ipq40xx: add HFCL ION4 support

Signed-off-by: John Crispin <john@phrozen.org>

.github/workflows/build-dev.yml

@@ -11,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ['cig_wf188', 'cig_wf194c', 'cig_wf160d', 'edgecore_eap101', 'edgecore_eap102', 'edgecore_ecs4100-12ph', 'edgecore_ecw5211', 'edgecore_ecw5410', 'edgecore_oap100', 'edgecore_spw2ac1200', 'indio_um-305ac', 'linksys_e8450-ubi', 'linksys_ea8300', 'mikrotik_nand', 'tplink_cpe210_v3', 'tplink_cpe510_v3', 'tplink_eap225_outdoor_v1', 'tplink_ec420', 'tplink_ex227', 'tplink_ex228', 'tplink_ex447' ]
+        target: ['cig_wf188', 'cig_wf194c', 'cig_wf160d', 'edgecore_eap101', 'edgecore_eap102', 'edgecore_ecs4100-12ph', 'edgecore_ecw5211', 'edgecore_ecw5410', 'edgecore_oap100', 'edgecore_ssw2ac2600', 'edgecore_spw2ac1200', 'indio_um-305ac', 'linksys_e8450-ubi', 'linksys_ea8300', 'mikrotik_nand', 'tplink_cpe210_v3', 'tplink_cpe510_v3', 'tplink_eap225_outdoor_v1', 'tplink_ec420', 'tplink_ex227', 'tplink_ex228', 'tplink_ex447', 'wallys_dr40x9' ]
 
     steps:
     - uses: actions/checkout@v2

backports/0014-libubox-update-to-latest-HEAD.patch

@@ -1,32 +1,44 @@
-From 5171503cfa4387370fd4c33bbcf0d8c4b6ec86e4 Mon Sep 17 00:00:00 2001
+From 029282d8ef8e4e813817d1c7d4aeae4208bc2da5 Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Tue, 18 May 2021 10:46:43 +0200
-Subject: [PATCH] libubox: update to latest HEAD
+Subject: [PATCH 01/52] libubox: update to latest HEAD
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
- package/libs/libubox/Makefile                 |   4 +-
- package/network/config/netifd/Makefile        |   4 +-
- .../config/netifd/patches/100-8021x.patch     | 421 ++++++++++++++++++
- 3 files changed, 425 insertions(+), 4 deletions(-)
- create mode 100644 package/network/config/netifd/patches/100-8021x.patch
+ package/libs/libubox/Makefile | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
 
 diff --git a/package/libs/libubox/Makefile b/package/libs/libubox/Makefile
-index 4d582eacfd..8644764d59 100644
+index 4d582eacfd..33aa73eef7 100644
 --- a/package/libs/libubox/Makefile
 +++ b/package/libs/libubox/Makefile
-@@ -5,9 +5,9 @@ PKG_RELEASE=1
+@@ -1,13 +1,13 @@
+ include $(TOPDIR)/rules.mk
+ 
+ PKG_NAME:=libubox
+-PKG_RELEASE=1
++PKG_RELEASE=2
  
  PKG_SOURCE_PROTO:=git
  PKG_SOURCE_URL=$(PROJECT_GIT)/project/libubox.git
 -PKG_MIRROR_HASH:=97dc4eba01cf2c5d6a6d0db3747e0cdc0d95cb87e51b3115272e7d3e69a8b255
-+#PKG_MIRROR_HASH:=97dc4eba01cf2c5d6a6d0db3747e0cdc0d95cb87e51b3115272e7d3e69a8b255
- PKG_SOURCE_DATE:=2020-12-12
+-PKG_SOURCE_DATE:=2020-12-12
 -PKG_SOURCE_VERSION:=357877693ca363b12e6e7e14d345639b2440cd07
-+PKG_SOURCE_VERSION:=b14c4688612c05c78ce984d7bde633bce8703b1e
++PKG_MIRROR_HASH:=1cdb91ac0ee925f133ee9f70eac131a99def312fe7cf0aed44df84eb1762e30b
++PKG_SOURCE_DATE:=2021-08-19
++PKG_SOURCE_VERSION:=d716ac4bc4236031d4c3cc1ed362b502e20e3787
  PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
  CMAKE_INSTALL:=1
  
+@@ -67,7 +67,7 @@ define Package/libubox-lua
+ endef
+ 
+ TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include
+-CMAKE_OPTIONS = \
++CMAKE_OPTIONS += \
+ 	-DLUAPATH=/usr/lib/lua \
+ 	-DABIVERSION="$(PKG_ABI_VERSION)"
+ 
 -- 
 2.25.1
 

backports/0035-uhttp-update-to-latest-HEAD.patch

@@ -0,0 +1,157 @@
+From patchwork Fri Aug 20 13:11:12 2021
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Stijn Tintel <stijn@linux-ipv6.be>
+X-Patchwork-Id: 1519040
+X-Patchwork-Delegate: stijn@linux-ipv6.be
+Return-Path: 
+ <openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org>
+X-Original-To: incoming@patchwork.ozlabs.org
+Delivered-To: patchwork-incoming@bilbo.ozlabs.org
+Authentication-Results: ozlabs.org;
+ spf=none (no SPF record) smtp.mailfrom=lists.openwrt.org
+ (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org;
+ envelope-from=openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org;
+ receiver=<UNKNOWN>)
+Authentication-Results: ozlabs.org;
+	dkim=pass (2048-bit key;
+ secure) header.d=lists.infradead.org header.i=@lists.infradead.org
+ header.a=rsa-sha256 header.s=bombadil.20210309 header.b=r2Ly8Vhy;
+	dkim=fail reason="signature verification failed" (1024-bit key;
+ unprotected) header.d=linux-ipv6.be header.i=@linux-ipv6.be
+ header.a=rsa-sha256 header.s=502B7754-045F-11E5-BBC5-64595FD46BE8
+ header.b=BipII9T0;
+	dkim-atps=neutral
+Received: from bombadil.infradead.org (bombadil.infradead.org
+ [IPv6:2607:7c80:54:e::133])
+	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest
+ SHA256)
+	(No client certificate requested)
+	by ozlabs.org (Postfix) with ESMTPS id 4Grhsz3FQvz9s1l
+	for <incoming@patchwork.ozlabs.org>; Fri, 20 Aug 2021 23:13:59 +1000 (AEST)
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+	d=lists.infradead.org; s=bombadil.20210309; h=Sender:
+	Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:
+	List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc
+	:To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:
+	Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:
+	List-Owner; bh=Dxw7atu76L/aBQntt7pW1jTYPCULL0mkcY2U1BYT2sI=; b=r2Ly8VhysFZseN
+	kLaheAFj130coCdyeHSxT/951GnDDBkmyursFZAP2hBLaKv9Z+9HpHIGM3sOiNhM/zDKfabNJ/1D2
+	CV4iyPpVkhRxG9t6HPpPx94E6J5Oknl7l6eyL04DWUB28EzXcoBSMiP0zYsoOWjI8sQO8wITNp6hf
+	neAM1VlZlNb22n5/Wu5oD1RoEiMUS5GeyhU7kEFEWpC45rcpyuQdvHpPLMn5GkcqCOO6i90E7BKAK
+	ipYG2tptIjqjrmR+nC6CPRavA+hSG/o6HzDSYNJvWmgVjCc6RpN/xliN03Rum4+mbDtMEB4Wpidmj
+	FepfgPqKxWRJ0UiXBJew==;
+Received: from localhost ([::1] helo=bombadil.infradead.org)
+	by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux))
+	id 1mH4J2-00BF23-C2; Fri, 20 Aug 2021 13:11:32 +0000
+Received: from mail.tintel.eu ([51.83.127.189])
+ by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux))
+ id 1mH4Iw-00BF1P-CR
+ for openwrt-devel@lists.openwrt.org; Fri, 20 Aug 2021 13:11:30 +0000
+Received: from localhost (localhost [IPv6:::1])
+ by mail.tintel.eu (Postfix) with ESMTP id 1BE4C4486AC4;
+ Fri, 20 Aug 2021 15:11:14 +0200 (CEST)
+Received: from mail.tintel.eu ([IPv6:::1])
+ by localhost (mail.tintel.eu [IPv6:::1]) (amavisd-new, port 10032)
+ with ESMTP id npDXmiQngdDU; Fri, 20 Aug 2021 15:11:13 +0200 (CEST)
+Received: from localhost (localhost [IPv6:::1])
+ by mail.tintel.eu (Postfix) with ESMTP id 5B1EC4486ACC;
+ Fri, 20 Aug 2021 15:11:13 +0200 (CEST)
+DKIM-Filter: OpenDKIM Filter v2.10.3 mail.tintel.eu 5B1EC4486ACC
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-ipv6.be;
+ s=502B7754-045F-11E5-BBC5-64595FD46BE8; t=1629465073;
+ bh=3YKw9bephsRsf4MDuHSX4MioHjRWefi/5PEc54pFn4g=;
+ h=From:To:Date:Message-Id:MIME-Version;
+ b=BipII9T0eY8ENYqcdZ7rxKFn6rwkKKOhJ2IoeLZ1fx4lgpPuGWsZrexzqU6mYTDRa
+ Aihei2/ovPeWgUDbzfjNC9hIqv0fXRaEW0sCAPZGOP6gNHWNCkJxuPqYI+4pjijRRt
+ 6YYC2qCi8DqzQJv7St1FqeVFoIaF8SfbniBW+1N4=
+X-Virus-Scanned: amavisd-new at mail.tintel.eu
+Received: from mail.tintel.eu ([IPv6:::1])
+ by localhost (mail.tintel.eu [IPv6:::1]) (amavisd-new, port 10026)
+ with ESMTP id J5m0pY66LdR7; Fri, 20 Aug 2021 15:11:13 +0200 (CEST)
+Received: from taz.sof.bg.adlevio.net (unknown [IPv6:2001:67c:21bc:20::10])
+ by mail.tintel.eu (Postfix) with SMTP id 17DF94486AC4;
+ Fri, 20 Aug 2021 15:11:13 +0200 (CEST)
+Received: (nullmailer pid 141125 invoked by uid 1000);
+ Fri, 20 Aug 2021 13:11:12 -0000
+From: Stijn Tintel <stijn@linux-ipv6.be>
+To: openwrt-devel@lists.openwrt.org
+Cc: nbd@nbd.name
+Subject: [PATCH] uhttpd: add config option for json_script
+Date: Fri, 20 Aug 2021 16:11:12 +0300
+Message-Id: <20210820131112.141077-1-stijn@linux-ipv6.be>
+X-Mailer: git-send-email 2.31.1
+MIME-Version: 1.0
+X-Rspamd-Queue-Id: 17DF94486AC4
+X-Spamd-Result: default: False [0.00 / 15.00];
+ IP_WHITELIST(0.00)[2001:67c:21bc:20::10];
+ ASN(0.00)[asn:200533, ipnet:2001:67c:21bc::/48, country:BG]
+X-Rspamd-Server: skulls
+X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
+X-CRM114-CacheID: sfid-20210820_061126_592239_17869382 
+X-CRM114-Status: UNSURE (   9.50  )
+X-CRM114-Notice: Please train this message.
+X-Spam-Score: 0.2 (/)
+X-Spam-Report: Spam detection software,
+ running on the system "bombadil.infradead.org",
+ has NOT identified this incoming email as spam.  The original
+ message has been attached to this so you can view it or label
+ similar future email.  If you have any questions, see
+ the administrator of that system for details.
+ Content preview: Add a config option for json_script instead of
+ unconditionally
+ including all json files in /etc/uhttpd in every uhttpd instance. This makes
+ it possible to configure a single instance with an unconditi [...]
+ Content analysis details:   (0.2 points, 5.0 required)
+ pts rule name              description
+ ---- ----------------------
+ --------------------------------------------------
+ -0.0 SPF_PASS               SPF: sender matches SPF record
+ -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
+ 0.1 DKIM_SIGNED            Message has a DKIM or DK signature,
+ not necessarily
+ valid
+ 0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
+X-BeenThere: openwrt-devel@lists.openwrt.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: OpenWrt Development List <openwrt-devel.lists.openwrt.org>
+List-Unsubscribe: <https://lists.openwrt.org/mailman/options/openwrt-devel>,
+ <mailto:openwrt-devel-request@lists.openwrt.org?subject=unsubscribe>
+List-Archive: <http://lists.openwrt.org/pipermail/openwrt-devel/>
+List-Post: <mailto:openwrt-devel@lists.openwrt.org>
+List-Help: <mailto:openwrt-devel-request@lists.openwrt.org?subject=help>
+List-Subscribe: <https://lists.openwrt.org/mailman/listinfo/openwrt-devel>,
+ <mailto:openwrt-devel-request@lists.openwrt.org?subject=subscribe>
+Sender: "openwrt-devel" <openwrt-devel-bounces@lists.openwrt.org>
+Errors-To: 
+ openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org
+
+Add a config option for json_script instead of unconditionally including
+all json files in /etc/uhttpd in every uhttpd instance. This makes it
+possible to configure a single instance with an unconditional redirect,
+which is currently not possible as it would render all other uhttpd
+instances unusable.
+
+Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
+---
+ package/network/services/uhttpd/Makefile          | 2 +-
+ package/network/services/uhttpd/files/uhttpd.init | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/package/network/services/uhttpd/files/uhttpd.init b/package/network/services/uhttpd/files/uhttpd.init
+index e7709941c2..30fd7b4259 100755
+--- a/package/network/services/uhttpd/files/uhttpd.init
++++ b/package/network/services/uhttpd/files/uhttpd.init
+@@ -196,7 +196,8 @@ start_instance()
+ 		append_bool "$cfg" redirect_https "-q" 0
+ 	}
+ 
+-	for file in /etc/uhttpd/*.json; do
++	config_get json_script "$cfg" json_script
++	for file in $json_script; do
+ 		[ -s "$file" ] && procd_append_param command -H "$file"
+ 	done
+ 

backports/0037-netifd-update-to-latest-HEAD.patch

@@ -1,36 +1,43 @@
-From ddaf9ee904b614f79c87f6d67d6c7b09c5d46eca Mon Sep 17 00:00:00 2001
+From 79a45074651c08e0036d4b05b9714bd0f714a115 Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Thu, 27 May 2021 13:24:47 +0200
-Subject: [PATCH 01/44] netifd: update to latest HEAD
+Subject: [PATCH 06/52] netifd: update to latest HEAD
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
- package/network/config/netifd/Makefile          | 12 +++++++++---
+ package/network/config/netifd/Makefile          | 14 +++++++++-----
  .../network/config/netifd/files/etc/udhcpc.user |  1 +
  .../config/netifd/files/lib/netifd/dhcp.script  |  3 +++
  .../netifd/patches/002-fix-dhcp-issue.patch     | 17 +++++++++++++++++
- 4 files changed, 30 insertions(+), 3 deletions(-)
+ 4 files changed, 30 insertions(+), 5 deletions(-)
  create mode 100644 package/network/config/netifd/files/etc/udhcpc.user
  create mode 100644 package/network/config/netifd/patches/002-fix-dhcp-issue.patch
 
 diff --git a/package/network/config/netifd/Makefile b/package/network/config/netifd/Makefile
-index 7061456b08..5717a400be 100644
+index 7061456b08..c33e0c2134 100644
 --- a/package/network/config/netifd/Makefile
 +++ b/package/network/config/netifd/Makefile
-@@ -5,9 +5,9 @@ PKG_RELEASE:=1
+@@ -5,16 +5,14 @@ PKG_RELEASE:=1
  
  PKG_SOURCE_PROTO:=git
  PKG_SOURCE_URL=$(PROJECT_GIT)/project/netifd.git
 -PKG_SOURCE_DATE:=2021-01-09
 -PKG_SOURCE_VERSION:=c00c8335d6188daa326ecfe5a62da15a9b9987e1
 -PKG_MIRROR_HASH:=c740e51e0cec13eec336ba1c7a643db3b64a9a2235f8c1b73a566cb89e841190
-+PKG_SOURCE_DATE:=2021-05-26
-+PKG_SOURCE_VERSION:=440eb0647708274cc8d7d9e7c2bb0cfdfba90023
-+PKG_MIRROR_HASH:=
++PKG_SOURCE_DATE:=2021-08-24
++PKG_SOURCE_VERSION:=454e9c33c90691d5bea12263f1801a7dc38c20b1
++PKG_MIRROR_HASH:=b8c6d8a1d0cb60c353c0272b8a526d8e28e6ee7d385e96b18018d1bc13b54cc2
  PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
  
  PKG_LICENSE:=GPL-2.0
-@@ -25,6 +25,11 @@ define Package/netifd
+ PKG_LICENSE_FILES:=
+ 
+-PKG_BUILD_PARALLEL:=1
+-
+ include $(INCLUDE_DIR)/package.mk
+ include $(INCLUDE_DIR)/cmake.mk
+ 
+@@ -25,6 +23,11 @@ define Package/netifd
    TITLE:=OpenWrt Network Interface Configuration Daemon
  endef
  
@@ -42,7 +49,7 @@ index 7061456b08..5717a400be 100644
  TARGET_CFLAGS += \
  	-I$(STAGING_DIR)/usr/include/libnl-tiny \
  	-I$(STAGING_DIR)/usr/include \
-@@ -40,6 +45,7 @@ define Package/netifd/install
+@@ -40,6 +43,7 @@ define Package/netifd/install
  	$(INSTALL_DIR) $(1)/sbin
  	$(INSTALL_BIN) $(PKG_BUILD_DIR)/netifd $(1)/sbin/
  	$(CP) ./files/* $(1)/

backports/0038-mac80211-update-to-latest-HEAD.patch

@@ -1,7 +1,7 @@
-From 7e9c8738c1030b154cb0c0b104dbb403e5270120 Mon Sep 17 00:00:00 2001
+From 2636d06404c24ec6c2ad8395ad1dc8d26875be7a Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Thu, 27 May 2021 13:25:03 +0200
-Subject: [PATCH 01/42] mac80211: update to latest HEAD
+Subject: [PATCH 01/44] mac80211: update to latest HEAD
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
  package/kernel/mac80211/ath.mk                |   13 +-
  package/kernel/mac80211/broadcom.mk           |    4 +-
  .../mac80211/files/lib/netifd/mac80211.sh     |   36 -
- .../files/lib/netifd/wireless/mac80211.sh     |  192 ++-
+ .../files/lib/netifd/wireless/mac80211.sh     |  195 ++-
  .../mac80211/files/lib/wifi/mac80211.sh       |  110 +-
  package/kernel/mac80211/mac80211.sh.diff      |   58 +
  .../patches/ath/402-ath_regd_optional.patch   |    2 +-
@@ -97,7 +97,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
  ...on-API-to-configure-SAR-power-limita.patch |  398 +++++
  ...mac80211-add-ieee80211_set_sar_specs.patch |   51 +
  .../500-mac80211_configure_antenna_gain.patch |   24 +-
- 92 files changed, 3735 insertions(+), 1344 deletions(-)
+ 92 files changed, 3737 insertions(+), 1345 deletions(-)
  delete mode 100644 package/kernel/mac80211/files/lib/netifd/mac80211.sh
  create mode 100644 package/kernel/mac80211/mac80211.sh.diff
  delete mode 100644 package/kernel/mac80211/patches/ath/560-ath9k-fix-transmitting-to-stations-in-dynamic-SMPS-m.patch
@@ -370,7 +370,7 @@ index 92e5c0e395..0000000000
 -	done
 -}
 diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
-index 92c56afd24..30d6b9311a 100644
+index 92c56afd24..a58af1fef0 100644
 --- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
 +++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
 @@ -1,7 +1,6 @@
@@ -445,14 +445,26 @@ index 92c56afd24..30d6b9311a 100644
  mac80211_hostapd_setup_base() {
  	local phy="$1"
  
-@@ -195,12 +224,14 @@ mac80211_hostapd_setup_base() {
- 	enable_ac=0
- 	vht_oper_chwidth=0
- 	vht_center_seg0=
+@@ -119,6 +148,9 @@ mac80211_hostapd_setup_base() {
+ 	[ "$noscan" -gt 0 ] && hostapd_noscan=1
+ 	[ "$tx_burst" = 0 ] && tx_burst=
+ 
 +	chan_ofs=0
 +	[ "$band" = "6g" ] && chan_ofs=1
- 
- 	idx="$channel"
++
+ 	ieee80211n=1
+ 	ht_capab=
+ 	case "$htmode" in
+@@ -126,7 +158,7 @@ mac80211_hostapd_setup_base() {
+ 		HT40*|VHT40|VHT80|VHT160|HE40|HE80|HE160)
+ 			case "$hwmode" in
+ 				a)
+-					case "$(( ($channel / 4) % 2 ))" in
++					case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
+ 						1) ht_capab="[HT40+]";;
+ 						0) ht_capab="[HT40-]";;
+ 					esac
+@@ -200,7 +232,7 @@ mac80211_hostapd_setup_base() {
  	case "$htmode" in
  		VHT20|HE20) enable_ac=1;;
  		VHT40|HE40)
@@ -461,7 +473,7 @@ index 92c56afd24..30d6b9311a 100644
  				1) idx=$(($channel + 2));;
  				0) idx=$(($channel - 2));;
  			esac
-@@ -208,7 +239,7 @@ mac80211_hostapd_setup_base() {
+@@ -208,7 +240,7 @@ mac80211_hostapd_setup_base() {
  			vht_center_seg0=$idx
  		;;
  		VHT80|HE80)
@@ -470,7 +482,7 @@ index 92c56afd24..30d6b9311a 100644
  				1) idx=$(($channel + 6));;
  				2) idx=$(($channel + 2));;
  				3) idx=$(($channel - 2));;
-@@ -219,15 +250,35 @@ mac80211_hostapd_setup_base() {
+@@ -219,15 +251,35 @@ mac80211_hostapd_setup_base() {
  			vht_center_seg0=$idx
  		;;
  		VHT160|HE160)
@@ -510,7 +522,7 @@ index 92c56afd24..30d6b9311a 100644
  	[ "$hwmode" = "a" ] || enable_ac=0
  
  	if [ "$enable_ac" != "0" ]; then
-@@ -337,16 +388,62 @@ mac80211_hostapd_setup_base() {
+@@ -337,16 +389,62 @@ mac80211_hostapd_setup_base() {
  	esac
  
  	if [ "$enable_ax" != "0" ]; then
@@ -576,7 +588,7 @@ index 92c56afd24..30d6b9311a 100644
  	fi
  
  	hostapd_prepare_device_config "$hostapd_conf_file" nl80211
-@@ -426,7 +523,11 @@ mac80211_generate_mac() {
+@@ -426,7 +524,11 @@ mac80211_generate_mac() {
  	local oIFS="$IFS"; IFS=":"; set -- $ref; IFS="$oIFS"
  
  	macidx=$(($id + 1))
@@ -589,7 +601,7 @@ index 92c56afd24..30d6b9311a 100644
  		b1="0x$1"
  		[ "$id" -gt 0 ] && \
  			b1=$(($b1 ^ ((($id - !($b1 & 2)) << 2)) | 0x2))
-@@ -434,7 +535,7 @@ mac80211_generate_mac() {
+@@ -434,7 +536,7 @@ mac80211_generate_mac() {
  		return
  	}
  
@@ -598,7 +610,7 @@ index 92c56afd24..30d6b9311a 100644
  		printf "%s:%s:%s:%s:%s:%02x" $1 $2 $3 $4 $5 $(( 0x$6 ^ $id ))
  		return
  	}
-@@ -449,7 +550,7 @@ mac80211_generate_mac() {
+@@ -449,7 +551,7 @@ mac80211_generate_mac() {
  find_phy() {
  	[ -n "$phy" -a -d /sys/class/ieee80211/$phy ] && return 0
  	[ -n "$path" ] && {
@@ -607,7 +619,7 @@ index 92c56afd24..30d6b9311a 100644
  		[ -n "$phy" ] && return 0
  	}
  	[ -n "$macaddr" ] && {
-@@ -689,14 +790,8 @@ mac80211_prepare_iw_htmode() {
+@@ -689,14 +791,8 @@ mac80211_prepare_iw_htmode() {
  	case "$htmode" in
  		VHT20|HT20) iw_htmode=HT20;;
  		HT40*|VHT40|VHT160)
@@ -624,7 +636,7 @@ index 92c56afd24..30d6b9311a 100644
  					case "$htmode" in
  						HT40+) iw_htmode="HT40+";;
  						HT40-) iw_htmode="HT40-";;
-@@ -709,6 +804,12 @@ mac80211_prepare_iw_htmode() {
+@@ -709,6 +805,12 @@ mac80211_prepare_iw_htmode() {
  						;;
  					esac
  				;;
@@ -637,7 +649,7 @@ index 92c56afd24..30d6b9311a 100644
  			esac
  			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
  		;;
-@@ -818,7 +919,6 @@ mac80211_setup_vif() {
+@@ -818,7 +920,6 @@ mac80211_setup_vif() {
  		mesh)
  			wireless_vif_parse_encryption
  			[ -z "$htmode" ] && htmode="NOHT";
@@ -645,7 +657,7 @@ index 92c56afd24..30d6b9311a 100644
  			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ] || chan_is_dfs "$phy" "$channel"; then
  				mac80211_setup_supplicant $vif_enable || failed=1
  			else
-@@ -832,7 +932,6 @@ mac80211_setup_vif() {
+@@ -832,7 +933,6 @@ mac80211_setup_vif() {
  		adhoc)
  			wireless_vif_parse_encryption
  			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ]; then
@@ -653,7 +665,7 @@ index 92c56afd24..30d6b9311a 100644
  				mac80211_setup_supplicant_noctl $vif_enable || failed=1
  			else
  				mac80211_setup_adhoc $vif_enable
-@@ -849,10 +948,30 @@ mac80211_setup_vif() {
+@@ -849,10 +949,30 @@ mac80211_setup_vif() {
  
  get_freq() {
  	local phy="$1"
@@ -686,7 +698,7 @@ index 92c56afd24..30d6b9311a 100644
  chan_is_dfs() {
  	local phy="$1"
  	local chan="$2"
-@@ -896,7 +1015,8 @@ drv_mac80211_setup() {
+@@ -896,7 +1016,8 @@ drv_mac80211_setup() {
  		country chanbw distance \
  		txpower antenna_gain \
  		rxantenna txantenna \
@@ -696,7 +708,7 @@ index 92c56afd24..30d6b9311a 100644
  	json_get_values basic_rate_list basic_rate
  	json_get_values scan_list scan_list
  	json_select ..
-@@ -907,10 +1027,8 @@ drv_mac80211_setup() {
+@@ -907,10 +1028,8 @@ drv_mac80211_setup() {
  		return 1
  	}
  
@@ -709,7 +721,7 @@ index 92c56afd24..30d6b9311a 100644
  
  	OLDAPLIST=$(uci -q -P /var/state get wireless._${phy}.aplist)
  	OLDSPLIST=$(uci -q -P /var/state get wireless._${phy}.splist)
-@@ -935,7 +1053,7 @@ drv_mac80211_setup() {
+@@ -935,7 +1054,7 @@ drv_mac80211_setup() {
  	done
  
  	# convert channel to frequency
@@ -718,7 +730,7 @@ index 92c56afd24..30d6b9311a 100644
  
  	[ -n "$country" ] && {
  		iw reg get | grep -q "^country $country:" || {
-@@ -960,6 +1078,7 @@ drv_mac80211_setup() {
+@@ -960,6 +1079,7 @@ drv_mac80211_setup() {
  	set_default txantenna 0xffffffff
  	set_default distance 0
  	set_default antenna_gain 0
@@ -726,7 +738,7 @@ index 92c56afd24..30d6b9311a 100644
  
  	[ "$txantenna" = "all" ] && txantenna=0xffffffff
  	[ "$rxantenna" = "all" ] && rxantenna=0xffffffff
-@@ -1003,6 +1122,7 @@ drv_mac80211_setup() {
+@@ -1003,6 +1123,7 @@ drv_mac80211_setup() {
  	[ -n "$hostapd_ctrl" ] && {
  		local no_reload=1
  		if [ -n "$(ubus list | grep hostapd.$primary_ap)" ]; then
@@ -734,7 +746,7 @@ index 92c56afd24..30d6b9311a 100644
  			[ "${NEW_MD5}" = "${OLD_MD5}" ] || {
  				ubus call hostapd.$primary_ap reload
  				no_reload=$?
-@@ -1077,6 +1197,10 @@ drv_mac80211_teardown() {
+@@ -1077,6 +1198,10 @@ drv_mac80211_teardown() {
  	json_select data
  	json_get_vars phy
  	json_select ..

backports/0039-hostapd-upsate-to-latest-HEAD.patch

@@ -1,14 +1,14 @@
-From 84b526991e77774e21c3eb1a193ca3087b624e83 Mon Sep 17 00:00:00 2001
+From bb2c5ff83be37b0bb951059e457192a7bed9388f Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Thu, 27 May 2021 13:25:19 +0200
-Subject: [PATCH 01/41] hostapd: upsate to latest HEAD
+Subject: [PATCH 01/43] hostapd: upsate to latest HEAD
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
  package/network/services/hostapd/Makefile     |  15 +-
  .../hostapd/files/hostapd-basic.config        |   2 +-
  .../hostapd/files/hostapd-full.config         |   4 +-
- .../network/services/hostapd/files/hostapd.sh | 156 ++++++++--
+ .../network/services/hostapd/files/hostapd.sh | 158 ++++++++--
  ...-fix-frequency-setup-with-HE-enabled.patch | 196 -------------
  .../001-wolfssl-init-RNG-with-ECC-key.patch   |  43 +++
  ...-init-order-disable-pri-sec-channel-.patch | 126 --------
@@ -69,10 +69,10 @@ Signed-off-by: John Crispin <john@phrozen.org>
  .../hostapd/patches/740-snoop_iface.patch     |  37 +++
  ...ate-if-no-available-channel-is-found.patch |  37 ---
  ...of-secondary-device-types-for-P2P-gr.patch |  33 ---
- .../services/hostapd/src/src/ap/ubus.c        | 217 +++++++++++++-
+ .../services/hostapd/src/src/ap/ubus.c        | 214 +++++++++++++-
  .../services/hostapd/src/src/ap/ubus.h        |  16 +
  .../hostapd/src/src/utils/build_features.h    |   2 -
- 67 files changed, 1302 insertions(+), 2330 deletions(-)
+ 67 files changed, 1300 insertions(+), 2331 deletions(-)
  delete mode 100644 package/network/services/hostapd/patches/001-HE-VHT-fix-frequency-setup-with-HE-enabled.patch
  create mode 100644 package/network/services/hostapd/patches/001-wolfssl-init-RNG-with-ECC-key.patch
  delete mode 100644 package/network/services/hostapd/patches/002-mesh-fix-channel-init-order-disable-pri-sec-channel-.patch
@@ -179,7 +179,7 @@ index df272e443a..61b6daf861 100644
  # EAP-SAKE for the integrated EAP server
  #CONFIG_EAP_SAKE=y
 diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh
-index 45a49b8faa..4591958b6f 100644
+index 45a49b8faa..e941fa4f77 100644
 --- a/package/network/services/hostapd/files/hostapd.sh
 +++ b/package/network/services/hostapd/files/hostapd.sh
 @@ -49,6 +49,7 @@ hostapd_append_wpa_key_mgmt() {
@@ -599,7 +599,15 @@ index 45a49b8faa..4591958b6f 100644
  
  	set_default per_sta_vif 0
  	if [ "$per_sta_vif" -gt 0 ]; then
-@@ -1079,9 +1174,9 @@ wpa_supplicant_set_fixed_freq() {
+@@ -1072,16 +1167,16 @@ wpa_supplicant_set_fixed_freq() {
+ 	append network_data "frequency=$freq" "$N$T"
+ 	case "$htmode" in
+ 		NOHT) append network_data "disable_ht=1" "$N$T";;
+-		HT20|VHT20) append network_data "disable_ht40=1" "$N$T";;
++		HT20|VHT20|HE20) append network_data "disable_ht40=1" "$N$T";;
+ 		HT40*|VHT40*|VHT80*|VHT160*) append network_data "ht40=1" "$N$T";;
+ 	esac
+ 	case "$htmode" in
  		VHT*) append network_data "vht=1" "$N$T";;
  	esac
  	case "$htmode" in
@@ -5441,7 +5449,7 @@ index 944f7d71c9..0000000000
 - 		  dev->info.wps_sec_dev_type_list_len);
 - }
 diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c
-index d03b848f94..07c366508c 100644
+index d03b848f94..09b25a29e5 100644
 --- a/package/network/services/hostapd/src/src/ap/ubus.c
 +++ b/package/network/services/hostapd/src/src/ap/ubus.c
 @@ -21,6 +21,7 @@
@@ -5733,7 +5741,7 @@ index d03b848f94..07c366508c 100644
  static const struct ubus_method daemon_methods[] = {
  	UBUS_METHOD("config_add", hostapd_config_add, config_add_policy),
  	UBUS_METHOD("config_remove", hostapd_config_remove, config_remove_policy),
-@@ -1550,3 +1734,24 @@ void hostapd_ubus_notify_beacon_report(
+@@ -1550,3 +1734,21 @@ void hostapd_ubus_notify_beacon_report(
  
  	ubus_notify(ctx, &hapd->ubus.obj, "beacon-report", b.head, -1);
  }
@@ -5744,9 +5752,6 @@ index d03b848f94..07c366508c 100644
 +	struct hostapd_data *hapd;
 +	int i;
 +
-+	if (!hapd->ubus.obj.has_subscribers)
-+		return;
-+
 +	blob_buf_init(&b, 0);
 +	blobmsg_add_u16(&b, "frequency", frequency);
 +	blobmsg_add_u16(&b, "width", chan_width);

backports/0041-ar71xx-hacks.patch

@@ -1,19 +1,20 @@
-From 26aedfa7e2aa5ab583c68638539d5fc173af173f Mon Sep 17 00:00:00 2001
+From d01d8c9e5cf7de98222860011d1d5b362bfde005 Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Mon, 12 Jul 2021 13:09:25 +0200
-Subject: [PATCH 36/37] ar71xx: hacks
+Subject: [PATCH 01/39] ar71xx: hacks
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
  package/kernel/linux/modules/crypto.mk                 | 2 +-
  package/kernel/mac80211/ath.mk                         | 1 +
- 2 files changed, 2 insertions(+), 1 deletion(-)
+ target/linux/ar71xx/files/arch/mips/ath79/mach-rb91x.c | 2 ++
+ 3 files changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/package/kernel/linux/modules/crypto.mk b/package/kernel/linux/modules/crypto.mk
-index c277c6b8ec..9bee6fd8a9 100644
+index 19b0d4696b..1b1c1e1a51 100644
 --- a/package/kernel/linux/modules/crypto.mk
 +++ b/package/kernel/linux/modules/crypto.mk
-@@ -885,7 +885,7 @@ define KernelPackage/crypto-sha256
+@@ -882,7 +882,7 @@ define KernelPackage/crypto-sha256
  	CONFIG_CRYPTO_SHA256_SSSE3
    FILES:= \
  	$(LINUX_DIR)/crypto/sha256_generic.ko \
@@ -34,6 +35,19 @@ index ba03ae11a6..ad2860a98e 100644
  config-$(CONFIG_TARGET_ipq40xx) += ATH10K_AHB
  config-$(CONFIG_PCI) += ATH9K_PCI
  config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD ATH_REG_DYNAMIC_USER_REG_HINTS
+diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb91x.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb91x.c
+index 9620718962..2cdf97efd6 100644
+--- a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb91x.c
++++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb91x.c
+@@ -271,6 +271,8 @@ static const struct rb_board_info rb711gr100_boards[] __initconst = {
+ 	RB_BOARD_INFO("911G-5HPnD", 0),
+ 	RB_BOARD_INFO("912UAG-2HPnD", RB91X_FLAG_USB | RB91X_FLAG_PCIE),
+ 	RB_BOARD_INFO("912UAG-5HPnD", RB91X_FLAG_USB | RB91X_FLAG_PCIE),
++	RB_BOARD_INFO("RB912UAG-2HPnD", RB91X_FLAG_USB | RB91X_FLAG_PCIE),
++	RB_BOARD_INFO("RB912UAG-5HPnD", RB91X_FLAG_USB | RB91X_FLAG_PCIE),
+ };
+ 
+ static u32 rb711gr100_get_flags(const struct rb_info *info)
 -- 
 2.25.1
 

feeds/facebook/fbwifi/Makefile

@@ -0,0 +1,56 @@
+# Copyright (c) Facebook, Inc. and its affiliates.
+# All rights reserved.
+#
+# This source code is licensed under the license found in the
+# LICENSE file in the root directory of this source tree.
+#
+
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=fbwifi
+PKG_VERSION:=2
+PKG_RELEASE:=0
+PKG_LICENSE:=GPL-2.0
+
+PKG_MAINTAINER:=Simon Kinane <skinane@fb.com>
+
+PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/fbwifi
+  SUBMENU:=Captive Portals
+  SECTION:=net
+  CATEGORY:=Network
+  DEPENDS:=+iptables +luasec +luasocket \
+	+luci-base +libuci-lua +luaposix \
+	+luci-mod-network +luci-mod-status +luci-theme-bootstrap \
+	+lua-cjson +uhttpd
+  TITLE:=Facebook Wi-Fi
+  PKGARCH:=all
+endef
+
+define Package/fbwifi/description
+  Facebook Wi-Fi, an AP authorisation solution
+endef
+
+define Package/fbwifi/conffiles
+/etc/config/fbwifi
+endef
+
+define Build/Prepare
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+endef
+
+define Package/fbwifi/install
+	$(INSTALL_DIR) $(1)
+	$(CP) ./files/* $(1)/
+endef
+
+$(eval $(call BuildPackage,fbwifi))

feeds/facebook/fbwifi/README.md

@@ -0,0 +1,55 @@
+# Facebook Wi-Fi v2.0 Reference Implementation for OpenWrt 
+
+## Getting started
+
+Case studies for OEM customers are available at the official page of [Facebook Wi-Fi](https://www.facebook.com/facebook-wifi).
+
+For OEM engineers, start by reading the init script in [files/etc/init.d/fbwifi](https://github.com/facebookincubator/fbc_owrt_feed/blob/master/fbwifi/files/etc/init.d/fbwifi)
+
+## Contents
+
+The 'files' subdirectory contains all the configuration, script and code 
+that implements the Facebook Wi-Fi v2.0 standard for OpenWrt.
+
+The folder structure follows *nix conventions :
+- 'etc' is the boot time scripts and configuration
+- 'usr' contains procedural scripts, lua common code module and GUI prototype for luci
+- 'www' contains the HTTP endpoints as CGI handlers 
+
+```
+files/
+├── etc
+│   ├── config
+│   │   └── fbwifi
+│   ├── hotplug.d
+│   │   └── iface
+│   │       └── 50-fbwifi
+│   ├── init.d
+│   │   └── fbwifi
+├── usr
+│   ├── lib
+│   │   └── lua
+│   │       ├── fbwifi.lua
+│   │       └── luci
+│   │           ├── controller
+│   │           │   └── fbwifi.lua
+│   │           └── view
+│   │               └── fbwifi.htm
+│   ├── sbin
+│   │   ├── fbwifi
+│   │   ├── fbwifi_debug_dump
+│   │   ├── fbwifi_gateway_info_update
+│   │   ├── fbwifi_get_config
+│   │   └── fbwifi_validate_token_db
+│   └── share
+│       └── fbwifi
+│           ├── firewall.include
+│           └── uhttpd.json
+└── www
+    └── cgi-bin
+        └── fbwifi
+            └── v2.0
+                ├── auth
+                ├── capport
+                └── info
+```

feeds/facebook/fbwifi/files/etc/config/fbwifi

@@ -0,0 +1,6 @@
+config fbwifi 'main'
+	option enabled '0'
+	option gateway_token 'FBWIFI:GATEWAY|123456789|0123456789|abcdeABCDE123456789'
+	option http_port '2060'
+	option https_port '2061'
+	option zone 'lan'

feeds/facebook/fbwifi/files/etc/hotplug.d/iface/50-fbwifi

@@ -0,0 +1,10 @@
+#!/bin/sh
+
+[ "$ACTION" = ifup ] || exit 0
+
+/etc/init.d/fbwifi enabled || exit 0
+
+ip route get fibmatch 1.1.1.1 | grep -q "$DEVICE" || exit 0
+
+logger -t fbwifi "Reloading fbwifi due to $ACTION of $INTERFACE ($DEVICE)"
+/etc/init.d/fbwifi restart

feeds/facebook/fbwifi/files/etc/init.d/fbwifi

@@ -0,0 +1,43 @@
+#!/bin/sh /etc/rc.common
+
+START=90
+
+USE_PROCD=1
+
+reload_service() {
+	restart
+}
+
+service_triggers() {
+	procd_add_reload_trigger fbwifi
+}
+
+start_service() {
+
+	config_load fbwifi
+	config_get_bool enabled 'main' 'enabled' '0'
+	[ "$enabled" -eq 0 ] && return
+
+	config_get http_port main http_port
+	[ -z "$http_port" ] && {
+		logger -t fbwifi "required option http_port not set"
+		exit 1
+	}
+
+	config_get https_port main https_port
+	[ -z "$https_port" ] && {
+		logger -t fbwifi "required option https_port not set"
+		exit 1
+	}
+
+	logger "[fbwifi] Enabled; starting"
+
+	mkdir -p /tmp/fbwifi
+
+	/usr/sbin/fbwifi reload
+
+	procd_open_instance
+	procd_set_param command /usr/sbin/fbwifi_validate_token_db
+	procd_set_param respawn 1 300 0
+	procd_close_instance
+}

feeds/facebook/fbwifi/files/usr/lib/lua/fbwifi.lua

@@ -0,0 +1,153 @@
+-- FBWIFI Lua library
+-- function table
+local fbwifi = {}
+
+local http = require("ssl.https")
+local json = require("cjson")
+local log = require("posix.syslog")
+local uci = require("uci")
+
+function fbwifi.gateway_token()
+
+	state = uci.cursor(nil, "/var/state")
+	token = state:get("fbwifi", "main", "gateway_token")
+	if token and string.len(token) > 0 then
+		return token
+	else
+		log.syslog( log.LOG_WARNING, "[fbwifi] UCI option fbwifi.main.gateway_token is missing" )
+		return nil
+	end 
+end
+
+function fbwifi.validate_token( token )
+
+	local valid = false
+
+	if string.len(token or '' ) > 0 then
+
+	        GATEWAY_TOKEN = fbwifi.gateway_token()
+
+	        URL="https://api.fbwifi.com/v2.0/token"
+	        BODY="token="..token
+	        body, code, headers = http.request(URL.."?access_token="..GATEWAY_TOKEN, BODY)
+
+	        if code==200 then
+	                valid = true
+	        else
+	                log.syslog(log.LOG_WARNING, "[fbwifi] validate_token:"..body)
+	        end
+
+	end
+
+	return valid
+end
+
+local mac_to_purge=''
+function remove_client_by_mac(client)
+	state = uci.cursor(nil, "/var/state")
+
+	for key, value in pairs(client) do
+		if
+			key == 'mac' and
+			value == mac_to_purge
+		then
+			log.syslog(log.LOG_INFO, string.format("[fbwifi] Purging DB entry %s for MAC %s", client['.name'] or 'unknown', mac_to_purge) )
+			state:delete("fbwifi", client['.name'])
+			return
+		end
+	end
+end
+
+function fbwifi.instate_client_rule( token, client_mac )
+
+	log.syslog(log.LOG_INFO, "[fbwifi] Validating client "..client_mac)
+
+	state = uci.cursor(nil, "/var/state")
+	state_name = "token_" .. token
+
+	RULE_COND="iptables -w -L FBWIFI_CLIENT_TO_INTERNET -t mangle | grep -i -q \"%s\""
+	RULE_FMT="iptables -w -t mangle -%s FBWIFI_CLIENT_TO_INTERNET -m mac --mac-source \"%s\" -j MARK --set-mark 0xfb"
+	local RULE
+
+	log.syslog(log.LOG_INFO, string.format("[fbwifi] Cleaning DB for MAC %s", client_mac) )
+	mac_to_purge = client_mac
+	state:foreach("fbwifi", "client", remove_client_by_mac)
+	
+		
+	log.syslog(log.LOG_INFO, string.format("[fbwifi] Adding DB entry %s for MAC %s", state_name, client_mac) )
+	state:set("fbwifi", state_name, "client")
+	state:set("fbwifi", state_name, "token", token)
+	state:set("fbwifi", state_name, "mac", client_mac)
+	state:set("fbwifi", state_name, "authenticated", "true")
+				
+	-- verify a rule exists for the given client MAC, 
+	--   OR install it
+	RULE=string.format(RULE_COND.." || "..RULE_FMT, client_mac, "A", client_mac)
+
+	log.syslog(log.LOG_INFO, string.format( "[fbwifi] Opening iptables for %s", client_mac ) )
+	res = os.execute(RULE)
+	if res ~= 0 then 
+		log.syslog(log.LOG_WARNING, string.format( "[fbwifi] Failed to update iptables (%s)", res ) )
+	end
+	log.syslog(log.LOG_INFO, "[fbwifi] "..RULE)
+	
+	state:save('fbwifi')
+end
+
+function fbwifi.revoke_client_rule( token )
+        
+        if (token == nil) then
+                log.syslog(log.LOG_INFO, "[fbwifi] Invalidating token, but token is Nil")
+                return
+        end
+
+	log.syslog(log.LOG_INFO, string.format( "[fbwifi] Invalidating token (%s)", token) )
+
+	state = uci.cursor(nil, "/var/state")
+	state_name = "token_" .. token
+	
+	client_mac = state:get("fbwifi", state_name, "mac")
+
+	if client_mac then
+		RULE_COND="iptables -w -L FBWIFI_CLIENT_TO_INTERNET -t mangle | grep -i -q \"%s\""
+		RULE_FMT="iptables -w -t mangle -%s FBWIFI_CLIENT_TO_INTERNET -m mac --mac-source \"%s\" -j MARK --set-mark 0xfb"
+
+		-- verify a rule exists for the given client MAC, 
+		--  AND delete it
+		RULE=string.format(RULE_COND.." && "..RULE_FMT, client_mac, "D", client_mac)
+
+		res = os.execute(RULE)
+		if res ~= 0 then 
+			log.syslog(log.LOG_WARNING, string.format( "[fbwifi] Failed to update iptables (%s)", res ) )
+		end
+		log.syslog(log.LOG_INFO, "[fbwifi] "..RULE)
+
+		state:delete("fbwifi", state_name)
+		state:save('fbwifi')
+	else
+		log.syslog(log.LOG_WARNING, string.format( "[fbwifi] Client MAC not found in DB (%s)", state_name ) )
+	end
+end
+
+function fbwifi.reset()
+
+	local success = false
+        GATEWAY_TOKEN = fbwifi.gateway_token()
+        URL="https://api.fbwifi.com/v2.0/gateway/reset"
+	BODY="{}"
+        body, code, headers = http.request(URL.."?access_token="..GATEWAY_TOKEN, BODY)
+
+        if code==200 then
+                log.syslog(log.LOG_INFO, "[fbwifi] Reset committed")
+                success = true
+        else
+                log.syslog(log.LOG_WARNING, "[fbwifi] Reset failed : "..body)
+        end
+
+	return success
+end
+
+--
+-- Return the function table to the host script
+--
+return fbwifi

feeds/facebook/fbwifi/files/usr/lib/lua/luci/controller/fbwifi.lua

@@ -0,0 +1,12 @@
+-- Copyright 
+-- Licensed to the public under the GNU General Public License v2.
+
+module("luci.controller.fbwifi", package.seeall)
+
+sys = require "luci.sys"
+ut = require "luci.util"
+
+function index()
+    entry({"admin", "network", "fbwifi"}, template("fbwifi"), "Facebook Wi-Fi", 90).dependent=false
+end
+

feeds/facebook/fbwifi/files/usr/lib/lua/luci/view/fbwifi.htm

@@ -0,0 +1,16 @@
+<%#
+ Copyright
+ Licensed to the public under the GNU General Public License v2.
+-%>
+
+<%+header%>
+
+<h1>Facebook Wi-Fi</h1>
+<%
+	require("uci")
+	state = uci.cursor(nil, "/var/state")
+	url = state:get("fbwifi", "main", "captive_portal_config_url")
+%>
+<a href="<% print(url) %>">Configure FB business page</a>
+
+<%+footer%>

feeds/facebook/fbwifi/files/usr/sbin/fbwifi

@@ -0,0 +1,57 @@
+#!/bin/sh
+
+case "$1" in
+disable)
+	uci set fbwifi.main.enabled=0
+
+	uci delete firewall.fbwifi
+
+	uci delete uhttpd.fbwifi_redirect
+
+	uci delete uhttpd.main.json_script
+	uci set uhttpd.main.cert='/etc/uhttpd.crt'
+	uci set uhttpd.main.key='/etc/uhttpd.key'
+	uci set uhttpd.main.rfc1918_filter=1
+	;;
+enable)
+	uci set fbwifi.main.enabled=1
+
+	uci set firewall.fbwifi=include
+	uci set firewall.fbwifi.enabled=1
+	uci set firewall.fbwifi.family=ipv4
+	uci set firewall.fbwifi.path=/usr/share/fbwifi/firewall.include
+	uci set firewall.fbwifi.reload=1
+	uci set firewall.fbwifi.type=script
+
+	uci set uhttpd.fbwifi_redirect=uhttpd
+	uci set uhttpd.fbwifi_redirect.enabled=1
+	uci set uhttpd.fbwifi_redirect.cert='/tmp/fbwifi/https_server_cert'
+	uci set uhttpd.fbwifi_redirect.json_script='/tmp/fbwifi/uhttpd-redirect.json'
+	uci set uhttpd.fbwifi_redirect.key='/tmp/fbwifi/https_server_key'
+	uci set uhttpd.fbwifi_redirect.listen_http='0.0.0.0:2060'
+	uci set uhttpd.fbwifi_redirect.listen_https='0.0.0.0:2061'
+
+	uci set uhttpd.main.cert='/tmp/fbwifi/https_server_cert'
+	uci set uhttpd.main.json_script='/usr/share/fbwifi/uhttpd.json'
+	uci set uhttpd.main.key='/tmp/fbwifi/https_server_key'
+	uci set uhttpd.main.rfc1918_filter=0
+	;;
+reload)
+	/usr/sbin/fbwifi_get_config
+
+	login_url=$(uci -p /var/state get fbwifi.main.captive_portal_url)
+	[ -z "$login_url" ] && {
+		logger -t fbwifi "captive_portal_url not available yet"
+		exit 1
+	}
+	printf '{ "request": [ ["redirect", "%s", 302] ] }' "$login_url" > /tmp/fbwifi/uhttpd-redirect.json
+
+	/etc/init.d/uhttpd restart
+
+	exit 0
+	;;
+esac
+
+uci commit
+/etc/init.d/uhttpd restart
+reload_config

feeds/facebook/fbwifi/files/usr/sbin/fbwifi_debug_dump

@@ -0,0 +1,8 @@
+echo -e "Runtime configuration and token DB\n"
+uci -p /var/state export fbwifi
+
+echo -e "\nDynamic firewall flow rules\n"
+iptables -t mangle -L FBWIFI_CLIENT_TO_INTERNET
+
+echo -e "\nDHCP leases\n"
+cat /tmp/dhcp.leases

feeds/facebook/fbwifi/files/usr/sbin/fbwifi_gateway_info_update

@@ -0,0 +1,38 @@
+#!/usr/bin/lua
+
+http = require("ssl.https")
+json = require("cjson")
+log = require("posix.syslog")
+socket = require("socket")
+require("uci")
+fbwifi = require("fbwifi")
+
+GATEWAY_TOKEN = fbwifi.gateway_token()
+state = uci.cursor(nil, "/var/state")
+
+payload="name="..socket.dns.gethostname()
+
+function queue_ssid_update(iface)
+	bssid_file="/sys/class/net/br-"..iface["network"].."/address"
+	local file = io.open(bssid_file)
+        if file then
+            for line in file:lines() do
+		payload=payload.."&bssid[]="..line
+            end
+	    payload=payload.."ssid[]="..iface["ssid"]
+        else
+	    log.syslog(log.LOG_WARNING, "[fbwifi] Failed to find BSSID for interface br-"..iface["network"])
+        end
+end
+
+state:foreach("wireless", "wifi-iface", queue_ssid_update)
+
+URL="https://api.fbwifi.com/v2.0/gateway"
+body, code, headers = http.request(URL.."?access_token="..GATEWAY_TOKEN, payload)
+if code == 200 then 
+	log.syslog(log.LOG_INFO, "[fbwifi] gateway information updated "..body)
+	os.exit(0)
+else
+	log.syslog(log.LOG_WARNING, "[fbwifi] gateway API failed "..body)
+	os.exit(code)
+end

feeds/facebook/fbwifi/files/usr/sbin/fbwifi_get_config

@@ -0,0 +1,106 @@
+#!/usr/bin/lua
+http = require("ssl.https")
+json = require("cjson")
+require("uci")
+log = require("posix.syslog")
+fbwifi = require("fbwifi")
+
+GATEWAY_TOKEN = fbwifi.gateway_token()
+
+http_port = uci.get("fbwifi.main.http_port")
+https_port = uci.get("fbwifi.main.https_port")
+
+state = uci.cursor(nil, "/var/state")
+
+URL="https://api.fbwifi.com/v2.0/gateway"
+body, code, headers = http.request(URL.."?access_token="..GATEWAY_TOKEN.."&fields=config,config_version")
+
+if code == 200 then
+	log.syslog(log.LOG_INFO, "[fbwifi] Got gateway config ("..code..")")
+else
+	log.syslog(log.LOG_CRIT, "[fbwifi] Failed to get gateway config ("..code..")")
+	os.exit(1)
+end
+
+obj = json.decode(body)
+
+function save_cert(name, value)
+	log.syslog(log.LOG_INFO, "[fbwifi] Saving cert "..name)
+	local f = assert(io.open("/tmp/fbwifi/"..name, "w"))
+	f:write(value)
+	f:close()
+end
+
+function process_redirect(ix, host)
+	IP_SET = "ip addr replace dev lo "..host
+	local result = os.execute(IP_SET)
+	if result == 0 then
+		log.syslog(log.LOG_INFO, "[fbwifi] Redirect address applied "..host)
+	else
+		log.syslog(log.LOG_WARNING, "[fbwifi] Failed to apply redirect address "..host)
+	end
+
+	ip = string.match(host, '([0-9\.]*)/([0-9]*)')
+	RULE_FMT="grep -q \"%s\" /etc/hosts || echo \"%s\tstar.fbwifigateway.net\" >> /etc/hosts"
+	HOSTS_RULE = string.format(RULE_FMT, ip, ip)
+	result = os.execute(HOSTS_RULE)
+	if result == 0 then
+		log.syslog(log.LOG_INFO, "[fbwifi] Cached redirect host for DNS")
+	else
+		log.syslog(log.LOG_WARNING, "[fbwifi] Failed to amend /etc/hosts")
+		log.syslog(log.LOG_INFO, "[fbwifi] "..HOSTS_RULE)
+	end
+
+	result = os.execute("iptables -t nat -A FBWIFI_HOST_REDIRLIST -p tcp --dport 80 -d "..ip.." -j ACCEPT # REDIRECT --to-ports "..http_port)
+	--print(result)
+	result = os.execute("iptables -t nat -A FBWIFI_HOST_REDIRLIST -p tcp --dport 443 -d "..ip.."  -j ACCEPT # REDIRECT --to-ports "..https_port)
+	--print(result)
+end
+
+save_cert("https_server_cert", obj['config']['https_server_cert'])
+save_cert("https_server_key", obj['config']['https_server_key'])
+
+result = os.execute("iptables -t nat -F FBWIFI_HOST_REDIRLIST")
+--print(result)
+table.foreach(obj['config']['host_redirect_ips'], process_redirect)
+
+RULE_FORMAT = "iptables -t mangle -A FBWIFI_TRAFFIC_ALLOWLIST -d %s -p %s --dport %s -j MARK --set-mark 0xfb"
+function process_traffic_rule(ix, rule)
+	log.syslog(log.LOG_INFO, "[fbwifi] Traffic rule "..ix)
+	
+	if rule["protocol"] == 6 then
+		PROTO = "tcp"
+	elseif rule["protocol"] == 17 then
+		PROTO = "udp"
+	end
+	RULE = string.format(RULE_FORMAT, rule["ip"], PROTO, rule["port"])
+	local result = os.execute(RULE)
+	if result == 0 then
+		log.syslog(log.LOG_INFO, "[fbwifi] Traffic rule "..ix)
+	else
+		log.syslog(log.LOG_WARNING, "[fbwifi] Failed to install traffic rule ; "..RULE)
+	end
+end
+
+local cross_origin_list = {}
+function process_cross_origin_rule(ix, url)
+	log.syslog(log.LOG_INFO, "[fbwifi] Cross origin rule "..url)
+	table.insert(cross_origin_list, url)
+end
+
+function process_url(url_purpose, fqdn)
+	log.syslog(log.LOG_INFO, "[fbwifi] Caching "..url_purpose)
+	state:set("fbwifi", "main", url_purpose, fqdn)	
+end
+
+state:set("fbwifi", "main", "config")
+
+result = os.execute("iptables -t mangle -F FBWIFI_TRAFFIC_ALLOWLIST ")
+--print(result)
+table.foreach(obj['config']['traffic_allowlist'], process_traffic_rule)
+table.foreach(obj['config']['cross_origin_allowlist'], process_cross_origin_rule)
+table.foreach(obj['config']['urls'], process_url)
+state:set("fbwifi", "main", "cross_origin_allow_rules", cross_origin_list)
+
+state:set("fbwifi", "main", "config_version", obj['config_version'])
+state:save('fbwifi')

feeds/facebook/fbwifi/files/usr/sbin/fbwifi_validate_token_db

@@ -0,0 +1,75 @@
+#!/usr/bin/lua
+
+https = require("ssl.https")
+json = require("cjson")
+log = require("posix.syslog")
+fbwifi = require("fbwifi")
+require("uci")
+
+state = uci.cursor(nil, "/var/state")
+GATEWAY_TOKEN = fbwifi.gateway_token()
+
+request = { 
+	tokens = {}, 
+	traffic_type = "total",
+	config_version = state:get("fbwifi", "main", "config_version")
+}
+
+function queue_token(client)
+
+	request.tokens[client.token]={
+		incoming = json.null,
+		outgoing = json.null,
+		connected_time_sec = json.null,
+		inactive_time_sec = json.null,
+		signal_rssi_dbm = json.null,
+		--expected_tpus_mbps = json.null,
+		is_connected = true
+	}
+
+end
+
+state:foreach("fbwifi", "client", queue_token)
+print( "\nRequest:\n"..json.encode(request) )
+
+URL="https://api.fbwifi.com/v2.0/tokens"
+BODY=string.format(
+	"tokens=%s&traffic_type=%s&config_version=%s",
+	json.encode(request.tokens),
+	"'total'",
+	state:get("fbwifi", "main", "config_version")
+)
+
+body, code, headers = https.request(URL.."?access_token="..GATEWAY_TOKEN, BODY)
+
+if code then
+	print( "\nResponse:\n"..body )
+end
+
+response = json.decode(body)
+--print(response)
+--table.foreach(response,print)
+--table.foreach(response.tokens,print)
+
+if response.config_valid then
+	log.syslog(log.LOG_INFO, "[fbwifi] Config validated")
+else
+	log.syslog(log.LOG_WARNING, "[fbwifi] config is stale, refreshing config")
+        local result = os.execute("/usr/sbin/fbwifi reload")
+        if result == 0 then
+                log.syslog(log.LOG_INFO, "[fbwifi] successfully fetched and loaded new config ")
+        else
+                log.syslog(log.LOG_WARNING, "[fbwifi] failed to fetch and load new config, possible stale config")
+        end
+end
+
+function process_token(token, metadata)
+	table.foreach(metadata,print)
+	if metadata.valid then
+		print("OK: "..token)	
+	else
+		print("Nok: "..token)	
+		fbwifi.revoke_client_rule( token )
+	end
+end
+table.foreach(response.tokens,process_token)

feeds/facebook/fbwifi/files/usr/share/fbwifi/firewall.include

@@ -0,0 +1,67 @@
+#!/bin/sh
+
+IPT4="/usr/sbin/iptables"
+
+fbwifi_http_port="$(uci get fbwifi.main.http_port)"
+[ -n "$fbwifi_http_port" ] || {
+	logger -t fbwifi "required option http_port not set"
+	exit 1
+}
+
+fbwifi_https_port="$(uci get fbwifi.main.https_port)"
+[ -n "$fbwifi_https_port" ] || {
+	logger -t fbwifi "required option https_port not set"
+	exit 1
+}
+
+fbwifi_zone="$(uci get fbwifi.main.zone)"
+[ -n "$fbwifi_zone" ] || {
+	logger -t fbwifi "required option zone  not set"
+	exit 1
+}
+
+fbwifi_ifaces="$(fw3 -q zone "$fbwifi_zone")"
+
+## Create custom chains
+$IPT4 -t filter -N FBWIFI_FORWARD 2>/dev/null
+$IPT4 -t filter -N FBWIFI_INPUT 2>/dev/null
+$IPT4 -t mangle -N FBWIFI_CLIENT_TO_INTERNET 2>/dev/null
+$IPT4 -t mangle -N FBWIFI_PREROUTING 2>/dev/null
+$IPT4 -t mangle -N FBWIFI_TRAFFIC_ALLOWLIST 2>/dev/null
+$IPT4 -t nat -N FBWIFI_CLIENT_TO_INTERNET 2>/dev/null
+$IPT4 -t nat -N FBWIFI_PREROUTING 2>/dev/null
+$IPT4 -t nat -N FBWIFI_HOST_REDIRLIST 2>/dev/null
+
+## Flush custom chains
+$IPT4 -t filter -F FBWIFI_FORWARD
+$IPT4 -t filter -F FBWIFI_INPUT
+$IPT4 -t mangle -F FBWIFI_CLIENT_TO_INTERNET
+$IPT4 -t mangle -F FBWIFI_PREROUTING
+$IPT4 -t mangle -F FBWIFI_TRAFFIC_ALLOWLIST
+$IPT4 -t nat -F FBWIFI_CLIENT_TO_INTERNET
+$IPT4 -t nat -F FBWIFI_PREROUTING
+$IPT4 -t nat -F FBWIFI_HOST_REDIRLIST
+
+## Populate custom chains
+$IPT4 -t filter -A FBWIFI_FORWARD -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+$IPT4 -t filter -A FBWIFI_FORWARD -m conntrack --ctstate NEW -m mark --mark 0xfb -j ACCEPT
+$IPT4 -t filter -A FBWIFI_FORWARD -j REJECT
+$IPT4 -t filter -A FBWIFI_INPUT -p tcp --dport "$fbwifi_http_port" -m conntrack --ctstate NEW -j ACCEPT
+$IPT4 -t filter -A FBWIFI_INPUT -p tcp --dport "$fbwifi_https_port"  -m conntrack --ctstate NEW -j ACCEPT
+$IPT4 -t mangle -A FBWIFI_PREROUTING -j FBWIFI_CLIENT_TO_INTERNET
+$IPT4 -t mangle -A FBWIFI_PREROUTING -j FBWIFI_TRAFFIC_ALLOWLIST
+$IPT4 -t nat -A FBWIFI_PREROUTING -j FBWIFI_CLIENT_TO_INTERNET
+$IPT4 -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 80 -m conntrack --ctstate NEW -j FBWIFI_HOST_REDIRLIST
+$IPT4 -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 443 -m conntrack --ctstate NEW -j FBWIFI_HOST_REDIRLIST
+$IPT4 -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 80 -m conntrack --ctstate NEW -m mark --mark 0xfb -j ACCEPT
+$IPT4 -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 443 -m conntrack --ctstate NEW -m mark --mark 0xfb -j ACCEPT
+$IPT4 -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 80 -m conntrack --ctstate NEW -j REDIRECT --to-ports "$fbwifi_http_port"
+
+## Hook custom chains in firewall3 chains
+$IPT4 -t filter -I "zone_${fbwifi_zone}_input" 2 -j FBWIFI_INPUT
+$IPT4 -t filter -I "zone_${fbwifi_zone}_forward" 2 -j FBWIFI_FORWARD
+$IPT4 -t nat -I "zone_${fbwifi_zone}_prerouting" 2 -j FBWIFI_PREROUTING
+# There are no firewall3 zone chains in the mangle table so we need to do this for all interfaces in the zone
+for iface in $fbwifi_ifaces; do
+	$IPT4 -t mangle -I PREROUTING -i "$iface" -j FBWIFI_PREROUTING
+done

feeds/facebook/fbwifi/files/usr/share/fbwifi/uhttpd.json

@@ -0,0 +1,8 @@
+{
+  "request": [
+    [ "if",
+      [ "regex", "REQUEST_URI", "^/fbwifi" ],
+      [ "rewrite", "/cgi-bin%REQUEST_URI%" ]
+    ]
+  ]
+}

feeds/facebook/fbwifi/files/www/cgi-bin/fbwifi/v2.0/auth

@@ -0,0 +1,69 @@
+#!/usr/bin/lua
+require("uci")
+log = require("posix.syslog")
+fbwifi = require("fbwifi")
+
+state = uci.cursor(nil, "/var/state")
+function process_cors()
+	origin = os.getenv("HTTP_ORIGIN")
+	log.syslog(log.LOG_INFO, string.format("[fbwifi] [auth] process_cors origin %s", origin or 'not found') )
+	if string.len(origin or '') > 0 then
+		allow_list = state:get("fbwifi", "main", "cross_origin_allow_rules")
+		for _, value in pairs(allow_list) do
+    			if value == origin then
+				log.syslog(log.LOG_INFO, "[fbwifi] [auth] process_cors Appending CORS Headers to HTTP")
+				print("Access-Control-Allow-Origin: "..origin)
+				print("Vary: Origin")
+				break
+			end
+		end
+	else	
+		log.syslog(log.LOG_INFO, "[fbwifi] [auth] process_cors No CORS Headers added to Response")
+	end
+end
+
+method = os.getenv("REQUEST_METHOD")
+if method == 'GET' then
+	log.syslog(log.LOG_INFO, "[fbwifi] [auth] GET handler")
+	print("Status: 302")
+	print("Location: "..state:get("fbwifi", "main", "landing_page_url"))
+	process_cors()
+	print ('\n')
+
+elseif method == 'POST' then
+	local token
+	
+	log.syslog(log.LOG_INFO, "[fbwifi] [auth] POST handler")
+	process_cors()
+	print("Status: 200")
+
+	form_data=io.read()
+	while form_data do
+		token = string.match(form_data, '[%d]+')
+		if string.len(token or '') > 14 then
+
+			client = os.getenv("REMOTE_ADDR")
+			f = io.popen("awk '/"..client.."/ { printf(\"%s\", $4) }' /proc/net/arp", 'r')
+			client_mac = assert(f:read('*a'))
+
+			if fbwifi.validate_token(token) then
+                                log.syslog(log.LOG_INFO, string.format( "[fbwifi] [auth] POST handler : Validating Token (%s) for MAC (%s)", token or 'nil', client_mac or 'nil') )
+				fbwifi.instate_client_rule(token, client_mac)
+				print("\n{\"valid\":true}\n")
+			else
+                                log.syslog(log.LOG_WARNING, string.format( "[fbwifi] [auth] POST handler : ! Invalid token (%s) for mac (%s) !", token or 'nil', client_mac or 'nil') )
+				fbwifi.revoke_client_rule(token)
+				print("\n{\"valid\":false}\n")
+			end
+			log.syslog(log.LOG_INFO, "[fbwifi] [auth] POST handler completed")
+			return
+		end
+
+		form_data=io.read()
+	end
+	print ('\n')
+
+	log.syslog(log.LOG_WARNING, string.format("[fbwifi] [auth] POST handler : token not found" ))
+	fbwifi.revoke_client_rule(token)
+	print("\n{\"valid\":false}\n")
+end

feeds/facebook/fbwifi/files/www/cgi-bin/fbwifi/v2.0/capport

@@ -0,0 +1,41 @@
+#!/usr/bin/lua
+json = require("cjson")
+require("uci")
+
+state = uci.cursor(nil, "/var/state")
+client_mac = ""
+token = ""
+
+response = {}
+response['venue-info-url'] = state:get("fbwifi", "main", "capport_venue_info_url")
+
+function map_remote_mac_to_token(client)
+        for key, value in pairs(client) do
+                if
+                        key == 'mac' and
+                        value == client_mac
+                then
+			token = client.token
+                        return false
+                end
+        end
+end
+
+function hasValidToken(client_ip)
+	f = io.popen("awk '/"..client_ip.."/ { printf(\"%s\", $4) }' /proc/net/arp", 'r')
+	client_mac = assert(f:read('*a'))
+	state:foreach("fbwifi", "client", map_remote_mac_to_token)
+
+	return 0 < string.len(token)
+end
+
+print("Content-type: application/captive+json; charset=utf-8\n")
+
+client = os.getenv("REMOTE_ADDR")
+response['captive'] = not hasValidToken(client)
+
+if response['captive'] then
+	response['user-portal-url'] = state:get("fbwifi", "main", "captive_portal_url")
+end
+
+print( json.encode(response) )

feeds/facebook/fbwifi/files/www/cgi-bin/fbwifi/v2.0/info

@@ -0,0 +1,58 @@
+#!/usr/bin/lua
+require "luci.cacheloader"
+require "luci.sgi.cgi"
+json = require("cjson")
+fbwifi = require("fbwifi")
+
+state = uci.cursor(nil, "/var/state")
+GATEWAY_TOKEN = fbwifi.gateway_token()
+
+response = { api_version = "2.0", token = json.null }
+client_mac = ""
+
+function process_cors()
+        origin = os.getenv("HTTP_ORIGIN")
+        if string.len(origin or '') > 0 then
+                allow_list = state:get("fbwifi", "main", "cross_origin_allow_rules")
+                for _, value in pairs(allow_list) do
+                        if value == origin then
+                                print("Access-Control-Allow-Origin: "..origin)
+                                print("Vary: Origin")
+                                break
+                        end
+                end
+        end
+end
+
+function map_remote_mac_to_token(client)
+
+	for key, value in pairs(client) do
+		if
+			key == 'mac' and
+			value == client_mac
+		then
+			response.token = client.token
+			return false -- escape outer loop
+		end
+	end
+end
+
+function getClientToken(client_ip)
+	f = io.popen("awk '/"..client_ip.."/ { printf(\"%s\", $4) }' /proc/net/arp", 'r')
+	client_mac = assert(f:read('*a'))
+
+	state:foreach("fbwifi", "client", map_remote_mac_to_token)
+end
+
+function getGatewayId()
+	id = string.match(GATEWAY_TOKEN, 'FBWIFI:GATEWAY|[0-9]*|([0-9]*)')
+	return id
+end
+
+process_cors()
+print("Content-type: application/json; charset=utf-8\n")
+
+getClientToken(os.getenv("REMOTE_ADDR"))
+response.gateway_id = getGatewayId()
+
+print( json.encode(response) )

feeds/openflow/openvswitch/Config.in

@@ -0,0 +1,8 @@
+menu "Configuration"
+	depends on PACKAGE_openvswitch
+
+	config	OPENVSWITCH_WITH_LIBUNBOUND
+		bool
+		default y
+		prompt "Build with libunbound library."
+endmenu

feeds/openflow/openvswitch/Makefile

@@ -17,10 +17,10 @@ include ./openvswitch.mk
 #
 PKG_NAME:=openvswitch
 PKG_VERSION:=$(ovs_version)
-PKG_RELEASE:=1
+PKG_RELEASE:=6
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://www.openvswitch.org/releases/
-PKG_HASH:=7d5797f2bf2449c6a266149e88f72123540f7fe7f31ad52902057ae8d8f88c38
+PKG_HASH:=55e3b7e59b3e52eeecccc783266be39780e1f693c0a974f180b4ec8256f48d6a
 
 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
@@ -40,6 +40,9 @@ include $(INCLUDE_DIR)/package.mk
 include $(TOPDIR)/feeds/packages/lang/python/python3-host.mk
 include $(TOPDIR)/feeds/packages/lang/python/python3-package.mk
 
+define Package/openvswitch/config
+source "$(SOURCE)/Config.in"
+endef
 
 ovs_kmod_packages:=
 ovs_kmod_intree_kernel_patchver_min:=3.10
@@ -150,8 +153,11 @@ $(eval $(call OvsKmodPackageTemplate,openvswitch-lisp-intree))
 #
 ovs_libopenvswitch_title:=Open vSwitch (libopenvswitch.so)
 ovs_libopenvswitch_hidden:=1
-ovs_libopenvswitch_depends:=+libopenssl +libunbound +!(arc||arceb):libunwind
+ovs_libopenvswitch_depends:=+libopenssl +!(arc||arceb):libunwind
 ovs_libopenvswitch_depends+=+libatomic
+ifeq ($(CONFIG_KEEPALIVED_ROUTES),y)
+ovs_libopenvswitch_depends+=+libunbound
+endif
 ovs_libopenvswitch_files:=usr/lib/libopenvswitch*.so*
 $(eval $(call OvsPackageTemplate,libopenvswitch))
 
@@ -243,6 +249,7 @@ CONFIGURE_ARGS+= \
 	--disable-silent-rules \
 
 CONFIGURE_VARS += \
+	$(if $(CONFIG_OPENVSWITCH_WITH_LIBUNBOUND),,ac_cv_lib_unbound_ub_ctx_create=no) \
 	ovs_cv_flake8=no \
 	ovs_cv_python3=$(PYTHON3) \
 	ovs_cv_python3_host=$(HOST_PYTHON3_BIN) \

feeds/openflow/openvswitch/README.md

@@ -63,17 +63,42 @@ E.g. replace in-tree datapath module with upstream version
 
 # UCI configuration options
 
-There are 4 config section types in package openvswitch:
+There are 5 config section types in package openvswitch:
 ovs ovn_northd, ovn_controller & ovs_bridge.
 
 Each of these supports a disabled option, which should be 
 set to 0 to launch the respective daemons.
 
+The ovs section section also supports the options below, to configure a set of
+SSL CA, certificate and private key. After adding these to Open vSwitch, you
+may specify ssl: connection methods for e.g. the OpenFlow controller. Note that
+Open vSwitch only reads these files during startup, so it needs to be restarted
+after adding or changing these options.
+
+| Name     | Type    | Required | Default | Description                       |
+|----------|---------|----------|---------|-----------------------------------|
+| disabled | boolean | no       | 0       | If set to 1, do not configure SSL |
+| ca       | string  | no       | (none)  | Path to CA certificate            |
+| cert     | string  | no       | (none)  | Path to certificate               |
+| key      | string  | no       | (none)  | Path to private key               |
+
 The ovs_bridge section also supports the options below,
 for initialising a virtual bridge with an OpenFlow controller.
 
 | Name        | Type    | Required | Default                        | Description                                                |
-|------------|---------|----------|--------------------------------|------------------------------------------------------------|
+|-------------|---------|----------|--------------------------------|------------------------------------------------------------|
 | disabled    | boolean | no       | 0                              | If set to true, disable initialisation of the named bridge |
 | name        | string  | no       | Inherits UCI config block name | The name of the switch in the OVS daemon                   |
 | controller  | string  | no       | (none)                         | The endpoint of an OpenFlow controller for this bridge     |
+| datapath_id | string  | no       | (none)                         | The OpenFlow datapath ID for this bridge                   |
+
+The ovs_port section can be used to add ports to a bridge. It supports the options below.
+
+| Name     | Type    | Required | Default | Description
+| ---------|---------|----------|---------|------------------------------------------------|
+| disabled | boolean | no       | 0       | If set to 1, do not add the port to the bridge |
+| bridge   | string  | yes      | (none)  | Name of the bridge to add the port to          |
+| port     | string  | yes      | (none)  | Name of the port to add to the bridge          |
+| ofport   | integer | no       | (none)  | OpenFlow port number to be used by the port    |
+| tag      | integer | no       | (none)  | 802.1Q VLAN tag to set on the port             |
+| type     | string  | no       | (none)  | Port type, e.g. internal, erspan, type, ...    |

feeds/openflow/openvswitch/files/openvswitch.config

@@ -1,5 +1,8 @@
 config ovs ovs
 	option disabled 1
+	option ca '/etc/openvswitch/example_ca.crt'
+	option cert '/etc/openvswitch/example_cert.crt'
+	option key '/etc/openvswitch/example_key.crt'
 
 config ovn_northd north
 	option disabled 1
@@ -11,3 +14,12 @@ config ovs_bridge
 	option disabled 1
 	option name 'my-bridge'
 	option controller 'tcp:192.168.0.1'
+	option datapath_id ''
+
+config ovs_port
+	option disabled 1
+	option bridge 'my-bridge'
+	option port 'ovs-port1'
+	option ofport '1'
+	option tag '123'
+	option type 'internal'

feeds/openflow/openvswitch/files/openvswitch.init

@@ -7,6 +7,8 @@
 . /lib/functions/procd.sh
 START=15
 
+basescript=$(readlink "$initscript")
+
 ovs_ctl="/usr/share/openvswitch/scripts/ovs-ctl"; [ -x "$ovs_ctl" ] || ovs_ctl=:
 ovn_ctl="/usr/share/ovn/scripts/ovn-ctl"; [ -x "$ovn_ctl" ] || ovn_ctl=:
 
@@ -59,7 +61,12 @@ ovs_action() {
 		config_foreach "ovs_xx" "$cfgtype" "$action" "$cfgtype"
 	done
 
+	case "$action" in
+		restart|start)
 			config_foreach ovs_bridge_init "ovs_bridge"
+			;;
+	esac
+
 }
 
 ovs_xx() {
@@ -83,6 +90,7 @@ ovs_xx() {
 		ovs)
 			"$ovs_ctl" "$action" \
 				--system-id=random 1000>&-
+			ovs_set_ssl
 			;;
 		ovn_*)
 			"$ovn_ctl" "${action}_${cfgtype#ovn_}"
@@ -116,6 +124,47 @@ ovs_bridge_port_add() {
 	__port_list="$__port_list ${port} "
 }
 
+ovs_bridge_port_add_complex() {
+	local cfg="$1"
+	local cur_bridge="$2"
+
+	local bridge disabled ofport port tag type
+	local cur_tag cur_type del_port
+
+	config_get_bool disabled "$cfg" disabled 0
+	[ "$disabled" = "0" ] || return
+
+	config_get bridge "$cfg" bridge
+	[ "$bridge" = "$cur_bridge" ] || return
+	ovs-vsctl br-exists "$bridge" || return
+
+	config_get port "$cfg" port
+	[ -n "$port" ] || return
+
+	config_get ofport "$cfg" ofport
+
+	config_get tag "$cfg" tag
+	if [ -n "$tag" ]; then
+		if cur_tag="$(ovs-vsctl get port "$port" tag 2>/dev/null)"; then
+			[ "$tag" = "$cur_tag" ] || del_port=1
+		fi
+	fi
+
+	config_get type "$cfg" type
+	if [ -n "$type" ]; then
+		if cur_type="$(ovs-vsctl get interface "$port" type 2>/dev/null)"; then
+			[ "$type" = "$cur_type" ] || del_port=1
+		fi
+	fi
+
+	[ "${del_port:-0}" -eq 1 ] && ovs-vsctl --if-exists del-port "$bridge" "$port"
+
+	ovs-vsctl --may-exist add-port "$bridge" "$port" ${tag:+tag="$tag"} \
+		${ofport:+ -- set interface "$port" ofport_request="$ofport"} \
+		${type:+ -- set interface "$port" type="$type"}
+	__port_list="$__port_list ${port} "
+}
+
 ovs_bridge_port_cleanup() {
 	for port in `ovs-vsctl list-ports "$name"`; do
 		case "$__port_list" in
@@ -125,12 +174,26 @@ ovs_bridge_port_cleanup() {
 	done
 }
 
+ovs_bridge_validate_datapath_id() {
+	local dpid="$1"
+
+	if expr "$dpid" : '[[:xdigit:]]\{16\}$' > /dev/null; then
+		return 0
+	elif expr "$dpid" : '0x[[:xdigit:]]\{1,16\}$' > /dev/null; then
+		return 0
+	else
+		logger -t openvswitch "invalid datapath_id: $dpid"
+		return 1
+	fi
+}
+
 ovs_bridge_init() {
 	local cfg="$1"
 
 	local disabled
 	local name
 	local controller
+	local datapath_id
 
 	config_get_bool disabled "$cfg" disabled 0
 	[ "$disabled" == "0" ] || return
@@ -138,7 +201,15 @@ ovs_bridge_init() {
 	config_get name "$cfg" name $cfg
 	ovs-vsctl --may-exist add-br "$name"
 
+	config_get datapath_id "$cfg" datapath_id
+	[ -n "$datapath_id" ] && {
+		ovs_bridge_validate_datapath_id "$datapath_id" && {
+			ovs-vsctl --if-exists set bridge "$name" other-config:datapath-id="$datapath_id"
+		}
+	}
+
 	config_list_foreach "$cfg" "ports" ovs_bridge_port_add
+	config_foreach ovs_bridge_port_add_complex ovs_port "$name"
 	config_get_bool drop "$cfg" "drop_unknown_ports" 0
 	[ "$drop" == 1 ] && ovs_bridge_port_cleanup
 
@@ -146,3 +217,14 @@ ovs_bridge_init() {
 	[ -n "$controller" ] && \
 		ovs-vsctl set-controller "$name" "$controller"
 }
+
+ovs_set_ssl() {
+	local ca="$(uci -q get openvswitch.ovs.ca)"
+	[ -f "$ca" ] || return
+	local cert="$(uci get openvswitch.ovs.cert)"
+	[ -f "$cert" ] || return
+	local key="$(uci get openvswitch.ovs.key)"
+	[ -f "$key" ] || return
+
+	ovs-vsctl set-ssl "$key" "$cert" "$ca"
+}

feeds/openflow/openvswitch/openvswitch.mk

@@ -5,7 +5,7 @@
 
 # Versions
 
-ovs_version:=2.15.0
+ovs_version:=2.16.0
 ovs_builddir=$(KERNEL_BUILD_DIR)/openvswitch-$(ovs_version)
 
 # Shared vars, macros

feeds/openflow/openvswitch/patches/0002-python-separate-host-target-python-for-cross-compile.patch

@@ -22,7 +22,7 @@ Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
  BUILT_SOURCES =
 --- a/m4/openvswitch.m4
 +++ b/m4/openvswitch.m4
-@@ -383,6 +383,8 @@ else:
+@@ -372,6 +372,8 @@ else:
       AC_MSG_ERROR([Python 3.4 or later is required but not found in $PATH, please install it or set $PYTHON3 to point to it])
     fi
     AC_ARG_VAR([PYTHON3])

feeds/openflow/openvswitch/patches/0004-build-trim-build.patch

@@ -10,7 +10,7 @@ Signed-off-by: Yousong Zhou <zhouyousong@yunionyun.com>
 
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -475,12 +475,10 @@ dist-docs:
+@@ -477,12 +477,10 @@ dist-docs:
  	VERSION=$(VERSION) MAKE='$(MAKE)' $(srcdir)/build-aux/dist-docs $(srcdir) $(docs)
  .PHONY: dist-docs
  

feeds/openflow/openvswitch/patches/0007-build-only-link-libopenvswitch-with-libunwind-libunb.patch

@@ -32,7 +32,7 @@ Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
  Cflags: -I${includedir}/openvswitch
 --- a/m4/openvswitch.m4
 +++ b/m4/openvswitch.m4
-@@ -657,7 +657,8 @@ AC_DEFUN([OVS_CHECK_UNBOUND],
+@@ -646,7 +646,8 @@ AC_DEFUN([OVS_CHECK_UNBOUND],
    [AC_CHECK_LIB(unbound, ub_ctx_create, [HAVE_UNBOUND=yes], [HAVE_UNBOUND=no])
     if test "$HAVE_UNBOUND" = yes; then
       AC_DEFINE([HAVE_UNBOUND], [1], [Define to 1 if unbound is detected.])
@@ -42,7 +42,7 @@ Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
     fi
     AM_CONDITIONAL([HAVE_UNBOUND], [test "$HAVE_UNBOUND" = yes])
     AC_SUBST([HAVE_UNBOUND])])
-@@ -669,7 +670,8 @@ AC_DEFUN([OVS_CHECK_UNWIND],
+@@ -658,7 +659,8 @@ AC_DEFUN([OVS_CHECK_UNWIND],
     [HAVE_UNWIND=no])
     if test "$HAVE_UNWIND" = yes; then
       AC_DEFINE([HAVE_UNWIND], [1], [Define to 1 if unwind is detected.])

feeds/third-party/chilli-redirect/Makefile

@@ -0,0 +1,35 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=chilli-redirect
+PKG_RELEASE:=1
+
+PKG_LICENSE:=BSD-3-Clause
+PKG_MAINTAINER:=John Crispin <john@phrozen.org>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/chilli-redirect
+  SUBMENU:=Captive Portals
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=Chilli-Redirect
+endef
+
+define Package/chilli-redirect/description
+ Chilli Captive portal redirect support.
+endef
+
+define Build/Prepare
+	mkdir -p $(PKG_BUILD_DIR)
+endef
+
+define Build/Compile/Default
+
+endef
+Build/Compile = $(Build/Compile/Default)
+
+define Package/chilli-redirect/install
+	$(CP) ./files/* $(1)
+endef
+
+$(eval $(call BuildPackage,chilli-redirect))

feeds/third-party/chilli-redirect/files/etc/uci-defaults/99-chilli

@@ -0,0 +1,23 @@
+#!/bin/sh
+rm /etc/config/chilli
+cat > /etc/config/chilli <<EOF
+config chilli
+	option disabled '0'
+	option domain 'lan'
+	option uamanydns '1'
+	option lease '900'
+	option redir '1'
+	option papalwaysok '1'
+	option adminupdatefile '/var/run/chilli/local.conf'
+	option wwwdir '/etc/chilli/www'
+	option wwwbin '/etc/chilli/wwwsh'
+	option conup '/etc/chilli/conup.sh'
+	option condown '/etc/chilli/condown.sh'
+	option ipup '/etc/chilli/up.sh'
+	option ipdown '/etc/chilli/down.sh'
+	option cmdsocket '/var/run/chilli/chilli.sock'
+	option unixipc 'ipc.sock'
+	option pidfile '/var/run/chilli/chilli.pid'
+	option kname 'chilli'
+	option debug 0
+EOF

feeds/third-party/chilli-redirect/files/usr/share/ucentral/templates/third-party/chilli-redirect.uc

@@ -0,0 +1,45 @@
+{%
+let interfaces = services.lookup_interfaces("chilli-redirect");
+let enable = length(interfaces);
+services.set_enabled("chilli", enable);
+if (!enable)
+	return;
+let name = ethernet.calculate_name(interfaces[0]);
+let keys = {
+	uamport: 3990,
+	radiusauthport: 1812,
+	radiusacctport: 1813,
+	radiusserver1: true,
+	radiusserver2: true,
+	radiusnasid: true,
+	uamallowed: true,
+	uamdomain: true,
+	defidletimeout: 0,
+	definteriminterval: 300,
+	acctupdate: 9,
+	uamserver: true,
+	radiussecret: true,
+	nasmac: true,
+};
+%}
+
+set chilli.@chilli[0].dhcpif='{{ name }}'
+
+{% if (interfaces[0].role == "upstream"): %}
+set chilli.@chilli[0].net='198.18.0.0/255.255.254.0'
+set chilli.@chilli[0].statip='198.18.0.0/255.255.254.0'
+set chilli.@chilli[0].uamlisten='198.18.0.1'
+set chilli.@chilli[0].uamanyip='1'
+set chilli.@chilli[0].dns1='198.18.0.1'
+set chilli.@chilli[0].nasip='198.18.0.1'
+{% else %}
+set chilli.@chilli[0].net='10.0.0.0/255.255.254.0'
+set chilli.@chilli[0].statip='10.0.0.0/255.255.254.0'
+set chilli.@chilli[0].uamlisten='10.0.0.1'
+set chilli.@chilli[0].dns1='10.0.0.1'
+set chilli.@chilli[0].nasip='10.0.0.1'
+{% endif %}
+
+{% for (let k, v in keys): %}
+set chilli.@chilli[0].{{ k }}='{{ chilli_redirect[k] ? chilli_redirect[k] : v}}'
+{% endfor %}

feeds/third-party/coova-chilli/Config.in

@@ -0,0 +1,48 @@
+# CoovaChilli advanced configuration
+
+if PACKAGE_coova-chilli
+
+config COOVACHILLI_PROXY
+	bool "Enable support for chilli proxy. Required for AAA Proxy through http"
+	default n
+
+config COOVACHILLI_REDIR
+	bool "Enable support for redir server. Required for uamregex"
+	default n
+
+config COOVACHILLI_MINIPORTAL
+	bool "Enable support Coova miniportal"
+	default n
+
+config COOVACHILLI_USERAGENT
+	bool "Enable recording user-agent"
+	default n
+
+config COOVACHILLI_UAMDOMAINFILE
+	bool "Enable loading of mass uamdomains from file"
+	default n
+
+config COOVACHILLI_LARGELIMITS
+	bool "Enable larger limits for use with non-embedded systems"
+	default n
+
+config COOVACHILLI_JSONINTERFACE
+	bool "Enable the JSON interface for the CoovaChilli Controller"
+	default n
+
+choice
+	prompt "SSL library"
+	default COOVACHILLI_NOSSL
+
+config COOVACHILLI_NOSSL
+	bool "No SSL support"
+
+config COOVACHILLI_WOLFSSL
+	bool "wolfSSL"
+
+config COOVACHILLI_OPENSSL
+	bool "OpenSSL"
+
+endchoice
+
+endif

feeds/third-party/coova-chilli/Makefile

@@ -0,0 +1,153 @@
+#
+# Copyright (C) 2007-2018 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=coova-chilli
+PKG_VERSION:=1.5
+PKG_RELEASE:=4
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/coova/coova-chilli/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=75e15fd00a870b8a95df1440977c688a05a109f90b57bf679b931101d427d0fb
+
+PKG_MAINTAINER:=Jaehoon You <teslamint@gmail.com>
+PKG_LICENSE:=GPL-2.0-or-later
+PKG_LICENSE_FILES:=COPYING
+
+PKG_FIXUP:=autoreconf
+PKG_INSTALL:=1
+PKG_BUILD_PARALLEL:=0
+
+PKG_CONFIG_DEPENDS:= \
+  COOVACHILLI_JSONINTERFACE \
+  COOVACHILLI_LARGELIMITS \
+  COOVACHILLI_MINIPORTAL \
+  COOVACHILLI_NOSSL \
+  COOVACHILLI_OPENSSL \
+  COOVACHILLI_PROXY \
+  COOVACHILLI_REDIR \
+  COOVACHILLI_UAMDOMAINFILE \
+  COOVACHILLI_USERAGENT \
+  COOVACHILLI_WOLFSSL \
+  IPV6
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+define Package/coova-chilli
+  SUBMENU:=Captive Portals
+  SECTION:=net
+  CATEGORY:=Network
+  DEPENDS:=+kmod-tun +librt +COOVACHILLI_MINIPORTAL:haserl \
+  +COOVACHILLI_WOLFSSL:libwolfssl +COOVACHILLI_OPENSSL:libopenssl \
+  +COOVACHILLI_JSONINTERFACE:libjson-c
+  TITLE:=Wireless LAN HotSpot controller (Coova Chilli Version)
+  URL:=https://coova.github.io/
+  MENU:=1
+endef
+
+define Package/coova-chilli/description
+	CoovaChilli is an open source access controller for wireless LAN
+	access points and is based on ChilliSpot. It is used for authenticating
+	users of a wireless (or wired) LAN. It supports web based login (UAM)
+	which is today's standard for public HotSpots and it supports Wireless
+	Protected Access (WPA) which is the standard of the future.
+	Authentication,	authorization and accounting (AAA) is handled by your
+	favorite radius server.
+endef
+
+define Package/coova-chilli/config
+  source "$(SOURCE)/Config.in"
+endef
+
+define KernelPackage/ipt-coova
+  URL:=http://www.coova.org/CoovaChilli
+  SUBMENU:=Netfilter Extensions
+  DEPENDS:=coova-chilli +kmod-ipt-core +libxtables
+  TITLE:=Coova netfilter module
+  FILES:=$(PKG_BUILD_DIR)/src/linux/xt_*.$(LINUX_KMOD_SUFFIX)
+  AUTOLOAD:=$(call AutoProbe,xt_coova)
+endef
+
+define KernelPackage/ipt-coova/description
+	Netfilter kernel module for CoovaChilli
+	Includes:
+	- coova
+endef
+
+DISABLE_NLS=
+
+TARGET_CFLAGS += $(FPIC) -Wno-error
+
+CONFIGURE_VARS += \
+       ARCH="$(LINUX_KARCH)" \
+       KERNEL_DIR="$(LINUX_DIR)"
+
+MAKE_FLAGS += \
+       ARCH="$(LINUX_KARCH)" \
+       KERNEL_DIR="$(LINUX_DIR)"
+
+MAKE_INSTALL_FLAGS += \
+       ARCH="$(LINUX_KARCH)" \
+       KERNEL_DIR="$(LINUX_DIR)" \
+       INSTALL_MOD_PATH="$(PKG_INSTALL_DIR)"
+
+define Build/Prepare
+$(call Build/Prepare/Default)
+	( cd $(PKG_BUILD_DIR) ; \
+		[ -f ./configure ] || { \
+			./bootstrap ; \
+		} \
+	)
+endef
+
+define Build/Configure
+	$(call Build/Configure/Default, \
+	$(if $(CONFIG_COOVACHILLI_PROXY),--enable,--disable)-chilliproxy \
+	$(if $(CONFIG_COOVACHILLI_REDIR),--enable,--disable)-chilliredir \
+	$(if $(CONFIG_COOVACHILLI_MINIPORTAL),--enable,--disable)-miniportal \
+	$(if $(CONFIG_COOVACHILLI_USERAGENT),--enable,--disable)-useragent \
+	$(if $(CONFIG_COOVACHILLI_LARGELIMITS),--enable,--disable)-largelimits \
+	$(if $(CONFIG_COOVACHILLI_JSONINTERFACE),--enable,--disable)-libjson \
+	$(if $(CONFIG_COOVACHILLI_JSONINTERFACE),--enable,--disable)-json \
+	$(if $(CONFIG_COOVACHILLI_UAMDOMAINFILE),--enable,--disable)-uamdomainfile \
+	$(if $(CONFIG_IPV6),--with,--without)-ipv6 \
+	$(if $(CONFIG_COOVACHILLI_WOLFSSL),--with,--without)-cyassl \
+	$(if $(CONFIG_COOVACHILLI_OPENSSL),--with,--without)-openssl \
+	$(if $(CONFIG_PACKAGE_kmod-ipt-coova),--with-nfcoova) \
+	--enable-chilliredir\
+	)
+endef
+
+define Package/coova-chilli/conffiles
+/etc/config/chilli
+endef
+
+define Package/coova-chilli/install
+	$(INSTALL_DIR) $(1)/etc
+	$(INSTALL_CONF) $(PKG_INSTALL_DIR)/etc/chilli.conf $(1)/etc/
+	$(INSTALL_DIR) $(1)/etc/chilli
+	$(CP) $(PKG_INSTALL_DIR)/etc/chilli/* $(1)/etc/chilli/
+	$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
+	$(INSTALL_DATA) ./files/chilli.hotplug $(1)/etc/hotplug.d/iface/30-chilli
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/chilli* $(1)/usr/sbin/
+	$(INSTALL_DIR) $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so.* $(1)/usr/lib/
+	$(if $(CONFIG_PACKAGE_kmod-ipt-coova), \
+		$(INSTALL_DIR) $(1)/usr/lib/iptables; \
+		$(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib*.so $(1)/usr/lib/iptables/ \
+	)
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) files/chilli.init $(1)/etc/init.d/chilli
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_DATA) files/chilli.config $(1)/etc/config/chilli
+endef
+
+$(eval $(call BuildPackage,coova-chilli))
+$(eval $(call KernelPackage,ipt-coova))

feeds/third-party/coova-chilli/files/chilli.config

@@ -0,0 +1,226 @@
+#
+# Sample Coova-Chilli configuration file
+#
+
+config chilli
+    # disable to running chilli. remove this option before running.
+    option disabled 1
+
+    # name of TUN device name. required.
+    option tundev 'tun0'
+
+    # name of network interface
+    option network ''
+
+    # Include this flag to include debug information.
+    #option debug 1
+
+    # Re-read configuration file at this interval. Will also cause new domain
+    # name lookups to be performed. Value is given in seconds.
+    #option interval 3600
+
+    # Directory to use for nonvolatile storage.
+    # The program must have write access to this directory.
+    # this option is currently ignored
+    #option statedir ./
+
+
+    # TUN parameters
+
+    # IP network address of external packet data network
+    # Used to allocate dynamic IP addresses and set up routing.
+    # Normally you do not need to uncomment this option.
+    #option net 192.168.182.0/24
+
+    # Dynamic IP address pool
+    # Used to allocate dynamic IP addresses to clients.
+    # If not set it defaults to the net tag.
+    # Do not uncomment this option unless you are an experienced user!
+    #option dynip 192.168.182.0/24
+
+    # Static IP address pool
+    # Used to allocate static IP addresses to clients.
+    # Do not uncomment this option unless you are an experienced user!
+    #option statip 192.168.182.0/24
+
+
+    # Primary DNS server.
+    # Will be suggested to the client.
+    # If omitted the system default will be used.
+    # Normally you do not need to uncomment this option.
+    #option dns1 172.16.0.5
+
+    # Secondary DNS server.
+    # Will be suggested to the client.
+    # If omitted the system default will be used.
+    # Normally you do not need to uncomment this option.
+    #option dns2 172.16.0.6
+
+    # Domain name
+    # Will be suggested to the client.
+    # Normally you do not need to uncomment this option.
+    #option domain key.chillispot.org
+
+    # Script executed after network interface has been brought up.
+    # Executed with the following parameters: <devicename> <ip address>
+    # <mask>
+    # Normally you do not need to modify this option.
+    option ipup /etc/chilli/up.sh
+
+    # Script executed after network interface has been taken down.
+    # Executed with the following parameters: <devicename> <ip address>
+    # <mask>
+    # Normally you do not need to modify this option.
+    option ipdown /etc/chilli/down.sh
+
+
+    # Radius parameters
+
+    # IP address to listen to
+    # Normally you do not need to uncomment this option.
+    #option radiuslisten 127.0.0.1
+
+    # IP address of radius server 1
+    # For most installations you need to modify this option.
+    option radiusserver1 rad01.chillispot.org
+
+    # IP address of radius server 2
+    # If you have only one radius server you should set radiusserver2 to the
+    # same value as radiusserver1.
+    # For most installations you need to modify this option.
+    option radiusserver2 rad02.chillispot.org
+
+    # Radius authentication port
+    # The UDP port number to use for radius authentication requests.
+    # The same port number is used for both radiusserver1 and radiusserver2.
+    # Normally you do not need to uncomment this option.
+    #option radiusauthport 1812
+
+    # Radius accounting port
+    # The UDP port number to use for radius accounting requests.
+    # The same port number is used for both radiusserver1 and radiusserver2.
+    # Normally you do not need to uncomment this option.
+    #option radiusacctport 1813
+
+    # Radius shared secret for both servers
+    # For all installations you should modify this option.
+    #option radiussecret testing123
+
+    # Radius NAS-Identifier
+    # Normally you do not need to uncomment this option.
+    #option radiusnasid nas01
+
+    # WISPr Location ID. Should be in the format: isocc=<ISO_Country_Code>,
+    # cc=<E.164_Country_Code>,ac=<E.164_Area_Code>,network=<ssid/ZONE>
+    # Normally you do not need to uncomment this option.
+    #option radiuslocationid isocc=us,cc=1,ac=408,network=ACMEWISP_NewarkAirport
+
+    # WISPr Location Name. Should be in the format:
+    # <HOTSPOT_OPERATOR_NAME>,<LOCATION>
+    # Normally you do not need to uncomment this option.
+    #option radiuslocationname ACMEWISP,Gate_14_Terminal_C_of_Newark_Airport
+
+
+    # Radius proxy parameters
+
+    # IP address to listen to
+    # Normally you do not need to uncomment this option.
+    #option proxylisten 10.0.0.1
+
+    # UDP port to listen to.
+    # If not specified a port will be selected by the system
+    # Normally you do not need to uncomment this option.
+    #option proxyport 1645
+
+    # Client(s) from which we accept radius requests
+    # Normally you do not need to uncomment this option.
+    #option proxyclient 10.0.0.1/24
+
+    # Radius proxy shared secret for all clients
+    # If not specified defaults to radiussecret
+    # Normally you do not need to uncomment this option.
+    #option proxysecret testing123
+
+
+    # DHCP Parameters
+
+    # Ethernet interface to listen to.
+    # This is the network interface which is connected to the access points.
+    # In a typical configuration this option should be set to eth1.
+    option dhcpif eth1
+
+    # Use specified MAC address.
+    # An address in the range  00:00:5E:00:02:00 - 00:00:5E:FF:FF:FF falls
+    # within the IANA range of addresses and is not allocated for other
+    # purposes.
+    # Normally you do not need to uncomment this option.
+    #option dhcpmac 00:00:5E:00:02:00
+
+    # Time before DHCP lease expires
+    # Normally you do not need to uncomment this option.
+    #option lease 600
+
+
+    # Universal access method (UAM) parameters
+
+    # URL of web server handling authentication.
+    option uamserver https://radius.chillispot.org/hotspotlogin
+
+    # URL of welcome homepage.
+    # Unauthenticated users will be redirected to this URL. If not specified
+    # users will be redirected to the uamserver instead.
+    # Normally you do not need to uncomment this option.
+    #option uamhomepage http://192.168.182.1/welcome.html
+
+    # Shared between chilli and authentication web server
+    #option uamsecret ht2eb8ej6s4et3rg1ulp
+
+    # IP address to listen to for authentication requests
+    # Do not uncomment this option unless you are an experienced user!
+    #option uamlisten 192.168.182.1
+
+    # TCP port to listen to for authentication requests
+    # Do not uncomment this option unless you are an experienced user!
+    #option uamport 3990
+
+    # Comma separated list of domain names, IP addresses or network segments
+    # the client can access without first authenticating.
+    # It is possible to specify this option multiple times.
+    # Normally you do not need to uncomment this option.
+    #option uamallowed www.chillispot.org,10.11.12.0/24
+
+    # Comma separated list of domain names
+    # the client can access without first authenticating.
+    # It is possible to specify this option multiple times.
+    # Normally you do not need to uncomment this option.
+    #option uamdomain .chillispot.org,.coova.org
+
+    # If this flag is given unauthenticated users are allowed to use
+    # any DNS server.
+    # Normally you do not need to uncomment this option.
+    #option uamanydns
+
+
+    # MAC authentication
+
+    # If this flag is given users will be authenticated only on their MAC
+    # address.
+    # Normally you do not need to uncomment this option.
+    #option macauth
+
+    # List of MAC addresses.
+    # The MAC addresses specified in this list will be authenticated only on
+    # their MAC address.
+    # this option is ignored if the macauth tag is given.
+    # It is possible to specify this option multiple times.
+    # Normally you do not need to uncomment this option.
+    #option macallowed 00-0A-5E-AC-BE-51,00-30-1B-3C-32-E9
+
+    # Password to use for MAC authentication.
+    # Normally you do not need to uncomment this option.
+    #option macpasswd password
+
+    # Suffix to add to MAC address in order to form the username.
+    # Normally you do not need to uncomment this option.
+    #option macsuffix suffix
+

feeds/third-party/coova-chilli/files/chilli.hotplug

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+[ "$ACTION" == "ifup" ] || exit 0
+
+[ "$INTERFACE" = "wan" ] && {
+	/etc/init.d/chilli restart
+}

feeds/third-party/coova-chilli/files/chilli.init

@@ -0,0 +1,93 @@
+#!/bin/sh /etc/rc.common
+
+START=90
+STOP=89
+USE_PROCD=1
+
+service_triggers() {
+	procd_add_reload_trigger "chilli"
+}
+
+config_cb() {
+	chilli_conf="/var/run/chilli_${2}.conf"
+	[ -e "$chilli_conf" ] && rm -f "$chilli_conf"
+}
+
+option_cb() {
+	case "$1" in
+		# ignored/internal settings
+		disabled)
+			;;
+		# UCI settings
+		network)
+			. /lib/functions/network.sh
+			local ifname
+			network_get_device ifname "$2"
+			echo "dhcpif=\"$ifname\"" >> "$chilli_conf"
+			;;
+		# boolean settings
+		acctupdate|chillixml|coanoipcheck|debug|dhcpbroadcast|dhcpmacset|dhcpnotidle|\
+		dhcpradius|dnsparanoia|domaindnslocal|eapolenable|fg|forgiving|framedservice|\
+		ieee8021q|injectwispr|ipv6|ipv6only|layer3|locationcopycalled|\
+		locationimmediateupdate|locationopt82|locationstopstart|macallowlocal|\
+		macauth|macauthdeny|macreauth|mmapring|mschapv2|noarpentries|noc2c|nochallenge|\
+		nodynip|noradallow|nosystemdns|nouamsuccess|nousergardendata|nowispr1|nowispr2|\
+		only8021q|openidauth|papalwaysok|patricia|postauthproxyssl|proxymacaccept|\
+		proxyonacct|radiusoriginalurl|radsec|redir|redirdnsreq|redirssl|redirurl|reload|\
+		routeonetone|scalewin|seskeepalive|statusfilesave|strictdhcp|strictmacauth|\
+		swapoctets|uamallowpost|uamanydns|uamanyip|uamauthedallowed|uamgardendata|\
+		uamnatanyip|uamotherdata|uamuissl|usetap|vlanlocation|wpaguests)
+			[ "$2" = "true" -o "$2" = "1" ] && echo "$1" >> "$chilli_conf"
+			;;
+		*)
+			echo "$1=\"$2\"" >> "$chilli_conf"
+			;;
+	esac
+}
+
+start_chilli() {
+	local cfg="$1"
+	local base="/var/run/chilli_${cfg}"
+
+	config_get_bool disabled "$1" 'disabled' 0
+	[ $disabled = 1 ] && return
+
+	procd_open_instance "$cfg"
+	procd_set_param command /usr/sbin/chilli
+	procd_set_param file "$chilli_conf"
+	procd_append_param command \
+		--fg \
+		--conf "${base}.conf" \
+		--pidfile "${base}.pid" \
+		--cmdsocket "${base}.sock" \
+		--unixipc "${base}.ipc"
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}
+
+start_service() {
+	config_load chilli
+	config_foreach start_chilli chilli
+}
+
+stop_service() {
+	rm -f /var/run/chilli_*
+}
+
+reload_chilli() {
+	local pid
+	local cfg="$1"
+	local base="/var/run/chilli_${cfg}"
+	if [ -f "${base}.pid" ]; then
+		pid="$(cat "${base}.pid")"
+		[ -f "/var/run/chilli.${pid}.cfg.bin" ] && rm -f "/var/run/chilli.${pid}.cfg.bin"
+		chilli_query -s "${base}.sock" reload
+	fi
+}
+
+reload_service() {
+	config_load chilli
+	config_foreach reload_chilli chilli
+}

feeds/third-party/coova-chilli/patches/100-fix_compile_kmod.patch

@@ -0,0 +1,13 @@
+--- a/src/linux/Makefile
++++ b/src/linux/Makefile
+@@ -25,8 +25,8 @@ lib%.o: lib%.c
+ 	$(CC) $(CFLAGS) -fPIC -O2 -Wall -D_INIT=lib$*_init -c -o $@ $<;
+ 
+ install: modules_install libxt_coova.so
+-	mkdir -p $(DESTDIR)/lib/xtables/
+-	cp libxt_coova.so $(DESTDIR)/lib/xtables/
++	mkdir -p $(DESTDIR)/usr/lib/iptables/
++	cp libxt_coova.so $(DESTDIR)/usr/lib/iptables/
+ 
+ distdir:
+ 

feeds/third-party/coova-chilli/patches/200-wolfssl.patch

@@ -0,0 +1,53 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -397,7 +397,7 @@ AC_ARG_WITH([cyassl],
+  [AS_HELP_STRING([--with-cyassl], [enable support for cyassl])],[],[with_cyassl=no])
+ 
+ AS_IF([test x"$with_cyassl" != xno],
+-  [AC_CHECK_LIB([cyassl], [CyaSSL_Init],
++  [AC_CHECK_LIB([cyassl], [wolfSSL_Init],
+               [AC_SUBST([LIBSSL], ["-lcyassl"])
+                AC_DEFINE([HAVE_CYASSL], [1],
+                          [Define if you have cyassl])
+--- a/src/ippool.c
++++ b/src/ippool.c
+@@ -35,6 +35,7 @@ int ippool_print(int fd, struct ippool_t
+   char * sep = "-- %-15s ------------------------------------------------------------\n";
+ 
+ #define ERR 0
++#undef USED /* defined in <wolfssl/wolfcrypt/integer.h> */
+ #define USED 1
+ #define FREE 2
+ #define LIST 3
+--- a/src/md5.h
++++ b/src/md5.h
+@@ -35,7 +35,6 @@
+ #define MD5Update MD5_Update
+ #define MD5Final MD5_Final
+ 
+-typedef struct CYASSL_MD5_CTX MD5_CTX;
+ #else
+ 
+ struct MD5Context {
+--- a/src/ssl.c
++++ b/src/ssl.c
+@@ -131,7 +131,7 @@ _openssl_env_init(openssl_env *env, char
+    */
+   const long options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
+   env->meth = SSLv23_method();
+-  env->ctx = SSL_CTX_new(env->meth);
++  env->ctx = SSL_CTX_new((void *)env->meth);
+   SSL_CTX_set_options(env->ctx, options);
+   if (_options.sslciphers) {
+     SSL_CTX_set_cipher_list(env->ctx, _options.sslciphers);
+--- a/src/ssl.h
++++ b/src/ssl.h
+@@ -48,6 +48,8 @@ typedef struct {
+ #include <time.h>
+ #include <string.h>
+ 
++#define OPENSSL_NO_ENGINE
++#include <cyassl/options.h>
+ #include <cyassl/ssl.h>
+ #include <cyassl/openssl/bio.h>
+ #include <cyassl/openssl/crypto.h>

feeds/third-party/coova-chilli/patches/300-sysinfo.patch

@@ -0,0 +1,23 @@
+From 196b783b5ea7f8d6cf57ddbd41dc1881ef47a1c4 Mon Sep 17 00:00:00 2001
+From: Rosen Penev <rosenp@gmail.com>
+Date: Wed, 11 Dec 2019 19:33:58 -0800
+Subject: [PATCH] system.h: Fix compilation with kernel 4.19 + musl
+
+<linux/netlink.h> includes <linux/sysinfo.h> , which redefines struct sysinfo, leading to an error.
+Define the linux header as included to solve compilation.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+---
+ src/system.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/system.h
++++ b/src/system.h
+@@ -114,6 +114,7 @@
+ 
+ #ifdef HAVE_SYS_SYSINFO_H
+ #include <sys/sysinfo.h>
++#define _LINUX_SYSINFO_H
+ #else
+ #ifdef HAVE_LINUX_SYSINFO_H
+ #define _LINUX_KERNEL_H

feeds/third-party/coova-chilli/patches/400-fix-version.patch

@@ -0,0 +1,11 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -2,7 +2,7 @@
+ # Process this file with autoconf to produce a configure script.
+ 
+ AC_PREREQ([2.59])
+-AC_INIT([coova-chilli],[1.4],[https://github.com/coova/coova-chilli/issues])
++AC_INIT([coova-chilli],[1.5],[https://github.com/coova/coova-chilli/issues])
+ AC_CONFIG_SRCDIR([src/chilli.c])
+ 
+ AM_INIT_AUTOMAKE

feeds/tip/firstcontact/files/usr/share/ucentral/firstcontact.uc

@@ -43,8 +43,11 @@ if (!config.Redirector) {
 
 function store_config(path) {
 	let cursor = uci.cursor(path);
+	let redir = split(config.Redirector, ":");
+
 	cursor.load("ucentral");
-	cursor.set("ucentral", "config", "server", config.Redirector);
+	cursor.set("ucentral", "config", "server", redir[0]);
+	cursor.set("ucentral", "config", "port", redir[1] || 15002);
 	cursor.commit();
 }
 

feeds/tip/firstcontact/src/firstcontact.c

@@ -1,5 +1,6 @@
 #define _GNU_SOURCE
 #include <stdio.h>
+#include <unistd.h>
 #include <getopt.h>
 
 #include <curl/curl.h>
@@ -20,6 +21,8 @@ int main(int argc, char **argv)
 	char *devid = NULL;
 	char *url;
 
+	alarm(15);
+
 	while (1) {
 		int option = getopt(argc, argv, "k:c:o:hi:");
 
@@ -85,6 +88,7 @@ int main(int argc, char **argv)
 	curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
 	curl_easy_setopt(curl, CURLOPT_SSLKEY, file_key);
 	curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+	curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 10L);
 
 	res = curl_easy_perform(curl);
 	if (res != CURLE_OK)

feeds/tip/maverick/src/maverick.c

@@ -28,7 +28,7 @@ main(int argc, char **argv)
 	ulog_open(ULOG_STDIO | ULOG_SYSLOG, LOG_DAEMON, "maverick");
 
 	uloop_init();
-	uloop_timeout_set(&maverick, 150 * 1000);
+	uloop_timeout_set(&maverick, 300 * 1000);
 	uloop_run();
 	uloop_done();
 

feeds/ucentral/switch-fabric/Makefile

@@ -0,0 +1,34 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=switch-fabric
+PKG_RELEASE:=1
+
+PKG_LICENSE:=BSD-3-Clause
+PKG_MAINTAINER:=John Crispin <john@phrozen.org>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/switch-fabric
+  SECTION:=ucentral
+  CATEGORY:=uCentral
+  TITLE:=switch-fabric
+endef
+
+define Package/switch-fabric/description
+ Allow configuring HW specific switch fabric features.
+endef
+
+define Build/Prepare
+	mkdir -p $(PKG_BUILD_DIR)
+endef
+
+define Build/Compile/Default
+
+endef
+Build/Compile = $(Build/Compile/Default)
+
+define Package/switch-fabric/install
+	$(CP) ./files/* $(1)
+endef
+
+$(eval $(call BuildPackage,switch-fabric))

feeds/ucentral/switch-fabric/files/etc/init.d/switch-fabric

@@ -0,0 +1,19 @@
+#!/bin/sh /etc/rc.common
+
+START=90
+USE_PROCD=1
+PROG=/usr/libexec/switch.sh
+
+reload_service() {
+	restart
+}
+
+service_triggers() {
+	procd_add_reload_trigger switch
+}
+
+start_service() {
+	procd_open_instance
+	procd_set_param command "$PROG"
+	procd_close_instance
+}

feeds/ucentral/switch-fabric/files/usr/libexec/switch.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+port_mirror() {
+	for lan in $(ls -d /sys/class/net/lan* | cut -dn -f3 |sort -n); do
+		tc qdisc del dev lan$lan clsact
+	done
+
+	monitor=$(uci get switch.mirror.monitor)
+	analysis=$(uci get switch.mirror.analysis)
+
+	[ -n "$monitor" -a -n "$analysis" ] || return
+
+	ifconfig $analysis up
+	for port in $monitor; do
+		tc qdisc add dev $port clsact
+		tc filter add dev $port ingress matchall skip_sw action mirred egress mirror dev $analysis
+		tc filter add dev $port egress matchall skip_sw action mirred egress mirror dev $analysis
+	done
+}
+
+port_mirror

feeds/ucentral/ucentral-client/Makefile

@@ -6,7 +6,7 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL=https://github.com/blogic/ucentral-client.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-02-15
-PKG_SOURCE_VERSION:=4bb62909328b2a7ed7214939b9aa5a7999794024
+PKG_SOURCE_VERSION:=8cfed4cd068a3c08795ce08099993a66a1a1f1cf
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>

feeds/ucentral/ucentral-schema/Makefile

@@ -6,7 +6,7 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL=https://github.com/blogic/ucentral-schema.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-02-15
-PKG_SOURCE_VERSION:=520bd6a23790d911f15248ec730f1068bf01ee5d
+PKG_SOURCE_VERSION:=2415d8838d44bd8a110c90f1d5d35f8499ac72b2
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=BSD-3-Clause

feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/switch-fabric.json

@@ -0,0 +1,46 @@
+{
+	"uuid": 2,
+
+	"switch": {
+		"port-mirror": {
+			"monitor-ports": [ "WAN2" ],
+			"analysis-port": "WAN3"
+		}
+	},
+
+	"interfaces": [
+		{
+			"name": "WAN",
+			"role": "upstream",
+			"services": [ "lldp", "ssh" ],
+			"ethernet": [
+				{
+					"select-ports": [
+						"WAN*"
+					]
+				}
+			],
+			"ipv4": {
+				"addressing": "dynamic"
+			}
+		}
+	],
+	"metrics": {
+		"statistics": {
+			"interval": 120,
+			"types": [ "ssids", "lldp", "clients" ]
+		},
+		"health": {
+			"interval": 120
+		}
+	},
+	"services": {
+		"lldp": {
+			"describe": "uCentral",
+			"location": "universe"
+		},
+		"ssh": {
+			"port": 22
+		}
+	}
+}

feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/switch-ports.json

@@ -0,0 +1,63 @@
+{
+	"uuid": 2,
+
+	"ethernet": [
+		{
+			"select-ports": [
+				"WAN1"
+			],
+			"speed": 100,
+			"duplex": "half"
+		},
+		{
+			"select-ports": [
+				"WAN2"
+			],
+			"speed": 1000,
+			"duplex": "full"
+		},
+		{
+			"select-ports": [
+				"WAN3"
+			],
+			"speed": 100,
+			"duplex": "half"
+		}
+	],
+
+	"interfaces": [
+		{
+			"name": "WAN",
+			"role": "upstream",
+			"services": [ "lldp", "ssh" ],
+			"ethernet": [
+				{
+					"select-ports": [
+						"WAN*"
+					]
+				}
+			],
+			"ipv4": {
+				"addressing": "dynamic"
+			}
+		}
+	],
+	"metrics": {
+		"statistics": {
+			"interval": 120,
+			"types": [ "ssids", "lldp", "clients" ]
+		},
+		"health": {
+			"interval": 120
+		}
+	},
+	"services": {
+		"lldp": {
+			"describe": "uCentral",
+			"location": "universe"
+		},
+		"ssh": {
+			"port": 22
+		}
+	}
+}

feeds/ucentral/ucentral-wifi/Makefile

@@ -6,7 +6,7 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL=https://github.com/blogic/ucentral-wifi.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-04-13
-PKG_SOURCE_VERSION:=a7e2f706d37a6e0b996d2af49c3b8663becb3f08
+PKG_SOURCE_VERSION:=b47ad92ff36faacbf4047904a9971f7361262a06
 #PKG_MIRROR_HASH:=a8000b3cf43ce9ebfa7305661475fec98ec1dba2dc7b062028c2e17d7c2ec50b
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>

feeds/ucentral/ustp/Makefile

@@ -0,0 +1,41 @@
+#
+# Copyright (C) 2014-2021 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=ustp
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL:=https://github.com/nbd168/ustp
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-08-24
+PKG_SOURCE_VERSION:=fd93aaef9ba99188e30731651c589a2ab9bfc421
+PKG_MIRROR_HASH:=ef99770c4992e236feb46efef7ded68b77de8dbd0a8aa99ab71788e7b35f9b58
+
+PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name
+PKG_LICENSE:=GPL-2.0
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/ustp
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=OpenWrt STP/RSTP daemon
+  DEPENDS:=+libubox +libubus
+endef
+
+TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include -flto
+TARGET_LDFLAGS += -flto -fuse-linker-plugin
+
+define Package/ustp/install
+	$(INSTALL_DIR) $(1)/sbin $(1)/etc/init.d
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ipkg-install/sbin/* $(1)/sbin/
+	$(INSTALL_BIN) ./files/ustpd.init $(1)/etc/init.d/ustpd
+endef
+
+$(eval $(call BuildPackage,ustp))

feeds/ucentral/ustp/files/ustpd.init

@@ -0,0 +1,14 @@
+#!/bin/sh /etc/rc.common
+# Copyright (c) 2021 OpenWrt.org
+
+START=50
+
+USE_PROCD=1
+PROG=/sbin/ustpd
+
+start_service() {
+	procd_open_instance
+	procd_set_param command "$PROG"
+	procd_set_param respawn
+	procd_close_instance
+}

patches/0040-netifd-fix-compile-on-older-kernels.patch

@@ -0,0 +1,54 @@
+From 5bf7a4a5befe6add789249fe02b737e353137146 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Wed, 4 Aug 2021 08:36:30 +0200
+Subject: [PATCH] netifd: fix compile on older kernels
+
+The ethtool features do not exist on ancient qualcomm kernels.
+Disable that feature if running on QCA.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ .../config/netifd/patches/003-ethtool.patch   | 31 +++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+ create mode 100644 package/network/config/netifd/patches/003-ethtool.patch
+
+diff --git a/package/network/config/netifd/patches/003-ethtool.patch b/package/network/config/netifd/patches/003-ethtool.patch
+new file mode 100644
+index 0000000000..6aee86283e
+--- /dev/null
++++ b/package/network/config/netifd/patches/003-ethtool.patch
+@@ -0,0 +1,31 @@
++Index: netifd-2021-05-26-1eb0fafa/system-linux.c
++===================================================================
++--- netifd-2021-05-26-1eb0fafa.orig/system-linux.c
+++++ netifd-2021-05-26-1eb0fafa/system-linux.c
++@@ -1578,6 +1578,8 @@ int system_vlandev_del(struct device *vl
++ 	return system_link_del(vlandev->ifname);
++ }
++ 
+++#ifdef SPEED_400000
+++// ugly hack to detect if we are running on an ancient kernel
++ static void
++ system_set_ethtool_settings(struct device *dev, struct device_settings *s)
++ {
++@@ -1628,6 +1630,7 @@ system_set_ethtool_settings(struct devic
++ 	ecmd.cmd = ETHTOOL_SSET;
++ 	ioctl(sock_ioctl, SIOCETHTOOL, &ifr);
++ }
+++#endif
++ 
++ void
++ system_if_get_settings(struct device *dev, struct device_settings *s)
++@@ -1852,7 +1855,9 @@ system_if_apply_settings(struct device *
++ 		system_set_drop_unsolicited_na(dev, s->drop_unsolicited_na ? "1" : "0");
++ 	if (apply_mask & DEV_OPT_ARP_ACCEPT)
++ 		system_set_arp_accept(dev, s->arp_accept ? "1" : "0");
+++#ifdef SPEED_400000
++ 	system_set_ethtool_settings(dev, s);
+++#endif
++ }
++ 
++ int system_if_up(struct device *dev)
+-- 
+2.25.1
+

patches/0041-ipq40xx-add-Wallys-DR40x9-support.patch

@@ -0,0 +1,641 @@
+From 5a0366889960ae89594177854b77889cdf22ac63 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Fri, 13 Aug 2021 18:28:21 +0200
+Subject: [PATCH] ipq40xx: add Wallys DR40x9 support
+
+Adds support for the Wallys DR40x9 series boards.
+They come in IPQ4019 and IPQ4029 versions.
+IPQ4019/4029 only differ in that that IPQ4029 is the industrial version that is rated to higher temperatures.
+
+Specifications are:
+* CPU: Qualcomm IPQ40x9 (4x ARMv7A Cortex A7) at 716 MHz
+* RAM: 512 MB
+* Storage: 2MB of SPI-NOR, 128 MB of parallel NAND
+* USB 3.0 TypeA port for users
+* MiniPCI-E with PCI-E 2.0 link
+* MiniPCI-E for LTE modems with only USB2.0 link
+* 2 SIM card slots that are selected via GPIO11
+* MicroSD card slot
+* Ethernet: 2x GBe with 24~48V passive POE
+* SFP port (Untested, I have no way to test it)
+* DC Jack
+* UART header
+* WLAN: In-SoC 2x2 802.11b/g/n and 2x2 802.11a/n/ac
+* 4x MMCX connectors for WLAN
+* Reset button
+* 8x LED-s
+
+Installation instructions:
+Connect to UART, pins are like this:
+-> 3.3V | TX | RX | GND
+
+Settings are 115200 8n1
+
+Boot initramfs from TFTP:
+tftpboot 0x84000000 openwrt-ipq40xx-generic-wallys_dr40x9-initramfs-fit-uImage.itb
+
+bootm
+
+Then copy the sysupgrade image to the /tmp folder and execute sysupgrade -n <image_name>
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ package/firmware/ipq-wifi/Makefile            |   2 +
+ .../ipq-wifi/board-wallys_dr40x9.qca4019      | Bin 0 -> 24316 bytes
+ .../ipq40xx/base-files/etc/board.d/02_network |   3 +-
+ .../base-files/etc/board.d/03_gpio_switches   |   3 +
+ .../etc/hotplug.d/firmware/11-ath10k-caldata  |   6 +-
+ .../base-files/lib/upgrade/platform.sh        |   1 +
+ .../arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts | 387 ++++++++++++++++++
+ target/linux/ipq40xx/image/generic.mk         |  13 +
+ .../901-arm-boot-add-dts-files.patch          |   3 +-
+ 9 files changed, 414 insertions(+), 4 deletions(-)
+ create mode 100644 package/firmware/ipq-wifi/board-wallys_dr40x9.qca4019
+ create mode 100644 target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts
+
+diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
+index 87dcf9a769..192e8dcf7e 100644
+--- a/package/firmware/ipq-wifi/Makefile
++++ b/package/firmware/ipq-wifi/Makefile
+@@ -49,6 +49,7 @@ ALLWIFIBOARDS:= \
+ 	plasmacloud_pa2200 \
+ 	qxwlan_e2600ac \
+ 	cig_wf610d \
++	wallys_dr40x9 \
+ 	tp-link_ec420-g1
+ 
+ ALLWIFIPACKAGES:=$(foreach BOARD,$(ALLWIFIBOARDS),ipq-wifi-$(BOARD))
+@@ -135,5 +136,6 @@ $(eval $(call generate-ipq-wifi-package,plasmacloud_pa2200,Plasma Cloud PA2200))
+ $(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac,Qxwlan E2600AC))
+ $(eval $(call generate-ipq-wifi-package,cig_wf610d,CIG WF_610D))
+ $(eval $(call generate-ipq-wifi-package,tp-link_ec420-g1,tp-link EC420-G1))
++$(eval $(call generate-ipq-wifi-package,wallys_dr40x9,Wallys DR40X9))
+ 
+ $(foreach PACKAGE,$(ALLWIFIPACKAGES),$(eval $(call BuildPackage,$(PACKAGE))))
+diff --git a/package/firmware/ipq-wifi/board-wallys_dr40x9.qca4019 b/package/firmware/ipq-wifi/board-wallys_dr40x9.qca4019
+new file mode 100644
+index 0000000000000000000000000000000000000000..9114eecbbdffb0c47192e9ea4d7b6055a1c4b470
+GIT binary patch
+literal 24316
+zcmeHPdr(tX8b1jj>SE!BfCzYj@Qj53A;lmO0z?`h1&fLVSOls_QldNz4?`F1_@EFG
+zfm$#`&@w2GrihG-4~WIu+8Jf`kNsn3|7bhg-R{h~s~zo5JF~mE=iYE338W?vrabN!
+z&N<&X_xsNI&hMTi_ulg(Zzsfs#O)P^hoywXr^TfUfJ`O>P>Msb9Drz;3gqQG^NR|C
+z3uKazcZwt>A(DeT!|+<c(fqQ5Sd|?XT#;WU$v<*z=l=ZS;_C7cK{_WaGfGB*{@$=J
+z?@*zTLIF0lG)@NA@3wB3<pHqK-U%uI&;fWY0@voxm`n!N6#x+t5kEeEPT|qlfuFxS
+z7fU1?*uetjp0QuEZY1y$3OqJlo3`pPwkGP1xDqF@1p<ohMI6CmB=p%bcHt4vb^^7H
+zcnur3o~nBp9EKG-O}{0UZf|dIXJ==lCjg9LGc{9Opq+klg?0U8W;Zitj!<SQD_kjQ
+z8pM{(v=~lid{EU`eJCp>i93En)mkmf+M5(V-mf~-P$qdhDRO)OYUPsjq&I$s^59Em
+zAQ=Bd)lglKl>`qCshX=LS-X>B#``cc*v5qpjSZDqqNHft;bGu5Fn(Qi7LM>%Qq=gT
+z&_Rkj^ukVxvQoG~u)CJ(lB{%Y*tA2SVSKNsRYQ4&iQ!?=!4Qx6YpVgJ`DeDWT6-Gv
+zE29ntW_YGdw3gK-%2)?n;>Y?+I}*<XmAU103}kmio$)Sr&hKr=mq!%@?Ae-hxA{oT
+zE=h2<OUxI2)gPsuVU=%v=k`El$6Jjdm7awoXN#(04ly&3s5{V3AZ2Ac$6W1|v<n+v
+zuk<Lo^+`onXsuU?bKc5AiHw#&z|MZdZ#Fq1&Mup`cx)v;@byaUGxnDR_5&}7u#8Hj
+zQn1{{27WECn-=?Pb(vvq58vC(M*aMJ;h#Ul$H$l9!(e3Ct~a_SAwnX{B}5=IGd-2T
+z@PZ@!^waZaQ&ZR#5SQuit84r3vp;{Y--a1(b+D(}+WrsPIl>b*>;K}#(<eIHB@7qu
+zx?~Vuk3g-YwrLPcSYu=)hoehSVTXmWSdmzD(HaN#!Nz;Bj)qUbC__*Li9_R%a5Nk#
+zksq%;`9V`_`&<R^rsb|h3Js;PXpd-!JL=AI7dfF$h#MM@#<Sud#UsgRGAmicNBM{l
+zWut5s`w<)2f$m`K5QU*(2p63RLVaa^btWbrZzd{IopXN7fy5bge(H>PpdKs_Q39Iq
+zGyzFLQ&=gY2sGkp1QLx#v!X@1lc1mDL+PMj@*G>XB_F5<^^^Z1MenO+Ue)NWvZ(56
+zxF#j%V9pXCQ6f<?fdIKQOaNohye3gHK!B`}2#^Sn2#^Sn2#^S@VFWg_HzQuOH`#9@
+zX|(O^?MN(bJs}{ypykT&ef^xc^|!2?JH`e=tTx6PK857eEkxkO9I>#2r7|~UEtnp~
+zTszY}EXyOJoFe7OV*p@TrR*MgY+S-;-q=HLR&en0)ZjDpNcc3J6}*kq7J|XDT$Fl2
+z@c{yyzh~9~5Do$$KgSEQf&3s9iUAW=Hq*iZgW>7PFp@UdKDU*@$Z7QhJT3+Ncocv(
+zdxXO001&hu0X)F7&0B{6sta{v4lJFV@J&a(NJw?HA@Fj@flj3!ggX#$cbRIt{v#-t
+zp%C*Ng|e77Q6~Iw?H>8cR2dlH@Aqpa-OinEuTHl+C)&L?Gbit0k+Qk1y|cUL+ThU0
+z=-6iuzItr=0lj@Z%dT8kj5WabK}EEBVkZ>e0~N*B6T6`J{-=mtPwaqN4x&kq)sOCq
+zSq7^sP;>T-Q!{c4n=V}H)!fv6X-Z#RsLalWK1D}7QBRhqhz<l(0z`z0SR#=CaHcp2
+z59P6VB97JWuV+WKL~~`kA}B49ort8;BH58h3@z&-_L|!V@jXYBE9Dl)QqFz&D>?Vy
+zJ)=+{;l8RFXMnqOLqzf*ciX-WDmaJxmpS+1CF9)Rzyr|BevxypXJ@FsnsbjL`W`y&
+zyZt&FJKGudI{-IdT1v&=2u^s%0gQ9+J^j)j1=9_Cv;x<kPNxGb5#s9V3a~_oh4oEP
+z2-k&{46x3GE1%v?{{#J=i?{1;*E-js*(goe8#n(`C!ZU)8`e8JCnr0*9UKhlForgk
+z)YjxyE;(s)mdG+h$(*pQV}sNKum^rX%iXBp>K`e1It|Oy-%>!89~JZuQo+CvRPcDz
+z20Z220>?315WCY3ATBm`_SOl3?1e;tL}1M!Fw2>rk8}T@fBf~^Z@&2xL`BEL$2j*d
+z|MmC3JbCgr*k+1z&*O2zbe#REsek`qeIC9!oO^uN0q5K=P9vE1!NJzi=38JS=U#V*
+zd3W|ka}BEIJU`KA+v{{3G96k=o?~lQpKp)pi=^E9i!!kX-D8gp?=WU-^Sxj6+rA#w
+zwy7%=8RF2dZ)sKP8bz*{tG%hdpePk5a{aZ#njWP>D&~4(|0j0$USJS_4y|grVxO2b
+zIixwSJSt5Wb2TICZmCq9$_>{3UfrUQiQ~E6n8VmaU?9NFq>2nh#^h~Hr&2E6Bi^pL
+zt-K&D6AHL&=+LStCLG2m0-0d)uI7@m0`~icc1ZKFvPLQv^E6teN_tGVE65EW;azFA
+zE+p*)3~BO~Mx{QXlu37KuWPQT8=!Nl=8m#MS|Jn$d1yz~AL1c-VIkeSAH)Q3s$H6M
+zYPm8GhNM=XQkE*jn(OK=sZ1Eh4V}EBxuUF=?&rGe9GC&v99q=Jm4%8_c<_?4O1fJd
+z3Ipj-$i*pK=HyMyMP->ZP3VU?d^W*^DBaL@sLPeP3c=(kJXo&CktV}1FGDQ(TofMd
+zR98w9gj;Zj2XGFS$TGatCqpvl1d=F`D49TDH7pGiQzM(#ECTJrN3O=Uh17dgT-N+n
+zB{&yYv*pOK3yCM0rS1g|iT8RAo!zPMJ-k_bdHC4X_}0*R5Bcy=p*s2e>%a3jdagU8
+zDg3y%)G_sozTy^soxf~Lu5xH!7x%nZ4NY3#m)prcjml{Sqt{9=@ZV>a(e~Z%m$b&#
+z`4+q7)(q^s6jJYA@mhZWQ02$`rl6Y5MM_obsqkYi`#0^n)mPB6qt^Rfm+a4PDf-h?
+zfhSyLn(Oi_(G83W+JT0Sw9}jlH?f28#=wCOx$k?)TylFgk}knHZ#k0JH&CwTonn+a
+ziATE1ni6V)Wv=NDKTU27uHI7Uw7+lYaCc&h-*I|jd;gJ3u?+!L^!%$GlKL3=w!_XT
+zz1NOjj6UgGM$f(2m){ZB=u=M1ZR?d><el~{cg{K6wEsPhl#xy25BHaMrk)L|bUU<W
+z7Y;db5`k5Kz+!)a1O5)ytjvSQP<<ZP3I7ESe}6yt2Y-FT+t<g3;gbQD%`b4w<--${
+z`}J1aub(>xLAl>xwK3*_pKKx#m=}RLl=~M(X66z;tZio$##*bAocp!S*I)kYUB|T#
+zfGnCGNFDNXfC;i-_>hCYv4>fQrR0g(66eiRZKrwjfFgjL{cTZxrOSVwWQ4{DV4Qec
+z$cfKvzxH4$IPu2gS-WnEYfrTQntXd~Y?5=2?{zISBRTgAMUM1awg{NBXKadRuiw6G
+RC%DMKNY1^rza=f}@BfIFW;6f*
+
+literal 0
+HcmV?d00001
+
+diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
+index 9d03b620ce..cfcf518907 100755
+--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
++++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
+@@ -19,7 +19,8 @@ ipq40xx_setup_interfaces()
+ 	engenius,ens620ext|\
+ 	luma,wrtq-329acn|\
+ 	plasmacloud,pa1200|\
+-	plasmacloud,pa2200)
++	plasmacloud,pa2200|\
++	wallys,dr40x9)
+ 		ucidef_set_interfaces_lan_wan "eth0" "eth1"
+ 		;;
+ 	aruba,ap-303|\
+diff --git a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
+index c255707f91..e1f75fd4bd 100755
+--- a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
++++ b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
+@@ -19,6 +19,9 @@ cilab,meshpoint-one)
+ compex,wpj428)
+ 	ucidef_add_gpio_switch "sim_card_select" "SIM card select" "3" "0"
+ 	;;
++wallys,dr40x9)
++	ucidef_add_gpio_switch "sim_card_select" "SIM card select" "423" "0"
++	;;
+ esac
+ 
+ board_config_flush
+diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+index 56b9935541..561c8289e7 100644
+--- a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
++++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+@@ -115,7 +115,8 @@ case "$FIRMWARE" in
+ 	plasmacloud,pa2200 |\
+ 	qxwlan,e2600ac-c1 |\
+ 	qxwlan,e2600ac-c2 |\
+-	unielec,u4019-32m)
++	unielec,u4019-32m |\
++	wallys,dr40x9)
+ 		caldata_extract "0:ART" 0x1000 0x2f20
+ 		;;
+ 	devolo,magic-2-wifi-next)
+@@ -227,7 +228,8 @@ case "$FIRMWARE" in
+ 	plasmacloud,pa2200 |\
+ 	qxwlan,e2600ac-c1 |\
+ 	qxwlan,e2600ac-c2 |\
+-	unielec,u4019-32m)
++	unielec,u4019-32m |\
++	wallys,dr40x9)
+ 		caldata_extract "0:ART" 0x5000 0x2f20
+ 		;;
+ 	devolo,magic-2-wifi-next)
+diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+index f6fc828134..7ebe0396f6 100644
+--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
++++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+@@ -73,6 +73,7 @@ platform_do_upgrade() {
+ 	luma,wrtq-329acn |\
+ 	mobipromo,cm520-79f |\
+ 	qxwlan,e2600ac-c2 |\
++	wallys,dr40x9 |\
+ 	tp-link,ec420-g1)
+ 		nand_do_upgrade "$1"
+ 		;;
+diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts
+new file mode 100644
+index 0000000000..cb3296f5e5
+--- /dev/null
++++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts
+@@ -0,0 +1,387 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++
++#include "qcom-ipq4019.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/input.h>
++#include <dt-bindings/soc/qcom,tcsr.h>
++
++/ {
++	model = "Wallys DR40X9";
++	compatible = "wallys,dr40x9";
++
++	chosen {
++		bootargs-append = " ubi.mtd=ubi root=/dev/ubiblock0_1";
++	};
++
++	soc {
++		rng@22000 {
++			status = "okay";
++		};
++
++		mdio@90000 {
++			status = "okay";
++
++			pinctrl-0 = <&mdio_pins>;
++			pinctrl-names = "default";
++			reset-gpios = <&tlmm 41 GPIO_ACTIVE_LOW>;
++			reset-delay-us = <2000>;
++		};
++
++		ess-psgmii@98000 {
++			status = "okay";
++		};
++
++		counter@4a1000 {
++			compatible = "qcom,qca-gcnt";
++			reg = <0x4a1000 0x4>;
++		};
++
++		tcsr@1949000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1949000 0x100>;
++			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
++		};
++
++		tcsr@194b000 {
++			status = "okay";
++
++			/* select hostmode */
++			compatible = "qcom,tcsr";
++			reg = <0x194b000 0x100>;
++			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
++		};
++
++		ess_tcsr@1953000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1953000 0x1000>;
++			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
++		};
++
++		tcsr@1957000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1957000 0x100>;
++			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
++		};
++
++		usb2: usb2@60f8800 {
++			status = "okay";
++		};
++
++		usb3: usb3@8af8800 {
++			status = "okay";
++		};
++
++		crypto@8e3a000 {
++			status = "okay";
++		};
++
++		watchdog@b017000 {
++			status = "okay";
++		};
++
++		ess-switch@c000000 {
++			status = "okay";
++		};
++
++		edma@c080000 {
++			status = "okay";
++		};
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		reset {
++			label = "reset";
++			gpios = <&tlmm 18 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		wlan2g {
++			label = "dr4029:green:wlan2g";
++			gpios = <&tlmm 32 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "phy0tpt";
++		};
++
++		wlan5g {
++			label = "dr4029:green:wlan5g";
++			gpios = <&tlmm 50 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "phy1tpt";
++		};
++
++		wlan2g-strength {
++			label = "dr4029:green:wlan2g-strength";
++			gpios = <&tlmm 36 GPIO_ACTIVE_LOW>;
++		};
++
++		wlan5g-strength {
++			label = "dr4029:green:wlan5g-strength";
++			gpios = <&tlmm 39 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&tlmm {
++	mdio_pins: mdio_pinmux {
++		mux_1 {
++			pins = "gpio6";
++			function = "mdio";
++			bias-pull-up;
++		};
++		mux_2 {
++			pins = "gpio7";
++			function = "mdc";
++			bias-pull-up;
++		};
++	};
++
++	serial0_pins: serial0_pinmux {
++		mux {
++			pins = "gpio16", "gpio17";
++			function = "blsp_uart0";
++			bias-disable;
++		};
++	};
++
++	serial1_pins: serial1_pinmux {
++		mux {
++			pins = "gpio8", "gpio9";
++			function = "blsp_uart1";
++			bias-disable;
++		};
++	};
++
++	spi_0_pins: spi_0_pinmux {
++		pinmux {
++			function = "blsp_spi0";
++			pins = "gpio13", "gpio14", "gpio15";
++			drive-strength = <12>;
++			bias-disable;
++		};
++		pinmux_cs {
++			function = "gpio";
++			pins = "gpio12";
++			drive-strength = <2>;
++			bias-disable;
++			output-high;
++		};
++	};
++
++	nand_pins: nand_pins {
++		pullups {
++			pins =  "gpio52", "gpio53", "gpio58", "gpio59";
++			function = "qpic";
++			bias-pull-up;
++		};
++
++		pulldowns {
++			pins = "gpio54", "gpio55", "gpio56", "gpio57",
++				"gpio60", "gpio62", "gpio63", "gpio64",
++				"gpio65", "gpio66", "gpio67", "gpio68",
++				"gpio69";
++			function = "qpic";
++			bias-pull-down;
++		};
++	};
++
++	sd_pins: sd_pins {
++		pinmux {
++			function = "sdio";
++			pins = "gpio23", "gpio24", "gpio25", "gpio26",
++				"gpio28", "gpio29", "gpio30", "gpio31";
++			drive-strength = <10>;
++		};
++		pinmux_sd_clk {
++			function = "sdio";
++			pins = "gpio27";
++			drive-strength = <16>;
++		};
++		pinmux_sd7 {
++			function = "sdio";
++			pins = "gpio32";
++			drive-strength = <10>;
++			bias-disable;
++		};
++	};
++};
++
++&blsp_dma {
++	status = "okay";
++};
++
++&blsp1_spi1 {
++	status = "okay";
++
++	pinctrl-0 = <&spi_0_pins>;
++	pinctrl-names = "default";
++
++	cs-gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>;
++
++	flash@0 {
++		compatible = "jedec,spi-nor";
++		spi-max-frequency = <24000000>;
++		reg = <0>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition0@0 {
++				label = "0:SBL1";
++				reg = <0x00000000 0x00040000>;
++				read-only;
++			};
++
++			partition1@40000 {
++				label = "0:MIBIB";
++				reg = <0x00040000 0x00020000>;
++				read-only;
++			};
++
++			partition2@60000 {
++				label = "0:QSEE";
++				reg = <0x00060000 0x00060000>;
++				read-only;
++			};
++
++			partition3@c0000 {
++				label = "0:CDT";
++				reg = <0x000c0000 0x00010000>;
++				read-only;
++			};
++
++			partition4@d0000 {
++				label = "0:DDRPARAMS";
++				reg = <0x000d0000 0x00010000>;
++				read-only;
++			};
++
++			partition5@e0000 {
++				label = "0:APPSBLENV"; /* uboot env */
++				reg = <0x000e0000 0x00010000>;
++				read-only;
++			};
++
++			partition6@f0000 {
++				label = "0:APPSBL"; /* uboot */
++				reg = <0x000f0000 0x00080000>;
++				read-only;
++			};
++
++			partition7@170000 {
++				label = "0:ART";
++				reg = <0x00170000 0x00010000>;
++				read-only;
++			};
++		};
++	};
++};
++
++&qpic_bam {
++	status = "okay";
++};
++
++&nand {
++	status = "okay";
++
++	pinctrl-0 = <&nand_pins>;
++	pinctrl-names = "default";
++
++	nand@0 {
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "ubi";
++				reg = <0x00000000 0x08000000>;
++			};
++		};
++	};
++};
++
++&blsp1_uart1 {
++	status = "okay";
++
++	pinctrl-0 = <&serial0_pins>;
++	pinctrl-names = "default";
++};
++
++&blsp1_uart2 {
++	status = "okay";
++
++	pinctrl-0 = <&serial1_pins>;
++	pinctrl-names = "default";
++};
++
++&cryptobam {
++	status = "okay";
++};
++
++&pcie0 {
++	status = "okay";
++
++	perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>;
++	wake-gpio = <&tlmm 40 GPIO_ACTIVE_LOW>;
++
++	/* Unpolulated slot */
++	bridge@0,0 {
++		reg = <0x00000000 0 0 0 0>;
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++	};
++};
++
++&vqmmc {
++	status = "okay";
++};
++
++&sdhci {
++	pinctrl-0 = <&sd_pins>;
++	pinctrl-names = "default";
++	cd-gpios = <&tlmm 22 GPIO_ACTIVE_LOW>;
++	vqmmc-supply = <&vqmmc>;
++	status = "okay";
++};
++
++&ethphy4 {
++	qcom,fiber-enable;
++};
++
++&gmac0 {
++	qcom,phy_mdio_addr = <3>;
++	qcom,poll_required = <1>;
++	qcom,forced_speed = <1000>;
++	qcom,forced_duplex = <1>;
++};
++
++&wifi0 {
++	status = "okay";
++
++	qcom,ath10k-calibration-variant = "Wallys-DR40X9";
++};
++
++&wifi1 {
++	status = "okay";
++
++	qcom,ath10k-calibration-variant = "Wallys-DR40X9";
++};
++
++&usb3_ss_phy {
++	status = "okay";
++};
++
++&usb3_hs_phy {
++	status = "okay";
++};
++
++&usb2_hs_phy {
++	status = "okay";
++};
+diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
+index e4e437bb95..7cbfecb233 100644
+--- a/target/linux/ipq40xx/image/generic.mk
++++ b/target/linux/ipq40xx/image/generic.mk
+@@ -834,6 +834,19 @@ define Device/zyxel_wre6606
+ endef
+ TARGET_DEVICES += zyxel_wre6606
+ 
++define Device/wallys_dr40x9
++	$(call Device/FitImage)
++	$(call Device/UbiFit)
++	DEVICE_VENDOR := Wallys
++	DEVICE_MODEL := DR40X9
++	SOC := qcom-ipq40x9
++	DEVICE_DTS_CONFIG := config@ap.dk07.1-c1
++	BLOCKSIZE := 128k
++	PAGESIZE := 2048
++	DEVICE_PACKAGES := ipq-wifi-wallys_dr40x9
++endef
++TARGET_DEVICES += wallys_dr40x9
++
+ define Device/tp-link_ec420_g1
+ 	$(call Device/FitImage)
+ 	$(call Device/UbiFit)
+diff --git a/target/linux/ipq40xx/patches-5.4/901-arm-boot-add-dts-files.patch b/target/linux/ipq40xx/patches-5.4/901-arm-boot-add-dts-files.patch
+index 492cc67b2c..4d686df304 100644
+--- a/target/linux/ipq40xx/patches-5.4/901-arm-boot-add-dts-files.patch
++++ b/target/linux/ipq40xx/patches-5.4/901-arm-boot-add-dts-files.patch
+@@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
+ 
+ --- a/arch/arm/boot/dts/Makefile
+ +++ b/arch/arm/boot/dts/Makefile
+-@@ -837,11 +837,60 @@ dtb-$(CONFIG_ARCH_QCOM) += \
++@@ -837,11 +837,61 @@ dtb-$(CONFIG_ARCH_QCOM) += \
+  	qcom-apq8074-dragonboard.dtb \
+  	qcom-apq8084-ifc6540.dtb \
+  	qcom-apq8084-mtp.dtb \
+@@ -68,6 +68,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
+ +	qcom-ipq4029-gl-b1300.dtb \
+ +	qcom-ipq4029-gl-s1300.dtb \
+ +	qcom-ipq4029-mr33.dtb \
+++	qcom-ipq40x9-dr40x9.dtb \
+  	qcom-ipq8064-ap148.dtb \
+  	qcom-msm8660-surf.dtb \
+  	qcom-msm8960-cdp.dtb \
+-- 
+2.25.1
+

patches/0042-ipq806x-add-edgecore_ssw2ac2600-support.patch

@@ -0,0 +1,590 @@
+From e5f38285a39a57f3f6faa6450e8b9e9847dfcc7a Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Wed, 18 Aug 2021 15:49:56 +0200
+Subject: [PATCH] ipq806x: add edgecore_ssw2ac2600 support
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ package/boot/uboot-envtools/files/ipq806x     |   1 +
+ package/firmware/ipq-wifi/Makefile            |   2 +
+ .../board-edgecore_ssw2ac2600.qca9984         | Bin 0 -> 24324 bytes
+ .../ipq806x/base-files/etc/board.d/01_leds    |   1 +
+ .../ipq806x/base-files/etc/board.d/02_network |   1 +
+ .../etc/hotplug.d/firmware/11-ath10k-caldata  |   2 +
+ .../ipq806x/base-files/etc/init.d/bootcount   |   1 +
+ .../base-files/lib/upgrade/platform.sh        |   1 +
+ .../arm/boot/dts/qcom-ipq8068-ssw2ac2600.dts  | 341 ++++++++++++++++++
+ target/linux/ipq806x/image/Makefile           |  14 +
+ .../0069-arm-boot-add-dts-files.patch         |   3 +-
+ 11 files changed, 366 insertions(+), 1 deletion(-)
+ create mode 100644 package/firmware/ipq-wifi/board-edgecore_ssw2ac2600.qca9984
+ create mode 100644 target/linux/ipq806x/files/arch/arm/boot/dts/qcom-ipq8068-ssw2ac2600.dts
+
+diff --git a/package/boot/uboot-envtools/files/ipq806x b/package/boot/uboot-envtools/files/ipq806x
+index 96a4ee6450..1b49fd51d4 100644
+--- a/package/boot/uboot-envtools/files/ipq806x
++++ b/package/boot/uboot-envtools/files/ipq806x
+@@ -31,6 +31,7 @@ ubootenv_mtdinfo () {
+ }
+ 
+ case "$board" in
++edgecore,ssw2ac2600 |\
+ edgecore,ecw5410)
+ 	ubootenv_add_uci_config "/dev/mtd11" "0x0" "0x10000" "0x10000"
+ 	;;
+diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
+index 192e8dcf7e..23fc4caa2e 100644
+--- a/package/firmware/ipq-wifi/Makefile
++++ b/package/firmware/ipq-wifi/Makefile
+@@ -33,6 +33,7 @@ ALLWIFIBOARDS:= \
+ 	devolo_magic-2-wifi-next \
+ 	dlink_dap2610 \
+ 	edgecore_ecw5410 \
++	edgecore_ssw2ac2600 \
+ 	edgecore_oap100 \
+ 	engenius_eap2200 \
+ 	engenius_emd1 \
+@@ -119,6 +120,7 @@ $(eval $(call generate-ipq-wifi-package,cellc_rtl30vw, Cell C RTL30VW))
+ $(eval $(call generate-ipq-wifi-package,devolo_magic-2-wifi-next,devolo Magic 2 WiFi next))
+ $(eval $(call generate-ipq-wifi-package,dlink_dap2610,D-Link DAP-2610))
+ $(eval $(call generate-ipq-wifi-package,edgecore_ecw5410,Edgecore ECW5410))
++$(eval $(call generate-ipq-wifi-package,edgecore_ssw2ac2600,Edgecore SSW2AC2600))
+ $(eval $(call generate-ipq-wifi-package,edgecore_oap100,Edgecore OAP100))
+ $(eval $(call generate-ipq-wifi-package,engenius_eap2200,EnGenius EAP2200))
+ $(eval $(call generate-ipq-wifi-package,engenius_emd1,EnGenius EMD1))
+diff --git a/package/firmware/ipq-wifi/board-edgecore_ssw2ac2600.qca9984 b/package/firmware/ipq-wifi/board-edgecore_ssw2ac2600.qca9984
+new file mode 100644
+index 0000000000000000000000000000000000000000..2c1992001d86268e0483b9e53ed4b563e224ada4
+GIT binary patch
+literal 24324
+zcmeHPeN+=y7JnH)J}sG$q9`3c1goeK0|h^#2wJq7)|7S8P(=c$7>lM6tOyq5L#PH#
+zk)SOLQb{PbK*6Pj7KMm{+M}HAIX$P{t+nl*ZU5Mw_MEnR+HQ}{?0YkrWC%pV*W$<A
+z%X{y>JNMrA-pycU-uvP6t6~?#Zd|)4eEovB4Y3KUL1tzqfTUW8Y5-zjNzLB3T$Q$K
+zero2f1!)<(R10>cFAt}Bse2Xbbktomf4@S#OR*<w`P1n;x2Nq@Z(s2As!dNtE(%{D
+z&E&xtfiPa+!rR$Ao***ufL4HFKmHZ0QUJ)_gdr1v0Wg(Bf*m3f0c8gwA|n3t(@#8!
+za0(zvGKMKmLOYK4R)215qNPVd@k#Tj0PxI8TVqS#8$9Fe4qkuV9q`QzFY(c3G)L4D
+zII0<n5xTgzI5|1-csy9s1VAU1gpn-9gEtqW$CdGDW=3FIq0P9Ae$=gxj}KrMUteFq
+zE+Y)=4rzog_pLd)XRI{(Y34v0kvHeyNV>QzO-Pm;3Ch`U8Q?PT|IdJt8qx?-$yCb&
+zRu}o9MFyajB?G|Nr;+IveG}PZkpVc!k^%S=)e9usOy^DCo9Oi|C6|)7|Da_6BFHMr
+zCWrio>2p(}**lp`CSNq$0}x9}DZLAsY05O^Q}Sx^oavm&aDoTics$J64gNrZiF&tI
+znv$;3e*DR2$mTP$6-N7z6vBd-@yjCP$N@5i^Z@Ok4l+X?pp~qGB@x;-kQEktt#*IX
+z#*NbW#emOuGaE0S8#*gEH~{v3`TC3BOs2=7MC*|9w{LD^&dw+euJADu`lrzTUS7^-
+z{~bG$5^3F?J3pFr0EFmN)Tr~x_e}4Z{%Ow9LUJM5PU-iN-<vj&QIrh822y60ECDQn
+zs!4Uc3HDU^$D2?=7v{4lENsqff<TJ<PqHk6CEx^(#}cvlB4QD)%08H1{Oa+Or-uqa
+zVx|it5(I=mB)B2KXAm<)Go*Zik54D!h&WN)jW~QAu}-v3x{_FluO-BUSR}q7#+MRH
+zMN6gOL^!^fuuP)n?C_#xP7;Y_R-8EG^Km34K7`K?KKM*xrf8;g6|w4vRrq>hy=c8O
+zf{6Gb0$)Zf6D^a{9|F6khN4qH;WfHtRj<}Gu}kO}NxC^hQ`dg+ruFS&u*CW`8CJY~
+zrKh3haPAhx%B#kfbDAP$s%*tTZ%e%<SD7Sx>eJp1z3vrtl05o1NE)5?1o+h0aaNbB
+zPLzwUUT$gDlql1n!{rveCQm7sMM4JybdbxVEDi&GEe2hYdW$@&r{D07Mx)#*i$$(F
+zje5I0X5eZ|qwa`$n|uj!IEF^(=&jKgl_+=1R(D)Nl49%H<t<lgnsZAOJJ!axT-MdA
+z^W=$(7f~Zry#^hOFz!)hx=hkxtf?z1fYS1gz8XVODGJhJtZ6JNQ)bHIEe<_K!&yzf
+za+7Rf$5lg{=D0dj{xqCiqo!23O%~nLYtX|)Y>`Ep9kk$TZ_C@d!rT-^Oh-R-C|B=R
+zJl}K0V9*q*74ju0bMUG{vC`u3>E({bnu4OO%9x(3FmACrMG@cA+tON7QM6YngIC{z
+zSCf^LLwS`}JM3p;PszQm*vkxC&t-|74SO<|C3~4+>$xnkv%$%ZW&oqNu?Lwu_O3F>
+z<$>)Sy^_``X_$M;_i%B?3+Ey#i6UIp*{f=Mwmz(UW^Ut!jCa=5JXtzDyQTk7*RyZ?
+z7vt*su073?Qz0e3FBP2Mqz^ytpU2PWx|rRxp>|&BjQv%8$?vT&1ZV^YFZIWrc~ay1
+zviHuK3mMH(y1*hlv$}I<W2819kH53_y0R-;AE?E1`>(ChhiRwh@?UJZvb8z-jeruL
+zY*lmI>!HQdvOE(@uWjm_SL=6lYSvrV_Iwak7jO*EuIyfK2&<T$=e_$~<L1W5$|nv9
+zG7F6ft)Z2|e6Nh+o)!Aw<NW=e+sodMtDapdRC#Ud>s@hbR*}z(UR&C(@4v9_?Z9%u
+zfs;M)^|Q-`Szf8vt}HthRER4*<n<q9oC`0Xall(qcYR;CtS$VEu%M_z@<w3sV@i)r
+zO}!bdq6)vfsc9#>Q(GmqGYTHt{lI?k+{C#Ia2WtDuI`>wy>Xw%r}@o%V(^O@)kE(K
+zcOzFe4U<n}-2vI0YlmcFA~ZAv{>%yv3Y--b6daW3;$}Ic9LCQv6%TWA!2ssuJjK-s
+zdSI?o&^DW^EBaD%b#<b?+wN^MO*{<`5Udfe!8Zt^#nE_-z>Oi0kXmu}{AG5{y!wx<
+z9XbX&J)~&d#$a+L@J0NTs{nFa1qPTx_-*8G<okPGce(C@bY;bKS>X?WGvDY5K!r2X
+zBWlRU0Mbjm2kX&wI{tds5Xeky)Y9=qo&zoe!^B?=<DVH6|2bd8zq;Ro%#4fL1Abb*
+zmVa|9=7zbk<J0y+Z-2;a{T=WNWB|hcOOj04>x7XQ++Rd}FB4rZ!tKjn;hlkWXpOo%
+zB#Cs5aLJ4g>3^pfN!FOVoSaE#n|R(XaR1aM9*<`NXycQa2Wr!ttn*{$vYfY$S7siU
+zvF*a@Anyg)kO64M{tD$%P=clbda*)S@1f*IN`3{-TMzjxXn+hrJJya>fGWs{S}~;4
+z04;VJ@?$(4G5}>*8Ro~sApbmsC^u^btsSEAwsUCE@iWp=IWOcP9>1ugk0jlap=rMf
+z0BjGyZL^!Ut%#!eVRPn~rP;y3obKVt0d>eR2a#EVpYQ#o8~vTlc|PbFAX~kJ&d%vz
+z^XbMubgp>{(wmT&b#+1-i;jsiQLS_{{KvJf{kpyO$=RVHlUeAKJNm4SKAn@wHg4XM
+zlAfW_R-XP#oxZWDwY~G=rM~MoM}C2IjyJL=*9XQLQ0JghK^b!rN}Yj9<I0#*Q0n|s
+zDlTJAKu4ZLyB-gJb|0AA;NhC6BWK3XB_{7UURB%B@_x@%d-B7T73*q*CL!)m_>26d
+zLa^Gj8kZ7MkyN@GM4BRT2_X?lq><zHer+9fB$BV#7bgVq;&}WyL6kTOUm-|(1M$!p
+z)P4wh3t`GIUxXncv*1r?a8MB3NeK?J>DuhE*mP}-ZMrtbHr-*SVo{9{cQ1Afci-a)
+z&mo-hA@m*%6!sOYQULIn23trlMP7E{L-6`g+`ZR$;qGrx6JS+i#oe<)Q6k)Ui?P+g
+zziJo>xPGX+MPtR?2LhVmB?|A)m<XxAbYOZhLb%08L;e}KKiq4h@&1g>-CG3XXBS`C
+zXP3Ks554LMX{h$W)IgjYYu9z~8gBP?>#GZLk`ki2FB=*Q3zCv!V+Q(~8%~zKq<Cie
+zz@=vW$&!~+o{^ya*>YXwNpSm8cYXEYoUI9qyRTFma`F>i2#@UVHPja#N=k~A^cyKj
+zPUBKe=qfA0ZDaSF&|zD`(r#mQLr!5ra`=+|O9p*mVN&wq#RGi?L*Zd4QP`RjRl3T-
+z^SeinJCeRff~d=nWR@IB%)M;j$u;_(oHVM`Csjlj1n%}p$~zN(bneSDGK9&+4I3)v
+z9rD}dopees*M{f%XZXmE)&Kdm=)-}T!mZ_o=U-ctAFy}&_7hDnR7aKuWC_!ons!&O
+zI1-XIJ-w?f=gnue0egJ5^`B2X8C4jv&u{0kcNDctj?FqaP5Ew9PVJhb^K$%^leS=P
+z;4x)jtS4=7aO#GKkaBeE!`jISel1TildJWlZSaF#aH8`#oV1N;=@a5SkBWNdj@W|N
+zr-wnfdz2mucMk<e23NgrwUPmewZoFcESW71u(0-QJ;crLr!n%Lo>QjKSFE`EJOBRI
+zS6_aKfc{q8z5A~}e*fKf-$0!=e7+sdpB>*Sdw6|KJqn*Soq<PBH@xU8JASuXI4TW?
+zyQfbV%r(T_&z?=mbKu4_eey6ay7|Mz8<}pnHFCIn`YrQ<^=0!B6dl<^VI%HonMxU*
+ztqHHuz01bjBYBLl`%u<v#jxUVzb~WJJ(3Tx+@c-1UAQc9S+bJ>?$)rAm_h1?Axnc6
+z#C5m~a2en-z-55T0GEMBI0Hj5@eJ(VZQRc6hmOI(?%l_2j0f!_EciQO-Hlwxc}Fn7
+z6#q}Yz4h&_-jDzI=#P((PF6w}+WzL>zJScwqV|3w_@^F-2jT9I{C>;zmMg7eaQ6(h
+zpTXRtb|Ti%gLOf6=XpW~K<%maoJ##=z!2E|&l55FC}KLaPY&ZcYB!20Os31daQ6s<
+zP5oap(>aNF2y-x*_Z~Mkmx0O50K)ZS5ZAAI75?)+0l0p9czZ@anV5StHix^X&bmfh
+zak%@@W{&f_Z!_S?nXx^rJzIa@E^v$!<8b#7Wo3ck+koY5x`XjpBg5?5doK7Nj2+EG
+
+literal 0
+HcmV?d00001
+
+diff --git a/target/linux/ipq806x/base-files/etc/board.d/01_leds b/target/linux/ipq806x/base-files/etc/board.d/01_leds
+index 74b94a29b4..05c63c817f 100755
+--- a/target/linux/ipq806x/base-files/etc/board.d/01_leds
++++ b/target/linux/ipq806x/base-files/etc/board.d/01_leds
+@@ -17,6 +17,7 @@ compex,wpq864)
+ 	ucidef_set_led_usbport "usb" "USB" "green:usb" "usb1-port1" "usb2-port1"
+ 	ucidef_set_led_usbport "pcie-usb" "PCIe USB" "green:usb-pcie" "usb3-port1"
+ 	;;
++edgecore,ssw2ac2600 |\
+ edgecore,ecw5410)
+ 	ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:wlan2g" "phy1tpt"
+ 	ucidef_set_led_wlan "wlan5g" "WLAN5G" "green:wlan5g" "phy0tpt"
+diff --git a/target/linux/ipq806x/base-files/etc/board.d/02_network b/target/linux/ipq806x/base-files/etc/board.d/02_network
+index 1a1cec51aa..146d42cb0a 100755
+--- a/target/linux/ipq806x/base-files/etc/board.d/02_network
++++ b/target/linux/ipq806x/base-files/etc/board.d/02_network
+@@ -27,6 +27,7 @@ tplink,vr2600v)
+ 	ucidef_add_switch "switch0" \
+ 		"1:lan" "2:lan" "3:lan" "4:lan" "6@eth1" "5:wan" "0@eth0"
+ 	;;
++edgecore,ssw2ac2600 |\
+ edgecore,ecw5410)
+ 	ucidef_set_interfaces_lan_wan "eth1" "eth0"
+ 	if [ -b "$(find_mtd_part 0:art)" ]; then
+diff --git a/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+index b9d0fec25e..ae8feba798 100644
+--- a/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
++++ b/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+@@ -74,6 +74,7 @@ case "$FIRMWARE" in
+ 		caldata_extract "ART" 0x5000 0x2f20
+ 		ath10k_patch_mac $(mtd_get_mac_binary ART 0x18)
+ 		;;
++	edgecore,ssw2ac2600 |\
+ 	edgecore,ecw5410)
+ 		if [ -b "$(find_mtd_part 0:art)" ]; then
+ 			caldata_extract "0:art" 0x1000 0x2f20
+@@ -121,6 +122,7 @@ case "$FIRMWARE" in
+ 	;;
+ "ath10k/pre-cal-pci-0002:01:00.0.bin")
+ 	case $board in
++	edgecore,ssw2ac2600 |\
+ 	edgecore,ecw5410)
+ 		if [ -b "$(find_mtd_part 0:art)" ]; then
+ 			caldata_extract "0:art" 0x5000 0x2f20
+diff --git a/target/linux/ipq806x/base-files/etc/init.d/bootcount b/target/linux/ipq806x/base-files/etc/init.d/bootcount
+index cb32a4ed35..f555e1af9a 100755
+--- a/target/linux/ipq806x/base-files/etc/init.d/bootcount
++++ b/target/linux/ipq806x/base-files/etc/init.d/bootcount
+@@ -9,6 +9,7 @@ boot() {
+ 	asrock,g10)
+ 		asrock_bootconfig_mangle "bootcheck" && reboot
+ 		;;
++	edgecore,ssw2ac2600|\
+ 	edgecore,ecw5410)
+ 		fw_setenv bootcount 0
+ 		;;
+diff --git a/target/linux/ipq806x/base-files/lib/upgrade/platform.sh b/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
+index a5e18201df..f3ac923ccb 100644
+--- a/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
++++ b/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
+@@ -29,6 +29,7 @@ platform_do_upgrade() {
+ 		CI_ROOTPART="ubi_rootfs"
+ 		nand_do_upgrade "$1"
+ 		;;
++	edgecore,ssw2ac2600|\
+ 	edgecore,ecw5410)
+ 		part="$(awk -F 'ubi.mtd=' '{printf $2}' /proc/cmdline | sed -e 's/ .*$//')"
+ 		if [ "$part" = "rootfs1" ]; then
+diff --git a/target/linux/ipq806x/files/arch/arm/boot/dts/qcom-ipq8068-ssw2ac2600.dts b/target/linux/ipq806x/files/arch/arm/boot/dts/qcom-ipq8068-ssw2ac2600.dts
+new file mode 100644
+index 0000000000..b5608c2f94
+--- /dev/null
++++ b/target/linux/ipq806x/files/arch/arm/boot/dts/qcom-ipq8068-ssw2ac2600.dts
+@@ -0,0 +1,341 @@
++#include "qcom-ipq8064-v2.0.dtsi"
++
++#include <dt-bindings/input/input.h>
++#include <dt-bindings/soc/qcom,tcsr.h>
++
++/ {
++	model = "Edgecore SSW2AC2600";
++	compatible = "edgecore,ssw2ac2600", "qcom,ipq8064";
++
++	reserved-memory {
++		nss@40000000 {
++			reg = <0x40000000 0x1000000>;
++			no-map;
++		};
++
++		smem: smem@41000000 {
++			reg = <0x41000000 0x200000>;
++			no-map;
++		};
++
++		wifi_dump@44000000 {
++			reg = <0x44000000 0x600000>;
++			no-map;
++		};
++	};
++
++	cpus {
++		idle-states {
++			CPU_SPC: spc {
++				status = "disabled";
++			};
++		};
++	};
++
++	aliases {
++		serial1 = &gsbi1_serial;
++		mdio-gpio0 = &mdio0;
++		ethernet0 = &gmac3;
++		ethernet1 = &gmac2;
++
++		led-boot = &led_power_green;
++		led-failsafe = &led_power_red;
++		led-running = &led_power_green;
++		led-upgrade = &led_power_green;
++	};
++
++	chosen {
++		bootargs-append = " console=ttyMSM0,115200n8 root=/dev/ubiblock0_1";
++	};
++
++	keys {
++		compatible = "gpio-keys";
++		pinctrl-0 = <&button_pins>;
++		pinctrl-names = "default";
++
++		reset {
++			label = "reset";
++			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
++			debounce-interval = <60>;
++			wakeup-source;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++		pinctrl-0 = <&led_pins>;
++		pinctrl-names = "default";
++
++		led_power_green: power_green {
++			label = "green:power";
++			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_HIGH>;
++		};
++
++		wlan2g_green {
++			label = "green:wlan2g";
++			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_LOW>;
++		};
++
++		wlan2g_yellow {
++			label = "yellow:wlan2g";
++			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_LOW>;
++		};
++
++		wlan5g_green {
++			label = "green:wlan5g";
++			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
++		};
++
++		led_power_red: power_red {
++			label = "red:power";
++			gpios = <&qcom_pinmux 28 GPIO_ACTIVE_LOW>;
++		};
++
++		wlan5g_yellow {
++			label = "yellow:wlan5g";
++			gpios = <&qcom_pinmux 59 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++
++&qcom_pinmux {
++	spi_pins: spi_pins {
++		mux {
++			pins = "gpio18", "gpio19";
++			function = "gsbi5";
++			drive-strength = <10>;
++			bias-pull-down;
++		};
++
++		clk {
++			pins = "gpio21";
++			function = "gsbi5";
++			drive-strength = <12>;
++			bias-pull-down;
++		};
++
++		cs {
++			pins = "gpio20";
++			function = "gpio";
++			drive-strength = <10>;
++			bias-pull-up;
++		};
++	};
++
++	led_pins: led_pins {
++		mux {
++			pins = "gpio16", "gpio23", "gpio24", "gpio26",
++				   "gpio28", "gpio59";
++			function = "gpio";
++			drive-strength = <2>;
++			bias-pull-up;
++		};
++	};
++
++	button_pins: button_pins {
++		mux {
++			pins = "gpio25";
++			function = "gpio";
++			drive-strength = <2>;
++			bias-pull-up;
++		};
++	};
++
++	uart1_pins: uart1_pins {
++		mux {
++			pins = "gpio51", "gpio52", "gpio53", "gpio54";
++			function = "gsbi1";
++			drive-strength = <12>;
++			bias-none;
++		};
++	};
++};
++
++&gsbi1 {
++	qcom,mode = <GSBI_PROT_UART_W_FC>;
++	status = "okay";
++
++	serial@12450000 {
++		status = "okay";
++
++		pinctrl-0 = <&uart1_pins>;
++		pinctrl-names = "default";
++	};
++};
++
++&gsbi5 {
++	qcom,mode = <GSBI_PROT_SPI>;
++	status = "okay";
++
++	spi4: spi@1a280000 {
++		status = "okay";
++		spi-max-frequency = <50000000>;
++
++		pinctrl-0 = <&spi_pins>;
++		pinctrl-names = "default";
++
++		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
++
++		m25p80@0 {
++			compatible = "jedec,spi-nor";
++			#address-cells = <1>;
++			#size-cells = <1>;
++			spi-max-frequency = <50000000>;
++			reg = <0>;
++
++			partitions {
++				compatible = "qcom,smem-part";
++			};
++		};
++	};
++};
++
++&hs_phy_0 {		/* USB3 port 0 HS phy */
++	status = "okay";
++};
++
++&hs_phy_1 {		/* USB3 port 1 HS phy */
++	status = "okay";
++};
++
++&ss_phy_0 {		/* USB3 port 0 SS phy */
++	status = "okay";
++};
++
++&ss_phy_1 {		/* USB3 port 1 SS phy */
++	status = "okay";
++};
++
++&usb3_0 {
++	status = "okay";
++};
++
++&usb3_1 {
++	status = "okay";
++};
++
++&pcie1 {
++	status = "okay";
++
++	/delete-property/ pinctrl-0;
++	/delete-property/ pinctrl-names;
++	/delete-property/ perst-gpios;
++
++	bridge@0,0 {
++		reg = <0x00000000 0 0 0 0>;
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++
++		wifi@1,0 {
++			compatible = "qcom,ath10k";
++			status = "okay";
++			reg = <0x00010000 0 0 0 0>;
++			qcom,ath10k-calibration-variant = "Edgecore-ECW5410-L";
++		};
++	};
++};
++
++&pcie2 {
++	status = "okay";
++
++	/delete-property/ pinctrl-0;
++	/delete-property/ pinctrl-names;
++	/delete-property/ perst-gpios;
++
++	bridge@0,0 {
++		reg = <0x00000000 0 0 0 0>;
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++
++		wifi@1,0 {
++			compatible = "qcom,ath10k";
++			status = "okay";
++			reg = <0x00010000 0 0 0 0>;
++			qcom,ath10k-calibration-variant = "Edgecore-ECW5410-L";
++		};
++	};
++};
++
++&nand_controller {
++	status = "okay";
++
++	pinctrl-0 = <&nand_pins>;
++	pinctrl-names = "default";
++
++	nand@0 {
++		compatible = "qcom,nandcs";
++
++		reg = <0>;
++
++		nand-ecc-strength = <4>;
++		nand-bus-width = <8>;
++		nand-ecc-step-size = <512>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			rootfs1@0 {
++				label = "rootfs1";
++				reg = <0x0000000 0x4000000>;
++			};
++
++			rootfs2@4000000 {
++				label = "rootfs2";
++				reg = <0x4000000 0x4000000>;
++			};
++		};
++	};
++};
++
++&soc {
++	mdio1: mdio {
++		compatible = "virtual,mdio-gpio";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		status = "okay";
++
++		pinctrl-0 = <&mdio0_pins>;
++		pinctrl-names = "default";
++
++		gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH &qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
++
++		phy0: ethernet-phy@0 {
++			reg = <0>;
++		};
++
++		phy1: ethernet-phy@1 {
++			reg = <1>;
++		};
++	};
++};
++
++&gmac2 {
++	status = "okay";
++
++	qcom,id = <2>;
++	mdiobus = <&mdio0>;
++
++	phy-mode = "sgmii";
++	phy-handle = <&phy1>;
++};
++
++&gmac3 {
++	status = "okay";
++
++	qcom,id = <3>;
++	mdiobus = <&mdio1>;
++
++	phy-mode = "sgmii";
++	phy-handle = <&phy0>;
++};
++
++&adm_dma {
++	status = "okay";
++};
+diff --git a/target/linux/ipq806x/image/Makefile b/target/linux/ipq806x/image/Makefile
+index 93e7ba3151..8c000075c6 100644
+--- a/target/linux/ipq806x/image/Makefile
++++ b/target/linux/ipq806x/image/Makefile
+@@ -157,6 +157,20 @@ define Device/edgecore_ecw5410
+ endef
+ TARGET_DEVICES += edgecore_ecw5410
+ 
++define Device/edgecore_ssw2ac2600
++	$(call Device/FitImage)
++	$(call Device/UbiFit)
++	DEVICE_VENDOR := Edgecore
++	DEVICE_MODEL := SSW2AC2600
++	SOC := qcom-ipq8068
++	BLOCKSIZE := 128k
++	PAGESIZE := 2048
++	DEVICE_DTS := qcom-ipq8068-ssw2ac2600
++	DEVICE_DTS_CONFIG := config@v2.0-ap160
++	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct ipq-wifi-edgecore_ssw2ac2600
++endef
++TARGET_DEVICES += edgecore_ssw2ac2600
++
+ define Device/linksys_ea7500-v1
+ 	$(call Device/LegacyImage)
+ 	DEVICE_VENDOR := Linksys
+diff --git a/target/linux/ipq806x/patches-5.4/0069-arm-boot-add-dts-files.patch b/target/linux/ipq806x/patches-5.4/0069-arm-boot-add-dts-files.patch
+index b97d36fd7c..7cb1d9cc75 100644
+--- a/target/linux/ipq806x/patches-5.4/0069-arm-boot-add-dts-files.patch
++++ b/target/linux/ipq806x/patches-5.4/0069-arm-boot-add-dts-files.patch
+@@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
+ 
+ --- a/arch/arm/boot/dts/Makefile
+ +++ b/arch/arm/boot/dts/Makefile
+-@@ -842,7 +842,25 @@ dtb-$(CONFIG_ARCH_QCOM) += \
++@@ -842,7 +842,26 @@ dtb-$(CONFIG_ARCH_QCOM) += \
+  	qcom-ipq4019-ap.dk04.1-c3.dtb \
+  	qcom-ipq4019-ap.dk07.1-c1.dtb \
+  	qcom-ipq4019-ap.dk07.1-c2.dtb \
+@@ -33,6 +33,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
+ +	qcom-ipq8065-r7800.dtb \
+ +	qcom-ipq8065-rt4230w-rev6.dtb \
+ +	qcom-ipq8068-ecw5410.dtb \
+++	qcom-ipq8068-ssw2ac2600.dtb \
+  	qcom-msm8660-surf.dtb \
+  	qcom-msm8960-cdp.dtb \
+  	qcom-msm8974-fairphone-fp2.dtb \
+-- 
+2.25.1
+

patches/0043-ipq40xx-add-HFCL-ION4-support.patch

@@ -0,0 +1,399 @@
+From e3a96108c0773915b53a08d04a98192338c5aeb9 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 26 Aug 2021 17:34:47 +0200
+Subject: [PATCH] ipq40xx: add HFCL ION4 support
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ package/boot/uboot-envtools/files/ipq40xx     |   4 +
+ package/firmware/ipq-wifi/Makefile            |   4 +-
+ .../ipq40xx/base-files/etc/board.d/01_leds    |   4 +
+ .../ipq40xx/base-files/etc/board.d/02_network |   1 +
+ .../etc/hotplug.d/firmware/11-ath10k-caldata  |   6 +
+ .../base-files/lib/upgrade/platform.sh        |   1 +
+ .../arm/boot/dts/qcom-ipq4019-hfcl-ion4.dts   | 226 ++++++++++++++++++
+ target/linux/ipq40xx/image/generic.mk         |  19 ++
+ .../ipq40xx/patches-5.4/999-hfcl_ion.patch    |  12 +
+ 9 files changed, 276 insertions(+), 1 deletion(-)
+ create mode 100644 target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hfcl-ion4.dts
+ create mode 100644 target/linux/ipq40xx/patches-5.4/999-hfcl_ion.patch
+
+diff --git a/package/boot/uboot-envtools/files/ipq40xx b/package/boot/uboot-envtools/files/ipq40xx
+index ac66a7f2bd..9d39350544 100644
+--- a/package/boot/uboot-envtools/files/ipq40xx
++++ b/package/boot/uboot-envtools/files/ipq40xx
+@@ -63,6 +63,10 @@ linksys,mr8300)
+ zyxel,nbg6617)
+ 	ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x10000" "0x10000"
+ 	;;
++hfcl,ion4)
++	env=$(ubootenv_mtdinfo)
++	ubootenv_add_uci_config $env
++	;;
+ esac
+ 
+ config_load ubootenv
+diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
+index 23fc4caa2e..e887e5ad1c 100644
+--- a/package/firmware/ipq-wifi/Makefile
++++ b/package/firmware/ipq-wifi/Makefile
+@@ -51,7 +51,8 @@ ALLWIFIBOARDS:= \
+ 	qxwlan_e2600ac \
+ 	cig_wf610d \
+ 	wallys_dr40x9 \
+-	tp-link_ec420-g1
++	tp-link_ec420-g1 \
++	hfcl_ion4
+ 
+ ALLWIFIPACKAGES:=$(foreach BOARD,$(ALLWIFIBOARDS),ipq-wifi-$(BOARD))
+ 
+@@ -139,5 +140,6 @@ $(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac,Qxwlan E2600AC))
+ $(eval $(call generate-ipq-wifi-package,cig_wf610d,CIG WF_610D))
+ $(eval $(call generate-ipq-wifi-package,tp-link_ec420-g1,tp-link EC420-G1))
+ $(eval $(call generate-ipq-wifi-package,wallys_dr40x9,Wallys DR40X9))
++$(eval $(call generate-ipq-wifi-package,hfcl_ion4,HFCL ION4))
+ 
+ $(foreach PACKAGE,$(ALLWIFIPACKAGES),$(eval $(call BuildPackage,$(PACKAGE))))
+diff --git a/target/linux/ipq40xx/base-files/etc/board.d/01_leds b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
+index efd5d002db..57d3664423 100755
+--- a/target/linux/ipq40xx/base-files/etc/board.d/01_leds
++++ b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
+@@ -70,6 +70,10 @@ zyxel,wre6606)
+ 	ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:wlan2g" "phy0tpt"
+ 	ucidef_set_led_wlan "wlan5g" "WLAN5G" "green:wlan5g" "phy1tpt"
+ 	;;
++hfcl,ion4)
++	ucidef_set_led_wlan "wlan2g" "WLAN2G" "yellow:wlan2g" "phy0tpt"
++	ucidef_set_led_wlan "wlan5g" "WLAN5G" "red:wlan5g" "phy1tpt"
++	;;
+ esac
+ 
+ board_config_flush
+diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
+index cfcf518907..84596dcf88 100755
+--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
++++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
+@@ -33,6 +33,7 @@ ipq40xx_setup_interfaces()
+ 	netgear,ex6100v2|\
+ 	netgear,ex6150v2|\
+ 	tp-link,ec420-g1|\
++	hfcl,ion4|\
+ 	zyxel,wre6606)
+ 		ucidef_set_interface_wan "eth0"
+ 		;;
+diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+index 561c8289e7..d38decf77b 100644
+--- a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
++++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+@@ -162,6 +162,9 @@ case "$FIRMWARE" in
+ 	tp-link,ec420-g1)
+ 		caldata_extract "0:ART" 0x1000 0x2f20
+ 		;;
++	hfcl,ion4)
++		caldata_extract "0:ART" 4096 12064
++		;;
+ 	esac
+ 	;;
+ "ath10k/pre-cal-ahb-a800000.wifi.bin")
+@@ -272,6 +275,9 @@ case "$FIRMWARE" in
+ 		caldata_extract "ART" 0x5000 0x2f20
+ 		ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) -1)
+ 		;;
++	hfcl,ion4)
++		caldata_extract "0:ART" 20480 12064
++		;;
+ 	esac
+ 	;;
+ *)
+diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+index 7ebe0396f6..c404f32f41 100644
+--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
++++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+@@ -74,6 +74,7 @@ platform_do_upgrade() {
+ 	mobipromo,cm520-79f |\
+ 	qxwlan,e2600ac-c2 |\
+ 	wallys,dr40x9 |\
++	hfcl,ion4 |\
+ 	tp-link,ec420-g1)
+ 		nand_do_upgrade "$1"
+ 		;;
+diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hfcl-ion4.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hfcl-ion4.dts
+new file mode 100644
+index 0000000000..662eb7dff0
+--- /dev/null
++++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hfcl-ion4.dts
+@@ -0,0 +1,226 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++
++#include "qcom-ipq4019.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/input.h>
++#include <dt-bindings/soc/qcom,tcsr.h>
++
++/ {
++	model = "HFCL Ltd, ION4";
++	compatible = "hfcl,ion4";
++
++	aliases {
++/*		led-boot = &power_green;
++		led-failsafe = &power_red;
++		led-running = &power_green;
++		led-upgrade = &power_red;
++		label-mac-device = &wifi0;
++		*/
++	};
++
++	soc {
++		rng@22000 {
++			status = "okay";
++		};
++
++		mdio@90000 {
++			status = "okay";
++			pinctrl-0 = <&mdio_pins>;
++			pinctrl-names = "default";
++
++			/delete-node/ ethernet-phy@1;
++			/delete-node/ ethernet-phy@2;
++			/delete-node/ ethernet-phy@3;
++			/delete-node/ ethernet-phy@4;
++			/delete-node/ psgmii-phy@5;
++		};
++
++		tcsr@1949000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1949000 0x100>;
++			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
++		};
++
++		ess_tcsr@1953000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1953000 0x1000>;
++			qcom,ess-interface-select = <TCSR_ESS_PSGMII_RGMII5>;
++		};
++
++		tcsr@1957000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1957000 0x100>;
++			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
++		};
++
++		crypto@8e3a000 {
++			status = "okay";
++		};
++
++		watchdog@b017000 {
++			status = "okay";
++		};
++
++		ess-switch@c000000 {
++			switch_mac_mode = <0x3>; /* mac mode for RGMII RMII */
++			switch_lan_bmp = <0x0>; /* lan port bitmap */
++			switch_wan_bmp = <0x10>; /* wan port bitmap */
++		};
++
++		edma@c080000 {
++			status = "okay";
++			phy-mode = "rgmii-id";
++			qcom,num_gmac = <1>;
++			qcom,single-phy;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		power_red: power_red {
++			label = "yellow:wlan2g";
++			gpios = <&tlmm 45 GPIO_ACTIVE_LOW>;
++		};
++
++		power_green: power_green {
++			label = "red:wlan5g";
++			gpios = <&tlmm 46 GPIO_ACTIVE_HIGH>;
++		};
++	};
++};
++
++&tlmm {
++	serial_0_pins: serial_pinmux {
++		mux {
++			pins = "gpio16", "gpio17";
++			function = "blsp_uart0";
++			bias-disable;
++		};
++	};
++
++	nand_pins: nand_pins {
++		pullups {
++			pins = "gpio53", "gpio58", "gpio59";
++			function = "qpic";
++			bias-pull-up;
++		};
++
++		pulldowns {
++			pins = "gpio54", "gpio55", "gpio56",
++				"gpio57", "gpio60", "gpio61",
++				"gpio62", "gpio63", "gpio64",
++				"gpio65", "gpio66", "gpio67",
++				"gpio68", "gpio69";
++			function = "qpic";
++			bias-pull-down;
++		};
++	};
++
++	mdio_pins: mdio_pinmux {
++		mux_1 {
++			pins = "gpio6";
++			function = "mdio";
++			bias-pull-up;
++		};
++		mux_2 {
++			pins = "gpio7";
++			function = "mdc";
++			bias-pull-up;
++		};
++	};
++};
++
++&nand {
++	pinctrl-0 = <&nand_pins>;
++	pinctrl-names = "default";
++	status = "okay";
++
++	nand@0 {
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition0@0 {
++				label = "0:SBL1";
++				reg = <0x00000000 0x00100000>;
++				read-only;
++			};
++			partition1@100000 {
++				label = "0:MIBIB";
++				reg = <0x00100000 0x00100000>;
++				read-only;
++			};
++			partition2@200000 {
++				label = "0:BOOTCONFIG";
++				reg = <0x00200000 0x00100000>;
++				read-only;
++			};
++			partition3@300000 {
++				label = "0:QSEE";
++				reg = <0x00300000 0x00200000>;
++				read-only;
++			};
++			partition4@500000 {
++				label = "0:CDT";
++				reg = <0x00500000 0x00180000>;
++				read-only;
++			};
++			partition5@680000 {
++				label = "0:APPSBLENV";
++				reg = <0x00680000 0x00080000>;
++			};
++			partition6@700000 {
++				label = "0:APPSBL";
++				reg = <0x00700000 0x00400000>;
++				read-only;
++			};
++			partition7@b00000 {
++				label = "0:ART";
++				reg = <0x00b00000 0x00080000>;
++				read-only;
++			};
++			partition8@b80000 {
++				label = "kernel";
++				reg = <0x00b80000 0x1000000>;
++			};
++			partition8@180000 {
++				label = "ubi";
++				reg = <0x02b80000 0x5480000>;
++			};
++		};
++	};
++};
++
++&cryptobam {
++	status = "okay";
++};
++
++&blsp_dma {
++	status = "okay";
++};
++
++&blsp1_uart1 {
++	pinctrl-0 = <&serial_0_pins>;
++	pinctrl-names = "default";
++	status = "okay";
++};
++
++&qpic_bam {
++	status = "okay";
++};
++
++&wifi0 {
++	status = "okay";
++};
++
++&wifi1 {
++	status = "okay";
++};
++
++&gmac0 {
++	qcom,phy_mdio_addr = <0>;
++	qcom,poll_required = <1>;
++	vlan_tag = <0 0x20>;
++};
+diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
+index 7cbfecb233..896f2a657c 100644
+--- a/target/linux/ipq40xx/image/generic.mk
++++ b/target/linux/ipq40xx/image/generic.mk
+@@ -861,3 +861,22 @@ define Device/tp-link_ec420_g1
+ 	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct ipq-wifi-tp-link_ec420-g1
+ endef
+ TARGET_DEVICES += tp-link_ec420_g1
++
++define Device/hfcl_ion4
++	$(call Device/FitImage)
++	$(call Device/UbiFit)
++	DEVICE_VENDOR := HFCL
++	DEVICE_MODEL := ION4
++	SOC := qcom-ipq4019
++	DEVICE_DTS := qcom-ipq4019-hfcl-ion4
++	KERNEL_INSTALL := 1
++	KERNEL_SIZE := 4048k
++	BLOCKSIZE := 128k
++	PAGESIZE := 2048
++	BOARD_NAME := hfcl-ion4
++	IMAGES := nand-sysupgrade.bin
++	IMAGE/nand-sysupgrade.bin := sysupgrade-tar | append-metadata
++	DEVICE_PACKAGES := uboot-envtools
++	_DEVICE_PACKAGES := ipq-wifi-hfcl_ion4 uboot-envtools
++endef
++TARGET_DEVICES += hfcl_ion4
+diff --git a/target/linux/ipq40xx/patches-5.4/999-hfcl_ion.patch b/target/linux/ipq40xx/patches-5.4/999-hfcl_ion.patch
+new file mode 100644
+index 0000000000..2b45b47521
+--- /dev/null
++++ b/target/linux/ipq40xx/patches-5.4/999-hfcl_ion.patch
+@@ -0,0 +1,12 @@
++Index: linux-5.4.111/arch/arm/boot/dts/Makefile
++===================================================================
++--- linux-5.4.111.orig/arch/arm/boot/dts/Makefile
+++++ linux-5.4.111/arch/arm/boot/dts/Makefile
++@@ -885,6 +885,7 @@ dtb-$(CONFIG_ARCH_QCOM) += \
++ 	qcom-ipq4019-wpj419.dtb \
++ 	qcom-ipq4019-wtr-m2133hp.dtb \
++ 	qcom-ipq4019-tp-link-ec420-g1.dtb \
+++	qcom-ipq4019-hfcl-ion4.dtb \
++ 	qcom-ipq4028-wpj428.dtb \
++ 	qcom-ipq4029-ap-303.dtb \
++ 	qcom-ipq4029-ap-303h.dtb \
+-- 
+2.25.1
+

profiles/chilli-redirect.yml

@@ -0,0 +1,9 @@
+---
+description: Add the chilli redirect dependencies
+feeds:
+  - name: third_party
+    path: ../../feeds/third-party
+
+packages:
+  - coova-chilli
+  - chilli-redirect

profiles/edgecore_ssw2ac2600.yml

@@ -0,0 +1,16 @@
+---
+profile: edgecore_ssw2ac2600
+target: ipq806x
+subtarget: generic
+description: Build image for the EdgeCore SSW2AC2600
+image: bin/targets/ipq806x/generic/openwrt-ipq806x-generic-edgecore_ssw2ac2600-squashfs-nand-sysupgrade.bin
+include:
+  - ucentral-ap
+packages:
+  - ath10k-firmware-qca4019-ct-htt
+  - ath10k-firmware-qca9888-ct-htt
+  - ath10k-firmware-qca9984-ct-htt
+diffconfig: |
+  # CONFIG_PACKAGE_ath10k-firmware-qca4019-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9888-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9984-ct is not set

profiles/fbwifi.yml

@@ -0,0 +1,8 @@
+---
+description: Add the FaceBook dependencies
+feeds:
+  - name: facebook
+    path: ../../feeds/facebook
+
+packages:
+  - fbwifi

profiles/hfcl_ion4.yml

@@ -0,0 +1,16 @@
+---
+profile: hfcl_ion4
+target: ipq40xx
+subtarget: generic
+description: Build image for the HFCL ION4
+image: bin/targets/ipq40xx/generic/openwrt-ipq40xx-generic-hfcl_ion4-squashfs-nand-sysupgrade.bin
+include:
+  - ucentral-ap
+packages:
+  - ath10k-firmware-qca4019-ct-htt
+  - ath10k-firmware-qca9888-ct-htt
+  - ath10k-firmware-qca9984-ct-htt
+diffconfig: |
+  # CONFIG_PACKAGE_ath10k-firmware-qca4019-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9888-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9984-ct is not set

profiles/mikrotik_nand.yml

@@ -6,3 +6,16 @@ description: Build image for the Mikrotik RouterBoards
 image: bin/targets/ar71xx/mikrotik/openwrt-ar71xx-mikrotik-nand-large-ac-squashfs-sysupgrade.bin
 include:
   - ucentral-ap-mikrotik
+packages:
+  - ath10k-firmware-qca4019-ct-htt
+  - ath10k-firmware-qca9888-ct-htt
+  - ath10k-firmware-qca9984-ct-htt
+  - ath10k-board-qca9887
+  - ath10k-board-qca9888
+  - ath10k-board-qca988x
+  - ath10k-board-qca9984
+  - ath10k-board-qca99x0
+diffconfig: |
+  # CONFIG_PACKAGE_ath10k-firmware-qca4019-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9888-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9984-ct is not set

profiles/realtek.yml

@@ -5,4 +5,17 @@ feeds:
     path: ../../feeds/realtek
 
 packages:
-  - realtek-poe=y
+  - realtek-poe
+  - kmod-sched-core
+  - kmod-sched
+  - kmod-sched-act-vlan
+  - kmod-sched-bpf
+  - kmod-sched-cake
+  - kmod-sched-connmark
+  - kmod-sched-ctinfo
+  - kmod-sched-flower
+  - kmod-sched-ipset
+  - kmod-sched-mqprio
+  - tc-full
+  - switch-fabric
+  - ustp

profiles/ucentral-ap.yml

@@ -42,6 +42,8 @@ packages:
   - ucode
   - udhcpsnoop
   - usteer
+  - ustp
+  - libustream-openssl
   - udevmand
   - umdns
   - vxlan
@@ -65,3 +67,8 @@ diffconfig: |
   CONFIG_TARGET_PREINIT_SUPPRESS_STDERR=y
   CONFIG_TARGET_PREINIT_DISABLE_FAILSAFE=y
   # CONFIG_BATMAN_ADV_BATMAN_V is not set
+  # CONFIG_OPENVSWITCH_WITH_LIBUNBOUND is not set
+  # CONFIG_PACKAGE_libustream-wolfssl is not set
+  # CONFIG_LIBCURL_WOLFSSL is not set
+  CONFIG_LIBCURL_OPENSSL=y
+  # CONFIG_PACKAGE_libwolfssl is not set

profiles/wallys_dr40x9.yml

@@ -0,0 +1,16 @@
+---
+profile: wallys_dr40x9
+target: ipq40xx
+subtarget: generic
+description: Build image for the wallys dr40x9
+image: bin/targets/ipq40xx/generic/openwrt-ipq40xx-generic-wallys_dr40x9-squashfs-nand-sysupgrade.bin
+include:
+  - ucentral-ap
+packages:
+  - ath10k-firmware-qca4019-ct-htt
+  - ath10k-firmware-qca9888-ct-htt
+  - ath10k-firmware-qca9984-ct-htt
+diffconfig: |
+  # CONFIG_PACKAGE_ath10k-firmware-qca4019-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9888-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9984-ct is not set