ucentral-schema: update to latest HEAD

* minor fixes to handling of boolean values

Signed-off-by: John Crispin <john@phrozen.org>

.github/workflows/build-dev.yml

@@ -11,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ['cig_wf188', 'cig_wf194c', 'cig_wf160d', 'edgecore_eap101', 'edgecore_eap102', 'edgecore_ecs4100-12ph', 'edgecore_ecw5211', 'edgecore_ecw5410', 'edgecore_oap100', 'edgecore_spw2ac1200', 'indio_um-305ac', 'linksys_e8450-ubi', 'linksys_ea8300', 'mikrotik_nand', 'tplink_cpe210_v3', 'tplink_cpe510_v3', 'tplink_eap225_outdoor_v1', 'tplink_ec420', 'tplink_ex227', 'tplink_ex228', 'tplink_ex447' ]
+        target: ['cig_wf188', 'cig_wf194c', 'cig_wf160d', 'edgecore_eap101', 'edgecore_eap102', 'edgecore_ecs4100-12ph', 'edgecore_ecw5211', 'edgecore_ecw5410', 'edgecore_oap100', 'edgecore_ssw2ac2600', 'edgecore_spw2ac1200', 'indio_um-305ac', 'linksys_e8450-ubi', 'linksys_ea8300', 'mikrotik_nand', 'tplink_cpe210_v3', 'tplink_cpe510_v3', 'tplink_eap225_outdoor_v1', 'tplink_ec420', 'tplink_ex227', 'tplink_ex228', 'tplink_ex447', 'wallys_dr40x9' ]
 
     steps:
     - uses: actions/checkout@v2

backports/0007-uboot-envtools-add-defaults-for-linksys-e8450-ubi.patch

@@ -1,7 +1,7 @@
-From 7837219939ea5d8ecab21acf943a8199bea7e89a Mon Sep 17 00:00:00 2001
+From 256daf33ec9c8cc8b094d7612ba7384db18d0a6b Mon Sep 17 00:00:00 2001
 From: Daniel Golle <daniel@makrotopia.org>
 Date: Fri, 12 Feb 2021 03:09:39 +0000
-Subject: [PATCH 7/9] uboot-envtools: add defaults for linksys-e8450-ubi
+Subject: [PATCH 04/64] uboot-envtools: add defaults for linksys-e8450-ubi
 
 Add U-Boot environment configuration for the Linksys E8450 (UBI) to
 allow access to the bootloader environment from OpenWrt via
@@ -9,17 +9,16 @@ allow access to the bootloader environment from OpenWrt via
 
 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 ---
- package/boot/uboot-envtools/files/mediatek | 25 ++++++++++++++++++++++
- 1 file changed, 25 insertions(+)
+ package/boot/uboot-envtools/files/mediatek | 46 ++++++++++++++++++++++
+ 1 file changed, 46 insertions(+)
  create mode 100644 package/boot/uboot-envtools/files/mediatek
 
 diff --git a/package/boot/uboot-envtools/files/mediatek b/package/boot/uboot-envtools/files/mediatek
 new file mode 100644
-index 0000000000..92a04ea73d
+index 0000000000..495a837274
 --- /dev/null
 +++ b/package/boot/uboot-envtools/files/mediatek
-@@ -0,0 +1,25 @@
-+#!/bin/sh
+@@ -0,0 +1,46 @@
 +#
 +# Copyright (C) 2021 OpenWrt.org
 +#
@@ -34,10 +33,32 @@ index 0000000000..92a04ea73d
 +board=$(board_name)
 +
 +case "$board" in
-+"linksys,e8450,ubi")
++linksys,e8450-ubi)
 +	ubootenv_add_uci_config "/dev/ubi0_0" "0x0" "0x1f000" "0x1f000" "1"
 +	ubootenv_add_uci_config "/dev/ubi0_1" "0x0" "0x1f000" "0x1f000" "1"
 +	;;
++bananapi,bpi-r64)
++	. /lib/upgrade/common.sh
++	export_bootdevice
++	export_partdevice rootdev 0
++	case "$rootdev" in
++	mmc*)
++		local envdev=/dev/$(get_partition_by_name $rootdev ubootenv)
++		ubootenv_add_uci_config "$envdev" "0x0" "0x80000" "0x80000" "1"
++		ubootenv_add_uci_config "$envdev" "0x80000" "0x80000" "0x80000" "1"
++		;;
++	*)
++		ubootenv_add_uci_config "/dev/ubi0_0" "0x0" "0x1f000" "0x1f000" "1"
++		ubootenv_add_uci_config "/dev/ubi0_1" "0x0" "0x1f000" "0x1f000" "1"
++		;;
++	esac
++	;;
++buffalo,wsr-2533dhp2)
++	ubootenv_add_uci_config "/dev/mtd3" "0x0" "0x1000" "0x20000"
++	;;
++ubnt,unifi-6-lr-ubootmod)
++	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x4000" "0x10000"
++	;;
 +esac
 +
 +config_load ubootenv

backports/0014-libubox-update-to-latest-HEAD.patch

@@ -1,32 +1,44 @@
-From 5171503cfa4387370fd4c33bbcf0d8c4b6ec86e4 Mon Sep 17 00:00:00 2001
+From 029282d8ef8e4e813817d1c7d4aeae4208bc2da5 Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Tue, 18 May 2021 10:46:43 +0200
-Subject: [PATCH] libubox: update to latest HEAD
+Subject: [PATCH 01/52] libubox: update to latest HEAD
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
- package/libs/libubox/Makefile                 |   4 +-
- package/network/config/netifd/Makefile        |   4 +-
- .../config/netifd/patches/100-8021x.patch     | 421 ++++++++++++++++++
- 3 files changed, 425 insertions(+), 4 deletions(-)
- create mode 100644 package/network/config/netifd/patches/100-8021x.patch
+ package/libs/libubox/Makefile | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
 
 diff --git a/package/libs/libubox/Makefile b/package/libs/libubox/Makefile
-index 4d582eacfd..8644764d59 100644
+index 4d582eacfd..33aa73eef7 100644
 --- a/package/libs/libubox/Makefile
 +++ b/package/libs/libubox/Makefile
-@@ -5,9 +5,9 @@ PKG_RELEASE=1
+@@ -1,13 +1,13 @@
+ include $(TOPDIR)/rules.mk
+ 
+ PKG_NAME:=libubox
+-PKG_RELEASE=1
++PKG_RELEASE=2
  
  PKG_SOURCE_PROTO:=git
  PKG_SOURCE_URL=$(PROJECT_GIT)/project/libubox.git
 -PKG_MIRROR_HASH:=97dc4eba01cf2c5d6a6d0db3747e0cdc0d95cb87e51b3115272e7d3e69a8b255
-+#PKG_MIRROR_HASH:=97dc4eba01cf2c5d6a6d0db3747e0cdc0d95cb87e51b3115272e7d3e69a8b255
- PKG_SOURCE_DATE:=2020-12-12
+-PKG_SOURCE_DATE:=2020-12-12
 -PKG_SOURCE_VERSION:=357877693ca363b12e6e7e14d345639b2440cd07
-+PKG_SOURCE_VERSION:=b14c4688612c05c78ce984d7bde633bce8703b1e
++PKG_MIRROR_HASH:=1cdb91ac0ee925f133ee9f70eac131a99def312fe7cf0aed44df84eb1762e30b
++PKG_SOURCE_DATE:=2021-08-19
++PKG_SOURCE_VERSION:=d716ac4bc4236031d4c3cc1ed362b502e20e3787
  PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
  CMAKE_INSTALL:=1
  
+@@ -67,7 +67,7 @@ define Package/libubox-lua
+ endef
+ 
+ TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include
+-CMAKE_OPTIONS = \
++CMAKE_OPTIONS += \
+ 	-DLUAPATH=/usr/lib/lua \
+ 	-DABIVERSION="$(PKG_ABI_VERSION)"
+ 
 -- 
 2.25.1
 

backports/0017-kernel-add-bdpu-filter-support.patch

@@ -0,0 +1,242 @@
+From 97fb5323a826e6b5ad89b5281c0b9d9e92bfc0b4 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Fri, 27 Aug 2021 16:52:34 +0200
+Subject: [PATCH 59/59] kernel: add bdpu filter support
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ ...l-knob-for-filtering-rx-tx-BPDU-pack.patch | 107 ++++++++++++++++++
+ ...l-knob-for-filtering-rx-tx-BPDU-pack.patch | 107 ++++++++++++++++++
+ 2 files changed, 214 insertions(+)
+ create mode 100644 target/linux/generic/pending-5.10/710-bridge-add-sysctl-knob-for-filtering-rx-tx-BPDU-pack.patch
+ create mode 100644 target/linux/generic/pending-5.4/710-bridge-add-sysctl-knob-for-filtering-rx-tx-BPDU-pack.patch
+
+diff --git a/target/linux/generic/pending-5.10/710-bridge-add-sysctl-knob-for-filtering-rx-tx-BPDU-pack.patch b/target/linux/generic/pending-5.10/710-bridge-add-sysctl-knob-for-filtering-rx-tx-BPDU-pack.patch
+new file mode 100644
+index 0000000000..918ae05d12
+--- /dev/null
++++ b/target/linux/generic/pending-5.10/710-bridge-add-sysctl-knob-for-filtering-rx-tx-BPDU-pack.patch
+@@ -0,0 +1,107 @@
++From: Felix Fietkau <nbd@nbd.name>
++Date: Fri, 27 Aug 2021 12:22:32 +0200
++Subject: [PATCH] bridge: add sysctl knob for filtering rx/tx BPDU packets on a
++ port
++
++Some devices (e.g. wireless APs) can't have devices behind them be part of
++a bridge topology with redundant links, due to address limitations.
++Additionally, broadcast traffic on these devices is somewhat expensive, due to
++the low data rate and wakeups of clients in powersave mode.
++This sysctl knob can be used to ensure that BPDU packets are never sent
++or forwarded to/from these devices
++
++Signed-off-by: Felix Fietkau <nbd@nbd.name>
++---
++
++--- a/include/linux/if_bridge.h
+++++ b/include/linux/if_bridge.h
++@@ -56,6 +56,7 @@ struct br_ip_list {
++ #define BR_MRP_AWARE		BIT(17)
++ #define BR_MRP_LOST_CONT	BIT(18)
++ #define BR_MRP_LOST_IN_CONT	BIT(19)
+++#define BR_BPDU_FILTER		BIT(20)
++ 
++ #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
++ 
++--- a/net/bridge/br_forward.c
+++++ b/net/bridge/br_forward.c
++@@ -191,6 +191,7 @@ out:
++ void br_flood(struct net_bridge *br, struct sk_buff *skb,
++ 	      enum br_pkt_type pkt_type, bool local_rcv, bool local_orig)
++ {
+++	const unsigned char *dest = eth_hdr(skb)->h_dest;
++ 	struct net_bridge_port *prev = NULL;
++ 	struct net_bridge_port *p;
++ 
++@@ -206,6 +207,10 @@ void br_flood(struct net_bridge *br, str
++ 		case BR_PKT_MULTICAST:
++ 			if (!(p->flags & BR_MCAST_FLOOD) && skb->dev != br->dev)
++ 				continue;
+++			if ((p->flags & BR_BPDU_FILTER) &&
+++			    unlikely(is_link_local_ether_addr(dest) &&
+++				     dest[5] == 0))
+++				continue;
++ 			break;
++ 		case BR_PKT_BROADCAST:
++ 			if (!(p->flags & BR_BCAST_FLOOD) && skb->dev != br->dev)
++--- a/net/bridge/br_input.c
+++++ b/net/bridge/br_input.c
++@@ -305,6 +305,8 @@ static rx_handler_result_t br_handle_fra
++ 		fwd_mask |= p->group_fwd_mask;
++ 		switch (dest[5]) {
++ 		case 0x00:	/* Bridge Group Address */
+++			if (p->flags & BR_BPDU_FILTER)
+++				goto drop;
++ 			/* If STP is turned off,
++ 			   then must forward to keep loop detection */
++ 			if (p->br->stp_enabled == BR_NO_STP ||
++--- a/net/bridge/br_sysfs_if.c
+++++ b/net/bridge/br_sysfs_if.c
++@@ -233,6 +233,7 @@ BRPORT_ATTR_FLAG(multicast_flood, BR_MCA
++ BRPORT_ATTR_FLAG(broadcast_flood, BR_BCAST_FLOOD);
++ BRPORT_ATTR_FLAG(neigh_suppress, BR_NEIGH_SUPPRESS);
++ BRPORT_ATTR_FLAG(isolated, BR_ISOLATED);
+++BRPORT_ATTR_FLAG(bpdu_filter, BR_BPDU_FILTER);
++ 
++ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
++ static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
++@@ -285,6 +286,7 @@ static const struct brport_attribute *br
++ 	&brport_attr_group_fwd_mask,
++ 	&brport_attr_neigh_suppress,
++ 	&brport_attr_isolated,
+++	&brport_attr_bpdu_filter,
++ 	&brport_attr_backup_port,
++ 	NULL
++ };
++--- a/net/bridge/br_stp_bpdu.c
+++++ b/net/bridge/br_stp_bpdu.c
++@@ -80,7 +80,8 @@ void br_send_config_bpdu(struct net_brid
++ {
++ 	unsigned char buf[35];
++ 
++-	if (p->br->stp_enabled != BR_KERNEL_STP)
+++	if (p->br->stp_enabled != BR_KERNEL_STP ||
+++	    (p->flags & BR_BPDU_FILTER))
++ 		return;
++ 
++ 	buf[0] = 0;
++@@ -127,7 +128,8 @@ void br_send_tcn_bpdu(struct net_bridge_
++ {
++ 	unsigned char buf[4];
++ 
++-	if (p->br->stp_enabled != BR_KERNEL_STP)
+++	if (p->br->stp_enabled != BR_KERNEL_STP ||
+++	    (p->flags & BR_BPDU_FILTER))
++ 		return;
++ 
++ 	buf[0] = 0;
++@@ -172,6 +174,9 @@ void br_stp_rcv(const struct stp_proto *
++ 	if (!(br->dev->flags & IFF_UP))
++ 		goto out;
++ 
+++	if (p->flags & BR_BPDU_FILTER)
+++		goto out;
+++
++ 	if (p->state == BR_STATE_DISABLED)
++ 		goto out;
++ 
+diff --git a/target/linux/generic/pending-5.4/710-bridge-add-sysctl-knob-for-filtering-rx-tx-BPDU-pack.patch b/target/linux/generic/pending-5.4/710-bridge-add-sysctl-knob-for-filtering-rx-tx-BPDU-pack.patch
+new file mode 100644
+index 0000000000..586d264cd5
+--- /dev/null
++++ b/target/linux/generic/pending-5.4/710-bridge-add-sysctl-knob-for-filtering-rx-tx-BPDU-pack.patch
+@@ -0,0 +1,107 @@
++From: Felix Fietkau <nbd@nbd.name>
++Date: Fri, 27 Aug 2021 12:22:32 +0200
++Subject: [PATCH] bridge: add sysctl knob for filtering rx/tx BPDU packets on a
++ port
++
++Some devices (e.g. wireless APs) can't have devices behind them be part of
++a bridge topology with redundant links, due to address limitations.
++Additionally, broadcast traffic on these devices is somewhat expensive, due to
++the low data rate and wakeups of clients in powersave mode.
++This sysctl knob can be used to ensure that BPDU packets are never sent
++or forwarded to/from these devices
++
++Signed-off-by: Felix Fietkau <nbd@nbd.name>
++---
++
++--- a/include/linux/if_bridge.h
+++++ b/include/linux/if_bridge.h
++@@ -47,6 +47,7 @@ struct br_ip_list {
++ #define BR_BCAST_FLOOD		BIT(14)
++ #define BR_NEIGH_SUPPRESS	BIT(15)
++ #define BR_ISOLATED		BIT(16)
+++#define BR_BPDU_FILTER		BIT(17)
++ 
++ #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
++ 
++--- a/net/bridge/br_forward.c
+++++ b/net/bridge/br_forward.c
++@@ -191,6 +191,7 @@ out:
++ void br_flood(struct net_bridge *br, struct sk_buff *skb,
++ 	      enum br_pkt_type pkt_type, bool local_rcv, bool local_orig)
++ {
+++	const unsigned char *dest = eth_hdr(skb)->h_dest;
++ 	struct net_bridge_port *prev = NULL;
++ 	struct net_bridge_port *p;
++ 
++@@ -206,6 +207,10 @@ void br_flood(struct net_bridge *br, str
++ 		case BR_PKT_MULTICAST:
++ 			if (!(p->flags & BR_MCAST_FLOOD) && skb->dev != br->dev)
++ 				continue;
+++			if ((p->flags & BR_BPDU_FILTER) &&
+++			    unlikely(is_link_local_ether_addr(dest) &&
+++				     dest[5] == 0))
+++				continue;
++ 			break;
++ 		case BR_PKT_BROADCAST:
++ 			if (!(p->flags & BR_BCAST_FLOOD) && skb->dev != br->dev)
++--- a/net/bridge/br_input.c
+++++ b/net/bridge/br_input.c
++@@ -300,6 +300,8 @@ rx_handler_result_t br_handle_frame(stru
++ 		fwd_mask |= p->group_fwd_mask;
++ 		switch (dest[5]) {
++ 		case 0x00:	/* Bridge Group Address */
+++			if (p->flags & BR_BPDU_FILTER)
+++				goto drop;
++ 			/* If STP is turned off,
++ 			   then must forward to keep loop detection */
++ 			if (p->br->stp_enabled == BR_NO_STP ||
++--- a/net/bridge/br_sysfs_if.c
+++++ b/net/bridge/br_sysfs_if.c
++@@ -233,6 +233,7 @@ BRPORT_ATTR_FLAG(multicast_flood, BR_MCA
++ BRPORT_ATTR_FLAG(broadcast_flood, BR_BCAST_FLOOD);
++ BRPORT_ATTR_FLAG(neigh_suppress, BR_NEIGH_SUPPRESS);
++ BRPORT_ATTR_FLAG(isolated, BR_ISOLATED);
+++BRPORT_ATTR_FLAG(bpdu_filter, BR_BPDU_FILTER);
++ 
++ #ifdef CONFIG_BRIDGE_IGMP_SNOOPING
++ static ssize_t show_multicast_router(struct net_bridge_port *p, char *buf)
++@@ -285,6 +286,7 @@ static const struct brport_attribute *br
++ 	&brport_attr_group_fwd_mask,
++ 	&brport_attr_neigh_suppress,
++ 	&brport_attr_isolated,
+++	&brport_attr_bpdu_filter,
++ 	&brport_attr_backup_port,
++ 	NULL
++ };
++--- a/net/bridge/br_stp_bpdu.c
+++++ b/net/bridge/br_stp_bpdu.c
++@@ -80,7 +80,8 @@ void br_send_config_bpdu(struct net_brid
++ {
++ 	unsigned char buf[35];
++ 
++-	if (p->br->stp_enabled != BR_KERNEL_STP)
+++	if (p->br->stp_enabled != BR_KERNEL_STP ||
+++	    (p->flags & BR_BPDU_FILTER))
++ 		return;
++ 
++ 	buf[0] = 0;
++@@ -125,7 +126,8 @@ void br_send_tcn_bpdu(struct net_bridge_
++ {
++ 	unsigned char buf[4];
++ 
++-	if (p->br->stp_enabled != BR_KERNEL_STP)
+++	if (p->br->stp_enabled != BR_KERNEL_STP ||
+++	    (p->flags & BR_BPDU_FILTER))
++ 		return;
++ 
++ 	buf[0] = 0;
++@@ -168,6 +170,9 @@ void br_stp_rcv(const struct stp_proto *
++ 	if (!(br->dev->flags & IFF_UP))
++ 		goto out;
++ 
+++	if (p->flags & BR_BPDU_FILTER)
+++		goto out;
+++
++ 	if (p->state == BR_STATE_DISABLED)
++ 		goto out;
++ 
+-- 
+2.25.1
+

backports/0035-uhttp-update-to-latest-HEAD.patch

@@ -0,0 +1,157 @@
+From patchwork Fri Aug 20 13:11:12 2021
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Stijn Tintel <stijn@linux-ipv6.be>
+X-Patchwork-Id: 1519040
+X-Patchwork-Delegate: stijn@linux-ipv6.be
+Return-Path: 
+ <openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org>
+X-Original-To: incoming@patchwork.ozlabs.org
+Delivered-To: patchwork-incoming@bilbo.ozlabs.org
+Authentication-Results: ozlabs.org;
+ spf=none (no SPF record) smtp.mailfrom=lists.openwrt.org
+ (client-ip=2607:7c80:54:e::133; helo=bombadil.infradead.org;
+ envelope-from=openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org;
+ receiver=<UNKNOWN>)
+Authentication-Results: ozlabs.org;
+	dkim=pass (2048-bit key;
+ secure) header.d=lists.infradead.org header.i=@lists.infradead.org
+ header.a=rsa-sha256 header.s=bombadil.20210309 header.b=r2Ly8Vhy;
+	dkim=fail reason="signature verification failed" (1024-bit key;
+ unprotected) header.d=linux-ipv6.be header.i=@linux-ipv6.be
+ header.a=rsa-sha256 header.s=502B7754-045F-11E5-BBC5-64595FD46BE8
+ header.b=BipII9T0;
+	dkim-atps=neutral
+Received: from bombadil.infradead.org (bombadil.infradead.org
+ [IPv6:2607:7c80:54:e::133])
+	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
+	 key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest
+ SHA256)
+	(No client certificate requested)
+	by ozlabs.org (Postfix) with ESMTPS id 4Grhsz3FQvz9s1l
+	for <incoming@patchwork.ozlabs.org>; Fri, 20 Aug 2021 23:13:59 +1000 (AEST)
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+	d=lists.infradead.org; s=bombadil.20210309; h=Sender:
+	Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post:
+	List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc
+	:To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:
+	Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:
+	List-Owner; bh=Dxw7atu76L/aBQntt7pW1jTYPCULL0mkcY2U1BYT2sI=; b=r2Ly8VhysFZseN
+	kLaheAFj130coCdyeHSxT/951GnDDBkmyursFZAP2hBLaKv9Z+9HpHIGM3sOiNhM/zDKfabNJ/1D2
+	CV4iyPpVkhRxG9t6HPpPx94E6J5Oknl7l6eyL04DWUB28EzXcoBSMiP0zYsoOWjI8sQO8wITNp6hf
+	neAM1VlZlNb22n5/Wu5oD1RoEiMUS5GeyhU7kEFEWpC45rcpyuQdvHpPLMn5GkcqCOO6i90E7BKAK
+	ipYG2tptIjqjrmR+nC6CPRavA+hSG/o6HzDSYNJvWmgVjCc6RpN/xliN03Rum4+mbDtMEB4Wpidmj
+	FepfgPqKxWRJ0UiXBJew==;
+Received: from localhost ([::1] helo=bombadil.infradead.org)
+	by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux))
+	id 1mH4J2-00BF23-C2; Fri, 20 Aug 2021 13:11:32 +0000
+Received: from mail.tintel.eu ([51.83.127.189])
+ by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux))
+ id 1mH4Iw-00BF1P-CR
+ for openwrt-devel@lists.openwrt.org; Fri, 20 Aug 2021 13:11:30 +0000
+Received: from localhost (localhost [IPv6:::1])
+ by mail.tintel.eu (Postfix) with ESMTP id 1BE4C4486AC4;
+ Fri, 20 Aug 2021 15:11:14 +0200 (CEST)
+Received: from mail.tintel.eu ([IPv6:::1])
+ by localhost (mail.tintel.eu [IPv6:::1]) (amavisd-new, port 10032)
+ with ESMTP id npDXmiQngdDU; Fri, 20 Aug 2021 15:11:13 +0200 (CEST)
+Received: from localhost (localhost [IPv6:::1])
+ by mail.tintel.eu (Postfix) with ESMTP id 5B1EC4486ACC;
+ Fri, 20 Aug 2021 15:11:13 +0200 (CEST)
+DKIM-Filter: OpenDKIM Filter v2.10.3 mail.tintel.eu 5B1EC4486ACC
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux-ipv6.be;
+ s=502B7754-045F-11E5-BBC5-64595FD46BE8; t=1629465073;
+ bh=3YKw9bephsRsf4MDuHSX4MioHjRWefi/5PEc54pFn4g=;
+ h=From:To:Date:Message-Id:MIME-Version;
+ b=BipII9T0eY8ENYqcdZ7rxKFn6rwkKKOhJ2IoeLZ1fx4lgpPuGWsZrexzqU6mYTDRa
+ Aihei2/ovPeWgUDbzfjNC9hIqv0fXRaEW0sCAPZGOP6gNHWNCkJxuPqYI+4pjijRRt
+ 6YYC2qCi8DqzQJv7St1FqeVFoIaF8SfbniBW+1N4=
+X-Virus-Scanned: amavisd-new at mail.tintel.eu
+Received: from mail.tintel.eu ([IPv6:::1])
+ by localhost (mail.tintel.eu [IPv6:::1]) (amavisd-new, port 10026)
+ with ESMTP id J5m0pY66LdR7; Fri, 20 Aug 2021 15:11:13 +0200 (CEST)
+Received: from taz.sof.bg.adlevio.net (unknown [IPv6:2001:67c:21bc:20::10])
+ by mail.tintel.eu (Postfix) with SMTP id 17DF94486AC4;
+ Fri, 20 Aug 2021 15:11:13 +0200 (CEST)
+Received: (nullmailer pid 141125 invoked by uid 1000);
+ Fri, 20 Aug 2021 13:11:12 -0000
+From: Stijn Tintel <stijn@linux-ipv6.be>
+To: openwrt-devel@lists.openwrt.org
+Cc: nbd@nbd.name
+Subject: [PATCH] uhttpd: add config option for json_script
+Date: Fri, 20 Aug 2021 16:11:12 +0300
+Message-Id: <20210820131112.141077-1-stijn@linux-ipv6.be>
+X-Mailer: git-send-email 2.31.1
+MIME-Version: 1.0
+X-Rspamd-Queue-Id: 17DF94486AC4
+X-Spamd-Result: default: False [0.00 / 15.00];
+ IP_WHITELIST(0.00)[2001:67c:21bc:20::10];
+ ASN(0.00)[asn:200533, ipnet:2001:67c:21bc::/48, country:BG]
+X-Rspamd-Server: skulls
+X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
+X-CRM114-CacheID: sfid-20210820_061126_592239_17869382 
+X-CRM114-Status: UNSURE (   9.50  )
+X-CRM114-Notice: Please train this message.
+X-Spam-Score: 0.2 (/)
+X-Spam-Report: Spam detection software,
+ running on the system "bombadil.infradead.org",
+ has NOT identified this incoming email as spam.  The original
+ message has been attached to this so you can view it or label
+ similar future email.  If you have any questions, see
+ the administrator of that system for details.
+ Content preview: Add a config option for json_script instead of
+ unconditionally
+ including all json files in /etc/uhttpd in every uhttpd instance. This makes
+ it possible to configure a single instance with an unconditi [...]
+ Content analysis details:   (0.2 points, 5.0 required)
+ pts rule name              description
+ ---- ----------------------
+ --------------------------------------------------
+ -0.0 SPF_PASS               SPF: sender matches SPF record
+ -0.0 SPF_HELO_PASS          SPF: HELO matches SPF record
+ 0.1 DKIM_SIGNED            Message has a DKIM or DK signature,
+ not necessarily
+ valid
+ 0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
+X-BeenThere: openwrt-devel@lists.openwrt.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: OpenWrt Development List <openwrt-devel.lists.openwrt.org>
+List-Unsubscribe: <https://lists.openwrt.org/mailman/options/openwrt-devel>,
+ <mailto:openwrt-devel-request@lists.openwrt.org?subject=unsubscribe>
+List-Archive: <http://lists.openwrt.org/pipermail/openwrt-devel/>
+List-Post: <mailto:openwrt-devel@lists.openwrt.org>
+List-Help: <mailto:openwrt-devel-request@lists.openwrt.org?subject=help>
+List-Subscribe: <https://lists.openwrt.org/mailman/listinfo/openwrt-devel>,
+ <mailto:openwrt-devel-request@lists.openwrt.org?subject=subscribe>
+Sender: "openwrt-devel" <openwrt-devel-bounces@lists.openwrt.org>
+Errors-To: 
+ openwrt-devel-bounces+incoming=patchwork.ozlabs.org@lists.openwrt.org
+
+Add a config option for json_script instead of unconditionally including
+all json files in /etc/uhttpd in every uhttpd instance. This makes it
+possible to configure a single instance with an unconditional redirect,
+which is currently not possible as it would render all other uhttpd
+instances unusable.
+
+Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
+---
+ package/network/services/uhttpd/Makefile          | 2 +-
+ package/network/services/uhttpd/files/uhttpd.init | 3 ++-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/package/network/services/uhttpd/files/uhttpd.init b/package/network/services/uhttpd/files/uhttpd.init
+index e7709941c2..30fd7b4259 100755
+--- a/package/network/services/uhttpd/files/uhttpd.init
++++ b/package/network/services/uhttpd/files/uhttpd.init
+@@ -196,7 +196,8 @@ start_instance()
+ 		append_bool "$cfg" redirect_https "-q" 0
+ 	}
+ 
+-	for file in /etc/uhttpd/*.json; do
++	config_get json_script "$cfg" json_script
++	for file in $json_script; do
+ 		[ -s "$file" ] && procd_append_param command -H "$file"
+ 	done
+ 

backports/0037-netifd-update-to-latest-HEAD.patch

@@ -1,36 +1,43 @@
-From ddaf9ee904b614f79c87f6d67d6c7b09c5d46eca Mon Sep 17 00:00:00 2001
+From a622ab0c15a2f58b724362339d6b467c02ee7576 Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Thu, 27 May 2021 13:24:47 +0200
-Subject: [PATCH 01/44] netifd: update to latest HEAD
+Subject: [PATCH 01/57] netifd: update to latest HEAD
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
- package/network/config/netifd/Makefile          | 12 +++++++++---
+ package/network/config/netifd/Makefile          | 14 +++++++++-----
  .../network/config/netifd/files/etc/udhcpc.user |  1 +
  .../config/netifd/files/lib/netifd/dhcp.script  |  3 +++
  .../netifd/patches/002-fix-dhcp-issue.patch     | 17 +++++++++++++++++
- 4 files changed, 30 insertions(+), 3 deletions(-)
+ 4 files changed, 30 insertions(+), 5 deletions(-)
  create mode 100644 package/network/config/netifd/files/etc/udhcpc.user
  create mode 100644 package/network/config/netifd/patches/002-fix-dhcp-issue.patch
 
 diff --git a/package/network/config/netifd/Makefile b/package/network/config/netifd/Makefile
-index 7061456b08..5717a400be 100644
+index 7061456b08..13c1d96ed7 100644
 --- a/package/network/config/netifd/Makefile
 +++ b/package/network/config/netifd/Makefile
-@@ -5,9 +5,9 @@ PKG_RELEASE:=1
+@@ -5,16 +5,14 @@ PKG_RELEASE:=1
  
  PKG_SOURCE_PROTO:=git
  PKG_SOURCE_URL=$(PROJECT_GIT)/project/netifd.git
 -PKG_SOURCE_DATE:=2021-01-09
 -PKG_SOURCE_VERSION:=c00c8335d6188daa326ecfe5a62da15a9b9987e1
 -PKG_MIRROR_HASH:=c740e51e0cec13eec336ba1c7a643db3b64a9a2235f8c1b73a566cb89e841190
-+PKG_SOURCE_DATE:=2021-05-26
-+PKG_SOURCE_VERSION:=440eb0647708274cc8d7d9e7c2bb0cfdfba90023
-+PKG_MIRROR_HASH:=
++PKG_SOURCE_DATE:=2021-09-01
++PKG_SOURCE_VERSION:=300b1220fab38600f102bb8cfcc59a29ce41b095
++PKG_MIRROR_HASH:=310fa90059795b1c956f9822db712ecc58bc19725b0f05f98c9e0a6824c8ca36
  PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
  
  PKG_LICENSE:=GPL-2.0
-@@ -25,6 +25,11 @@ define Package/netifd
+ PKG_LICENSE_FILES:=
+ 
+-PKG_BUILD_PARALLEL:=1
+-
+ include $(INCLUDE_DIR)/package.mk
+ include $(INCLUDE_DIR)/cmake.mk
+ 
+@@ -25,6 +23,11 @@ define Package/netifd
    TITLE:=OpenWrt Network Interface Configuration Daemon
  endef
  
@@ -42,7 +49,7 @@ index 7061456b08..5717a400be 100644
  TARGET_CFLAGS += \
  	-I$(STAGING_DIR)/usr/include/libnl-tiny \
  	-I$(STAGING_DIR)/usr/include \
-@@ -40,6 +45,7 @@ define Package/netifd/install
+@@ -40,6 +43,7 @@ define Package/netifd/install
  	$(INSTALL_DIR) $(1)/sbin
  	$(INSTALL_BIN) $(PKG_BUILD_DIR)/netifd $(1)/sbin/
  	$(CP) ./files/* $(1)/

backports/0038-mac80211-update-to-latest-HEAD.patch

@@ -1,7 +1,7 @@
-From 7e9c8738c1030b154cb0c0b104dbb403e5270120 Mon Sep 17 00:00:00 2001
+From 2636d06404c24ec6c2ad8395ad1dc8d26875be7a Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Thu, 27 May 2021 13:25:03 +0200
-Subject: [PATCH 01/42] mac80211: update to latest HEAD
+Subject: [PATCH 01/44] mac80211: update to latest HEAD
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
@@ -9,7 +9,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
  package/kernel/mac80211/ath.mk                |   13 +-
  package/kernel/mac80211/broadcom.mk           |    4 +-
  .../mac80211/files/lib/netifd/mac80211.sh     |   36 -
- .../files/lib/netifd/wireless/mac80211.sh     |  192 ++-
+ .../files/lib/netifd/wireless/mac80211.sh     |  195 ++-
  .../mac80211/files/lib/wifi/mac80211.sh       |  110 +-
  package/kernel/mac80211/mac80211.sh.diff      |   58 +
  .../patches/ath/402-ath_regd_optional.patch   |    2 +-
@@ -97,7 +97,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
  ...on-API-to-configure-SAR-power-limita.patch |  398 +++++
  ...mac80211-add-ieee80211_set_sar_specs.patch |   51 +
  .../500-mac80211_configure_antenna_gain.patch |   24 +-
- 92 files changed, 3735 insertions(+), 1344 deletions(-)
+ 92 files changed, 3737 insertions(+), 1345 deletions(-)
  delete mode 100644 package/kernel/mac80211/files/lib/netifd/mac80211.sh
  create mode 100644 package/kernel/mac80211/mac80211.sh.diff
  delete mode 100644 package/kernel/mac80211/patches/ath/560-ath9k-fix-transmitting-to-stations-in-dynamic-SMPS-m.patch
@@ -370,7 +370,7 @@ index 92e5c0e395..0000000000
 -	done
 -}
 diff --git a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
-index 92c56afd24..30d6b9311a 100644
+index 92c56afd24..a58af1fef0 100644
 --- a/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
 +++ b/package/kernel/mac80211/files/lib/netifd/wireless/mac80211.sh
 @@ -1,7 +1,6 @@
@@ -445,14 +445,26 @@ index 92c56afd24..30d6b9311a 100644
  mac80211_hostapd_setup_base() {
  	local phy="$1"
  
-@@ -195,12 +224,14 @@ mac80211_hostapd_setup_base() {
- 	enable_ac=0
- 	vht_oper_chwidth=0
- 	vht_center_seg0=
+@@ -119,6 +148,9 @@ mac80211_hostapd_setup_base() {
+ 	[ "$noscan" -gt 0 ] && hostapd_noscan=1
+ 	[ "$tx_burst" = 0 ] && tx_burst=
+ 
 +	chan_ofs=0
 +	[ "$band" = "6g" ] && chan_ofs=1
- 
- 	idx="$channel"
++
+ 	ieee80211n=1
+ 	ht_capab=
+ 	case "$htmode" in
+@@ -126,7 +158,7 @@ mac80211_hostapd_setup_base() {
+ 		HT40*|VHT40|VHT80|VHT160|HE40|HE80|HE160)
+ 			case "$hwmode" in
+ 				a)
+-					case "$(( ($channel / 4) % 2 ))" in
++					case "$(( (($channel / 4) + $chan_ofs) % 2 ))" in
+ 						1) ht_capab="[HT40+]";;
+ 						0) ht_capab="[HT40-]";;
+ 					esac
+@@ -200,7 +232,7 @@ mac80211_hostapd_setup_base() {
  	case "$htmode" in
  		VHT20|HE20) enable_ac=1;;
  		VHT40|HE40)
@@ -461,7 +473,7 @@ index 92c56afd24..30d6b9311a 100644
  				1) idx=$(($channel + 2));;
  				0) idx=$(($channel - 2));;
  			esac
-@@ -208,7 +239,7 @@ mac80211_hostapd_setup_base() {
+@@ -208,7 +240,7 @@ mac80211_hostapd_setup_base() {
  			vht_center_seg0=$idx
  		;;
  		VHT80|HE80)
@@ -470,7 +482,7 @@ index 92c56afd24..30d6b9311a 100644
  				1) idx=$(($channel + 6));;
  				2) idx=$(($channel + 2));;
  				3) idx=$(($channel - 2));;
-@@ -219,15 +250,35 @@ mac80211_hostapd_setup_base() {
+@@ -219,15 +251,35 @@ mac80211_hostapd_setup_base() {
  			vht_center_seg0=$idx
  		;;
  		VHT160|HE160)
@@ -510,7 +522,7 @@ index 92c56afd24..30d6b9311a 100644
  	[ "$hwmode" = "a" ] || enable_ac=0
  
  	if [ "$enable_ac" != "0" ]; then
-@@ -337,16 +388,62 @@ mac80211_hostapd_setup_base() {
+@@ -337,16 +389,62 @@ mac80211_hostapd_setup_base() {
  	esac
  
  	if [ "$enable_ax" != "0" ]; then
@@ -576,7 +588,7 @@ index 92c56afd24..30d6b9311a 100644
  	fi
  
  	hostapd_prepare_device_config "$hostapd_conf_file" nl80211
-@@ -426,7 +523,11 @@ mac80211_generate_mac() {
+@@ -426,7 +524,11 @@ mac80211_generate_mac() {
  	local oIFS="$IFS"; IFS=":"; set -- $ref; IFS="$oIFS"
  
  	macidx=$(($id + 1))
@@ -589,7 +601,7 @@ index 92c56afd24..30d6b9311a 100644
  		b1="0x$1"
  		[ "$id" -gt 0 ] && \
  			b1=$(($b1 ^ ((($id - !($b1 & 2)) << 2)) | 0x2))
-@@ -434,7 +535,7 @@ mac80211_generate_mac() {
+@@ -434,7 +536,7 @@ mac80211_generate_mac() {
  		return
  	}
  
@@ -598,7 +610,7 @@ index 92c56afd24..30d6b9311a 100644
  		printf "%s:%s:%s:%s:%s:%02x" $1 $2 $3 $4 $5 $(( 0x$6 ^ $id ))
  		return
  	}
-@@ -449,7 +550,7 @@ mac80211_generate_mac() {
+@@ -449,7 +551,7 @@ mac80211_generate_mac() {
  find_phy() {
  	[ -n "$phy" -a -d /sys/class/ieee80211/$phy ] && return 0
  	[ -n "$path" ] && {
@@ -607,7 +619,7 @@ index 92c56afd24..30d6b9311a 100644
  		[ -n "$phy" ] && return 0
  	}
  	[ -n "$macaddr" ] && {
-@@ -689,14 +790,8 @@ mac80211_prepare_iw_htmode() {
+@@ -689,14 +791,8 @@ mac80211_prepare_iw_htmode() {
  	case "$htmode" in
  		VHT20|HT20) iw_htmode=HT20;;
  		HT40*|VHT40|VHT160)
@@ -624,7 +636,7 @@ index 92c56afd24..30d6b9311a 100644
  					case "$htmode" in
  						HT40+) iw_htmode="HT40+";;
  						HT40-) iw_htmode="HT40-";;
-@@ -709,6 +804,12 @@ mac80211_prepare_iw_htmode() {
+@@ -709,6 +805,12 @@ mac80211_prepare_iw_htmode() {
  						;;
  					esac
  				;;
@@ -637,7 +649,7 @@ index 92c56afd24..30d6b9311a 100644
  			esac
  			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
  		;;
-@@ -818,7 +919,6 @@ mac80211_setup_vif() {
+@@ -818,7 +920,6 @@ mac80211_setup_vif() {
  		mesh)
  			wireless_vif_parse_encryption
  			[ -z "$htmode" ] && htmode="NOHT";
@@ -645,7 +657,7 @@ index 92c56afd24..30d6b9311a 100644
  			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ] || chan_is_dfs "$phy" "$channel"; then
  				mac80211_setup_supplicant $vif_enable || failed=1
  			else
-@@ -832,7 +932,6 @@ mac80211_setup_vif() {
+@@ -832,7 +933,6 @@ mac80211_setup_vif() {
  		adhoc)
  			wireless_vif_parse_encryption
  			if [ "$wpa" -gt 0 -o "$auto_channel" -gt 0 ]; then
@@ -653,7 +665,7 @@ index 92c56afd24..30d6b9311a 100644
  				mac80211_setup_supplicant_noctl $vif_enable || failed=1
  			else
  				mac80211_setup_adhoc $vif_enable
-@@ -849,10 +948,30 @@ mac80211_setup_vif() {
+@@ -849,10 +949,30 @@ mac80211_setup_vif() {
  
  get_freq() {
  	local phy="$1"
@@ -686,7 +698,7 @@ index 92c56afd24..30d6b9311a 100644
  chan_is_dfs() {
  	local phy="$1"
  	local chan="$2"
-@@ -896,7 +1015,8 @@ drv_mac80211_setup() {
+@@ -896,7 +1016,8 @@ drv_mac80211_setup() {
  		country chanbw distance \
  		txpower antenna_gain \
  		rxantenna txantenna \
@@ -696,7 +708,7 @@ index 92c56afd24..30d6b9311a 100644
  	json_get_values basic_rate_list basic_rate
  	json_get_values scan_list scan_list
  	json_select ..
-@@ -907,10 +1027,8 @@ drv_mac80211_setup() {
+@@ -907,10 +1028,8 @@ drv_mac80211_setup() {
  		return 1
  	}
  
@@ -709,7 +721,7 @@ index 92c56afd24..30d6b9311a 100644
  
  	OLDAPLIST=$(uci -q -P /var/state get wireless._${phy}.aplist)
  	OLDSPLIST=$(uci -q -P /var/state get wireless._${phy}.splist)
-@@ -935,7 +1053,7 @@ drv_mac80211_setup() {
+@@ -935,7 +1054,7 @@ drv_mac80211_setup() {
  	done
  
  	# convert channel to frequency
@@ -718,7 +730,7 @@ index 92c56afd24..30d6b9311a 100644
  
  	[ -n "$country" ] && {
  		iw reg get | grep -q "^country $country:" || {
-@@ -960,6 +1078,7 @@ drv_mac80211_setup() {
+@@ -960,6 +1079,7 @@ drv_mac80211_setup() {
  	set_default txantenna 0xffffffff
  	set_default distance 0
  	set_default antenna_gain 0
@@ -726,7 +738,7 @@ index 92c56afd24..30d6b9311a 100644
  
  	[ "$txantenna" = "all" ] && txantenna=0xffffffff
  	[ "$rxantenna" = "all" ] && rxantenna=0xffffffff
-@@ -1003,6 +1122,7 @@ drv_mac80211_setup() {
+@@ -1003,6 +1123,7 @@ drv_mac80211_setup() {
  	[ -n "$hostapd_ctrl" ] && {
  		local no_reload=1
  		if [ -n "$(ubus list | grep hostapd.$primary_ap)" ]; then
@@ -734,7 +746,7 @@ index 92c56afd24..30d6b9311a 100644
  			[ "${NEW_MD5}" = "${OLD_MD5}" ] || {
  				ubus call hostapd.$primary_ap reload
  				no_reload=$?
-@@ -1077,6 +1197,10 @@ drv_mac80211_teardown() {
+@@ -1077,6 +1198,10 @@ drv_mac80211_teardown() {
  	json_select data
  	json_get_vars phy
  	json_select ..

backports/0039-hostapd-upsate-to-latest-HEAD.patch

@@ -1,14 +1,14 @@
-From 84b526991e77774e21c3eb1a193ca3087b624e83 Mon Sep 17 00:00:00 2001
+From b70c9429587452776241c95729481accb9c193ae Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Thu, 27 May 2021 13:25:19 +0200
-Subject: [PATCH 01/41] hostapd: upsate to latest HEAD
+Subject: [PATCH 03/57] hostapd: upsate to latest HEAD
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
  package/network/services/hostapd/Makefile     |  15 +-
  .../hostapd/files/hostapd-basic.config        |   2 +-
  .../hostapd/files/hostapd-full.config         |   4 +-
- .../network/services/hostapd/files/hostapd.sh | 156 ++++++++--
+ .../network/services/hostapd/files/hostapd.sh | 158 ++++++++--
  ...-fix-frequency-setup-with-HE-enabled.patch | 196 -------------
  .../001-wolfssl-init-RNG-with-ECC-key.patch   |  43 +++
  ...-init-order-disable-pri-sec-channel-.patch | 126 --------
@@ -66,13 +66,13 @@ Signed-off-by: John Crispin <john@phrozen.org>
  .../720-ACS-fix-channel-100-frequency.patch   |  30 ++
  .../patches/720-iface_max_num_sta.patch       |  82 ++++++
  .../hostapd/patches/730-ft_iface.patch        |  38 +++
- .../hostapd/patches/740-snoop_iface.patch     |  37 +++
+ .../hostapd/patches/740-snoop_iface.patch     |  66 +++++
  ...ate-if-no-available-channel-is-found.patch |  37 ---
  ...of-secondary-device-types-for-P2P-gr.patch |  33 ---
- .../services/hostapd/src/src/ap/ubus.c        | 217 +++++++++++++-
+ .../services/hostapd/src/src/ap/ubus.c        | 214 +++++++++++++-
  .../services/hostapd/src/src/ap/ubus.h        |  16 +
  .../hostapd/src/src/utils/build_features.h    |   2 -
- 67 files changed, 1302 insertions(+), 2330 deletions(-)
+ 67 files changed, 1329 insertions(+), 2331 deletions(-)
  delete mode 100644 package/network/services/hostapd/patches/001-HE-VHT-fix-frequency-setup-with-HE-enabled.patch
  create mode 100644 package/network/services/hostapd/patches/001-wolfssl-init-RNG-with-ECC-key.patch
  delete mode 100644 package/network/services/hostapd/patches/002-mesh-fix-channel-init-order-disable-pri-sec-channel-.patch
@@ -179,7 +179,7 @@ index df272e443a..61b6daf861 100644
  # EAP-SAKE for the integrated EAP server
  #CONFIG_EAP_SAKE=y
 diff --git a/package/network/services/hostapd/files/hostapd.sh b/package/network/services/hostapd/files/hostapd.sh
-index 45a49b8faa..4591958b6f 100644
+index 45a49b8faa..e941fa4f77 100644
 --- a/package/network/services/hostapd/files/hostapd.sh
 +++ b/package/network/services/hostapd/files/hostapd.sh
 @@ -49,6 +49,7 @@ hostapd_append_wpa_key_mgmt() {
@@ -599,7 +599,15 @@ index 45a49b8faa..4591958b6f 100644
  
  	set_default per_sta_vif 0
  	if [ "$per_sta_vif" -gt 0 ]; then
-@@ -1079,9 +1174,9 @@ wpa_supplicant_set_fixed_freq() {
+@@ -1072,16 +1167,16 @@ wpa_supplicant_set_fixed_freq() {
+ 	append network_data "frequency=$freq" "$N$T"
+ 	case "$htmode" in
+ 		NOHT) append network_data "disable_ht=1" "$N$T";;
+-		HT20|VHT20) append network_data "disable_ht40=1" "$N$T";;
++		HT20|VHT20|HE20) append network_data "disable_ht40=1" "$N$T";;
+ 		HT40*|VHT40*|VHT80*|VHT160*) append network_data "ht40=1" "$N$T";;
+ 	esac
+ 	case "$htmode" in
  		VHT*) append network_data "vht=1" "$N$T";;
  	esac
  	case "$htmode" in
@@ -5317,10 +5325,10 @@ index 0000000000..793e8e0194
 + 		if (!hapd->l2) {
 diff --git a/package/network/services/hostapd/patches/740-snoop_iface.patch b/package/network/services/hostapd/patches/740-snoop_iface.patch
 new file mode 100644
-index 0000000000..722d1e713a
+index 0000000000..8d928f8505
 --- /dev/null
 +++ b/package/network/services/hostapd/patches/740-snoop_iface.patch
-@@ -0,0 +1,37 @@
+@@ -0,0 +1,66 @@
 +--- a/src/ap/ap_config.h
 ++++ b/src/ap/ap_config.h
 +@@ -278,6 +278,7 @@ struct hostapd_bss_config {
@@ -5333,7 +5341,36 @@ index 0000000000..722d1e713a
 + 
 +--- a/src/ap/x_snoop.c
 ++++ b/src/ap/x_snoop.c
-+@@ -71,8 +71,12 @@ x_snoop_get_l2_packet(struct hostapd_dat
++@@ -31,14 +31,16 @@ int x_snoop_init(struct hostapd_data *ha
++ 		return -1;
++ 	}
++ 
++-	if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
+++	if (!conf->snoop_iface[0] &&
+++	    hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
++ 					 1)) {
++ 		wpa_printf(MSG_DEBUG,
++ 			   "x_snoop: Failed to enable hairpin_mode on the bridge port");
++ 		return -1;
++ 	}
++ 
++-	if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) {
+++	if (!conf->snoop_iface[0] &&
+++	    hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) {
++ 		wpa_printf(MSG_DEBUG,
++ 			   "x_snoop: Failed to enable proxyarp on the bridge port");
++ 		return -1;
++@@ -52,7 +54,8 @@ int x_snoop_init(struct hostapd_data *ha
++ 	}
++ 
++ #ifdef CONFIG_IPV6
++-	if (hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) {
+++	if (!conf->snoop_iface[0] &&
+++	    hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) {
++ 		wpa_printf(MSG_DEBUG,
++ 			   "x_snoop: Failed to enable multicast snooping on the bridge");
++ 		return -1;
++@@ -71,8 +74,12 @@ x_snoop_get_l2_packet(struct hostapd_dat
 + {
 + 	struct hostapd_bss_config *conf = hapd->conf;
 + 	struct l2_packet_data *l2;
@@ -5441,7 +5478,7 @@ index 944f7d71c9..0000000000
 - 		  dev->info.wps_sec_dev_type_list_len);
 - }
 diff --git a/package/network/services/hostapd/src/src/ap/ubus.c b/package/network/services/hostapd/src/src/ap/ubus.c
-index d03b848f94..07c366508c 100644
+index d03b848f94..09b25a29e5 100644
 --- a/package/network/services/hostapd/src/src/ap/ubus.c
 +++ b/package/network/services/hostapd/src/src/ap/ubus.c
 @@ -21,6 +21,7 @@
@@ -5733,7 +5770,7 @@ index d03b848f94..07c366508c 100644
  static const struct ubus_method daemon_methods[] = {
  	UBUS_METHOD("config_add", hostapd_config_add, config_add_policy),
  	UBUS_METHOD("config_remove", hostapd_config_remove, config_remove_policy),
-@@ -1550,3 +1734,24 @@ void hostapd_ubus_notify_beacon_report(
+@@ -1550,3 +1734,21 @@ void hostapd_ubus_notify_beacon_report(
  
  	ubus_notify(ctx, &hapd->ubus.obj, "beacon-report", b.head, -1);
  }
@@ -5744,9 +5781,6 @@ index d03b848f94..07c366508c 100644
 +	struct hostapd_data *hapd;
 +	int i;
 +
-+	if (!hapd->ubus.obj.has_subscribers)
-+		return;
-+
 +	blob_buf_init(&b, 0);
 +	blobmsg_add_u16(&b, "frequency", frequency);
 +	blobmsg_add_u16(&b, "width", chan_width);

backports/0041-ar71xx-hacks.patch

@@ -1,19 +1,20 @@
-From 26aedfa7e2aa5ab583c68638539d5fc173af173f Mon Sep 17 00:00:00 2001
+From d01d8c9e5cf7de98222860011d1d5b362bfde005 Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Mon, 12 Jul 2021 13:09:25 +0200
-Subject: [PATCH 36/37] ar71xx: hacks
+Subject: [PATCH 01/39] ar71xx: hacks
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
- package/kernel/linux/modules/crypto.mk | 2 +-
- package/kernel/mac80211/ath.mk         | 1 +
- 2 files changed, 2 insertions(+), 1 deletion(-)
+ package/kernel/linux/modules/crypto.mk                 | 2 +-
+ package/kernel/mac80211/ath.mk                         | 1 +
+ target/linux/ar71xx/files/arch/mips/ath79/mach-rb91x.c | 2 ++
+ 3 files changed, 4 insertions(+), 1 deletion(-)
 
 diff --git a/package/kernel/linux/modules/crypto.mk b/package/kernel/linux/modules/crypto.mk
-index c277c6b8ec..9bee6fd8a9 100644
+index 19b0d4696b..1b1c1e1a51 100644
 --- a/package/kernel/linux/modules/crypto.mk
 +++ b/package/kernel/linux/modules/crypto.mk
-@@ -885,7 +885,7 @@ define KernelPackage/crypto-sha256
+@@ -882,7 +882,7 @@ define KernelPackage/crypto-sha256
  	CONFIG_CRYPTO_SHA256_SSSE3
    FILES:= \
  	$(LINUX_DIR)/crypto/sha256_generic.ko \
@@ -34,6 +35,19 @@ index ba03ae11a6..ad2860a98e 100644
  config-$(CONFIG_TARGET_ipq40xx) += ATH10K_AHB
  config-$(CONFIG_PCI) += ATH9K_PCI
  config-$(CONFIG_ATH_USER_REGD) += ATH_USER_REGD ATH_REG_DYNAMIC_USER_REG_HINTS
+diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb91x.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb91x.c
+index 9620718962..2cdf97efd6 100644
+--- a/target/linux/ar71xx/files/arch/mips/ath79/mach-rb91x.c
++++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-rb91x.c
+@@ -271,6 +271,8 @@ static const struct rb_board_info rb711gr100_boards[] __initconst = {
+ 	RB_BOARD_INFO("911G-5HPnD", 0),
+ 	RB_BOARD_INFO("912UAG-2HPnD", RB91X_FLAG_USB | RB91X_FLAG_PCIE),
+ 	RB_BOARD_INFO("912UAG-5HPnD", RB91X_FLAG_USB | RB91X_FLAG_PCIE),
++	RB_BOARD_INFO("RB912UAG-2HPnD", RB91X_FLAG_USB | RB91X_FLAG_PCIE),
++	RB_BOARD_INFO("RB912UAG-5HPnD", RB91X_FLAG_USB | RB91X_FLAG_PCIE),
+ };
+ 
+ static u32 rb711gr100_get_flags(const struct rb_info *info)
 -- 
 2.25.1
 

backports/0100-procd-add-uxc-support.patch

@@ -0,0 +1,170 @@
+From 8897bab871fb43701fad786c94af5d1b1ef123ae Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Sun, 25 Jul 2021 13:32:37 +0200
+Subject: [PATCH 01/46] procd: add uxc support
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ package/system/procd/Makefile       | 12 ++---
+ package/system/procd/files/procd.sh | 79 +++++++++++++++++++++++++++++
+ package/system/procd/files/uxc.init |  4 ++
+ 3 files changed, 89 insertions(+), 6 deletions(-)
+
+diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
+index fff9faa1bf..98f1ed1775 100644
+--- a/package/system/procd/Makefile
++++ b/package/system/procd/Makefile
+@@ -12,9 +12,9 @@ PKG_RELEASE:=$(AUTORELEASE)
+ 
+ PKG_SOURCE_PROTO:=git
+ PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git
+-PKG_SOURCE_DATE:=2021-02-08
+-PKG_SOURCE_VERSION:=08938fe1cbc06eeaafa39448057368391d165272
+-PKG_MIRROR_HASH:=efc3deac56057e929789d44742858b2a16d976f6bfa0a2036e413d10afcaeee4
++PKG_SOURCE_DATE:=2021-08-15
++PKG_SOURCE_VERSION:=104b49d6ab25a8cf067e6d8d1f2da7defb9876d4
++PKG_MIRROR_HASH:=d13b566a14e84f6babe8b7d3dfb88e34c3dff0e97d7770d6fe71174685bca628
+ CMAKE_INSTALL:=1
+ 
+ PKG_LICENSE:=GPL-2.0
+@@ -32,7 +32,7 @@ include $(INCLUDE_DIR)/package.mk
+ include $(INCLUDE_DIR)/cmake.mk
+ 
+ ifeq ($(DUMP),)
+-  STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell echo $(CONFIG_TARGET_INIT_PATH) | mkhash md5)
++  STAMP_CONFIGURED:=$(strip $(STAMP_CONFIGURED))_$(shell echo $(CONFIG_TARGET_INIT_PATH) | $(MKHASH) md5)
+ endif
+ 
+ CMAKE_OPTIONS += -DEARLY_PATH="$(TARGET_INIT_PATH)"
+@@ -82,7 +82,7 @@ endef
+ define Package/procd-seccomp
+   SECTION:=base
+   CATEGORY:=Base system
+-  DEPENDS:=@(arm||armeb||mips||mipsel||i386||powerpc||x86_64) @!TARGET_uml \
++  DEPENDS:=@(aarch64||arm||armeb||mips||mipsel||i386||powerpc||x86_64) @!TARGET_uml \
+ 	  @KERNEL_SECCOMP +libubox +libblobmsg-json
+   TITLE:=OpenWrt process seccomp helper + utrace
+ endef
+@@ -90,7 +90,7 @@ endef
+ define Package/uxc
+   SECTION:=base
+   CATEGORY:=Base system
+-  DEPENDS:=+procd-ujail +libubus +libubox +libblobmsg-json
++  DEPENDS:=+procd-ujail +libubus +libubox +libblobmsg-json +blockd +rpcd
+   TITLE:=OpenWrt container management
+   MAINTAINER:=Daniel Golle <daniel@makrotopia.org>
+ endef
+diff --git a/package/system/procd/files/procd.sh b/package/system/procd/files/procd.sh
+index d86b7219da..3549a5a914 100644
+--- a/package/system/procd/files/procd.sh
++++ b/package/system/procd/files/procd.sh
+@@ -329,6 +329,82 @@ _procd_add_config_trigger() {
+ 	json_close_array
+ }
+ 
++_procd_add_mount_trigger() {
++	json_add_array
++	_procd_add_array_data "$1"
++	local action="$2"
++	local multi=0
++	shift ; shift
++
++	json_add_array
++	_procd_add_array_data "if"
++
++	if [ "$2" ]; then
++		json_add_array
++		_procd_add_array_data "or"
++		multi=1
++	fi
++
++	while [ "$1" ]; do
++		json_add_array
++		_procd_add_array_data "eq" "target" "$1"
++		shift
++		json_close_array
++	done
++
++	[ $multi = 1 ] && json_close_array
++
++	json_add_array
++	_procd_add_array_data "run_script" /etc/init.d/$name $action
++	json_close_array
++
++	json_close_array
++	_procd_add_timeout
++	json_close_array
++}
++
++_procd_add_action_mount_trigger() {
++	local script=$(readlink "$initscript")
++	local name=$(basename ${script:-$initscript})
++	local action="$1"
++	local mpath
++	shift
++
++	_procd_open_trigger
++	_procd_add_mount_trigger mount.add $action "$@"
++	_procd_close_trigger
++}
++
++procd_get_mountpoints() {
++	(
++		__procd_check_mount() {
++			local cfg="$1"
++			local path="${2%%/}/"
++			local target
++			config_get target "$cfg" target
++			target="${target%%/}/"
++			[ "$path" != "${path##$target}" ] && echo "${target%%/}"
++		}
++
++		config_load fstab
++		for mpath in "$@"; do
++			config_foreach __procd_check_mount mount "$mpath"
++		done
++	) | sort -u
++}
++
++_procd_add_restart_mount_trigger() {
++	local mountpoints="$(procd_get_mountpoints "$@")"
++	[ "${mountpoints//[[:space:]]}" ] &&
++		_procd_add_action_mount_trigger restart $mountpoints
++}
++
++_procd_add_reload_mount_trigger() {
++	local mountpoints="$(procd_get_mountpoints "$@")"
++	[ "${mountpoints//[[:space:]]}" ] &&
++		_procd_add_action_mount_trigger reload $mountpoints
++}
++
+ _procd_add_raw_trigger() {
+ 	json_add_array
+ 	_procd_add_array_data "$1"
+@@ -560,8 +636,11 @@ _procd_wrapper \
+ 	procd_add_raw_trigger \
+ 	procd_add_config_trigger \
+ 	procd_add_interface_trigger \
++	procd_add_mount_trigger \
+ 	procd_add_reload_trigger \
+ 	procd_add_reload_interface_trigger \
++	procd_add_reload_mount_trigger \
++	procd_add_restart_mount_trigger \
+ 	procd_open_trigger \
+ 	procd_close_trigger \
+ 	procd_open_instance \
+diff --git a/package/system/procd/files/uxc.init b/package/system/procd/files/uxc.init
+index 035c8b0b9e..1e75b796f8 100644
+--- a/package/system/procd/files/uxc.init
++++ b/package/system/procd/files/uxc.init
+@@ -16,3 +16,7 @@ boot() {
+ 	__BOOT_UXC=1
+ 	start
+ }
++
++service_triggers() {
++	procd_add_raw_trigger "mount.add" 3000 /etc/init.d/uxc boot
++}
+-- 
+2.25.1
+

backports/0101-build-create-APK-files-parrallel-to-IPK.patch

@@ -0,0 +1,174 @@
+From 0a31ac2bfc8aa43c2a5e43eac81c4647dbf2d1b7 Mon Sep 17 00:00:00 2001
+From: Paul Spooren <mail@aparcar.org>
+Date: Fri, 2 Oct 2020 23:30:30 -1000
+Subject: [PATCH 01/45] build: create APK files parrallel to IPK
+
+Create APK files based on the folder and control files of IPK packages.
+
+Signed-off-by: Paul Spooren <mail@aparcar.org>
+---
+ include/package-ipkg.mk     | 48 +++++++++++++++++++++++++------------
+ package/Makefile            |  2 ++
+ package/base-files/Makefile |  4 ++++
+ rules.mk                    |  2 ++
+ scripts/apk-make-index.sh   | 20 ++++++++++++++++
+ 5 files changed, 61 insertions(+), 15 deletions(-)
+ create mode 100755 scripts/apk-make-index.sh
+
+diff --git a/include/package-ipkg.mk b/include/package-ipkg.mk
+index c2017cd220..b0177070f8 100644
+--- a/include/package-ipkg.mk
++++ b/include/package-ipkg.mk
+@@ -102,6 +102,7 @@ ifeq ($(DUMP),)
+     ABIV_$(1):=$(if $(filter-out kmod-%,$(1)),$(ABI_VERSION))
+     PDIR_$(1):=$(call FeedPackageDir,$(1))
+     IPKG_$(1):=$$(PDIR_$(1))/$(1)$$(ABIV_$(1))_$(VERSION)_$(PKGARCH).ipk
++    APK_$(1):=$$(PDIR_$(1))/$(1)$$(ABIV_$(1))_$(VERSION)_$(PKGARCH).apk
+     IDIR_$(1):=$(PKG_BUILD_DIR)/ipkg-$(PKGARCH)/$(1)
+     KEEP_$(1):=$(strip $(call Package/$(1)/conffiles))
+ 
+@@ -200,7 +201,7 @@ $(_endef)
+     $(PKG_INFO_DIR)/$(1).provides $$(IPKG_$(1)): $(STAMP_BUILT) $(INCLUDE_DIR)/package-ipkg.mk
+ 	@rm -rf $$(IDIR_$(1)); \
+ 		$$(call remove_ipkg_files,$(1),$$(call opkg_package_files,$(call gen_ipkg_wildcard,$(1))))
+-	mkdir -p $(PACKAGE_DIR) $$(IDIR_$(1))/CONTROL $(PKG_INFO_DIR)
++	mkdir -p $(PACKAGE_DIR) $$(IDIR_$(1)) $(PKG_INFO_DIR)
+ 	$(call Package/$(1)/install,$$(IDIR_$(1)))
+ 	$(if $(Package/$(1)/install-overlay),mkdir -p $(PACKAGE_DIR) $$(IDIR_$(1))/rootfs-overlay)
+ 	$(call Package/$(1)/install-overlay,$$(IDIR_$(1))/rootfs-overlay)
+@@ -226,6 +227,37 @@ $(_endef)
+ 		) || true \
+ 	)
+     endif
++
++    ifneq ($$(KEEP_$(1)),)
++		@( \
++			keepfiles=""; \
++			for x in $$(KEEP_$(1)); do \
++				[ -f "$$(IDIR_$(1))/$$$$x" ] || keepfiles="$$$${keepfiles:+$$$$keepfiles }$$$$x"; \
++			done; \
++			[ -z "$$$$keepfiles" ] || { \
++				mkdir -p $$(IDIR_$(1))/lib/upgrade/keep.d; \
++				for x in $$$$keepfiles; do echo $$$$x >> $$(IDIR_$(1))/lib/upgrade/keep.d/$(1); done; \
++			}; \
++		)
++    endif
++
++	$(INSTALL_DIR) $$(PDIR_$(1))
++
++	$(FAKEROOT) apk mkpkg \
++	  --info "name:$(1)" \
++	  --info "version:$(VERSION)" \
++	  --info "description:$()" \
++	  --info "arch:$(PKGARCH)" \
++	  --info "license:$(LICENSE)" \
++	  --info "origin:$(SOURCE)" \
++	  --info "maintainer:$(MAINTAINER)" \
++	  $$(foreach dep,$$(Package/$(1)/DEPENDS),--info "depends:$$(subst $$(comma),,$$(dep))") \
++	  --files "$$(IDIR_$(1))" \
++	  --output "$$(APK_$(1))" \
++	  --sign "$(BUILD_KEY_APK_SEC)"
++
++	mkdir -p $$(IDIR_$(1))/CONTROL
++
+ 	(cd $$(IDIR_$(1))/CONTROL; \
+ 		( \
+ 			echo "$$$$CONTROL"; \
+@@ -249,20 +281,6 @@ $(_endef)
+ 		$($(1)_COMMANDS) \
+ 	)
+ 
+-    ifneq ($$(KEEP_$(1)),)
+-		@( \
+-			keepfiles=""; \
+-			for x in $$(KEEP_$(1)); do \
+-				[ -f "$$(IDIR_$(1))/$$$$x" ] || keepfiles="$$$${keepfiles:+$$$$keepfiles }$$$$x"; \
+-			done; \
+-			[ -z "$$$$keepfiles" ] || { \
+-				mkdir -p $$(IDIR_$(1))/lib/upgrade/keep.d; \
+-				for x in $$$$keepfiles; do echo $$$$x >> $$(IDIR_$(1))/lib/upgrade/keep.d/$(1); done; \
+-			}; \
+-		)
+-    endif
+-
+-	$(INSTALL_DIR) $$(PDIR_$(1))
+ 	$(FAKEROOT) $(SCRIPT_DIR)/ipkg-build -m "$(FILE_MODES)" $$(IDIR_$(1)) $$(PDIR_$(1))
+ 	@[ -f $$(IPKG_$(1)) ]
+ 
+diff --git a/package/Makefile b/package/Makefile
+index ec503dc527..18a19fff13 100644
+--- a/package/Makefile
++++ b/package/Makefile
+@@ -60,6 +60,7 @@ $(curdir)/merge-index: $(curdir)/merge
+ 
+ ifndef SDK
+   $(curdir)/compile: $(curdir)/system/opkg/host/compile
++  $(patsubst %,$(curdir)/%/compile,$(filter-out %/apk/host,$($(curdir)/builddirs))): $(curdir)/system/apk/host/compile
+ endif
+ 
+ $(curdir)/install: $(TMP_DIR)/.build $(curdir)/merge $(if $(CONFIG_TARGET_PER_DEVICE_ROOTFS),$(curdir)/merge-index)
+@@ -84,6 +85,7 @@ $(curdir)/index: FORCE
+ 	@for d in $(PACKAGE_SUBDIRS); do ( \
+ 		mkdir -p $$d; \
+ 		cd $$d || continue; \
++		$(SCRIPT_DIR)/apk-make-index.sh . 2>&1; \
+ 		$(SCRIPT_DIR)/ipkg-make-index.sh . 2>&1 > Packages.manifest; \
+ 		grep -vE '^(Maintainer|LicenseFiles|Source|SourceName|Require|SourceDateEpoch)' Packages.manifest > Packages; \
+ 		case "$$(((64 + $$(stat -L -c%s Packages)) % 128))" in 110|111) \
+diff --git a/package/base-files/Makefile b/package/base-files/Makefile
+index 8a1ddf96f5..9db4812981 100644
+--- a/package/base-files/Makefile
++++ b/package/base-files/Makefile
+@@ -107,6 +107,10 @@ ifdef CONFIG_SIGNED_PACKAGES
+ 	[ -s $(BUILD_KEY).ucert ] || \
+ 		$(STAGING_DIR_HOST)/bin/ucert -I -c $(BUILD_KEY).ucert -p $(BUILD_KEY).pub -s $(BUILD_KEY)
+ 
++	[ -s $(BUILD_KEY_APK_SEC) -a -s $(BUILD_KEY_APK_PUB) ] || \
++		openssl ecparam -name prime256v1 -genkey -noout -out $(BUILD_KEY_APK_SEC); \
++		openssl ec -in $(BUILD_KEY_APK_SEC) -pubout > $(BUILD_KEY_APK_PUB)
++
+   endef
+ 
+ ifndef CONFIG_BUILDBOT
+diff --git a/rules.mk b/rules.mk
+index f31d9bb113..de81b65d46 100644
+--- a/rules.mk
++++ b/rules.mk
+@@ -258,6 +258,8 @@ else
+ endif
+ 
+ BUILD_KEY=$(TOPDIR)/key-build
++BUILD_KEY_APK_SEC=$(TOPDIR)/private-key.pem
++BUILD_KEY_APK_PUB=$(TOPDIR)/public-key.pem
+ 
+ FAKEROOT:=$(STAGING_DIR_HOST)/bin/fakeroot
+ 
+diff --git a/scripts/apk-make-index.sh b/scripts/apk-make-index.sh
+new file mode 100755
+index 0000000000..df1f1a2e2b
+--- /dev/null
++++ b/scripts/apk-make-index.sh
+@@ -0,0 +1,20 @@
++#!/usr/bin/env bash
++set -e
++
++pkg_dir=$1
++
++if [ -z "$pkg_dir" ] || [ ! -d "$pkg_dir" ]; then
++	echo "Usage: apk-make-index <package_directory>" >&2
++	exit 1
++fi
++
++(
++	cd "$pkg_dir" || exit 1
++	GLOBIGNORE="kernel*:libc*"
++	set -- *.apk
++	if [ "$1" = '*.apk' ]; then
++		echo "No APK packages found"
++	fi
++	apk index --output APKINDEX.tar.gz "$@"
++	unset GLOBIGNORE
++)
+-- 
+2.25.1
+

backports/0102-fstools-update-to-git-HEAD.patch

@@ -0,0 +1,69 @@
+From 2239c3c87a723bee8efa64ecf22c61a15433517e Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sun, 25 Jul 2021 01:20:31 +0100
+Subject: [PATCH 102/146] fstools: update to git HEAD
+
+ bad1835 fstools: add partname volume driver
+ 19d7d93 libfstools: partname: several fixes
+ 3c38f0c libfstools: fix build with glibc
+ d05ad93 libfstools: remove superflus include
+ 964d1e3 partname: allow skipping existing 'rootfs_data' partition
+ c44b40b overlay: fix syncronizing typo
+ b5397a1 fstools: block: fix segfault on mount with no target
+ bd7cc8d block: use dynamically allocated target string
+ 6d8450e blockd: use allocated strings instead of fixed buffers
+ d47909e libblkid-tiny: fix buffer overflow
+ 67d2297 block: match device path instead of assuming /dev/%s
+ 2aeba88 block: allow autofs and umount commands also on MTD/UBI
+ 3d40a1b blockd: add missing #define _GNU_SOURCE
+ 4d4dcfb blockd: detect mountpoint of /dev/mapper/*
+ 2f42515 block: resolve /dev/mapper/* name for /dev/dm-0 when hotplugging
+ 39558a1 blockd: also send ubus notification on mount hotplug
+ 3386b6b blockd: fix trigger name
+ cdc9939 blockd: move to its own POSIX process group
+ 59f7c11 blockd: create mountpoint parent folder if needed
+ 9cc96af Revert "block: resolve /dev/mapper/* name for /dev/dm-0 when hotplugging"
+ 06334ac Revert "blockd: detect mountpoint of /dev/mapper/*"
+ 9ab3551 block: use /dev/dm-* instead of /dev/mapper/*
+ 5114595 block: allow remove hotplug event to arrive at blockd
+ a846c6b blockd: fix length of timeout int passed to ioctl
+ 1d681ca block: support umount device basename
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ package/system/fstools/Makefile          | 6 +++---
+ package/system/fstools/files/blockd.init | 1 +
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/package/system/fstools/Makefile b/package/system/fstools/Makefile
+index 2da508d541..b582a17bae 100644
+--- a/package/system/fstools/Makefile
++++ b/package/system/fstools/Makefile
+@@ -12,9 +12,9 @@ PKG_RELEASE:=1
+ 
+ PKG_SOURCE_PROTO:=git
+ PKG_SOURCE_URL=$(PROJECT_GIT)/project/fstools.git
+-PKG_MIRROR_HASH:=a485792d90c71cd4fb396ce97f42a57ee4d2a3d78e5f3fd0748270ffb14209e6
+-PKG_SOURCE_DATE:=2021-01-04
+-PKG_SOURCE_VERSION:=c53b18820756f6f32ad0782d3bf489422b7c4ad3
++PKG_MIRROR_HASH:=6a457b812166e04e2244ee1be92a4957666b5d1554315c0e18db1b30376cc617
++PKG_SOURCE_DATE:=2021-07-28
++PKG_SOURCE_VERSION:=cc63933faedd8d4fcdabb872cf4661ac04fe4ba2
+ CMAKE_INSTALL:=1
+ 
+ PKG_LICENSE:=GPL-2.0
+diff --git a/package/system/fstools/files/blockd.init b/package/system/fstools/files/blockd.init
+index a4ce57d40d..bdd8bbf622 100755
+--- a/package/system/fstools/files/blockd.init
++++ b/package/system/fstools/files/blockd.init
+@@ -16,6 +16,7 @@ reload_service() {
+ start_service() {
+ 	procd_open_instance
+ 	procd_set_param command "$PROG"
++	procd_set_param watch block
+ 	procd_set_param respawn
+ 	procd_close_instance
+ }
+-- 
+2.25.1
+

backports/0103-tools-libressl-update-to-3.3.3.patch

@@ -0,0 +1,40 @@
+From c40bb49f31443d9c03043c4361e4af56e5c3eba4 Mon Sep 17 00:00:00 2001
+From: Rosen Penev <rosenp@gmail.com>
+Date: Sat, 19 Jun 2021 14:45:11 -0700
+Subject: [PATCH 103/146] tools/libressl: update to 3.3.3
+
+Fix wrong FPIC variable usage. Fixes compilation under sparc64 host.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+(cherry picked from commit bf4dbbb55e2b8e23f186e1334f1e9ce6a3a8ddfe)
+---
+ tools/libressl/Makefile | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/tools/libressl/Makefile b/tools/libressl/Makefile
+index 2b5a33450c..e25b5661ee 100644
+--- a/tools/libressl/Makefile
++++ b/tools/libressl/Makefile
+@@ -8,8 +8,8 @@
+ include $(TOPDIR)/rules.mk
+ 
+ PKG_NAME:=libressl
+-PKG_VERSION:=3.3.1
+-PKG_HASH:=a6d331865e0164a13ac85a228e52517f7cf8f8488f2f95f34e7857302f97cfdb
++PKG_VERSION:=3.3.3
++PKG_HASH:=a471565b36ccd1a70d0bd7d37c6e95c43a26a62829b487d9d2cdebfe58be3066
+ PKG_RELEASE:=1
+ 
+ PKG_CPE_ID:=cpe:/a:openbsd:libressl
+@@ -25,7 +25,7 @@ include $(INCLUDE_DIR)/host-build.mk
+ 
+ HOSTCC := $(HOSTCC_NOCACHE)
+ HOST_CONFIGURE_ARGS += --enable-static --disable-shared --disable-tests
+-HOST_CFLAGS += $(FPIC)
++HOST_CFLAGS += $(HOST_FPIC)
+ 
+ ifeq ($(GNU_HOST_NAME),x86_64-linux-gnux32)
+ HOST_CONFIGURE_ARGS += --disable-asm
+-- 
+2.25.1
+

backports/0105-apk-backport-package.patch

@@ -0,0 +1,312 @@
+From 6741963067c4be8999896a5e653dc0d72487e392 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Fri, 13 Aug 2021 08:47:11 +0200
+Subject: [PATCH 06/46] apk: backport package
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ package/system/apk/Makefile                   | 93 +++++++++++++++++++
+ ...vel@lists.alpinelinux.org-4a6a0840.rsa.pub |  9 ++
+ ...vel@lists.alpinelinux.org-5243ef4b.rsa.pub |  9 ++
+ ...vel@lists.alpinelinux.org-5261cecb.rsa.pub |  9 ++
+ package/system/apk/files/alpine-repositories  |  3 +
+ .../apk/patches/000-Makefile-version.patch    | 11 +++
+ .../patches/0001-remove-doc-generation.patch  | 21 +++++
+ package/system/apk/patches/100-link.patch     | 16 ++++
+ package/system/apk/patches/100-phtread.patch  | 12 +++
+ ...ude-limits.h-to-fix-build-with-glibc.patch | 20 ++++
+ package/system/apk/test.sh                    |  9 ++
+ 11 files changed, 212 insertions(+)
+ create mode 100644 package/system/apk/Makefile
+ create mode 100644 package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
+ create mode 100644 package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub
+ create mode 100644 package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub
+ create mode 100644 package/system/apk/files/alpine-repositories
+ create mode 100644 package/system/apk/patches/000-Makefile-version.patch
+ create mode 100644 package/system/apk/patches/0001-remove-doc-generation.patch
+ create mode 100644 package/system/apk/patches/100-link.patch
+ create mode 100644 package/system/apk/patches/100-phtread.patch
+ create mode 100644 package/system/apk/patches/100-tar-include-limits.h-to-fix-build-with-glibc.patch
+ create mode 100644 package/system/apk/test.sh
+
+diff --git a/package/system/apk/Makefile b/package/system/apk/Makefile
+new file mode 100644
+index 0000000000..335f50c155
+--- /dev/null
++++ b/package/system/apk/Makefile
+@@ -0,0 +1,93 @@
++include $(TOPDIR)/rules.mk
++
++PKG_NAME:=apk
++PKG_VERSION:=3.0.0_pre0
++
++PKG_SOURCE_PROTO:=git
++PKG_SOURCE_URL:=https://git.alpinelinux.org/apk-tools.git
++PKG_SOURCE_DATE:=2021-08-17
++PKG_SOURCE_VERSION:=a46043bcc4cc15b456ef1eac5c5f9d93bd905d53
++PKG_MIRROR_HASH:=e16fd04b18043e78a177acd8c6958fa03fd1484b62c879c2dd0bed8ce9c50625
++PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_SOURCE_DATE)-$(call version_abbrev,$(PKG_SOURCE_VERSION))
++PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_SOURCE_SUBDIR)
++HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/$(PKG_SOURCE_SUBDIR)
++PKG_SOURCE:=$(PKG_SOURCE_SUBDIR).tar.xz
++PKG_RELEASE:=r$(PKG_SOURCE_DATE)-$(call version_abbrev,$(PKG_SOURCE_VERSION))-$(AUTORELEASE)
++
++PKG_MAINTAINER:=Paul Spooren <mail@aparcar.org>
++PKG_LICENSE:=GPL-2.0-only
++PKG_LICENSE_FILES:=LICENSE
++
++PKG_INSTALL:=1
++PKG_BUILD_PARALLEL:=1
++
++HOST_BUILD_DEPENDS:=lua/host lua-lzlib/host
++PKG_BUILD_DEPENDS:=$(HOST_BUILD_DEPENDS)
++
++include $(INCLUDE_DIR)/package.mk
++include $(INCLUDE_DIR)/host-build.mk
++
++define Package/apk
++  SECTION:=utils
++  CATEGORY:=Utilities
++  TITLE:=apk package manager
++  DEPENDS:=+liblua +libopenssl +zlib @!arc
++  URL:=$(PKG_SOURCE_URL)
++endef
++
++define Package/alpine-keys
++  SECTION:=utils
++  CATEGORY:=Utilities
++  TITLE:=Alpine apk public signing keys
++  DEPENDS:=apk
++endef
++
++define Package/alpine-repositories
++  SECTION:=utils
++  CATEGORY:=Utilities
++  TITLE:=Official Alpine repositories
++  DEPENDS:=apk
++endef
++
++MAKE_FLAGS += \
++	LUA=$(STAGING_DIR_HOSTPKG)/bin/lua \
++	LUA_VERSION=5.1 \
++	LUA_PC=lua
++
++HOST_MAKE_FLAGS += \
++	LUA=$(STAGING_DIR_HOSTPKG)/bin/lua \
++	LUA_VERSION=5.1 \
++	DESTDIR=$(STAGING_DIR_HOSTPKG) \
++	SBINDIR=/bin \
++	PREFIX=
++
++HOST_LDFLAGS+=-Wl,-rpath=$(STAGING_DIR_HOSTPKG)/lib -lpthread
++
++define Package/apk/install
++	$(INSTALL_DIR) $(1)/lib/apk/db
++
++	$(INSTALL_DIR) $(1)/bin
++	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/sbin/apk $(1)/bin/apk
++
++	$(INSTALL_DIR) $(1)/usr/lib
++	$(CP) $(PKG_INSTALL_DIR)/lib/*.so.* $(1)/usr/lib/
++
++	$(INSTALL_DIR) $(1)/etc/apk/
++	echo $(ARCH) > $(1)/etc/apk/arch
++	touch $(1)/etc/apk/world
++endef
++
++define Package/alpine-keys/install
++	$(INSTALL_DIR) $(1)/etc/apk/keys
++	$(INSTALL_DATA) ./files/alpine-keys/* $(1)/etc/apk/keys
++endef
++
++define Package/alpine-repositories/install
++	$(INSTALL_DIR) $(1)/etc/apk/keys
++	$(INSTALL_DATA) ./files/alpine-repositories $(1)/etc/apk/repositories
++endef
++
++$(eval $(call BuildPackage,apk))
++$(eval $(call BuildPackage,alpine-keys))
++$(eval $(call BuildPackage,alpine-repositories))
++$(eval $(call HostBuild))
+diff --git a/package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub b/package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
+new file mode 100644
+index 0000000000..bb4bdc80fd
+--- /dev/null
++++ b/package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-4a6a0840.rsa.pub
+@@ -0,0 +1,9 @@
++-----BEGIN PUBLIC KEY-----
++MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1yHJxQgsHQREclQu4Ohe
++qxTxd1tHcNnvnQTu/UrTky8wWvgXT+jpveroeWWnzmsYlDI93eLI2ORakxb3gA2O
++Q0Ry4ws8vhaxLQGC74uQR5+/yYrLuTKydFzuPaS1dK19qJPXB8GMdmFOijnXX4SA
++jixuHLe1WW7kZVtjL7nufvpXkWBGjsfrvskdNA/5MfxAeBbqPgaq0QMEfxMAn6/R
++L5kNepi/Vr4S39Xvf2DzWkTLEK8pcnjNkt9/aafhWqFVW7m3HCAII6h/qlQNQKSo
++GuH34Q8GsFG30izUENV9avY7hSLq7nggsvknlNBZtFUcmGoQrtx3FmyYsIC8/R+B
++ywIDAQAB
++-----END PUBLIC KEY-----
+diff --git a/package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub b/package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub
+new file mode 100644
+index 0000000000..6cbfad7441
+--- /dev/null
++++ b/package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-5243ef4b.rsa.pub
+@@ -0,0 +1,9 @@
++-----BEGIN PUBLIC KEY-----
++MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvNijDxJ8kloskKQpJdx+
++mTMVFFUGDoDCbulnhZMJoKNkSuZOzBoFC94omYPtxnIcBdWBGnrm6ncbKRlR+6oy
++DO0W7c44uHKCFGFqBhDasdI4RCYP+fcIX/lyMh6MLbOxqS22TwSLhCVjTyJeeH7K
++aA7vqk+QSsF4TGbYzQDDpg7+6aAcNzg6InNePaywA6hbT0JXbxnDWsB+2/LLSF2G
++mnhJlJrWB1WGjkz23ONIWk85W4S0XB/ewDefd4Ly/zyIciastA7Zqnh7p3Ody6Q0
++sS2MJzo7p3os1smGjUF158s6m/JbVh4DN6YIsxwl2OjDOz9R0OycfJSDaBVIGZzg
++cQIDAQAB
++-----END PUBLIC KEY-----
+diff --git a/package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub b/package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub
+new file mode 100644
+index 0000000000..83f0658e9c
+--- /dev/null
++++ b/package/system/apk/files/alpine-keys/alpine-devel@lists.alpinelinux.org-5261cecb.rsa.pub
+@@ -0,0 +1,9 @@
++-----BEGIN PUBLIC KEY-----
++MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwlzMkl7b5PBdfMzGdCT0
++cGloRr5xGgVmsdq5EtJvFkFAiN8Ac9MCFy/vAFmS8/7ZaGOXoCDWbYVLTLOO2qtX
++yHRl+7fJVh2N6qrDDFPmdgCi8NaE+3rITWXGrrQ1spJ0B6HIzTDNEjRKnD4xyg4j
++g01FMcJTU6E+V2JBY45CKN9dWr1JDM/nei/Pf0byBJlMp/mSSfjodykmz4Oe13xB
++Ca1WTwgFykKYthoLGYrmo+LKIGpMoeEbY1kuUe04UiDe47l6Oggwnl+8XD1MeRWY
++sWgj8sF4dTcSfCMavK4zHRFFQbGp/YFJ/Ww6U9lA3Vq0wyEI6MCMQnoSMFwrbgZw
++wwIDAQAB
++-----END PUBLIC KEY-----
+diff --git a/package/system/apk/files/alpine-repositories b/package/system/apk/files/alpine-repositories
+new file mode 100644
+index 0000000000..5babbb23b4
+--- /dev/null
++++ b/package/system/apk/files/alpine-repositories
+@@ -0,0 +1,3 @@
++https://dl-cdn.alpinelinux.org/alpine/edge/main
++https://dl-cdn.alpinelinux.org/alpine/edge/community
++
+diff --git a/package/system/apk/patches/000-Makefile-version.patch b/package/system/apk/patches/000-Makefile-version.patch
+new file mode 100644
+index 0000000000..2e7f5b0f15
+--- /dev/null
++++ b/package/system/apk/patches/000-Makefile-version.patch
+@@ -0,0 +1,11 @@
++--- a/Makefile
+++++ b/Makefile
++@@ -4,7 +4,7 @@
++ -include config.mk
++ 
++ PACKAGE := apk-tools
++-VERSION := 2.12.0
+++VERSION := 3.0.0_pre0
++ 
++ export VERSION
++ 
+diff --git a/package/system/apk/patches/0001-remove-doc-generation.patch b/package/system/apk/patches/0001-remove-doc-generation.patch
+new file mode 100644
+index 0000000000..dee05c56f2
+--- /dev/null
++++ b/package/system/apk/patches/0001-remove-doc-generation.patch
+@@ -0,0 +1,21 @@
++From b05a93c48fdbb50f0c464310dc2ce45777d32ea2 Mon Sep 17 00:00:00 2001
++From: Paul Spooren <mail@aparcar.org>
++Date: Fri, 2 Oct 2020 14:08:52 -1000
++Subject: [PATCH] remove doc generation
++
++Signed-off-by: Paul Spooren <mail@aparcar.org>
++---
++ Makefile | 2 +-
++ 1 file changed, 1 insertion(+), 1 deletion(-)
++
++--- a/Makefile
+++++ b/Makefile
++@@ -25,7 +25,7 @@ export DESTDIR SBINDIR LIBDIR CONFDIR MA
++ ##
++ # Top-level subdirs
++ 
++-subdirs		:= libfetch/ src/ doc/
+++subdirs		:= libfetch/ src/
++ 
++ ##
++ # Include all rules and stuff
+diff --git a/package/system/apk/patches/100-link.patch b/package/system/apk/patches/100-link.patch
+new file mode 100644
+index 0000000000..9cae2787d9
+--- /dev/null
++++ b/package/system/apk/patches/100-link.patch
+@@ -0,0 +1,16 @@
++diff -urN apk-2021-08-17-a46043bc.orig/src/Makefile apk-2021-08-17-a46043bc/src/Makefile
++--- apk-2021-08-17-a46043bc.orig/src/Makefile	2021-08-17 14:21:04.117760513 +0200
+++++ apk-2021-08-17-a46043bc/src/Makefile	2021-08-17 14:21:16.653830180 +0200
++@@ -65,7 +65,11 @@
++ 	app_convdb.o app_convndx.o app_del.o app_dot.o app_extract.o app_fetch.o \
++ 	app_fix.o app_index.o app_info.o app_list.o app_manifest.o app_mkndx.o \
++ 	app_mkpkg.o app_policy.o app_update.o app_upgrade.o app_search.o \
++-	app_stats.o app_verify.o app_version.o app_vertest.o applet.o
+++	app_stats.o app_verify.o app_version.o app_vertest.o applet.o \
+++	adb.o adb_comp.o adb_walk_adb.o adb_walk_genadb.o adb_walk_gentext.o adb_walk_text.o apk_adb.o \
+++	atom.o blob.o commit.o common.o context.o crypto_openssl.o database.o hash.o \
+++	extract.o extract_v2.o extract_v3.o io.o io_gunzip.o io_url.o tar.o \
+++	package.o pathbuilder.o print.o solver.o trust.o version.o
++ 
++ ifeq ($(ADB),y)
++ libapk.so.$(libapk_soname)-objs += apk_adb.o
+diff --git a/package/system/apk/patches/100-phtread.patch b/package/system/apk/patches/100-phtread.patch
+new file mode 100644
+index 0000000000..c252e14dc1
+--- /dev/null
++++ b/package/system/apk/patches/100-phtread.patch
+@@ -0,0 +1,12 @@
++diff -urN apk-2021-07-23-3d203e8f.orig/src/Makefile apk-2021-07-23-3d203e8f/src/Makefile
++--- apk-2021-07-23-3d203e8f.orig/src/Makefile	2021-07-25 12:55:05.576564663 +0200
+++++ apk-2021-07-23-3d203e8f/src/Makefile	2021-07-25 12:55:48.660862181 +0200
++@@ -87,7 +87,7 @@
++ apk.static-libs		:= $(apk-static-libs)
++ LDFLAGS_apk.static	:= -static
++ LIBS_apk.static		:= -Wl,--as-needed -ldl -Wl,--no-as-needed
++-LDFLAGS_apk		+= -L$(obj)
+++LDFLAGS_apk		+= -L$(obj) -pthread
++ LDFLAGS_apk-test	+= -L$(obj)
++ 
++ CFLAGS_ALL		+= $(OPENSSL_CFLAGS) $(ZLIB_CFLAGS)
+diff --git a/package/system/apk/patches/100-tar-include-limits.h-to-fix-build-with-glibc.patch b/package/system/apk/patches/100-tar-include-limits.h-to-fix-build-with-glibc.patch
+new file mode 100644
+index 0000000000..43ec7d5f1a
+--- /dev/null
++++ b/package/system/apk/patches/100-tar-include-limits.h-to-fix-build-with-glibc.patch
+@@ -0,0 +1,20 @@
++From c72ea983e287ec1d8b1f2b3aab1bf40aa7a30b03 Mon Sep 17 00:00:00 2001
++From: Daniel Golle <daniel@makrotopia.org>
++Date: Wed, 4 Aug 2021 21:37:40 +0100
++Subject: [PATCH] tar: include <limits.h> to fix build with glibc
++
++Signed-off-by: Daniel Golle <daniel@makrotopia.org>
++---
++ src/tar.c | 1 +
++ 1 file changed, 1 insertion(+)
++
++--- a/src/tar.c
+++++ b/src/tar.c
++@@ -9,6 +9,7 @@
++ 
++ #include <sys/stat.h>
++ #include <sys/sysmacros.h>
+++#include <limits.h> /* for SSIZE_MAX with glibc */
++ 
++ #include "apk_defines.h"
++ #include "apk_tar.h"
+diff --git a/package/system/apk/test.sh b/package/system/apk/test.sh
+new file mode 100644
+index 0000000000..814777fd70
+--- /dev/null
++++ b/package/system/apk/test.sh
+@@ -0,0 +1,9 @@
++#!/bin/sh
++
++case "$1" in
++    "apk")
++        apk --version | grep "${2/-r*/}"
++        ;;
++    *)
++        return 0;
++esac
+-- 
+2.25.1
+

backports/0106-lua-lzlib-backport-package.patch

@@ -0,0 +1,104 @@
+From 900d18f3ae2cd5bb3d8d6e2584d2280cb5302e01 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Fri, 13 Aug 2021 08:48:02 +0200
+Subject: [PATCH 106/146] lua-lzlib: backport package
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ package/libs/lua-lzlib/Makefile               | 64 +++++++++++++++++++
+ .../patches/001-allow_optim_flags.patch       | 12 ++++
+ 2 files changed, 76 insertions(+)
+ create mode 100644 package/libs/lua-lzlib/Makefile
+ create mode 100644 package/libs/lua-lzlib/patches/001-allow_optim_flags.patch
+
+diff --git a/package/libs/lua-lzlib/Makefile b/package/libs/lua-lzlib/Makefile
+new file mode 100644
+index 0000000000..5e0a16b135
+--- /dev/null
++++ b/package/libs/lua-lzlib/Makefile
+@@ -0,0 +1,64 @@
++#
++# Copyright (C) 2015 OpenWrt.org
++#
++# This is free software, licensed under the GNU General Public License v2.
++# See /LICENSE for more information.
++#
++
++include $(TOPDIR)/rules.mk
++
++PKG_NAME:=lua-lzlib
++PKG_VERSION:=0.4.3
++PKG_RELEASE:=1
++PKG_MAINTAINER:=Dirk Chang <dirk@kooiot.com>
++PKG_LICENSE:=MIT
++
++PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
++PKG_MIRROR_HASH:=b6ef5e3f04b7f2137b39931a175ee802489a2486e70537770919bcccca10e723
++PKG_SOURCE_URL:=https://github.com/LuaDist/lzlib.git
++PKG_SOURCE_PROTO:=git
++PKG_SOURCE_VERSION:=79329a07d8f79c19eadd7ea2752b4c4e1574b015
++PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
++
++HOST_BUILD_DEPENDS:=lua/host
++
++include $(INCLUDE_DIR)/package.mk
++include $(INCLUDE_DIR)/host-build.mk
++
++define Package/lua-lzlib
++  SUBMENU:=Lua
++  SECTION:=lang
++  CATEGORY:=Languages
++  TITLE:=Lua zlib binding
++  URL:=http://github.com/LuaDist/lzlib
++  DEPENDS:= +lua +zlib
++endef
++
++define Package/lua-lzlib/description
++	A library to access zlib library functions and also to read/write gzip files using an interface similar to the base io package. 
++endef
++
++MAKE_FLAGS += \
++	LUA="$(STAGING_DIR)/usr" \
++	OFLAGS="$(TARGET_CFLAGS)" \
++
++HOST_MAKE_FLAGS += \
++	LUA="$(STAGING_DIR_HOSTPKG)" \
++	OFLAGS="$(HOST_CFLAGS)" \
++
++define Package/lua-lzlib/install
++	$(INSTALL_DIR) $(1)/usr/lib/lua
++	$(INSTALL_BIN) $(PKG_BUILD_DIR)/zlib.so $(1)/usr/lib/lua/
++
++	$(INSTALL_DATA) $(PKG_BUILD_DIR)/gzip.lua $(1)/usr/lib/lua/
++endef
++
++define Host/Install
++	$(INSTALL_DIR) $(STAGING_DIR_HOSTPKG)/lib/lua/5.1
++	$(INSTALL_BIN) $(HOST_BUILD_DIR)/zlib.so $(STAGING_DIR_HOSTPKG)/lib/lua/5.1
++
++	$(INSTALL_DATA) $(HOST_BUILD_DIR)/gzip.lua $(STAGING_DIR_HOSTPKG)/lib/lua/5.1
++endef
++
++$(eval $(call BuildPackage,lua-lzlib))
++$(eval $(call HostBuild))
+diff --git a/package/libs/lua-lzlib/patches/001-allow_optim_flags.patch b/package/libs/lua-lzlib/patches/001-allow_optim_flags.patch
+new file mode 100644
+index 0000000000..78f981d237
+--- /dev/null
++++ b/package/libs/lua-lzlib/patches/001-allow_optim_flags.patch
+@@ -0,0 +1,12 @@
++--- a/Makefile
+++++ b/Makefile
++@@ -14,7 +14,8 @@ LUABIN= $(LUA)/bin
++ ZLIB=../zlib-1.2.3
++ 
++ # no need to change anything below here
++-CFLAGS= $(INCS) $(DEFS) $(WARN) -O0 -fPIC
+++CFLAGS= $(INCS) $(DEFS) $(WARN) $(OFLAGS) -fPIC
+++OFLAGS= -O0
++ WARN= -g -Werror -Wall -pedantic #-ansi
++ INCS= -I$(LUAINC) -I$(ZLIB)
++ LIBS= -L$(ZLIB) -lz -L$(LUALIB) -L$(LUABIN) #-llua51
+-- 
+2.25.1
+

backports/0107-lua-make-it-easier-to-detect-host-built-Lua.patch

@@ -0,0 +1,35 @@
+From 5c8a575ec759105e63a3aad033289d124516ec69 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 10 Jul 2021 20:21:26 +0100
+Subject: [PATCH 107/146] lua: make it easier to detect host-built Lua
+
+Install pkg-config file also for host-build, clean up Lua symlinks.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+(cherry picked from commit 315f52e0f3bfa3d65ad14ca21a696c6d31c4edcd)
+---
+ package/utils/lua/Makefile | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/package/utils/lua/Makefile b/package/utils/lua/Makefile
+index a54ef7d25a..be18880cb1 100644
+--- a/package/utils/lua/Makefile
++++ b/package/utils/lua/Makefile
+@@ -134,8 +134,12 @@ define Host/Install
+ 		INSTALL_TOP="$(STAGING_DIR_HOSTPKG)" \
+ 		install
+ 
+-	$(LN) $(STAGING_DIR_HOSTPKG)/bin/lua5.1 $(STAGING_DIR_HOSTPKG)/bin/lua
+-	$(LN) $(STAGING_DIR_HOSTPKG)/bin/luac5.1 $(STAGING_DIR_HOSTPKG)/bin/luac
++	$(INSTALL_DIR) $(STAGING_DIR_HOSTPKG)/lib/pkgconfig
++	$(CP) $(HOST_BUILD_DIR)/etc/lua.pc $(STAGING_DIR_HOSTPKG)/lib/pkgconfig/lua5.1.pc
++
++	$(LN) lua5.1 $(STAGING_DIR_HOSTPKG)/bin/lua
++	$(LN) luac5.1 $(STAGING_DIR_HOSTPKG)/bin/luac
++	$(LN) lua5.1.pc $(STAGING_DIR_HOSTPKG)/lib/pkgconfig/lua.pc
+ endef
+ 
+ define Build/InstallDev
+-- 
+2.25.1
+

feeds/facebook/fbwifi/Makefile

@@ -0,0 +1,56 @@
+# Copyright (c) Facebook, Inc. and its affiliates.
+# All rights reserved.
+#
+# This source code is licensed under the license found in the
+# LICENSE file in the root directory of this source tree.
+#
+
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=fbwifi
+PKG_VERSION:=2
+PKG_RELEASE:=0
+PKG_LICENSE:=GPL-2.0
+
+PKG_MAINTAINER:=Simon Kinane <skinane@fb.com>
+
+PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/fbwifi
+  SUBMENU:=Captive Portals
+  SECTION:=net
+  CATEGORY:=Network
+  DEPENDS:=+iptables +luasec +luasocket \
+	+luci-base +libuci-lua +luaposix \
+	+luci-mod-network +luci-mod-status +luci-theme-bootstrap \
+	+lua-cjson +uhttpd
+  TITLE:=Facebook Wi-Fi
+  PKGARCH:=all
+endef
+
+define Package/fbwifi/description
+  Facebook Wi-Fi, an AP authorisation solution
+endef
+
+define Package/fbwifi/conffiles
+/etc/config/fbwifi
+endef
+
+define Build/Prepare
+endef
+
+define Build/Configure
+endef
+
+define Build/Compile
+endef
+
+define Package/fbwifi/install
+	$(INSTALL_DIR) $(1)
+	$(CP) ./files/* $(1)/
+endef
+
+$(eval $(call BuildPackage,fbwifi))

feeds/facebook/fbwifi/README.md

@@ -0,0 +1,55 @@
+# Facebook Wi-Fi v2.0 Reference Implementation for OpenWrt 
+
+## Getting started
+
+Case studies for OEM customers are available at the official page of [Facebook Wi-Fi](https://www.facebook.com/facebook-wifi).
+
+For OEM engineers, start by reading the init script in [files/etc/init.d/fbwifi](https://github.com/facebookincubator/fbc_owrt_feed/blob/master/fbwifi/files/etc/init.d/fbwifi)
+
+## Contents
+
+The 'files' subdirectory contains all the configuration, script and code 
+that implements the Facebook Wi-Fi v2.0 standard for OpenWrt.
+
+The folder structure follows *nix conventions :
+- 'etc' is the boot time scripts and configuration
+- 'usr' contains procedural scripts, lua common code module and GUI prototype for luci
+- 'www' contains the HTTP endpoints as CGI handlers 
+
+```
+files/
+├── etc
+│   ├── config
+│   │   └── fbwifi
+│   ├── hotplug.d
+│   │   └── iface
+│   │       └── 50-fbwifi
+│   ├── init.d
+│   │   └── fbwifi
+├── usr
+│   ├── lib
+│   │   └── lua
+│   │       ├── fbwifi.lua
+│   │       └── luci
+│   │           ├── controller
+│   │           │   └── fbwifi.lua
+│   │           └── view
+│   │               └── fbwifi.htm
+│   ├── sbin
+│   │   ├── fbwifi
+│   │   ├── fbwifi_debug_dump
+│   │   ├── fbwifi_gateway_info_update
+│   │   ├── fbwifi_get_config
+│   │   └── fbwifi_validate_token_db
+│   └── share
+│       └── fbwifi
+│           ├── firewall.include
+│           └── uhttpd.json
+└── www
+    └── cgi-bin
+        └── fbwifi
+            └── v2.0
+                ├── auth
+                ├── capport
+                └── info
+```

feeds/facebook/fbwifi/files/etc/config/fbwifi

@@ -0,0 +1,6 @@
+config fbwifi 'main'
+	option enabled '0'
+	option gateway_token 'FBWIFI:GATEWAY|123456789|0123456789|abcdeABCDE123456789'
+	option http_port '2060'
+	option https_port '2061'
+	option zone 'lan'

feeds/facebook/fbwifi/files/etc/hotplug.d/iface/50-fbwifi

@@ -0,0 +1,10 @@
+#!/bin/sh
+
+[ "$ACTION" = ifup ] || exit 0
+
+/etc/init.d/fbwifi enabled || exit 0
+
+ip route get fibmatch 1.1.1.1 | grep -q "$DEVICE" || exit 0
+
+logger -t fbwifi "Reloading fbwifi due to $ACTION of $INTERFACE ($DEVICE)"
+/etc/init.d/fbwifi restart

feeds/facebook/fbwifi/files/etc/init.d/fbwifi

@@ -0,0 +1,43 @@
+#!/bin/sh /etc/rc.common
+
+START=90
+
+USE_PROCD=1
+
+reload_service() {
+	restart
+}
+
+service_triggers() {
+	procd_add_reload_trigger fbwifi
+}
+
+start_service() {
+
+	config_load fbwifi
+	config_get_bool enabled 'main' 'enabled' '0'
+	[ "$enabled" -eq 0 ] && return
+
+	config_get http_port main http_port
+	[ -z "$http_port" ] && {
+		logger -t fbwifi "required option http_port not set"
+		exit 1
+	}
+
+	config_get https_port main https_port
+	[ -z "$https_port" ] && {
+		logger -t fbwifi "required option https_port not set"
+		exit 1
+	}
+
+	logger "[fbwifi] Enabled; starting"
+
+	mkdir -p /tmp/fbwifi
+
+	/usr/sbin/fbwifi reload
+
+	procd_open_instance
+	procd_set_param command /usr/sbin/fbwifi_validate_token_db
+	procd_set_param respawn 1 300 0
+	procd_close_instance
+}

feeds/facebook/fbwifi/files/usr/lib/lua/fbwifi.lua

@@ -0,0 +1,153 @@
+-- FBWIFI Lua library
+-- function table
+local fbwifi = {}
+
+local http = require("ssl.https")
+local json = require("cjson")
+local log = require("posix.syslog")
+local uci = require("uci")
+
+function fbwifi.gateway_token()
+
+	state = uci.cursor(nil, "/var/state")
+	token = state:get("fbwifi", "main", "gateway_token")
+	if token and string.len(token) > 0 then
+		return token
+	else
+		log.syslog( log.LOG_WARNING, "[fbwifi] UCI option fbwifi.main.gateway_token is missing" )
+		return nil
+	end 
+end
+
+function fbwifi.validate_token( token )
+
+	local valid = false
+
+	if string.len(token or '' ) > 0 then
+
+	        GATEWAY_TOKEN = fbwifi.gateway_token()
+
+	        URL="https://api.fbwifi.com/v2.0/token"
+	        BODY="token="..token
+	        body, code, headers = http.request(URL.."?access_token="..GATEWAY_TOKEN, BODY)
+
+	        if code==200 then
+	                valid = true
+	        else
+	                log.syslog(log.LOG_WARNING, "[fbwifi] validate_token:"..body)
+	        end
+
+	end
+
+	return valid
+end
+
+local mac_to_purge=''
+function remove_client_by_mac(client)
+	state = uci.cursor(nil, "/var/state")
+
+	for key, value in pairs(client) do
+		if
+			key == 'mac' and
+			value == mac_to_purge
+		then
+			log.syslog(log.LOG_INFO, string.format("[fbwifi] Purging DB entry %s for MAC %s", client['.name'] or 'unknown', mac_to_purge) )
+			state:delete("fbwifi", client['.name'])
+			return
+		end
+	end
+end
+
+function fbwifi.instate_client_rule( token, client_mac )
+
+	log.syslog(log.LOG_INFO, "[fbwifi] Validating client "..client_mac)
+
+	state = uci.cursor(nil, "/var/state")
+	state_name = "token_" .. token
+
+	RULE_COND="iptables -w -L FBWIFI_CLIENT_TO_INTERNET -t mangle | grep -i -q \"%s\""
+	RULE_FMT="iptables -w -t mangle -%s FBWIFI_CLIENT_TO_INTERNET -m mac --mac-source \"%s\" -j MARK --set-mark 0xfb"
+	local RULE
+
+	log.syslog(log.LOG_INFO, string.format("[fbwifi] Cleaning DB for MAC %s", client_mac) )
+	mac_to_purge = client_mac
+	state:foreach("fbwifi", "client", remove_client_by_mac)
+	
+		
+	log.syslog(log.LOG_INFO, string.format("[fbwifi] Adding DB entry %s for MAC %s", state_name, client_mac) )
+	state:set("fbwifi", state_name, "client")
+	state:set("fbwifi", state_name, "token", token)
+	state:set("fbwifi", state_name, "mac", client_mac)
+	state:set("fbwifi", state_name, "authenticated", "true")
+				
+	-- verify a rule exists for the given client MAC, 
+	--   OR install it
+	RULE=string.format(RULE_COND.." || "..RULE_FMT, client_mac, "A", client_mac)
+
+	log.syslog(log.LOG_INFO, string.format( "[fbwifi] Opening iptables for %s", client_mac ) )
+	res = os.execute(RULE)
+	if res ~= 0 then 
+		log.syslog(log.LOG_WARNING, string.format( "[fbwifi] Failed to update iptables (%s)", res ) )
+	end
+	log.syslog(log.LOG_INFO, "[fbwifi] "..RULE)
+	
+	state:save('fbwifi')
+end
+
+function fbwifi.revoke_client_rule( token )
+        
+        if (token == nil) then
+                log.syslog(log.LOG_INFO, "[fbwifi] Invalidating token, but token is Nil")
+                return
+        end
+
+	log.syslog(log.LOG_INFO, string.format( "[fbwifi] Invalidating token (%s)", token) )
+
+	state = uci.cursor(nil, "/var/state")
+	state_name = "token_" .. token
+	
+	client_mac = state:get("fbwifi", state_name, "mac")
+
+	if client_mac then
+		RULE_COND="iptables -w -L FBWIFI_CLIENT_TO_INTERNET -t mangle | grep -i -q \"%s\""
+		RULE_FMT="iptables -w -t mangle -%s FBWIFI_CLIENT_TO_INTERNET -m mac --mac-source \"%s\" -j MARK --set-mark 0xfb"
+
+		-- verify a rule exists for the given client MAC, 
+		--  AND delete it
+		RULE=string.format(RULE_COND.." && "..RULE_FMT, client_mac, "D", client_mac)
+
+		res = os.execute(RULE)
+		if res ~= 0 then 
+			log.syslog(log.LOG_WARNING, string.format( "[fbwifi] Failed to update iptables (%s)", res ) )
+		end
+		log.syslog(log.LOG_INFO, "[fbwifi] "..RULE)
+
+		state:delete("fbwifi", state_name)
+		state:save('fbwifi')
+	else
+		log.syslog(log.LOG_WARNING, string.format( "[fbwifi] Client MAC not found in DB (%s)", state_name ) )
+	end
+end
+
+function fbwifi.reset()
+
+	local success = false
+        GATEWAY_TOKEN = fbwifi.gateway_token()
+        URL="https://api.fbwifi.com/v2.0/gateway/reset"
+	BODY="{}"
+        body, code, headers = http.request(URL.."?access_token="..GATEWAY_TOKEN, BODY)
+
+        if code==200 then
+                log.syslog(log.LOG_INFO, "[fbwifi] Reset committed")
+                success = true
+        else
+                log.syslog(log.LOG_WARNING, "[fbwifi] Reset failed : "..body)
+        end
+
+	return success
+end
+
+--
+-- Return the function table to the host script
+--
+return fbwifi

feeds/facebook/fbwifi/files/usr/lib/lua/luci/controller/fbwifi.lua

@@ -0,0 +1,12 @@
+-- Copyright 
+-- Licensed to the public under the GNU General Public License v2.
+
+module("luci.controller.fbwifi", package.seeall)
+
+sys = require "luci.sys"
+ut = require "luci.util"
+
+function index()
+    entry({"admin", "network", "fbwifi"}, template("fbwifi"), "Facebook Wi-Fi", 90).dependent=false
+end
+

feeds/facebook/fbwifi/files/usr/lib/lua/luci/view/fbwifi.htm

@@ -0,0 +1,16 @@
+<%#
+ Copyright
+ Licensed to the public under the GNU General Public License v2.
+-%>
+
+<%+header%>
+
+<h1>Facebook Wi-Fi</h1>
+<%
+	require("uci")
+	state = uci.cursor(nil, "/var/state")
+	url = state:get("fbwifi", "main", "captive_portal_config_url")
+%>
+<a href="<% print(url) %>">Configure FB business page</a>
+
+<%+footer%>

feeds/facebook/fbwifi/files/usr/sbin/fbwifi

@@ -0,0 +1,57 @@
+#!/bin/sh
+
+case "$1" in
+disable)
+	uci set fbwifi.main.enabled=0
+
+	uci delete firewall.fbwifi
+
+	uci delete uhttpd.fbwifi_redirect
+
+	uci delete uhttpd.main.json_script
+	uci set uhttpd.main.cert='/etc/uhttpd.crt'
+	uci set uhttpd.main.key='/etc/uhttpd.key'
+	uci set uhttpd.main.rfc1918_filter=1
+	;;
+enable)
+	uci set fbwifi.main.enabled=1
+
+	uci set firewall.fbwifi=include
+	uci set firewall.fbwifi.enabled=1
+	uci set firewall.fbwifi.family=ipv4
+	uci set firewall.fbwifi.path=/usr/share/fbwifi/firewall.include
+	uci set firewall.fbwifi.reload=1
+	uci set firewall.fbwifi.type=script
+
+	uci set uhttpd.fbwifi_redirect=uhttpd
+	uci set uhttpd.fbwifi_redirect.enabled=1
+	uci set uhttpd.fbwifi_redirect.cert='/tmp/fbwifi/https_server_cert'
+	uci set uhttpd.fbwifi_redirect.json_script='/tmp/fbwifi/uhttpd-redirect.json'
+	uci set uhttpd.fbwifi_redirect.key='/tmp/fbwifi/https_server_key'
+	uci set uhttpd.fbwifi_redirect.listen_http='0.0.0.0:2060'
+	uci set uhttpd.fbwifi_redirect.listen_https='0.0.0.0:2061'
+
+	uci set uhttpd.main.cert='/tmp/fbwifi/https_server_cert'
+	uci set uhttpd.main.json_script='/usr/share/fbwifi/uhttpd.json'
+	uci set uhttpd.main.key='/tmp/fbwifi/https_server_key'
+	uci set uhttpd.main.rfc1918_filter=0
+	;;
+reload)
+	/usr/sbin/fbwifi_get_config
+
+	login_url=$(uci -p /var/state get fbwifi.main.captive_portal_url)
+	[ -z "$login_url" ] && {
+		logger -t fbwifi "captive_portal_url not available yet"
+		exit 1
+	}
+	printf '{ "request": [ ["redirect", "%s", 302] ] }' "$login_url" > /tmp/fbwifi/uhttpd-redirect.json
+
+	/etc/init.d/uhttpd restart
+
+	exit 0
+	;;
+esac
+
+uci commit
+/etc/init.d/uhttpd restart
+reload_config

feeds/facebook/fbwifi/files/usr/sbin/fbwifi_debug_dump

@@ -0,0 +1,8 @@
+echo -e "Runtime configuration and token DB\n"
+uci -p /var/state export fbwifi
+
+echo -e "\nDynamic firewall flow rules\n"
+iptables -t mangle -L FBWIFI_CLIENT_TO_INTERNET
+
+echo -e "\nDHCP leases\n"
+cat /tmp/dhcp.leases

feeds/facebook/fbwifi/files/usr/sbin/fbwifi_gateway_info_update

@@ -0,0 +1,38 @@
+#!/usr/bin/lua
+
+http = require("ssl.https")
+json = require("cjson")
+log = require("posix.syslog")
+socket = require("socket")
+require("uci")
+fbwifi = require("fbwifi")
+
+GATEWAY_TOKEN = fbwifi.gateway_token()
+state = uci.cursor(nil, "/var/state")
+
+payload="name="..socket.dns.gethostname()
+
+function queue_ssid_update(iface)
+	bssid_file="/sys/class/net/br-"..iface["network"].."/address"
+	local file = io.open(bssid_file)
+        if file then
+            for line in file:lines() do
+		payload=payload.."&bssid[]="..line
+            end
+	    payload=payload.."ssid[]="..iface["ssid"]
+        else
+	    log.syslog(log.LOG_WARNING, "[fbwifi] Failed to find BSSID for interface br-"..iface["network"])
+        end
+end
+
+state:foreach("wireless", "wifi-iface", queue_ssid_update)
+
+URL="https://api.fbwifi.com/v2.0/gateway"
+body, code, headers = http.request(URL.."?access_token="..GATEWAY_TOKEN, payload)
+if code == 200 then 
+	log.syslog(log.LOG_INFO, "[fbwifi] gateway information updated "..body)
+	os.exit(0)
+else
+	log.syslog(log.LOG_WARNING, "[fbwifi] gateway API failed "..body)
+	os.exit(code)
+end

feeds/facebook/fbwifi/files/usr/sbin/fbwifi_get_config

@@ -0,0 +1,106 @@
+#!/usr/bin/lua
+http = require("ssl.https")
+json = require("cjson")
+require("uci")
+log = require("posix.syslog")
+fbwifi = require("fbwifi")
+
+GATEWAY_TOKEN = fbwifi.gateway_token()
+
+http_port = uci.get("fbwifi.main.http_port")
+https_port = uci.get("fbwifi.main.https_port")
+
+state = uci.cursor(nil, "/var/state")
+
+URL="https://api.fbwifi.com/v2.0/gateway"
+body, code, headers = http.request(URL.."?access_token="..GATEWAY_TOKEN.."&fields=config,config_version")
+
+if code == 200 then
+	log.syslog(log.LOG_INFO, "[fbwifi] Got gateway config ("..code..")")
+else
+	log.syslog(log.LOG_CRIT, "[fbwifi] Failed to get gateway config ("..code..")")
+	os.exit(1)
+end
+
+obj = json.decode(body)
+
+function save_cert(name, value)
+	log.syslog(log.LOG_INFO, "[fbwifi] Saving cert "..name)
+	local f = assert(io.open("/tmp/fbwifi/"..name, "w"))
+	f:write(value)
+	f:close()
+end
+
+function process_redirect(ix, host)
+	IP_SET = "ip addr replace dev lo "..host
+	local result = os.execute(IP_SET)
+	if result == 0 then
+		log.syslog(log.LOG_INFO, "[fbwifi] Redirect address applied "..host)
+	else
+		log.syslog(log.LOG_WARNING, "[fbwifi] Failed to apply redirect address "..host)
+	end
+
+	ip = string.match(host, '([0-9\.]*)/([0-9]*)')
+	RULE_FMT="grep -q \"%s\" /etc/hosts || echo \"%s\tstar.fbwifigateway.net\" >> /etc/hosts"
+	HOSTS_RULE = string.format(RULE_FMT, ip, ip)
+	result = os.execute(HOSTS_RULE)
+	if result == 0 then
+		log.syslog(log.LOG_INFO, "[fbwifi] Cached redirect host for DNS")
+	else
+		log.syslog(log.LOG_WARNING, "[fbwifi] Failed to amend /etc/hosts")
+		log.syslog(log.LOG_INFO, "[fbwifi] "..HOSTS_RULE)
+	end
+
+	result = os.execute("iptables -t nat -A FBWIFI_HOST_REDIRLIST -p tcp --dport 80 -d "..ip.." -j ACCEPT # REDIRECT --to-ports "..http_port)
+	--print(result)
+	result = os.execute("iptables -t nat -A FBWIFI_HOST_REDIRLIST -p tcp --dport 443 -d "..ip.."  -j ACCEPT # REDIRECT --to-ports "..https_port)
+	--print(result)
+end
+
+save_cert("https_server_cert", obj['config']['https_server_cert'])
+save_cert("https_server_key", obj['config']['https_server_key'])
+
+result = os.execute("iptables -t nat -F FBWIFI_HOST_REDIRLIST")
+--print(result)
+table.foreach(obj['config']['host_redirect_ips'], process_redirect)
+
+RULE_FORMAT = "iptables -t mangle -A FBWIFI_TRAFFIC_ALLOWLIST -d %s -p %s --dport %s -j MARK --set-mark 0xfb"
+function process_traffic_rule(ix, rule)
+	log.syslog(log.LOG_INFO, "[fbwifi] Traffic rule "..ix)
+	
+	if rule["protocol"] == 6 then
+		PROTO = "tcp"
+	elseif rule["protocol"] == 17 then
+		PROTO = "udp"
+	end
+	RULE = string.format(RULE_FORMAT, rule["ip"], PROTO, rule["port"])
+	local result = os.execute(RULE)
+	if result == 0 then
+		log.syslog(log.LOG_INFO, "[fbwifi] Traffic rule "..ix)
+	else
+		log.syslog(log.LOG_WARNING, "[fbwifi] Failed to install traffic rule ; "..RULE)
+	end
+end
+
+local cross_origin_list = {}
+function process_cross_origin_rule(ix, url)
+	log.syslog(log.LOG_INFO, "[fbwifi] Cross origin rule "..url)
+	table.insert(cross_origin_list, url)
+end
+
+function process_url(url_purpose, fqdn)
+	log.syslog(log.LOG_INFO, "[fbwifi] Caching "..url_purpose)
+	state:set("fbwifi", "main", url_purpose, fqdn)	
+end
+
+state:set("fbwifi", "main", "config")
+
+result = os.execute("iptables -t mangle -F FBWIFI_TRAFFIC_ALLOWLIST ")
+--print(result)
+table.foreach(obj['config']['traffic_allowlist'], process_traffic_rule)
+table.foreach(obj['config']['cross_origin_allowlist'], process_cross_origin_rule)
+table.foreach(obj['config']['urls'], process_url)
+state:set("fbwifi", "main", "cross_origin_allow_rules", cross_origin_list)
+
+state:set("fbwifi", "main", "config_version", obj['config_version'])
+state:save('fbwifi')

feeds/facebook/fbwifi/files/usr/sbin/fbwifi_validate_token_db

@@ -0,0 +1,75 @@
+#!/usr/bin/lua
+
+https = require("ssl.https")
+json = require("cjson")
+log = require("posix.syslog")
+fbwifi = require("fbwifi")
+require("uci")
+
+state = uci.cursor(nil, "/var/state")
+GATEWAY_TOKEN = fbwifi.gateway_token()
+
+request = { 
+	tokens = {}, 
+	traffic_type = "total",
+	config_version = state:get("fbwifi", "main", "config_version")
+}
+
+function queue_token(client)
+
+	request.tokens[client.token]={
+		incoming = json.null,
+		outgoing = json.null,
+		connected_time_sec = json.null,
+		inactive_time_sec = json.null,
+		signal_rssi_dbm = json.null,
+		--expected_tpus_mbps = json.null,
+		is_connected = true
+	}
+
+end
+
+state:foreach("fbwifi", "client", queue_token)
+print( "\nRequest:\n"..json.encode(request) )
+
+URL="https://api.fbwifi.com/v2.0/tokens"
+BODY=string.format(
+	"tokens=%s&traffic_type=%s&config_version=%s",
+	json.encode(request.tokens),
+	"'total'",
+	state:get("fbwifi", "main", "config_version")
+)
+
+body, code, headers = https.request(URL.."?access_token="..GATEWAY_TOKEN, BODY)
+
+if code then
+	print( "\nResponse:\n"..body )
+end
+
+response = json.decode(body)
+--print(response)
+--table.foreach(response,print)
+--table.foreach(response.tokens,print)
+
+if response.config_valid then
+	log.syslog(log.LOG_INFO, "[fbwifi] Config validated")
+else
+	log.syslog(log.LOG_WARNING, "[fbwifi] config is stale, refreshing config")
+        local result = os.execute("/usr/sbin/fbwifi reload")
+        if result == 0 then
+                log.syslog(log.LOG_INFO, "[fbwifi] successfully fetched and loaded new config ")
+        else
+                log.syslog(log.LOG_WARNING, "[fbwifi] failed to fetch and load new config, possible stale config")
+        end
+end
+
+function process_token(token, metadata)
+	table.foreach(metadata,print)
+	if metadata.valid then
+		print("OK: "..token)	
+	else
+		print("Nok: "..token)	
+		fbwifi.revoke_client_rule( token )
+	end
+end
+table.foreach(response.tokens,process_token)

feeds/facebook/fbwifi/files/usr/share/fbwifi/firewall.include

@@ -0,0 +1,67 @@
+#!/bin/sh
+
+IPT4="/usr/sbin/iptables"
+
+fbwifi_http_port="$(uci get fbwifi.main.http_port)"
+[ -n "$fbwifi_http_port" ] || {
+	logger -t fbwifi "required option http_port not set"
+	exit 1
+}
+
+fbwifi_https_port="$(uci get fbwifi.main.https_port)"
+[ -n "$fbwifi_https_port" ] || {
+	logger -t fbwifi "required option https_port not set"
+	exit 1
+}
+
+fbwifi_zone="$(uci get fbwifi.main.zone)"
+[ -n "$fbwifi_zone" ] || {
+	logger -t fbwifi "required option zone  not set"
+	exit 1
+}
+
+fbwifi_ifaces="$(fw3 -q zone "$fbwifi_zone")"
+
+## Create custom chains
+$IPT4 -t filter -N FBWIFI_FORWARD 2>/dev/null
+$IPT4 -t filter -N FBWIFI_INPUT 2>/dev/null
+$IPT4 -t mangle -N FBWIFI_CLIENT_TO_INTERNET 2>/dev/null
+$IPT4 -t mangle -N FBWIFI_PREROUTING 2>/dev/null
+$IPT4 -t mangle -N FBWIFI_TRAFFIC_ALLOWLIST 2>/dev/null
+$IPT4 -t nat -N FBWIFI_CLIENT_TO_INTERNET 2>/dev/null
+$IPT4 -t nat -N FBWIFI_PREROUTING 2>/dev/null
+$IPT4 -t nat -N FBWIFI_HOST_REDIRLIST 2>/dev/null
+
+## Flush custom chains
+$IPT4 -t filter -F FBWIFI_FORWARD
+$IPT4 -t filter -F FBWIFI_INPUT
+$IPT4 -t mangle -F FBWIFI_CLIENT_TO_INTERNET
+$IPT4 -t mangle -F FBWIFI_PREROUTING
+$IPT4 -t mangle -F FBWIFI_TRAFFIC_ALLOWLIST
+$IPT4 -t nat -F FBWIFI_CLIENT_TO_INTERNET
+$IPT4 -t nat -F FBWIFI_PREROUTING
+$IPT4 -t nat -F FBWIFI_HOST_REDIRLIST
+
+## Populate custom chains
+$IPT4 -t filter -A FBWIFI_FORWARD -p udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+$IPT4 -t filter -A FBWIFI_FORWARD -m conntrack --ctstate NEW -m mark --mark 0xfb -j ACCEPT
+$IPT4 -t filter -A FBWIFI_FORWARD -j REJECT
+$IPT4 -t filter -A FBWIFI_INPUT -p tcp --dport "$fbwifi_http_port" -m conntrack --ctstate NEW -j ACCEPT
+$IPT4 -t filter -A FBWIFI_INPUT -p tcp --dport "$fbwifi_https_port"  -m conntrack --ctstate NEW -j ACCEPT
+$IPT4 -t mangle -A FBWIFI_PREROUTING -j FBWIFI_CLIENT_TO_INTERNET
+$IPT4 -t mangle -A FBWIFI_PREROUTING -j FBWIFI_TRAFFIC_ALLOWLIST
+$IPT4 -t nat -A FBWIFI_PREROUTING -j FBWIFI_CLIENT_TO_INTERNET
+$IPT4 -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 80 -m conntrack --ctstate NEW -j FBWIFI_HOST_REDIRLIST
+$IPT4 -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 443 -m conntrack --ctstate NEW -j FBWIFI_HOST_REDIRLIST
+$IPT4 -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 80 -m conntrack --ctstate NEW -m mark --mark 0xfb -j ACCEPT
+$IPT4 -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 443 -m conntrack --ctstate NEW -m mark --mark 0xfb -j ACCEPT
+$IPT4 -t nat -A FBWIFI_CLIENT_TO_INTERNET -p tcp --dport 80 -m conntrack --ctstate NEW -j REDIRECT --to-ports "$fbwifi_http_port"
+
+## Hook custom chains in firewall3 chains
+$IPT4 -t filter -I "zone_${fbwifi_zone}_input" 2 -j FBWIFI_INPUT
+$IPT4 -t filter -I "zone_${fbwifi_zone}_forward" 2 -j FBWIFI_FORWARD
+$IPT4 -t nat -I "zone_${fbwifi_zone}_prerouting" 2 -j FBWIFI_PREROUTING
+# There are no firewall3 zone chains in the mangle table so we need to do this for all interfaces in the zone
+for iface in $fbwifi_ifaces; do
+	$IPT4 -t mangle -I PREROUTING -i "$iface" -j FBWIFI_PREROUTING
+done

feeds/facebook/fbwifi/files/usr/share/fbwifi/uhttpd.json

@@ -0,0 +1,8 @@
+{
+  "request": [
+    [ "if",
+      [ "regex", "REQUEST_URI", "^/fbwifi" ],
+      [ "rewrite", "/cgi-bin%REQUEST_URI%" ]
+    ]
+  ]
+}

feeds/facebook/fbwifi/files/www/cgi-bin/fbwifi/v2.0/auth

@@ -0,0 +1,69 @@
+#!/usr/bin/lua
+require("uci")
+log = require("posix.syslog")
+fbwifi = require("fbwifi")
+
+state = uci.cursor(nil, "/var/state")
+function process_cors()
+	origin = os.getenv("HTTP_ORIGIN")
+	log.syslog(log.LOG_INFO, string.format("[fbwifi] [auth] process_cors origin %s", origin or 'not found') )
+	if string.len(origin or '') > 0 then
+		allow_list = state:get("fbwifi", "main", "cross_origin_allow_rules")
+		for _, value in pairs(allow_list) do
+    			if value == origin then
+				log.syslog(log.LOG_INFO, "[fbwifi] [auth] process_cors Appending CORS Headers to HTTP")
+				print("Access-Control-Allow-Origin: "..origin)
+				print("Vary: Origin")
+				break
+			end
+		end
+	else	
+		log.syslog(log.LOG_INFO, "[fbwifi] [auth] process_cors No CORS Headers added to Response")
+	end
+end
+
+method = os.getenv("REQUEST_METHOD")
+if method == 'GET' then
+	log.syslog(log.LOG_INFO, "[fbwifi] [auth] GET handler")
+	print("Status: 302")
+	print("Location: "..state:get("fbwifi", "main", "landing_page_url"))
+	process_cors()
+	print ('\n')
+
+elseif method == 'POST' then
+	local token
+	
+	log.syslog(log.LOG_INFO, "[fbwifi] [auth] POST handler")
+	process_cors()
+	print("Status: 200")
+
+	form_data=io.read()
+	while form_data do
+		token = string.match(form_data, '[%d]+')
+		if string.len(token or '') > 14 then
+
+			client = os.getenv("REMOTE_ADDR")
+			f = io.popen("awk '/"..client.."/ { printf(\"%s\", $4) }' /proc/net/arp", 'r')
+			client_mac = assert(f:read('*a'))
+
+			if fbwifi.validate_token(token) then
+                                log.syslog(log.LOG_INFO, string.format( "[fbwifi] [auth] POST handler : Validating Token (%s) for MAC (%s)", token or 'nil', client_mac or 'nil') )
+				fbwifi.instate_client_rule(token, client_mac)
+				print("\n{\"valid\":true}\n")
+			else
+                                log.syslog(log.LOG_WARNING, string.format( "[fbwifi] [auth] POST handler : ! Invalid token (%s) for mac (%s) !", token or 'nil', client_mac or 'nil') )
+				fbwifi.revoke_client_rule(token)
+				print("\n{\"valid\":false}\n")
+			end
+			log.syslog(log.LOG_INFO, "[fbwifi] [auth] POST handler completed")
+			return
+		end
+
+		form_data=io.read()
+	end
+	print ('\n')
+
+	log.syslog(log.LOG_WARNING, string.format("[fbwifi] [auth] POST handler : token not found" ))
+	fbwifi.revoke_client_rule(token)
+	print("\n{\"valid\":false}\n")
+end

feeds/facebook/fbwifi/files/www/cgi-bin/fbwifi/v2.0/capport

@@ -0,0 +1,41 @@
+#!/usr/bin/lua
+json = require("cjson")
+require("uci")
+
+state = uci.cursor(nil, "/var/state")
+client_mac = ""
+token = ""
+
+response = {}
+response['venue-info-url'] = state:get("fbwifi", "main", "capport_venue_info_url")
+
+function map_remote_mac_to_token(client)
+        for key, value in pairs(client) do
+                if
+                        key == 'mac' and
+                        value == client_mac
+                then
+			token = client.token
+                        return false
+                end
+        end
+end
+
+function hasValidToken(client_ip)
+	f = io.popen("awk '/"..client_ip.."/ { printf(\"%s\", $4) }' /proc/net/arp", 'r')
+	client_mac = assert(f:read('*a'))
+	state:foreach("fbwifi", "client", map_remote_mac_to_token)
+
+	return 0 < string.len(token)
+end
+
+print("Content-type: application/captive+json; charset=utf-8\n")
+
+client = os.getenv("REMOTE_ADDR")
+response['captive'] = not hasValidToken(client)
+
+if response['captive'] then
+	response['user-portal-url'] = state:get("fbwifi", "main", "captive_portal_url")
+end
+
+print( json.encode(response) )

feeds/facebook/fbwifi/files/www/cgi-bin/fbwifi/v2.0/info

@@ -0,0 +1,58 @@
+#!/usr/bin/lua
+require "luci.cacheloader"
+require "luci.sgi.cgi"
+json = require("cjson")
+fbwifi = require("fbwifi")
+
+state = uci.cursor(nil, "/var/state")
+GATEWAY_TOKEN = fbwifi.gateway_token()
+
+response = { api_version = "2.0", token = json.null }
+client_mac = ""
+
+function process_cors()
+        origin = os.getenv("HTTP_ORIGIN")
+        if string.len(origin or '') > 0 then
+                allow_list = state:get("fbwifi", "main", "cross_origin_allow_rules")
+                for _, value in pairs(allow_list) do
+                        if value == origin then
+                                print("Access-Control-Allow-Origin: "..origin)
+                                print("Vary: Origin")
+                                break
+                        end
+                end
+        end
+end
+
+function map_remote_mac_to_token(client)
+
+	for key, value in pairs(client) do
+		if
+			key == 'mac' and
+			value == client_mac
+		then
+			response.token = client.token
+			return false -- escape outer loop
+		end
+	end
+end
+
+function getClientToken(client_ip)
+	f = io.popen("awk '/"..client_ip.."/ { printf(\"%s\", $4) }' /proc/net/arp", 'r')
+	client_mac = assert(f:read('*a'))
+
+	state:foreach("fbwifi", "client", map_remote_mac_to_token)
+end
+
+function getGatewayId()
+	id = string.match(GATEWAY_TOKEN, 'FBWIFI:GATEWAY|[0-9]*|([0-9]*)')
+	return id
+end
+
+process_cors()
+print("Content-type: application/json; charset=utf-8\n")
+
+getClientToken(os.getenv("REMOTE_ADDR"))
+response.gateway_id = getGatewayId()
+
+print( json.encode(response) )

feeds/openflow/openvswitch/Config.in

@@ -0,0 +1,8 @@
+menu "Configuration"
+	depends on PACKAGE_openvswitch
+
+	config	OPENVSWITCH_WITH_LIBUNBOUND
+		bool
+		default y
+		prompt "Build with libunbound library."
+endmenu

feeds/openflow/openvswitch/Makefile

@@ -17,10 +17,10 @@ include ./openvswitch.mk
 #
 PKG_NAME:=openvswitch
 PKG_VERSION:=$(ovs_version)
-PKG_RELEASE:=1
+PKG_RELEASE:=6
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://www.openvswitch.org/releases/
-PKG_HASH:=7d5797f2bf2449c6a266149e88f72123540f7fe7f31ad52902057ae8d8f88c38
+PKG_HASH:=55e3b7e59b3e52eeecccc783266be39780e1f693c0a974f180b4ec8256f48d6a
 
 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
@@ -40,6 +40,9 @@ include $(INCLUDE_DIR)/package.mk
 include $(TOPDIR)/feeds/packages/lang/python/python3-host.mk
 include $(TOPDIR)/feeds/packages/lang/python/python3-package.mk
 
+define Package/openvswitch/config
+source "$(SOURCE)/Config.in"
+endef
 
 ovs_kmod_packages:=
 ovs_kmod_intree_kernel_patchver_min:=3.10
@@ -150,8 +153,11 @@ $(eval $(call OvsKmodPackageTemplate,openvswitch-lisp-intree))
 #
 ovs_libopenvswitch_title:=Open vSwitch (libopenvswitch.so)
 ovs_libopenvswitch_hidden:=1
-ovs_libopenvswitch_depends:=+libopenssl +libunbound +!(arc||arceb):libunwind
+ovs_libopenvswitch_depends:=+libopenssl +!(arc||arceb):libunwind
 ovs_libopenvswitch_depends+=+libatomic
+ifeq ($(CONFIG_KEEPALIVED_ROUTES),y)
+ovs_libopenvswitch_depends+=+libunbound
+endif
 ovs_libopenvswitch_files:=usr/lib/libopenvswitch*.so*
 $(eval $(call OvsPackageTemplate,libopenvswitch))
 
@@ -243,6 +249,7 @@ CONFIGURE_ARGS+= \
 	--disable-silent-rules \
 
 CONFIGURE_VARS += \
+	$(if $(CONFIG_OPENVSWITCH_WITH_LIBUNBOUND),,ac_cv_lib_unbound_ub_ctx_create=no) \
 	ovs_cv_flake8=no \
 	ovs_cv_python3=$(PYTHON3) \
 	ovs_cv_python3_host=$(HOST_PYTHON3_BIN) \

feeds/openflow/openvswitch/README.md

@@ -63,17 +63,42 @@ E.g. replace in-tree datapath module with upstream version
 
 # UCI configuration options
 
-There are 4 config section types in package openvswitch:
+There are 5 config section types in package openvswitch:
 ovs ovn_northd, ovn_controller & ovs_bridge.
 
 Each of these supports a disabled option, which should be 
 set to 0 to launch the respective daemons.
 
+The ovs section section also supports the options below, to configure a set of
+SSL CA, certificate and private key. After adding these to Open vSwitch, you
+may specify ssl: connection methods for e.g. the OpenFlow controller. Note that
+Open vSwitch only reads these files during startup, so it needs to be restarted
+after adding or changing these options.
+
+| Name     | Type    | Required | Default | Description                       |
+|----------|---------|----------|---------|-----------------------------------|
+| disabled | boolean | no       | 0       | If set to 1, do not configure SSL |
+| ca       | string  | no       | (none)  | Path to CA certificate            |
+| cert     | string  | no       | (none)  | Path to certificate               |
+| key      | string  | no       | (none)  | Path to private key               |
+
 The ovs_bridge section also supports the options below,
 for initialising a virtual bridge with an OpenFlow controller.
 
-| Name       | Type    | Required | Default                        | Description                                                |
-|------------|---------|----------|--------------------------------|------------------------------------------------------------|
-| disabled   | boolean | no       | 0                              | If set to true, disable initialisation of the named bridge |
-| name       | string  | no       | Inherits UCI config block name | The name of the switch in the OVS daemon                   |
-| controller | string  | no       | (none)                         | The endpoint of an OpenFlow controller for this bridge     |
+| Name        | Type    | Required | Default                        | Description                                                |
+|-------------|---------|----------|--------------------------------|------------------------------------------------------------|
+| disabled    | boolean | no       | 0                              | If set to true, disable initialisation of the named bridge |
+| name        | string  | no       | Inherits UCI config block name | The name of the switch in the OVS daemon                   |
+| controller  | string  | no       | (none)                         | The endpoint of an OpenFlow controller for this bridge     |
+| datapath_id | string  | no       | (none)                         | The OpenFlow datapath ID for this bridge                   |
+
+The ovs_port section can be used to add ports to a bridge. It supports the options below.
+
+| Name     | Type    | Required | Default | Description
+| ---------|---------|----------|---------|------------------------------------------------|
+| disabled | boolean | no       | 0       | If set to 1, do not add the port to the bridge |
+| bridge   | string  | yes      | (none)  | Name of the bridge to add the port to          |
+| port     | string  | yes      | (none)  | Name of the port to add to the bridge          |
+| ofport   | integer | no       | (none)  | OpenFlow port number to be used by the port    |
+| tag      | integer | no       | (none)  | 802.1Q VLAN tag to set on the port             |
+| type     | string  | no       | (none)  | Port type, e.g. internal, erspan, type, ...    |

feeds/openflow/openvswitch/files/openvswitch.config

@@ -1,5 +1,8 @@
 config ovs ovs
 	option disabled 1
+	option ca '/etc/openvswitch/example_ca.crt'
+	option cert '/etc/openvswitch/example_cert.crt'
+	option key '/etc/openvswitch/example_key.crt'
 
 config ovn_northd north
 	option disabled 1
@@ -10,4 +13,13 @@ config ovn_controller controller
 config ovs_bridge
 	option disabled 1
 	option name 'my-bridge'
-	option controller 'tcp:192.168.0.1'
+	option controller 'tcp:192.168.0.1'
+	option datapath_id ''
+
+config ovs_port
+	option disabled 1
+	option bridge 'my-bridge'
+	option port 'ovs-port1'
+	option ofport '1'
+	option tag '123'
+	option type 'internal'

feeds/openflow/openvswitch/files/openvswitch.init

@@ -7,6 +7,8 @@
 . /lib/functions/procd.sh
 START=15
 
+basescript=$(readlink "$initscript")
+
 ovs_ctl="/usr/share/openvswitch/scripts/ovs-ctl"; [ -x "$ovs_ctl" ] || ovs_ctl=:
 ovn_ctl="/usr/share/ovn/scripts/ovn-ctl"; [ -x "$ovn_ctl" ] || ovn_ctl=:
 
@@ -59,7 +61,12 @@ ovs_action() {
 		config_foreach "ovs_xx" "$cfgtype" "$action" "$cfgtype"
 	done
 
-	config_foreach ovs_bridge_init "ovs_bridge"
+	case "$action" in
+		restart|start)
+			config_foreach ovs_bridge_init "ovs_bridge"
+			;;
+	esac
+
 }
 
 ovs_xx() {
@@ -83,6 +90,7 @@ ovs_xx() {
 		ovs)
 			"$ovs_ctl" "$action" \
 				--system-id=random 1000>&-
+			ovs_set_ssl
 			;;
 		ovn_*)
 			"$ovn_ctl" "${action}_${cfgtype#ovn_}"
@@ -116,6 +124,47 @@ ovs_bridge_port_add() {
 	__port_list="$__port_list ${port} "
 }
 
+ovs_bridge_port_add_complex() {
+	local cfg="$1"
+	local cur_bridge="$2"
+
+	local bridge disabled ofport port tag type
+	local cur_tag cur_type del_port
+
+	config_get_bool disabled "$cfg" disabled 0
+	[ "$disabled" = "0" ] || return
+
+	config_get bridge "$cfg" bridge
+	[ "$bridge" = "$cur_bridge" ] || return
+	ovs-vsctl br-exists "$bridge" || return
+
+	config_get port "$cfg" port
+	[ -n "$port" ] || return
+
+	config_get ofport "$cfg" ofport
+
+	config_get tag "$cfg" tag
+	if [ -n "$tag" ]; then
+		if cur_tag="$(ovs-vsctl get port "$port" tag 2>/dev/null)"; then
+			[ "$tag" = "$cur_tag" ] || del_port=1
+		fi
+	fi
+
+	config_get type "$cfg" type
+	if [ -n "$type" ]; then
+		if cur_type="$(ovs-vsctl get interface "$port" type 2>/dev/null)"; then
+			[ "$type" = "$cur_type" ] || del_port=1
+		fi
+	fi
+
+	[ "${del_port:-0}" -eq 1 ] && ovs-vsctl --if-exists del-port "$bridge" "$port"
+
+	ovs-vsctl --may-exist add-port "$bridge" "$port" ${tag:+tag="$tag"} \
+		${ofport:+ -- set interface "$port" ofport_request="$ofport"} \
+		${type:+ -- set interface "$port" type="$type"}
+	__port_list="$__port_list ${port} "
+}
+
 ovs_bridge_port_cleanup() {
 	for port in `ovs-vsctl list-ports "$name"`; do
 		case "$__port_list" in
@@ -125,12 +174,26 @@ ovs_bridge_port_cleanup() {
 	done
 }
 
+ovs_bridge_validate_datapath_id() {
+	local dpid="$1"
+
+	if expr "$dpid" : '[[:xdigit:]]\{16\}$' > /dev/null; then
+		return 0
+	elif expr "$dpid" : '0x[[:xdigit:]]\{1,16\}$' > /dev/null; then
+		return 0
+	else
+		logger -t openvswitch "invalid datapath_id: $dpid"
+		return 1
+	fi
+}
+
 ovs_bridge_init() {
 	local cfg="$1"
 
 	local disabled
 	local name
 	local controller
+	local datapath_id
 
 	config_get_bool disabled "$cfg" disabled 0
 	[ "$disabled" == "0" ] || return
@@ -138,7 +201,15 @@ ovs_bridge_init() {
 	config_get name "$cfg" name $cfg
 	ovs-vsctl --may-exist add-br "$name"
 
+	config_get datapath_id "$cfg" datapath_id
+	[ -n "$datapath_id" ] && {
+		ovs_bridge_validate_datapath_id "$datapath_id" && {
+			ovs-vsctl --if-exists set bridge "$name" other-config:datapath-id="$datapath_id"
+		}
+	}
+
 	config_list_foreach "$cfg" "ports" ovs_bridge_port_add
+	config_foreach ovs_bridge_port_add_complex ovs_port "$name"
 	config_get_bool drop "$cfg" "drop_unknown_ports" 0
 	[ "$drop" == 1 ] && ovs_bridge_port_cleanup
 
@@ -146,3 +217,14 @@ ovs_bridge_init() {
 	[ -n "$controller" ] && \
 		ovs-vsctl set-controller "$name" "$controller"
 }
+
+ovs_set_ssl() {
+	local ca="$(uci -q get openvswitch.ovs.ca)"
+	[ -f "$ca" ] || return
+	local cert="$(uci get openvswitch.ovs.cert)"
+	[ -f "$cert" ] || return
+	local key="$(uci get openvswitch.ovs.key)"
+	[ -f "$key" ] || return
+
+	ovs-vsctl set-ssl "$key" "$cert" "$ca"
+}

feeds/openflow/openvswitch/openvswitch.mk

@@ -5,7 +5,7 @@
 
 # Versions
 
-ovs_version:=2.15.0
+ovs_version:=2.16.0
 ovs_builddir=$(KERNEL_BUILD_DIR)/openvswitch-$(ovs_version)
 
 # Shared vars, macros

feeds/openflow/openvswitch/patches/0002-python-separate-host-target-python-for-cross-compile.patch

@@ -22,7 +22,7 @@ Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
  BUILT_SOURCES =
 --- a/m4/openvswitch.m4
 +++ b/m4/openvswitch.m4
-@@ -383,6 +383,8 @@ else:
+@@ -372,6 +372,8 @@ else:
       AC_MSG_ERROR([Python 3.4 or later is required but not found in $PATH, please install it or set $PYTHON3 to point to it])
     fi
     AC_ARG_VAR([PYTHON3])

feeds/openflow/openvswitch/patches/0004-build-trim-build.patch

@@ -10,7 +10,7 @@ Signed-off-by: Yousong Zhou <zhouyousong@yunionyun.com>
 
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -475,12 +475,10 @@ dist-docs:
+@@ -477,12 +477,10 @@ dist-docs:
  	VERSION=$(VERSION) MAKE='$(MAKE)' $(srcdir)/build-aux/dist-docs $(srcdir) $(docs)
  .PHONY: dist-docs
  

feeds/openflow/openvswitch/patches/0007-build-only-link-libopenvswitch-with-libunwind-libunb.patch

@@ -32,7 +32,7 @@ Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
  Cflags: -I${includedir}/openvswitch
 --- a/m4/openvswitch.m4
 +++ b/m4/openvswitch.m4
-@@ -657,7 +657,8 @@ AC_DEFUN([OVS_CHECK_UNBOUND],
+@@ -646,7 +646,8 @@ AC_DEFUN([OVS_CHECK_UNBOUND],
    [AC_CHECK_LIB(unbound, ub_ctx_create, [HAVE_UNBOUND=yes], [HAVE_UNBOUND=no])
     if test "$HAVE_UNBOUND" = yes; then
       AC_DEFINE([HAVE_UNBOUND], [1], [Define to 1 if unbound is detected.])
@@ -42,7 +42,7 @@ Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
     fi
     AM_CONDITIONAL([HAVE_UNBOUND], [test "$HAVE_UNBOUND" = yes])
     AC_SUBST([HAVE_UNBOUND])])
-@@ -669,7 +670,8 @@ AC_DEFUN([OVS_CHECK_UNWIND],
+@@ -658,7 +659,8 @@ AC_DEFUN([OVS_CHECK_UNWIND],
     [HAVE_UNWIND=no])
     if test "$HAVE_UNWIND" = yes; then
       AC_DEFINE([HAVE_UNWIND], [1], [Define to 1 if unwind is detected.])

feeds/third-party/chilli-redirect/Makefile

@@ -0,0 +1,35 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=chilli-redirect
+PKG_RELEASE:=1
+
+PKG_LICENSE:=BSD-3-Clause
+PKG_MAINTAINER:=John Crispin <john@phrozen.org>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/chilli-redirect
+  SUBMENU:=Captive Portals
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=Chilli-Redirect
+endef
+
+define Package/chilli-redirect/description
+ Chilli Captive portal redirect support.
+endef
+
+define Build/Prepare
+	mkdir -p $(PKG_BUILD_DIR)
+endef
+
+define Build/Compile/Default
+
+endef
+Build/Compile = $(Build/Compile/Default)
+
+define Package/chilli-redirect/install
+	$(CP) ./files/* $(1)
+endef
+
+$(eval $(call BuildPackage,chilli-redirect))

feeds/third-party/chilli-redirect/files/etc/uci-defaults/99-chilli

@@ -0,0 +1,23 @@
+#!/bin/sh
+rm /etc/config/chilli
+cat > /etc/config/chilli <<EOF
+config chilli
+	option disabled '0'
+	option domain 'lan'
+	option uamanydns '1'
+	option lease '900'
+	option redir '1'
+	option papalwaysok '1'
+	option adminupdatefile '/var/run/chilli/local.conf'
+	option wwwdir '/etc/chilli/www'
+	option wwwbin '/etc/chilli/wwwsh'
+	option conup '/etc/chilli/conup.sh'
+	option condown '/etc/chilli/condown.sh'
+	option ipup '/etc/chilli/up.sh'
+	option ipdown '/etc/chilli/down.sh'
+	option cmdsocket '/var/run/chilli/chilli.sock'
+	option unixipc 'ipc.sock'
+	option pidfile '/var/run/chilli/chilli.pid'
+	option kname 'chilli'
+	option debug 0
+EOF

feeds/third-party/chilli-redirect/files/usr/share/ucentral/templates/third-party/chilli-redirect.uc

@@ -0,0 +1,47 @@
+{%
+let interfaces = services.lookup_interfaces("chilli-redirect");
+let enable = length(interfaces);
+services.set_enabled("chilli", enable);
+if (!enable)
+	return;
+let name = ethernet.calculate_name(interfaces[0]);
+let keys = {
+	uamport: 3990,
+	radiusauthport: 1812,
+	radiusacctport: 1813,
+	radiusserver1: true,
+	radiusserver2: true,
+	radiusnasid: true,
+	uamallowed: true,
+	uamdomain: true,
+	defidletimeout: 0,
+	definteriminterval: 300,
+	acctupdate: 9,
+	uamserver: true,
+	radiussecret: true,
+	nasmac: true,
+	macauth: true,
+	macpassword: true,
+};
+%}
+
+set chilli.@chilli[0].dhcpif='{{ name }}'
+
+{% if (interfaces[0].role == "upstream"): %}
+set chilli.@chilli[0].net='198.18.0.0/255.255.254.0'
+set chilli.@chilli[0].statip='198.18.0.0/255.255.254.0'
+set chilli.@chilli[0].uamlisten='198.18.0.1'
+set chilli.@chilli[0].uamanyip='1'
+set chilli.@chilli[0].dns1='198.18.0.1'
+set chilli.@chilli[0].nasip='198.18.0.1'
+{% else %}
+set chilli.@chilli[0].net='10.0.0.0/255.255.254.0'
+set chilli.@chilli[0].statip='10.0.0.0/255.255.254.0'
+set chilli.@chilli[0].uamlisten='10.0.0.1'
+set chilli.@chilli[0].dns1='10.0.0.1'
+set chilli.@chilli[0].nasip='10.0.0.1'
+{% endif %}
+
+{% for (let k, v in keys): %}
+set chilli.@chilli[0].{{ k }}='{{ chilli_redirect[k] ? chilli_redirect[k] : v}}'
+{% endfor %}

feeds/third-party/coova-chilli/Config.in

@@ -0,0 +1,48 @@
+# CoovaChilli advanced configuration
+
+if PACKAGE_coova-chilli
+
+config COOVACHILLI_PROXY
+	bool "Enable support for chilli proxy. Required for AAA Proxy through http"
+	default n
+
+config COOVACHILLI_REDIR
+	bool "Enable support for redir server. Required for uamregex"
+	default n
+
+config COOVACHILLI_MINIPORTAL
+	bool "Enable support Coova miniportal"
+	default n
+
+config COOVACHILLI_USERAGENT
+	bool "Enable recording user-agent"
+	default n
+
+config COOVACHILLI_UAMDOMAINFILE
+	bool "Enable loading of mass uamdomains from file"
+	default n
+
+config COOVACHILLI_LARGELIMITS
+	bool "Enable larger limits for use with non-embedded systems"
+	default n
+
+config COOVACHILLI_JSONINTERFACE
+	bool "Enable the JSON interface for the CoovaChilli Controller"
+	default n
+
+choice
+	prompt "SSL library"
+	default COOVACHILLI_NOSSL
+
+config COOVACHILLI_NOSSL
+	bool "No SSL support"
+
+config COOVACHILLI_WOLFSSL
+	bool "wolfSSL"
+
+config COOVACHILLI_OPENSSL
+	bool "OpenSSL"
+
+endchoice
+
+endif

feeds/third-party/coova-chilli/Makefile

@@ -0,0 +1,153 @@
+#
+# Copyright (C) 2007-2018 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=coova-chilli
+PKG_VERSION:=1.5
+PKG_RELEASE:=4
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/coova/coova-chilli/tar.gz/$(PKG_VERSION)?
+PKG_HASH:=75e15fd00a870b8a95df1440977c688a05a109f90b57bf679b931101d427d0fb
+
+PKG_MAINTAINER:=Jaehoon You <teslamint@gmail.com>
+PKG_LICENSE:=GPL-2.0-or-later
+PKG_LICENSE_FILES:=COPYING
+
+PKG_FIXUP:=autoreconf
+PKG_INSTALL:=1
+PKG_BUILD_PARALLEL:=0
+
+PKG_CONFIG_DEPENDS:= \
+  COOVACHILLI_JSONINTERFACE \
+  COOVACHILLI_LARGELIMITS \
+  COOVACHILLI_MINIPORTAL \
+  COOVACHILLI_NOSSL \
+  COOVACHILLI_OPENSSL \
+  COOVACHILLI_PROXY \
+  COOVACHILLI_REDIR \
+  COOVACHILLI_UAMDOMAINFILE \
+  COOVACHILLI_USERAGENT \
+  COOVACHILLI_WOLFSSL \
+  IPV6
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/kernel.mk
+
+define Package/coova-chilli
+  SUBMENU:=Captive Portals
+  SECTION:=net
+  CATEGORY:=Network
+  DEPENDS:=+kmod-tun +librt +COOVACHILLI_MINIPORTAL:haserl \
+  +COOVACHILLI_WOLFSSL:libwolfssl +COOVACHILLI_OPENSSL:libopenssl \
+  +COOVACHILLI_JSONINTERFACE:libjson-c
+  TITLE:=Wireless LAN HotSpot controller (Coova Chilli Version)
+  URL:=https://coova.github.io/
+  MENU:=1
+endef
+
+define Package/coova-chilli/description
+	CoovaChilli is an open source access controller for wireless LAN
+	access points and is based on ChilliSpot. It is used for authenticating
+	users of a wireless (or wired) LAN. It supports web based login (UAM)
+	which is today's standard for public HotSpots and it supports Wireless
+	Protected Access (WPA) which is the standard of the future.
+	Authentication,	authorization and accounting (AAA) is handled by your
+	favorite radius server.
+endef
+
+define Package/coova-chilli/config
+  source "$(SOURCE)/Config.in"
+endef
+
+define KernelPackage/ipt-coova
+  URL:=http://www.coova.org/CoovaChilli
+  SUBMENU:=Netfilter Extensions
+  DEPENDS:=coova-chilli +kmod-ipt-core +libxtables
+  TITLE:=Coova netfilter module
+  FILES:=$(PKG_BUILD_DIR)/src/linux/xt_*.$(LINUX_KMOD_SUFFIX)
+  AUTOLOAD:=$(call AutoProbe,xt_coova)
+endef
+
+define KernelPackage/ipt-coova/description
+	Netfilter kernel module for CoovaChilli
+	Includes:
+	- coova
+endef
+
+DISABLE_NLS=
+
+TARGET_CFLAGS += $(FPIC) -Wno-error
+
+CONFIGURE_VARS += \
+       ARCH="$(LINUX_KARCH)" \
+       KERNEL_DIR="$(LINUX_DIR)"
+
+MAKE_FLAGS += \
+       ARCH="$(LINUX_KARCH)" \
+       KERNEL_DIR="$(LINUX_DIR)"
+
+MAKE_INSTALL_FLAGS += \
+       ARCH="$(LINUX_KARCH)" \
+       KERNEL_DIR="$(LINUX_DIR)" \
+       INSTALL_MOD_PATH="$(PKG_INSTALL_DIR)"
+
+define Build/Prepare
+$(call Build/Prepare/Default)
+	( cd $(PKG_BUILD_DIR) ; \
+		[ -f ./configure ] || { \
+			./bootstrap ; \
+		} \
+	)
+endef
+
+define Build/Configure
+	$(call Build/Configure/Default, \
+	$(if $(CONFIG_COOVACHILLI_PROXY),--enable,--disable)-chilliproxy \
+	$(if $(CONFIG_COOVACHILLI_REDIR),--enable,--disable)-chilliredir \
+	$(if $(CONFIG_COOVACHILLI_MINIPORTAL),--enable,--disable)-miniportal \
+	$(if $(CONFIG_COOVACHILLI_USERAGENT),--enable,--disable)-useragent \
+	$(if $(CONFIG_COOVACHILLI_LARGELIMITS),--enable,--disable)-largelimits \
+	$(if $(CONFIG_COOVACHILLI_JSONINTERFACE),--enable,--disable)-libjson \
+	$(if $(CONFIG_COOVACHILLI_JSONINTERFACE),--enable,--disable)-json \
+	$(if $(CONFIG_COOVACHILLI_UAMDOMAINFILE),--enable,--disable)-uamdomainfile \
+	$(if $(CONFIG_IPV6),--with,--without)-ipv6 \
+	$(if $(CONFIG_COOVACHILLI_WOLFSSL),--with,--without)-cyassl \
+	$(if $(CONFIG_COOVACHILLI_OPENSSL),--with,--without)-openssl \
+	$(if $(CONFIG_PACKAGE_kmod-ipt-coova),--with-nfcoova) \
+	--enable-chilliredir\
+	)
+endef
+
+define Package/coova-chilli/conffiles
+/etc/config/chilli
+endef
+
+define Package/coova-chilli/install
+	$(INSTALL_DIR) $(1)/etc
+	$(INSTALL_CONF) $(PKG_INSTALL_DIR)/etc/chilli.conf $(1)/etc/
+	$(INSTALL_DIR) $(1)/etc/chilli
+	$(CP) $(PKG_INSTALL_DIR)/etc/chilli/* $(1)/etc/chilli/
+	$(INSTALL_DIR) $(1)/etc/hotplug.d/iface
+	$(INSTALL_DATA) ./files/chilli.hotplug $(1)/etc/hotplug.d/iface/30-chilli
+	$(INSTALL_DIR) $(1)/usr/sbin
+	$(INSTALL_BIN) $(PKG_INSTALL_DIR)/usr/sbin/chilli* $(1)/usr/sbin/
+	$(INSTALL_DIR) $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib*.so.* $(1)/usr/lib/
+	$(if $(CONFIG_PACKAGE_kmod-ipt-coova), \
+		$(INSTALL_DIR) $(1)/usr/lib/iptables; \
+		$(CP) $(PKG_INSTALL_DIR)/usr/lib/iptables/lib*.so $(1)/usr/lib/iptables/ \
+	)
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) files/chilli.init $(1)/etc/init.d/chilli
+	$(INSTALL_DIR) $(1)/etc/config
+	$(INSTALL_DATA) files/chilli.config $(1)/etc/config/chilli
+endef
+
+$(eval $(call BuildPackage,coova-chilli))
+$(eval $(call KernelPackage,ipt-coova))

feeds/third-party/coova-chilli/files/chilli.config

@@ -0,0 +1,226 @@
+#
+# Sample Coova-Chilli configuration file
+#
+
+config chilli
+    # disable to running chilli. remove this option before running.
+    option disabled 1
+
+    # name of TUN device name. required.
+    option tundev 'tun0'
+
+    # name of network interface
+    option network ''
+
+    # Include this flag to include debug information.
+    #option debug 1
+
+    # Re-read configuration file at this interval. Will also cause new domain
+    # name lookups to be performed. Value is given in seconds.
+    #option interval 3600
+
+    # Directory to use for nonvolatile storage.
+    # The program must have write access to this directory.
+    # this option is currently ignored
+    #option statedir ./
+
+
+    # TUN parameters
+
+    # IP network address of external packet data network
+    # Used to allocate dynamic IP addresses and set up routing.
+    # Normally you do not need to uncomment this option.
+    #option net 192.168.182.0/24
+
+    # Dynamic IP address pool
+    # Used to allocate dynamic IP addresses to clients.
+    # If not set it defaults to the net tag.
+    # Do not uncomment this option unless you are an experienced user!
+    #option dynip 192.168.182.0/24
+
+    # Static IP address pool
+    # Used to allocate static IP addresses to clients.
+    # Do not uncomment this option unless you are an experienced user!
+    #option statip 192.168.182.0/24
+
+
+    # Primary DNS server.
+    # Will be suggested to the client.
+    # If omitted the system default will be used.
+    # Normally you do not need to uncomment this option.
+    #option dns1 172.16.0.5
+
+    # Secondary DNS server.
+    # Will be suggested to the client.
+    # If omitted the system default will be used.
+    # Normally you do not need to uncomment this option.
+    #option dns2 172.16.0.6
+
+    # Domain name
+    # Will be suggested to the client.
+    # Normally you do not need to uncomment this option.
+    #option domain key.chillispot.org
+
+    # Script executed after network interface has been brought up.
+    # Executed with the following parameters: <devicename> <ip address>
+    # <mask>
+    # Normally you do not need to modify this option.
+    option ipup /etc/chilli/up.sh
+
+    # Script executed after network interface has been taken down.
+    # Executed with the following parameters: <devicename> <ip address>
+    # <mask>
+    # Normally you do not need to modify this option.
+    option ipdown /etc/chilli/down.sh
+
+
+    # Radius parameters
+
+    # IP address to listen to
+    # Normally you do not need to uncomment this option.
+    #option radiuslisten 127.0.0.1
+
+    # IP address of radius server 1
+    # For most installations you need to modify this option.
+    option radiusserver1 rad01.chillispot.org
+
+    # IP address of radius server 2
+    # If you have only one radius server you should set radiusserver2 to the
+    # same value as radiusserver1.
+    # For most installations you need to modify this option.
+    option radiusserver2 rad02.chillispot.org
+
+    # Radius authentication port
+    # The UDP port number to use for radius authentication requests.
+    # The same port number is used for both radiusserver1 and radiusserver2.
+    # Normally you do not need to uncomment this option.
+    #option radiusauthport 1812
+
+    # Radius accounting port
+    # The UDP port number to use for radius accounting requests.
+    # The same port number is used for both radiusserver1 and radiusserver2.
+    # Normally you do not need to uncomment this option.
+    #option radiusacctport 1813
+
+    # Radius shared secret for both servers
+    # For all installations you should modify this option.
+    #option radiussecret testing123
+
+    # Radius NAS-Identifier
+    # Normally you do not need to uncomment this option.
+    #option radiusnasid nas01
+
+    # WISPr Location ID. Should be in the format: isocc=<ISO_Country_Code>,
+    # cc=<E.164_Country_Code>,ac=<E.164_Area_Code>,network=<ssid/ZONE>
+    # Normally you do not need to uncomment this option.
+    #option radiuslocationid isocc=us,cc=1,ac=408,network=ACMEWISP_NewarkAirport
+
+    # WISPr Location Name. Should be in the format:
+    # <HOTSPOT_OPERATOR_NAME>,<LOCATION>
+    # Normally you do not need to uncomment this option.
+    #option radiuslocationname ACMEWISP,Gate_14_Terminal_C_of_Newark_Airport
+
+
+    # Radius proxy parameters
+
+    # IP address to listen to
+    # Normally you do not need to uncomment this option.
+    #option proxylisten 10.0.0.1
+
+    # UDP port to listen to.
+    # If not specified a port will be selected by the system
+    # Normally you do not need to uncomment this option.
+    #option proxyport 1645
+
+    # Client(s) from which we accept radius requests
+    # Normally you do not need to uncomment this option.
+    #option proxyclient 10.0.0.1/24
+
+    # Radius proxy shared secret for all clients
+    # If not specified defaults to radiussecret
+    # Normally you do not need to uncomment this option.
+    #option proxysecret testing123
+
+
+    # DHCP Parameters
+
+    # Ethernet interface to listen to.
+    # This is the network interface which is connected to the access points.
+    # In a typical configuration this option should be set to eth1.
+    option dhcpif eth1
+
+    # Use specified MAC address.
+    # An address in the range  00:00:5E:00:02:00 - 00:00:5E:FF:FF:FF falls
+    # within the IANA range of addresses and is not allocated for other
+    # purposes.
+    # Normally you do not need to uncomment this option.
+    #option dhcpmac 00:00:5E:00:02:00
+
+    # Time before DHCP lease expires
+    # Normally you do not need to uncomment this option.
+    #option lease 600
+
+
+    # Universal access method (UAM) parameters
+
+    # URL of web server handling authentication.
+    option uamserver https://radius.chillispot.org/hotspotlogin
+
+    # URL of welcome homepage.
+    # Unauthenticated users will be redirected to this URL. If not specified
+    # users will be redirected to the uamserver instead.
+    # Normally you do not need to uncomment this option.
+    #option uamhomepage http://192.168.182.1/welcome.html
+
+    # Shared between chilli and authentication web server
+    #option uamsecret ht2eb8ej6s4et3rg1ulp
+
+    # IP address to listen to for authentication requests
+    # Do not uncomment this option unless you are an experienced user!
+    #option uamlisten 192.168.182.1
+
+    # TCP port to listen to for authentication requests
+    # Do not uncomment this option unless you are an experienced user!
+    #option uamport 3990
+
+    # Comma separated list of domain names, IP addresses or network segments
+    # the client can access without first authenticating.
+    # It is possible to specify this option multiple times.
+    # Normally you do not need to uncomment this option.
+    #option uamallowed www.chillispot.org,10.11.12.0/24
+
+    # Comma separated list of domain names
+    # the client can access without first authenticating.
+    # It is possible to specify this option multiple times.
+    # Normally you do not need to uncomment this option.
+    #option uamdomain .chillispot.org,.coova.org
+
+    # If this flag is given unauthenticated users are allowed to use
+    # any DNS server.
+    # Normally you do not need to uncomment this option.
+    #option uamanydns
+
+
+    # MAC authentication
+
+    # If this flag is given users will be authenticated only on their MAC
+    # address.
+    # Normally you do not need to uncomment this option.
+    #option macauth
+
+    # List of MAC addresses.
+    # The MAC addresses specified in this list will be authenticated only on
+    # their MAC address.
+    # this option is ignored if the macauth tag is given.
+    # It is possible to specify this option multiple times.
+    # Normally you do not need to uncomment this option.
+    #option macallowed 00-0A-5E-AC-BE-51,00-30-1B-3C-32-E9
+
+    # Password to use for MAC authentication.
+    # Normally you do not need to uncomment this option.
+    #option macpasswd password
+
+    # Suffix to add to MAC address in order to form the username.
+    # Normally you do not need to uncomment this option.
+    #option macsuffix suffix
+

feeds/third-party/coova-chilli/files/chilli.hotplug

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+[ "$ACTION" == "ifup" ] || exit 0
+
+[ "$INTERFACE" = "wan" ] && {
+	/etc/init.d/chilli restart
+}

feeds/third-party/coova-chilli/files/chilli.init

@@ -0,0 +1,93 @@
+#!/bin/sh /etc/rc.common
+
+START=90
+STOP=89
+USE_PROCD=1
+
+service_triggers() {
+	procd_add_reload_trigger "chilli"
+}
+
+config_cb() {
+	chilli_conf="/var/run/chilli_${2}.conf"
+	[ -e "$chilli_conf" ] && rm -f "$chilli_conf"
+}
+
+option_cb() {
+	case "$1" in
+		# ignored/internal settings
+		disabled)
+			;;
+		# UCI settings
+		network)
+			. /lib/functions/network.sh
+			local ifname
+			network_get_device ifname "$2"
+			echo "dhcpif=\"$ifname\"" >> "$chilli_conf"
+			;;
+		# boolean settings
+		acctupdate|chillixml|coanoipcheck|debug|dhcpbroadcast|dhcpmacset|dhcpnotidle|\
+		dhcpradius|dnsparanoia|domaindnslocal|eapolenable|fg|forgiving|framedservice|\
+		ieee8021q|injectwispr|ipv6|ipv6only|layer3|locationcopycalled|\
+		locationimmediateupdate|locationopt82|locationstopstart|macallowlocal|\
+		macauth|macauthdeny|macreauth|mmapring|mschapv2|noarpentries|noc2c|nochallenge|\
+		nodynip|noradallow|nosystemdns|nouamsuccess|nousergardendata|nowispr1|nowispr2|\
+		only8021q|openidauth|papalwaysok|patricia|postauthproxyssl|proxymacaccept|\
+		proxyonacct|radiusoriginalurl|radsec|redir|redirdnsreq|redirssl|redirurl|reload|\
+		routeonetone|scalewin|seskeepalive|statusfilesave|strictdhcp|strictmacauth|\
+		swapoctets|uamallowpost|uamanydns|uamanyip|uamauthedallowed|uamgardendata|\
+		uamnatanyip|uamotherdata|uamuissl|usetap|vlanlocation|wpaguests)
+			[ "$2" = "true" -o "$2" = "1" ] && echo "$1" >> "$chilli_conf"
+			;;
+		*)
+			echo "$1=\"$2\"" >> "$chilli_conf"
+			;;
+	esac
+}
+
+start_chilli() {
+	local cfg="$1"
+	local base="/var/run/chilli_${cfg}"
+
+	config_get_bool disabled "$1" 'disabled' 0
+	[ $disabled = 1 ] && return
+
+	procd_open_instance "$cfg"
+	procd_set_param command /usr/sbin/chilli
+	procd_set_param file "$chilli_conf"
+	procd_append_param command \
+		--fg \
+		--conf "${base}.conf" \
+		--pidfile "${base}.pid" \
+		--cmdsocket "${base}.sock" \
+		--unixipc "${base}.ipc"
+	procd_set_param respawn
+	procd_set_param stdout 1
+	procd_set_param stderr 1
+	procd_close_instance
+}
+
+start_service() {
+	config_load chilli
+	config_foreach start_chilli chilli
+}
+
+stop_service() {
+	rm -f /var/run/chilli_*
+}
+
+reload_chilli() {
+	local pid
+	local cfg="$1"
+	local base="/var/run/chilli_${cfg}"
+	if [ -f "${base}.pid" ]; then
+		pid="$(cat "${base}.pid")"
+		[ -f "/var/run/chilli.${pid}.cfg.bin" ] && rm -f "/var/run/chilli.${pid}.cfg.bin"
+		chilli_query -s "${base}.sock" reload
+	fi
+}
+
+reload_service() {
+	config_load chilli
+	config_foreach reload_chilli chilli
+}

feeds/third-party/coova-chilli/patches/100-fix_compile_kmod.patch

@@ -0,0 +1,13 @@
+--- a/src/linux/Makefile
++++ b/src/linux/Makefile
+@@ -25,8 +25,8 @@ lib%.o: lib%.c
+ 	$(CC) $(CFLAGS) -fPIC -O2 -Wall -D_INIT=lib$*_init -c -o $@ $<;
+ 
+ install: modules_install libxt_coova.so
+-	mkdir -p $(DESTDIR)/lib/xtables/
+-	cp libxt_coova.so $(DESTDIR)/lib/xtables/
++	mkdir -p $(DESTDIR)/usr/lib/iptables/
++	cp libxt_coova.so $(DESTDIR)/usr/lib/iptables/
+ 
+ distdir:
+ 

feeds/third-party/coova-chilli/patches/200-wolfssl.patch

@@ -0,0 +1,53 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -397,7 +397,7 @@ AC_ARG_WITH([cyassl],
+  [AS_HELP_STRING([--with-cyassl], [enable support for cyassl])],[],[with_cyassl=no])
+ 
+ AS_IF([test x"$with_cyassl" != xno],
+-  [AC_CHECK_LIB([cyassl], [CyaSSL_Init],
++  [AC_CHECK_LIB([cyassl], [wolfSSL_Init],
+               [AC_SUBST([LIBSSL], ["-lcyassl"])
+                AC_DEFINE([HAVE_CYASSL], [1],
+                          [Define if you have cyassl])
+--- a/src/ippool.c
++++ b/src/ippool.c
+@@ -35,6 +35,7 @@ int ippool_print(int fd, struct ippool_t
+   char * sep = "-- %-15s ------------------------------------------------------------\n";
+ 
+ #define ERR 0
++#undef USED /* defined in <wolfssl/wolfcrypt/integer.h> */
+ #define USED 1
+ #define FREE 2
+ #define LIST 3
+--- a/src/md5.h
++++ b/src/md5.h
+@@ -35,7 +35,6 @@
+ #define MD5Update MD5_Update
+ #define MD5Final MD5_Final
+ 
+-typedef struct CYASSL_MD5_CTX MD5_CTX;
+ #else
+ 
+ struct MD5Context {
+--- a/src/ssl.c
++++ b/src/ssl.c
+@@ -131,7 +131,7 @@ _openssl_env_init(openssl_env *env, char
+    */
+   const long options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_COMPRESSION;
+   env->meth = SSLv23_method();
+-  env->ctx = SSL_CTX_new(env->meth);
++  env->ctx = SSL_CTX_new((void *)env->meth);
+   SSL_CTX_set_options(env->ctx, options);
+   if (_options.sslciphers) {
+     SSL_CTX_set_cipher_list(env->ctx, _options.sslciphers);
+--- a/src/ssl.h
++++ b/src/ssl.h
+@@ -48,6 +48,8 @@ typedef struct {
+ #include <time.h>
+ #include <string.h>
+ 
++#define OPENSSL_NO_ENGINE
++#include <cyassl/options.h>
+ #include <cyassl/ssl.h>
+ #include <cyassl/openssl/bio.h>
+ #include <cyassl/openssl/crypto.h>

feeds/third-party/coova-chilli/patches/300-sysinfo.patch

@@ -0,0 +1,23 @@
+From 196b783b5ea7f8d6cf57ddbd41dc1881ef47a1c4 Mon Sep 17 00:00:00 2001
+From: Rosen Penev <rosenp@gmail.com>
+Date: Wed, 11 Dec 2019 19:33:58 -0800
+Subject: [PATCH] system.h: Fix compilation with kernel 4.19 + musl
+
+<linux/netlink.h> includes <linux/sysinfo.h> , which redefines struct sysinfo, leading to an error.
+Define the linux header as included to solve compilation.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+---
+ src/system.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/system.h
++++ b/src/system.h
+@@ -114,6 +114,7 @@
+ 
+ #ifdef HAVE_SYS_SYSINFO_H
+ #include <sys/sysinfo.h>
++#define _LINUX_SYSINFO_H
+ #else
+ #ifdef HAVE_LINUX_SYSINFO_H
+ #define _LINUX_KERNEL_H

feeds/third-party/coova-chilli/patches/400-fix-version.patch

@@ -0,0 +1,11 @@
+--- a/configure.ac
++++ b/configure.ac
+@@ -2,7 +2,7 @@
+ # Process this file with autoconf to produce a configure script.
+ 
+ AC_PREREQ([2.59])
+-AC_INIT([coova-chilli],[1.4],[https://github.com/coova/coova-chilli/issues])
++AC_INIT([coova-chilli],[1.5],[https://github.com/coova/coova-chilli/issues])
+ AC_CONFIG_SRCDIR([src/chilli.c])
+ 
+ AM_INIT_AUTOMAKE

feeds/tip/firstcontact/files/usr/share/ucentral/firstcontact.uc

@@ -43,8 +43,11 @@ if (!config.Redirector) {
 
 function store_config(path) {
 	let cursor = uci.cursor(path);
+	let redir = split(config.Redirector, ":");
+
 	cursor.load("ucentral");
-	cursor.set("ucentral", "config", "server", config.Redirector);
+	cursor.set("ucentral", "config", "server", redir[0]);
+	cursor.set("ucentral", "config", "port", redir[1] || 15002);
 	cursor.commit();
 }
 

feeds/tip/firstcontact/src/firstcontact.c

@@ -1,5 +1,6 @@
 #define _GNU_SOURCE
 #include <stdio.h>
+#include <unistd.h>
 #include <getopt.h>
 
 #include <curl/curl.h>
@@ -20,6 +21,8 @@ int main(int argc, char **argv)
 	char *devid = NULL;
 	char *url;
 
+	alarm(15);
+
 	while (1) {
 		int option = getopt(argc, argv, "k:c:o:hi:");
 
@@ -85,6 +88,7 @@ int main(int argc, char **argv)
 	curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
 	curl_easy_setopt(curl, CURLOPT_SSLKEY, file_key);
 	curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+	curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 10L);
 
 	res = curl_easy_perform(curl);
 	if (res != CURLE_OK)

feeds/ucentral/switch-fabric/Makefile

@@ -0,0 +1,34 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=switch-fabric
+PKG_RELEASE:=1
+
+PKG_LICENSE:=BSD-3-Clause
+PKG_MAINTAINER:=John Crispin <john@phrozen.org>
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/switch-fabric
+  SECTION:=ucentral
+  CATEGORY:=uCentral
+  TITLE:=switch-fabric
+endef
+
+define Package/switch-fabric/description
+ Allow configuring HW specific switch fabric features.
+endef
+
+define Build/Prepare
+	mkdir -p $(PKG_BUILD_DIR)
+endef
+
+define Build/Compile/Default
+
+endef
+Build/Compile = $(Build/Compile/Default)
+
+define Package/switch-fabric/install
+	$(CP) ./files/* $(1)
+endef
+
+$(eval $(call BuildPackage,switch-fabric))

feeds/ucentral/switch-fabric/files/etc/init.d/switch-fabric

@@ -0,0 +1,19 @@
+#!/bin/sh /etc/rc.common
+
+START=90
+USE_PROCD=1
+PROG=/usr/libexec/switch.sh
+
+reload_service() {
+	restart
+}
+
+service_triggers() {
+	procd_add_reload_trigger switch
+}
+
+start_service() {
+	procd_open_instance
+	procd_set_param command "$PROG"
+	procd_close_instance
+}

feeds/ucentral/switch-fabric/files/usr/libexec/switch.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+
+. /lib/functions.sh
+
+port_mirror() {
+	for lan in $(ls -d /sys/class/net/lan* | cut -dn -f3 |sort -n); do
+		tc qdisc del dev lan$lan clsact
+	done
+
+	monitor=$(uci get switch.mirror.monitor)
+	analysis=$(uci get switch.mirror.analysis)
+
+	[ -n "$monitor" -a -n "$analysis" ] || return
+
+	ifconfig $analysis up
+	for port in $monitor; do
+		tc qdisc add dev $port clsact
+		tc filter add dev $port ingress matchall skip_sw action mirred egress mirror dev $analysis
+		tc filter add dev $port egress matchall skip_sw action mirred egress mirror dev $analysis
+	done
+}
+
+port_mirror

feeds/ucentral/ucentral-client/Makefile

@@ -6,7 +6,7 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL=https://github.com/blogic/ucentral-client.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-02-15
-PKG_SOURCE_VERSION:=6e51960fe1d803ef93363882c9e11a75fc1c1805
+PKG_SOURCE_VERSION:=8cfed4cd068a3c08795ce08099993a66a1a1f1cf
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>

feeds/ucentral/ucentral-schema/Makefile

@@ -6,7 +6,7 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL=https://github.com/blogic/ucentral-schema.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-02-15
-PKG_SOURCE_VERSION:=b3c69b5ff1c57ac5b9b0e2f9359ea1f7b4b12d4c
+PKG_SOURCE_VERSION:=8dd7c83a1c7a290edf0575cbcba450d3bc91bbbe
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=BSD-3-Clause

feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/loop-detect.json

@@ -0,0 +1,104 @@
+{
+	"uuid": 2,
+	"radios": [
+		{
+			"band": "2G",
+			"country": "CA",
+			"channel-mode": "HE",
+			"channel-width": 80,
+			"channel": 32
+		}
+	],
+
+	"switch": {
+		"loop-detection": {
+			"roles": [ "downstream" ]
+		}
+	},
+
+	"interfaces": [
+		{
+			"name": "WAN",
+			"role": "upstream",
+			"services": [ "lldp" ],
+			"ethernet": [
+				{
+					"select-ports": [
+						"WAN*"
+					]
+				}
+			],
+			"ipv4": {
+				"addressing": "dynamic"
+			},
+			"ssids": [
+				{
+					"name": "OpenWifi",
+					"wifi-bands": [
+						"2G"
+					],
+					"bss-mode": "ap",
+					"encryption": {
+						"proto": "psk2",
+						"key": "OpenWifi",
+						"ieee80211w": "optional"
+					}
+				}
+			]
+		},
+		{
+			"name": "LAN",
+			"role": "downstream",
+			"services": [ "ssh", "lldp" ],
+			"ethernet": [
+				{
+					"select-ports": [
+						"LAN*"
+					]
+				}
+			],
+			"ipv4": {
+				"addressing": "static",
+				"subnet": "192.168.1.1/24",
+				"dhcp": {
+					"lease-first": 10,
+					"lease-count": 100,
+					"lease-time": "6h"
+				}
+			},
+			"ssids": [
+				{
+					"name": "OpenWifi",
+					"wifi-bands": [
+						"2G"
+					],
+					"bss-mode": "ap",
+					"encryption": {
+						"proto": "psk2",
+						"key": "OpenWifi",
+						"ieee80211w": "optional"
+					}
+				}
+			]
+
+		}
+	],
+	"metrics": {
+		"statistics": {
+			"interval": 120,
+			"types": [ "ssids", "lldp", "clients" ]
+		},
+		"health": {
+			"interval": 120
+		}
+	},
+	"services": {
+		"lldp": {
+			"describe": "uCentral",
+			"location": "universe"
+		},
+		"ssh": {
+			"port": 22
+		}
+	}
+}

feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/switch-fabric.json

@@ -0,0 +1,46 @@
+{
+	"uuid": 2,
+
+	"switch": {
+		"port-mirror": {
+			"monitor-ports": [ "WAN2" ],
+			"analysis-port": "WAN3"
+		}
+	},
+
+	"interfaces": [
+		{
+			"name": "WAN",
+			"role": "upstream",
+			"services": [ "lldp", "ssh" ],
+			"ethernet": [
+				{
+					"select-ports": [
+						"WAN*"
+					]
+				}
+			],
+			"ipv4": {
+				"addressing": "dynamic"
+			}
+		}
+	],
+	"metrics": {
+		"statistics": {
+			"interval": 120,
+			"types": [ "ssids", "lldp", "clients" ]
+		},
+		"health": {
+			"interval": 120
+		}
+	},
+	"services": {
+		"lldp": {
+			"describe": "uCentral",
+			"location": "universe"
+		},
+		"ssh": {
+			"port": 22
+		}
+	}
+}

feeds/ucentral/ucentral-schema/files/etc/ucentral/examples/switch-ports.json

@@ -0,0 +1,63 @@
+{
+	"uuid": 2,
+
+	"ethernet": [
+		{
+			"select-ports": [
+				"WAN1"
+			],
+			"speed": 100,
+			"duplex": "half"
+		},
+		{
+			"select-ports": [
+				"WAN2"
+			],
+			"speed": 1000,
+			"duplex": "full"
+		},
+		{
+			"select-ports": [
+				"WAN3"
+			],
+			"speed": 100,
+			"duplex": "half"
+		}
+	],
+
+	"interfaces": [
+		{
+			"name": "WAN",
+			"role": "upstream",
+			"services": [ "lldp", "ssh" ],
+			"ethernet": [
+				{
+					"select-ports": [
+						"WAN*"
+					]
+				}
+			],
+			"ipv4": {
+				"addressing": "dynamic"
+			}
+		}
+	],
+	"metrics": {
+		"statistics": {
+			"interval": 120,
+			"types": [ "ssids", "lldp", "clients" ]
+		},
+		"health": {
+			"interval": 120
+		}
+	},
+	"services": {
+		"lldp": {
+			"describe": "uCentral",
+			"location": "universe"
+		},
+		"ssh": {
+			"port": 22
+		}
+	}
+}

feeds/ucentral/ucentral-wifi/Makefile

@@ -6,7 +6,7 @@ PKG_RELEASE:=1
 PKG_SOURCE_URL=https://github.com/blogic/ucentral-wifi.git
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_DATE:=2021-04-13
-PKG_SOURCE_VERSION:=a7e2f706d37a6e0b996d2af49c3b8663becb3f08
+PKG_SOURCE_VERSION:=b47ad92ff36faacbf4047904a9971f7361262a06
 #PKG_MIRROR_HASH:=a8000b3cf43ce9ebfa7305661475fec98ec1dba2dc7b062028c2e17d7c2ec50b
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>

feeds/ucentral/ustp/Makefile

@@ -0,0 +1,41 @@
+#
+# Copyright (C) 2014-2021 OpenWrt.org
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=ustp
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL=$(PROJECT_GIT)/project/ustp.git
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2021-08-27
+PKG_SOURCE_VERSION:=25555611be916da7fe8cb53f85c741a51ddffa1c
+PKG_MIRROR_HASH:=d84d05b1a05279f2efe4aa6a27ac9590381636091cb1ec2aba72a604f58cddae
+
+PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name
+PKG_LICENSE:=GPL-2.0
+
+include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/cmake.mk
+
+define Package/ustp
+  SECTION:=net
+  CATEGORY:=Network
+  TITLE:=OpenWrt STP/RSTP daemon
+  DEPENDS:=+libubox +libubus
+endef
+
+TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include -flto
+TARGET_LDFLAGS += -flto -fuse-linker-plugin
+
+define Package/ustp/install
+	$(INSTALL_DIR) $(1)/sbin $(1)/etc/init.d
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ipkg-install/sbin/* $(1)/sbin/
+	$(INSTALL_BIN) ./files/ustpd.init $(1)/etc/init.d/ustpd
+endef
+
+$(eval $(call BuildPackage,ustp))

feeds/ucentral/ustp/files/ustpd.init

@@ -0,0 +1,14 @@
+#!/bin/sh /etc/rc.common
+# Copyright (c) 2021 OpenWrt.org
+
+START=50
+
+USE_PROCD=1
+PROG=/sbin/ustpd
+
+start_service() {
+	procd_open_instance
+	procd_set_param command "$PROG"
+	procd_set_param respawn
+	procd_close_instance
+}

feeds/wifi-ax/hostapd/patches/740-snoop_iface.patch

@@ -10,7 +10,36 @@
  
 --- a/src/ap/x_snoop.c
 +++ b/src/ap/x_snoop.c
-@@ -71,8 +71,12 @@ x_snoop_get_l2_packet(struct hostapd_dat
+@@ -31,14 +31,16 @@ int x_snoop_init(struct hostapd_data *ha
+ 		return -1;
+ 	}
+ 
+-	if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
++	if (!conf->snoop_iface[0] &&
++	    hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_HAIRPIN_MODE,
+ 					 1)) {
+ 		wpa_printf(MSG_DEBUG,
+ 			   "x_snoop: Failed to enable hairpin_mode on the bridge port");
+ 		return -1;
+ 	}
+ 
+-	if (hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) {
++	if (!conf->snoop_iface[0] &&
++	    hostapd_drv_br_port_set_attr(hapd, DRV_BR_PORT_ATTR_PROXYARP, 1)) {
+ 		wpa_printf(MSG_DEBUG,
+ 			   "x_snoop: Failed to enable proxyarp on the bridge port");
+ 		return -1;
+@@ -52,7 +54,8 @@ int x_snoop_init(struct hostapd_data *ha
+ 	}
+ 
+ #ifdef CONFIG_IPV6
+-	if (hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) {
++	if (!conf->snoop_iface[0] &&
++	    hostapd_drv_br_set_net_param(hapd, DRV_BR_MULTICAST_SNOOPING, 1)) {
+ 		wpa_printf(MSG_DEBUG,
+ 			   "x_snoop: Failed to enable multicast snooping on the bridge");
+ 		return -1;
+@@ -71,8 +74,12 @@ x_snoop_get_l2_packet(struct hostapd_dat
  {
  	struct hostapd_bss_config *conf = hapd->conf;
  	struct l2_packet_data *l2;

patches/0032-ipq40xx-add-tplink-ec420-support.patch

@@ -1,25 +1,38 @@
-From 07b09c01d002572c58d37de90d9b69d89a179de8 Mon Sep 17 00:00:00 2001
+From fa71a84201e148d5eb9c36cb7acb9d9d2fa8fca9 Mon Sep 17 00:00:00 2001
 From: John Crispin <john@phrozen.org>
 Date: Fri, 18 Jun 2021 11:07:02 +0200
 Subject: [PATCH 1/7] ipq40xx: add tplink ec420 support
 
 Signed-off-by: John Crispin <john@phrozen.org>
 ---
+ package/boot/uboot-envtools/files/ipq40xx     |   1 +
  package/firmware/ipq-wifi/Makefile            |   4 +-
  .../ipq-wifi/board-tp-link_ec420-g1.qca4019   | Bin 0 -> 607304 bytes
  .../ipq-wifi/board-tp-link_ec420-g1.qca9984   | Bin 0 -> 171916 bytes
  .../ipq40xx/base-files/etc/board.d/02_network |   3 +-
  .../etc/hotplug.d/firmware/11-ath10k-caldata  |  11 +-
  .../base-files/lib/upgrade/platform.sh        |   3 +-
- .../dts/qcom-ipq4019-tp-link-ec420-g1.dts     | 276 ++++++++++++++++++
+ .../dts/qcom-ipq4019-tp-link-ec420-g1.dts     | 275 ++++++++++++++++++
  target/linux/ipq40xx/image/generic.mk         |  15 +
  .../patches-5.4/998-tp-link-ec420-g1.patch    |  12 +
- 9 files changed, 316 insertions(+), 8 deletions(-)
+ 10 files changed, 316 insertions(+), 8 deletions(-)
  create mode 100644 package/firmware/ipq-wifi/board-tp-link_ec420-g1.qca4019
  create mode 100644 package/firmware/ipq-wifi/board-tp-link_ec420-g1.qca9984
  create mode 100755 target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-tp-link-ec420-g1.dts
  create mode 100644 target/linux/ipq40xx/patches-5.4/998-tp-link-ec420-g1.patch
 
+diff --git a/package/boot/uboot-envtools/files/ipq40xx b/package/boot/uboot-envtools/files/ipq40xx
+index b24cbf979e..44a8688dbe 100644
+--- a/package/boot/uboot-envtools/files/ipq40xx
++++ b/package/boot/uboot-envtools/files/ipq40xx
+@@ -59,6 +59,7 @@ linksys,ea8300 |\
+ linksys,mr8300)
+ 	ubootenv_add_uci_config "/dev/mtd7" "0x0" "0x40000" "0x20000"
+ 	;;
++tp-link,ec420-g1 |\
+ zyxel,nbg6617)
+ 	ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x10000" "0x10000"
+ 	;;
 diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
 index 513ad4ea67..87dcf9a769 100644
 --- a/package/firmware/ipq-wifi/Makefile
@@ -1148,10 +1161,10 @@ index 5582696759..530545e442 100644
  	alfa-network,ap120c-ac)
 diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-tp-link-ec420-g1.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-tp-link-ec420-g1.dts
 new file mode 100755
-index 0000000000..fc48e605d5
+index 0000000000..9f6fdd5e76
 --- /dev/null
 +++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-tp-link-ec420-g1.dts
-@@ -0,0 +1,276 @@
+@@ -0,0 +1,275 @@
 +// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 +
 +#include "qcom-ipq4019.dtsi"
@@ -1344,7 +1357,6 @@ index 0000000000..fc48e605d5
 +			partition5@e0000 {
 +				label = "0:APPSBLENV";
 +				reg = <0x000e0000 0x00010000>;
-+				read-only;
 +			};
 +			partition6@f0000 {
 +				label = "0:APPSBL";
@@ -1429,7 +1441,7 @@ index 0000000000..fc48e605d5
 +};
 +
 diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
-index 487bba77b0..ee648edc50 100644
+index 487bba77b0..860b5e03bf 100644
 --- a/target/linux/ipq40xx/image/generic.mk
 +++ b/target/linux/ipq40xx/image/generic.mk
 @@ -820,3 +820,18 @@ define Device/zyxel_wre6606
@@ -1448,7 +1460,7 @@ index 487bba77b0..ee648edc50 100644
 +	BLOCKSIZE := 128k
 +	PAGESIZE := 2048
 +	SUPPORTED_DEVICES := tp-link,ec420-g1
-+	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct ipq-wifi-tp-link_ec420-g1
++	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct ipq-wifi-tp-link_ec420-g1 uboot-envtools
 +endef
 +TARGET_DEVICES += tp-link_ec420_g1
 diff --git a/target/linux/ipq40xx/patches-5.4/998-tp-link-ec420-g1.patch b/target/linux/ipq40xx/patches-5.4/998-tp-link-ec420-g1.patch

patches/0040-netifd-fix-compile-on-older-kernels.patch

@@ -0,0 +1,54 @@
+From 5bf7a4a5befe6add789249fe02b737e353137146 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Wed, 4 Aug 2021 08:36:30 +0200
+Subject: [PATCH] netifd: fix compile on older kernels
+
+The ethtool features do not exist on ancient qualcomm kernels.
+Disable that feature if running on QCA.
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ .../config/netifd/patches/003-ethtool.patch   | 31 +++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+ create mode 100644 package/network/config/netifd/patches/003-ethtool.patch
+
+diff --git a/package/network/config/netifd/patches/003-ethtool.patch b/package/network/config/netifd/patches/003-ethtool.patch
+new file mode 100644
+index 0000000000..6aee86283e
+--- /dev/null
++++ b/package/network/config/netifd/patches/003-ethtool.patch
+@@ -0,0 +1,31 @@
++Index: netifd-2021-05-26-1eb0fafa/system-linux.c
++===================================================================
++--- netifd-2021-05-26-1eb0fafa.orig/system-linux.c
+++++ netifd-2021-05-26-1eb0fafa/system-linux.c
++@@ -1578,6 +1578,8 @@ int system_vlandev_del(struct device *vl
++ 	return system_link_del(vlandev->ifname);
++ }
++ 
+++#ifdef SPEED_400000
+++// ugly hack to detect if we are running on an ancient kernel
++ static void
++ system_set_ethtool_settings(struct device *dev, struct device_settings *s)
++ {
++@@ -1628,6 +1630,7 @@ system_set_ethtool_settings(struct devic
++ 	ecmd.cmd = ETHTOOL_SSET;
++ 	ioctl(sock_ioctl, SIOCETHTOOL, &ifr);
++ }
+++#endif
++ 
++ void
++ system_if_get_settings(struct device *dev, struct device_settings *s)
++@@ -1852,7 +1855,9 @@ system_if_apply_settings(struct device *
++ 		system_set_drop_unsolicited_na(dev, s->drop_unsolicited_na ? "1" : "0");
++ 	if (apply_mask & DEV_OPT_ARP_ACCEPT)
++ 		system_set_arp_accept(dev, s->arp_accept ? "1" : "0");
+++#ifdef SPEED_400000
++ 	system_set_ethtool_settings(dev, s);
+++#endif
++ }
++ 
++ int system_if_up(struct device *dev)
+-- 
+2.25.1
+

patches/0041-ipq40xx-add-Wallys-DR40x9-support.patch

@@ -0,0 +1,641 @@
+From 5a0366889960ae89594177854b77889cdf22ac63 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robert.marko@sartura.hr>
+Date: Fri, 13 Aug 2021 18:28:21 +0200
+Subject: [PATCH] ipq40xx: add Wallys DR40x9 support
+
+Adds support for the Wallys DR40x9 series boards.
+They come in IPQ4019 and IPQ4029 versions.
+IPQ4019/4029 only differ in that that IPQ4029 is the industrial version that is rated to higher temperatures.
+
+Specifications are:
+* CPU: Qualcomm IPQ40x9 (4x ARMv7A Cortex A7) at 716 MHz
+* RAM: 512 MB
+* Storage: 2MB of SPI-NOR, 128 MB of parallel NAND
+* USB 3.0 TypeA port for users
+* MiniPCI-E with PCI-E 2.0 link
+* MiniPCI-E for LTE modems with only USB2.0 link
+* 2 SIM card slots that are selected via GPIO11
+* MicroSD card slot
+* Ethernet: 2x GBe with 24~48V passive POE
+* SFP port (Untested, I have no way to test it)
+* DC Jack
+* UART header
+* WLAN: In-SoC 2x2 802.11b/g/n and 2x2 802.11a/n/ac
+* 4x MMCX connectors for WLAN
+* Reset button
+* 8x LED-s
+
+Installation instructions:
+Connect to UART, pins are like this:
+-> 3.3V | TX | RX | GND
+
+Settings are 115200 8n1
+
+Boot initramfs from TFTP:
+tftpboot 0x84000000 openwrt-ipq40xx-generic-wallys_dr40x9-initramfs-fit-uImage.itb
+
+bootm
+
+Then copy the sysupgrade image to the /tmp folder and execute sysupgrade -n <image_name>
+
+Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+---
+ package/firmware/ipq-wifi/Makefile            |   2 +
+ .../ipq-wifi/board-wallys_dr40x9.qca4019      | Bin 0 -> 24316 bytes
+ .../ipq40xx/base-files/etc/board.d/02_network |   3 +-
+ .../base-files/etc/board.d/03_gpio_switches   |   3 +
+ .../etc/hotplug.d/firmware/11-ath10k-caldata  |   6 +-
+ .../base-files/lib/upgrade/platform.sh        |   1 +
+ .../arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts | 387 ++++++++++++++++++
+ target/linux/ipq40xx/image/generic.mk         |  13 +
+ .../901-arm-boot-add-dts-files.patch          |   3 +-
+ 9 files changed, 414 insertions(+), 4 deletions(-)
+ create mode 100644 package/firmware/ipq-wifi/board-wallys_dr40x9.qca4019
+ create mode 100644 target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts
+
+diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
+index 87dcf9a769..192e8dcf7e 100644
+--- a/package/firmware/ipq-wifi/Makefile
++++ b/package/firmware/ipq-wifi/Makefile
+@@ -49,6 +49,7 @@ ALLWIFIBOARDS:= \
+ 	plasmacloud_pa2200 \
+ 	qxwlan_e2600ac \
+ 	cig_wf610d \
++	wallys_dr40x9 \
+ 	tp-link_ec420-g1
+ 
+ ALLWIFIPACKAGES:=$(foreach BOARD,$(ALLWIFIBOARDS),ipq-wifi-$(BOARD))
+@@ -135,5 +136,6 @@ $(eval $(call generate-ipq-wifi-package,plasmacloud_pa2200,Plasma Cloud PA2200))
+ $(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac,Qxwlan E2600AC))
+ $(eval $(call generate-ipq-wifi-package,cig_wf610d,CIG WF_610D))
+ $(eval $(call generate-ipq-wifi-package,tp-link_ec420-g1,tp-link EC420-G1))
++$(eval $(call generate-ipq-wifi-package,wallys_dr40x9,Wallys DR40X9))
+ 
+ $(foreach PACKAGE,$(ALLWIFIPACKAGES),$(eval $(call BuildPackage,$(PACKAGE))))
+diff --git a/package/firmware/ipq-wifi/board-wallys_dr40x9.qca4019 b/package/firmware/ipq-wifi/board-wallys_dr40x9.qca4019
+new file mode 100644
+index 0000000000000000000000000000000000000000..9114eecbbdffb0c47192e9ea4d7b6055a1c4b470
+GIT binary patch
+literal 24316
+zcmeHPdr(tX8b1jj>SE!BfCzYj@Qj53A;lmO0z?`h1&fLVSOls_QldNz4?`F1_@EFG
+zfm$#`&@w2GrihG-4~WIu+8Jf`kNsn3|7bhg-R{h~s~zo5JF~mE=iYE338W?vrabN!
+z&N<&X_xsNI&hMTi_ulg(Zzsfs#O)P^hoywXr^TfUfJ`O>P>Msb9Drz;3gqQG^NR|C
+z3uKazcZwt>A(DeT!|+<c(fqQ5Sd|?XT#;WU$v<*z=l=ZS;_C7cK{_WaGfGB*{@$=J
+z?@*zTLIF0lG)@NA@3wB3<pHqK-U%uI&;fWY0@voxm`n!N6#x+t5kEeEPT|qlfuFxS
+z7fU1?*uetjp0QuEZY1y$3OqJlo3`pPwkGP1xDqF@1p<ohMI6CmB=p%bcHt4vb^^7H
+zcnur3o~nBp9EKG-O}{0UZf|dIXJ==lCjg9LGc{9Opq+klg?0U8W;Zitj!<SQD_kjQ
+z8pM{(v=~lid{EU`eJCp>i93En)mkmf+M5(V-mf~-P$qdhDRO)OYUPsjq&I$s^59Em
+zAQ=Bd)lglKl>`qCshX=LS-X>B#``cc*v5qpjSZDqqNHft;bGu5Fn(Qi7LM>%Qq=gT
+z&_Rkj^ukVxvQoG~u)CJ(lB{%Y*tA2SVSKNsRYQ4&iQ!?=!4Qx6YpVgJ`DeDWT6-Gv
+zE29ntW_YGdw3gK-%2)?n;>Y?+I}*<XmAU103}kmio$)Sr&hKr=mq!%@?Ae-hxA{oT
+zE=h2<OUxI2)gPsuVU=%v=k`El$6Jjdm7awoXN#(04ly&3s5{V3AZ2Ac$6W1|v<n+v
+zuk<Lo^+`onXsuU?bKc5AiHw#&z|MZdZ#Fq1&Mup`cx)v;@byaUGxnDR_5&}7u#8Hj
+zQn1{{27WECn-=?Pb(vvq58vC(M*aMJ;h#Ul$H$l9!(e3Ct~a_SAwnX{B}5=IGd-2T
+z@PZ@!^waZaQ&ZR#5SQuit84r3vp;{Y--a1(b+D(}+WrsPIl>b*>;K}#(<eIHB@7qu
+zx?~Vuk3g-YwrLPcSYu=)hoehSVTXmWSdmzD(HaN#!Nz;Bj)qUbC__*Li9_R%a5Nk#
+zksq%;`9V`_`&<R^rsb|h3Js;PXpd-!JL=AI7dfF$h#MM@#<Sud#UsgRGAmicNBM{l
+zWut5s`w<)2f$m`K5QU*(2p63RLVaa^btWbrZzd{IopXN7fy5bge(H>PpdKs_Q39Iq
+zGyzFLQ&=gY2sGkp1QLx#v!X@1lc1mDL+PMj@*G>XB_F5<^^^Z1MenO+Ue)NWvZ(56
+zxF#j%V9pXCQ6f<?fdIKQOaNohye3gHK!B`}2#^Sn2#^Sn2#^S@VFWg_HzQuOH`#9@
+zX|(O^?MN(bJs}{ypykT&ef^xc^|!2?JH`e=tTx6PK857eEkxkO9I>#2r7|~UEtnp~
+zTszY}EXyOJoFe7OV*p@TrR*MgY+S-;-q=HLR&en0)ZjDpNcc3J6}*kq7J|XDT$Fl2
+z@c{yyzh~9~5Do$$KgSEQf&3s9iUAW=Hq*iZgW>7PFp@UdKDU*@$Z7QhJT3+Ncocv(
+zdxXO001&hu0X)F7&0B{6sta{v4lJFV@J&a(NJw?HA@Fj@flj3!ggX#$cbRIt{v#-t
+zp%C*Ng|e77Q6~Iw?H>8cR2dlH@Aqpa-OinEuTHl+C)&L?Gbit0k+Qk1y|cUL+ThU0
+z=-6iuzItr=0lj@Z%dT8kj5WabK}EEBVkZ>e0~N*B6T6`J{-=mtPwaqN4x&kq)sOCq
+zSq7^sP;>T-Q!{c4n=V}H)!fv6X-Z#RsLalWK1D}7QBRhqhz<l(0z`z0SR#=CaHcp2
+z59P6VB97JWuV+WKL~~`kA}B49ort8;BH58h3@z&-_L|!V@jXYBE9Dl)QqFz&D>?Vy
+zJ)=+{;l8RFXMnqOLqzf*ciX-WDmaJxmpS+1CF9)Rzyr|BevxypXJ@FsnsbjL`W`y&
+zyZt&FJKGudI{-IdT1v&=2u^s%0gQ9+J^j)j1=9_Cv;x<kPNxGb5#s9V3a~_oh4oEP
+z2-k&{46x3GE1%v?{{#J=i?{1;*E-js*(goe8#n(`C!ZU)8`e8JCnr0*9UKhlForgk
+z)YjxyE;(s)mdG+h$(*pQV}sNKum^rX%iXBp>K`e1It|Oy-%>!89~JZuQo+CvRPcDz
+z20Z220>?315WCY3ATBm`_SOl3?1e;tL}1M!Fw2>rk8}T@fBf~^Z@&2xL`BEL$2j*d
+z|MmC3JbCgr*k+1z&*O2zbe#REsek`qeIC9!oO^uN0q5K=P9vE1!NJzi=38JS=U#V*
+zd3W|ka}BEIJU`KA+v{{3G96k=o?~lQpKp)pi=^E9i!!kX-D8gp?=WU-^Sxj6+rA#w
+zwy7%=8RF2dZ)sKP8bz*{tG%hdpePk5a{aZ#njWP>D&~4(|0j0$USJS_4y|grVxO2b
+zIixwSJSt5Wb2TICZmCq9$_>{3UfrUQiQ~E6n8VmaU?9NFq>2nh#^h~Hr&2E6Bi^pL
+zt-K&D6AHL&=+LStCLG2m0-0d)uI7@m0`~icc1ZKFvPLQv^E6teN_tGVE65EW;azFA
+zE+p*)3~BO~Mx{QXlu37KuWPQT8=!Nl=8m#MS|Jn$d1yz~AL1c-VIkeSAH)Q3s$H6M
+zYPm8GhNM=XQkE*jn(OK=sZ1Eh4V}EBxuUF=?&rGe9GC&v99q=Jm4%8_c<_?4O1fJd
+z3Ipj-$i*pK=HyMyMP->ZP3VU?d^W*^DBaL@sLPeP3c=(kJXo&CktV}1FGDQ(TofMd
+zR98w9gj;Zj2XGFS$TGatCqpvl1d=F`D49TDH7pGiQzM(#ECTJrN3O=Uh17dgT-N+n
+zB{&yYv*pOK3yCM0rS1g|iT8RAo!zPMJ-k_bdHC4X_}0*R5Bcy=p*s2e>%a3jdagU8
+zDg3y%)G_sozTy^soxf~Lu5xH!7x%nZ4NY3#m)prcjml{Sqt{9=@ZV>a(e~Z%m$b&#
+z`4+q7)(q^s6jJYA@mhZWQ02$`rl6Y5MM_obsqkYi`#0^n)mPB6qt^Rfm+a4PDf-h?
+zfhSyLn(Oi_(G83W+JT0Sw9}jlH?f28#=wCOx$k?)TylFgk}knHZ#k0JH&CwTonn+a
+ziATE1ni6V)Wv=NDKTU27uHI7Uw7+lYaCc&h-*I|jd;gJ3u?+!L^!%$GlKL3=w!_XT
+zz1NOjj6UgGM$f(2m){ZB=u=M1ZR?d><el~{cg{K6wEsPhl#xy25BHaMrk)L|bUU<W
+z7Y;db5`k5Kz+!)a1O5)ytjvSQP<<ZP3I7ESe}6yt2Y-FT+t<g3;gbQD%`b4w<--${
+z`}J1aub(>xLAl>xwK3*_pKKx#m=}RLl=~M(X66z;tZio$##*bAocp!S*I)kYUB|T#
+zfGnCGNFDNXfC;i-_>hCYv4>fQrR0g(66eiRZKrwjfFgjL{cTZxrOSVwWQ4{DV4Qec
+z$cfKvzxH4$IPu2gS-WnEYfrTQntXd~Y?5=2?{zISBRTgAMUM1awg{NBXKadRuiw6G
+RC%DMKNY1^rza=f}@BfIFW;6f*
+
+literal 0
+HcmV?d00001
+
+diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
+index 9d03b620ce..cfcf518907 100755
+--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
++++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
+@@ -19,7 +19,8 @@ ipq40xx_setup_interfaces()
+ 	engenius,ens620ext|\
+ 	luma,wrtq-329acn|\
+ 	plasmacloud,pa1200|\
+-	plasmacloud,pa2200)
++	plasmacloud,pa2200|\
++	wallys,dr40x9)
+ 		ucidef_set_interfaces_lan_wan "eth0" "eth1"
+ 		;;
+ 	aruba,ap-303|\
+diff --git a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
+index c255707f91..e1f75fd4bd 100755
+--- a/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
++++ b/target/linux/ipq40xx/base-files/etc/board.d/03_gpio_switches
+@@ -19,6 +19,9 @@ cilab,meshpoint-one)
+ compex,wpj428)
+ 	ucidef_add_gpio_switch "sim_card_select" "SIM card select" "3" "0"
+ 	;;
++wallys,dr40x9)
++	ucidef_add_gpio_switch "sim_card_select" "SIM card select" "423" "0"
++	;;
+ esac
+ 
+ board_config_flush
+diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+index 56b9935541..561c8289e7 100644
+--- a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
++++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+@@ -115,7 +115,8 @@ case "$FIRMWARE" in
+ 	plasmacloud,pa2200 |\
+ 	qxwlan,e2600ac-c1 |\
+ 	qxwlan,e2600ac-c2 |\
+-	unielec,u4019-32m)
++	unielec,u4019-32m |\
++	wallys,dr40x9)
+ 		caldata_extract "0:ART" 0x1000 0x2f20
+ 		;;
+ 	devolo,magic-2-wifi-next)
+@@ -227,7 +228,8 @@ case "$FIRMWARE" in
+ 	plasmacloud,pa2200 |\
+ 	qxwlan,e2600ac-c1 |\
+ 	qxwlan,e2600ac-c2 |\
+-	unielec,u4019-32m)
++	unielec,u4019-32m |\
++	wallys,dr40x9)
+ 		caldata_extract "0:ART" 0x5000 0x2f20
+ 		;;
+ 	devolo,magic-2-wifi-next)
+diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+index f6fc828134..7ebe0396f6 100644
+--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
++++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+@@ -73,6 +73,7 @@ platform_do_upgrade() {
+ 	luma,wrtq-329acn |\
+ 	mobipromo,cm520-79f |\
+ 	qxwlan,e2600ac-c2 |\
++	wallys,dr40x9 |\
+ 	tp-link,ec420-g1)
+ 		nand_do_upgrade "$1"
+ 		;;
+diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts
+new file mode 100644
+index 0000000000..cb3296f5e5
+--- /dev/null
++++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq40x9-dr40x9.dts
+@@ -0,0 +1,387 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++
++#include "qcom-ipq4019.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/input.h>
++#include <dt-bindings/soc/qcom,tcsr.h>
++
++/ {
++	model = "Wallys DR40X9";
++	compatible = "wallys,dr40x9";
++
++	chosen {
++		bootargs-append = " ubi.mtd=ubi root=/dev/ubiblock0_1";
++	};
++
++	soc {
++		rng@22000 {
++			status = "okay";
++		};
++
++		mdio@90000 {
++			status = "okay";
++
++			pinctrl-0 = <&mdio_pins>;
++			pinctrl-names = "default";
++			reset-gpios = <&tlmm 41 GPIO_ACTIVE_LOW>;
++			reset-delay-us = <2000>;
++		};
++
++		ess-psgmii@98000 {
++			status = "okay";
++		};
++
++		counter@4a1000 {
++			compatible = "qcom,qca-gcnt";
++			reg = <0x4a1000 0x4>;
++		};
++
++		tcsr@1949000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1949000 0x100>;
++			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
++		};
++
++		tcsr@194b000 {
++			status = "okay";
++
++			/* select hostmode */
++			compatible = "qcom,tcsr";
++			reg = <0x194b000 0x100>;
++			qcom,usb-hsphy-mode-select = <TCSR_USB_HSPHY_HOST_MODE>;
++		};
++
++		ess_tcsr@1953000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1953000 0x1000>;
++			qcom,ess-interface-select = <TCSR_ESS_PSGMII>;
++		};
++
++		tcsr@1957000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1957000 0x100>;
++			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
++		};
++
++		usb2: usb2@60f8800 {
++			status = "okay";
++		};
++
++		usb3: usb3@8af8800 {
++			status = "okay";
++		};
++
++		crypto@8e3a000 {
++			status = "okay";
++		};
++
++		watchdog@b017000 {
++			status = "okay";
++		};
++
++		ess-switch@c000000 {
++			status = "okay";
++		};
++
++		edma@c080000 {
++			status = "okay";
++		};
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		reset {
++			label = "reset";
++			gpios = <&tlmm 18 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		wlan2g {
++			label = "dr4029:green:wlan2g";
++			gpios = <&tlmm 32 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "phy0tpt";
++		};
++
++		wlan5g {
++			label = "dr4029:green:wlan5g";
++			gpios = <&tlmm 50 GPIO_ACTIVE_LOW>;
++			linux,default-trigger = "phy1tpt";
++		};
++
++		wlan2g-strength {
++			label = "dr4029:green:wlan2g-strength";
++			gpios = <&tlmm 36 GPIO_ACTIVE_LOW>;
++		};
++
++		wlan5g-strength {
++			label = "dr4029:green:wlan5g-strength";
++			gpios = <&tlmm 39 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&tlmm {
++	mdio_pins: mdio_pinmux {
++		mux_1 {
++			pins = "gpio6";
++			function = "mdio";
++			bias-pull-up;
++		};
++		mux_2 {
++			pins = "gpio7";
++			function = "mdc";
++			bias-pull-up;
++		};
++	};
++
++	serial0_pins: serial0_pinmux {
++		mux {
++			pins = "gpio16", "gpio17";
++			function = "blsp_uart0";
++			bias-disable;
++		};
++	};
++
++	serial1_pins: serial1_pinmux {
++		mux {
++			pins = "gpio8", "gpio9";
++			function = "blsp_uart1";
++			bias-disable;
++		};
++	};
++
++	spi_0_pins: spi_0_pinmux {
++		pinmux {
++			function = "blsp_spi0";
++			pins = "gpio13", "gpio14", "gpio15";
++			drive-strength = <12>;
++			bias-disable;
++		};
++		pinmux_cs {
++			function = "gpio";
++			pins = "gpio12";
++			drive-strength = <2>;
++			bias-disable;
++			output-high;
++		};
++	};
++
++	nand_pins: nand_pins {
++		pullups {
++			pins =  "gpio52", "gpio53", "gpio58", "gpio59";
++			function = "qpic";
++			bias-pull-up;
++		};
++
++		pulldowns {
++			pins = "gpio54", "gpio55", "gpio56", "gpio57",
++				"gpio60", "gpio62", "gpio63", "gpio64",
++				"gpio65", "gpio66", "gpio67", "gpio68",
++				"gpio69";
++			function = "qpic";
++			bias-pull-down;
++		};
++	};
++
++	sd_pins: sd_pins {
++		pinmux {
++			function = "sdio";
++			pins = "gpio23", "gpio24", "gpio25", "gpio26",
++				"gpio28", "gpio29", "gpio30", "gpio31";
++			drive-strength = <10>;
++		};
++		pinmux_sd_clk {
++			function = "sdio";
++			pins = "gpio27";
++			drive-strength = <16>;
++		};
++		pinmux_sd7 {
++			function = "sdio";
++			pins = "gpio32";
++			drive-strength = <10>;
++			bias-disable;
++		};
++	};
++};
++
++&blsp_dma {
++	status = "okay";
++};
++
++&blsp1_spi1 {
++	status = "okay";
++
++	pinctrl-0 = <&spi_0_pins>;
++	pinctrl-names = "default";
++
++	cs-gpios = <&tlmm 12 GPIO_ACTIVE_HIGH>;
++
++	flash@0 {
++		compatible = "jedec,spi-nor";
++		spi-max-frequency = <24000000>;
++		reg = <0>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition0@0 {
++				label = "0:SBL1";
++				reg = <0x00000000 0x00040000>;
++				read-only;
++			};
++
++			partition1@40000 {
++				label = "0:MIBIB";
++				reg = <0x00040000 0x00020000>;
++				read-only;
++			};
++
++			partition2@60000 {
++				label = "0:QSEE";
++				reg = <0x00060000 0x00060000>;
++				read-only;
++			};
++
++			partition3@c0000 {
++				label = "0:CDT";
++				reg = <0x000c0000 0x00010000>;
++				read-only;
++			};
++
++			partition4@d0000 {
++				label = "0:DDRPARAMS";
++				reg = <0x000d0000 0x00010000>;
++				read-only;
++			};
++
++			partition5@e0000 {
++				label = "0:APPSBLENV"; /* uboot env */
++				reg = <0x000e0000 0x00010000>;
++				read-only;
++			};
++
++			partition6@f0000 {
++				label = "0:APPSBL"; /* uboot */
++				reg = <0x000f0000 0x00080000>;
++				read-only;
++			};
++
++			partition7@170000 {
++				label = "0:ART";
++				reg = <0x00170000 0x00010000>;
++				read-only;
++			};
++		};
++	};
++};
++
++&qpic_bam {
++	status = "okay";
++};
++
++&nand {
++	status = "okay";
++
++	pinctrl-0 = <&nand_pins>;
++	pinctrl-names = "default";
++
++	nand@0 {
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "ubi";
++				reg = <0x00000000 0x08000000>;
++			};
++		};
++	};
++};
++
++&blsp1_uart1 {
++	status = "okay";
++
++	pinctrl-0 = <&serial0_pins>;
++	pinctrl-names = "default";
++};
++
++&blsp1_uart2 {
++	status = "okay";
++
++	pinctrl-0 = <&serial1_pins>;
++	pinctrl-names = "default";
++};
++
++&cryptobam {
++	status = "okay";
++};
++
++&pcie0 {
++	status = "okay";
++
++	perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>;
++	wake-gpio = <&tlmm 40 GPIO_ACTIVE_LOW>;
++
++	/* Unpolulated slot */
++	bridge@0,0 {
++		reg = <0x00000000 0 0 0 0>;
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++	};
++};
++
++&vqmmc {
++	status = "okay";
++};
++
++&sdhci {
++	pinctrl-0 = <&sd_pins>;
++	pinctrl-names = "default";
++	cd-gpios = <&tlmm 22 GPIO_ACTIVE_LOW>;
++	vqmmc-supply = <&vqmmc>;
++	status = "okay";
++};
++
++&ethphy4 {
++	qcom,fiber-enable;
++};
++
++&gmac0 {
++	qcom,phy_mdio_addr = <3>;
++	qcom,poll_required = <1>;
++	qcom,forced_speed = <1000>;
++	qcom,forced_duplex = <1>;
++};
++
++&wifi0 {
++	status = "okay";
++
++	qcom,ath10k-calibration-variant = "Wallys-DR40X9";
++};
++
++&wifi1 {
++	status = "okay";
++
++	qcom,ath10k-calibration-variant = "Wallys-DR40X9";
++};
++
++&usb3_ss_phy {
++	status = "okay";
++};
++
++&usb3_hs_phy {
++	status = "okay";
++};
++
++&usb2_hs_phy {
++	status = "okay";
++};
+diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
+index e4e437bb95..7cbfecb233 100644
+--- a/target/linux/ipq40xx/image/generic.mk
++++ b/target/linux/ipq40xx/image/generic.mk
+@@ -834,6 +834,19 @@ define Device/zyxel_wre6606
+ endef
+ TARGET_DEVICES += zyxel_wre6606
+ 
++define Device/wallys_dr40x9
++	$(call Device/FitImage)
++	$(call Device/UbiFit)
++	DEVICE_VENDOR := Wallys
++	DEVICE_MODEL := DR40X9
++	SOC := qcom-ipq40x9
++	DEVICE_DTS_CONFIG := config@ap.dk07.1-c1
++	BLOCKSIZE := 128k
++	PAGESIZE := 2048
++	DEVICE_PACKAGES := ipq-wifi-wallys_dr40x9
++endef
++TARGET_DEVICES += wallys_dr40x9
++
+ define Device/tp-link_ec420_g1
+ 	$(call Device/FitImage)
+ 	$(call Device/UbiFit)
+diff --git a/target/linux/ipq40xx/patches-5.4/901-arm-boot-add-dts-files.patch b/target/linux/ipq40xx/patches-5.4/901-arm-boot-add-dts-files.patch
+index 492cc67b2c..4d686df304 100644
+--- a/target/linux/ipq40xx/patches-5.4/901-arm-boot-add-dts-files.patch
++++ b/target/linux/ipq40xx/patches-5.4/901-arm-boot-add-dts-files.patch
+@@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
+ 
+ --- a/arch/arm/boot/dts/Makefile
+ +++ b/arch/arm/boot/dts/Makefile
+-@@ -837,11 +837,60 @@ dtb-$(CONFIG_ARCH_QCOM) += \
++@@ -837,11 +837,61 @@ dtb-$(CONFIG_ARCH_QCOM) += \
+  	qcom-apq8074-dragonboard.dtb \
+  	qcom-apq8084-ifc6540.dtb \
+  	qcom-apq8084-mtp.dtb \
+@@ -68,6 +68,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
+ +	qcom-ipq4029-gl-b1300.dtb \
+ +	qcom-ipq4029-gl-s1300.dtb \
+ +	qcom-ipq4029-mr33.dtb \
+++	qcom-ipq40x9-dr40x9.dtb \
+  	qcom-ipq8064-ap148.dtb \
+  	qcom-msm8660-surf.dtb \
+  	qcom-msm8960-cdp.dtb \
+-- 
+2.25.1
+

patches/0042-base-files-fix-rootfs_data_max-support-during-sysupg.patch

@@ -0,0 +1,26 @@
+From b673b8dad0cb6392c7097dfe75b2919b13ecd1c6 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Tue, 17 Aug 2021 17:29:22 +0200
+Subject: [PATCH] base-files: fix rootfs_data_max support during sysupgrade
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ package/base-files/files/sbin/sysupgrade | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/package/base-files/files/sbin/sysupgrade b/package/base-files/files/sbin/sysupgrade
+index 7e0a00e13b..5a2d459013 100755
+--- a/package/base-files/files/sbin/sysupgrade
++++ b/package/base-files/files/sbin/sysupgrade
+@@ -357,6 +357,8 @@ if [ $TEST -eq 1 ]; then
+ 	exit 0
+ fi
+ 
++fw_printenv > /dev/null
++
+ install_bin /sbin/upgraded
+ v "Commencing upgrade. Closing all shell sessions."
+ 
+-- 
+2.25.1
+

patches/0042-ipq806x-add-edgecore_ssw2ac2600-support.patch

@@ -0,0 +1,590 @@
+From e5f38285a39a57f3f6faa6450e8b9e9847dfcc7a Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Wed, 18 Aug 2021 15:49:56 +0200
+Subject: [PATCH] ipq806x: add edgecore_ssw2ac2600 support
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ package/boot/uboot-envtools/files/ipq806x     |   1 +
+ package/firmware/ipq-wifi/Makefile            |   2 +
+ .../board-edgecore_ssw2ac2600.qca9984         | Bin 0 -> 24324 bytes
+ .../ipq806x/base-files/etc/board.d/01_leds    |   1 +
+ .../ipq806x/base-files/etc/board.d/02_network |   1 +
+ .../etc/hotplug.d/firmware/11-ath10k-caldata  |   2 +
+ .../ipq806x/base-files/etc/init.d/bootcount   |   1 +
+ .../base-files/lib/upgrade/platform.sh        |   1 +
+ .../arm/boot/dts/qcom-ipq8068-ssw2ac2600.dts  | 341 ++++++++++++++++++
+ target/linux/ipq806x/image/Makefile           |  14 +
+ .../0069-arm-boot-add-dts-files.patch         |   3 +-
+ 11 files changed, 366 insertions(+), 1 deletion(-)
+ create mode 100644 package/firmware/ipq-wifi/board-edgecore_ssw2ac2600.qca9984
+ create mode 100644 target/linux/ipq806x/files/arch/arm/boot/dts/qcom-ipq8068-ssw2ac2600.dts
+
+diff --git a/package/boot/uboot-envtools/files/ipq806x b/package/boot/uboot-envtools/files/ipq806x
+index 96a4ee6450..1b49fd51d4 100644
+--- a/package/boot/uboot-envtools/files/ipq806x
++++ b/package/boot/uboot-envtools/files/ipq806x
+@@ -31,6 +31,7 @@ ubootenv_mtdinfo () {
+ }
+ 
+ case "$board" in
++edgecore,ssw2ac2600 |\
+ edgecore,ecw5410)
+ 	ubootenv_add_uci_config "/dev/mtd11" "0x0" "0x10000" "0x10000"
+ 	;;
+diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
+index 192e8dcf7e..23fc4caa2e 100644
+--- a/package/firmware/ipq-wifi/Makefile
++++ b/package/firmware/ipq-wifi/Makefile
+@@ -33,6 +33,7 @@ ALLWIFIBOARDS:= \
+ 	devolo_magic-2-wifi-next \
+ 	dlink_dap2610 \
+ 	edgecore_ecw5410 \
++	edgecore_ssw2ac2600 \
+ 	edgecore_oap100 \
+ 	engenius_eap2200 \
+ 	engenius_emd1 \
+@@ -119,6 +120,7 @@ $(eval $(call generate-ipq-wifi-package,cellc_rtl30vw, Cell C RTL30VW))
+ $(eval $(call generate-ipq-wifi-package,devolo_magic-2-wifi-next,devolo Magic 2 WiFi next))
+ $(eval $(call generate-ipq-wifi-package,dlink_dap2610,D-Link DAP-2610))
+ $(eval $(call generate-ipq-wifi-package,edgecore_ecw5410,Edgecore ECW5410))
++$(eval $(call generate-ipq-wifi-package,edgecore_ssw2ac2600,Edgecore SSW2AC2600))
+ $(eval $(call generate-ipq-wifi-package,edgecore_oap100,Edgecore OAP100))
+ $(eval $(call generate-ipq-wifi-package,engenius_eap2200,EnGenius EAP2200))
+ $(eval $(call generate-ipq-wifi-package,engenius_emd1,EnGenius EMD1))
+diff --git a/package/firmware/ipq-wifi/board-edgecore_ssw2ac2600.qca9984 b/package/firmware/ipq-wifi/board-edgecore_ssw2ac2600.qca9984
+new file mode 100644
+index 0000000000000000000000000000000000000000..2c1992001d86268e0483b9e53ed4b563e224ada4
+GIT binary patch
+literal 24324
+zcmeHPeN+=y7JnH)J}sG$q9`3c1goeK0|h^#2wJq7)|7S8P(=c$7>lM6tOyq5L#PH#
+zk)SOLQb{PbK*6Pj7KMm{+M}HAIX$P{t+nl*ZU5Mw_MEnR+HQ}{?0YkrWC%pV*W$<A
+z%X{y>JNMrA-pycU-uvP6t6~?#Zd|)4eEovB4Y3KUL1tzqfTUW8Y5-zjNzLB3T$Q$K
+zero2f1!)<(R10>cFAt}Bse2Xbbktomf4@S#OR*<w`P1n;x2Nq@Z(s2As!dNtE(%{D
+z&E&xtfiPa+!rR$Ao***ufL4HFKmHZ0QUJ)_gdr1v0Wg(Bf*m3f0c8gwA|n3t(@#8!
+za0(zvGKMKmLOYK4R)215qNPVd@k#Tj0PxI8TVqS#8$9Fe4qkuV9q`QzFY(c3G)L4D
+zII0<n5xTgzI5|1-csy9s1VAU1gpn-9gEtqW$CdGDW=3FIq0P9Ae$=gxj}KrMUteFq
+zE+Y)=4rzog_pLd)XRI{(Y34v0kvHeyNV>QzO-Pm;3Ch`U8Q?PT|IdJt8qx?-$yCb&
+zRu}o9MFyajB?G|Nr;+IveG}PZkpVc!k^%S=)e9usOy^DCo9Oi|C6|)7|Da_6BFHMr
+zCWrio>2p(}**lp`CSNq$0}x9}DZLAsY05O^Q}Sx^oavm&aDoTics$J64gNrZiF&tI
+znv$;3e*DR2$mTP$6-N7z6vBd-@yjCP$N@5i^Z@Ok4l+X?pp~qGB@x;-kQEktt#*IX
+z#*NbW#emOuGaE0S8#*gEH~{v3`TC3BOs2=7MC*|9w{LD^&dw+euJADu`lrzTUS7^-
+z{~bG$5^3F?J3pFr0EFmN)Tr~x_e}4Z{%Ow9LUJM5PU-iN-<vj&QIrh822y60ECDQn
+zs!4Uc3HDU^$D2?=7v{4lENsqff<TJ<PqHk6CEx^(#}cvlB4QD)%08H1{Oa+Or-uqa
+zVx|it5(I=mB)B2KXAm<)Go*Zik54D!h&WN)jW~QAu}-v3x{_FluO-BUSR}q7#+MRH
+zMN6gOL^!^fuuP)n?C_#xP7;Y_R-8EG^Km34K7`K?KKM*xrf8;g6|w4vRrq>hy=c8O
+zf{6Gb0$)Zf6D^a{9|F6khN4qH;WfHtRj<}Gu}kO}NxC^hQ`dg+ruFS&u*CW`8CJY~
+zrKh3haPAhx%B#kfbDAP$s%*tTZ%e%<SD7Sx>eJp1z3vrtl05o1NE)5?1o+h0aaNbB
+zPLzwUUT$gDlql1n!{rveCQm7sMM4JybdbxVEDi&GEe2hYdW$@&r{D07Mx)#*i$$(F
+zje5I0X5eZ|qwa`$n|uj!IEF^(=&jKgl_+=1R(D)Nl49%H<t<lgnsZAOJJ!axT-MdA
+z^W=$(7f~Zry#^hOFz!)hx=hkxtf?z1fYS1gz8XVODGJhJtZ6JNQ)bHIEe<_K!&yzf
+za+7Rf$5lg{=D0dj{xqCiqo!23O%~nLYtX|)Y>`Ep9kk$TZ_C@d!rT-^Oh-R-C|B=R
+zJl}K0V9*q*74ju0bMUG{vC`u3>E({bnu4OO%9x(3FmACrMG@cA+tON7QM6YngIC{z
+zSCf^LLwS`}JM3p;PszQm*vkxC&t-|74SO<|C3~4+>$xnkv%$%ZW&oqNu?Lwu_O3F>
+z<$>)Sy^_``X_$M;_i%B?3+Ey#i6UIp*{f=Mwmz(UW^Ut!jCa=5JXtzDyQTk7*RyZ?
+z7vt*su073?Qz0e3FBP2Mqz^ytpU2PWx|rRxp>|&BjQv%8$?vT&1ZV^YFZIWrc~ay1
+zviHuK3mMH(y1*hlv$}I<W2819kH53_y0R-;AE?E1`>(ChhiRwh@?UJZvb8z-jeruL
+zY*lmI>!HQdvOE(@uWjm_SL=6lYSvrV_Iwak7jO*EuIyfK2&<T$=e_$~<L1W5$|nv9
+zG7F6ft)Z2|e6Nh+o)!Aw<NW=e+sodMtDapdRC#Ud>s@hbR*}z(UR&C(@4v9_?Z9%u
+zfs;M)^|Q-`Szf8vt}HthRER4*<n<q9oC`0Xall(qcYR;CtS$VEu%M_z@<w3sV@i)r
+zO}!bdq6)vfsc9#>Q(GmqGYTHt{lI?k+{C#Ia2WtDuI`>wy>Xw%r}@o%V(^O@)kE(K
+zcOzFe4U<n}-2vI0YlmcFA~ZAv{>%yv3Y--b6daW3;$}Ic9LCQv6%TWA!2ssuJjK-s
+zdSI?o&^DW^EBaD%b#<b?+wN^MO*{<`5Udfe!8Zt^#nE_-z>Oi0kXmu}{AG5{y!wx<
+z9XbX&J)~&d#$a+L@J0NTs{nFa1qPTx_-*8G<okPGce(C@bY;bKS>X?WGvDY5K!r2X
+zBWlRU0Mbjm2kX&wI{tds5Xeky)Y9=qo&zoe!^B?=<DVH6|2bd8zq;Ro%#4fL1Abb*
+zmVa|9=7zbk<J0y+Z-2;a{T=WNWB|hcOOj04>x7XQ++Rd}FB4rZ!tKjn;hlkWXpOo%
+zB#Cs5aLJ4g>3^pfN!FOVoSaE#n|R(XaR1aM9*<`NXycQa2Wr!ttn*{$vYfY$S7siU
+zvF*a@Anyg)kO64M{tD$%P=clbda*)S@1f*IN`3{-TMzjxXn+hrJJya>fGWs{S}~;4
+z04;VJ@?$(4G5}>*8Ro~sApbmsC^u^btsSEAwsUCE@iWp=IWOcP9>1ugk0jlap=rMf
+z0BjGyZL^!Ut%#!eVRPn~rP;y3obKVt0d>eR2a#EVpYQ#o8~vTlc|PbFAX~kJ&d%vz
+z^XbMubgp>{(wmT&b#+1-i;jsiQLS_{{KvJf{kpyO$=RVHlUeAKJNm4SKAn@wHg4XM
+zlAfW_R-XP#oxZWDwY~G=rM~MoM}C2IjyJL=*9XQLQ0JghK^b!rN}Yj9<I0#*Q0n|s
+zDlTJAKu4ZLyB-gJb|0AA;NhC6BWK3XB_{7UURB%B@_x@%d-B7T73*q*CL!)m_>26d
+zLa^Gj8kZ7MkyN@GM4BRT2_X?lq><zHer+9fB$BV#7bgVq;&}WyL6kTOUm-|(1M$!p
+z)P4wh3t`GIUxXncv*1r?a8MB3NeK?J>DuhE*mP}-ZMrtbHr-*SVo{9{cQ1Afci-a)
+z&mo-hA@m*%6!sOYQULIn23trlMP7E{L-6`g+`ZR$;qGrx6JS+i#oe<)Q6k)Ui?P+g
+zziJo>xPGX+MPtR?2LhVmB?|A)m<XxAbYOZhLb%08L;e}KKiq4h@&1g>-CG3XXBS`C
+zXP3Ks554LMX{h$W)IgjYYu9z~8gBP?>#GZLk`ki2FB=*Q3zCv!V+Q(~8%~zKq<Cie
+zz@=vW$&!~+o{^ya*>YXwNpSm8cYXEYoUI9qyRTFma`F>i2#@UVHPja#N=k~A^cyKj
+zPUBKe=qfA0ZDaSF&|zD`(r#mQLr!5ra`=+|O9p*mVN&wq#RGi?L*Zd4QP`RjRl3T-
+z^SeinJCeRff~d=nWR@IB%)M;j$u;_(oHVM`Csjlj1n%}p$~zN(bneSDGK9&+4I3)v
+z9rD}dopees*M{f%XZXmE)&Kdm=)-}T!mZ_o=U-ctAFy}&_7hDnR7aKuWC_!ons!&O
+zI1-XIJ-w?f=gnue0egJ5^`B2X8C4jv&u{0kcNDctj?FqaP5Ew9PVJhb^K$%^leS=P
+z;4x)jtS4=7aO#GKkaBeE!`jISel1TildJWlZSaF#aH8`#oV1N;=@a5SkBWNdj@W|N
+zr-wnfdz2mucMk<e23NgrwUPmewZoFcESW71u(0-QJ;crLr!n%Lo>QjKSFE`EJOBRI
+zS6_aKfc{q8z5A~}e*fKf-$0!=e7+sdpB>*Sdw6|KJqn*Soq<PBH@xU8JASuXI4TW?
+zyQfbV%r(T_&z?=mbKu4_eey6ay7|Mz8<}pnHFCIn`YrQ<^=0!B6dl<^VI%HonMxU*
+ztqHHuz01bjBYBLl`%u<v#jxUVzb~WJJ(3Tx+@c-1UAQc9S+bJ>?$)rAm_h1?Axnc6
+z#C5m~a2en-z-55T0GEMBI0Hj5@eJ(VZQRc6hmOI(?%l_2j0f!_EciQO-Hlwxc}Fn7
+z6#q}Yz4h&_-jDzI=#P((PF6w}+WzL>zJScwqV|3w_@^F-2jT9I{C>;zmMg7eaQ6(h
+zpTXRtb|Ti%gLOf6=XpW~K<%maoJ##=z!2E|&l55FC}KLaPY&ZcYB!20Os31daQ6s<
+zP5oap(>aNF2y-x*_Z~Mkmx0O50K)ZS5ZAAI75?)+0l0p9czZ@anV5StHix^X&bmfh
+zak%@@W{&f_Z!_S?nXx^rJzIa@E^v$!<8b#7Wo3ck+koY5x`XjpBg5?5doK7Nj2+EG
+
+literal 0
+HcmV?d00001
+
+diff --git a/target/linux/ipq806x/base-files/etc/board.d/01_leds b/target/linux/ipq806x/base-files/etc/board.d/01_leds
+index 74b94a29b4..05c63c817f 100755
+--- a/target/linux/ipq806x/base-files/etc/board.d/01_leds
++++ b/target/linux/ipq806x/base-files/etc/board.d/01_leds
+@@ -17,6 +17,7 @@ compex,wpq864)
+ 	ucidef_set_led_usbport "usb" "USB" "green:usb" "usb1-port1" "usb2-port1"
+ 	ucidef_set_led_usbport "pcie-usb" "PCIe USB" "green:usb-pcie" "usb3-port1"
+ 	;;
++edgecore,ssw2ac2600 |\
+ edgecore,ecw5410)
+ 	ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:wlan2g" "phy1tpt"
+ 	ucidef_set_led_wlan "wlan5g" "WLAN5G" "green:wlan5g" "phy0tpt"
+diff --git a/target/linux/ipq806x/base-files/etc/board.d/02_network b/target/linux/ipq806x/base-files/etc/board.d/02_network
+index 1a1cec51aa..146d42cb0a 100755
+--- a/target/linux/ipq806x/base-files/etc/board.d/02_network
++++ b/target/linux/ipq806x/base-files/etc/board.d/02_network
+@@ -27,6 +27,7 @@ tplink,vr2600v)
+ 	ucidef_add_switch "switch0" \
+ 		"1:lan" "2:lan" "3:lan" "4:lan" "6@eth1" "5:wan" "0@eth0"
+ 	;;
++edgecore,ssw2ac2600 |\
+ edgecore,ecw5410)
+ 	ucidef_set_interfaces_lan_wan "eth1" "eth0"
+ 	if [ -b "$(find_mtd_part 0:art)" ]; then
+diff --git a/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+index b9d0fec25e..ae8feba798 100644
+--- a/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
++++ b/target/linux/ipq806x/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+@@ -74,6 +74,7 @@ case "$FIRMWARE" in
+ 		caldata_extract "ART" 0x5000 0x2f20
+ 		ath10k_patch_mac $(mtd_get_mac_binary ART 0x18)
+ 		;;
++	edgecore,ssw2ac2600 |\
+ 	edgecore,ecw5410)
+ 		if [ -b "$(find_mtd_part 0:art)" ]; then
+ 			caldata_extract "0:art" 0x1000 0x2f20
+@@ -121,6 +122,7 @@ case "$FIRMWARE" in
+ 	;;
+ "ath10k/pre-cal-pci-0002:01:00.0.bin")
+ 	case $board in
++	edgecore,ssw2ac2600 |\
+ 	edgecore,ecw5410)
+ 		if [ -b "$(find_mtd_part 0:art)" ]; then
+ 			caldata_extract "0:art" 0x5000 0x2f20
+diff --git a/target/linux/ipq806x/base-files/etc/init.d/bootcount b/target/linux/ipq806x/base-files/etc/init.d/bootcount
+index cb32a4ed35..f555e1af9a 100755
+--- a/target/linux/ipq806x/base-files/etc/init.d/bootcount
++++ b/target/linux/ipq806x/base-files/etc/init.d/bootcount
+@@ -9,6 +9,7 @@ boot() {
+ 	asrock,g10)
+ 		asrock_bootconfig_mangle "bootcheck" && reboot
+ 		;;
++	edgecore,ssw2ac2600|\
+ 	edgecore,ecw5410)
+ 		fw_setenv bootcount 0
+ 		;;
+diff --git a/target/linux/ipq806x/base-files/lib/upgrade/platform.sh b/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
+index a5e18201df..f3ac923ccb 100644
+--- a/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
++++ b/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
+@@ -29,6 +29,7 @@ platform_do_upgrade() {
+ 		CI_ROOTPART="ubi_rootfs"
+ 		nand_do_upgrade "$1"
+ 		;;
++	edgecore,ssw2ac2600|\
+ 	edgecore,ecw5410)
+ 		part="$(awk -F 'ubi.mtd=' '{printf $2}' /proc/cmdline | sed -e 's/ .*$//')"
+ 		if [ "$part" = "rootfs1" ]; then
+diff --git a/target/linux/ipq806x/files/arch/arm/boot/dts/qcom-ipq8068-ssw2ac2600.dts b/target/linux/ipq806x/files/arch/arm/boot/dts/qcom-ipq8068-ssw2ac2600.dts
+new file mode 100644
+index 0000000000..b5608c2f94
+--- /dev/null
++++ b/target/linux/ipq806x/files/arch/arm/boot/dts/qcom-ipq8068-ssw2ac2600.dts
+@@ -0,0 +1,341 @@
++#include "qcom-ipq8064-v2.0.dtsi"
++
++#include <dt-bindings/input/input.h>
++#include <dt-bindings/soc/qcom,tcsr.h>
++
++/ {
++	model = "Edgecore SSW2AC2600";
++	compatible = "edgecore,ssw2ac2600", "qcom,ipq8064";
++
++	reserved-memory {
++		nss@40000000 {
++			reg = <0x40000000 0x1000000>;
++			no-map;
++		};
++
++		smem: smem@41000000 {
++			reg = <0x41000000 0x200000>;
++			no-map;
++		};
++
++		wifi_dump@44000000 {
++			reg = <0x44000000 0x600000>;
++			no-map;
++		};
++	};
++
++	cpus {
++		idle-states {
++			CPU_SPC: spc {
++				status = "disabled";
++			};
++		};
++	};
++
++	aliases {
++		serial1 = &gsbi1_serial;
++		mdio-gpio0 = &mdio0;
++		ethernet0 = &gmac3;
++		ethernet1 = &gmac2;
++
++		led-boot = &led_power_green;
++		led-failsafe = &led_power_red;
++		led-running = &led_power_green;
++		led-upgrade = &led_power_green;
++	};
++
++	chosen {
++		bootargs-append = " console=ttyMSM0,115200n8 root=/dev/ubiblock0_1";
++	};
++
++	keys {
++		compatible = "gpio-keys";
++		pinctrl-0 = <&button_pins>;
++		pinctrl-names = "default";
++
++		reset {
++			label = "reset";
++			gpios = <&qcom_pinmux 25 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
++			debounce-interval = <60>;
++			wakeup-source;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++		pinctrl-0 = <&led_pins>;
++		pinctrl-names = "default";
++
++		led_power_green: power_green {
++			label = "green:power";
++			gpios = <&qcom_pinmux 16 GPIO_ACTIVE_HIGH>;
++		};
++
++		wlan2g_green {
++			label = "green:wlan2g";
++			gpios = <&qcom_pinmux 23 GPIO_ACTIVE_LOW>;
++		};
++
++		wlan2g_yellow {
++			label = "yellow:wlan2g";
++			gpios = <&qcom_pinmux 24 GPIO_ACTIVE_LOW>;
++		};
++
++		wlan5g_green {
++			label = "green:wlan5g";
++			gpios = <&qcom_pinmux 26 GPIO_ACTIVE_LOW>;
++		};
++
++		led_power_red: power_red {
++			label = "red:power";
++			gpios = <&qcom_pinmux 28 GPIO_ACTIVE_LOW>;
++		};
++
++		wlan5g_yellow {
++			label = "yellow:wlan5g";
++			gpios = <&qcom_pinmux 59 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++
++&qcom_pinmux {
++	spi_pins: spi_pins {
++		mux {
++			pins = "gpio18", "gpio19";
++			function = "gsbi5";
++			drive-strength = <10>;
++			bias-pull-down;
++		};
++
++		clk {
++			pins = "gpio21";
++			function = "gsbi5";
++			drive-strength = <12>;
++			bias-pull-down;
++		};
++
++		cs {
++			pins = "gpio20";
++			function = "gpio";
++			drive-strength = <10>;
++			bias-pull-up;
++		};
++	};
++
++	led_pins: led_pins {
++		mux {
++			pins = "gpio16", "gpio23", "gpio24", "gpio26",
++				   "gpio28", "gpio59";
++			function = "gpio";
++			drive-strength = <2>;
++			bias-pull-up;
++		};
++	};
++
++	button_pins: button_pins {
++		mux {
++			pins = "gpio25";
++			function = "gpio";
++			drive-strength = <2>;
++			bias-pull-up;
++		};
++	};
++
++	uart1_pins: uart1_pins {
++		mux {
++			pins = "gpio51", "gpio52", "gpio53", "gpio54";
++			function = "gsbi1";
++			drive-strength = <12>;
++			bias-none;
++		};
++	};
++};
++
++&gsbi1 {
++	qcom,mode = <GSBI_PROT_UART_W_FC>;
++	status = "okay";
++
++	serial@12450000 {
++		status = "okay";
++
++		pinctrl-0 = <&uart1_pins>;
++		pinctrl-names = "default";
++	};
++};
++
++&gsbi5 {
++	qcom,mode = <GSBI_PROT_SPI>;
++	status = "okay";
++
++	spi4: spi@1a280000 {
++		status = "okay";
++		spi-max-frequency = <50000000>;
++
++		pinctrl-0 = <&spi_pins>;
++		pinctrl-names = "default";
++
++		cs-gpios = <&qcom_pinmux 20 GPIO_ACTIVE_HIGH>;
++
++		m25p80@0 {
++			compatible = "jedec,spi-nor";
++			#address-cells = <1>;
++			#size-cells = <1>;
++			spi-max-frequency = <50000000>;
++			reg = <0>;
++
++			partitions {
++				compatible = "qcom,smem-part";
++			};
++		};
++	};
++};
++
++&hs_phy_0 {		/* USB3 port 0 HS phy */
++	status = "okay";
++};
++
++&hs_phy_1 {		/* USB3 port 1 HS phy */
++	status = "okay";
++};
++
++&ss_phy_0 {		/* USB3 port 0 SS phy */
++	status = "okay";
++};
++
++&ss_phy_1 {		/* USB3 port 1 SS phy */
++	status = "okay";
++};
++
++&usb3_0 {
++	status = "okay";
++};
++
++&usb3_1 {
++	status = "okay";
++};
++
++&pcie1 {
++	status = "okay";
++
++	/delete-property/ pinctrl-0;
++	/delete-property/ pinctrl-names;
++	/delete-property/ perst-gpios;
++
++	bridge@0,0 {
++		reg = <0x00000000 0 0 0 0>;
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++
++		wifi@1,0 {
++			compatible = "qcom,ath10k";
++			status = "okay";
++			reg = <0x00010000 0 0 0 0>;
++			qcom,ath10k-calibration-variant = "Edgecore-ECW5410-L";
++		};
++	};
++};
++
++&pcie2 {
++	status = "okay";
++
++	/delete-property/ pinctrl-0;
++	/delete-property/ pinctrl-names;
++	/delete-property/ perst-gpios;
++
++	bridge@0,0 {
++		reg = <0x00000000 0 0 0 0>;
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++
++		wifi@1,0 {
++			compatible = "qcom,ath10k";
++			status = "okay";
++			reg = <0x00010000 0 0 0 0>;
++			qcom,ath10k-calibration-variant = "Edgecore-ECW5410-L";
++		};
++	};
++};
++
++&nand_controller {
++	status = "okay";
++
++	pinctrl-0 = <&nand_pins>;
++	pinctrl-names = "default";
++
++	nand@0 {
++		compatible = "qcom,nandcs";
++
++		reg = <0>;
++
++		nand-ecc-strength = <4>;
++		nand-bus-width = <8>;
++		nand-ecc-step-size = <512>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			rootfs1@0 {
++				label = "rootfs1";
++				reg = <0x0000000 0x4000000>;
++			};
++
++			rootfs2@4000000 {
++				label = "rootfs2";
++				reg = <0x4000000 0x4000000>;
++			};
++		};
++	};
++};
++
++&soc {
++	mdio1: mdio {
++		compatible = "virtual,mdio-gpio";
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		status = "okay";
++
++		pinctrl-0 = <&mdio0_pins>;
++		pinctrl-names = "default";
++
++		gpios = <&qcom_pinmux 1 GPIO_ACTIVE_HIGH &qcom_pinmux 0 GPIO_ACTIVE_HIGH>;
++
++		phy0: ethernet-phy@0 {
++			reg = <0>;
++		};
++
++		phy1: ethernet-phy@1 {
++			reg = <1>;
++		};
++	};
++};
++
++&gmac2 {
++	status = "okay";
++
++	qcom,id = <2>;
++	mdiobus = <&mdio0>;
++
++	phy-mode = "sgmii";
++	phy-handle = <&phy1>;
++};
++
++&gmac3 {
++	status = "okay";
++
++	qcom,id = <3>;
++	mdiobus = <&mdio1>;
++
++	phy-mode = "sgmii";
++	phy-handle = <&phy0>;
++};
++
++&adm_dma {
++	status = "okay";
++};
+diff --git a/target/linux/ipq806x/image/Makefile b/target/linux/ipq806x/image/Makefile
+index 93e7ba3151..8c000075c6 100644
+--- a/target/linux/ipq806x/image/Makefile
++++ b/target/linux/ipq806x/image/Makefile
+@@ -157,6 +157,20 @@ define Device/edgecore_ecw5410
+ endef
+ TARGET_DEVICES += edgecore_ecw5410
+ 
++define Device/edgecore_ssw2ac2600
++	$(call Device/FitImage)
++	$(call Device/UbiFit)
++	DEVICE_VENDOR := Edgecore
++	DEVICE_MODEL := SSW2AC2600
++	SOC := qcom-ipq8068
++	BLOCKSIZE := 128k
++	PAGESIZE := 2048
++	DEVICE_DTS := qcom-ipq8068-ssw2ac2600
++	DEVICE_DTS_CONFIG := config@v2.0-ap160
++	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct ipq-wifi-edgecore_ssw2ac2600
++endef
++TARGET_DEVICES += edgecore_ssw2ac2600
++
+ define Device/linksys_ea7500-v1
+ 	$(call Device/LegacyImage)
+ 	DEVICE_VENDOR := Linksys
+diff --git a/target/linux/ipq806x/patches-5.4/0069-arm-boot-add-dts-files.patch b/target/linux/ipq806x/patches-5.4/0069-arm-boot-add-dts-files.patch
+index b97d36fd7c..7cb1d9cc75 100644
+--- a/target/linux/ipq806x/patches-5.4/0069-arm-boot-add-dts-files.patch
++++ b/target/linux/ipq806x/patches-5.4/0069-arm-boot-add-dts-files.patch
+@@ -10,7 +10,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
+ 
+ --- a/arch/arm/boot/dts/Makefile
+ +++ b/arch/arm/boot/dts/Makefile
+-@@ -842,7 +842,25 @@ dtb-$(CONFIG_ARCH_QCOM) += \
++@@ -842,7 +842,26 @@ dtb-$(CONFIG_ARCH_QCOM) += \
+  	qcom-ipq4019-ap.dk04.1-c3.dtb \
+  	qcom-ipq4019-ap.dk07.1-c1.dtb \
+  	qcom-ipq4019-ap.dk07.1-c2.dtb \
+@@ -33,6 +33,7 @@ Signed-off-by: John Crispin <john@phrozen.org>
+ +	qcom-ipq8065-r7800.dtb \
+ +	qcom-ipq8065-rt4230w-rev6.dtb \
+ +	qcom-ipq8068-ecw5410.dtb \
+++	qcom-ipq8068-ssw2ac2600.dtb \
+  	qcom-msm8660-surf.dtb \
+  	qcom-msm8960-cdp.dtb \
+  	qcom-msm8974-fairphone-fp2.dtb \
+-- 
+2.25.1
+

patches/0043-ipq40xx-add-HFCL-ION4-support.patch

@@ -0,0 +1,398 @@
+From f9a7699980b31760712245ea1dab0641ac7425e1 Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 26 Aug 2021 17:34:47 +0200
+Subject: [PATCH] ipq40xx: add HFCL ION4 support
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ package/boot/uboot-envtools/files/ipq40xx     |   4 +
+ package/firmware/ipq-wifi/Makefile            |   4 +-
+ .../ipq40xx/base-files/etc/board.d/01_leds    |   4 +
+ .../ipq40xx/base-files/etc/board.d/02_network |   1 +
+ .../etc/hotplug.d/firmware/11-ath10k-caldata  |   6 +
+ .../base-files/lib/upgrade/platform.sh        |   1 +
+ .../arm/boot/dts/qcom-ipq4019-hfcl-ion4.dts   | 226 ++++++++++++++++++
+ target/linux/ipq40xx/image/generic.mk         |  18 ++
+ .../ipq40xx/patches-5.4/999-hfcl_ion.patch    |  12 +
+ 9 files changed, 275 insertions(+), 1 deletion(-)
+ create mode 100644 target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hfcl-ion4.dts
+ create mode 100644 target/linux/ipq40xx/patches-5.4/999-hfcl_ion.patch
+
+diff --git a/package/boot/uboot-envtools/files/ipq40xx b/package/boot/uboot-envtools/files/ipq40xx
+index ab489a6e18..fd7ad69eff 100644
+--- a/package/boot/uboot-envtools/files/ipq40xx
++++ b/package/boot/uboot-envtools/files/ipq40xx
+@@ -64,6 +64,10 @@ tp-link,ec420-g1 |\
+ zyxel,nbg6617)
+ 	ubootenv_add_uci_config "/dev/mtd6" "0x0" "0x10000" "0x10000"
+ 	;;
++hfcl,ion4)
++	env=$(ubootenv_mtdinfo)
++	ubootenv_add_uci_config $env
++	;;
+ esac
+ 
+ config_load ubootenv
+diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
+index 23fc4caa2e..e887e5ad1c 100644
+--- a/package/firmware/ipq-wifi/Makefile
++++ b/package/firmware/ipq-wifi/Makefile
+@@ -51,7 +51,8 @@ ALLWIFIBOARDS:= \
+ 	qxwlan_e2600ac \
+ 	cig_wf610d \
+ 	wallys_dr40x9 \
+-	tp-link_ec420-g1
++	tp-link_ec420-g1 \
++	hfcl_ion4
+ 
+ ALLWIFIPACKAGES:=$(foreach BOARD,$(ALLWIFIBOARDS),ipq-wifi-$(BOARD))
+ 
+@@ -139,5 +140,6 @@ $(eval $(call generate-ipq-wifi-package,qxwlan_e2600ac,Qxwlan E2600AC))
+ $(eval $(call generate-ipq-wifi-package,cig_wf610d,CIG WF_610D))
+ $(eval $(call generate-ipq-wifi-package,tp-link_ec420-g1,tp-link EC420-G1))
+ $(eval $(call generate-ipq-wifi-package,wallys_dr40x9,Wallys DR40X9))
++$(eval $(call generate-ipq-wifi-package,hfcl_ion4,HFCL ION4))
+ 
+ $(foreach PACKAGE,$(ALLWIFIPACKAGES),$(eval $(call BuildPackage,$(PACKAGE))))
+diff --git a/target/linux/ipq40xx/base-files/etc/board.d/01_leds b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
+index efd5d002db..85fa1bcfbf 100755
+--- a/target/linux/ipq40xx/base-files/etc/board.d/01_leds
++++ b/target/linux/ipq40xx/base-files/etc/board.d/01_leds
+@@ -70,6 +70,10 @@ zyxel,wre6606)
+ 	ucidef_set_led_wlan "wlan2g" "WLAN2G" "green:wlan2g" "phy0tpt"
+ 	ucidef_set_led_wlan "wlan5g" "WLAN5G" "green:wlan5g" "phy1tpt"
+ 	;;
++hfcl,ion4)
++	ucidef_set_led_wlan "wlan2g" "WLAN2G" "yellow:wlan2g" "phy0tpt"
++	ucidef_set_led_wlan "wlan5g" "WLAN5G" "red:wlan5g" "phy1tpt"
++	;;
+ esac
+ 
+ board_config_flush
+diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
+index cfcf518907..84596dcf88 100755
+--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
++++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
+@@ -33,6 +33,7 @@ ipq40xx_setup_interfaces()
+ 	netgear,ex6100v2|\
+ 	netgear,ex6150v2|\
+ 	tp-link,ec420-g1|\
++	hfcl,ion4|\
+ 	zyxel,wre6606)
+ 		ucidef_set_interface_wan "eth0"
+ 		;;
+diff --git a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+index 561c8289e7..d38decf77b 100644
+--- a/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
++++ b/target/linux/ipq40xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+@@ -162,6 +162,9 @@ case "$FIRMWARE" in
+ 	tp-link,ec420-g1)
+ 		caldata_extract "0:ART" 0x1000 0x2f20
+ 		;;
++	hfcl,ion4)
++		caldata_extract "0:ART" 4096 12064
++		;;
+ 	esac
+ 	;;
+ "ath10k/pre-cal-ahb-a800000.wifi.bin")
+@@ -272,6 +275,9 @@ case "$FIRMWARE" in
+ 		caldata_extract "ART" 0x5000 0x2f20
+ 		ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) -1)
+ 		;;
++	hfcl,ion4)
++		caldata_extract "0:ART" 20480 12064
++		;;
+ 	esac
+ 	;;
+ *)
+diff --git a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+index 7ebe0396f6..c404f32f41 100644
+--- a/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
++++ b/target/linux/ipq40xx/base-files/lib/upgrade/platform.sh
+@@ -74,6 +74,7 @@ platform_do_upgrade() {
+ 	mobipromo,cm520-79f |\
+ 	qxwlan,e2600ac-c2 |\
+ 	wallys,dr40x9 |\
++	hfcl,ion4 |\
+ 	tp-link,ec420-g1)
+ 		nand_do_upgrade "$1"
+ 		;;
+diff --git a/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hfcl-ion4.dts b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hfcl-ion4.dts
+new file mode 100644
+index 0000000000..7437b98c02
+--- /dev/null
++++ b/target/linux/ipq40xx/files/arch/arm/boot/dts/qcom-ipq4019-hfcl-ion4.dts
+@@ -0,0 +1,226 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++
++#include "qcom-ipq4019.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/input.h>
++#include <dt-bindings/soc/qcom,tcsr.h>
++
++/ {
++	model = "HFCL Ltd, ION4";
++	compatible = "hfcl,ion4";
++
++	aliases {
++/*		led-boot = &power_green;
++		led-failsafe = &power_red;
++		led-running = &power_green;
++		led-upgrade = &power_red;
++		label-mac-device = &wifi0;
++		*/
++	};
++
++	soc {
++		rng@22000 {
++			status = "okay";
++		};
++
++		mdio@90000 {
++			status = "okay";
++			pinctrl-0 = <&mdio_pins>;
++			pinctrl-names = "default";
++
++			/delete-node/ ethernet-phy@1;
++			/delete-node/ ethernet-phy@2;
++			/delete-node/ ethernet-phy@3;
++			/delete-node/ ethernet-phy@4;
++			/delete-node/ psgmii-phy@5;
++		};
++
++		tcsr@1949000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1949000 0x100>;
++			qcom,wifi_glb_cfg = <TCSR_WIFI_GLB_CFG>;
++		};
++
++		ess_tcsr@1953000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1953000 0x1000>;
++			qcom,ess-interface-select = <TCSR_ESS_PSGMII_RGMII5>;
++		};
++
++		tcsr@1957000 {
++			compatible = "qcom,tcsr";
++			reg = <0x1957000 0x100>;
++			qcom,wifi_noc_memtype_m0_m2 = <TCSR_WIFI_NOC_MEMTYPE_M0_M2>;
++		};
++
++		crypto@8e3a000 {
++			status = "okay";
++		};
++
++		watchdog@b017000 {
++			status = "okay";
++		};
++
++		ess-switch@c000000 {
++			switch_mac_mode = <0x3>; /* mac mode for RGMII RMII */
++			switch_lan_bmp = <0x0>; /* lan port bitmap */
++			switch_wan_bmp = <0x10>; /* wan port bitmap */
++		};
++
++		edma@c080000 {
++			status = "okay";
++			phy-mode = "rgmii-id";
++			qcom,num_gmac = <1>;
++			qcom,single-phy;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		power_red: power_red {
++			label = "yellow:wlan2g";
++			gpios = <&tlmm 45 GPIO_ACTIVE_LOW>;
++		};
++
++		power_green: power_green {
++			label = "red:wlan5g";
++			gpios = <&tlmm 46 GPIO_ACTIVE_HIGH>;
++		};
++	};
++};
++
++&tlmm {
++	serial_0_pins: serial_pinmux {
++		mux {
++			pins = "gpio16", "gpio17";
++			function = "blsp_uart0";
++			bias-disable;
++		};
++	};
++
++	nand_pins: nand_pins {
++		pullups {
++			pins = "gpio53", "gpio58", "gpio59";
++			function = "qpic";
++			bias-pull-up;
++		};
++
++		pulldowns {
++			pins = "gpio54", "gpio55", "gpio56",
++				"gpio57", "gpio60", "gpio61",
++				"gpio62", "gpio63", "gpio64",
++				"gpio65", "gpio66", "gpio67",
++				"gpio68", "gpio69";
++			function = "qpic";
++			bias-pull-down;
++		};
++	};
++
++	mdio_pins: mdio_pinmux {
++		mux_1 {
++			pins = "gpio6";
++			function = "mdio";
++			bias-pull-up;
++		};
++		mux_2 {
++			pins = "gpio7";
++			function = "mdc";
++			bias-pull-up;
++		};
++	};
++};
++
++&nand {
++	pinctrl-0 = <&nand_pins>;
++	pinctrl-names = "default";
++	status = "okay";
++
++	nand@0 {
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition0@0 {
++				label = "0:SBL1";
++				reg = <0x00000000 0x00100000>;
++				read-only;
++			};
++			partition1@100000 {
++				label = "0:MIBIB";
++				reg = <0x00100000 0x00100000>;
++				read-only;
++			};
++			partition2@200000 {
++				label = "0:BOOTCONFIG";
++				reg = <0x00200000 0x00100000>;
++				read-only;
++			};
++			partition3@300000 {
++				label = "0:QSEE";
++				reg = <0x00300000 0x00200000>;
++				read-only;
++			};
++			partition4@500000 {
++				label = "0:CDT";
++				reg = <0x00500000 0x00180000>;
++				read-only;
++			};
++			partition5@680000 {
++				label = "0:APPSBLENV";
++				reg = <0x00680000 0x00080000>;
++			};
++			partition6@700000 {
++				label = "0:APPSBL";
++				reg = <0x00700000 0x00400000>;
++				read-only;
++			};
++			partition7@b00000 {
++				label = "0:ART";
++				reg = <0x00b00000 0x00080000>;
++				read-only;
++			};
++			partition8@b80000 {
++				label = "kernel";
++				reg = <0x00b80000 0x1000000>;
++			};
++			partition8@180000 {
++				label = "ubi";
++				reg = <0x02b80000 0x5480000>;
++			};
++		};
++	};
++};
++
++&cryptobam {
++	status = "okay";
++};
++
++&blsp_dma {
++	status = "okay";
++};
++
++&blsp1_uart1 {
++	pinctrl-0 = <&serial_0_pins>;
++	pinctrl-names = "default";
++	status = "okay";
++};
++
++&qpic_bam {
++	status = "okay";
++};
++
++&wifi0 {
++	status = "okay";
++};
++
++&wifi1 {
++	status = "okay";
++};
++
++&gmac0 {
++	qcom,phy_mdio_addr = <0>;
++	qcom,poll_required = <1>;
++	vlan_tag = <0 0x20>;
++};
+diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
+index 93a896e75d..ac7a5c7dfa 100644
+--- a/target/linux/ipq40xx/image/generic.mk
++++ b/target/linux/ipq40xx/image/generic.mk
+@@ -861,3 +861,21 @@ define Device/tp-link_ec420_g1
+ 	DEVICE_PACKAGES := ath10k-firmware-qca9984-ct ipq-wifi-tp-link_ec420-g1 uboot-envtools
+ endef
+ TARGET_DEVICES += tp-link_ec420_g1
++
++define Device/hfcl_ion4
++	$(call Device/FitImage)
++	$(call Device/UbiFit)
++	DEVICE_VENDOR := HFCL
++	DEVICE_MODEL := ION4
++	SOC := qcom-ipq4019
++	DEVICE_DTS := qcom-ipq4019-hfcl-ion4
++	KERNEL_INSTALL := 1
++	KERNEL_SIZE := 4048k
++	BLOCKSIZE := 128k
++	PAGESIZE := 2048
++	BOARD_NAME := hfcl-ion4
++	IMAGES := nand-sysupgrade.bin
++	IMAGE/nand-sysupgrade.bin := sysupgrade-tar | append-metadata
++	DEVICE_PACKAGES := uboot-envtools
++endef
++TARGET_DEVICES += hfcl_ion4
+diff --git a/target/linux/ipq40xx/patches-5.4/999-hfcl_ion.patch b/target/linux/ipq40xx/patches-5.4/999-hfcl_ion.patch
+new file mode 100644
+index 0000000000..2b45b47521
+--- /dev/null
++++ b/target/linux/ipq40xx/patches-5.4/999-hfcl_ion.patch
+@@ -0,0 +1,12 @@
++Index: linux-5.4.111/arch/arm/boot/dts/Makefile
++===================================================================
++--- linux-5.4.111.orig/arch/arm/boot/dts/Makefile
+++++ linux-5.4.111/arch/arm/boot/dts/Makefile
++@@ -885,6 +885,7 @@ dtb-$(CONFIG_ARCH_QCOM) += \
++ 	qcom-ipq4019-wpj419.dtb \
++ 	qcom-ipq4019-wtr-m2133hp.dtb \
++ 	qcom-ipq4019-tp-link-ec420-g1.dtb \
+++	qcom-ipq4019-hfcl-ion4.dtb \
++ 	qcom-ipq4028-wpj428.dtb \
++ 	qcom-ipq4029-ap-303.dtb \
++ 	qcom-ipq4029-ap-303h.dtb \
+-- 
+2.25.1
+

profiles/chilli-redirect.yml

@@ -0,0 +1,9 @@
+---
+description: Add the chilli redirect dependencies
+feeds:
+  - name: third_party
+    path: ../../feeds/third-party
+
+packages:
+  - coova-chilli
+  - chilli-redirect

profiles/container.yml

@@ -1,6 +1,12 @@
 ---
 description: Add the container dependencies
+feeds:
+  - name: container
+    path: ../../feeds/container
 packages:
-  - procd-ujail
-  - procd-ujail-console
+  - apk
+  - uvol
   - uxc
+  - blockd
+  - procd-ujail-console
+  - kmod-veth

profiles/edgecore_ecw5211.yml

@@ -6,6 +6,7 @@ description: Build image for the Edgecore ECW5211
 image: bin/targets/ipq40xx/generic/openwrt-ipq40xx-generic-edgecore_ecw5211-squashfs-nand-sysupgrade.bin
 include:
   - ucentral-ap
+  - container
 packages:
   - ath10k-firmware-qca4019-ct-htt
   - ath10k-firmware-qca9888-ct-htt

profiles/edgecore_spw2ac1200.yml

@@ -6,6 +6,7 @@ description: Build image for the Edgecore spw2ac1200
 image: bin/targets/ipq40xx/generic/openwrt-ipq40xx-generic-edgecore_spw2ac1200-squashfs-nand-sysupgrade.bin
 include:
   - ucentral-ap
+  - container
 packages:
   - ath10k-firmware-qca4019-ct-htt
   - ath10k-firmware-qca9888-ct-htt

profiles/edgecore_ssw2ac2600.yml

@@ -0,0 +1,16 @@
+---
+profile: edgecore_ssw2ac2600
+target: ipq806x
+subtarget: generic
+description: Build image for the EdgeCore SSW2AC2600
+image: bin/targets/ipq806x/generic/openwrt-ipq806x-generic-edgecore_ssw2ac2600-squashfs-nand-sysupgrade.bin
+include:
+  - ucentral-ap
+packages:
+  - ath10k-firmware-qca4019-ct-htt
+  - ath10k-firmware-qca9888-ct-htt
+  - ath10k-firmware-qca9984-ct-htt
+diffconfig: |
+  # CONFIG_PACKAGE_ath10k-firmware-qca4019-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9888-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9984-ct is not set

profiles/fbwifi.yml

@@ -0,0 +1,8 @@
+---
+description: Add the FaceBook dependencies
+feeds:
+  - name: facebook
+    path: ../../feeds/facebook
+
+packages:
+  - fbwifi

profiles/hfcl_ion4.yml

@@ -0,0 +1,16 @@
+---
+profile: hfcl_ion4
+target: ipq40xx
+subtarget: generic
+description: Build image for the HFCL ION4
+image: bin/targets/ipq40xx/generic/openwrt-ipq40xx-generic-hfcl_ion4-squashfs-nand-sysupgrade.bin
+include:
+  - ucentral-ap
+packages:
+  - ath10k-firmware-qca4019-ct-htt
+  - ath10k-firmware-qca9888-ct-htt
+  - ath10k-firmware-qca9984-ct-htt
+diffconfig: |
+  # CONFIG_PACKAGE_ath10k-firmware-qca4019-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9888-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9984-ct is not set

profiles/linksys_e8450-ubi.yml

@@ -6,6 +6,7 @@ description: Build image for the Linksys E8450
 image: bin/targets/mediatek/mt7622/openwrt-mediatek-mt7622-linksys_e8450-ubi-squashfs-sysupgrade.itb
 include:
   - ucentral-ap
+  - container
 diffconfig: |
   CONFIG_TESTING_KERNEL=y
   CONFIG_TARGET_ROOTFS_INITRAMFS=y

profiles/mikrotik_nand.yml

@@ -6,3 +6,16 @@ description: Build image for the Mikrotik RouterBoards
 image: bin/targets/ar71xx/mikrotik/openwrt-ar71xx-mikrotik-nand-large-ac-squashfs-sysupgrade.bin
 include:
   - ucentral-ap-mikrotik
+packages:
+  - ath10k-firmware-qca4019-ct-htt
+  - ath10k-firmware-qca9888-ct-htt
+  - ath10k-firmware-qca9984-ct-htt
+  - ath10k-board-qca9887
+  - ath10k-board-qca9888
+  - ath10k-board-qca988x
+  - ath10k-board-qca9984
+  - ath10k-board-qca99x0
+diffconfig: |
+  # CONFIG_PACKAGE_ath10k-firmware-qca4019-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9888-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9984-ct is not set

profiles/realtek.yml

@@ -5,4 +5,17 @@ feeds:
     path: ../../feeds/realtek
 
 packages:
-  - realtek-poe=y
+  - realtek-poe
+  - kmod-sched-core
+  - kmod-sched
+  - kmod-sched-act-vlan
+  - kmod-sched-bpf
+  - kmod-sched-cake
+  - kmod-sched-connmark
+  - kmod-sched-ctinfo
+  - kmod-sched-flower
+  - kmod-sched-ipset
+  - kmod-sched-mqprio
+  - tc-full
+  - switch-fabric
+  - ustp

profiles/tplink_ec420.yml

@@ -6,6 +6,7 @@ description: Build image for the TP-Link EC420
 image: bin/targets/ipq40xx/generic/openwrt-ipq40xx-generic-tp-link_ec420_g1-squashfs-nand-sysupgrade.bin
 include:
   - ucentral-ap
+  - container
 packages:
   - ath10k-firmware-qca4019-ct-htt
   - ath10k-firmware-qca9888-ct-htt

profiles/ucentral-ap.yml

@@ -42,6 +42,8 @@ packages:
   - ucode
   - udhcpsnoop
   - usteer
+  - ustp
+  - libustream-openssl
   - udevmand
   - umdns
   - vxlan
@@ -65,3 +67,8 @@ diffconfig: |
   CONFIG_TARGET_PREINIT_SUPPRESS_STDERR=y
   CONFIG_TARGET_PREINIT_DISABLE_FAILSAFE=y
   # CONFIG_BATMAN_ADV_BATMAN_V is not set
+  # CONFIG_OPENVSWITCH_WITH_LIBUNBOUND is not set
+  # CONFIG_PACKAGE_libustream-wolfssl is not set
+  # CONFIG_LIBCURL_WOLFSSL is not set
+  CONFIG_LIBCURL_OPENSSL=y
+  # CONFIG_PACKAGE_libwolfssl is not set

profiles/wallys_dr40x9.yml

@@ -0,0 +1,16 @@
+---
+profile: wallys_dr40x9
+target: ipq40xx
+subtarget: generic
+description: Build image for the wallys dr40x9
+image: bin/targets/ipq40xx/generic/openwrt-ipq40xx-generic-wallys_dr40x9-squashfs-nand-sysupgrade.bin
+include:
+  - ucentral-ap
+packages:
+  - ath10k-firmware-qca4019-ct-htt
+  - ath10k-firmware-qca9888-ct-htt
+  - ath10k-firmware-qca9984-ct-htt
+diffconfig: |
+  # CONFIG_PACKAGE_ath10k-firmware-qca4019-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9888-ct is not set
+  # CONFIG_PACKAGE_ath10k-firmware-qca9984-ct is not set