4, rfvalue;
 +	int i;
 +
@@ -24,15 +65,10 @@
 +	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x8);
 +
-+	for (i = 0; i < 10000; i++) {
-+		macvalue1 = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue1 & 0x1)
-+			udelay(50);
-+		else
-+			break;
-+	}
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_TX)))
++		rt2x00_warn(rt2x00dev, "RF TX busy in RX RXDCOC calibration\n");
 +
-+	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 0);
++	saverfb5r4 = rt2800_rfcsr_read_bank(rt2x00dev, 5, 4);
 +	saverfb7r4 = rt2800_rfcsr_read_bank(rt2x00dev, 7, 4);
 +	saverfb5r4 = saverfb5r4 & (~0x40);
 +	saverfb7r4 = saverfb7r4 & (~0x40);
@@ -49,9 +85,9 @@
 +
 +	for (i = 0; i < 10000; i++) {
 +		bbpreg = rt2800_bbp_read(rt2x00dev, 159);
-+		if ((bbpreg & 0x40)==0)
++		if ((bbpreg & 0x40) == 0)
 +			break;
-+		udelay(50);
++		usleep_range(50, 100);
 +	}
 +
 +	bbpreg = rt2800_bbp_read(rt2x00dev, 159);
@@ -71,7 +107,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9246,6 +9310,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9216,6 +9275,7 @@ static void rt2800_init_rfcsr_6352(struc
  
  	rt2800_r_calibration(rt2x00dev);
  	rt2800_rf_self_txdc_cal(rt2x00dev);

package/kernel/mac80211/patches/rt2x00/008-rt2x00-add-RXIQ-calibration-for-MT7620.patch

@@ -1,17 +1,62 @@
+From patchwork Sat Sep 17 20:28:10 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979249
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:28:10 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 08/16] rt2x00: add RXIQ calibration for MT7620
+Message-ID: 
+ <033a39a697d51f6df258acea4c33608e0944fe4c.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Add RXIQ calibration found in mtk driver. With old openwrt builds this
+gets us ~8Mbps more of RX bandwidth (test with iPA/eLNA layout).
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+v2: use rt2800_wait_bbp_rf_ready(), fix indentation
+
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 375 ++++++++++++++++++
+ 1 file changed, 375 insertions(+)
+
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -8701,6 +8701,384 @@ static void rt2800_rxdcoc_calibration(st
+@@ -8666,6 +8666,380 @@ static void rt2800_rxdcoc_calibration(st
  	rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, saverfb0r2);
  }
  
-+static u32 rt2800_do_sqrt_accumulation(u32 si) {
++static u32 rt2800_do_sqrt_accumulation(u32 si)
++{
 +	u32 root, root_pre, bit;
 +	char i;
++
 +	bit = 1 << 15;
 +	root = 0;
 +	for (i = 15; i >= 0; i = i - 1) {
 +		root_pre = root + bit;
-+		if ((root_pre*root_pre) <= si)
++		if ((root_pre * root_pre) <= si)
 +			root = root_pre;
 +		bit = bit >> 1;
 +	}
@@ -19,7 +64,8 @@
 +	return root;
 +}
 +
-+static void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev) {
++static void rt2800_rxiq_calibration(struct rt2x00_dev *rt2x00dev)
++{
 +	u8 rfb0r1, rfb0r2, rfb0r42;
 +	u8 rfb4r0, rfb4r19;
 +	u8 rfb5r3, rfb5r4, rfb5r17, rfb5r18, rfb5r19, rfb5r20;
@@ -43,8 +89,8 @@
 +	u32 orig_RF_BYPASS1 = 0;
 +	u32 orig_RF_CONTROL3 = 0;
 +	u32 orig_RF_BYPASS3 = 0;
-+	u32 macstatus, bbpval1 = 0;
-+	u8 rf_vga_table[] = {0x20, 0x21, 0x22, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f};
++	u32 bbpval1 = 0;
++	static const u8 rf_vga_table[] = {0x20, 0x21, 0x22, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f};
 +
 +	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	orig_RF_CONTROL0 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
@@ -59,16 +105,8 @@
 +
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x0);
 +
-+	for (i = 0; i < 10000; i++) {
-+		macstatus = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macstatus & 0x3)
-+			udelay(50);
-+		else
-+			break;
-+	}
-+
-+	if (i == 10000)
-+		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
++		rt2x00_warn(rt2x00dev, "Timeout waiting for MAC status in RXIQ calibration\n");
 +
 +	bbpval = bbp4 & (~0x18);
 +	bbpval = bbp4 | 0x00;
@@ -165,7 +203,7 @@
 +			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
 +			udelay(1);
 +
-+			bbpval = bbp1 & (~ 0x18);
++			bbpval = bbp1 & (~0x18);
 +			bbpval = bbpval | 0x00;
 +			rt2800_bbp_write(rt2x00dev, 1, bbpval);
 +
@@ -184,132 +222,133 @@
 +			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002006);
 +			udelay(1);
 +
-+			bbpval = bbp1 & (~ 0x18);
++			bbpval = bbp1 & (~0x18);
 +			bbpval = bbpval | 0x08;
 +			rt2800_bbp_write(rt2x00dev, 1, bbpval);
 +
 +			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x01);
 +		}
-+		udelay(500);
++		usleep_range(500, 1500);
 +
 +		vga_idx = 0;
-+			while (vga_idx < 11) {
-+				rt2800_rfcsr_write_dccal(rt2x00dev, 3, rf_vga_table[vga_idx]);
-+				rt2800_rfcsr_write_dccal(rt2x00dev, 4, rf_vga_table[vga_idx]);
++		while (vga_idx < 11) {
++			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rf_vga_table[vga_idx]);
++			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rf_vga_table[vga_idx]);
 +
-+				rt2800_bbp_dcoc_write(rt2x00dev, 0, 0x93);
++			rt2800_bbp_dcoc_write(rt2x00dev, 0, 0x93);
 +
-+				for (i = 0; i < 10000; i++) {
-+					bbpval = rt2800_bbp_read(rt2x00dev, 159);
-+					if ((bbpval & 0xff) == 0x93)
-+						udelay(50);
-+					else
-+						break;
-+					}
-+
-+				if ((bbpval & 0xff) == 0x93) {
-+					rt2x00_warn(rt2x00dev, "Fatal Error: Calibration doesn't finish");
-+					goto restore_value;
-+				}
-+
-+				for (i = 0; i < 5; i++) {
-+					u32 bbptemp = 0;
-+					u8 value = 0;
-+					int result = 0;
-+
-+					rt2800_bbp_write(rt2x00dev, 158, 0x1e);
-+					rt2800_bbp_write(rt2x00dev, 159, i);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x22);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 24);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x21);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 16);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x20);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + (value << 8);
-+					rt2800_bbp_write(rt2x00dev, 158, 0x1f);
-+					value = rt2800_bbp_read(rt2x00dev, 159);
-+					bbptemp = bbptemp + value;
-+
-+					if ((i < 2) && (bbptemp & 0x800000))
-+						result = (bbptemp & 0xffffff) - 0x1000000;
-+					else if (i == 4)
-+						result = bbptemp;
-+					else
-+						result = bbptemp;
-+
-+					if (i == 0)
-+						mi = result/4096;
-+					else if (i == 1)
-+						mq = result/4096;
-+					else if (i == 2)
-+						si = bbptemp/4096;
-+					else if (i == 3)
-+						sq = bbptemp/4096;
-+					else
-+						riq = result/4096;
-+				}
-+
-+				bbpval1 = si - mi*mi;
-+				rt2x00_dbg(rt2x00dev, "RXIQ si=%d, sq=%d, riq=%d, bbpval %d, vga_idx %d", si, sq, riq, bbpval1, vga_idx);
-+
-+				if (bbpval1 >= (100*100))
-+					break;
-+
-+				if (bbpval1 <= 100)
-+					vga_idx = vga_idx + 9;
-+				else if (bbpval1 <= 158)
-+					vga_idx = vga_idx + 8;
-+				else if (bbpval1 <= 251)
-+					vga_idx = vga_idx + 7;
-+				else if (bbpval1 <= 398)
-+					vga_idx = vga_idx + 6;
-+				else if (bbpval1 <= 630)
-+					vga_idx = vga_idx + 5;
-+				else if (bbpval1 <= 1000)
-+					vga_idx = vga_idx + 4;
-+				else if (bbpval1 <= 1584)
-+					vga_idx = vga_idx + 3;
-+				else if (bbpval1 <= 2511)
-+					vga_idx = vga_idx + 2;
++			for (i = 0; i < 10000; i++) {
++				bbpval = rt2800_bbp_read(rt2x00dev, 159);
++				if ((bbpval & 0xff) == 0x93)
++					usleep_range(50, 100);
 +				else
-+					vga_idx = vga_idx + 1;
++					break;
++				}
++
++			if ((bbpval & 0xff) == 0x93) {
++				rt2x00_warn(rt2x00dev, "Fatal Error: Calibration doesn't finish");
++				goto restore_value;
++			}
++			for (i = 0; i < 5; i++) {
++				u32 bbptemp = 0;
++				u8 value = 0;
++				int result = 0;
++
++				rt2800_bbp_write(rt2x00dev, 158, 0x1e);
++				rt2800_bbp_write(rt2x00dev, 159, i);
++				rt2800_bbp_write(rt2x00dev, 158, 0x22);
++				value = rt2800_bbp_read(rt2x00dev, 159);
++				bbptemp = bbptemp + (value << 24);
++				rt2800_bbp_write(rt2x00dev, 158, 0x21);
++				value = rt2800_bbp_read(rt2x00dev, 159);
++				bbptemp = bbptemp + (value << 16);
++				rt2800_bbp_write(rt2x00dev, 158, 0x20);
++				value = rt2800_bbp_read(rt2x00dev, 159);
++				bbptemp = bbptemp + (value << 8);
++				rt2800_bbp_write(rt2x00dev, 158, 0x1f);
++				value = rt2800_bbp_read(rt2x00dev, 159);
++				bbptemp = bbptemp + value;
++
++				if (i < 2 && (bbptemp & 0x800000))
++					result = (bbptemp & 0xffffff) - 0x1000000;
++				else if (i == 4)
++					result = bbptemp;
++				else
++					result = bbptemp;
++
++				if (i == 0)
++					mi = result / 4096;
++				else if (i == 1)
++					mq = result / 4096;
++				else if (i == 2)
++					si = bbptemp / 4096;
++				else if (i == 3)
++					sq = bbptemp / 4096;
++				else
++					riq = result / 4096;
 +			}
 +
-+		sigma_i = rt2800_do_sqrt_accumulation(100*(si - mi*mi));
-+		sigma_q = rt2800_do_sqrt_accumulation(100*(sq - mq*mq));
-+		r_iq = 10*(riq-(mi*mq));
++			bbpval1 = si - mi * mi;
++			rt2x00_dbg(rt2x00dev,
++				   "RXIQ si=%d, sq=%d, riq=%d, bbpval %d, vga_idx %d",
++				   si, sq, riq, bbpval1, vga_idx);
++
++			if (bbpval1 >= (100 * 100))
++				break;
++
++			if (bbpval1 <= 100)
++				vga_idx = vga_idx + 9;
++			else if (bbpval1 <= 158)
++				vga_idx = vga_idx + 8;
++			else if (bbpval1 <= 251)
++				vga_idx = vga_idx + 7;
++			else if (bbpval1 <= 398)
++				vga_idx = vga_idx + 6;
++			else if (bbpval1 <= 630)
++				vga_idx = vga_idx + 5;
++			else if (bbpval1 <= 1000)
++				vga_idx = vga_idx + 4;
++			else if (bbpval1 <= 1584)
++				vga_idx = vga_idx + 3;
++			else if (bbpval1 <= 2511)
++				vga_idx = vga_idx + 2;
++			else
++				vga_idx = vga_idx + 1;
++		}
++
++		sigma_i = rt2800_do_sqrt_accumulation(100 * (si - mi * mi));
++		sigma_q = rt2800_do_sqrt_accumulation(100 * (sq - mq * mq));
++		r_iq = 10 * (riq - (mi * mq));
 +
 +		rt2x00_dbg(rt2x00dev, "Sigma_i=%d, Sigma_q=%d, R_iq=%d", sigma_i, sigma_q, r_iq);
 +
-+		if (((sigma_i <= 1400 ) && (sigma_i >= 1000))
-+			&& ((sigma_i - sigma_q) <= 112)
-+			&& ((sigma_i - sigma_q) >= -112)
-+			&& ((mi <= 32) && (mi >= -32))
-+			&& ((mq <= 32) && (mq >= -32))) {
-+				r_iq = 10*(riq-(mi*mq));
-+				rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
++		if (sigma_i <= 1400 && sigma_i >= 1000 &&
++		    (sigma_i - sigma_q) <= 112 &&
++		    (sigma_i - sigma_q) >= -112 &&
++		    mi <= 32 && mi >= -32 &&
++		    mq <= 32 && mq >= -32) {
++			r_iq = 10 * (riq - (mi * mq));
++			rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n",
++				   sigma_i, sigma_q, r_iq);
 +
-+				g_rx = (1000 * sigma_q) / sigma_i;
-+				g_imb = ((-2) * 128 * (1000 - g_rx)) / (1000 + g_rx);
-+				ph_rx = (r_iq * 2292) / (sigma_i * sigma_q);
-+				rt2x00_info(rt2x00dev, "RXIQ G_imb=%d, Ph_rx=%d\n", g_imb, ph_rx);
++			g_rx = (1000 * sigma_q) / sigma_i;
++			g_imb = ((-2) * 128 * (1000 - g_rx)) / (1000 + g_rx);
++			ph_rx = (r_iq * 2292) / (sigma_i * sigma_q);
 +
-+				if ((ph_rx > 20) || (ph_rx < -20)) {
-+					ph_rx = 0;
-+					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
-+				}
-+
-+				if ((g_imb > 12) || (g_imb < -12)) {
-+					g_imb = 0;
-+					rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
-+				}
++			if (ph_rx > 20 || ph_rx < -20) {
++				ph_rx = 0;
++				rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
 +			}
-+		else {
++
++			if (g_imb > 12 || g_imb < -12) {
++				g_imb = 0;
++				rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
++			}
++		} else {
 +			g_imb = 0;
 +			ph_rx = 0;
-+			rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n", sigma_i, sigma_q, r_iq);
++			rt2x00_dbg(rt2x00dev, "RXIQ Sigma_i=%d, Sigma_q=%d, R_iq=%d\n",
++				   sigma_i, sigma_q, r_iq);
 +			rt2x00_warn(rt2x00dev, "RXIQ calibration FAIL");
 +		}
 +
@@ -385,7 +424,7 @@
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9313,6 +9691,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9278,6 +9652,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rxdcoc_calibration(rt2x00dev);
  	rt2800_bw_filter_calibration(rt2x00dev, true);
  	rt2800_bw_filter_calibration(rt2x00dev, false);

package/kernel/mac80211/patches/rt2x00/009-rt2x00-don-t-run-Rt5592-IQ-calibration-on-MT7620.patch

@@ -0,0 +1,52 @@
+From patchwork Sat Sep 17 20:28:29 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979250
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:28:29 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 09/16] rt2x00: don't run Rt5592 IQ calibration on MT7620
+Message-ID: 
+ <31a1c34ddbd296b82f38c18c9ae7339059215fdc.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+The function rt2800_iq_calibrate is intended for Rt5592 only.
+Don't call it for MT7620 which has it's own calibration functions.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+v2: test for RT5592 instead of !RT6352
+
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -4398,7 +4398,8 @@ static void rt2800_config_channel(struct
+ 		reg = (rf->channel <= 14 ? 0x1c : 0x24) + 2*rt2x00dev->lna_gain;
+ 		rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+ 
+-		rt2800_iq_calibrate(rt2x00dev, rf->channel);
++		if (rt2x00_rt(rt2x00dev, RT5592))
++			rt2800_iq_calibrate(rt2x00dev, rf->channel);
+ 	}
+ 
+ 	if (rt2x00_rt(rt2x00dev, RT6352)) {

package/kernel/mac80211/patches/rt2x00/010-rt2x00-add-TX-LOFT-calibration-for-MT7620.patch

@@ -1,10 +1,56 @@
+From patchwork Sat Sep 17 20:28:43 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 8bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979251
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:28:43 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 10/16] rt2x00: add TX LOFT calibration for MT7620
+Message-ID: 
+ <d9295a9138a1f552b648aacb84e1419d38f5c896.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+From: Tomislav Požega <pozega.tomislav@gmail.com>
+
+Add TX LOFT calibration from mtk driver.
+
+Signed-off-by: Tomislav Požega <pozega.tomislav@gmail.com>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+v2: use helper functions, make tables static const, remove useless
+    debug prints
+v3: don't export function not used anywhere else
+Reported-by: kernel test robot <lkp@intel.com>
+
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 902 ++++++++++++++++++
+ .../net/wireless/ralink/rt2x00/rt2800lib.h    |  10 +
+ 2 files changed, 912 insertions(+)
+
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -9079,6 +9079,943 @@ restore_value:
+@@ -9041,6 +9041,907 @@ restore_value:
  	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
  }
  
-+static void rt2800_rf_configstore(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_reg_record[][13], u8 chain)
++static void rt2800_rf_configstore(struct rt2x00_dev *rt2x00dev,
++				  struct rf_reg_pair rf_reg_record[][13], u8 chain)
 +{
 +	u8 rfvalue = 0;
 +
@@ -116,13 +162,11 @@
 +		rf_reg_record[CHAIN_1][12].value = rfvalue;
 +	} else {
 +		rt2x00_warn(rt2x00dev, "Unknown chain = %u\n", chain);
-+		return;
 +	}
-+
-+	return;
 +}
 +
-+static void rt2800_rf_configrecover(struct rt2x00_dev *rt2x00dev, rf_reg_pair rf_record[][13])
++static void rt2800_rf_configrecover(struct rt2x00_dev *rt2x00dev,
++				    struct rf_reg_pair rf_record[][13])
 +{
 +	u8 chain_index = 0, record_index = 0;
 +	u8 bank = 0, rf_register = 0, value = 0;
@@ -133,11 +177,10 @@
 +			rf_register = rf_record[chain_index][record_index].reg;
 +			value = rf_record[chain_index][record_index].value;
 +			rt2800_rfcsr_write_bank(rt2x00dev, bank, rf_register, value);
-+			rt2x00_dbg(rt2x00dev, "bank: %d, rf_register: %d, value: %x\n", bank, rf_register, value);
++			rt2x00_dbg(rt2x00dev, "bank: %d, rf_register: %d, value: %x\n",
++				   bank, rf_register, value);
 +		}
 +	}
-+
-+	return;
 +}
 +
 +static void rt2800_setbbptonegenerator(struct rt2x00_dev *rt2x00dev)
@@ -155,15 +198,13 @@
 +	rt2800_bbp_write(rt2x00dev, 159, 0x3F);
 +
 +	rt2800_bbp_write(rt2x00dev, 244, 0x40);
-+
-+	return;
 +}
 +
 +static u32 rt2800_do_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx, u8 read_neg)
 +{
 +	u32 macvalue = 0;
 +	int fftout_i = 0, fftout_q = 0;
-+	u32 ptmp=0, pint = 0;
++	u32 ptmp = 0, pint = 0;
 +	u8 bbp = 0;
 +	u8 tidxi;
 +
@@ -173,7 +214,7 @@
 +	bbp = 0x9b;
 +
 +	while (bbp == 0x9b) {
-+		udelay(10);
++		usleep_range(10, 50);
 +		bbp = rt2800_bbp_read(rt2x00dev, 159);
 +		bbp = bbp & 0xff;
 +	}
@@ -218,10 +259,11 @@
 +	return pint;
 +}
 +
-+static u32 rt2800_read_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx) {
++static u32 rt2800_read_fft_accumulation(struct rt2x00_dev *rt2x00dev, u8 tidx)
++{
 +	u32 macvalue = 0;
 +	int fftout_i = 0, fftout_q = 0;
-+	u32 ptmp=0, pint = 0;
++	u32 ptmp = 0, pint = 0;
 +
 +	rt2800_bbp_write(rt2x00dev, 158, 0xBA);
 +	rt2800_bbp_write(rt2x00dev, 159, tidx);
@@ -237,7 +279,6 @@
 +	ptmp = (fftout_i * fftout_i);
 +	ptmp = ptmp + (fftout_q * fftout_q);
 +	pint = ptmp;
-+	rt2x00_info(rt2x00dev, "I = %d,  Q = %d, power = %x\n", fftout_i, fftout_q, pint);
 +
 +	return pint;
 +}
@@ -251,18 +292,17 @@
 +	rt2800_bbp_write(rt2x00dev, 159, bbp);
 +
 +	if (ch_idx == 0)
-+		bbp = (iorq == 0) ? 0xb1: 0xb2;
++		bbp = (iorq == 0) ? 0xb1 : 0xb2;
 +	else
-+		bbp = (iorq == 0) ? 0xb8: 0xb9;
++		bbp = (iorq == 0) ? 0xb8 : 0xb9;
 +
 +	rt2800_bbp_write(rt2x00dev, 158, bbp);
 +	bbp = dc;
 +	rt2800_bbp_write(rt2x00dev, 159, bbp);
-+
-+	return;
 +}
 +
-+static void rt2800_loft_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 alc_idx, u8 dc_result[][RF_ALC_NUM][2])
++static void rt2800_loft_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx,
++			       u8 alc_idx, u8 dc_result[][RF_ALC_NUM][2])
 +{
 +	u32 p0 = 0, p1 = 0, pf = 0;
 +	char idx0 = 0, idx1 = 0;
@@ -276,8 +316,6 @@
 +
 +	for (bidx = 5; bidx >= 0; bidx--) {
 +		for (iorq = 0; iorq <= 1; iorq++) {
-+			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
-+
 +			if (idxf[iorq] == 0x20) {
 +				idx0 = 0x20;
 +				p0 = pf;
@@ -288,16 +326,17 @@
 +				p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
 +			}
 +
-+			idx1 = idxf[iorq] + ((bidx == 5) ? 0 : ibit);
++			idx1 = idxf[iorq] + (bidx == 5 ? 0 : ibit);
 +			idx1 = idx1 & 0x3F;
 +			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idx1);
 +			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
 +
-+			rt2x00_dbg(rt2x00dev, "alc=%u, IorQ=%u, idx_final=%2x\n", alc_idx, iorq, idxf[iorq]);
-+			rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pf=%x, idx_0=%x, idx_1=%x, ibit=%x !\n", p0, p1, pf, idx0, idx1, ibit);
++			rt2x00_dbg(rt2x00dev, "alc=%u, IorQ=%u, idx_final=%2x\n",
++				   alc_idx, iorq, idxf[iorq]);
++			rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pf=%x, idx_0=%x, idx_1=%x, ibit=%x\n",
++				   p0, p1, pf, idx0, idx1, ibit);
 +
-+			if ((bidx != 5) && (pf <= p0) && (pf < p1)) {
-+				pf = pf;
++			if (bidx != 5 && pf <= p0 && pf < p1) {
 +				idxf[iorq] = idxf[iorq];
 +			} else if (p0 < p1) {
 +				pf = p0;
@@ -306,17 +345,15 @@
 +				pf = p1;
 +				idxf[iorq] = idx1 & 0x3F;
 +			}
-+			rt2x00_dbg(rt2x00dev, "IorQ=%u, idx_final[%u]:%x, pf:%8x\n", iorq, iorq, idxf[iorq], pf);
++			rt2x00_dbg(rt2x00dev, "IorQ=%u, idx_final[%u]:%x, pf:%8x\n",
++				   iorq, iorq, idxf[iorq], pf);
 +
 +			rt2800_write_dc(rt2x00dev, ch_idx, 0, iorq, idxf[iorq]);
-+
 +		}
 +		ibit = ibit >> 1;
 +	}
 +	dc_result[ch_idx][alc_idx][0] = idxf[0];
 +	dc_result[ch_idx][alc_idx][1] = idxf[1];
-+
-+	return;
 +}
 +
 +static void rt2800_iq_search(struct rt2x00_dev *rt2x00dev, u8 ch_idx, u8 *ges, u8 *pes)
@@ -334,26 +371,25 @@
 +	u8 bbp = 0;
 +	char bidx;
 +
-+	rt2x00_info(rt2x00dev, "IQCalibration Start!\n");
 +	for (bidx = 5; bidx >= 1; bidx--) {
 +		for (gop = 0; gop < 2; gop++) {
-+			rt2x00_dbg(rt2x00dev, "\n========================================================\n");
-+
-+			if ((gop == 1) || (bidx < 4)) {
++			if (gop == 1 || bidx < 4) {
 +				if (gop == 0)
 +					iq_err = gerr;
 +				else
 +					iq_err = perr;
 +
 +				first_search = (gop == 0) ? (bidx == 3) : (bidx == 5);
-+				touch_neg_max = (gop) ? ((iq_err & 0x0F) == 0x08) : ((iq_err & 0x3F) == 0x20);
++				touch_neg_max = (gop) ? ((iq_err & 0x0F) == 0x08) :
++							((iq_err & 0x3F) == 0x20);
 +
 +				if (touch_neg_max) {
 +					p0 = pf;
 +					idx0 = iq_err;
 +				} else {
 +					idx0 = iq_err - ibit;
-+					bbp = (ch_idx == 0) ? ((gop == 0) ? 0x28 : 0x29): ((gop == 0) ? 0x46 : 0x47);
++					bbp = (ch_idx == 0) ? ((gop == 0) ? 0x28 : 0x29) :
++							      ((gop == 0) ? 0x46 : 0x47);
 +
 +					rt2800_bbp_write(rt2x00dev, 158, bbp);
 +					rt2800_bbp_write(rt2x00dev, 159, idx0);
@@ -364,26 +400,30 @@
 +				idx1 = iq_err + (first_search ? 0 : ibit);
 +				idx1 = (gop == 0) ? (idx1 & 0x0F) : (idx1 & 0x3F);
 +
-+				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
++				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 :
++				      (gop == 0) ? 0x46 : 0x47;
 +
 +				rt2800_bbp_write(rt2x00dev, 158, bbp);
 +				rt2800_bbp_write(rt2x00dev, 159, idx1);
 +
 +				p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
 +
-+				rt2x00_dbg(rt2x00dev, "p0=%x, p1=%x, pwer_final=%x, idx0=%x, idx1=%x, iq_err=%x, gop=%d, ibit=%x !\n", p0, p1, pf, idx0, idx1, iq_err, gop, ibit);
++				rt2x00_dbg(rt2x00dev,
++					   "p0=%x, p1=%x, pwer_final=%x, idx0=%x, idx1=%x, iq_err=%x, gop=%d, ibit=%x\n",
++					   p0, p1, pf, idx0, idx1, iq_err, gop, ibit);
 +
-+				if ((!first_search) && (pf <= p0) && (pf < p1)) {
-+					pf = pf;
-+				} else if (p0 < p1) {
-+					pf = p0;
-+					iq_err = idx0;
-+				} else {
-+					pf = p1;
-+					iq_err = idx1;
++				if (!(!first_search && pf <= p0 && pf < p1)) {
++					if (p0 < p1) {
++						pf = p0;
++						iq_err = idx0;
++					} else {
++						pf = p1;
++						iq_err = idx1;
++					}
 +				}
 +
-+				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 : (gop == 0) ? 0x46 : 0x47;
++				bbp = (ch_idx == 0) ? (gop == 0) ? 0x28 : 0x29 :
++						      (gop == 0) ? 0x46 : 0x47;
 +
 +				rt2800_bbp_write(rt2x00dev, 158, bbp);
 +				rt2800_bbp_write(rt2x00dev, 159, iq_err);
@@ -393,8 +433,8 @@
 +				else
 +					perr = iq_err;
 +
-+				rt2x00_dbg(rt2x00dev, "IQCalibration pf=%8x (%2x, %2x) !\n", pf, gerr & 0x0F, perr & 0x3F);
-+
++				rt2x00_dbg(rt2x00dev, "IQCalibration pf=%8x (%2x, %2x) !\n",
++					   pf, gerr & 0x0F, perr & 0x3F);
 +			}
 +		}
 +
@@ -423,25 +463,21 @@
 +			rt2800_bbp_write(rt2x00dev, 159, pef & 0x3F);
 +
 +			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 1);
-+			if ((gef == gsta) && (pef == psta)) {
++			if (gef == gsta && pef == psta) {
++				pf = p1;
++				gerr = gef;
++				perr = pef;
++			} else if (pf > p1) {
 +				pf = p1;
 +				gerr = gef;
 +				perr = pef;
 +			}
-+			else if (pf > p1){
-+				pf = p1;
-+				gerr = gef;
-+				perr = pef;
-+			}
-+			rt2x00_dbg(rt2x00dev, "Fine IQCalibration p1=%8x pf=%8x (%2x, %2x) !\n", p1, pf, gef & 0x0F, pef & 0x3F);
++			rt2x00_dbg(rt2x00dev, "Fine IQCalibration p1=%8x pf=%8x (%2x, %2x) !\n",
++				   p1, pf, gef & 0x0F, pef & 0x3F);
 +		}
 +
 +	ges[ch_idx] = gerr & 0x0F;
 +	pes[ch_idx] = perr & 0x3F;
-+
-+	rt2x00_info(rt2x00dev, "IQCalibration Done! CH = %u, (gain=%2x, phase=%2x)\n", ch_idx, gerr & 0x0F, perr & 0x3F);
-+
-+	return;
 +}
 +
 +static void rt2800_rf_aux_tx0_loopback(struct rt2x00_dev *rt2x00dev)
@@ -478,9 +514,9 @@
 +	rt2800_rfcsr_write_bank(rt2x00dev, 7, 20, 0x20);
 +}
 +
-+void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev)
++static void rt2800_loft_iq_calibration(struct rt2x00_dev *rt2x00dev)
 +{
-+	rf_reg_pair rf_store[CHAIN_NUM][13];
++	struct rf_reg_pair rf_store[CHAIN_NUM][13];
 +	u32 macorg1 = 0;
 +	u32 macorg2 = 0;
 +	u32 macorg3 = 0;
@@ -489,7 +525,7 @@
 +	u32 orig528 = 0;
 +	u32 orig52c = 0;
 +
-+	u32 savemacsysctrl = 0, mtxcycle = 0;
++	u32 savemacsysctrl = 0;
 +	u32 macvalue = 0;
 +	u32 mac13b8 = 0;
 +	u32 p0 = 0, p1 = 0;
@@ -498,11 +534,8 @@
 +	u8 rfvalue;
 +	u8 loft_dc_search_result[CHAIN_NUM][RF_ALC_NUM][2];
 +	u8 ger[CHAIN_NUM], per[CHAIN_NUM];
-+	u8 rf_gain[] = {0x00, 0x01, 0x02, 0x04, 0x08, 0x0c};
-+	u8 rfvga_gain_table[] = {0x24, 0x25, 0x26, 0x27, 0x28, 0x2c, 0x2d, 0x2e, 0x2f, 0x30, 0x31, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3F};
 +
 +	u8 vga_gain[] = {14, 14};
-+	u8 bbp_2324gain[] = {0x16, 0x14, 0x12, 0x10, 0x0c, 0x08};
 +	u8 bbp = 0, ch_idx = 0, rf_alc_idx = 0, idx = 0;
 +	u8 bbpr30, rfb0r39, rfb0r42;
 +	u8 bbpr1;
@@ -510,6 +543,11 @@
 +	u8 bbpr241, bbpr242;
 +	u8 count_step;
 +
++	static const u8 rf_gain[] = {0x00, 0x01, 0x02, 0x04, 0x08, 0x0c};
++	static const u8 rfvga_gain_table[] = {0x24, 0x25, 0x26, 0x27, 0x28, 0x2c, 0x2d, 0x2e, 0x2f, 0x30,
++					      0x31, 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3F};
++	static const u8 bbp_2324gain[] = {0x16, 0x14, 0x12, 0x10, 0x0c, 0x08};
++
 +	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
 +	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
@@ -524,29 +562,18 @@
 +	macvalue &= (~0x04);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
 +
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x01)
-+			udelay(50);
-+		else
-+			break;
-+	}
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_TX)))
++		rt2x00_warn(rt2x00dev, "RF TX busy in LOFT IQ calibration\n");
 +
 +	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	macvalue &= (~0x08);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
 +
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x02)
-+			udelay(50);
-+		else
-+			break;
-+	}
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_RX)))
++		rt2x00_warn(rt2x00dev, "RF RX busy in LOFT IQ calibration\n");
 +
-+	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
++	for (ch_idx = 0; ch_idx < 2; ch_idx++)
 +		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
-+	}
 +
 +	bbpr30 = rt2800_bbp_read(rt2x00dev, 30);
 +	rfb0r39 = rt2800_rfcsr_read_bank(rt2x00dev, 0, 39);
@@ -561,7 +588,7 @@
 +
 +	rt2800_setbbptonegenerator(rt2x00dev);
 +
-+	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
++	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
 +		rt2800_bbp_write(rt2x00dev, 23, 0x00);
 +		rt2800_bbp_write(rt2x00dev, 24, 0x00);
 +		rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, 0x00);
@@ -571,18 +598,17 @@
 +		rt2800_register_write(rt2x00dev, 0x13b8, 0x10);
 +		udelay(1);
 +
-+		if (ch_idx == 0) {
++		if (ch_idx == 0)
 +			rt2800_rf_aux_tx0_loopback(rt2x00dev);
-+		} else {
++		else
 +			rt2800_rf_aux_tx1_loopback(rt2x00dev);
-+		}
++
 +		udelay(1);
 +
-+		if (ch_idx == 0) {
++		if (ch_idx == 0)
 +			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001004);
-+		} else {
++		else
 +			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002004);
-+		}
 +
 +		rt2800_bbp_write(rt2x00dev, 158, 0x05);
 +		rt2800_bbp_write(rt2x00dev, 159, 0x00);
@@ -608,7 +634,8 @@
 +
 +			if (rf_alc_idx == 0) {
 +				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x21);
-+				for (;vga_gain[ch_idx] > 0;vga_gain[ch_idx] = vga_gain[ch_idx] - 2) {
++				for (; vga_gain[ch_idx] > 0;
++				     vga_gain[ch_idx] = vga_gain[ch_idx] - 2) {
 +					rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
 +					rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
 +					rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
@@ -618,19 +645,19 @@
 +					rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x21);
 +					p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x0A, 0);
 +					rt2x00_dbg(rt2x00dev, "LOFT AGC %d %d\n", p0, p1);
-+					if ((p0 < 7000*7000) && (p1 < (7000*7000))) {
++					if ((p0 < 7000 * 7000) && (p1 < (7000 * 7000)))
 +						break;
-+					}
 +				}
 +
 +				rt2800_write_dc(rt2x00dev, ch_idx, 0, 0, 0x00);
 +				rt2800_write_dc(rt2x00dev, ch_idx, 0, 1, 0x00);
 +
-+				rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]);
++				rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n", vga_gain[ch_idx],
++					   rfvga_gain_table[vga_gain[ch_idx]]);
 +
 +				if (vga_gain[ch_idx] < 0)
 +					vga_gain[ch_idx] = 0;
-+		 	}
++			}
 +
 +			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
 +
@@ -644,7 +671,7 @@
 +	for (rf_alc_idx = 0; rf_alc_idx < 3; rf_alc_idx++) {
 +		for (idx = 0; idx < 4; idx++) {
 +			rt2800_bbp_write(rt2x00dev, 158, 0xB0);
-+			bbp = (idx<<2) + rf_alc_idx;
++			bbp = (idx << 2) + rf_alc_idx;
 +			rt2800_bbp_write(rt2x00dev, 159, bbp);
 +			rt2x00_dbg(rt2x00dev, " ALC %2x,", bbp);
 +
@@ -705,8 +732,6 @@
 +	rt2800_register_write(rt2x00dev, RF_BYPASS2, orig52c);
 +	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
 +
-+	rt2x00_info(rt2x00dev, "LOFT Calibration Done!\n");
-+
 +	savemacsysctrl = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	macorg1 = rt2800_register_read(rt2x00dev, TX_PIN_CFG);
 +	macorg2 = rt2800_register_read(rt2x00dev, RF_CONTROL0);
@@ -723,24 +748,16 @@
 +	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	macvalue &= (~0x04);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x01)
-+			udelay(50);
-+		else
-+			break;
-+	}
++
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_TX)))
++		rt2x00_warn(rt2x00dev, "RF TX busy in LOFT IQ calibration\n");
 +
 +	macvalue = rt2800_register_read(rt2x00dev, MAC_SYS_CTRL);
 +	macvalue &= (~0x08);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, macvalue);
-+	for (mtxcycle = 0; mtxcycle < 10000; mtxcycle++) {
-+		macvalue = rt2800_register_read(rt2x00dev, MAC_STATUS_CFG);
-+		if (macvalue & 0x02)
-+			udelay(50);
-+		else
-+			break;
-+	}
++
++	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY_RX)))
++		rt2x00_warn(rt2x00dev, "RF RX busy in LOFT IQ calibration\n");
 +
 +	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
 +		rt2800_register_write(rt2x00dev, RF_CONTROL3, 0x00000101);
@@ -776,9 +793,8 @@
 +
 +	rt2800_register_write(rt2x00dev, 0x13b8, 0x00000010);
 +
-+	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
++	for (ch_idx = 0; ch_idx < 2; ch_idx++)
 +		rt2800_rf_configstore(rt2x00dev, rf_store, ch_idx);
-+	}
 +
 +	rt2800_rfcsr_write_dccal(rt2x00dev, 3, 0x3B);
 +	rt2800_rfcsr_write_dccal(rt2x00dev, 4, 0x3B);
@@ -788,7 +804,7 @@
 +	rt2800_bbp_write(rt2x00dev, 158, 0xB0);
 +	rt2800_bbp_write(rt2x00dev, 159, 0x80);
 +
-+	for (ch_idx = 0; ch_idx < 2; ch_idx ++) {
++	for (ch_idx = 0; ch_idx < 2; ch_idx++) {
 +		rt2800_bbp_write(rt2x00dev, 23, 0x00);
 +		rt2800_bbp_write(rt2x00dev, 24, 0x00);
 +
@@ -831,7 +847,7 @@
 +			count_step = 2;
 +		}
 +
-+		for (;vga_gain[ch_idx] < 19; vga_gain[ch_idx]=(vga_gain[ch_idx] + count_step)) {
++		for (; vga_gain[ch_idx] < 19; vga_gain[ch_idx] = (vga_gain[ch_idx] + count_step)) {
 +			rfvalue = rfvga_gain_table[vga_gain[ch_idx]];
 +			rt2800_rfcsr_write_dccal(rt2x00dev, 3, rfvalue);
 +			rt2800_rfcsr_write_dccal(rt2x00dev, 4, rfvalue);
@@ -840,37 +856,35 @@
 +			rt2800_bbp_write(rt2x00dev, 158, bbp);
 +			rt2800_bbp_write(rt2x00dev, 159, 0x00);
 +			p0 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags))
 +				p0_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
-+			}
 +
 +			bbp = (ch_idx == 0) ? 0x29 : 0x47;
 +			rt2800_bbp_write(rt2x00dev, 158, bbp);
 +			rt2800_bbp_write(rt2x00dev, 159, 0x21);
 +			p1 = rt2800_do_fft_accumulation(rt2x00dev, 0x14, 0);
-+			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags)) {
++			if (test_bit(CAPABILITY_EXTERNAL_PA_TX1, &rt2x00dev->cap_flags))
 +				p1_idx10 = rt2800_read_fft_accumulation(rt2x00dev, 0x0A);
-+			}
 +
 +			rt2x00_dbg(rt2x00dev, "IQ AGC %d %d\n", p0, p1);
 +
 +			if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
 +				rt2x00_dbg(rt2x00dev, "IQ AGC IDX 10 %d %d\n", p0_idx10, p1_idx10);
-+				if ((p0_idx10 > 7000*7000) || (p1_idx10 > 7000*7000)) {
-+					if (vga_gain[ch_idx]!=0)
-+						vga_gain[ch_idx] = vga_gain[ch_idx]-1;
++				if ((p0_idx10 > 7000 * 7000) || (p1_idx10 > 7000 * 7000)) {
++					if (vga_gain[ch_idx] != 0)
++						vga_gain[ch_idx] = vga_gain[ch_idx] - 1;
 +					break;
 +				}
 +			}
 +
-+			if ((p0 > 2500*2500) || (p1 > 2500*2500)) {
++			if ((p0 > 2500 * 2500) || (p1 > 2500 * 2500))
 +				break;
-+			}
 +		}
 +
 +		if (vga_gain[ch_idx] > 18)
 +			vga_gain[ch_idx] = 18;
-+		rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n",vga_gain[ch_idx], rfvga_gain_table[vga_gain[ch_idx]]);
++		rt2x00_dbg(rt2x00dev, "Used VGA %d %x\n", vga_gain[ch_idx],
++			   rfvga_gain_table[vga_gain[ch_idx]]);
 +
 +		bbp = (ch_idx == 0) ? 0x29 : 0x47;
 +		rt2800_bbp_write(rt2x00dev, 158, bbp);
@@ -915,9 +929,8 @@
 +	rt2800_rfcsr_write_bank(rt2x00dev, 0, 39, rfb0r39);
 +	rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfb0r42);
 +
-+	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags)) {
++	if (test_bit(CAPABILITY_EXTERNAL_PA_TX0, &rt2x00dev->cap_flags))
 +		rt2800_bbp_write(rt2x00dev, 4, bbpr4);
-+	}
 +
 +	rt2800_bbp_write(rt2x00dev, 21, 0x01);
 +	udelay(1);
@@ -935,16 +948,12 @@
 +	rt2800_register_write(rt2x00dev, RF_BYPASS3, macorg5);
 +	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, savemacsysctrl);
 +	rt2800_register_write(rt2x00dev, 0x13b8, mac13b8);
-+
-+	rt2x00_info(rt2x00dev, "TX IQ Calibration Done!\n");
-+
-+	return;
 +}
 +
  static void rt2800_bbp_core_soft_reset(struct rt2x00_dev *rt2x00dev,
  				       bool set_bw, bool is_ht40)
  {
-@@ -9691,6 +10628,7 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -9653,6 +10554,7 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rxdcoc_calibration(rt2x00dev);
  	rt2800_bw_filter_calibration(rt2x00dev, true);
  	rt2800_bw_filter_calibration(rt2x00dev, false);
@@ -963,11 +972,11 @@
 +#define RF_ALC_NUM	6
 +#define CHAIN_NUM	2
 +
-+typedef struct rf_reg_pair {
++struct rf_reg_pair {
 +	u8 bank;
 +	u8 reg;
 +	u8 value;
-+} rf_reg_pair;
++};
  
  /* RT2800 driver data structure */
  struct rt2800_drv_data {

package/kernel/mac80211/patches/rt2x00/011-rt2x00-move-helper-functions-up-in-file.patch

@@ -0,0 +1,94 @@
+From patchwork Sat Sep 17 20:28:58 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979252
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:28:58 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 11/16] rt2x00: move helper functions up in file
+Message-ID: 
+ <c27baa8efd5c29e2bcb2432925d9cdc5c913a125.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Move register access helper functions up to the head of the file so
+they can be used in all functions.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 40 +++++++++----------
+ 1 file changed, 20 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -198,6 +198,26 @@ static void rt2800_rfcsr_write_dccal(str
+ 	rt2800_rfcsr_write_bank(rt2x00dev, 7, reg, value);
+ }
+ 
++static void rt2800_bbp_dcoc_write(struct rt2x00_dev *rt2x00dev,
++				  const u8 reg, const u8 value)
++{
++	rt2800_bbp_write(rt2x00dev, 158, reg);
++	rt2800_bbp_write(rt2x00dev, 159, value);
++}
++
++static u8 rt2800_bbp_dcoc_read(struct rt2x00_dev *rt2x00dev, const u8 reg)
++{
++	rt2800_bbp_write(rt2x00dev, 158, reg);
++	return rt2800_bbp_read(rt2x00dev, 159);
++}
++
++static void rt2800_bbp_glrt_write(struct rt2x00_dev *rt2x00dev,
++				  const u8 reg, const u8 value)
++{
++	rt2800_bbp_write(rt2x00dev, 195, reg);
++	rt2800_bbp_write(rt2x00dev, 196, value);
++}
++
+ static u8 rt2800_rfcsr_read(struct rt2x00_dev *rt2x00dev,
+ 			    const unsigned int word)
+ {
+@@ -6947,26 +6967,6 @@ static void rt2800_init_bbp_5592(struct
+ 		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+ }
+ 
+-static void rt2800_bbp_glrt_write(struct rt2x00_dev *rt2x00dev,
+-				  const u8 reg, const u8 value)
+-{
+-	rt2800_bbp_write(rt2x00dev, 195, reg);
+-	rt2800_bbp_write(rt2x00dev, 196, value);
+-}
+-
+-static void rt2800_bbp_dcoc_write(struct rt2x00_dev *rt2x00dev,
+-				  const u8 reg, const u8 value)
+-{
+-	rt2800_bbp_write(rt2x00dev, 158, reg);
+-	rt2800_bbp_write(rt2x00dev, 159, value);
+-}
+-
+-static u8 rt2800_bbp_dcoc_read(struct rt2x00_dev *rt2x00dev, const u8 reg)
+-{
+-	rt2800_bbp_write(rt2x00dev, 158, reg);
+-	return rt2800_bbp_read(rt2x00dev, 159);
+-}
+-
+ static void rt2800_init_bbp_6352(struct rt2x00_dev *rt2x00dev)
+ {
+ 	u8 bbp;

package/kernel/mac80211/patches/rt2x00/012-rt2x00-fix-HT20-HT40-bandwidth-switch-on-MT7620.patch

@@ -0,0 +1,56 @@
+From patchwork Sat Sep 17 20:29:13 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979253
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:29:13 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 12/16] rt2x00: fix HT20/HT40 bandwidth switch on MT7620
+Message-ID: 
+ <1664d89ba149f7b0bcec18b2a2abaedf49654507.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Add missing configuration of the channel bandwidth filter to the
+channel setup function for MT7620.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3855,6 +3855,14 @@ static void rt2800_config_channel_rf7620
+ 		rfcsr |= tx_agc_fc;
+ 		rt2800_rfcsr_write_bank(rt2x00dev, 7, 59, rfcsr);
+ 	}
++
++	if (conf_is_ht40(conf)) {
++		rt2800_bbp_glrt_write(rt2x00dev, 141, 0x10);
++		rt2800_bbp_glrt_write(rt2x00dev, 157, 0x2f);
++	} else {
++		rt2800_bbp_glrt_write(rt2x00dev, 141, 0x1a);
++		rt2800_bbp_glrt_write(rt2x00dev, 157, 0x40);
++	}
+ }
+ 
+ static void rt2800_config_alc(struct rt2x00_dev *rt2x00dev,

package/kernel/mac80211/patches/rt2x00/013-rt2x00-set-correct-TX_SW_CFG1-MAC-register-for-MT7620.patch

@@ -0,0 +1,52 @@
+From patchwork Sat Sep 17 20:29:26 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979254
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:29:26 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 13/16] rt2x00: set correct TX_SW_CFG1 MAC register for
+ MT7620
+Message-ID: 
+ <4be38975ce600a34249e12d09a3cb758c6e71071.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Set correct TX_SW_CFG1 MAC register as it is done also in v3 of the
+vendor driver[1].
+
+[1]: https://gitlab.com/dm38/padavan-ng/-/blob/master/trunk/proprietary/rt_wifi/rtpci/3.0.X.X/mt76x2/chips/rt6352.c#L531
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5966,7 +5966,7 @@ static int rt2800_init_registers(struct
+ 		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
+ 	} else if (rt2x00_rt(rt2x00dev, RT6352)) {
+ 		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
+-		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
++		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
+ 		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
+ 		rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
+ 		rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);

package/kernel/mac80211/patches/rt2x00/014-rt2x00-set-VGC-gain-for-both-chains-of-MT7620.patch

@@ -0,0 +1,50 @@
+From patchwork Sat Sep 17 20:29:40 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979255
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:29:40 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 14/16] rt2x00: set VGC gain for both chains of MT7620
+Message-ID: 
+ <29e161397e5c9d9399da0fe87d44458aa2b90a78.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Set bbp66 for all chains of the MT7620.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5743,7 +5743,8 @@ static inline void rt2800_set_vgc(struct
+ 	if (qual->vgc_level != vgc_level) {
+ 		if (rt2x00_rt(rt2x00dev, RT3572) ||
+ 		    rt2x00_rt(rt2x00dev, RT3593) ||
+-		    rt2x00_rt(rt2x00dev, RT3883)) {
++		    rt2x00_rt(rt2x00dev, RT3883) ||
++		    rt2x00_rt(rt2x00dev, RT6352)) {
+ 			rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
+ 						       vgc_level);
+ 		} else if (rt2x00_rt(rt2x00dev, RT5592)) {

package/kernel/mac80211/patches/rt2x00/015-rt2x00-set-SoC-wmac-clock-register.patch

@@ -0,0 +1,70 @@
+From patchwork Sat Sep 17 20:29:55 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979256
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+Date: Sat, 17 Sep 2022 21:29:55 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 15/16] rt2x00: set SoC wmac clock register
+Message-ID: 
+ <3e275d259f476f597dab91a9c395015ef3fe3284.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Instead of using the default value 33 (pci), set US_CYC_CNT init based
+on Programming guide:
+If available, set chipset bus clock with fallback to cpu clock/3.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 21 +++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -6229,6 +6229,27 @@ static int rt2800_init_registers(struct
+ 		reg = rt2800_register_read(rt2x00dev, US_CYC_CNT);
+ 		rt2x00_set_field32(&reg, US_CYC_CNT_CLOCK_CYCLE, 125);
+ 		rt2800_register_write(rt2x00dev, US_CYC_CNT, reg);
++	} else if (rt2x00_is_soc(rt2x00dev)) {
++		struct clk *clk = clk_get_sys("bus", NULL);
++		int rate;
++
++		if (IS_ERR(clk)) {
++			clk = clk_get_sys("cpu", NULL);
++
++			if (IS_ERR(clk)) {
++				rate = 125;
++			} else {
++				rate = clk_get_rate(clk) / 3000000;
++				clk_put(clk);
++			}
++		} else {
++			rate = clk_get_rate(clk) / 1000000;
++			clk_put(clk);
++		}
++
++		reg = rt2800_register_read(rt2x00dev, US_CYC_CNT);
++		rt2x00_set_field32(&reg, US_CYC_CNT_CLOCK_CYCLE, rate);
++		rt2800_register_write(rt2x00dev, US_CYC_CNT, reg);
+ 	}
+ 
+ 	reg = rt2800_register_read(rt2x00dev, HT_FBK_CFG0);

package/kernel/mac80211/patches/rt2x00/016-rt2x00-correctly-set-BBP-register-86-for-MT7620.patch

@@ -0,0 +1,79 @@
+From patchwork Sat Sep 17 20:30:09 2022
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 12979257
+X-Patchwork-Delegate: kvalo@adurom.com
+Return-Path: <linux-wireless-owner@kernel.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
+	by smtp.lore.kernel.org (Postfix) with ESMTP id E9118ECAAA1
+	for <linux-wireless@archiver.kernel.org>;
+ Sat, 17 Sep 2022 20:30:22 +0000 (UTC)
+Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
+        id S229639AbiIQUaV (ORCPT
+        <rfc822;linux-wireless@archiver.kernel.org>);
+        Sat, 17 Sep 2022 16:30:21 -0400
+Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53912 "EHLO
+        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+        with ESMTP id S229628AbiIQUaT (ORCPT
+        <rfc822;linux-wireless@vger.kernel.org>);
+        Sat, 17 Sep 2022 16:30:19 -0400
+Received: from fudo.makrotopia.org (fudo.makrotopia.org
+ [IPv6:2a07:2ec0:3002::71])
+        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1AEA822B27
+        for <linux-wireless@vger.kernel.org>;
+ Sat, 17 Sep 2022 13:30:16 -0700 (PDT)
+Received: from local
+        by fudo.makrotopia.org with esmtpsa
+ (TLS1.3:TLS_AES_256_GCM_SHA384:256)
+         (Exim 4.96)
+        (envelope-from <daniel@makrotopia.org>)
+        id 1oZeS7-0003ra-0k;
+        Sat, 17 Sep 2022 22:30:15 +0200
+Date: Sat, 17 Sep 2022 21:30:09 +0100
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-wireless@vger.kernel.org, Stanislaw Gruszka <stf_xl@wp.pl>,
+        Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+        "David S. Miller" <davem@davemloft.net>,
+        Eric Dumazet <edumazet@google.com>,
+        Jakub Kicinski <kuba@kernel.org>,
+        Paolo Abeni <pabeni@redhat.com>,
+        Johannes Berg <johannes.berg@intel.com>
+Subject: [PATCH v3 16/16] rt2x00: correctly set BBP register 86 for MT7620
+Message-ID: 
+ <257267247ee4fa7ebc6a5d0c4948b3f8119c0d77.1663445157.git.daniel@makrotopia.org>
+References: <cover.1663445157.git.daniel@makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+In-Reply-To: <cover.1663445157.git.daniel@makrotopia.org>
+Precedence: bulk
+List-ID: <linux-wireless.vger.kernel.org>
+X-Mailing-List: linux-wireless@vger.kernel.org
+
+Instead of 0 set the correct value for BBP register 86 for MT7620.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -4225,7 +4225,10 @@ static void rt2800_config_channel(struct
+ 		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+-		rt2800_bbp_write(rt2x00dev, 86, 0);
++		if (rt2x00_rt(rt2x00dev, RT6352))
++			rt2800_bbp_write(rt2x00dev, 86, 0x38);
++		else
++			rt2800_bbp_write(rt2x00dev, 86, 0);
+ 	}
+ 
+ 	if (rf->channel <= 14) {

package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch

@@ -48,7 +48,7 @@
  obj-$(CPTCFG_RT2X00_LIB_MMIO)		+= rt2x00mmio.o
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.h
-@@ -37,6 +37,8 @@ struct rt2800_drv_data {
+@@ -47,6 +47,8 @@ struct rt2800_drv_data {
  	struct ieee80211_sta *wcid_to_sta[STA_IDS_SIZE];
  };
  
@@ -57,7 +57,7 @@
  struct rt2800_ops {
  	u32 (*register_read)(struct rt2x00_dev *rt2x00dev,
  			      const unsigned int offset);
-@@ -135,6 +137,15 @@ static inline int rt2800_read_eeprom(str
+@@ -145,6 +147,15 @@ static inline int rt2800_read_eeprom(str
  {
  	const struct rt2800_ops *rt2800ops = rt2x00dev->ops->drv;
  
@@ -127,7 +127,7 @@
  	DECLARE_KFIFO_PTR(txstatus_fifo, u32);
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1401,6 +1401,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
+@@ -1419,6 +1419,10 @@ int rt2x00lib_probe_dev(struct rt2x00_de
  	INIT_DELAYED_WORK(&rt2x00dev->autowakeup_work, rt2x00lib_autowakeup);
  	INIT_WORK(&rt2x00dev->sleep_work, rt2x00lib_sleep);
  
@@ -138,7 +138,7 @@
  	/*
  	 * Let the driver probe the device to detect the capabilities.
  	 */
-@@ -1541,6 +1545,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
+@@ -1559,6 +1563,11 @@ void rt2x00lib_remove_dev(struct rt2x00_
  	 * Free the driver data.
  	 */
  	kfree(rt2x00dev->drv_data);
@@ -193,7 +193,7 @@
 +	if (pdata && pdata->eeprom_file_name)
 +		return pdata->eeprom_file_name;
 +
-+	return NULL
++	return NULL;
 +}
 +
 +static int rt2x00lib_request_eeprom_file(struct rt2x00_dev *rt2x00dev)

package/kernel/mac80211/patches/rt2x00/603-rt2x00-of_load_eeprom_filename.patch

@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2x00lib.h"
-@@ -34,11 +35,21 @@ static const char *
+@@ -34,10 +35,20 @@ static const char *
  rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
  	struct rt2x00_platform_data *pdata = rt2x00dev->dev->platform_data;
@@ -20,14 +20,12 @@
  	if (pdata && pdata->eeprom_file_name)
  		return pdata->eeprom_file_name;
  
--	return NULL
 +#ifdef CONFIG_OF
 +	np = rt2x00dev->dev->of_node;
 +	if (np && of_property_read_string(np, "ralink,eeprom", &eep) == 0)
 +	    return eep;
 +#endif
 +
-+	return NULL;
+ 	return NULL;
  }
  
- static int rt2x00lib_request_eeprom_file(struct rt2x00_dev *rt2x00dev)

package/kernel/mac80211/patches/rt2x00/610-rt2x00-change-led-polarity-from-OF.patch

@@ -8,7 +8,7 @@
  
  #include "rt2x00.h"
  #include "rt2800lib.h"
-@@ -9549,6 +9550,17 @@ static int rt2800_init_eeprom(struct rt2
+@@ -11131,6 +11132,17 @@ static int rt2800_init_eeprom(struct rt2
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
  	rt2800_init_led(rt2x00dev, &rt2x00dev->led_qual, LED_TYPE_QUALITY);
  

package/kernel/mac80211/patches/rt2x00/611-rt2x00-add-AP+STA-support.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1340,7 +1340,7 @@ static inline void rt2x00lib_set_if_comb
+@@ -1358,7 +1358,7 @@ static inline void rt2x00lib_set_if_comb
  	 */
  	if_limit = &rt2x00dev->if_limits_ap;
  	if_limit->max = rt2x00dev->ops->max_ap_intf;

package/kernel/mac80211/patches/rt2x00/612-rt2x00-led-tpt-trigger-support.patch

@@ -1,44 +0,0 @@
-From: David Bauer <mail@david-bauer.net>
-Date: Mon, 16 Dec 2019 20:47:06 +0100
-Subject: [PATCH] rt2x00: add throughput LED trigger
-
-This adds a (currently missing) throughput LED trigger for the rt2x00
-driver. Previously, LED triggers had to be assigned to the netdev, which
-was limited to a single VAP.
-
-Signed-off-by: David Bauer <mail@david-bauer.net>
-Tested-by: Christoph Krapp <achterin@googlemail.com>
-
---- a/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00dev.c
-@@ -1125,6 +1125,19 @@ static void rt2x00lib_remove_hw(struct r
- 	kfree(rt2x00dev->spec.channels_info);
- }
- 
-+static const struct ieee80211_tpt_blink rt2x00_tpt_blink[] = {
-+	{ .throughput = 0 * 1024, .blink_time = 334 },
-+	{ .throughput = 1 * 1024, .blink_time = 260 },
-+	{ .throughput = 2 * 1024, .blink_time = 220 },
-+	{ .throughput = 5 * 1024, .blink_time = 190 },
-+	{ .throughput = 10 * 1024, .blink_time = 170 },
-+	{ .throughput = 25 * 1024, .blink_time = 150 },
-+	{ .throughput = 54 * 1024, .blink_time = 130 },
-+	{ .throughput = 120 * 1024, .blink_time = 110 },
-+	{ .throughput = 265 * 1024, .blink_time = 80 },
-+	{ .throughput = 586 * 1024, .blink_time = 50 },
-+};
-+
- static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
- {
- 	struct hw_mode_spec *spec = &rt2x00dev->spec;
-@@ -1206,6 +1219,10 @@ static int rt2x00lib_probe_hw(struct rt2
- 
- #undef RT2X00_TASKLET_INIT
- 
-+	ieee80211_create_tpt_led_trigger(rt2x00dev->hw,
-+		IEEE80211_TPT_LEDTRIG_FL_RADIO, rt2x00_tpt_blink,
-+		ARRAY_SIZE(rt2x00_tpt_blink));
-+
- 	/*
- 	 * Register HW.
- 	 */

package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch

@@ -0,0 +1,161 @@
+From 0fce1109f894ec7fcd72cb098843a1eff786716a Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Fri, 16 Sep 2022 20:49:42 +0100
+Subject: [PATCH 16/16] rt2x00: import support for external LNA on MT7620
+To: linux-wireless@vger.kernel.org,
+    Stanislaw Gruszka <stf_xl@wp.pl>,
+    Helmut Schaa <helmut.schaa@googlemail.com>
+Cc: Kalle Valo <kvalo@kernel.org>,
+    David S. Miller <davem@davemloft.net>,
+    Eric Dumazet <edumazet@google.com>,
+    Jakub Kicinski <kuba@kernel.org>,
+    Paolo Abeni <pabeni@redhat.com>,
+    Johannes Berg <johannes.berg@intel.com>
+
+In order to carry out calibration on boards with ePA or eLNA the PA pin
+needs to be switch to GPIO mode on MT7620. Implement that by selecting
+pinctrl state "pa_gpio" which should be defined for MT7620 boards with
+eLNA or ePA beside the "default" state.
+
+Reported-by: Serge Vasilugin <vasilugin@yandex.ru>
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 58 +++++++++++++++++++
+ drivers/net/wireless/ralink/rt2x00/rt2x00.h   |  5 ++
+ .../net/wireless/ralink/rt2x00/rt2x00soc.c    | 15 +++++
+ 3 files changed, 78 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -304,6 +304,24 @@ static void rt2800_rf_write(struct rt2x0
+ 	mutex_unlock(&rt2x00dev->csr_mutex);
+ }
+ 
++void rt6352_enable_pa_pin(struct rt2x00_dev *rt2x00dev, int enable)
++{
++	if (!rt2x00dev->pinctrl)
++		return;
++
++	if (enable) {
++		if (!rt2x00dev->pins_default)
++			return;
++
++		pinctrl_select_state(rt2x00dev->pinctrl, rt2x00dev->pins_default);
++	} else {
++		if (!rt2x00dev->pins_pa_gpio)
++			return;
++
++		pinctrl_select_state(rt2x00dev->pinctrl, rt2x00dev->pins_pa_gpio);
++	}
++}
++
+ static const unsigned int rt2800_eeprom_map[EEPROM_WORD_COUNT] = {
+ 	[EEPROM_CHIP_ID]		= 0x0000,
+ 	[EEPROM_VERSION]		= 0x0001,
+@@ -4469,6 +4487,29 @@ static void rt2800_config_channel(struct
+ 			rt2800_register_write(rt2x00dev, TX1_RF_GAIN_ATTEN,
+ 					      0x6C6C6B6C);
+ 		}
++
++		if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++			reg = rt2800_register_read(rt2x00dev, RF_CONTROL3);
++			reg |= 0x00000101;
++			rt2800_register_write(rt2x00dev, RF_CONTROL3, reg);
++
++			reg = rt2800_register_read(rt2x00dev, RF_BYPASS3);
++			reg |= 0x00000101;
++			rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
++
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
++			rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
++			rt2800_bbp_write(rt2x00dev, 75, 0x68);
++			rt2800_bbp_write(rt2x00dev, 76, 0x4C);
++			rt2800_bbp_write(rt2x00dev, 79, 0x1C);
++			rt2800_bbp_write(rt2x00dev, 80, 0x0C);
++			rt2800_bbp_write(rt2x00dev, 82, 0xB6);
++			/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in
++			 * config channel function in dependence of channel and
++			 * HT20/HT40 so don't touch it
++			 */
++		}
+ 	}
+ 
+ 	bbp = rt2800_bbp_read(rt2x00dev, 4);
+@@ -10583,6 +10624,7 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+ 
++	rt6352_enable_pa_pin(rt2x00dev, 0);
+ 	rt2800_r_calibration(rt2x00dev);
+ 	rt2800_rf_self_txdc_cal(rt2x00dev);
+ 	rt2800_rxdcoc_calibration(rt2x00dev);
+@@ -10590,6 +10632,22 @@ static void rt2800_init_rfcsr_6352(struc
+ 	rt2800_bw_filter_calibration(rt2x00dev, false);
+ 	rt2800_loft_iq_calibration(rt2x00dev);
+ 	rt2800_rxiq_calibration(rt2x00dev);
++	rt6352_enable_pa_pin(rt2x00dev, 1);
++
++	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
++		rt2800_rfcsr_write_chanreg(rt2x00dev, 18, 0x42);
++		rt2800_bbp_write(rt2x00dev, 75, 0x68);
++		rt2800_bbp_write(rt2x00dev, 76, 0x4C);
++		rt2800_bbp_write(rt2x00dev, 79, 0x1C);
++		rt2800_bbp_write(rt2x00dev, 80, 0x0C);
++		rt2800_bbp_write(rt2x00dev, 82, 0xB6);
++		/* bank 0 RF reg 42 and glrt BBP reg 141 will be set in config
++		 * channel function in dependence of channel and HT20/HT40,
++		 * so don't touch them here.
++		 */
++	}
+ }
+ 
+ static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -28,6 +28,7 @@
+ #include <linux/average.h>
+ #include <linux/usb.h>
+ #include <linux/clk.h>
++#include <linux/pinctrl/consumer.h>
+ #include <linux/rt2x00_platform.h>
+ 
+ #include <net/mac80211.h>
+@@ -1029,6 +1030,11 @@ struct rt2x00_dev {
+ 
+ 	/* Clock for System On Chip devices. */
+ 	struct clk *clk;
++
++	/* pinctrl and states for System On Chip devices with PA/LNA. */
++	struct pinctrl *pinctrl;
++	struct pinctrl_state *pins_default;
++	struct pinctrl_state *pins_pa_gpio;
+ };
+ 
+ struct rt2x00_bar_list_entry {
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00soc.c
+@@ -97,6 +97,21 @@ int rt2x00soc_probe(struct platform_devi
+ 	if (retval)
+ 		goto exit_free_reg;
+ 
++	rt2x00dev->pinctrl = devm_pinctrl_get(&pdev->dev);
++	if (IS_ERR(rt2x00dev->pinctrl)) {
++		rt2x00dev->pinctrl = NULL;
++		rt2x00dev->pins_default = NULL;
++		rt2x00dev->pins_pa_gpio = NULL;
++	} else {
++		rt2x00dev->pins_default = pinctrl_lookup_state(rt2x00dev->pinctrl, "default");
++		if (IS_ERR(rt2x00dev->pins_default))
++			rt2x00dev->pins_default = NULL;
++
++		rt2x00dev->pins_pa_gpio = pinctrl_lookup_state(rt2x00dev->pinctrl, "pa_gpio");
++		if (IS_ERR(rt2x00dev->pins_pa_gpio))
++			rt2x00dev->pins_pa_gpio = NULL;
++	}
++
+ 	return 0;
+ 
+ exit_free_reg:

package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
-@@ -1042,6 +1042,11 @@
+@@ -1044,6 +1044,11 @@
  #define MIMO_PS_CFG_RX_STBY_POL		FIELD32(0x00000010)
  #define MIMO_PS_CFG_RX_RX_STBY0		FIELD32(0x00000020)
  
@@ -14,7 +14,7 @@
   */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3698,14 +3698,16 @@ static void rt2800_config_channel_rf7620
+@@ -3778,14 +3778,16 @@ static void rt2800_config_channel_rf7620
  	rt2x00_set_field8(&rfcsr, RFCSR19_K, rf->rf4);
  	rt2800_rfcsr_write(rt2x00dev, 19, rfcsr);
  
@@ -39,7 +39,7 @@
  
  	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
  	rt2x00_set_field8(&rfcsr, RFCSR1_TX2_EN_MT7620,
-@@ -3739,18 +3741,23 @@ static void rt2800_config_channel_rf7620
+@@ -3819,18 +3821,23 @@ static void rt2800_config_channel_rf7620
  		rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x20);
  	}
  
@@ -73,9 +73,9 @@
  
  	if (!test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags)) {
  		if (conf_is_ht40(conf)) {
-@@ -3850,25 +3857,29 @@ static void rt2800_config_alc(struct rt2
- 	if (i == 10000)
- 		rt2x00_warn(rt2x00dev, "Wait MAC Status to MAX !!!\n");
+@@ -3929,25 +3936,29 @@ static void rt2800_config_alc(struct rt2
+ 	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
+ 		rt2x00_warn(rt2x00dev, "RF busy while configuring ALC\n");
  
 -	if (chan->center_freq > 2457) {
 -		bbp = rt2800_bbp_read(rt2x00dev, 30);
@@ -121,12 +121,12 @@
  	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, mac_sys_ctrl);
  
  	rt2800_vco_calibration(rt2x00dev);
-@@ -5906,18 +5917,33 @@ static int rt2800_init_registers(struct
+@@ -6011,18 +6022,33 @@ static int rt2800_init_registers(struct
  	} else if (rt2x00_rt(rt2x00dev, RT5350)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
  	} else if (rt2x00_rt(rt2x00dev, RT6352)) {
 -		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
--		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
+-		rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
 -		rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
 -		rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
 -		rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
@@ -150,7 +150,7 @@
 +					      0x00550055);
 +		} else {
 +			rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
-+			rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0000);
++			rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
 +			rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
 +			rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
 +			rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
@@ -167,7 +167,7 @@
  		reg = rt2800_register_read(rt2x00dev, TX_ALC_CFG_1);
  		rt2x00_set_field32(&reg, TX_ALC_CFG_1_ROS_BUSY_EN, 0);
  		rt2800_register_write(rt2x00dev, TX_ALC_CFG_1, reg);
-@@ -7061,14 +7087,16 @@ static void rt2800_init_bbp_6352(struct
+@@ -7127,14 +7153,16 @@ static void rt2800_init_bbp_6352(struct
  	rt2800_bbp_write(rt2x00dev, 188, 0x00);
  	rt2800_bbp_write(rt2x00dev, 189, 0x00);
  
@@ -192,7 +192,7 @@
  
  	/* BBP for G band GLRT function (BBP_128 ~ BBP_221) */
  	rt2800_bbp_glrt_write(rt2x00dev, 0, 0x00);
-@@ -10407,31 +10435,36 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10408,31 +10436,36 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write(rt2x00dev, 42, 0x5B);
  	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
  
@@ -254,7 +254,7 @@
  
  	/* Initialize RF channel register to default value */
  	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x03);
-@@ -10497,63 +10530,71 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10498,63 +10531,71 @@ static void rt2800_init_rfcsr_6352(struc
  
  	rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0xC5);
  
@@ -383,7 +383,7 @@
  
  	/* Initialize RF DC calibration register to default value */
  	rt2800_rfcsr_write_dccal(rt2x00dev, 0, 0x47);
-@@ -10616,12 +10657,17 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10617,12 +10658,17 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 62, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 63, 0x00);
  
@@ -404,5 +404,5 @@
 +		rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
 +	}
  
+ 	rt6352_enable_pa_pin(rt2x00dev, 0);
  	rt2800_r_calibration(rt2x00dev);
- 	rt2800_rf_self_txdc_cal(rt2x00dev);

package/kernel/mac80211/patches/subsys/328-mac80211-do-not-wake-queues-on-a-vif-that-is-being-s.patch

@@ -0,0 +1,38 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sat, 26 Mar 2022 23:58:35 +0100
+Subject: [PATCH] mac80211: do not wake queues on a vif that is being stopped
+
+When a vif is being removed and sdata->bss is cleared, __ieee80211_wake_txqs
+can still be called on it, which crashes as soon as sdata->bss is being
+dereferenced.
+To fix this properly, check for SDATA_STATE_RUNNING before waking queues,
+and take the fq lock when setting it (to ensure that __ieee80211_wake_txqs
+observes the change when running on a different CPU
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -377,7 +377,9 @@ static void ieee80211_do_stop(struct iee
+ 	bool cancel_scan;
+ 	struct cfg80211_nan_func *func;
+ 
++	spin_lock_bh(&local->fq.lock);
+ 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
++	spin_unlock_bh(&local->fq.lock);
+ 
+ 	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+ 	if (cancel_scan)
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -301,6 +301,9 @@ static void __ieee80211_wake_txqs(struct
+ 	local_bh_disable();
+ 	spin_lock(&fq->lock);
+ 
++	if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
++		goto out;
++
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP)
+ 		ps = &sdata->bss->ps;
+ 

package/kernel/mac80211/patches/subsys/340-wifi-mac80211-do-not-abuse-fq.lock-in-ieee80211_do_s.patch

@@ -0,0 +1,46 @@
+From aa40d5a43526cca9439a2b45fcfdcd016594dece Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Date: Sun, 17 Jul 2022 21:21:52 +0900
+Subject: [PATCH] wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+lockdep complains use of uninitialized spinlock at ieee80211_do_stop() [1],
+for commit f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif
+that is being stopped") guards clear_bit() using fq.lock even before
+fq_init() from ieee80211_txq_setup_flows() initializes this spinlock.
+
+According to discussion [2], Toke was not happy with expanding usage of
+fq.lock. Since __ieee80211_wake_txqs() is called under RCU read lock, we
+can instead use synchronize_rcu() for flushing ieee80211_wake_txqs().
+
+Link: https://syzkaller.appspot.com/bug?extid=eceab52db7c4b961e9d6 [1]
+Link: https://lkml.kernel.org/r/874k0zowh2.fsf@toke.dk [2]
+Reported-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Fixes: f856373e2f31ffd3 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
+Tested-by: syzbot <syzbot+eceab52db7c4b961e9d6@syzkaller.appspotmail.com>
+Acked-by: Toke Høiland-Jørgensen <toke@kernel.org>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/9cc9b81d-75a3-3925-b612-9d0ad3cab82b@I-love.SAKURA.ne.jp
+[ pick up commit 3598cb6e1862 ("wifi: mac80211: do not abuse fq.lock in ieee80211_do_stop()") from -next]
+Link: https://lore.kernel.org/all/87o7xcq6qt.fsf@kernel.org/
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ net/mac80211/iface.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -377,9 +377,8 @@ static void ieee80211_do_stop(struct iee
+ 	bool cancel_scan;
+ 	struct cfg80211_nan_func *func;
+ 
+-	spin_lock_bh(&local->fq.lock);
+ 	clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+-	spin_unlock_bh(&local->fq.lock);
++	synchronize_rcu(); /* flush _ieee80211_wake_txqs() */
+ 
+ 	cancel_scan = rcu_access_pointer(local->scan_sdata) == sdata;
+ 	if (cancel_scan)

package/kernel/mac80211/patches/subsys/341-mac80211-Fix-deadlock-Don-t-start-TX-while-holding-f.patch

@@ -0,0 +1,40 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Thu, 15 Sep 2022 14:41:20 +0200
+Subject: [PATCH] mac80211: Fix deadlock: Don't start TX while holding
+ fq->lock
+
+ieee80211_txq_purge() calls fq_tin_reset() and
+ieee80211_purge_tx_queue(); Both are then calling
+ieee80211_free_txskb(). Which can decide to TX the skb again.
+
+There are at least two ways to get a deadlock:
+
+1) When we have a TDLS teardown packet queued in either tin or frags
+   ieee80211_tdls_td_tx_handle() will call ieee80211_subif_start_xmit()
+   while we still hold fq->lock. ieee80211_txq_enqueue() will thus
+   deadlock.
+
+2) A variant of the above happens if aggregation is up and running:
+   In that case ieee80211_iface_work() will deadlock with the original
+   task: The original tasks already holds fq->lock and tries to get
+   sta->lock after kicking off ieee80211_iface_work(). But the worker
+   can get sta->lock prior to the original task and will then spin for
+   fq->lock.
+
+Avoid these deadlocks by not sending out any skbs when called via
+ieee80211_free_txskb().
+
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+---
+
+--- a/net/mac80211/status.c
++++ b/net/mac80211/status.c
+@@ -698,7 +698,7 @@ static void ieee80211_report_used_skb(st
+ 
+ 		if (!sdata) {
+ 			skb->dev = NULL;
+-		} else {
++		} else if (!dropped) {
+ 			unsigned int hdr_size =
+ 				ieee80211_hdrlen(hdr->frame_control);
+ 

package/kernel/mac80211/patches/subsys/342-mac80211-Ensure-vif-queues-are-operational-after-sta.patch

@@ -0,0 +1,47 @@
+From: Alexander Wetzel <alexander@wetzel-home.de>
+Date: Thu, 15 Sep 2022 15:09:46 +0200
+Subject: [PATCH] mac80211: Ensure vif queues are operational after start
+
+Make sure local->queue_stop_reasons and vif.txqs_stopped stay in sync.
+
+When a new vif is created the queues may end up in an inconsistent state
+and be inoperable:
+Communication not using iTXQ will work, allowing to e.g. complete the
+association. But the 4-way handshake will time out. The sta will not
+send out any skbs queued in iTXQs.
+
+All normal attempts to start the queues will fail when reaching this
+state.
+local->queue_stop_reasons will have marked all queues as operational but
+vif.txqs_stopped will still be set, creating an inconsistent internal
+state.
+
+In reality this seems to be race between the mac80211 function
+ieee80211_do_open() setting SDATA_STATE_RUNNING and the wake_txqs_tasklet:
+Depending on the driver and the timing the queues may end up to be
+operational or not.
+
+Cc: stable@vger.kernel.org
+Fixes: f856373e2f31 ("wifi: mac80211: do not wake queues on a vif that is being stopped")
+Signed-off-by: Alexander Wetzel <alexander@wetzel-home.de>
+---
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -301,14 +301,14 @@ static void __ieee80211_wake_txqs(struct
+ 	local_bh_disable();
+ 	spin_lock(&fq->lock);
+ 
++	sdata->vif.txqs_stopped[ac] = false;
++
+ 	if (!test_bit(SDATA_STATE_RUNNING, &sdata->state))
+ 		goto out;
+ 
+ 	if (sdata->vif.type == NL80211_IFTYPE_AP)
+ 		ps = &sdata->bss->ps;
+ 
+-	sdata->vif.txqs_stopped[ac] = false;
+-
+ 	list_for_each_entry_rcu(sta, &local->sta_list, list) {
+ 		if (sdata != sta->sdata)
+ 			continue;

package/kernel/mac80211/patches/subsys/346-mac80211-mesh-clean-up-rx_bcn_presp-API.patch

@@ -0,0 +1,110 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 20 Sep 2021 15:40:07 +0200
+Subject: [PATCH] mac80211: mesh: clean up rx_bcn_presp API
+
+commit a5b983c6073140b624f64e79fea6d33c3e4315a0 upstream.
+
+We currently pass the entire elements to the rx_bcn_presp()
+method, but only need mesh_config. Additionally, we use the
+length of the elements to calculate back the entire frame's
+length, but that's confusing - just pass the length of the
+frame instead.
+
+Link: https://lore.kernel.org/r/20210920154009.a18ed3d2da6c.I1824b773a0fbae4453e1433c184678ca14e8df45@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -645,10 +645,9 @@ struct ieee80211_if_ocb {
+  */
+ struct ieee802_11_elems;
+ struct ieee80211_mesh_sync_ops {
+-	void (*rx_bcn_presp)(struct ieee80211_sub_if_data *sdata,
+-			     u16 stype,
+-			     struct ieee80211_mgmt *mgmt,
+-			     struct ieee802_11_elems *elems,
++	void (*rx_bcn_presp)(struct ieee80211_sub_if_data *sdata, u16 stype,
++			     struct ieee80211_mgmt *mgmt, unsigned int len,
++			     const struct ieee80211_meshconf_ie *mesh_cfg,
+ 			     struct ieee80211_rx_status *rx_status);
+ 
+ 	/* should be called with beacon_data under RCU read lock */
+--- a/net/mac80211/mesh.c
++++ b/net/mac80211/mesh.c
+@@ -1354,8 +1354,8 @@ static void ieee80211_mesh_rx_bcn_presp(
+ 	}
+ 
+ 	if (ifmsh->sync_ops)
+-		ifmsh->sync_ops->rx_bcn_presp(sdata,
+-			stype, mgmt, &elems, rx_status);
++		ifmsh->sync_ops->rx_bcn_presp(sdata, stype, mgmt, len,
++					      elems.mesh_config, rx_status);
+ }
+ 
+ int ieee80211_mesh_finish_csa(struct ieee80211_sub_if_data *sdata)
+--- a/net/mac80211/mesh_sync.c
++++ b/net/mac80211/mesh_sync.c
+@@ -3,6 +3,7 @@
+  * Copyright 2011-2012, Pavel Zubarev <pavel.zubarev@gmail.com>
+  * Copyright 2011-2012, Marco Porsch <marco.porsch@s2005.tu-chemnitz.de>
+  * Copyright 2011-2012, cozybit Inc.
++ * Copyright (C) 2021 Intel Corporation
+  */
+ 
+ #include "ieee80211_i.h"
+@@ -35,12 +36,12 @@ struct sync_method {
+ /**
+  * mesh_peer_tbtt_adjusting - check if an mp is currently adjusting its TBTT
+  *
+- * @ie: information elements of a management frame from the mesh peer
++ * @cfg: mesh config element from the mesh peer (or %NULL)
+  */
+-static bool mesh_peer_tbtt_adjusting(struct ieee802_11_elems *ie)
++static bool mesh_peer_tbtt_adjusting(const struct ieee80211_meshconf_ie *cfg)
+ {
+-	return (ie->mesh_config->meshconf_cap &
+-			IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING) != 0;
++	return cfg &&
++	       (cfg->meshconf_cap & IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING);
+ }
+ 
+ void mesh_sync_adjust_tsf(struct ieee80211_sub_if_data *sdata)
+@@ -76,11 +77,11 @@ void mesh_sync_adjust_tsf(struct ieee802
+ 	}
+ }
+ 
+-static void mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata,
+-				   u16 stype,
+-				   struct ieee80211_mgmt *mgmt,
+-				   struct ieee802_11_elems *elems,
+-				   struct ieee80211_rx_status *rx_status)
++static void
++mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata, u16 stype,
++			      struct ieee80211_mgmt *mgmt, unsigned int len,
++			      const struct ieee80211_meshconf_ie *mesh_cfg,
++			      struct ieee80211_rx_status *rx_status)
+ {
+ 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+ 	struct ieee80211_local *local = sdata->local;
+@@ -101,10 +102,7 @@ static void mesh_sync_offset_rx_bcn_pres
+ 	 */
+ 	if (ieee80211_have_rx_timestamp(rx_status))
+ 		t_r = ieee80211_calculate_rx_timestamp(local, rx_status,
+-						       24 + 12 +
+-						       elems->total_len +
+-						       FCS_LEN,
+-						       24);
++						       len + FCS_LEN, 24);
+ 	else
+ 		t_r = drv_get_tsf(local, sdata);
+ 
+@@ -119,7 +117,7 @@ static void mesh_sync_offset_rx_bcn_pres
+ 	 * dot11MeshNbrOffsetMaxNeighbor non-peer non-MBSS neighbors
+ 	 */
+ 
+-	if (elems->mesh_config && mesh_peer_tbtt_adjusting(elems)) {
++	if (mesh_peer_tbtt_adjusting(mesh_cfg)) {
+ 		msync_dbg(sdata, "STA %pM : is adjusting TBTT\n",
+ 			  sta->sta.addr);
+ 		goto no_sync;

package/kernel/mac80211/patches/subsys/347-mac80211-move-CRC-into-struct-ieee802_11_elems.patch

@@ -0,0 +1,82 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 20 Sep 2021 15:40:08 +0200
+Subject: [PATCH] mac80211: move CRC into struct ieee802_11_elems
+
+commit c6e37ed498f958254b5459253199e816b6bfc52f upstream.
+
+We're currently returning this value, but to prepare for
+returning the allocated structure, move it into there.
+
+Link: https://lore.kernel.org/r/20210920154009.479b8ebf999d.If0d4ba75ee38998dc3eeae25058aa748efcb2fc9@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1530,6 +1530,7 @@ struct ieee80211_csa_ie {
+ struct ieee802_11_elems {
+ 	const u8 *ie_start;
+ 	size_t total_len;
++	u32 crc;
+ 
+ 	/* pointers to IEs */
+ 	const struct ieee80211_tdls_lnkie *lnk_id;
+@@ -2089,10 +2090,10 @@ static inline void ieee80211_tx_skb(stru
+ 	ieee80211_tx_skb_tid(sdata, skb, 7);
+ }
+ 
+-u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+-			       struct ieee802_11_elems *elems,
+-			       u64 filter, u32 crc, u8 *transmitter_bssid,
+-			       u8 *bss_bssid);
++void ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
++				struct ieee802_11_elems *elems,
++				u64 filter, u32 crc, u8 *transmitter_bssid,
++				u8 *bss_bssid);
+ static inline void ieee802_11_parse_elems(const u8 *start, size_t len,
+ 					  bool action,
+ 					  struct ieee802_11_elems *elems,
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -4102,10 +4102,11 @@ static void ieee80211_rx_mgmt_beacon(str
+ 	 */
+ 	if (!ieee80211_is_s1g_beacon(hdr->frame_control))
+ 		ncrc = crc32_be(0, (void *)&mgmt->u.beacon.beacon_int, 4);
+-	ncrc = ieee802_11_parse_elems_crc(variable,
+-					  len - baselen, false, &elems,
+-					  care_about_ies, ncrc,
+-					  mgmt->bssid, bssid);
++	ieee802_11_parse_elems_crc(variable,
++				   len - baselen, false, &elems,
++				   care_about_ies, ncrc,
++				   mgmt->bssid, bssid);
++	ncrc = elems.crc;
+ 
+ 	if (ieee80211_hw_check(&local->hw, PS_NULLFUNC_STACK) &&
+ 	    ieee80211_check_tim(elems.tim, elems.tim_len, bss_conf->aid)) {
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1469,10 +1469,10 @@ static size_t ieee802_11_find_bssid_prof
+ 	return found ? profile_len : 0;
+ }
+ 
+-u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
+-			       struct ieee802_11_elems *elems,
+-			       u64 filter, u32 crc, u8 *transmitter_bssid,
+-			       u8 *bss_bssid)
++void ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action,
++				struct ieee802_11_elems *elems,
++				u64 filter, u32 crc, u8 *transmitter_bssid,
++				u8 *bss_bssid)
+ {
+ 	const struct element *non_inherit = NULL;
+ 	u8 *nontransmitted_profile;
+@@ -1524,7 +1524,7 @@ u32 ieee802_11_parse_elems_crc(const u8
+ 
+ 	kfree(nontransmitted_profile);
+ 
+-	return crc;
++	elems->crc = crc;
+ }
+ 
+ void ieee80211_regulatory_limit_wmm_params(struct ieee80211_sub_if_data *sdata,

package/kernel/mac80211/patches/subsys/348-mac80211-mlme-find-auth-challenge-directly.patch

@@ -0,0 +1,80 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Mon, 20 Sep 2021 15:40:09 +0200
+Subject: [PATCH] mac80211: mlme: find auth challenge directly
+
+commit 49a765d6785e99157ff5091cc37485732496864e upstream.
+
+There's no need to parse all elements etc. just to find the
+authentication challenge - use cfg80211_find_elem() instead.
+This also allows us to remove WLAN_EID_CHALLENGE handling
+from the element parsing entirely.
+
+Link: https://lore.kernel.org/r/20210920154009.45f9b3a15722.Ice3159ffad03a007d6154cbf1fb3a8c48489e86f@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1540,7 +1540,6 @@ struct ieee802_11_elems {
+ 	const u8 *supp_rates;
+ 	const u8 *ds_params;
+ 	const struct ieee80211_tim_ie *tim;
+-	const u8 *challenge;
+ 	const u8 *rsn;
+ 	const u8 *rsnx;
+ 	const u8 *erp_info;
+@@ -1594,7 +1593,6 @@ struct ieee802_11_elems {
+ 	u8 ssid_len;
+ 	u8 supp_rates_len;
+ 	u8 tim_len;
+-	u8 challenge_len;
+ 	u8 rsn_len;
+ 	u8 rsnx_len;
+ 	u8 ext_supp_rates_len;
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2889,17 +2889,17 @@ static void ieee80211_auth_challenge(str
+ {
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
++	const struct element *challenge;
+ 	u8 *pos;
+-	struct ieee802_11_elems elems;
+ 	u32 tx_flags = 0;
+ 	struct ieee80211_prep_tx_info info = {
+ 		.subtype = IEEE80211_STYPE_AUTH,
+ 	};
+ 
+ 	pos = mgmt->u.auth.variable;
+-	ieee802_11_parse_elems(pos, len - (pos - (u8 *)mgmt), false, &elems,
+-			       mgmt->bssid, auth_data->bss->bssid);
+-	if (!elems.challenge)
++	challenge = cfg80211_find_elem(WLAN_EID_CHALLENGE, pos,
++				       len - (pos - (u8 *)mgmt));
++	if (!challenge)
+ 		return;
+ 	auth_data->expected_transaction = 4;
+ 	drv_mgd_prepare_tx(sdata->local, sdata, &info);
+@@ -2907,7 +2907,8 @@ static void ieee80211_auth_challenge(str
+ 		tx_flags = IEEE80211_TX_CTL_REQ_TX_STATUS |
+ 			   IEEE80211_TX_INTFL_MLME_CONN_TX;
+ 	ieee80211_send_auth(sdata, 3, auth_data->algorithm, 0,
+-			    elems.challenge - 2, elems.challenge_len + 2,
++			    (void *)challenge,
++			    challenge->datalen + sizeof(*challenge),
+ 			    auth_data->bss->bssid, auth_data->bss->bssid,
+ 			    auth_data->key, auth_data->key_len,
+ 			    auth_data->key_idx, tx_flags);
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1120,10 +1120,6 @@ _ieee802_11_parse_elems_crc(const u8 *st
+ 			} else
+ 				elem_parse_failed = true;
+ 			break;
+-		case WLAN_EID_CHALLENGE:
+-			elems->challenge = pos;
+-			elems->challenge_len = elen;
+-			break;
+ 		case WLAN_EID_VENDOR_SPECIFIC:
+ 			if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
+ 			    pos[2] == 0xf2) {

package/kernel/mac80211/patches/subsys/350-mac80211-fix-memory-leaks-with-element-parsing.patch

@@ -0,0 +1,115 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 1 Oct 2021 21:11:08 +0200
+Subject: [PATCH] mac80211: fix memory leaks with element parsing
+
+commit 8223ac199a3849257e86ec27865dc63f034b1cf1 upstream.
+
+My previous commit 5d24828d05f3 ("mac80211: always allocate
+struct ieee802_11_elems") had a few bugs and leaked the new
+allocated struct in a few error cases, fix that.
+
+Fixes: 5d24828d05f3 ("mac80211: always allocate struct ieee802_11_elems")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Link: https://lore.kernel.org/r/20211001211108.9839928e42e0.Ib81ca187d3d3af7ed1bfeac2e00d08a4637c8025@changeid
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -499,13 +499,14 @@ void ieee80211_process_addba_request(str
+ 		elems = ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable,
+ 					       ies_len, true, mgmt->bssid, NULL);
+ 		if (!elems || elems->parse_error)
+-			return;
++			goto free;
+ 	}
+ 
+ 	__ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
+ 					start_seq_num, ba_policy, tid,
+ 					buf_size, true, false,
+ 					elems ? elems->addba_ext_ie : NULL);
++free:
+ 	kfree(elems);
+ }
+ 
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -1659,11 +1659,11 @@ void ieee80211_ibss_rx_queued_mgmt(struc
+ 				mgmt->u.action.u.chan_switch.variable,
+ 				ies_len, true, mgmt->bssid, NULL);
+ 
+-			if (!elems || elems->parse_error)
+-				break;
+-
+-			ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt, skb->len,
+-							rx_status, elems);
++			if (elems && !elems->parse_error)
++				ieee80211_rx_mgmt_spectrum_mgmt(sdata, mgmt,
++								skb->len,
++								rx_status,
++								elems);
+ 			kfree(elems);
+ 			break;
+ 		}
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3374,8 +3374,10 @@ static bool ieee80211_assoc_success(stru
+ 			bss_ies = kmemdup(ies, sizeof(*ies) + ies->len,
+ 					  GFP_ATOMIC);
+ 		rcu_read_unlock();
+-		if (!bss_ies)
+-			return false;
++		if (!bss_ies) {
++			ret = false;
++			goto out;
++		}
+ 
+ 		bss_elems = ieee802_11_parse_elems(bss_ies->data, bss_ies->len,
+ 						   false, mgmt->bssid,
+@@ -4358,13 +4360,11 @@ void ieee80211_sta_rx_queued_mgmt(struct
+ 					mgmt->u.action.u.chan_switch.variable,
+ 					ies_len, true, mgmt->bssid, NULL);
+ 
+-			if (!elems || elems->parse_error)
+-				break;
+-
+-			ieee80211_sta_process_chanswitch(sdata,
+-						 rx_status->mactime,
+-						 rx_status->device_timestamp,
+-						 elems, false);
++			if (elems && !elems->parse_error)
++				ieee80211_sta_process_chanswitch(sdata,
++								 rx_status->mactime,
++								 rx_status->device_timestamp,
++								 elems, false);
+ 			kfree(elems);
+ 		} else if (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC) {
+ 			struct ieee802_11_elems *elems;
+@@ -4384,17 +4384,17 @@ void ieee80211_sta_rx_queued_mgmt(struct
+ 					mgmt->u.action.u.ext_chan_switch.variable,
+ 					ies_len, true, mgmt->bssid, NULL);
+ 
+-			if (!elems || elems->parse_error)
+-				break;
++			if (elems && !elems->parse_error) {
++				/* for the handling code pretend it was an IE */
++				elems->ext_chansw_ie =
++					&mgmt->u.action.u.ext_chan_switch.data;
++
++				ieee80211_sta_process_chanswitch(sdata,
++								 rx_status->mactime,
++								 rx_status->device_timestamp,
++								 elems, false);
++			}
+ 
+-			/* for the handling code pretend this was also an IE */
+-			elems->ext_chansw_ie =
+-				&mgmt->u.action.u.ext_chan_switch.data;
+-
+-			ieee80211_sta_process_chanswitch(sdata,
+-						 rx_status->mactime,
+-						 rx_status->device_timestamp,
+-						 elems, false);
+ 			kfree(elems);
+ 		}
+ 		break;

package/kernel/mac80211/patches/subsys/351-wifi-cfg80211-fix-u8-overflow-in-cfg80211_update_not.patch

@@ -0,0 +1,41 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 28 Sep 2022 21:56:15 +0200
+Subject: [PATCH] wifi: cfg80211: fix u8 overflow in
+ cfg80211_update_notlisted_nontrans()
+
+commit aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d upstream.
+
+In the copy code of the elements, we do the following calculation
+to reach the end of the MBSSID element:
+
+	/* copy the IEs after MBSSID */
+	cpy_len = mbssid[1] + 2;
+
+This looks fine, however, cpy_len is a u8, the same as mbssid[1],
+so the addition of two can overflow. In this case the subsequent
+memcpy() will overflow the allocated buffer, since it copies 256
+bytes too much due to the way the allocation and memcpy() sizes
+are calculated.
+
+Fix this by using size_t for the cpy_len variable.
+
+This fixes CVE-2022-41674.
+
+Reported-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
+Tested-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -2238,7 +2238,7 @@ cfg80211_update_notlisted_nontrans(struc
+ 	size_t new_ie_len;
+ 	struct cfg80211_bss_ies *new_ies;
+ 	const struct cfg80211_bss_ies *old;
+-	u8 cpy_len;
++	size_t cpy_len;
+ 
+ 	lockdep_assert_held(&wiphy_to_rdev(wiphy)->bss_lock);
+ 

package/kernel/mac80211/patches/subsys/352-wifi-cfg80211-mac80211-reject-bad-MBSSID-elements.patch

@@ -0,0 +1,47 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 28 Sep 2022 22:01:37 +0200
+Subject: [PATCH] wifi: cfg80211/mac80211: reject bad MBSSID elements
+
+commit 8f033d2becc24aa6bfd2a5c104407963560caabc upstream
+
+Per spec, the maximum value for the MaxBSSID ('n') indicator is 8,
+and the minimum is 1 since a multiple BSSID set with just one BSSID
+doesn't make sense (the # of BSSIDs is limited by 2^n).
+
+Limit this in the parsing in both cfg80211 and mac80211, rejecting
+any elements with an invalid value.
+
+This fixes potentially bad shifts in the processing of these inside
+the cfg80211_gen_new_bssid() function later.
+
+I found this during the investigation of CVE-2022-41674 fixed by the
+previous patch.
+
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Fixes: 78ac51f81532 ("mac80211: support multi-bssid")
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1413,6 +1413,8 @@ static size_t ieee802_11_find_bssid_prof
+ 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) {
+ 		if (elem->datalen < 2)
+ 			continue;
++		if (elem->data[0] < 1 || elem->data[0] > 8)
++			continue;
+ 
+ 		for_each_element(sub, elem->data + 1, elem->datalen - 1) {
+ 			u8 new_bssid[ETH_ALEN];
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -2103,6 +2103,8 @@ static void cfg80211_parse_mbssid_data(s
+ 	for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, ie, ielen) {
+ 		if (elem->datalen < 4)
+ 			continue;
++		if (elem->data[0] < 1 || (int)elem->data[0] > 8)
++			continue;
+ 		for_each_element(sub, elem->data + 1, elem->datalen - 1) {
+ 			u8 profile_len;
+ 

package/kernel/mac80211/patches/subsys/353-wifi-mac80211-fix-MBSSID-parsing-use-after-free.patch

@@ -0,0 +1,94 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 28 Sep 2022 22:07:15 +0200
+Subject: [PATCH] wifi: mac80211: fix MBSSID parsing use-after-free
+
+commit ff05d4b45dd89b922578dac497dcabf57cf771c6
+
+When we parse a multi-BSSID element, we might point some
+element pointers into the allocated nontransmitted_profile.
+However, we free this before returning, causing UAF when the
+relevant pointers in the parsed elements are accessed.
+
+Fix this by not allocating the scratch buffer separately but
+as part of the returned structure instead, that way, there
+are no lifetime issues with it.
+
+The scratch buffer introduction as part of the returned data
+here is taken from MLO feature work done by Ilan.
+
+This fixes CVE-2022-42719.
+
+Fixes: 5023b14cf4df ("mac80211: support profile split between elements")
+Co-developed-by: Ilan Peer <ilan.peer@intel.com>
+Signed-off-by: Ilan Peer <ilan.peer@intel.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1611,6 +1611,14 @@ struct ieee802_11_elems {
+ 
+ 	/* whether a parse error occurred while retrieving these elements */
+ 	bool parse_error;
++
++	/*
++	 * scratch buffer that can be used for various element parsing related
++	 * tasks, e.g., element de-fragmentation etc.
++	 */
++	size_t scratch_len;
++	u8 *scratch_pos;
++	u8 scratch[];
+ };
+ 
+ static inline struct ieee80211_local *hw_to_local(
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -1478,24 +1478,25 @@ struct ieee802_11_elems *ieee802_11_pars
+ 	u8 *nontransmitted_profile;
+ 	int nontransmitted_profile_len = 0;
+ 
+-	elems = kzalloc(sizeof(*elems), GFP_ATOMIC);
++	elems = kzalloc(sizeof(*elems) + len, GFP_ATOMIC);
+ 	if (!elems)
+ 		return NULL;
+ 	elems->ie_start = start;
+ 	elems->total_len = len;
+ 
+-	nontransmitted_profile = kmalloc(len, GFP_ATOMIC);
+-	if (nontransmitted_profile) {
+-		nontransmitted_profile_len =
+-			ieee802_11_find_bssid_profile(start, len, elems,
+-						      transmitter_bssid,
+-						      bss_bssid,
+-						      nontransmitted_profile);
+-		non_inherit =
+-			cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
+-					       nontransmitted_profile,
+-					       nontransmitted_profile_len);
+-	}
++	elems->scratch_len = len;
++	elems->scratch_pos = elems->scratch;
++
++	nontransmitted_profile = elems->scratch_pos;
++	nontransmitted_profile_len =
++		ieee802_11_find_bssid_profile(start, len, elems,
++					      transmitter_bssid,
++					      bss_bssid,
++					      nontransmitted_profile);
++	non_inherit =
++		cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
++				       nontransmitted_profile,
++				       nontransmitted_profile_len);
+ 
+ 	crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter,
+ 					  crc, non_inherit);
+@@ -1524,8 +1525,6 @@ struct ieee802_11_elems *ieee802_11_pars
+ 	    offsetofend(struct ieee80211_bssid_index, dtim_count))
+ 		elems->dtim_count = elems->bssid_index->dtim_count;
+ 
+-	kfree(nontransmitted_profile);
+-
+ 	elems->crc = crc;
+ 
+ 	return elems;

package/kernel/mac80211/patches/subsys/354-wifi-cfg80211-ensure-length-byte-is-present-before-a.patch

@@ -0,0 +1,41 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Thu, 29 Sep 2022 21:50:44 +0200
+Subject: [PATCH] wifi: cfg80211: ensure length byte is present before
+ access
+
+commit 567e14e39e8f8c6997a1378bc3be615afca86063 upstream.
+
+When iterating the elements here, ensure the length byte is
+present before checking it to see if the entire element will
+fit into the buffer.
+
+Longer term, we should rewrite this code using the type-safe
+element iteration macros that check all of this.
+
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Reported-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -304,7 +304,8 @@ static size_t cfg80211_gen_new_ie(const
+ 	tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);
+ 	tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;
+ 
+-	while (tmp_old + tmp_old[1] + 2 - ie <= ielen) {
++	while (tmp_old + 2 - ie <= ielen &&
++	       tmp_old + tmp_old[1] + 2 - ie <= ielen) {
+ 		if (tmp_old[0] == 0) {
+ 			tmp_old++;
+ 			continue;
+@@ -364,7 +365,8 @@ static size_t cfg80211_gen_new_ie(const
+ 	 * copied to new ie, skip ssid, capability, bssid-index ie
+ 	 */
+ 	tmp_new = sub_copy;
+-	while (tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
++	while (tmp_new + 2 - sub_copy <= subie_len &&
++	       tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {
+ 		if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||
+ 		      tmp_new[0] == WLAN_EID_SSID)) {
+ 			memcpy(pos, tmp_new, tmp_new[1] + 2);

package/kernel/mac80211/patches/subsys/355-wifi-cfg80211-fix-BSS-refcounting-bugs.patch

@@ -0,0 +1,87 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Fri, 30 Sep 2022 23:44:23 +0200
+Subject: [PATCH] wifi: cfg80211: fix BSS refcounting bugs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 0b7808818cb9df6680f98996b8e9a439fa7bcc2f upstream.
+
+There are multiple refcounting bugs related to multi-BSSID:
+ - In bss_ref_get(), if the BSS has a hidden_beacon_bss, then
+   the bss pointer is overwritten before checking for the
+   transmitted BSS, which is clearly wrong. Fix this by using
+   the bss_from_pub() macro.
+
+ - In cfg80211_bss_update() we copy the transmitted_bss pointer
+   from tmp into new, but then if we release new, we'll unref
+   it erroneously. We already set the pointer and ref it, but
+   need to NULL it since it was copied from the tmp data.
+
+ - In cfg80211_inform_single_bss_data(), if adding to the non-
+   transmitted list fails, we unlink the BSS and yet still we
+   return it, but this results in returning an entry without
+   a reference. We shouldn't return it anyway if it was broken
+   enough to not get added there.
+
+This fixes CVE-2022-42720.
+
+Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Fixes: a3584f56de1c ("cfg80211: Properly track transmitting and non-transmitting BSS")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -143,18 +143,12 @@ static inline void bss_ref_get(struct cf
+ 	lockdep_assert_held(&rdev->bss_lock);
+ 
+ 	bss->refcount++;
+-	if (bss->pub.hidden_beacon_bss) {
+-		bss = container_of(bss->pub.hidden_beacon_bss,
+-				   struct cfg80211_internal_bss,
+-				   pub);
+-		bss->refcount++;
+-	}
+-	if (bss->pub.transmitted_bss) {
+-		bss = container_of(bss->pub.transmitted_bss,
+-				   struct cfg80211_internal_bss,
+-				   pub);
+-		bss->refcount++;
+-	}
++
++	if (bss->pub.hidden_beacon_bss)
++		bss_from_pub(bss->pub.hidden_beacon_bss)->refcount++;
++
++	if (bss->pub.transmitted_bss)
++		bss_from_pub(bss->pub.transmitted_bss)->refcount++;
+ }
+ 
+ static inline void bss_ref_put(struct cfg80211_registered_device *rdev,
+@@ -1743,6 +1737,8 @@ cfg80211_bss_update(struct cfg80211_regi
+ 		new->refcount = 1;
+ 		INIT_LIST_HEAD(&new->hidden_list);
+ 		INIT_LIST_HEAD(&new->pub.nontrans_list);
++		/* we'll set this later if it was non-NULL */
++		new->pub.transmitted_bss = NULL;
+ 
+ 		if (rcu_access_pointer(tmp->pub.proberesp_ies)) {
+ 			hidden = rb_find_bss(rdev, tmp, BSS_CMP_HIDE_ZLEN);
+@@ -1983,10 +1979,15 @@ cfg80211_inform_single_bss_data(struct w
+ 		spin_lock_bh(&rdev->bss_lock);
+ 		if (cfg80211_add_nontrans_list(non_tx_data->tx_bss,
+ 					       &res->pub)) {
+-			if (__cfg80211_unlink_bss(rdev, res))
++			if (__cfg80211_unlink_bss(rdev, res)) {
+ 				rdev->bss_generation++;
++				res = NULL;
++			}
+ 		}
+ 		spin_unlock_bh(&rdev->bss_lock);
++
++		if (!res)
++			return NULL;
+ 	}
+ 
+ 	trace_cfg80211_return_bss(&res->pub);

package/kernel/mac80211/patches/subsys/356-wifi-cfg80211-avoid-nontransmitted-BSS-list-corrupti.patch

@@ -0,0 +1,48 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Sat, 1 Oct 2022 00:01:44 +0200
+Subject: [PATCH] wifi: cfg80211: avoid nontransmitted BSS list
+ corruption
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit bcca852027e5878aec911a347407ecc88d6fff7f upstream.
+
+If a non-transmitted BSS shares enough information (both
+SSID and BSSID!) with another non-transmitted BSS of a
+different AP, then we can find and update it, and then
+try to add it to the non-transmitted BSS list. We do a
+search for it on the transmitted BSS, but if it's not
+there (but belongs to another transmitted BSS), the list
+gets corrupted.
+
+Since this is an erroneous situation, simply fail the
+list insertion in this case and free the non-transmitted
+BSS.
+
+This fixes CVE-2022-42721.
+
+Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -425,6 +425,15 @@ cfg80211_add_nontrans_list(struct cfg802
+ 
+ 	rcu_read_unlock();
+ 
++	/*
++	 * This is a bit weird - it's not on the list, but already on another
++	 * one! The only way that could happen is if there's some BSSID/SSID
++	 * shared by multiple APs in their multi-BSSID profiles, potentially
++	 * with hidden SSID mixed in ... ignore it.
++	 */
++	if (!list_empty(&nontrans_bss->nontrans_list))
++		return -EINVAL;
++
+ 	/* add to the list */
+ 	list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
+ 	return 0;

package/kernel/mac80211/patches/subsys/357-wifi-mac80211_hwsim-avoid-mac80211-warning-on-bad-ra.patch

@@ -0,0 +1,31 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 5 Oct 2022 15:10:09 +0200
+Subject: [PATCH] wifi: mac80211_hwsim: avoid mac80211 warning on bad
+ rate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 1833b6f46d7e2830251a063935ab464256defe22 upstream.
+
+If the tool on the other side (e.g. wmediumd) gets confused
+about the rate, we hit a warning in mac80211. Silence that
+by effectively duplicating the check here and dropping the
+frame silently (in mac80211 it's dropped with the warning).
+
+Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3760,6 +3760,8 @@ static int hwsim_cloned_frame_received_n
+ 
+ 	rx_status.band = channel->band;
+ 	rx_status.rate_idx = nla_get_u32(info->attrs[HWSIM_ATTR_RX_RATE]);
++	if (rx_status.rate_idx >= data2->hw->wiphy->bands[rx_status.band]->n_bitrates)
++		goto out;
+ 	rx_status.signal = nla_get_u32(info->attrs[HWSIM_ATTR_SIGNAL]);
+ 
+ 	hdr = (void *)skb->data;

package/kernel/mac80211/patches/subsys/358-wifi-mac80211-fix-crash-in-beacon-protection-for-P2P.patch

@@ -0,0 +1,52 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 5 Oct 2022 21:24:10 +0200
+Subject: [PATCH] wifi: mac80211: fix crash in beacon protection for
+ P2P-device
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit b2d03cabe2b2e150ff5a381731ea0355459be09f upstream.
+
+If beacon protection is active but the beacon cannot be
+decrypted or is otherwise malformed, we call the cfg80211
+API to report this to userspace, but that uses a netdev
+pointer, which isn't present for P2P-Device. Fix this to
+call it only conditionally to ensure cfg80211 won't crash
+in the case of P2P-Device.
+
+This fixes CVE-2022-42722.
+
+Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Fixes: 9eaf183af741 ("mac80211: Report beacon protection failures to user space")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1986,10 +1986,11 @@ ieee80211_rx_h_decrypt(struct ieee80211_
+ 
+ 		if (mmie_keyidx < NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS ||
+ 		    mmie_keyidx >= NUM_DEFAULT_KEYS + NUM_DEFAULT_MGMT_KEYS +
+-		    NUM_DEFAULT_BEACON_KEYS) {
+-			cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
+-						     skb->data,
+-						     skb->len);
++				   NUM_DEFAULT_BEACON_KEYS) {
++			if (rx->sdata->dev)
++				cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
++							     skb->data,
++							     skb->len);
+ 			return RX_DROP_MONITOR; /* unexpected BIP keyidx */
+ 		}
+ 
+@@ -2137,7 +2138,8 @@ ieee80211_rx_h_decrypt(struct ieee80211_
+ 	/* either the frame has been decrypted or will be dropped */
+ 	status->flag |= RX_FLAG_DECRYPTED;
+ 
+-	if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE))
++	if (unlikely(ieee80211_is_beacon(fc) && result == RX_DROP_UNUSABLE &&
++		     rx->sdata->dev))
+ 		cfg80211_rx_unprot_mlme_mgmt(rx->sdata->dev,
+ 					     skb->data, skb->len);
+ 

package/kernel/mac80211/patches/subsys/359-wifi-cfg80211-update-hidden-BSSes-to-avoid-WARN_ON.patch

@@ -0,0 +1,85 @@
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 5 Oct 2022 23:11:43 +0200
+Subject: [PATCH] wifi: cfg80211: update hidden BSSes to avoid WARN_ON
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit c90b93b5b782891ebfda49d4e5da36632fefd5d1 upstream.
+
+When updating beacon elements in a non-transmitted BSS,
+also update the hidden sub-entries to the same beacon
+elements, so that a future update through other paths
+won't trigger a WARN_ON().
+
+The warning is triggered because the beacon elements in
+the hidden BSSes that are children of the BSS should
+always be the same as in the parent.
+
+Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
+Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/wireless/scan.c
++++ b/net/wireless/scan.c
+@@ -1609,6 +1609,23 @@ struct cfg80211_non_tx_bss {
+ 	u8 bssid_index;
+ };
+ 
++static void cfg80211_update_hidden_bsses(struct cfg80211_internal_bss *known,
++					 const struct cfg80211_bss_ies *new_ies,
++					 const struct cfg80211_bss_ies *old_ies)
++{
++	struct cfg80211_internal_bss *bss;
++
++	/* Assign beacon IEs to all sub entries */
++	list_for_each_entry(bss, &known->hidden_list, hidden_list) {
++		const struct cfg80211_bss_ies *ies;
++
++		ies = rcu_access_pointer(bss->pub.beacon_ies);
++		WARN_ON(ies != old_ies);
++
++		rcu_assign_pointer(bss->pub.beacon_ies, new_ies);
++	}
++}
++
+ static bool
+ cfg80211_update_known_bss(struct cfg80211_registered_device *rdev,
+ 			  struct cfg80211_internal_bss *known,
+@@ -1632,7 +1649,6 @@ cfg80211_update_known_bss(struct cfg8021
+ 			kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
+ 	} else if (rcu_access_pointer(new->pub.beacon_ies)) {
+ 		const struct cfg80211_bss_ies *old;
+-		struct cfg80211_internal_bss *bss;
+ 
+ 		if (known->pub.hidden_beacon_bss &&
+ 		    !list_empty(&known->hidden_list)) {
+@@ -1660,16 +1676,7 @@ cfg80211_update_known_bss(struct cfg8021
+ 		if (old == rcu_access_pointer(known->pub.ies))
+ 			rcu_assign_pointer(known->pub.ies, new->pub.beacon_ies);
+ 
+-		/* Assign beacon IEs to all sub entries */
+-		list_for_each_entry(bss, &known->hidden_list, hidden_list) {
+-			const struct cfg80211_bss_ies *ies;
+-
+-			ies = rcu_access_pointer(bss->pub.beacon_ies);
+-			WARN_ON(ies != old);
+-
+-			rcu_assign_pointer(bss->pub.beacon_ies,
+-					   new->pub.beacon_ies);
+-		}
++		cfg80211_update_hidden_bsses(known, new->pub.beacon_ies, old);
+ 
+ 		if (old)
+ 			kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);
+@@ -2319,6 +2326,8 @@ cfg80211_update_notlisted_nontrans(struc
+ 	} else {
+ 		old = rcu_access_pointer(nontrans_bss->beacon_ies);
+ 		rcu_assign_pointer(nontrans_bss->beacon_ies, new_ies);
++		cfg80211_update_hidden_bsses(bss_from_pub(nontrans_bss),
++					     new_ies, old);
+ 		rcu_assign_pointer(nontrans_bss->ies, new_ies);
+ 		if (old)
+ 			kfree_rcu((struct cfg80211_bss_ies *)old, rcu_head);

package/kernel/mac80211/patches/subsys/360-mac80211-fix-a-memory-leak-where-sta_info-is-not-fre.patch

@@ -0,0 +1,77 @@
+From 4db561ae4a90c2d0e15996634567559e292dc9e5 Mon Sep 17 00:00:00 2001
+From: Ahmed Zaki <anzaki@gmail.com>
+Date: Sat, 2 Oct 2021 08:53:29 -0600
+Subject: [PATCH] mac80211: fix a memory leak where sta_info is not freed
+
+commit 8f9dcc29566626f683843ccac6113a12208315ca upstream.
+
+The following is from a system that went OOM due to a memory leak:
+
+wlan0: Allocated STA 74:83:c2:64:0b:87
+wlan0: Allocated STA 74:83:c2:64:0b:87
+wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_add_sta)
+wlan0: Adding new IBSS station 74:83:c2:64:0b:87
+wlan0: moving STA 74:83:c2:64:0b:87 to state 2
+wlan0: moving STA 74:83:c2:64:0b:87 to state 3
+wlan0: Inserted STA 74:83:c2:64:0b:87
+wlan0: IBSS finish 74:83:c2:64:0b:87 (---from ieee80211_ibss_work)
+wlan0: Adding new IBSS station 74:83:c2:64:0b:87
+wlan0: moving STA 74:83:c2:64:0b:87 to state 2
+wlan0: moving STA 74:83:c2:64:0b:87 to state 3
+.
+.
+wlan0: expiring inactive not authorized STA 74:83:c2:64:0b:87
+wlan0: moving STA 74:83:c2:64:0b:87 to state 2
+wlan0: moving STA 74:83:c2:64:0b:87 to state 1
+wlan0: Removed STA 74:83:c2:64:0b:87
+wlan0: Destroyed STA 74:83:c2:64:0b:87
+
+The ieee80211_ibss_finish_sta() is called twice on the same STA from 2
+different locations. On the second attempt, the allocated STA is not
+destroyed creating a kernel memory leak.
+
+This is happening because sta_info_insert_finish() does not call
+sta_info_free() the second time when the STA already exists (returns
+-EEXIST). Note that the caller sta_info_insert_rcu() assumes STA is
+destroyed upon errors.
+
+Same fix is applied to -ENOMEM.
+
+Signed-off-by: Ahmed Zaki <anzaki@gmail.com>
+Link: https://lore.kernel.org/r/20211002145329.3125293-1-anzaki@gmail.com
+[change the error path label to use the existing code]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Viacheslav Sablin <sablin@ispras.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/sta_info.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -646,13 +646,13 @@ static int sta_info_insert_finish(struct
+ 	/* check if STA exists already */
+ 	if (sta_info_get_bss(sdata, sta->sta.addr)) {
+ 		err = -EEXIST;
+-		goto out_err;
++		goto out_cleanup;
+ 	}
+ 
+ 	sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL);
+ 	if (!sinfo) {
+ 		err = -ENOMEM;
+-		goto out_err;
++		goto out_cleanup;
+ 	}
+ 
+ 	local->num_sta++;
+@@ -708,8 +708,8 @@ static int sta_info_insert_finish(struct
+  out_drop_sta:
+ 	local->num_sta--;
+ 	synchronize_net();
++ out_cleanup:
+ 	cleanup_single_sta(sta);
+- out_err:
+ 	mutex_unlock(&local->sta_mtx);
+ 	kfree(sinfo);
+ 	rcu_read_lock();

package/kernel/mac80211/patches/subsys/361-wifi-mac80211-Don-t-finalize-CSA-in-IBSS-mode-if-sta.patch

@@ -0,0 +1,47 @@
+From 552ba102a6898630a7d16887f29e606d6fabe508 Mon Sep 17 00:00:00 2001
+From: Siddh Raman Pant <code@siddh.me>
+Date: Sun, 14 Aug 2022 20:45:12 +0530
+Subject: [PATCH] wifi: mac80211: Don't finalize CSA in IBSS mode if state is
+ disconnected
+
+commit 15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0 upstream.
+
+When we are not connected to a channel, sending channel "switch"
+announcement doesn't make any sense.
+
+The BSS list is empty in that case. This causes the for loop in
+cfg80211_get_bss() to be bypassed, so the function returns NULL
+(check line 1424 of net/wireless/scan.c), causing the WARN_ON()
+in ieee80211_ibss_csa_beacon() to get triggered (check line 500
+of net/mac80211/ibss.c), which was consequently reported on the
+syzkaller dashboard.
+
+Thus, check if we have an existing connection before generating
+the CSA beacon in ieee80211_ibss_finish_csa().
+
+Cc: stable@vger.kernel.org
+Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode")
+Link: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9ca6
+Reported-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
+Signed-off-by: Siddh Raman Pant <code@siddh.me>
+Tested-by: syzbot+b6c9fe29aefe68e4ad34@syzkaller.appspotmail.com
+Link: https://lore.kernel.org/r/20220814151512.9985-1-code@siddh.me
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/ibss.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -534,6 +534,10 @@ int ieee80211_ibss_finish_csa(struct iee
+ 
+ 	sdata_assert_lock(sdata);
+ 
++	/* When not connected/joined, sending CSA doesn't make sense. */
++	if (ifibss->state != IEEE80211_IBSS_MLME_JOINED)
++		return -ENOLINK;
++
+ 	/* update cfg80211 bss information with the new channel */
+ 	if (!is_zero_ether_addr(ifibss->bssid)) {
+ 		cbss = cfg80211_get_bss(sdata->local->hw.wiphy,

package/kernel/mac80211/patches/subsys/362-wifi-mac80211-Fix-UAF-in-ieee80211_scan_rx.patch

@@ -0,0 +1,55 @@
+From 5d20c6f932f2758078d0454729129c894fe353e7 Mon Sep 17 00:00:00 2001
+From: Siddh Raman Pant <code@siddh.me>
+Date: Sat, 20 Aug 2022 01:33:40 +0530
+Subject: [PATCH] wifi: mac80211: Fix UAF in ieee80211_scan_rx()
+
+commit 60deb9f10eec5c6a20252ed36238b55d8b614a2c upstream.
+
+ieee80211_scan_rx() tries to access scan_req->flags after a
+null check, but a UAF is observed when the scan is completed
+and __ieee80211_scan_completed() executes, which then calls
+cfg80211_scan_done() leading to the freeing of scan_req.
+
+Since scan_req is rcu_dereference()'d, prevent the racing in
+__ieee80211_scan_completed() by ensuring that from mac80211's
+POV it is no longer accessed from an RCU read critical section
+before we call cfg80211_scan_done().
+
+Cc: stable@vger.kernel.org
+Link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d
+Reported-by: syzbot+f9acff9bf08a845f225d@syzkaller.appspotmail.com
+Suggested-by: Johannes Berg <johannes@sipsolutions.net>
+Signed-off-by: Siddh Raman Pant <code@siddh.me>
+Link: https://lore.kernel.org/r/20220819200340.34826-1-code@siddh.me
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/mac80211/scan.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/net/mac80211/scan.c
++++ b/net/mac80211/scan.c
+@@ -465,16 +465,19 @@ static void __ieee80211_scan_completed(s
+ 	scan_req = rcu_dereference_protected(local->scan_req,
+ 					     lockdep_is_held(&local->mtx));
+ 
+-	if (scan_req != local->int_scan_req) {
+-		local->scan_info.aborted = aborted;
+-		cfg80211_scan_done(scan_req, &local->scan_info);
+-	}
+ 	RCU_INIT_POINTER(local->scan_req, NULL);
+ 	RCU_INIT_POINTER(local->scan_sdata, NULL);
+ 
+ 	local->scanning = 0;
+ 	local->scan_chandef.chan = NULL;
+ 
++	synchronize_rcu();
++
++	if (scan_req != local->int_scan_req) {
++		local->scan_info.aborted = aborted;
++		cfg80211_scan_done(scan_req, &local->scan_info);
++	}
++
+ 	/* Set power back to normal operating levels. */
+ 	ieee80211_hw_config(local, 0);
+ 

package/kernel/mt76/Makefile

@@ -8,9 +8,9 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2022-08-26
-PKG_SOURCE_VERSION:=5ec78e1ec43d1e39edfea1efb9fd4541fa004af0
-PKG_MIRROR_HASH:=b96ec5199d423dc27e4fe7f0e94c8d5970f6db812237816235f3b735a5cb216a
+PKG_SOURCE_DATE:=2022-09-06
+PKG_SOURCE_VERSION:=d70546462b7b51ebc2bcdd5c534fdf3465be62a4
+PKG_MIRROR_HASH:=3d6b68d70a78c0072ed10ab2548344b6b3a70ad99e4edc258fafa16886f4abf9
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_USE_NINJA:=0

package/libs/ustream-ssl/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ustream-ssl
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ustream-ssl.git

package/libs/wolfssl/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wolfssl
-PKG_VERSION:=5.4.0-stable
+PKG_VERSION:=5.5.1-stable
 PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_VERSION)
-PKG_HASH:=dc36cc19dad197253e5c2ecaa490c7eef579ad448706e55d73d79396e814098b
+PKG_HASH:=97339e6956c90e7c881ba5c748dd04f7c30e5dbe0c06da765418c51375a6dee3
 
 PKG_FIXUP:=libtool libtool-abiver
 PKG_INSTALL:=1

package/libs/wolfssl/patches/100-disable-hardening-check.patch

@@ -1,6 +1,6 @@
 --- a/wolfssl/wolfcrypt/settings.h
 +++ b/wolfssl/wolfcrypt/settings.h
-@@ -2442,7 +2442,7 @@ extern void uITRON4_free(void *p) ;
+@@ -2454,7 +2454,7 @@ extern void uITRON4_free(void *p) ;
  #endif
  
  /* warning for not using harden build options (default with ./configure) */

package/libs/wolfssl/patches/101-update-sp_rand_prime-s-preprocessor-gating-to-match.patch

@@ -1,23 +0,0 @@
-From dc92ec2aa9cb76b782bdba3fc5203267ebf39994 Mon Sep 17 00:00:00 2001
-From: Kareem <kareem@wolfssl.com>
-Date: Fri, 22 Jul 2022 11:07:46 -0700
-Subject: [PATCH] Update sp_rand_prime's preprocessor gating to match
- wolfSSL_BN_generate_prime_ex's.
-
----
- wolfcrypt/src/sp_int.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/wolfcrypt/src/sp_int.c
-+++ b/wolfcrypt/src/sp_int.c
-@@ -15647,8 +15647,8 @@ int sp_radix_size(sp_int* a, int radix,
-  * Prime number generation and checking.
-  ***************************************/
- 
--#if defined(WOLFSSL_KEY_GEN) && (!defined(NO_DH) || !defined(NO_DSA)) && \
--    !defined(WC_NO_RNG)
-+#if defined(WOLFSSL_KEY_GEN) && (!defined(NO_RSA) || !defined(NO_DH) || \
-+    !defined(NO_DSA)) && !defined(WC_NO_RNG)
- /* Generate a random prime for RSA only.
-  *
-  * @param  [out]  r     SP integer to hold result.

package/libs/wolfssl/patches/200-ecc-rng.patch

@@ -11,7 +11,7 @@ RNG regardless of the built settings for wolfssl.
 
 --- a/wolfcrypt/src/ecc.c
 +++ b/wolfcrypt/src/ecc.c
-@@ -12288,21 +12288,21 @@ void wc_ecc_fp_free(void)
+@@ -12505,21 +12505,21 @@ void wc_ecc_fp_free(void)
  
  #endif /* FP_ECC */
  
@@ -37,7 +37,7 @@ RNG regardless of the built settings for wolfssl.
  
 --- a/wolfssl/wolfcrypt/ecc.h
 +++ b/wolfssl/wolfcrypt/ecc.h
-@@ -650,10 +650,8 @@ WOLFSSL_API
+@@ -656,10 +656,8 @@ WOLFSSL_ABI WOLFSSL_API
  void wc_ecc_fp_free(void);
  WOLFSSL_LOCAL
  void wc_ecc_fp_init(void);

package/network/config/firewall4/Makefile

@@ -9,9 +9,9 @@ PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/firewall4.git
-PKG_SOURCE_DATE:=2022-09-01
-PKG_SOURCE_VERSION:=f5fcdcf2c51f6f0a4b116c352000c4fe0523be77
-PKG_MIRROR_HASH:=57ef6f161abdd323019c026c959ab875fdfd3c972b8dc7767623634b1c259138
+PKG_SOURCE_DATE:=2022-10-14
+PKG_SOURCE_VERSION:=4fbf6d75a4a9e523d1848a28d8a3ea095e870195
+PKG_MIRROR_HASH:=d8ffb01baf0c8412962aaaf504ad05387f3fef5bd709f7b7840ddd4e8311b4bb
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=ISC
 

package/network/services/hostapd/Makefile

@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=$(AUTORELEASE).1
 
 PKG_SOURCE_URL:=http://w1.fi/hostap.git
 PKG_SOURCE_PROTO:=git

package/network/services/hostapd/files/hostapd.sh

@@ -361,7 +361,7 @@ hostapd_common_add_bss_config() {
 	config_add_array airtime_sta_weight
 	config_add_int airtime_bss_weight airtime_bss_limit
 
-	config_add_boolean multicast_to_unicast proxy_arp per_sta_vif
+	config_add_boolean multicast_to_unicast multicast_to_unicast_all proxy_arp per_sta_vif
 
 	config_add_array hostapd_bss_options
 	config_add_boolean default_disabled
@@ -545,7 +545,7 @@ hostapd_set_bss_options() {
 		bss_load_update_period chan_util_avg_period sae_require_mfp sae_pwe \
 		multi_ap multi_ap_backhaul_ssid multi_ap_backhaul_key skip_inactivity_poll \
 		airtime_bss_weight airtime_bss_limit airtime_sta_weight \
-		multicast_to_unicast proxy_arp per_sta_vif \
+		multicast_to_unicast_all proxy_arp per_sta_vif \
 		eap_server eap_user_file ca_cert server_cert private_key private_key_passwd server_id \
 		vendor_elements fils
 
@@ -1096,9 +1096,9 @@ hostapd_set_bss_options() {
 		[ -n "$server_id" ] && append bss_conf "server_id=$server_id" "$N"
 	fi
 
-	set_default multicast_to_unicast 0
-	if [ "$multicast_to_unicast" -gt 0 ]; then
-		append bss_conf "multicast_to_unicast=$multicast_to_unicast" "$N"
+	set_default multicast_to_unicast_all 0
+	if [ "$multicast_to_unicast_all" -gt 0 ]; then
+		append bss_conf "multicast_to_unicast=$multicast_to_unicast_all" "$N"
 	fi
 	set_default proxy_arp 0
 	if [ "$proxy_arp" -gt 0 ]; then

package/system/rpcd/Makefile

@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/rpcd.git
-PKG_MIRROR_HASH:=52ca9beab4b18afec9717a5f05c5232ef6160c3ece82a020851ac3aeaa52a29a
-PKG_SOURCE_DATE:=2022-08-24
-PKG_SOURCE_VERSION:=82904bd4f92e5928d047db6396cc14ca2b07d89f
+PKG_MIRROR_HASH:=18137fa6904b1a7aec03a16a4c25fd9b9689b24ee14d431bacdda9f093339071
+PKG_SOURCE_DATE:=2022-09-21
+PKG_SOURCE_VERSION:=8c852b656bf1622dee1ae2cfa4c083f730c1c539
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 
 PKG_LICENSE:=ISC

package/utils/busybox/patches/530-nslookup-ensure-unique-transaction-IDs-for-the-DNS-queries.patch

@@ -0,0 +1,42 @@
+From: Uwe Kleine-König <uwe@kleine-koenig.org>
+Date: Sat, 8 Oct 2022 19:22:52 +0200
+Subject: [PATCH] nslookup: ensure unique transaction IDs for the DNS queries
+
+The transaction IDs generated by res_mkquery() for both glibc and musl only
+depends on the state of the monotonic clock.
+For some machines (here: a TP-Link RE200 powered by a MediaTek MT7620A)
+the monotonic clock has a coarse resolution (here: 20 µs) and it can happen
+that the requests for A and AAAA share the same transaction ID.
+
+In that case the mapping from received responses to the sent queries
+doesn't work and name resolution fails as follows:
+
+        # /bin/busybox nslookup heise.de
+        Server:         127.0.0.1
+        Address:        127.0.0.1:53
+
+        Non-authoritative answer:
+        Name:   heise.de
+        Address: 193.99.144.80
+
+        *** Can't find heise.de: No answer
+
+because the AAAA reply is dropped as a duplicate reply to the A query.
+
+To prevent this make sure the transaction IDs are unique.
+
+Forwarded: http://lists.busybox.net/pipermail/busybox/2022-October/089911.html
+---
+--- a/networking/nslookup.c
++++ b/networking/nslookup.c
+@@ -978,6 +978,10 @@ int nslookup_main(int argc UNUSED_PARAM,
+ 		}
+ 	}
+ 
++	/* Ensure the Transaction IDs are unique */
++	for (rc = 1; rc < G.query_count; rc++)
++		G.query[rc].query[1] = G.query[rc - 1].query[1] + 1;
++
+ 	for (rc = 0; rc < G.serv_count;) {
+ 		int c;
+ 

package/utils/px5g-wolfssl/Makefile

@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=px5g-wolfssl
-PKG_RELEASE:=$(COMMITCOUNT)
+PKG_RELEASE:=$(COMMITCOUNT).1
 PKG_LICENSE:=GPL-2.0-or-later
 
 PKG_USE_MIPS16:=0

package/utils/ucode/Makefile

@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/jow-/ucode.git
-PKG_SOURCE_DATE:=2022-08-29
-PKG_SOURCE_VERSION:=344fa9e69da43ecdc4d8f7768d85d42639352405
-PKG_MIRROR_HASH:=94e1ae6779536b2bd8957db8c2922ec32dcef75258401707505b1d34b6f16d0b
+PKG_SOURCE_DATE:=2022-10-07
+PKG_SOURCE_VERSION:=4ae70721aae5f974538928cadc71fa3269e5ad20
+PKG_MIRROR_HASH:=97339d563e988d57ed02f5fd27722c908d616c2cec8b1f0479f42bc53dfd0aa1
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=ISC
 

package/utils/uencrypt/Makefile

@@ -4,7 +4,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=uencrypt
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_FLAGS:=nonshared
 PKG_LICENSE:=GPL-2.0-or-later

package/utils/zyxel-bootconfig/Makefile

@@ -0,0 +1,38 @@
+#
+# Copyright (C) 2022 David Bauer <mail@david-bauer.net>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=zyxel-bootconfig
+PKG_RELEASE:=1
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/zyxel-bootconfig
+  SECTION:=utils
+  CATEGORY:=Base system
+  TITLE:=Utility for handling ZyXEL Bootconfig settings
+  MAINTAINER:=David Bauer <mail@david-bauer.net>
+endef
+
+define Package/zyxel-bootconfig/description
+ This package contains an utility that allows handling ZyXEL Bootconfig settings.
+endef
+
+define Build/Compile
+	$(MAKE) -C $(PKG_BUILD_DIR) \
+		CC="$(TARGET_CC)" \
+		CFLAGS="$(TARGET_CFLAGS) -Wall"
+endef
+
+define Package/zyxel-bootconfig/install
+	$(INSTALL_DIR) $(1)/usr/bin $(1)/lib/preinit
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/zyxel-bootconfig $(1)/usr/bin/
+	$(CP) ./files/95_apply_bootconfig $(1)/lib/preinit/95_apply_bootconfig
+endef
+
+$(eval $(call BuildPackage,zyxel-bootconfig))

package/utils/zyxel-bootconfig/files/95_apply_bootconfig

@@ -0,0 +1,16 @@
+apply_bootconfig() {
+	. /lib/functions.sh
+
+	local part
+
+	case $(board_name) in
+	zyxel,nwa50ax|\
+	zyxel,nwa55axe)
+        mtd_idx=$(find_mtd_index "bootconfig")
+		zyxel-bootconfig "/dev/mtd$mtd_idx" set-image-status 0 valid
+		zyxel-bootconfig "/dev/mtd$mtd_idx" set-active-image 0
+		;;
+	esac
+}
+
+[ "$INITRAMFS" = "1" ] || boot_hook_add preinit_main apply_bootconfig

package/utils/zyxel-bootconfig/src/Makefile

@@ -0,0 +1,7 @@
+all: zyxel-bootconfig
+
+zyxel-bootconfig:
+	$(CC) $(CFLAGS) -Wall zyxel-bootconfig.c -o zyxel-bootconfig
+
+clean:
+	rm -f zyxel-bootconfig

package/utils/zyxel-bootconfig/src/zyxel-bootconfig.c

@@ -0,0 +1,331 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/* Copyright (C) 2022 David Bauer <mail@david-bauer.net> */
+
+/*
+ * First byte: Image status
+ *
+ * Possible status-codes:
+ * 0x0: none
+ * 0x1: new
+ * 0x2: valid
+ * 0x3: invalid
+ *
+ * Example: Image 0 valid; Image 1 invalid
+ * 11001000
+ * ||  ||
+ * img1||
+ *     img0
+ *
+ * Second byte: Active Image
+ * Possible values:
+ * 0x0: Image0 active
+ * 0x1: Image1 active
+ */
+
+#include <stdio.h>
+#include <stdbool.h>
+#include <stdlib.h>
+#include <stddef.h>
+
+#include <fcntl.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <sys/ioctl.h>
+#include <mtd/mtd-user.h>
+
+#define BOOTCONFIG_SIZE			0x20
+#define BOOTCONFIG_IMAGE_STATUS		0x0
+#define BOOTCONFIG_ACTIVE_IMAGE		0x1
+
+#define IMAGE_0_SHIFT			2
+#define IMAGE_0_MASK			0x0c
+#define IMAGE_1_SHIFT			6
+#define IMAGE_1_MASK			0xc0
+
+#define IMAGE_STATUS(img0, img1)	(((img0 << IMAGE_0_SHIFT) & IMAGE_0_MASK) | ((img1 << IMAGE_1_SHIFT) & IMAGE_1_MASK))
+
+#define ACTIVE_IMAGE_MASK		0x1
+#define ACTIVE_IMAGE(img)		(img & ACTIVE_IMAGE_MASK)
+
+enum zyxel_bootconfig_image_status {
+	IMAGE_STATUS_NONE = 0x0,
+	IMAGE_STATUS_NEW = 0x1,
+	IMAGE_STATUS_VALID = 0x2,
+	IMAGE_STATUS_INVALID = 0x3,
+	__IMAGE_STATUS_EINVAL,
+};
+
+struct zyxel_bootconfig {
+	enum zyxel_bootconfig_image_status image0_status;
+	enum zyxel_bootconfig_image_status image1_status;
+	unsigned int active_image;
+};
+
+struct zyxel_bootconfig_mtd {
+	struct mtd_info_user mtd_info;
+	int fd;
+};
+
+struct zyxel_image_status {
+	enum zyxel_bootconfig_image_status code;
+	const char *name;
+};
+
+struct zyxel_image_status image_status_codes[] = {
+	{ .code = IMAGE_STATUS_NONE, .name = "none" },
+	{ .code = IMAGE_STATUS_NEW, .name = "new" },
+	{ .code = IMAGE_STATUS_VALID, .name = "valid" },
+	{ .code = IMAGE_STATUS_INVALID, .name = "invalid" },
+	{},
+};
+
+
+static enum zyxel_bootconfig_image_status zyxel_bootconfig_image_status_parse(const char *status) {
+	struct zyxel_image_status* s;
+
+	for (s = image_status_codes; s->name; s++) {
+		if (!strcmp(status, s->name)) {
+			return s->code;
+		}
+	}
+
+	return __IMAGE_STATUS_EINVAL;
+}
+
+const char *zyxel_bootconfig_image_status_name(const enum zyxel_bootconfig_image_status bootconfig) {
+	struct zyxel_image_status* s;
+
+	for (s = image_status_codes; s->name; s++) {
+		if (bootconfig == s->code) {
+			return s->name;
+		}
+	}
+
+	return "N/A";
+}
+
+static void zyxel_bootconfig_mtd_close(struct zyxel_bootconfig_mtd *mtd) {
+	close(mtd->fd);
+}
+
+
+static int zyxel_bootconfig_mtd_open(struct zyxel_bootconfig_mtd *mtd, const char *mtd_name) {
+	int ret = 0;
+
+	mtd->fd = open(mtd_name, O_RDWR | O_SYNC);
+	if (mtd->fd < 0) {
+		fprintf(stderr, "Could not open mtd device: %s\n", mtd_name);
+		ret = -1;
+		goto out;
+	}
+
+	if (ioctl(mtd->fd, MEMGETINFO, &mtd->mtd_info)) {
+		fprintf(stderr, "Could not get MTD device info from %s\n", mtd_name);
+		ret = -1;
+		zyxel_bootconfig_mtd_close(mtd);
+		goto out;
+	}
+
+out:
+	return ret;
+}
+
+
+static int zyxel_bootconfig_read(struct zyxel_bootconfig *config, struct zyxel_bootconfig_mtd *mtd) {
+	char *args = NULL;
+	int ret = 0;
+
+	/* Allocate memory for reading boot-config partition */
+	args = calloc(1, mtd->mtd_info.erasesize);
+	if (!args) {
+		fprintf(stderr, "Could not allocate memory!\n");
+		ret = -1;
+		goto out;
+	}
+
+	/* Read bootconfig partition */
+	pread(mtd->fd, args, mtd->mtd_info.erasesize, 0);
+
+	/* Parse config */
+	memset(config, 0, sizeof(*config));
+
+	config->image0_status = (args[BOOTCONFIG_IMAGE_STATUS] & IMAGE_0_MASK) >> IMAGE_0_SHIFT;
+	config->image1_status = (args[BOOTCONFIG_IMAGE_STATUS] & IMAGE_1_MASK) >> IMAGE_1_SHIFT;
+	config->active_image = (args[BOOTCONFIG_ACTIVE_IMAGE] & ACTIVE_IMAGE_MASK);
+
+out:
+	if (args)
+		free(args);
+	return ret;
+}
+
+
+static int zyxel_bootconfig_write(struct zyxel_bootconfig *config, struct zyxel_bootconfig_mtd *mtd)
+{
+	struct erase_info_user erase_info;
+	char img_status, img_active;
+	char *args = NULL;
+	int ret = 0;
+
+	/* Allocate memory for reading boot-config partition */
+	args = calloc(1, mtd->mtd_info.erasesize);
+	if (!args) {
+		fprintf(stderr, "Could not allocate memory!\n");
+		ret = -1;
+		goto out;
+	}
+
+	/* Read bootconfig partition */
+	pread(mtd->fd, args, mtd->mtd_info.erasesize, 0);
+
+	img_status = IMAGE_STATUS(config->image0_status, config->image1_status);
+	img_active = ACTIVE_IMAGE(config->active_image);
+
+	/* Check if bootconfig has to be written */
+	if (args[BOOTCONFIG_IMAGE_STATUS] == img_status && args[BOOTCONFIG_ACTIVE_IMAGE] == img_active) {
+		ret = 0;
+		goto out;
+	}
+
+	/* Erase first block (containing the magic) */
+	erase_info.start = 0;
+	erase_info.length = mtd->mtd_info.erasesize;
+	ret = ioctl(mtd->fd, MEMERASE, &erase_info);
+	if (ret < 0) {
+		fprintf(stderr, "Failed to erase block: %i\n", ret);
+		goto out;
+	}
+
+
+	/* Write bootconfig */
+	args[BOOTCONFIG_IMAGE_STATUS] = img_status;
+	args[BOOTCONFIG_ACTIVE_IMAGE] = img_active;
+
+	if (pwrite(mtd->fd, args, mtd->mtd_info.erasesize, 0) != mtd->mtd_info.erasesize) {
+		fprintf(stderr, "Error writing bootconfig!\n");
+		ret = -1;
+		goto out;
+	}
+
+out:
+	if (args)
+		free(args);
+	return ret;
+}
+
+
+static void zyxel_bootconfig_print_usage(char *programm)
+{
+	struct zyxel_image_status* s = image_status_codes;
+
+	printf("Usage: %s <mtd-device> <command> [args]\n", programm);
+	printf("Available commands:\n");
+	printf("	get-status\n");
+	printf("	set-image-status [0/1] [");
+
+	while (s->name) {
+		printf("%s", s->name);
+		s++;
+
+		if (s->name)
+			printf(",");
+	}
+
+	printf("]\n");
+	printf("	set-active-image [0/1]\n");
+}
+
+int main(int argc, char *argv[])
+{
+	enum zyxel_bootconfig_image_status image_status;
+	struct zyxel_bootconfig_mtd mtd;
+	struct zyxel_bootconfig config;
+	const char *mtd_name, *command;
+	bool writeback = false;
+	int image_idx;
+
+	if (argc < 3) {
+		zyxel_bootconfig_print_usage(argv[0]);
+		return 1;
+	}
+
+	mtd_name = argv[1];
+	command = argv[2];
+
+	if (zyxel_bootconfig_mtd_open(&mtd, mtd_name)) {
+		fprintf(stderr, "Error opening %s!\n", mtd_name);
+		return 1;
+	}
+
+	if (zyxel_bootconfig_read(&config, &mtd)) {
+		fprintf(stderr, "Error reading bootconfig!\n");
+		zyxel_bootconfig_mtd_close(&mtd);
+		return 1;
+	}
+
+	if (!strcmp(command, "set-image-status")) {
+		if (argc < 5) {
+			zyxel_bootconfig_print_usage(argv[0]);
+			zyxel_bootconfig_mtd_close(&mtd);
+			return 1;
+		}
+
+		image_idx = atoi(argv[3]);
+		if (image_idx > 1 || image_idx < 0) {
+			fprintf(stderr, "Invalid image-slot set!\n");
+			zyxel_bootconfig_mtd_close(&mtd);
+			return 1;
+		}
+
+		image_status = zyxel_bootconfig_image_status_parse(argv[4]);
+		if (image_status == __IMAGE_STATUS_EINVAL) {
+			fprintf(stderr, "Invalid image-status!\n");
+			zyxel_bootconfig_mtd_close(&mtd);
+			return 1;
+		}
+
+		if (image_idx == 0) {
+			config.image0_status = image_status;
+		} else {
+			config.image1_status = image_status;
+		}
+
+		writeback = true;
+	} else if (!strcmp(command, "set-active-image")) {
+		if (argc < 4) {
+			zyxel_bootconfig_print_usage(argv[0]);
+			zyxel_bootconfig_mtd_close(&mtd);
+			return 1;
+		}
+
+		image_idx = atoi(argv[3]);
+		if (image_idx > 1 || image_idx < 0) {
+			fprintf(stderr, "Invalid image-slot set!\n");
+			zyxel_bootconfig_mtd_close(&mtd);
+			return 1;
+		}
+
+		config.active_image = image_idx;
+
+		writeback = true;
+	} else if (!strcmp(command, "get-status")) {
+		printf("Active Image: %d\n", config.active_image);
+		printf("Image 0 Status: %s\n", zyxel_bootconfig_image_status_name(config.image0_status));
+		printf("Image 1 Status: %s\n", zyxel_bootconfig_image_status_name(config.image1_status));
+
+		writeback = false;
+	}
+
+	if (writeback) {
+		if (zyxel_bootconfig_write(&config, &mtd)) {
+			fprintf(stderr, "Error writing bootconfig!\n");
+			zyxel_bootconfig_mtd_close(&mtd);
+			return 1;
+		}
+
+		zyxel_bootconfig_mtd_close(&mtd);
+	}
+
+	return 0;
+}

rules.mk

@@ -208,7 +208,6 @@ ifndef DUMP
       ifneq ($(TOOLCHAIN_LIB_DIRS),)
         TARGET_LDFLAGS+= $(patsubst %,-L%,$(TOOLCHAIN_LIB_DIRS))
       endif
-      TARGET_PATH:=$(TOOLCHAIN_DIR)/bin:$(TARGET_PATH)
     endif
   endif
 endif
@@ -243,20 +242,13 @@ HOST_CXXFLAGS:=
 HOST_CFLAGS:=-O2 $(HOST_CPPFLAGS)
 HOST_LDFLAGS:=-L$(STAGING_DIR_HOST)/lib $(if $(IS_PACKAGE_BUILD),-L$(STAGING_DIR_HOSTPKG)/lib -L$(STAGING_DIR)/host/lib)
 
-ifeq ($(CONFIG_EXTERNAL_TOOLCHAIN),)
-  TARGET_AR:=$(TARGET_CROSS)gcc-ar
-  TARGET_RANLIB:=$(TARGET_CROSS)gcc-ranlib
-  TARGET_NM:=$(TARGET_CROSS)gcc-nm
-else
-  TARGET_AR:=$(TARGET_CROSS)ar
-  TARGET_RANLIB:=$(TARGET_CROSS)ranlib
-  TARGET_NM:=$(TARGET_CROSS)nm
-endif
-
 BUILD_KEY=$(TOPDIR)/key-build
 
 FAKEROOT:=$(STAGING_DIR_HOST)/bin/fakeroot
 
+TARGET_AR:=$(TARGET_CROSS)gcc-ar
+TARGET_RANLIB:=$(TARGET_CROSS)gcc-ranlib
+TARGET_NM:=$(TARGET_CROSS)gcc-nm
 TARGET_CC:=$(TARGET_CROSS)gcc
 TARGET_CXX:=$(TARGET_CROSS)g++
 KPATCH:=$(SCRIPT_DIR)/patch-kernel.sh
@@ -265,6 +257,9 @@ ESED:=$(STAGING_DIR_HOST)/bin/sed -E -i -e
 MKHASH:=$(STAGING_DIR_HOST)/bin/mkhash
 # MKHASH is used in /scripts, so we export it here.
 export MKHASH
+# DOWNLOAD_CHECK_CERTIFICATE is used in /scripts, so we export it here.
+DOWNLOAD_CHECK_CERTIFICATE:=$(CONFIG_DOWNLOAD_CHECK_CERTIFICATE)
+export DOWNLOAD_CHECK_CERTIFICATE
 CP:=cp -fpR
 LN:=ln -sf
 XARGS:=xargs -r

scripts/download.pl

@@ -24,6 +24,8 @@ my $scriptdir = dirname($0);
 my @mirrors;
 my $ok;
 
+my $check_certificate = $ENV{DOWNLOAD_CHECK_CERTIFICATE} eq "y";
+
 $url_filename or $url_filename = $filename;
 
 sub localmirrors {
@@ -72,7 +74,7 @@ sub download_cmd($) {
 	my $url = shift;
 	my $have_curl = 0;
 
-	if (open CURL, '-|', 'curl', '--version') {
+	if (open CURL, "curl --version 2>/dev/null |") {
 		if (defined(my $line = readline CURL)) {
 			$have_curl = 1 if $line =~ /^curl /;
 		}
@@ -80,8 +82,14 @@ sub download_cmd($) {
 	}
 
 	return $have_curl
-		? (qw(curl -f --connect-timeout 20 --retry 5 --location --insecure), shellwords($ENV{CURL_OPTIONS} || ''), $url)
-		: (qw(wget --tries=5 --timeout=20 --no-check-certificate --output-document=-), shellwords($ENV{WGET_OPTIONS} || ''), $url)
+		? (qw(curl -f --connect-timeout 20 --retry 5 --location),
+			$check_certificate ? () : '--insecure',
+			shellwords($ENV{CURL_OPTIONS} || ''),
+			$url)
+		: (qw(wget --tries=5 --timeout=20 --output-document=-),
+			$check_certificate ? () : '--no-check-certificate',
+			shellwords($ENV{WGET_OPTIONS} || ''),
+			$url)
 	;
 }
 

scripts/ext-toolchain.sh

@@ -50,6 +50,7 @@ BIN_SPECS="
 	gdbserver: gdbserver
 "
 
+OVERWRITE_CONFIG=""
 
 test_c() {
 	cat <<-EOT | "${CC:-false}" $CFLAGS -o /dev/null -x c - 2>/dev/null
@@ -281,8 +282,11 @@ print_config() {
 	local mksubtarget
 
 	local target="$("$CC" $CFLAGS -dumpmachine)"
+	local version="$("$CC" $CFLAGS -dumpversion)"
 	local cpuarch="${target%%-*}"
-	local prefix="${CC##*/}"; prefix="${prefix%-*}-"
+
+	# get CC; strip version; strip gcc and add - suffix
+	local prefix="${CC##*/}"; prefix="${prefix%-$version}"; prefix="${prefix%-*}-"
 	local config="${0%/scripts/*}/.config"
 
 	# if no target specified, print choice list and exit
@@ -317,9 +321,13 @@ print_config() {
 	fi
 
 	# bail out if there is a .config already
-	if [ -f "${0%/scripts/*}/.config" ]; then
-		echo "There already is a .config file, refusing to overwrite!" >&2
-		return 1
+	if [ -f "$config" ]; then
+		if [ "$OVERWRITE_CONFIG" == "" ]; then
+			echo "There already is a .config file, refusing to overwrite!" >&2
+			return 1
+		else
+			echo "There already is a .config file, trying to overwrite!"
+		fi
 	fi
 
 	case "$mktarget" in */*)
@@ -327,8 +335,11 @@ print_config() {
 		mktarget="${mktarget%/*}"
 	;; esac
 
+	if [ ! -f "$config" ]; then
+		touch "$config"
+	fi
 
-	echo "CONFIG_TARGET_${mktarget}=y" > "$config"
+	echo "CONFIG_TARGET_${mktarget}=y" >> "$config"
 
 	if [ -n "$mksubtarget" ]; then
 		echo "CONFIG_TARGET_${mktarget}_${mksubtarget}=y" >> "$config"
@@ -358,8 +369,18 @@ print_config() {
 	echo "CONFIG_TOOLCHAIN_PREFIX=\"$prefix\"" >> "$config"
 	echo "CONFIG_TARGET_NAME=\"$target\"" >> "$config"
 
-	if [ "$LIBC_TYPE" != glibc ]; then
-		echo "CONFIG_TOOLCHAIN_LIBC=\"$LIBC_TYPE\"" >> "$config"
+	if [ -f "$config" ]; then
+		sed -i '/CONFIG_EXTERNAL_TOOLCHAIN_LIBC_USE_MUSL/d' "$config"
+		sed -i '/CONFIG_EXTERNAL_TOOLCHAIN_LIBC_USE_GLIBC/d' "$config"
+	fi
+
+	if [ "$LIBC_TYPE" == glibc ]; then
+		echo "CONFIG_EXTERNAL_TOOLCHAIN_LIBC_USE_GLIBC=y" >> "$config"
+	elif [ "$LIBC_TYPE" == musl ]; then
+		echo "CONFIG_EXTERNAL_TOOLCHAIN_LIBC_USE_MUSL=y" >> "$config"
+	else
+		echo "Can't detect LIBC type. Aborting!" >&2
+		return 1
 	fi
 
 	local lib
@@ -452,6 +473,13 @@ probe_cpp() {
 }
 
 probe_libc() {
+	if [ -f $TOOLCHAIN/info.mk ]; then
+		LIBC_TYPE=$(grep LIBC_TYPE $TOOLCHAIN/info.mk | sed 's/LIBC_TYPE=//')
+		return 0
+	fi
+
+	echo "Warning! Can't find info.mk, trying to detect with alternative way."
+
 	if [ -z "$LIBC_TYPE" ]; then
 		if test_uclibc; then
 			LIBC_TYPE="uclibc"
@@ -529,8 +557,13 @@ while [ -n "$1" ]; do
 			exit $?
 		;;
 
+		--overwrite-config)
+			OVERWRITE_CONFIG=y
+		;;
+
 		--config)
 			if probe_cc; then
+				probe_libc
 				print_config "$1"
 				exit $?
 			fi
@@ -570,6 +603,8 @@ while [ -n "$1" ]; do
 			echo -e "  is used to specify C flags to be passed to the "     >&2
 			echo -e "  cross compiler when performing tests."               >&2
 			echo -e "  This parameter may be repeated multiple times."      >&2
+			echo -e "  Use --overwrite-config before --config to overwrite" >&2
+			echo -e "  an already present config with the required changes.">&2
 			exit 1
 		;;
 

scripts/mkits-zyxel-fit.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+#
+# Licensed under the terms of the GNU GPL License version 2 or later.
+# Author: David Bauer <mail@david-bauer.net>, based on mkits-zyxel-factory.sh.
+
+usage() {
+	echo "Usage: `basename $0` output file compat-models"
+	exit 1
+}
+
+# We need at least 3 arguments
+[ "$#" -lt 3 ] && usage
+
+# Target output file
+OUTPUT="$1"; shift
+FILE="$1"; shift
+MODELS="$1"; shift
+
+# Create a default, fully populated DTS file
+echo "\
+/dts-v1/;
+
+/ {
+	description = \"Zyxel FIT (Flattened Image Tree)\";
+	compat-models = [${MODELS}];
+	#address-cells = <1>;
+
+	images {
+		firmware {
+			data = /incbin/(\"${FILE}\");
+			type = \"firmware\";
+			compression = \"none\";
+			hash@1 {
+				algo = \"sha1\";
+			};
+		};
+	};
+};" > ${OUTPUT}

scripts/xxdi.pl

@@ -0,0 +1,66 @@
+#!/usr/bin/env perl
+#
+# xxdi.pl - perl implementation of 'xxd -i' mode
+#
+# Copyright 2013 Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+# Copyright 2013 Linux Foundation
+#
+# Released under the GPLv2.
+#
+# Implements the "basic" functionality of 'xxd -i' in perl to keep build
+# systems from having to build/install/rely on vim-core, which not all
+# distros want to do.  But everyone has perl, so use it instead.
+#
+
+use strict;
+use warnings;
+
+my $indata;
+my $var_name = "stdin";
+my $full_output = (@ARGV > 0 && $ARGV[0] eq '-i') ? shift @ARGV : undef;
+
+{
+	local $/;
+	my $fh;
+
+	if (@ARGV) {
+		$var_name = $ARGV[0];
+		open($fh, '<:raw', $var_name) || die("xxdi.pl: Unable to open $var_name: $!\n");
+	} elsif (! -t STDIN) {
+		$fh = \*STDIN;
+		undef $full_output;
+	} else {
+		die "usage: xxdi.pl [-i] [infile]\n";
+	}
+
+	$indata = readline $fh;
+
+	close $fh;
+}
+
+my $len_data = length($indata);
+my $num_digits_per_line = 12;
+my $outdata = "";
+
+# Use the variable name of the file we read from, converting '/' and '.
+# to '_', or, if this is stdin, just use "stdin" as the name.
+$var_name =~ s/\//_/g;
+$var_name =~ s/\./_/g;
+$var_name = "__$var_name" if $var_name =~ /^\d/;
+
+$outdata = "unsigned char $var_name\[] = { " if $full_output;
+
+for (my $key= 0; $key < $len_data; $key++) {
+	if ($key % $num_digits_per_line == 0) {
+		$outdata = substr($outdata, 0, -1)."\n  ";
+	}
+	$outdata .= sprintf("0x%.2x, ", ord(substr($indata, $key, 1)));
+}
+
+$outdata = substr($outdata, 0, -2);
+$outdata .= "\n";
+
+$outdata .= "};\nunsigned int $var_name\_len = $len_data;\n" if $full_output;
+
+binmode STDOUT;
+print $outdata;

target/linux/Makefile

@@ -8,4 +8,4 @@ include $(INCLUDE_DIR)/target.mk
 export TARGET_BUILD=1
 
 prereq clean download prepare compile install oldconfig menuconfig nconfig xconfig update refresh: FORCE
-	@+$(NO_TRACE_MAKE) -C $(BOARD) $@
+	@+$(NO_TRACE_MAKE) -C $(firstword $(wildcard feeds/$(BOARD) $(BOARD))) $@

target/linux/apm821xx/patches-5.10/802-usb-xhci-force-msi-renesas-xhci.patch

@@ -23,7 +23,7 @@ produce a noisy warning.
  		xhci->quirks |= XHCI_RESET_ON_RESUME;
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -425,10 +425,14 @@ static int xhci_try_enable_msi(struct us
+@@ -427,10 +427,14 @@ static int xhci_try_enable_msi(struct us
  		free_irq(hcd->irq, hcd);
  	hcd->irq = 0;
  

target/linux/at91/patches-5.10/127-regulator-core-validate-selector-against-linear_min_.patch

@@ -20,7 +20,7 @@ Signed-off-by: Mark Brown <broonie@kernel.org>
 
 --- a/drivers/regulator/core.c
 +++ b/drivers/regulator/core.c
-@@ -2987,7 +2987,8 @@ static int _regulator_list_voltage(struc
+@@ -2992,7 +2992,8 @@ static int _regulator_list_voltage(struc
  		return rdev->desc->fixed_uV;
  
  	if (ops->list_voltage) {
@@ -30,7 +30,7 @@ Signed-off-by: Mark Brown <broonie@kernel.org>
  			return -EINVAL;
  		if (lock)
  			regulator_lock(rdev);
-@@ -3138,7 +3139,8 @@ int regulator_list_hardware_vsel(struct
+@@ -3143,7 +3144,8 @@ int regulator_list_hardware_vsel(struct
  	struct regulator_dev *rdev = regulator->rdev;
  	const struct regulator_ops *ops = rdev->desc->ops;
  
@@ -40,7 +40,7 @@ Signed-off-by: Mark Brown <broonie@kernel.org>
  		return -EINVAL;
  	if (ops->set_voltage_sel != regulator_set_voltage_sel_regmap)
  		return -EOPNOTSUPP;
-@@ -4061,6 +4063,9 @@ int regulator_set_voltage_time(struct re
+@@ -4066,6 +4068,9 @@ int regulator_set_voltage_time(struct re
  
  	for (i = 0; i < rdev->desc->n_voltages; i++) {
  		/* We only look for exact voltage matches here */

target/linux/at91/patches-5.10/128-regulator-core-do-not-continue-if-selector-match.patch

@@ -14,7 +14,7 @@ Signed-off-by: Mark Brown <broonie@kernel.org>
 
 --- a/drivers/regulator/core.c
 +++ b/drivers/regulator/core.c
-@@ -4066,6 +4066,9 @@ int regulator_set_voltage_time(struct re
+@@ -4071,6 +4071,9 @@ int regulator_set_voltage_time(struct re
  		if (i < rdev->desc->linear_min_sel)
  			continue;
  

target/linux/at91/patches-5.10/129-regulator-core-return-zero-for-selectors-lower-than-.patch

@@ -21,7 +21,7 @@ Signed-off-by: Mark Brown <broonie@kernel.org>
 
 --- a/drivers/regulator/core.c
 +++ b/drivers/regulator/core.c
-@@ -2987,9 +2987,10 @@ static int _regulator_list_voltage(struc
+@@ -2992,9 +2992,10 @@ static int _regulator_list_voltage(struc
  		return rdev->desc->fixed_uV;
  
  	if (ops->list_voltage) {
@@ -34,7 +34,7 @@ Signed-off-by: Mark Brown <broonie@kernel.org>
  		if (lock)
  			regulator_lock(rdev);
  		ret = ops->list_voltage(rdev, selector);
-@@ -3139,9 +3140,10 @@ int regulator_list_hardware_vsel(struct
+@@ -3144,9 +3145,10 @@ int regulator_list_hardware_vsel(struct
  	struct regulator_dev *rdev = regulator->rdev;
  	const struct regulator_ops *ops = rdev->desc->ops;
  

target/linux/at91/patches-5.10/247-clk-use-clk_core_get_rate_recalc-in-clk_rate_get.patch

@@ -18,7 +18,7 @@ Signed-off-by: Stephen Boyd <sboyd@kernel.org>
 
 --- a/drivers/clk/clk.c
 +++ b/drivers/clk/clk.c
-@@ -3106,7 +3106,10 @@ static int clk_rate_get(void *data, u64
+@@ -3105,7 +3105,10 @@ static int clk_rate_get(void *data, u64
  {
  	struct clk_core *core = data;
  

target/linux/ath79/dts/qca9557_extreme-networks_ws-ap3805i.dts

@@ -7,7 +7,7 @@
 
 / {
 	compatible = "extreme-networks,ws-ap3805i", "qca,qca9557";
-	model = "Extreme Networks AP3805i";
+	model = "Extreme Networks WS-AP3805i";
 
 	aliases {
 		led-boot = &led_power_green;

target/linux/ath79/dts/qca9558_librerouter_librerouter-v1.dts

@@ -40,6 +40,10 @@
 	keys {
 		compatible = "gpio-keys";
 
+		pinctrl-names = "default";
+		/* GPIO1 (poe_pass) and GPIO2 (watchdog) requires jtag disabled */
+		pinctrl-0 = <&jtag_disable_pins>;
+
 		reset {
 			label = "Reset";
 			linux,code = <KEY_RESTART>;

target/linux/ath79/dts/qca9563_zte_mf281.dts

@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+// Copyright (c) 2021 Cezary Jackiewicz
+// Copyright (c) 2021, 2022 Lech Perczak
+// Copyright (c) 2022 David Bauer <mail@david-bauer.net>
+
+#include "qca956x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "ZTE MF281";
+	compatible = "zte,mf281", "qca,qca9563";
+
+	aliases {
+		led-boot = &led_debug;
+		led-failsafe = &led_debug;
+		led-running = &led_debug;
+		led-upgrade = &led_debug;
+		label-mac-device = &eth0;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&enable_wlan_led_gpio>;
+
+		/* Hidden SMD LED below signal strength LEDs.
+		 * Visible through slits underside of the case.
+		 */
+		led_debug: debug {
+			label = "green:debug";
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	/* This GPIO is used to reset whole board _including_ the modem */
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
+		active-delay = <3000>;
+		inactive-delay = <1000>;
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0xa0000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0xa0000 0x20000>;
+				read-only;
+			};
+		};
+	};
+
+	flash@1 {
+		compatible = "spi-nand";
+		reg = <1>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "fota-flag";
+				reg = <0x000000 0xa0000>;
+				read-only;
+			};
+
+			partition@a0000 {
+				label = "art";
+				reg = <0xa0000 0x80000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				cal_caldata_1000: cal@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				cal_caldata_5000: cal@5000 {
+					reg = <0x5000 0x2f20>;
+				};
+			};
+
+			partition@120000 {
+				label = "mac";
+				reg = <0x120000 0x80000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				macaddr_mac_0: macaddr@0 {
+					reg = <0x0 0x6>;
+				};
+			};
+
+			partition@1a0000 {
+				label = "reserved2";
+				reg = <0x1a0000 0xc0000>;
+				read-only;
+			};
+
+			partition@260000 {
+				label = "cfg-param";
+				reg = <0x260000 0x400000>;
+				read-only;
+			};
+
+			partition@660000 {
+				label = "log";
+				reg = <0x660000 0x400000>;
+				read-only;
+			};
+
+			partition@a60000 {
+				label = "oops";
+				reg = <0xa60000 0xa0000>;
+				read-only;
+			};
+
+			partition@b00000 {
+				label = "reserved3";
+				reg = <0xb00000 0x500000>;
+				read-only;
+			};
+
+			partition@1000000 {
+				label = "web";
+				reg = <0x1000000 0x800000>;
+				read-only;
+			};
+
+			partition@1800000 {
+				label = "firmware";
+				reg = <0x1800000 0x1d00000>;
+
+				compatible = "fixed-partitions";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "kernel";
+					reg = <0x0 0x600000>;
+				};
+
+				partition@600000 {
+					label = "ubi";
+					reg = <0x600000 0x1700000>;
+				};
+			};
+
+			partition@3500000 {
+				label = "data";
+				reg = <0x3500000 0x1900000>;
+				read-only;
+			};
+
+			partition@4e00000 {
+				label = "fota";
+				reg = <0x4e00000 0x3200000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		phy-mode = "sgmii";
+
+		qca,ar8327-initvals = <
+			0x04 0x00080080 /* PORT0 PAD MODE CTRL */
+			0x7c 0x0000007e /* PORT0_STATUS */
+		>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-mode = "sgmii";
+	phy-handle = <&phy0>;
+
+	nvmem-cells = <&macaddr_mac_0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&pcie {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0x0 0 0 0 0>;
+
+		nvmem-cells = <&macaddr_mac_0>, <&cal_caldata_5000>;
+		nvmem-cell-names = "mac-address", "pre-calibration";
+		mac-address-increment = <1>;
+	};
+};
+
+&pinmux {
+	enable_wlan_led_gpio: pinmux_wlan_led_gpio {
+		pinctrl-single,bits = <0x10 0x0 0xff000000>;
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_mac_0>, <&cal_caldata_1000>;
+	nvmem-cell-names = "mac-address", "calibration";
+};
+
+&usb_phy0 {
+	status = "okay";
+};
+
+&usb0 {
+	status = "okay";
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&usb1 {
+	status = "okay";
+};

target/linux/ath79/generic/base-files/etc/board.d/01_leds

@@ -432,19 +432,11 @@ ubnt,powerbeam-5ac-gen2)
 	ucidef_set_led_rssi "rssimediumhigh" "RSSIMEDIUMHIGH" "blue:rssi2" "wlan0" "51" "100"
 	ucidef_set_led_rssi "rssihigh" "RSSIHIGH" "blue:rssi3" "wlan0" "76" "100"
 	;;
-ubnt,bullet-m-ar7240|\
-ubnt,bullet-m-ar7241|\
 ubnt,bullet-m-xw|\
-ubnt,nanobridge-m|\
-ubnt,nanostation-loco-m|\
 ubnt,nanostation-loco-m-xw|\
-ubnt,nanostation-m|\
 ubnt,nanostation-m-xw|\
-ubnt,picostation-m|\
 ubnt,powerbeam-m2-xw|\
-ubnt,powerbeam-m5-xw|\
-ubnt,powerbridge-m|\
-ubnt,rocket-m)
+ubnt,powerbeam-m5-xw)
 	ucidef_set_rssimon "wlan0" "200000" "1"
 	ucidef_set_led_rssi "rssilow" "RSSILOW" "red:link1" "wlan0" "1" "100"
 	ucidef_set_led_rssi "rssimediumlow" "RSSIMEDIUMLOW" "orange:link2" "wlan0" "26" "100"

target/linux/ath79/generic/base-files/etc/board.d/02_network

@@ -89,25 +89,18 @@ ath79_setup_interfaces()
 	tplink,tl-wa1201-v2|\
 	tplink,tl-wr902ac-v1|\
 	ubnt,bullet-ac|\
-	ubnt,bullet-m-ar7240|\
-	ubnt,bullet-m-ar7241|\
 	ubnt,bullet-m-xw|\
 	ubnt,lap-120|\
 	ubnt,litebeam-ac-gen2|\
 	ubnt,nanobeam-ac|\
 	ubnt,nanobeam-ac-xc|\
-	ubnt,nanobridge-m|\
 	ubnt,nanostation-ac-loco|\
-	ubnt,nanostation-loco-m|\
 	ubnt,nanostation-loco-m-xw|\
-	ubnt,picostation-m|\
 	ubnt,powerbeam-5ac-500|\
 	ubnt,powerbeam-5ac-gen2|\
 	ubnt,powerbeam-m2-xw|\
 	ubnt,powerbeam-m5-xw|\
-	ubnt,powerbridge-m|\
 	ubnt,rocket-5ac-lite|\
-	ubnt,rocket-m|\
 	ubnt,unifiac-lite|\
 	ubnt,unifiac-lr|\
 	ubnt,unifiac-mesh|\
@@ -177,8 +170,7 @@ ath79_setup_interfaces()
 	tplink,archer-c60-v3|\
 	tplink,tl-wdr3500-v1|\
 	tplink,tl-wr842n-v1|\
-	tplink,tl-wr842n-v3|\
-	ubnt,airrouter)
+	tplink,tl-wr842n-v3)
 		ucidef_set_interface_wan "eth1"
 		ucidef_add_switch "switch0" \
 			"0@eth0" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1"
@@ -213,7 +205,6 @@ ath79_setup_interfaces()
 	tplink,wbs210-v2|\
 	tplink,wbs510-v1|\
 	tplink,wbs510-v2|\
-	ubnt,nanostation-m|\
 	ubnt,routerstation)
 		ucidef_set_interfaces_lan_wan "eth1" "eth0"
 		;;
@@ -713,15 +704,6 @@ ath79_setup_macs()
 		wan_mac=$(mtd_get_mac_text mac 0x18)
 		label_mac=$wan_mac
 		;;
-	ubnt,airrouter|\
-	ubnt,bullet-m-ar7240|\
-	ubnt,bullet-m-ar7241|\
-	ubnt,nanobridge-m|\
-	ubnt,nanostation-loco-m|\
-	ubnt,nanostation-m|\
-	ubnt,picostation-m|\
-	ubnt,powerbridge-m|\
-	ubnt,rocket-m|\
 	ubnt,unifi)
 		label_mac=$(cat /sys/class/ieee80211/phy0/macaddress)
 		;;

target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom

@@ -119,16 +119,7 @@ case "$FIRMWARE" in
 	netgear,wnr2200-16m|\
 	pcs,cap324|\
 	tplink,tl-wr2543-v1|\
-	tplink,tl-wr842n-v1|\
-	ubnt,airrouter|\
-	ubnt,bullet-m-ar7240|\
-	ubnt,bullet-m-ar7241|\
-	ubnt,nanobridge-m|\
-	ubnt,nanostation-loco-m|\
-	ubnt,nanostation-m|\
-	ubnt,picostation-m|\
-	ubnt,powerbridge-m|\
-	ubnt,rocket-m)
+	tplink,tl-wr842n-v1)
 		caldata_extract "art" 0x1000 0x1000
 		;;
 	openmesh,mr600-v1|\

target/linux/ath79/image/Makefile

@@ -97,6 +97,7 @@ endif
 ifeq ($(SUBTARGET),tiny)
 include tiny-netgear.mk
 include tiny-tp-link.mk
+include tiny-ubnt.mk
 endif
 
 $(eval $(call BuildImage))