Merge branch 'openwrt:master' into master

include/kernel-5.15

@@ -1,2 +1,2 @@
-LINUX_VERSION-5.15 = .92
+LINUX_VERSION-5.15 = .93
-LINUX_KERNEL_HASH-5.15.92 = 9f420451db99a31a4aade9a46487b39318340d228f5c87c6dc56d83477e6ef91
+LINUX_KERNEL_HASH-5.15.93 = e7ed24f2690bf0e11158ccfa8ddc5c0e8a4816d83c4055d205218853da9c5dad

package/boot/uboot-envtools/files/ramips

@@ -53,6 +53,7 @@ zte,mf283plus)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000" "0x10000"
 	;;
 asus,rt-ax53u|\
+asus,rt-ax54|\
 belkin,rt1800|\
 h3c,tx1800-plus|\
 h3c,tx1801-plus|\

package/boot/uboot-envtools/files/realtek

@@ -8,6 +8,14 @@ touch /etc/config/ubootenv
 board=$(board_name)
 
 case "$board" in
+apresia,aplgs120gtss)
+	idx="$(find_mtd_index u-boot-env)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x40000" "0x10000"
+	idx2="$(find_mtd_index u-boot-env2)"
+	[ -n "$idx2" ] && \
+		ubootenv_add_uci_sys_config "/dev/mtd$idx2" "0x0" "0x40000" "0x10000"
+	;;
 d-link,dgs-1210-10mp|\
 d-link,dgs-1210-10p|\
 d-link,dgs-1210-16|\

package/firmware/ipq-wifi/Makefile

@@ -26,6 +26,7 @@ endef
 
 ALLWIFIBOARDS:= \
 	aruba_ap-365 \
+	buffalo_wxr-5950ax12 \
 	devolo_magic-2-wifi-next \
 	dynalink_dl-wrx36 \
 	edgecore_eap102 \
@@ -125,6 +126,7 @@ endef
 # Add $(eval $(call generate-ipq-wifi-package,<devicename>,<display name>))
 
 $(eval $(call generate-ipq-wifi-package,aruba_ap-365,Aruba AP-365))
+$(eval $(call generate-ipq-wifi-package,buffalo_wxr-5950ax12,Buffalo WXR-5950AX12))
 $(eval $(call generate-ipq-wifi-package,devolo_magic-2-wifi-next,devolo Magic 2 WiFi next))
 $(eval $(call generate-ipq-wifi-package,dynalink_dl-wrx36,Dynalink DL-WRX36))
 $(eval $(call generate-ipq-wifi-package,edgecore_eap102,Edgecore EAP102))

package/kernel/mac80211/patches/subsys/311-wifi-mac80211-fix-and-simplify-unencrypted-drop-chec.patch

@@ -0,0 +1,87 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Thu, 1 Dec 2022 14:57:30 +0100
+Subject: [PATCH] wifi: mac80211: fix and simplify unencrypted drop check for
+ mesh
+
+ieee80211_drop_unencrypted is called from ieee80211_rx_h_mesh_fwding and
+ieee80211_frame_allowed.
+
+Since ieee80211_rx_h_mesh_fwding can forward packets for other mesh nodes
+and is called earlier, it needs to check the decryptions status and if the
+packet is using the control protocol on its own, instead of deferring to
+the later call from ieee80211_frame_allowed.
+
+Because of that, ieee80211_drop_unencrypted has a mesh specific check
+that skips over the mesh header in order to check the payload protocol.
+This code is invalid when called from ieee80211_frame_allowed, since that
+happens after the 802.11->802.3 conversion.
+
+Fix this by moving the mesh specific check directly into
+ieee80211_rx_h_mesh_fwding.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+Link: https://lore.kernel.org/r/20221201135730.19723-1-nbd@nbd.name
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2403,7 +2403,6 @@ static int ieee80211_802_1x_port_control
+ 
+ static int ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
+ {
+-	struct ieee80211_hdr *hdr = (void *)rx->skb->data;
+ 	struct sk_buff *skb = rx->skb;
+ 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+ 
+@@ -2414,31 +2413,6 @@ static int ieee80211_drop_unencrypted(st
+ 	if (status->flag & RX_FLAG_DECRYPTED)
+ 		return 0;
+ 
+-	/* check mesh EAPOL frames first */
+-	if (unlikely(rx->sta && ieee80211_vif_is_mesh(&rx->sdata->vif) &&
+-		     ieee80211_is_data(fc))) {
+-		struct ieee80211s_hdr *mesh_hdr;
+-		u16 hdr_len = ieee80211_hdrlen(fc);
+-		u16 ethertype_offset;
+-		__be16 ethertype;
+-
+-		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr))
+-			goto drop_check;
+-
+-		/* make sure fixed part of mesh header is there, also checks skb len */
+-		if (!pskb_may_pull(rx->skb, hdr_len + 6))
+-			goto drop_check;
+-
+-		mesh_hdr = (struct ieee80211s_hdr *)(skb->data + hdr_len);
+-		ethertype_offset = hdr_len + ieee80211_get_mesh_hdrlen(mesh_hdr) +
+-				   sizeof(rfc1042_header);
+-
+-		if (skb_copy_bits(rx->skb, ethertype_offset, &ethertype, 2) == 0 &&
+-		    ethertype == rx->sdata->control_port_protocol)
+-			return 0;
+-	}
+-
+-drop_check:
+ 	/* Drop unencrypted frames if key is set. */
+ 	if (unlikely(!ieee80211_has_protected(fc) &&
+ 		     !ieee80211_is_any_nullfunc(fc) &&
+@@ -2892,8 +2866,16 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+ 	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+ 
+-	if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
+-		return RX_DROP_MONITOR;
++	if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) {
++		int offset = hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr) +
++			     sizeof(rfc1042_header);
++		__be16 ethertype;
++
++		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr) ||
++		    skb_copy_bits(rx->skb, offset, &ethertype, 2) != 0 ||
++		    ethertype != rx->sdata->control_port_protocol)
++			return RX_DROP_MONITOR;
++	}
+ 
+ 	/* frame is in RMC, don't forward */
+ 	if (ieee80211_is_data(hdr->frame_control) &&

package/kernel/mac80211/patches/subsys/312-wifi-cfg80211-move-A-MSDU-check-in-ieee80211_data_to.patch

@@ -0,0 +1,25 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 2 Dec 2022 13:53:11 +0100
+Subject: [PATCH] wifi: cfg80211: move A-MSDU check in
+ ieee80211_data_to_8023_exthdr
+
+When parsing the outer A-MSDU header, don't check for inner bridge tunnel
+or RFC1042 headers. This is handled by ieee80211_amsdu_to_8023s already.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -631,8 +631,9 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		break;
+ 	}
+ 
+-	if (likely(skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
+-	           ((!is_amsdu && ether_addr_equal(payload.hdr, rfc1042_header) &&
++	if (likely(!is_amsdu &&
++		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
++	           ((ether_addr_equal(payload.hdr, rfc1042_header) &&
+ 		     payload.proto != htons(ETH_P_AARP) &&
+ 		     payload.proto != htons(ETH_P_IPX)) ||
+ 		    ether_addr_equal(payload.hdr, bridge_tunnel_header)))) {

package/kernel/mac80211/patches/subsys/313-wifi-cfg80211-factor-out-bridge-tunnel-RFC1042-heade.patch

@@ -0,0 +1,76 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 2 Dec 2022 13:54:15 +0100
+Subject: [PATCH] wifi: cfg80211: factor out bridge tunnel / RFC1042 header
+ check
+
+The same check is done in multiple places, unify it.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -542,6 +542,21 @@ unsigned int ieee80211_get_mesh_hdrlen(s
+ }
+ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
+ 
++static bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
++{
++	const __be16 *hdr_proto = hdr + ETH_ALEN;
++
++	if (!(ether_addr_equal(hdr, rfc1042_header) &&
++	      *hdr_proto != htons(ETH_P_AARP) &&
++	      *hdr_proto != htons(ETH_P_IPX)) &&
++	    !ether_addr_equal(hdr, bridge_tunnel_header))
++		return false;
++
++	*proto = *hdr_proto;
++
++	return true;
++}
++
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+ 				  const u8 *addr, enum nl80211_iftype iftype,
+ 				  u8 data_offset, bool is_amsdu)
+@@ -633,14 +648,9 @@ int ieee80211_data_to_8023_exthdr(struct
+ 
+ 	if (likely(!is_amsdu &&
+ 		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
+-	           ((ether_addr_equal(payload.hdr, rfc1042_header) &&
+-		     payload.proto != htons(ETH_P_AARP) &&
+-		     payload.proto != htons(ETH_P_IPX)) ||
+-		    ether_addr_equal(payload.hdr, bridge_tunnel_header)))) {
+-		/* remove RFC1042 or Bridge-Tunnel encapsulation and
+-		 * replace EtherType */
++		   ieee80211_get_8023_tunnel_proto(&payload, &tmp.h_proto))) {
++		/* remove RFC1042 or Bridge-Tunnel encapsulation */
+ 		hdrlen += ETH_ALEN + 2;
+-		tmp.h_proto = payload.proto;
+ 		skb_postpull_rcsum(skb, &payload, ETH_ALEN + 2);
+ 	} else {
+ 		tmp.h_proto = htons(skb->len - hdrlen);
+@@ -756,8 +766,6 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ {
+ 	unsigned int hlen = ALIGN(extra_headroom, 4);
+ 	struct sk_buff *frame = NULL;
+-	u16 ethertype;
+-	u8 *payload;
+ 	int offset = 0, remaining;
+ 	struct ethhdr eth;
+ 	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
+@@ -811,14 +819,8 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 		frame->dev = skb->dev;
+ 		frame->priority = skb->priority;
+ 
+-		payload = frame->data;
+-		ethertype = (payload[6] << 8) | payload[7];
+-		if (likely((ether_addr_equal(payload, rfc1042_header) &&
+-			    ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
+-			   ether_addr_equal(payload, bridge_tunnel_header))) {
+-			eth.h_proto = htons(ethertype);
++		if (likely(ieee80211_get_8023_tunnel_proto(frame->data, &eth.h_proto)))
+ 			skb_pull(frame, ETH_ALEN + 2);
+-		}
+ 
+ 		memcpy(skb_push(frame, sizeof(eth)), &eth, sizeof(eth));
+ 		__skb_queue_tail(list, frame);

package/kernel/mac80211/patches/subsys/314-wifi-mac80211-remove-mesh-forwarding-congestion-chec.patch

@@ -0,0 +1,54 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 2 Dec 2022 17:01:46 +0100
+Subject: [PATCH] wifi: mac80211: remove mesh forwarding congestion check
+
+Now that all drivers use iTXQ, it does not make sense to check to drop
+tx forwarding packets when the driver has stopped the queues.
+fq_codel will take care of dropping packets when the queues fill up
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -603,8 +603,6 @@ IEEE80211_IF_FILE(fwded_mcast, u.mesh.ms
+ IEEE80211_IF_FILE(fwded_unicast, u.mesh.mshstats.fwded_unicast, DEC);
+ IEEE80211_IF_FILE(fwded_frames, u.mesh.mshstats.fwded_frames, DEC);
+ IEEE80211_IF_FILE(dropped_frames_ttl, u.mesh.mshstats.dropped_frames_ttl, DEC);
+-IEEE80211_IF_FILE(dropped_frames_congestion,
+-		  u.mesh.mshstats.dropped_frames_congestion, DEC);
+ IEEE80211_IF_FILE(dropped_frames_no_route,
+ 		  u.mesh.mshstats.dropped_frames_no_route, DEC);
+ 
+@@ -740,7 +738,6 @@ static void add_mesh_stats(struct ieee80
+ 	MESHSTATS_ADD(fwded_frames);
+ 	MESHSTATS_ADD(dropped_frames_ttl);
+ 	MESHSTATS_ADD(dropped_frames_no_route);
+-	MESHSTATS_ADD(dropped_frames_congestion);
+ #undef MESHSTATS_ADD
+ }
+ 
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -329,7 +329,6 @@ struct mesh_stats {
+ 	__u32 fwded_frames;		/* Mesh total forwarded frames */
+ 	__u32 dropped_frames_ttl;	/* Not transmitted since mesh_ttl == 0*/
+ 	__u32 dropped_frames_no_route;	/* Not transmitted, no route found */
+-	__u32 dropped_frames_congestion;/* Not forwarded due to congestion */
+ };
+ 
+ #define PREQ_Q_F_START		0x1
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2926,11 +2926,6 @@ ieee80211_rx_h_mesh_fwding(struct ieee80
+ 		return RX_CONTINUE;
+ 
+ 	ac = ieee802_1d_to_ac[skb->priority];
+-	q = sdata->vif.hw_queue[ac];
+-	if (ieee80211_queue_stopped(&local->hw, q)) {
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
+-		return RX_DROP_MONITOR;
+-	}
+ 	skb_set_queue_mapping(skb, ac);
+ 
+ 	if (!--mesh_hdr->ttl) {

package/kernel/mac80211/patches/subsys/315-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch

@@ -0,0 +1,753 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Tue, 6 Dec 2022 11:15:02 +0100
+Subject: [PATCH] wifi: mac80211: fix receiving A-MSDU frames on mesh
+ interfaces
+
+The current mac80211 mesh A-MSDU receive path fails to parse A-MSDU packets
+on mesh interfaces, because it assumes that the Mesh Control field is always
+directly after the 802.11 header.
+802.11-2020 9.3.2.2.2 Figure 9-70 shows that the Mesh Control field is
+actually part of the A-MSDU subframe header.
+This makes more sense, since it allows packets for multiple different
+destinations to be included in the same A-MSDU, as long as RA and TID are
+still the same.
+Another issue is the fact that the A-MSDU subframe length field was apparently
+accidentally defined as little-endian in the standard.
+
+In order to fix this, the mesh forwarding path needs happen at a different
+point in the receive path.
+
+ieee80211_data_to_8023_exthdr is changed to ignore the mesh control field
+and leave it in after the ethernet header. This also affects the source/dest
+MAC address fields, which now in the case of mesh point to the mesh SA/DA.
+
+ieee80211_amsdu_to_8023s is changed to deal with the endian difference and
+to add the Mesh Control length to the subframe length, since it's not covered
+by the MSDU length field.
+
+With these changes, the mac80211 will get the same packet structure for
+converted regular data packets and unpacked A-MSDU subframes.
+
+The mesh forwarding checks are now only performed after the A-MSDU decap.
+For locally received packets, the Mesh Control header is stripped away.
+For forwarded packets, a new 802.11 header gets added.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
++++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+@@ -33,7 +33,7 @@ static int mwifiex_11n_dispatch_amsdu_pk
+ 		skb_trim(skb, le16_to_cpu(local_rx_pd->rx_pkt_length));
+ 
+ 		ieee80211_amsdu_to_8023s(skb, &list, priv->curr_addr,
+-					 priv->wdev.iftype, 0, NULL, NULL);
++					 priv->wdev.iftype, 0, NULL, NULL, false);
+ 
+ 		while (!skb_queue_empty(&list)) {
+ 			struct rx_packet_hdr *rx_hdr;
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -6208,11 +6208,36 @@ static inline int ieee80211_data_to_8023
+  * @extra_headroom: The hardware extra headroom for SKBs in the @list.
+  * @check_da: DA to check in the inner ethernet header, or NULL
+  * @check_sa: SA to check in the inner ethernet header, or NULL
++ * @mesh_control: A-MSDU subframe header includes the mesh control field
+  */
+ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+ 			      const u8 *addr, enum nl80211_iftype iftype,
+ 			      const unsigned int extra_headroom,
+-			      const u8 *check_da, const u8 *check_sa);
++			      const u8 *check_da, const u8 *check_sa,
++			      bool mesh_control);
++
++/**
++ * ieee80211_get_8023_tunnel_proto - get RFC1042 or bridge tunnel encap protocol
++ *
++ * Check for RFC1042 or bridge tunnel header and fetch the encapsulated
++ * protocol.
++ *
++ * @hdr: pointer to the MSDU payload
++ * @proto: destination pointer to store the protocol
++ * Return: true if encapsulation was found
++ */
++bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto);
++
++/**
++ * ieee80211_strip_8023_mesh_hdr - strip mesh header from converted 802.3 frames
++ *
++ * Strip the mesh header, which was left in by ieee80211_data_to_8023 as part
++ * of the MSDU data. Also move any source/destination addresses from the mesh
++ * header to the ethernet header (if present).
++ *
++ * @skb: The 802.3 frame with embedded mesh header
++ */
++int ieee80211_strip_8023_mesh_hdr(struct sk_buff *skb);
+ 
+ /**
+  * cfg80211_classify8021d - determine the 802.1p/1d tag for a data frame
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2720,6 +2720,174 @@ ieee80211_deliver_skb(struct ieee80211_r
+ 	}
+ }
+ 
++static ieee80211_rx_result
++ieee80211_rx_mesh_data(struct ieee80211_sub_if_data *sdata, struct sta_info *sta,
++		       struct sk_buff *skb)
++{
++#ifdef CPTCFG_MAC80211_MESH
++	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
++	struct ieee80211_local *local = sdata->local;
++	uint16_t fc = IEEE80211_FTYPE_DATA | IEEE80211_STYPE_QOS_DATA;
++	struct ieee80211_hdr hdr = {
++		.frame_control = cpu_to_le16(fc)
++	};
++	struct ieee80211_hdr *fwd_hdr;
++	struct ieee80211s_hdr *mesh_hdr;
++	struct ieee80211_tx_info *info;
++	struct sk_buff *fwd_skb;
++	struct ethhdr *eth;
++	bool multicast;
++	int tailroom = 0;
++	int hdrlen, mesh_hdrlen;
++	u8 *qos;
++
++	if (!ieee80211_vif_is_mesh(&sdata->vif))
++		return RX_CONTINUE;
++
++	if (!pskb_may_pull(skb, sizeof(*eth) + 6))
++		return RX_DROP_MONITOR;
++
++	mesh_hdr = (struct ieee80211s_hdr *)(skb->data + sizeof(*eth));
++	mesh_hdrlen = ieee80211_get_mesh_hdrlen(mesh_hdr);
++
++	if (!pskb_may_pull(skb, sizeof(*eth) + mesh_hdrlen))
++		return RX_DROP_MONITOR;
++
++	eth = (struct ethhdr *)skb->data;
++	multicast = is_multicast_ether_addr(eth->h_dest);
++
++	mesh_hdr = (struct ieee80211s_hdr *)(eth + 1);
++	if (!mesh_hdr->ttl)
++		return RX_DROP_MONITOR;
++
++	/* frame is in RMC, don't forward */
++	if (is_multicast_ether_addr(eth->h_dest) &&
++	    mesh_rmc_check(sdata, eth->h_source, mesh_hdr))
++		return RX_DROP_MONITOR;
++
++	/* Frame has reached destination.  Don't forward */
++	if (ether_addr_equal(sdata->vif.addr, eth->h_dest))
++		goto rx_accept;
++
++	if (!ifmsh->mshcfg.dot11MeshForwarding) {
++		if (is_multicast_ether_addr(eth->h_dest))
++			goto rx_accept;
++
++		return RX_DROP_MONITOR;
++	}
++
++	/* forward packet */
++	if (sdata->crypto_tx_tailroom_needed_cnt)
++		tailroom = IEEE80211_ENCRYPT_TAILROOM;
++
++	if (!--mesh_hdr->ttl) {
++		if (multicast)
++			goto rx_accept;
++
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_ttl);
++		return RX_DROP_MONITOR;
++	}
++
++	if (mesh_hdr->flags & MESH_FLAGS_AE) {
++		struct mesh_path *mppath;
++		char *proxied_addr;
++
++		if (multicast)
++			proxied_addr = mesh_hdr->eaddr1;
++		else if ((mesh_hdr->flags & MESH_FLAGS_AE) == MESH_FLAGS_AE_A5_A6)
++			/* has_a4 already checked in ieee80211_rx_mesh_check */
++			proxied_addr = mesh_hdr->eaddr2;
++		else
++			return RX_DROP_MONITOR;
++
++		rcu_read_lock();
++		mppath = mpp_path_lookup(sdata, proxied_addr);
++		if (!mppath) {
++			mpp_path_add(sdata, proxied_addr, eth->h_source);
++		} else {
++			spin_lock_bh(&mppath->state_lock);
++			if (!ether_addr_equal(mppath->mpp, eth->h_source))
++				memcpy(mppath->mpp, eth->h_source, ETH_ALEN);
++			mppath->exp_time = jiffies;
++			spin_unlock_bh(&mppath->state_lock);
++		}
++		rcu_read_unlock();
++	}
++
++	skb_set_queue_mapping(skb, ieee802_1d_to_ac[skb->priority]);
++
++	ieee80211_fill_mesh_addresses(&hdr, &hdr.frame_control,
++				      eth->h_dest, eth->h_source);
++	hdrlen = ieee80211_hdrlen(hdr.frame_control);
++	if (multicast) {
++		int extra_head = sizeof(struct ieee80211_hdr) - sizeof(*eth);
++
++		fwd_skb = skb_copy_expand(skb, local->tx_headroom + extra_head +
++					       IEEE80211_ENCRYPT_HEADROOM,
++					  tailroom, GFP_ATOMIC);
++		if (!fwd_skb)
++			goto rx_accept;
++	} else {
++		fwd_skb = skb;
++		skb = NULL;
++
++		if (skb_cow_head(fwd_skb, hdrlen - sizeof(struct ethhdr)))
++			return RX_DROP_UNUSABLE;
++	}
++
++	fwd_hdr = skb_push(fwd_skb, hdrlen - sizeof(struct ethhdr));
++	memcpy(fwd_hdr, &hdr, hdrlen - 2);
++	qos = ieee80211_get_qos_ctl(fwd_hdr);
++	qos[0] = qos[1] = 0;
++
++	skb_reset_mac_header(fwd_skb);
++	hdrlen += mesh_hdrlen;
++	if (ieee80211_get_8023_tunnel_proto(fwd_skb->data + hdrlen,
++					    &fwd_skb->protocol))
++		hdrlen += ETH_ALEN;
++	else
++		fwd_skb->protocol = htons(fwd_skb->len - hdrlen);
++	skb_set_network_header(fwd_skb, hdrlen);
++
++	info = IEEE80211_SKB_CB(fwd_skb);
++	memset(info, 0, sizeof(*info));
++	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
++	info->control.vif = &sdata->vif;
++	info->control.jiffies = jiffies;
++	if (multicast) {
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
++		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
++		/* update power mode indication when forwarding */
++		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
++	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
++		/* mesh power mode flags updated in mesh_nexthop_lookup */
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
++	} else {
++		/* unable to resolve next hop */
++		if (sta)
++			mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
++					   hdr.addr3, 0,
++					   WLAN_REASON_MESH_PATH_NOFORWARD,
++					   sta->sta.addr);
++		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
++		kfree_skb(fwd_skb);
++		goto rx_accept;
++	}
++
++	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
++	fwd_skb->dev = sdata->dev;
++	ieee80211_add_pending_skb(local, fwd_skb);
++
++rx_accept:
++	if (!skb)
++		return RX_QUEUED;
++
++	ieee80211_strip_8023_mesh_hdr(skb);
++#endif
++
++	return RX_CONTINUE;
++}
++
+ static ieee80211_rx_result debug_noinline
+ __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
+ {
+@@ -2728,8 +2896,10 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+ 	__le16 fc = hdr->frame_control;
+ 	struct sk_buff_head frame_list;
++	static ieee80211_rx_result res;
+ 	struct ethhdr ethhdr;
+ 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
++	bool mesh = false;
+ 
+ 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
+ 		check_da = NULL;
+@@ -2746,6 +2916,8 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 			break;
+ 		case NL80211_IFTYPE_MESH_POINT:
+ 			check_sa = NULL;
++			check_da = NULL;
++			mesh = true;
+ 			break;
+ 		default:
+ 			break;
+@@ -2763,17 +2935,29 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+ 				 rx->sdata->vif.type,
+ 				 rx->local->hw.extra_tx_headroom,
+-				 check_da, check_sa);
++				 check_da, check_sa, mesh);
+ 
+ 	while (!skb_queue_empty(&frame_list)) {
+ 		rx->skb = __skb_dequeue(&frame_list);
+ 
+-		if (!ieee80211_frame_allowed(rx, fc)) {
+-			dev_kfree_skb(rx->skb);
++		res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
++		switch (res) {
++		case RX_QUEUED:
+ 			continue;
++		case RX_CONTINUE:
++			break;
++		default:
++			goto free;
+ 		}
+ 
++		if (!ieee80211_frame_allowed(rx, fc))
++			goto free;
++
+ 		ieee80211_deliver_skb(rx);
++		continue;
++
++free:
++		dev_kfree_skb(rx->skb);
+ 	}
+ 
+ 	return RX_QUEUED;
+@@ -2806,6 +2990,8 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ 			if (!rx->sdata->u.mgd.use_4addr)
+ 				return RX_DROP_UNUSABLE;
+ 			break;
++		case NL80211_IFTYPE_MESH_POINT:
++			break;
+ 		default:
+ 			return RX_DROP_UNUSABLE;
+ 		}
+@@ -2834,155 +3020,6 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx
+ 	return __ieee80211_rx_h_amsdu(rx, 0);
+ }
+ 
+-#ifdef CPTCFG_MAC80211_MESH
+-static ieee80211_rx_result
+-ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+-{
+-	struct ieee80211_hdr *fwd_hdr, *hdr;
+-	struct ieee80211_tx_info *info;
+-	struct ieee80211s_hdr *mesh_hdr;
+-	struct sk_buff *skb = rx->skb, *fwd_skb;
+-	struct ieee80211_local *local = rx->local;
+-	struct ieee80211_sub_if_data *sdata = rx->sdata;
+-	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+-	u16 ac, q, hdrlen;
+-	int tailroom = 0;
+-
+-	hdr = (struct ieee80211_hdr *) skb->data;
+-	hdrlen = ieee80211_hdrlen(hdr->frame_control);
+-
+-	/* make sure fixed part of mesh header is there, also checks skb len */
+-	if (!pskb_may_pull(rx->skb, hdrlen + 6))
+-		return RX_DROP_MONITOR;
+-
+-	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+-
+-	/* make sure full mesh header is there, also checks skb len */
+-	if (!pskb_may_pull(rx->skb,
+-			   hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr)))
+-		return RX_DROP_MONITOR;
+-
+-	/* reload pointers */
+-	hdr = (struct ieee80211_hdr *) skb->data;
+-	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+-
+-	if (ieee80211_drop_unencrypted(rx, hdr->frame_control)) {
+-		int offset = hdrlen + ieee80211_get_mesh_hdrlen(mesh_hdr) +
+-			     sizeof(rfc1042_header);
+-		__be16 ethertype;
+-
+-		if (!ether_addr_equal(hdr->addr1, rx->sdata->vif.addr) ||
+-		    skb_copy_bits(rx->skb, offset, &ethertype, 2) != 0 ||
+-		    ethertype != rx->sdata->control_port_protocol)
+-			return RX_DROP_MONITOR;
+-	}
+-
+-	/* frame is in RMC, don't forward */
+-	if (ieee80211_is_data(hdr->frame_control) &&
+-	    is_multicast_ether_addr(hdr->addr1) &&
+-	    mesh_rmc_check(rx->sdata, hdr->addr3, mesh_hdr))
+-		return RX_DROP_MONITOR;
+-
+-	if (!ieee80211_is_data(hdr->frame_control))
+-		return RX_CONTINUE;
+-
+-	if (!mesh_hdr->ttl)
+-		return RX_DROP_MONITOR;
+-
+-	if (mesh_hdr->flags & MESH_FLAGS_AE) {
+-		struct mesh_path *mppath;
+-		char *proxied_addr;
+-		char *mpp_addr;
+-
+-		if (is_multicast_ether_addr(hdr->addr1)) {
+-			mpp_addr = hdr->addr3;
+-			proxied_addr = mesh_hdr->eaddr1;
+-		} else if ((mesh_hdr->flags & MESH_FLAGS_AE) ==
+-			    MESH_FLAGS_AE_A5_A6) {
+-			/* has_a4 already checked in ieee80211_rx_mesh_check */
+-			mpp_addr = hdr->addr4;
+-			proxied_addr = mesh_hdr->eaddr2;
+-		} else {
+-			return RX_DROP_MONITOR;
+-		}
+-
+-		rcu_read_lock();
+-		mppath = mpp_path_lookup(sdata, proxied_addr);
+-		if (!mppath) {
+-			mpp_path_add(sdata, proxied_addr, mpp_addr);
+-		} else {
+-			spin_lock_bh(&mppath->state_lock);
+-			if (!ether_addr_equal(mppath->mpp, mpp_addr))
+-				memcpy(mppath->mpp, mpp_addr, ETH_ALEN);
+-			mppath->exp_time = jiffies;
+-			spin_unlock_bh(&mppath->state_lock);
+-		}
+-		rcu_read_unlock();
+-	}
+-
+-	/* Frame has reached destination.  Don't forward */
+-	if (!is_multicast_ether_addr(hdr->addr1) &&
+-	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
+-		return RX_CONTINUE;
+-
+-	ac = ieee802_1d_to_ac[skb->priority];
+-	skb_set_queue_mapping(skb, ac);
+-
+-	if (!--mesh_hdr->ttl) {
+-		if (!is_multicast_ether_addr(hdr->addr1))
+-			IEEE80211_IFSTA_MESH_CTR_INC(ifmsh,
+-						     dropped_frames_ttl);
+-		goto out;
+-	}
+-
+-	if (!ifmsh->mshcfg.dot11MeshForwarding)
+-		goto out;
+-
+-	if (sdata->crypto_tx_tailroom_needed_cnt)
+-		tailroom = IEEE80211_ENCRYPT_TAILROOM;
+-
+-	fwd_skb = skb_copy_expand(skb, local->tx_headroom +
+-				       IEEE80211_ENCRYPT_HEADROOM,
+-				  tailroom, GFP_ATOMIC);
+-	if (!fwd_skb)
+-		goto out;
+-
+-	fwd_skb->dev = sdata->dev;
+-	fwd_hdr =  (struct ieee80211_hdr *) fwd_skb->data;
+-	fwd_hdr->frame_control &= ~cpu_to_le16(IEEE80211_FCTL_RETRY);
+-	info = IEEE80211_SKB_CB(fwd_skb);
+-	memset(info, 0, sizeof(*info));
+-	info->control.flags |= IEEE80211_TX_INTCFL_NEED_TXPROCESSING;
+-	info->control.vif = &rx->sdata->vif;
+-	info->control.jiffies = jiffies;
+-	if (is_multicast_ether_addr(fwd_hdr->addr1)) {
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_mcast);
+-		memcpy(fwd_hdr->addr2, sdata->vif.addr, ETH_ALEN);
+-		/* update power mode indication when forwarding */
+-		ieee80211_mps_set_frame_flags(sdata, NULL, fwd_hdr);
+-	} else if (!mesh_nexthop_lookup(sdata, fwd_skb)) {
+-		/* mesh power mode flags updated in mesh_nexthop_lookup */
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_unicast);
+-	} else {
+-		/* unable to resolve next hop */
+-		mesh_path_error_tx(sdata, ifmsh->mshcfg.element_ttl,
+-				   fwd_hdr->addr3, 0,
+-				   WLAN_REASON_MESH_PATH_NOFORWARD,
+-				   fwd_hdr->addr2);
+-		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_no_route);
+-		kfree_skb(fwd_skb);
+-		return RX_DROP_MONITOR;
+-	}
+-
+-	IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, fwded_frames);
+-	ieee80211_add_pending_skb(local, fwd_skb);
+- out:
+-	if (is_multicast_ether_addr(hdr->addr1))
+-		return RX_CONTINUE;
+-	return RX_DROP_MONITOR;
+-}
+-#endif
+-
+ static ieee80211_rx_result debug_noinline
+ ieee80211_rx_h_data(struct ieee80211_rx_data *rx)
+ {
+@@ -2991,6 +3028,7 @@ ieee80211_rx_h_data(struct ieee80211_rx_
+ 	struct net_device *dev = sdata->dev;
+ 	struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+ 	__le16 fc = hdr->frame_control;
++	static ieee80211_rx_result res;
+ 	bool port_control;
+ 	int err;
+ 
+@@ -3017,6 +3055,10 @@ ieee80211_rx_h_data(struct ieee80211_rx_
+ 	if (unlikely(err))
+ 		return RX_DROP_UNUSABLE;
+ 
++	res = ieee80211_rx_mesh_data(rx->sdata, rx->sta, rx->skb);
++	if (res != RX_CONTINUE)
++		return res;
++
+ 	if (!ieee80211_frame_allowed(rx, fc))
+ 		return RX_DROP_MONITOR;
+ 
+@@ -3987,10 +4029,6 @@ static void ieee80211_rx_handlers(struct
+ 		CALL_RXH(ieee80211_rx_h_defragment);
+ 		CALL_RXH(ieee80211_rx_h_michael_mic_verify);
+ 		/* must be after MMIC verify so header is counted in MPDU mic */
+-#ifdef CPTCFG_MAC80211_MESH
+-		if (ieee80211_vif_is_mesh(&rx->sdata->vif))
+-			CALL_RXH(ieee80211_rx_h_mesh_fwding);
+-#endif
+ 		CALL_RXH(ieee80211_rx_h_amsdu);
+ 		CALL_RXH(ieee80211_rx_h_data);
+ 
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -542,7 +542,7 @@ unsigned int ieee80211_get_mesh_hdrlen(s
+ }
+ EXPORT_SYMBOL(ieee80211_get_mesh_hdrlen);
+ 
+-static bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
++bool ieee80211_get_8023_tunnel_proto(const void *hdr, __be16 *proto)
+ {
+ 	const __be16 *hdr_proto = hdr + ETH_ALEN;
+ 
+@@ -556,6 +556,49 @@ static bool ieee80211_get_8023_tunnel_pr
+ 
+ 	return true;
+ }
++EXPORT_SYMBOL(ieee80211_get_8023_tunnel_proto);
++
++int ieee80211_strip_8023_mesh_hdr(struct sk_buff *skb)
++{
++	const void *mesh_addr;
++	struct {
++		struct ethhdr eth;
++		u8 flags;
++	} payload;
++	int hdrlen;
++	int ret;
++
++	ret = skb_copy_bits(skb, 0, &payload, sizeof(payload));
++	if (ret)
++		return ret;
++
++	hdrlen = sizeof(payload.eth) + __ieee80211_get_mesh_hdrlen(payload.flags);
++
++	if (likely(pskb_may_pull(skb, hdrlen + 8) &&
++		   ieee80211_get_8023_tunnel_proto(skb->data + hdrlen,
++						   &payload.eth.h_proto)))
++		hdrlen += ETH_ALEN + 2;
++	else if (!pskb_may_pull(skb, hdrlen))
++		return -EINVAL;
++
++	mesh_addr = skb->data + sizeof(payload.eth) + ETH_ALEN;
++	switch (payload.flags & MESH_FLAGS_AE) {
++	case MESH_FLAGS_AE_A4:
++		memcpy(&payload.eth.h_source, mesh_addr, ETH_ALEN);
++		break;
++	case MESH_FLAGS_AE_A5_A6:
++		memcpy(&payload.eth.h_dest, mesh_addr, 2 * ETH_ALEN);
++		break;
++	default:
++		break;
++	}
++
++	pskb_pull(skb, hdrlen - sizeof(payload.eth));
++	memcpy(skb->data, &payload.eth, sizeof(payload.eth));
++
++	return 0;
++}
++EXPORT_SYMBOL(ieee80211_strip_8023_mesh_hdr);
+ 
+ int ieee80211_data_to_8023_exthdr(struct sk_buff *skb, struct ethhdr *ehdr,
+ 				  const u8 *addr, enum nl80211_iftype iftype,
+@@ -568,7 +611,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 	} payload;
+ 	struct ethhdr tmp;
+ 	u16 hdrlen;
+-	u8 mesh_flags = 0;
+ 
+ 	if (unlikely(!ieee80211_is_data_present(hdr->frame_control)))
+ 		return -1;
+@@ -589,12 +631,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 	memcpy(tmp.h_dest, ieee80211_get_DA(hdr), ETH_ALEN);
+ 	memcpy(tmp.h_source, ieee80211_get_SA(hdr), ETH_ALEN);
+ 
+-	if (iftype == NL80211_IFTYPE_MESH_POINT &&
+-	    skb_copy_bits(skb, hdrlen, &mesh_flags, 1) < 0)
+-		return -1;
+-
+-	mesh_flags &= MESH_FLAGS_AE;
+-
+ 	switch (hdr->frame_control &
+ 		cpu_to_le16(IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
+ 	case cpu_to_le16(IEEE80211_FCTL_TODS):
+@@ -608,17 +644,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 			     iftype != NL80211_IFTYPE_AP_VLAN &&
+ 			     iftype != NL80211_IFTYPE_STATION))
+ 			return -1;
+-		if (iftype == NL80211_IFTYPE_MESH_POINT) {
+-			if (mesh_flags == MESH_FLAGS_AE_A4)
+-				return -1;
+-			if (mesh_flags == MESH_FLAGS_AE_A5_A6 &&
+-			    skb_copy_bits(skb, hdrlen +
+-					  offsetof(struct ieee80211s_hdr, eaddr1),
+-					  tmp.h_dest, 2 * ETH_ALEN) < 0)
+-				return -1;
+-
+-			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
+-		}
+ 		break;
+ 	case cpu_to_le16(IEEE80211_FCTL_FROMDS):
+ 		if ((iftype != NL80211_IFTYPE_STATION &&
+@@ -627,16 +652,6 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		    (is_multicast_ether_addr(tmp.h_dest) &&
+ 		     ether_addr_equal(tmp.h_source, addr)))
+ 			return -1;
+-		if (iftype == NL80211_IFTYPE_MESH_POINT) {
+-			if (mesh_flags == MESH_FLAGS_AE_A5_A6)
+-				return -1;
+-			if (mesh_flags == MESH_FLAGS_AE_A4 &&
+-			    skb_copy_bits(skb, hdrlen +
+-					  offsetof(struct ieee80211s_hdr, eaddr1),
+-					  tmp.h_source, ETH_ALEN) < 0)
+-				return -1;
+-			hdrlen += __ieee80211_get_mesh_hdrlen(mesh_flags);
+-		}
+ 		break;
+ 	case cpu_to_le16(0):
+ 		if (iftype != NL80211_IFTYPE_ADHOC &&
+@@ -646,7 +661,7 @@ int ieee80211_data_to_8023_exthdr(struct
+ 		break;
+ 	}
+ 
+-	if (likely(!is_amsdu &&
++	if (likely(!is_amsdu && iftype != NL80211_IFTYPE_MESH_POINT &&
+ 		   skb_copy_bits(skb, hdrlen, &payload, sizeof(payload)) == 0 &&
+ 		   ieee80211_get_8023_tunnel_proto(&payload, &tmp.h_proto))) {
+ 		/* remove RFC1042 or Bridge-Tunnel encapsulation */
+@@ -722,7 +737,8 @@ __ieee80211_amsdu_copy_frag(struct sk_bu
+ 
+ static struct sk_buff *
+ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
+-		       int offset, int len, bool reuse_frag)
++		       int offset, int len, bool reuse_frag,
++		       int min_len)
+ {
+ 	struct sk_buff *frame;
+ 	int cur_len = len;
+@@ -736,7 +752,7 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ 	 * in the stack later.
+ 	 */
+ 	if (reuse_frag)
+-		cur_len = min_t(int, len, 32);
++		cur_len = min_t(int, len, min_len);
+ 
+ 	/*
+ 	 * Allocate and reserve two bytes more for payload
+@@ -746,6 +762,7 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ 	if (!frame)
+ 		return NULL;
+ 
++	frame->priority = skb->priority;
+ 	skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
+ 	skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
+ 
+@@ -762,23 +779,37 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+ 			      const u8 *addr, enum nl80211_iftype iftype,
+ 			      const unsigned int extra_headroom,
+-			      const u8 *check_da, const u8 *check_sa)
++			      const u8 *check_da, const u8 *check_sa,
++			      bool mesh_control)
+ {
+ 	unsigned int hlen = ALIGN(extra_headroom, 4);
+ 	struct sk_buff *frame = NULL;
+ 	int offset = 0, remaining;
+-	struct ethhdr eth;
++	struct {
++		struct ethhdr eth;
++		uint8_t flags;
++	} hdr;
+ 	bool reuse_frag = skb->head_frag && !skb_has_frag_list(skb);
+ 	bool reuse_skb = false;
+ 	bool last = false;
++	int copy_len = sizeof(hdr.eth);
++
++	if (iftype == NL80211_IFTYPE_MESH_POINT)
++		copy_len = sizeof(hdr);
+ 
+ 	while (!last) {
+ 		unsigned int subframe_len;
+-		int len;
++		int len, mesh_len = 0;
+ 		u8 padding;
+ 
+-		skb_copy_bits(skb, offset, &eth, sizeof(eth));
+-		len = ntohs(eth.h_proto);
++		skb_copy_bits(skb, offset, &hdr, copy_len);
++		if (iftype == NL80211_IFTYPE_MESH_POINT)
++			mesh_len = __ieee80211_get_mesh_hdrlen(hdr.flags);
++		if (mesh_control)
++			len = le16_to_cpu(*(__le16 *)&hdr.eth.h_proto) + mesh_len;
++		else
++			len = ntohs(hdr.eth.h_proto);
++
+ 		subframe_len = sizeof(struct ethhdr) + len;
+ 		padding = (4 - subframe_len) & 0x3;
+ 
+@@ -787,16 +818,16 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 		if (subframe_len > remaining)
+ 			goto purge;
+ 		/* mitigate A-MSDU aggregation injection attacks */
+-		if (ether_addr_equal(eth.h_dest, rfc1042_header))
++		if (ether_addr_equal(hdr.eth.h_dest, rfc1042_header))
+ 			goto purge;
+ 
+ 		offset += sizeof(struct ethhdr);
+ 		last = remaining <= subframe_len + padding;
+ 
+ 		/* FIXME: should we really accept multicast DA? */
+-		if ((check_da && !is_multicast_ether_addr(eth.h_dest) &&
+-		     !ether_addr_equal(check_da, eth.h_dest)) ||
+-		    (check_sa && !ether_addr_equal(check_sa, eth.h_source))) {
++		if ((check_da && !is_multicast_ether_addr(hdr.eth.h_dest) &&
++		     !ether_addr_equal(check_da, hdr.eth.h_dest)) ||
++		    (check_sa && !ether_addr_equal(check_sa, hdr.eth.h_source))) {
+ 			offset += len + padding;
+ 			continue;
+ 		}
+@@ -808,7 +839,7 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 			reuse_skb = true;
+ 		} else {
+ 			frame = __ieee80211_amsdu_copy(skb, hlen, offset, len,
+-						       reuse_frag);
++						       reuse_frag, 32 + mesh_len);
+ 			if (!frame)
+ 				goto purge;
+ 
+@@ -819,10 +850,11 @@ void ieee80211_amsdu_to_8023s(struct sk_
+ 		frame->dev = skb->dev;
+ 		frame->priority = skb->priority;
+ 
+-		if (likely(ieee80211_get_8023_tunnel_proto(frame->data, &eth.h_proto)))
++		if (likely(iftype != NL80211_IFTYPE_MESH_POINT &&
++			   ieee80211_get_8023_tunnel_proto(frame->data, &hdr.eth.h_proto)))
+ 			skb_pull(frame, ETH_ALEN + 2);
+ 
+-		memcpy(skb_push(frame, sizeof(eth)), &eth, sizeof(eth));
++		memcpy(skb_push(frame, sizeof(hdr.eth)), &hdr.eth, sizeof(hdr.eth));
+ 		__skb_queue_tail(list, frame);
+ 	}
+ 

package/kernel/mac80211/patches/subsys/316-wifi-mac80211-add-a-workaround-for-receiving-non-sta.patch

@@ -0,0 +1,145 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 9 Dec 2022 21:15:04 +0100
+Subject: [PATCH] wifi: mac80211: add a workaround for receiving
+ non-standard mesh A-MSDU
+
+At least ath10k and ath11k supported hardware (maybe more) does not implement
+mesh A-MSDU aggregation in a standard compliant way.
+802.11-2020 9.3.2.2.2 declares that the Mesh Control field is part of the
+A-MSDU header. As such, its length must not be included in the subframe
+length field.
+Hardware affected by this bug treats the mesh control field as part of the
+MSDU data and sets the length accordingly.
+In order to avoid packet loss, keep track of which stations are affected
+by this and take it into account when converting A-MSDU to 802.3 + mesh control
+packets.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -6194,6 +6194,19 @@ static inline int ieee80211_data_to_8023
+ }
+ 
+ /**
++ * ieee80211_is_valid_amsdu - check if subframe lengths of an A-MSDU are valid
++ *
++ * This is used to detect non-standard A-MSDU frames, e.g. the ones generated
++ * by ath10k and ath11k, where the subframe length includes the length of the
++ * mesh control field.
++ *
++ * @skb: The input A-MSDU frame without any headers.
++ * @mesh_hdr: use standard compliant mesh A-MSDU subframe header
++ * Returns: true if subframe header lengths are valid for the @mesh_hdr mode
++ */
++bool ieee80211_is_valid_amsdu(struct sk_buff *skb, bool mesh_hdr);
++
++/**
+  * ieee80211_amsdu_to_8023s - decode an IEEE 802.11n A-MSDU frame
+  *
+  * Decode an IEEE 802.11 A-MSDU and convert it to a list of 802.3 frames.
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2899,7 +2899,6 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 	static ieee80211_rx_result res;
+ 	struct ethhdr ethhdr;
+ 	const u8 *check_da = ethhdr.h_dest, *check_sa = ethhdr.h_source;
+-	bool mesh = false;
+ 
+ 	if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
+ 		check_da = NULL;
+@@ -2917,7 +2916,6 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 		case NL80211_IFTYPE_MESH_POINT:
+ 			check_sa = NULL;
+ 			check_da = NULL;
+-			mesh = true;
+ 			break;
+ 		default:
+ 			break;
+@@ -2932,10 +2930,21 @@ __ieee80211_rx_h_amsdu(struct ieee80211_
+ 					  data_offset, true))
+ 		return RX_DROP_UNUSABLE;
+ 
++	if (rx->sta && rx->sta->amsdu_mesh_control < 0) {
++		bool valid_std = ieee80211_is_valid_amsdu(skb, true);
++		bool valid_nonstd = ieee80211_is_valid_amsdu(skb, false);
++
++		if (valid_std && !valid_nonstd)
++			rx->sta->amsdu_mesh_control = 1;
++		else if (valid_nonstd && !valid_std)
++			rx->sta->amsdu_mesh_control = 0;
++	}
++
+ 	ieee80211_amsdu_to_8023s(skb, &frame_list, dev->dev_addr,
+ 				 rx->sdata->vif.type,
+ 				 rx->local->hw.extra_tx_headroom,
+-				 check_da, check_sa, mesh);
++				 check_da, check_sa,
++				 rx->sta->amsdu_mesh_control);
+ 
+ 	while (!skb_queue_empty(&frame_list)) {
+ 		rx->skb = __skb_dequeue(&frame_list);
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -591,6 +591,9 @@ __sta_info_alloc(struct ieee80211_sub_if
+ 
+ 	sta->sta_state = IEEE80211_STA_NONE;
+ 
++	if (sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
++		sta->amsdu_mesh_control = -1;
++
+ 	/* Mark TID as unreserved */
+ 	sta->reserved_tid = IEEE80211_TID_UNRESERVED;
+ 
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -702,6 +702,7 @@ struct sta_info {
+ 	struct codel_params cparams;
+ 
+ 	u8 reserved_tid;
++	s8 amsdu_mesh_control;
+ 
+ 	struct cfg80211_chan_def tdls_chandef;
+ 
+--- a/net/wireless/util.c
++++ b/net/wireless/util.c
+@@ -776,6 +776,38 @@ __ieee80211_amsdu_copy(struct sk_buff *s
+ 	return frame;
+ }
+ 
++bool ieee80211_is_valid_amsdu(struct sk_buff *skb, bool mesh_hdr)
++{
++	int offset = 0, remaining, subframe_len, padding;
++
++	for (offset = 0; offset < skb->len; offset += subframe_len + padding) {
++		struct {
++		    __be16 len;
++		    u8 mesh_flags;
++		} hdr;
++		u16 len;
++
++		if (skb_copy_bits(skb, offset + 2 * ETH_ALEN, &hdr, sizeof(hdr)) < 0)
++			return false;
++
++		if (mesh_hdr)
++			len = le16_to_cpu(*(__le16 *)&hdr.len) +
++			      __ieee80211_get_mesh_hdrlen(hdr.mesh_flags);
++		else
++			len = ntohs(hdr.len);
++
++		subframe_len = sizeof(struct ethhdr) + len;
++		padding = (4 - subframe_len) & 0x3;
++		remaining = skb->len - offset;
++
++		if (subframe_len > remaining)
++			return false;
++	}
++
++	return true;
++}
++EXPORT_SYMBOL(ieee80211_is_valid_amsdu);
++
+ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
+ 			      const u8 *addr, enum nl80211_iftype iftype,
+ 			      const unsigned int extra_headroom,

package/kernel/mac80211/patches/subsys/500-mac80211_configure_antenna_gain.patch

@@ -87,7 +87,7 @@
  	CFG80211_TESTMODE_DUMP(ieee80211_testmode_dump)
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1521,6 +1521,7 @@ struct ieee80211_local {
+@@ -1520,6 +1520,7 @@ struct ieee80211_local {
  	int dynamic_ps_forced_timeout;
  
  	int user_power_level; /* in dBm, for all interfaces */

package/kernel/mac80211/patches/subsys/800-mac80211-mask-nested-A-MSDU-support-for-mesh.patch

@@ -1,33 +0,0 @@
-From 313d8c18385f10957402b475f9b0c209ceab6c5a Mon Sep 17 00:00:00 2001
-From: David Bauer <mail@david-bauer.net>
-Date: Fri, 8 Oct 2021 00:25:19 +0200
-Subject: [PATCH] mac80211: mask nested A-MSDU support for mesh
-
-mac80211 incorrectly processes A-MSDUs contained in A-MPDU frames. This
-results in dropped packets and severely impacted throughput.
-
-As a workaround, don't indicate support for A-MSDUs contained in
-A-MPDUs. This improves throughput over mesh links by factor 10.
-
-Ref: https://github.com/openwrt/mt76/issues/450
-
-Signed-off-by: David Bauer <mail@david-bauer.net>
----
- net/mac80211/agg-rx.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
---- a/net/mac80211/agg-rx.c
-+++ b/net/mac80211/agg-rx.c
-@@ -254,7 +254,11 @@ static void ieee80211_send_addba_resp(st
- 	mgmt->u.action.u.addba_resp.action_code = WLAN_ACTION_ADDBA_RESP;
- 	mgmt->u.action.u.addba_resp.dialog_token = dialog_token;
- 
--	capab = u16_encode_bits(amsdu, IEEE80211_ADDBA_PARAM_AMSDU_MASK);
-+	capab = 0;
-+#ifdef CPTCFG_MAC80211_MESH
-+	if (!sta->mesh)
-+#endif
-+		capab = u16_encode_bits(amsdu, IEEE80211_ADDBA_PARAM_AMSDU_MASK);
- 	capab |= u16_encode_bits(policy, IEEE80211_ADDBA_PARAM_POLICY_MASK);
- 	capab |= u16_encode_bits(tid, IEEE80211_ADDBA_PARAM_TID_MASK);
- 	capab |= u16_encode_bits(buf_size, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);

package/libs/openssl/Makefile

@@ -9,9 +9,9 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=openssl
 PKG_BASE:=1.1.1
-PKG_BUGFIX:=s
+PKG_BUGFIX:=t
 PKG_VERSION:=$(PKG_BASE)$(PKG_BUGFIX)
-PKG_RELEASE:=$(AUTORELEASE)
+PKG_RELEASE:=1
 PKG_USE_MIPS16:=0
 
 PKG_BUILD_PARALLEL:=1
@@ -25,7 +25,7 @@ PKG_SOURCE_URL:= \
 	ftp://ftp.pca.dfn.de/pub/tools/net/openssl/source/ \
 	ftp://ftp.pca.dfn.de/pub/tools/net/openssl/source/old/$(PKG_BASE)/
 
-PKG_HASH:=c5ac01e760ee6ff0dab61d6b2bbd30146724d063eb322180c6f18a6f74e4b6aa
+PKG_HASH:=8dee9b24bdb1dcbf0c3d1e9b02fb8f6bf22165e807f45adeb7c9677536859d3b
 
 PKG_LICENSE:=OpenSSL
 PKG_LICENSE_FILES:=LICENSE

package/libs/openssl/patches/010-padlock.patch

@@ -1,52 +0,0 @@
-From 2bcf8e69bd92e33d84c48e7d108d3d46b22f8a6d Mon Sep 17 00:00:00 2001
-From: ValdikSS <iam@valdikss.org.ru>
-Date: Wed, 18 Jan 2023 20:14:48 +0300
-Subject: [PATCH] Padlock: fix byte swapping assembly for AES-192 and 256
-
-Byte swapping code incorrectly uses the number of AES rounds to swap expanded
-AES key, while swapping only a single dword in a loop, resulting in swapped
-key and partially swapped expanded keys, breaking AES encryption and
-decryption on VIA Padlock hardware.
-
-This commit correctly sets the number of swapping loops to be done.
-
-Fixes #20073
-
-CLA: trivial
-
-Reviewed-by: Hugo Landau <hlandau@openssl.org>
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/20077)
-
-(cherry picked from commit 7331e7ef79fe4499d81cc92249e9c97e9ff9291a)
----
- engines/asm/e_padlock-x86.pl    | 2 ++
- engines/asm/e_padlock-x86_64.pl | 2 ++
- 2 files changed, 4 insertions(+)
-
-diff --git a/engines/asm/e_padlock-x86.pl b/engines/asm/e_padlock-x86.pl
-index 5b097ce3ef9b..07f7000fd38a 100644
---- a/engines/asm/e_padlock-x86.pl
-+++ b/engines/asm/e_padlock-x86.pl
-@@ -116,6 +116,8 @@
- &function_begin_B("padlock_key_bswap");
- 	&mov	("edx",&wparam(0));
- 	&mov	("ecx",&DWP(240,"edx"));
-+	&inc	("ecx");
-+	&shl	("ecx",2);
- &set_label("bswap_loop");
- 	&mov	("eax",&DWP(0,"edx"));
- 	&bswap	("eax");
-diff --git a/engines/asm/e_padlock-x86_64.pl b/engines/asm/e_padlock-x86_64.pl
-index 09b0aaa48dfe..dfd2ae656375 100644
---- a/engines/asm/e_padlock-x86_64.pl
-+++ b/engines/asm/e_padlock-x86_64.pl
-@@ -92,6 +92,8 @@
- .align	16
- padlock_key_bswap:
- 	mov	240($arg1),%edx
-+	inc	%edx
-+	shl	\$2,%edx
- .Lbswap_loop:
- 	mov	($arg1),%eax
- 	bswap	%eax

package/utils/e2fsprogs/Makefile

@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=e2fsprogs
-PKG_VERSION:=1.46.6
+PKG_VERSION:=1.47.0
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/kernel/people/tytso/e2fsprogs/v$(PKG_VERSION)/
-PKG_HASH:=a77517f19ff5e4e97ede63536566865dd5d48654e13fc145f5f2249ef7c4f4fc
+PKG_HASH:=144af53f2bbd921cef6f8bea88bb9faddca865da3fbc657cc9b4d2001097d5db
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=NOTICE

target/linux/ath79/dts/qca9557_engenius_esr1200.dts

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x_senao_router-dual.dtsi"
+
+/ {
+	compatible = "engenius,esr1200", "qca,qca9557";
+	model = "EnGenius ESR1200";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "amber:power";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wps_amber {
+			label = "amber:wps";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+
+		wps_blue {
+			label = "blue:wps";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&phy0 {
+	qca,mib-poll-interval = <500>;
+
+	qca,ar8327-initvals = <
+		0x04 0x87680000 /* PORT0 PAD MODE CTRL */
+		0x10 0x40000000 /* POWER_ON_STRAP */
+		0x50 0xcf35cf35 /* LED_CTRL0 */
+		0x54 0xcf35cf35 /* LED_CTRL1 */
+		0x58 0xcf35cf35 /* LED_CTRL2 */
+		0x5c 0x03ffff00 /* LED_CTRL3 */
+		0x7c 0x0000007e /* PORT0_STATUS */
+	>;
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&usb1 {
+	status = "okay";
+};
+
+&wmac {
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
+};
+
+&ath10k_0 {
+	nvmem-cells = <&calibration_art_5000>;
+	nvmem-cell-names = "calibration";
+};

target/linux/ath79/dts/qca9558_engenius_epg5000.dts

@@ -1,9 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "qca955x.dtsi"
+#include "qca955x_senao_router-dual.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
 
 / {
 	model = "EnGenius EPG5000";
@@ -47,111 +44,21 @@
 			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
 		};
 	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
 };
 
-		wps {
+&phy0 {
-			label = "wps";
+	qca,mib-poll-interval = <500>;
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-	};
-};
-
-&eth0 {
-	status = "okay";
-
-	phy-handle = <&phy0>;
-	pll-data = <0xa6000000 0x00000101 0x00001616>;
-};
-
-&mdio0 {
-	status = "okay";
-
-	phy0: ethernet-phy@0 {
-		reg = <0>;
 
 	qca,ar8327-initvals = <
-			0x04 0x87600000 /* PORT0 PAD MODE CTRL */
+		0x04 0x87680000 /* PORT0 PAD MODE CTRL */
+		0x10 0x40000000 /* POWER_ON_STRAP */
+		0x50 0xcf35cf35 /* LED_CTRL0 */
+		0x54 0xcf35cf35 /* LED_CTRL1 */
+		0x58 0xcf35cf35 /* LED_CTRL2 */
+		0x5c 0x03ffff00 /* LED_CTRL3 */
 		0x7c 0x0000007e /* PORT0_STATUS */
 	>;
 };
-};
-
-&pcie0 {
-	status = "okay";
-
-	wifi@0,0 {
-		compatible = "pci168c,003c";
-		reg = <0x0000 0 0 0 0>;
-	};
-};
-
-&spi {
-	status = "okay";
-
-	flash@0 {
-		compatible = "jedec,spi-nor";
-		reg = <0>;
-		spi-max-frequency = <25000000>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "u-boot";
-				reg = <0x000000 0x030000>;
-				read-only;
-			};
-
-			partition@30000 {
-				label = "u-boot-env";
-				reg = <0x030000 0x010000>;
-			};
-
-			partition@40000 {
-				compatible = "denx,uimage";
-				label = "firmware";
-				reg = <0x040000 0xe50000>;
-			};
-
-			partition@790000 {
-				label = "manufacture";
-				reg = <0xe90000 0x100000>;
-				read-only;
-			};
-
-			partition@ed0000 {
-				label = "backup";
-				reg = <0xf90000 0x010000>;
-				read-only;
-			};
-
-			partition@fe0000 {
-				label = "storage";
-				reg = <0xfa0000 0x050000>;
-				read-only;
-			};
-
-			partition@ff0000 {
-				label = "art";
-				reg = <0xff0000 0x010000>;
-				read-only;
-			};
-		};
-	};
-};
 
 &usb_phy1 {
 	status = "okay";
@@ -162,7 +69,11 @@
 };
 
 &wmac {
-	status = "okay";
+	nvmem-cells = <&calibration_art_1000>;
-
+	nvmem-cell-names = "calibration";
-	qca,no-eeprom;
+};
+
+&ath10k_0 {
+	nvmem-cells = <&calibration_art_5000>;
+	nvmem-cell-names = "calibration";
 };

target/linux/ath79/dts/qca9558_engenius_esr1750.dts

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x_senao_router-dual.dtsi"
+
+/ {
+	compatible = "engenius,esr1750", "qca,qca9558";
+	model = "EnGenius ESR1750";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "amber:power";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wps_amber {
+			label = "amber:wps";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+
+		wps_blue {
+			label = "blue:wps";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&phy0 {
+	qca,mib-poll-interval = <500>;
+
+	qca,ar8327-initvals = <
+		0x04 0x87680000 /* PORT0 PAD MODE CTRL */
+		0x10 0x40000000 /* POWER_ON_STRAP */
+		0x50 0xcf35cf35 /* LED_CTRL0 */
+		0x54 0xcf35cf35 /* LED_CTRL1 */
+		0x58 0xcf35cf35 /* LED_CTRL2 */
+		0x5c 0x03ffff00 /* LED_CTRL3 */
+		0x7c 0x0000007e /* PORT0_STATUS */
+	>;
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&usb1 {
+	status = "okay";
+};
+
+&wmac {
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
+};
+
+&ath10k_0 {
+	nvmem-cells = <&calibration_art_5000>;
+	nvmem-cell-names = "calibration";
+};

target/linux/ath79/dts/qca9558_engenius_esr900.dts

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x_senao_router-dual.dtsi"
+
+/ {
+	compatible = "engenius,esr900", "qca,qca9558";
+	model = "EnGenius ESR900";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "amber:power";
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		wlan2g {
+			label = "blue:wlan2g";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wlan5g {
+			label = "blue:wlan5g";
+			gpios = <&gpio 23 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wps_amber {
+			label = "amber:wps";
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+
+		wps_blue {
+			label = "blue:wps";
+			gpios = <&gpio 19 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&phy0 {
+	qca,mib-poll-interval = <500>;
+
+	qca,ar8327-initvals = <
+		0x04 0x07680000 /* PORT0 PAD MODE CTRL */
+		0x10 0x40000000 /* POWER_ON_STRAP */
+		0x50 0xcf35cf35 /* LED_CTRL0 */
+		0x54 0xcf35cf35 /* LED_CTRL1 */
+		0x58 0xcf35cf35 /* LED_CTRL2 */
+		0x5c 0x03ffff00 /* LED_CTRL3 */
+		0x7c 0x0000007e /* PORT0_STATUS */
+	>;
+};
+
+&usb_phy1 {
+	status = "okay";
+};
+
+&usb1 {
+	status = "okay";
+};
+
+&wmac {
+	nvmem-cells = <&calibration_art_1000>;
+	nvmem-cell-names = "calibration";
+};
+
+&pcie0 {
+	status = "okay";
+
+	wifi@0,0,0 {
+		compatible = "pci168c,0033";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&calibration_art_5000>;
+		nvmem-cell-names = "calibration";
+	};
+};

target/linux/ath79/dts/qca955x_senao_router-dual.dtsi

@@ -0,0 +1,122 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	phy-handle = <&phy0>;
+	pll-data = <0xa6000000 0x00000101 0x00001616>;
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	ath10k_0: wifi@0,0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0x0000 0 0 0 0>;
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x030000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x030000 0x010000>;
+				read-only;
+			};
+
+			partition@40000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x040000 0xe50000>;
+			};
+
+			partition@e90000 {
+				label = "manufacture";
+				reg = <0xe90000 0x100000>;
+				read-only;
+			};
+
+			partition@f90000 {
+				label = "backup";
+				reg = <0xf90000 0x010000>;
+				read-only;
+			};
+
+			partition@fa0000 {
+				label = "storage";
+				reg = <0xfa0000 0x050000>;
+				read-only;
+			};
+
+			art: partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x010000>;
+				read-only;
+
+				compatible = "nvmem-cells";
+
+				calibration_art_1000: calibration@1000 {
+					reg = <0x1000 0x440>;
+				};
+
+				calibration_art_5000: calibration@5000 {
+					reg = <0x5000 0x844>;
+				};
+			};
+		};
+	};
+};
+
+&wmac {
+	status = "okay";
+};

target/linux/ath79/generic/base-files/etc/board.d/02_network

@@ -287,6 +287,9 @@ ath79_setup_interfaces()
 	dlink,dir-842-c3|\
 	dlink,dir-859-a1|\
 	engenius,epg5000|\
+	engenius,esr1200|\
+	engenius,esr1750|\
+	engenius,esr900|\
 	sitecom,wlr-7100|\
 	tplink,archer-c2-v3|\
 	tplink,tl-wr1043nd-v4|\
@@ -665,7 +668,10 @@ ath79_setup_macs()
 		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		label_mac=$lan_mac
 		;;
-	engenius,epg5000)
+	engenius,epg5000|\
+	engenius,esr1200|\
+	engenius,esr1750|\
+	engenius,esr900)
 		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		wan_mac=$(mtd_get_mac_ascii u-boot-env wanaddr)
 		;;

target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/10-ath9k-eeprom

@@ -43,7 +43,14 @@ case "$FIRMWARE" in
 		caldata_extract "art" 0x1000 0x440
 		ath9k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env athaddr) 1)
 		;;
-	engenius,epg5000|\
+	enterasys,ws-ap3705i)
+		caldata_extract "calibrate" 0x1000 0x440
+		ath9k_patch_mac $(mtd_get_mac_ascii u-boot-env0 RADIOADDR1)
+		;;
+	extreme-networks,ws-ap3805i)
+		caldata_extract "art" 0x1000 0x440
+		ath9k_patch_mac $(mtd_get_mac_ascii cfg1 RADIOADDR1)
+		;;
 	iodata,wn-ac1167dgr|\
 	iodata,wn-ac1600dgr|\
 	iodata,wn-ac1600dgr2|\
@@ -53,14 +60,6 @@ case "$FIRMWARE" in
 		caldata_extract "art" 0x1000 0x440
 		ath9k_patch_mac $(mtd_get_mac_ascii u-boot-env ethaddr)
 		;;
-	enterasys,ws-ap3705i)
-		caldata_extract "calibrate" 0x1000 0x440
-		ath9k_patch_mac $(mtd_get_mac_ascii u-boot-env0 RADIOADDR1)
-		;;
-	extreme-networks,ws-ap3805i)
-		caldata_extract "art" 0x1000 0x440
-		ath9k_patch_mac $(mtd_get_mac_ascii cfg1 RADIOADDR1)
-		;;
 	nec,wg800hp)
 		caldata_extract "art" 0x1000 0x440
 		ath9k_patch_mac $(mtd_get_mac_text board_data 0x680)

target/linux/ath79/generic/base-files/etc/hotplug.d/firmware/11-ath10k-caldata

@@ -77,14 +77,6 @@ case "$FIRMWARE" in
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(mtd_get_mac_ascii u-boot-env athaddr)
 		;;
-	engenius,epg5000|\
-	iodata,wn-ac1167dgr|\
-	iodata,wn-ac1600dgr2|\
-	sitecom,wlr-7100|\
-	zyxel,nbg6616)
-		caldata_extract "art" 0x5000 0x844
-		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) 1)
-		;;
 	engenius,ews511ap)
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) 1)
@@ -97,6 +89,13 @@ case "$FIRMWARE" in
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) 1)
 		;;
+	iodata,wn-ac1167dgr|\
+	iodata,wn-ac1600dgr2|\
+	sitecom,wlr-7100|\
+	zyxel,nbg6616)
+		caldata_extract "art" 0x5000 0x844
+		ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) 1)
+		;;
 	nec,wg800hp)
 		caldata_extract "art" 0x5000 0x844
 		ath10k_patch_mac $(mtd_get_mac_text board_data 0x880)

target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac

@@ -35,6 +35,12 @@ case "$board" in
 		[ "$PHYNBR" -eq 1 ] && \
 			mtd_get_mac_ascii bdcfg "wlanmac" > /sys${DEVPATH}/macaddress
 		;;
+	engenius,epg5000|\
+	engenius,esr1200|\
+	engenius,esr1750|\
+	engenius,esr900)
+		macaddr_add "$(mtd_get_mac_ascii u-boot-env ethaddr)" "$PHYNBR" > /sys${DEVPATH}/macaddress
+		;;
 	fortinet,fap-221-b)
 		macaddr_add "$(mtd_get_mac_text u-boot 0x3ff80 12)" $((PHYNBR*7+1)) > /sys${DEVPATH}/macaddress
 		;;

target/linux/ath79/generic/base-files/lib/preinit/10_fix_eth_mac.sh

@@ -12,6 +12,12 @@ preinit_set_mac_address() {
 		ip link set dev eth0 address $(mtd_get_mac_ascii bdcfg "lanmac")
 		ip link set dev eth1 address $(mtd_get_mac_ascii bdcfg "wanmac")
 		;;
+	engenius,epg5000|\
+	engenius,esr1200|\
+	engenius,esr1750|\
+	engenius,esr900)
+		ip link set dev eth0 address $(mtd_get_mac_ascii u-boot-env ethaddr)
+		;;
 	enterasys,ws-ap3705i)
 		ip link set dev eth0 address $(mtd_get_mac_ascii u-boot-env0 ethaddr)
 		;;

target/linux/ath79/image/generic.mk

@@ -1299,6 +1299,48 @@ define Device/engenius_epg5000
 endef
 TARGET_DEVICES += engenius_epg5000
 
+define Device/engenius_esr1200
+  SOC := qca9557
+  DEVICE_VENDOR := EnGenius
+  DEVICE_MODEL := ESR1200
+  DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct kmod-usb2
+  IMAGE_SIZE := 14656k
+  IMAGES += factory.dlf
+  IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | check-size | \
+	senao-header -r 0x101 -p 0x61 -t 2
+  SUPPORTED_DEVICES += esr1200 esr1750 engenius,esr1750
+endef
+TARGET_DEVICES += engenius_esr1200
+
+define Device/engenius_esr1750
+  SOC := qca9558
+  DEVICE_VENDOR := EnGenius
+  DEVICE_MODEL := ESR1750
+  DEVICE_PACKAGES := ath10k-firmware-qca988x-ct kmod-ath10k-ct kmod-usb2
+  IMAGE_SIZE := 14656k
+  IMAGES += factory.dlf
+  IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | check-size | \
+	senao-header -r 0x101 -p 0x62 -t 2
+  SUPPORTED_DEVICES += esr1750 esr1200 engenius,esr1200
+endef
+TARGET_DEVICES += engenius_esr1750
+
+define Device/engenius_esr900
+  SOC := qca9558
+  DEVICE_VENDOR := EnGenius
+  DEVICE_MODEL := ESR900
+  DEVICE_PACKAGES := kmod-usb2
+  IMAGE_SIZE := 14656k
+  IMAGES += factory.dlf
+  IMAGE/factory.dlf := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+	append-rootfs | pad-rootfs | check-size | \
+	senao-header -r 0x101 -p 0x4e -t 2
+  SUPPORTED_DEVICES += esr900
+endef
+TARGET_DEVICES += engenius_esr900
+
 define Device/engenius_ews511ap
   SOC := qca9531
   DEVICE_VENDOR := EnGenius

target/linux/bcm27xx/patches-5.15/950-0005-drm-vc4-hdmi-Raise-the-maximum-clock-rate.patch

@@ -20,7 +20,7 @@ Link: https://lore.kernel.org/r/20211025152903.1088803-9-maxime@cerno.tech
 
 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
 +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -2385,7 +2385,7 @@ static const struct vc4_hdmi_variant bcm
+@@ -2386,7 +2386,7 @@ static const struct vc4_hdmi_variant bcm
  	.encoder_type		= VC4_ENCODER_TYPE_HDMI0,
  	.debugfs_name		= "hdmi0_regs",
  	.card_name		= "vc4-hdmi-0",

target/linux/bcm27xx/patches-5.15/950-0007-drm-vc4-hdmi-Add-a-spinlock-to-protect-register-acce.patch

@@ -736,7 +736,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	u32 value;
  	int ret;
  
-@@ -1885,10 +2062,12 @@ static int vc4_hdmi_cec_init(struct vc4_
+@@ -1886,10 +2063,12 @@ static int vc4_hdmi_cec_init(struct vc4_
  	cec_fill_conn_info_from_drm(&conn_info, &vc4_hdmi->connector);
  	cec_s_conn_info(vc4_hdmi->cec_adap, &conn_info);
  
@@ -749,7 +749,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	vc4_hdmi_cec_update_clk_div(vc4_hdmi);
  
-@@ -1907,7 +2086,9 @@ static int vc4_hdmi_cec_init(struct vc4_
+@@ -1908,7 +2087,9 @@ static int vc4_hdmi_cec_init(struct vc4_
  		if (ret)
  			goto err_remove_cec_rx_handler;
  	} else {
@@ -759,7 +759,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  		ret = request_threaded_irq(platform_get_irq(pdev, 0),
  					   vc4_cec_irq_handler,
-@@ -2177,6 +2358,7 @@ static int vc4_hdmi_bind(struct device *
+@@ -2178,6 +2359,7 @@ static int vc4_hdmi_bind(struct device *
  	vc4_hdmi = devm_kzalloc(dev, sizeof(*vc4_hdmi), GFP_KERNEL);
  	if (!vc4_hdmi)
  		return -ENOMEM;

target/linux/bcm27xx/patches-5.15/950-0008-drm-vc4-hdmi-Use-a-mutex-to-prevent-concurrent-frame.patch

@@ -411,7 +411,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (msg->len > 16) {
  		drm_err(dev, "Attempting to transmit too much data (%d)\n", msg->len);
  		return -ENOMEM;
-@@ -2358,6 +2463,7 @@ static int vc4_hdmi_bind(struct device *
+@@ -2359,6 +2464,7 @@ static int vc4_hdmi_bind(struct device *
  	vc4_hdmi = devm_kzalloc(dev, sizeof(*vc4_hdmi), GFP_KERNEL);
  	if (!vc4_hdmi)
  		return -ENOMEM;

target/linux/bcm27xx/patches-5.15/950-0012-drm-vc4-hdmi-Introduce-a-scdc_enabled-flag.patch

@@ -69,7 +69,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	if (delayed_work_pending(&vc4_hdmi->scrambling_work))
  		cancel_delayed_work_sync(&vc4_hdmi->scrambling_work);
-@@ -2521,6 +2515,14 @@ static int vc4_hdmi_bind(struct device *
+@@ -2522,6 +2516,14 @@ static int vc4_hdmi_bind(struct device *
  	vc4_hdmi->pdev = pdev;
  	vc4_hdmi->variant = variant;
  

target/linux/bcm27xx/patches-5.15/950-0427-drm-vc4-Add-all-the-HDMI-registers-into-the-debugfs-.patch

@@ -29,7 +29,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  	return 0;
  }
-@@ -2368,6 +2374,7 @@ static int vc5_hdmi_init_resources(struc
+@@ -2369,6 +2375,7 @@ static int vc5_hdmi_init_resources(struc
  	struct platform_device *pdev = vc4_hdmi->pdev;
  	struct device *dev = &pdev->dev;
  	struct resource *res;
@@ -37,7 +37,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "hdmi");
  	if (!res)
-@@ -2464,6 +2471,38 @@ static int vc5_hdmi_init_resources(struc
+@@ -2465,6 +2472,38 @@ static int vc5_hdmi_init_resources(struc
  		return PTR_ERR(vc4_hdmi->reset);
  	}
  

target/linux/bcm27xx/patches-5.15/950-0572-drm-vc4-Don-t-try-disabling-SCDC-on-Pi0-3.patch

@@ -20,7 +20,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
 +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -2556,7 +2556,8 @@ static int vc4_hdmi_bind(struct device *
+@@ -2557,7 +2557,8 @@ static int vc4_hdmi_bind(struct device *
  	 * vc4_hdmi_disable_scrambling() will thus run at boot, make
  	 * sure it's disabled, and avoid any inconsistency.
  	 */

target/linux/bcm27xx/patches-5.15/950-0580-drm-vc4-Ensure-vc4_hdmi-doesn-t-use-2711-HPD-registe.patch

@@ -55,7 +55,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  /* HDMI audio codec callbacks */
  static void vc4_hdmi_audio_set_mai_clock(struct vc4_hdmi *vc4_hdmi,
  					 unsigned int samplerate)
-@@ -2776,6 +2782,7 @@ static const struct vc4_hdmi_variant bcm
+@@ -2777,6 +2783,7 @@ static const struct vc4_hdmi_variant bcm
  	.phy_rng_disable	= vc5_hdmi_phy_rng_disable,
  	.channel_map		= vc5_hdmi_channel_map,
  	.supports_hdr		= true,
@@ -63,7 +63,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  };
  
  static const struct vc4_hdmi_variant bcm2711_hdmi1_variant = {
-@@ -2804,6 +2811,7 @@ static const struct vc4_hdmi_variant bcm
+@@ -2805,6 +2812,7 @@ static const struct vc4_hdmi_variant bcm
  	.phy_rng_disable	= vc5_hdmi_phy_rng_disable,
  	.channel_map		= vc5_hdmi_channel_map,
  	.supports_hdr		= true,

target/linux/bcm27xx/patches-5.15/950-0590-drm-vc4-Move-HDMI-reset-to-pm_resume.patch

@@ -30,7 +30,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	int ret;
  
  	if (!of_find_property(dev->of_node, "interrupts", NULL)) {
-@@ -2212,15 +2211,6 @@ static int vc4_hdmi_cec_init(struct vc4_
+@@ -2213,15 +2212,6 @@ static int vc4_hdmi_cec_init(struct vc4_
  	cec_fill_conn_info_from_drm(&conn_info, &vc4_hdmi->connector);
  	cec_s_conn_info(vc4_hdmi->cec_adap, &conn_info);
  
@@ -46,7 +46,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	if (vc4_hdmi->variant->external_irq_controller) {
  		ret = request_threaded_irq(platform_get_irq_byname(pdev, "cec-rx"),
  					   vc4_cec_irq_handler_rx_bare,
-@@ -2283,6 +2273,29 @@ static void vc4_hdmi_cec_exit(struct vc4
+@@ -2284,6 +2274,29 @@ static void vc4_hdmi_cec_exit(struct vc4
  
  	cec_unregister_adapter(vc4_hdmi->cec_adap);
  }
@@ -76,7 +76,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  #else
  static int vc4_hdmi_cec_init(struct vc4_hdmi *vc4_hdmi)
  {
-@@ -2291,6 +2304,10 @@ static int vc4_hdmi_cec_init(struct vc4_
+@@ -2292,6 +2305,10 @@ static int vc4_hdmi_cec_init(struct vc4_
  
  static void vc4_hdmi_cec_exit(struct vc4_hdmi *vc4_hdmi) {};
  
@@ -87,7 +87,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  #endif
  
  static int vc4_hdmi_build_regset(struct vc4_hdmi *vc4_hdmi,
-@@ -2525,6 +2542,15 @@ static int vc4_hdmi_runtime_resume(struc
+@@ -2526,6 +2543,15 @@ static int vc4_hdmi_runtime_resume(struc
  	if (ret)
  		return ret;
  

target/linux/bcm27xx/patches-5.15/950-0607-drm-vc4-Fix-build-without-DRM_VC4_HDMI_CEC.patch

@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
 +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -2279,7 +2279,7 @@ static int vc4_hdmi_cec_init(struct vc4_
+@@ -2280,7 +2280,7 @@ static int vc4_hdmi_cec_init(struct vc4_
  
  static void vc4_hdmi_cec_exit(struct vc4_hdmi *vc4_hdmi) {};
  

target/linux/bcm27xx/patches-5.15/950-0868-drm-vc4-hdmi-Rework-hdmi_enable_4kp60-detection.patch

@@ -79,7 +79,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		return MODE_CLOCK_HIGH;
  
  	if (info->max_tmds_clock && clock > (info->max_tmds_clock * 1000))
-@@ -3156,14 +3158,6 @@ static int vc4_hdmi_bind(struct device *
+@@ -3157,14 +3159,6 @@ static int vc4_hdmi_bind(struct device *
  	vc4_hdmi->disable_wifi_frequencies =
  		of_property_read_bool(dev->of_node, "wifi-2.4ghz-coexistence");
  

target/linux/generic/backport-5.10/631-v6.3-net-page_pool-use-in_softirq-instead.patch

@@ -0,0 +1,56 @@
+From: Qingfang DENG <qingfang.deng@siflower.com.cn>
+Date: Fri, 3 Feb 2023 09:16:11 +0800
+Subject: [PATCH] net: page_pool: use in_softirq() instead
+
+We use BH context only for synchronization, so we don't care if it's
+actually serving softirq or not.
+
+As a side node, in case of threaded NAPI, in_serving_softirq() will
+return false because it's in process context with BH off, making
+page_pool_recycle_in_cache() unreachable.
+
+Signed-off-by: Qingfang DENG <qingfang.deng@siflower.com.cn>
+---
+
+--- a/include/net/page_pool.h
++++ b/include/net/page_pool.h
+@@ -295,7 +295,7 @@ static inline void page_pool_nid_changed
+ static inline void page_pool_ring_lock(struct page_pool *pool)
+ 	__acquires(&pool->ring.producer_lock)
+ {
+-	if (in_serving_softirq())
++	if (in_softirq())
+ 		spin_lock(&pool->ring.producer_lock);
+ 	else
+ 		spin_lock_bh(&pool->ring.producer_lock);
+@@ -304,7 +304,7 @@ static inline void page_pool_ring_lock(s
+ static inline void page_pool_ring_unlock(struct page_pool *pool)
+ 	__releases(&pool->ring.producer_lock)
+ {
+-	if (in_serving_softirq())
++	if (in_softirq())
+ 		spin_unlock(&pool->ring.producer_lock);
+ 	else
+ 		spin_unlock_bh(&pool->ring.producer_lock);
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -338,8 +338,8 @@ static void page_pool_return_page(struct
+ static bool page_pool_recycle_in_ring(struct page_pool *pool, struct page *page)
+ {
+ 	int ret;
+-	/* BH protection not needed if current is serving softirq */
+-	if (in_serving_softirq())
++	/* BH protection not needed if current is softirq */
++	if (in_softirq())
+ 		ret = ptr_ring_produce(&pool->ring, page);
+ 	else
+ 		ret = ptr_ring_produce_bh(&pool->ring, page);
+@@ -397,7 +397,7 @@ __page_pool_put_page(struct page_pool *p
+ 			page_pool_dma_sync_for_device(pool, page,
+ 						      dma_sync_size);
+ 
+-		if (allow_direct && in_serving_softirq() &&
++		if (allow_direct && in_softirq() &&
+ 		    page_pool_recycle_in_cache(page, pool))
+ 			return NULL;
+ 

target/linux/generic/backport-5.15/020-v6.1-04-mm-multigenerational-lru-groundwork.patch

@@ -694,7 +694,7 @@ Change-Id: I71de7cd15b8dfa6f9fdd838023474693c4fee0a7
  		local_lock(&lru_pvecs.lock);
 --- a/mm/swapfile.c
 +++ b/mm/swapfile.c
-@@ -2688,6 +2688,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
+@@ -2689,6 +2689,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
  	err = 0;
  	atomic_inc(&proc_poll_event);
  	wake_up_interruptible(&proc_poll_wait);
@@ -702,7 +702,7 @@ Change-Id: I71de7cd15b8dfa6f9fdd838023474693c4fee0a7
  
  out_dput:
  	filp_close(victim, NULL);
-@@ -3349,6 +3350,7 @@ SYSCALL_DEFINE2(swapon, const char __use
+@@ -3350,6 +3351,7 @@ SYSCALL_DEFINE2(swapon, const char __use
  	mutex_unlock(&swapon_mutex);
  	atomic_inc(&proc_poll_event);
  	wake_up_interruptible(&proc_poll_wait);

target/linux/generic/backport-5.15/610-v6.3-net-page_pool-use-in_softirq-instead.patch

@@ -0,0 +1,56 @@
+From: Qingfang DENG <qingfang.deng@siflower.com.cn>
+Date: Fri, 3 Feb 2023 09:16:11 +0800
+Subject: [PATCH] net: page_pool: use in_softirq() instead
+
+We use BH context only for synchronization, so we don't care if it's
+actually serving softirq or not.
+
+As a side node, in case of threaded NAPI, in_serving_softirq() will
+return false because it's in process context with BH off, making
+page_pool_recycle_in_cache() unreachable.
+
+Signed-off-by: Qingfang DENG <qingfang.deng@siflower.com.cn>
+---
+
+--- a/include/net/page_pool.h
++++ b/include/net/page_pool.h
+@@ -357,7 +357,7 @@ static inline void page_pool_nid_changed
+ static inline void page_pool_ring_lock(struct page_pool *pool)
+ 	__acquires(&pool->ring.producer_lock)
+ {
+-	if (in_serving_softirq())
++	if (in_softirq())
+ 		spin_lock(&pool->ring.producer_lock);
+ 	else
+ 		spin_lock_bh(&pool->ring.producer_lock);
+@@ -366,7 +366,7 @@ static inline void page_pool_ring_lock(s
+ static inline void page_pool_ring_unlock(struct page_pool *pool)
+ 	__releases(&pool->ring.producer_lock)
+ {
+-	if (in_serving_softirq())
++	if (in_softirq())
+ 		spin_unlock(&pool->ring.producer_lock);
+ 	else
+ 		spin_unlock_bh(&pool->ring.producer_lock);
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -512,8 +512,8 @@ static void page_pool_return_page(struct
+ static bool page_pool_recycle_in_ring(struct page_pool *pool, struct page *page)
+ {
+ 	int ret;
+-	/* BH protection not needed if current is serving softirq */
+-	if (in_serving_softirq())
++	/* BH protection not needed if current is softirq */
++	if (in_softirq())
+ 		ret = ptr_ring_produce(&pool->ring, page);
+ 	else
+ 		ret = ptr_ring_produce_bh(&pool->ring, page);
+@@ -576,7 +576,7 @@ __page_pool_put_page(struct page_pool *p
+ 			page_pool_dma_sync_for_device(pool, page,
+ 						      dma_sync_size);
+ 
+-		if (allow_direct && in_serving_softirq() &&
++		if (allow_direct && in_softirq() &&
+ 		    page_pool_recycle_in_cache(page, pool))
+ 			return NULL;
+ 

target/linux/generic/backport-5.15/802-v5.16-0001-nvmem-core-rework-nvmem-cell-instance-creation.patch

@@ -206,7 +206,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	}
  
  	return 0;
-@@ -1141,9 +1143,33 @@ struct nvmem_device *devm_nvmem_device_g
+@@ -1139,9 +1141,33 @@ struct nvmem_device *devm_nvmem_device_g
  }
  EXPORT_SYMBOL_GPL(devm_nvmem_device_get);
  
@@ -240,7 +240,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	struct nvmem_cell *cell = ERR_PTR(-ENOENT);
  	struct nvmem_cell_lookup *lookup;
  	struct nvmem_device *nvmem;
-@@ -1168,11 +1194,15 @@ nvmem_cell_get_from_lookup(struct device
+@@ -1166,11 +1192,15 @@ nvmem_cell_get_from_lookup(struct device
  				break;
  			}
  
@@ -259,7 +259,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  			}
  			break;
  		}
-@@ -1183,10 +1213,10 @@ nvmem_cell_get_from_lookup(struct device
+@@ -1181,10 +1211,10 @@ nvmem_cell_get_from_lookup(struct device
  }
  
  #if IS_ENABLED(CONFIG_OF)
@@ -273,7 +273,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  
  	mutex_lock(&nvmem_mutex);
  	list_for_each_entry(iter, &nvmem->cells, node) {
-@@ -1216,6 +1246,7 @@ struct nvmem_cell *of_nvmem_cell_get(str
+@@ -1214,6 +1244,7 @@ struct nvmem_cell *of_nvmem_cell_get(str
  {
  	struct device_node *cell_np, *nvmem_np;
  	struct nvmem_device *nvmem;
@@ -281,7 +281,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	struct nvmem_cell *cell;
  	int index = 0;
  
-@@ -1236,12 +1267,16 @@ struct nvmem_cell *of_nvmem_cell_get(str
+@@ -1234,12 +1265,16 @@ struct nvmem_cell *of_nvmem_cell_get(str
  	if (IS_ERR(nvmem))
  		return ERR_CAST(nvmem);
  
@@ -300,7 +300,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	return cell;
  }
  EXPORT_SYMBOL_GPL(of_nvmem_cell_get);
-@@ -1347,13 +1382,17 @@ EXPORT_SYMBOL(devm_nvmem_cell_put);
+@@ -1345,13 +1380,17 @@ EXPORT_SYMBOL(devm_nvmem_cell_put);
   */
  void nvmem_cell_put(struct nvmem_cell *cell)
  {
@@ -320,7 +320,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  {
  	u8 *p, *b;
  	int i, extra, bit_offset = cell->bit_offset;
-@@ -1387,8 +1426,8 @@ static void nvmem_shift_read_buffer_in_p
+@@ -1385,8 +1424,8 @@ static void nvmem_shift_read_buffer_in_p
  }
  
  static int __nvmem_cell_read(struct nvmem_device *nvmem,
@@ -331,7 +331,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  {
  	int rc;
  
-@@ -1419,18 +1458,18 @@ static int __nvmem_cell_read(struct nvme
+@@ -1417,18 +1456,18 @@ static int __nvmem_cell_read(struct nvme
   */
  void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
  {
@@ -353,7 +353,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	if (rc) {
  		kfree(buf);
  		return ERR_PTR(rc);
-@@ -1440,7 +1479,7 @@ void *nvmem_cell_read(struct nvmem_cell
+@@ -1438,7 +1477,7 @@ void *nvmem_cell_read(struct nvmem_cell
  }
  EXPORT_SYMBOL_GPL(nvmem_cell_read);
  
@@ -362,7 +362,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  					     u8 *_buf, int len)
  {
  	struct nvmem_device *nvmem = cell->nvmem;
-@@ -1493,16 +1532,7 @@ err:
+@@ -1491,16 +1530,7 @@ err:
  	return ERR_PTR(rc);
  }
  
@@ -380,7 +380,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  {
  	struct nvmem_device *nvmem = cell->nvmem;
  	int rc;
-@@ -1528,6 +1558,21 @@ int nvmem_cell_write(struct nvmem_cell *
+@@ -1526,6 +1556,21 @@ int nvmem_cell_write(struct nvmem_cell *
  
  	return len;
  }
@@ -402,7 +402,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  EXPORT_SYMBOL_GPL(nvmem_cell_write);
  
  static int nvmem_cell_read_common(struct device *dev, const char *cell_id,
-@@ -1630,7 +1675,7 @@ static const void *nvmem_cell_read_varia
+@@ -1628,7 +1673,7 @@ static const void *nvmem_cell_read_varia
  	if (IS_ERR(cell))
  		return cell;
  
@@ -411,7 +411,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	buf = nvmem_cell_read(cell, len);
  	nvmem_cell_put(cell);
  	if (IS_ERR(buf))
-@@ -1726,18 +1771,18 @@ EXPORT_SYMBOL_GPL(nvmem_cell_read_variab
+@@ -1724,18 +1769,18 @@ EXPORT_SYMBOL_GPL(nvmem_cell_read_variab
  ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
  			   struct nvmem_cell_info *info, void *buf)
  {
@@ -433,7 +433,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	if (rc)
  		return rc;
  
-@@ -1757,17 +1802,17 @@ EXPORT_SYMBOL_GPL(nvmem_device_cell_read
+@@ -1755,17 +1800,17 @@ EXPORT_SYMBOL_GPL(nvmem_device_cell_read
  int nvmem_device_cell_write(struct nvmem_device *nvmem,
  			    struct nvmem_cell_info *info, void *buf)
  {

target/linux/generic/backport-5.15/802-v5.16-0002-nvmem-core-add-nvmem-cell-post-processing-callback.patch

@@ -30,7 +30,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	struct gpio_desc	*wp_gpio;
  	void *priv;
  };
-@@ -798,6 +799,7 @@ struct nvmem_device *nvmem_register(cons
+@@ -797,6 +798,7 @@ struct nvmem_device *nvmem_register(cons
  	nvmem->type = config->type;
  	nvmem->reg_read = config->reg_read;
  	nvmem->reg_write = config->reg_write;
@@ -38,7 +38,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	nvmem->keepout = config->keepout;
  	nvmem->nkeepout = config->nkeepout;
  	if (config->of_node)
-@@ -1440,6 +1442,13 @@ static int __nvmem_cell_read(struct nvme
+@@ -1438,6 +1440,13 @@ static int __nvmem_cell_read(struct nvme
  	if (cell->bit_offset || cell->nbits)
  		nvmem_shift_read_buffer_in_place(cell, buf);
  
@@ -72,7 +72,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
   * @size:	Device size.
   * @word_size:	Minimum read/write access granularity.
   * @stride:	Minimum read/write access stride.
-@@ -94,6 +98,7 @@ struct nvmem_config {
+@@ -92,6 +96,7 @@ struct nvmem_config {
  	bool			no_of_node;
  	nvmem_reg_read_t	reg_read;
  	nvmem_reg_write_t	reg_write;

target/linux/generic/backport-5.15/804-v5.18-0001-nvmem-core-Remove-unused-devm_nvmem_unregister.patch

@@ -17,7 +17,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/nvmem/core.c
 +++ b/drivers/nvmem/core.c
-@@ -942,28 +942,6 @@ struct nvmem_device *devm_nvmem_register
+@@ -940,28 +940,6 @@ struct nvmem_device *devm_nvmem_register
  }
  EXPORT_SYMBOL_GPL(devm_nvmem_register);
  
@@ -48,7 +48,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  {
 --- a/include/linux/nvmem-provider.h
 +++ b/include/linux/nvmem-provider.h
-@@ -135,8 +135,6 @@ void nvmem_unregister(struct nvmem_devic
+@@ -133,8 +133,6 @@ void nvmem_unregister(struct nvmem_devic
  struct nvmem_device *devm_nvmem_register(struct device *dev,
  					 const struct nvmem_config *cfg);
  
@@ -57,7 +57,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  void nvmem_add_cell_table(struct nvmem_cell_table *table);
  void nvmem_del_cell_table(struct nvmem_cell_table *table);
  
-@@ -155,12 +153,6 @@ devm_nvmem_register(struct device *dev,
+@@ -153,12 +151,6 @@ devm_nvmem_register(struct device *dev,
  	return nvmem_register(c);
  }
  

target/linux/generic/backport-5.15/804-v5.18-0002-nvmem-core-Use-devm_add_action_or_reset.patch

@@ -16,7 +16,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/nvmem/core.c
 +++ b/drivers/nvmem/core.c
-@@ -904,9 +904,9 @@ void nvmem_unregister(struct nvmem_devic
+@@ -902,9 +902,9 @@ void nvmem_unregister(struct nvmem_devic
  }
  EXPORT_SYMBOL_GPL(nvmem_unregister);
  
@@ -28,7 +28,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  }
  
  /**
-@@ -923,20 +923,16 @@ static void devm_nvmem_release(struct de
+@@ -921,20 +921,16 @@ static void devm_nvmem_release(struct de
  struct nvmem_device *devm_nvmem_register(struct device *dev,
  					 const struct nvmem_config *config)
  {

target/linux/generic/backport-5.15/804-v5.18-0003-nvmem-core-Check-input-parameter-for-NULL-in-nvmem_u.patch

@@ -18,7 +18,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/nvmem/core.c
 +++ b/drivers/nvmem/core.c
-@@ -900,7 +900,8 @@ static void nvmem_device_release(struct
+@@ -898,7 +898,8 @@ static void nvmem_device_release(struct
   */
  void nvmem_unregister(struct nvmem_device *nvmem)
  {

target/linux/generic/backport-5.15/807-v6.1-0003-nvmem-core-add-error-handling-for-dev_set_name.patch

@@ -17,7 +17,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/nvmem/core.c
 +++ b/drivers/nvmem/core.c
-@@ -810,18 +810,24 @@ struct nvmem_device *nvmem_register(cons
+@@ -809,18 +809,24 @@ struct nvmem_device *nvmem_register(cons
  
  	switch (config->id) {
  	case NVMEM_DEVID_NONE:

target/linux/ipq807x/base-files/etc/board.d/02_network

@@ -11,7 +11,9 @@ ipq807x_setup_interfaces()
 	local board="$1"
 
 	case "$board" in
-	dynalink,dl-wrx36)
+	buffalo,wxr-5950ax12|\
+	dynalink,dl-wrx36|\
+	xiaomi,ax9000)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
 		;;
 	edgecore,eap102)
@@ -27,9 +29,6 @@ ipq807x_setup_interfaces()
 	xiaomi,ax3600)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
 		;;
-	xiaomi,ax9000)
-		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
-		;;
 	zyxel,nbg7815)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 10g" "wan"
 		;;

target/linux/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata

@@ -9,6 +9,7 @@ board=$(board_name)
 case "$FIRMWARE" in
 "ath11k/IPQ8074/hw2.0/cal-ahb-c000000.wifi.bin")
 	case "$board" in
+	buffalo,wxr-5950ax12|\
 	edgecore,eap102|\
 	edimax,cax1800|\
 	dynalink,dl-wrx36|\

target/linux/ipq807x/base-files/lib/upgrade/buffalo.sh

@@ -0,0 +1,55 @@
+. /lib/functions.sh
+
+# Prepare UBI devices for OpenWrt installation
+# - rootfs (mtd22)
+#   - remove "ubi_rootfs" volume (rootfs on stock)
+#   - remove "fw_hash" volume (firmware hash)
+# - user_property (mtd24)
+#   - remove "user_property_ubi" volume (user configuration)
+#   - remove "extra_property" volume (gzipped syslog)
+buffalo_upgrade_prepare() {
+	local ubi_rootdev ubi_propdev
+
+	if ! ubi_rootdev="$(nand_attach_ubi rootfs)" || \
+	   ! ubi_propdev="$(nand_attach_ubi user_property)"; then
+		echo "failed to attach UBI volume \"rootfs\" or \"user_property\", rebooting..."
+		reboot -f
+	fi
+
+	ubirmvol /dev/$ubi_rootdev -N ubi_rootfs &> /dev/null || true
+	ubirmvol /dev/$ubi_rootdev -N fw_hash &> /dev/null || true
+
+	ubirmvol /dev/$ubi_propdev -N user_property_ubi &> /dev/null || true
+	ubirmvol /dev/$ubi_propdev -N extra_property &> /dev/null || true
+}
+
+# Re-create small dummy ubi_rootfs volume and update
+# fw_hash volume to pass the checking by U-Boot
+# - rootfs (mtd22)
+#   - re-create "ubi_rootfs" volume
+#   - re-create and update "fw_hash" volume
+# - rootfs_recover (mtd23)
+#   - update "fw_hash" volume
+buffalo_upgrade_optvol() {
+	local ubi_rootdev ubi_rcvrdev
+	local hashvol_root hashvol_rcvr
+
+	if ! ubi_rootdev="$(nand_attach_ubi rootfs)" || \
+	   ! ubi_rcvrdev="$(nand_attach_ubi rootfs_recover)"; then
+		echo "failed to attach UBI volume \"rootfs\" or \"rootfs_recover\", rebooting..."
+		reboot -f
+	fi
+
+	ubimkvol /dev/$ubi_rootdev -N ubi_rootfs -S 1
+	ubimkvol /dev/$ubi_rootdev -N fw_hash -S 1 -t static
+
+	if ! hashvol_root="$(nand_find_volume $ubi_rootdev fw_hash)" || \
+	   ! hashvol_rcvr="$(nand_find_volume $ubi_rcvrdev fw_hash)"; then
+		echo "\"fw_hash\" volume in \"rootfs\" or \"rootfs_recover\" not found, rebooting..."
+		reboot -f
+	fi
+
+	echo -n "00000000000000000000000000000000" > /tmp/dummyhash.txt
+	ubiupdatevol /dev/$hashvol_root /tmp/dummyhash.txt
+	ubiupdatevol /dev/$hashvol_rcvr /tmp/dummyhash.txt
+}

target/linux/ipq807x/base-files/lib/upgrade/platform.sh

@@ -43,6 +43,14 @@ platform_pre_upgrade() {
 
 platform_do_upgrade() {
 	case "$(board_name)" in
+	buffalo,wxr-5950ax12)
+		CI_KERN_UBIPART="rootfs"
+		CI_ROOT_UBIPART="user_property"
+		buffalo_upgrade_prepare
+		nand_do_flash_file "$1" || nand_do_upgrade_failed
+		nand_do_restore_config || nand_do_upgrade_failed
+		buffalo_upgrade_optvol
+		;;
 	dynalink,dl-wrx36)
 		nand_do_upgrade "$1"
 		;;

target/linux/ipq807x/config-5.15

@@ -398,6 +398,7 @@ CONFIG_REGULATOR=y
 CONFIG_REGULATOR_CPR3=y
 # CONFIG_REGULATOR_CPR3_NPU is not set
 CONFIG_REGULATOR_CPR4_APSS=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
 # CONFIG_REGULATOR_QCOM_LABIBB is not set
 CONFIG_REGULATOR_QCOM_SPMI=y
 # CONFIG_REGULATOR_QCOM_USB_VBUS is not set

target/linux/ipq807x/files/arch/arm64/boot/dts/qcom/ipq8074-wxr-5950ax12.dts

@@ -0,0 +1,376 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include "ipq8074.dtsi"
+#include "ipq8074-hk-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/input/input.h>
+
+/ {
+	model = "Buffalo WXR-5950AX12";
+	compatible = "buffalo,wxr-5950ax12", "qcom,ipq8074";
+
+	aliases {
+		serial0 = &blsp1_uart5;
+		led-boot = &led_power_white;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_white;
+		led-upgrade = &led_power_white;
+		label-mac-device = &dp5_syn;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " ubi.mtd=user_property root=/dev/ubiblock1_0";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "white:router";
+			gpios = <&tlmm 21 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+		};
+
+		led-1 {
+			label = "red:router";
+			gpios = <&tlmm 22 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led_power_red: led-2 {
+			label = "red:power";
+			gpios = <&tlmm 31 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led_power_white: led-3 {
+			label = "white:power";
+			gpios = <&tlmm 34 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led-4 {
+			label = "white:internet";
+			gpios = <&tlmm 43 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+		};
+
+		led-5 {
+			label = "red:internet";
+			gpios = <&tlmm 44 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+		led-6 {
+			label = "red:wireless";
+			gpios = <&tlmm 55 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN;
+		};
+
+		led-7 {
+			label = "white:wireless";
+			gpios = <&tlmm 56 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_WLAN;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		/*
+		 * mode: 3x position switch
+		 *
+		 * - ROUTER
+		 * - AP
+		 * - WB (Wireless Bridge)
+		 */
+		ap {
+			label = "mode-ap";
+			gpios = <&tlmm 29 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+		};
+
+		bridge {
+			label = "mode-wb";
+			gpios = <&tlmm 30 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+		};
+
+		/*
+		 * op: 2x position switch
+		 *
+		 * - AUTO
+		 * - MANUAL (select Router/AP/WB manually)
+		 */
+		manual {
+			label = "op-manual";
+			gpios = <&tlmm 52 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_2>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&tlmm 51 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&tlmm 54 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	reg_usb_vbus: regulator-5v-vbus {
+		compatible = "regulator-fixed";
+		regulator-name = "vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpio = <&tlmm 64 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-always-on;
+	};
+};
+
+&tlmm {
+	mdio_pins: mdio-pins {
+		mdc {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&qpic_nand {
+	status = "okay";
+
+	nand@0 {
+		reg = <0>;
+		nand-ecc-strength = <4>;
+		nand-ecc-step-size = <512>;
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "qcom,smem-part";
+
+			partition-0-appsblenv {
+				compatible = "fixed-partitions";
+				label = "0:appsblenv";
+				read-only;
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					compatible = "u-boot,env";
+					label = "env-data";
+					reg = <0x0 0x40000>;
+
+					macaddr_appsblenv_ethaddr: ethaddr {
+					};
+				};
+			};
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	/*
+	 * RESET pins of phy chips
+	 *
+	 * WXR-5950AX12 has 2x RESET pins for QCA8075 and AQR113C.
+	 * The pin of QCA8075 is for the chip and not phys in the chip, the
+	 * pin of AQR113C is for 2x chips. So both pins are not appropriate
+	 * to declare them as reset-gpios in phy nodes.
+	 * Multiple entries in reset-gpios of mdio may not be supported, but
+	 * leave the following as-is to show that the those reset pin exists.
+	 */
+	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>, /* QCA8075 RESET */
+		      <&tlmm 63 GPIO_ACTIVE_LOW>; /* AQR113C RESET (2x) */
+
+	aqr113c_1: ethernet-phy@0 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <0x0>;
+	};
+
+	aqr113c_2: ethernet-phy@8 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <0x8>;
+	};
+
+	qca8075_1: ethernet-phy@18 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x18>;
+	};
+
+	qca8075_2: ethernet-phy@19 {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x19>;
+	};
+
+	qca8075_3: ethernet-phy@1a {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x1a>;
+	};
+
+	qca8075_4: ethernet-phy@1b {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x1b>;
+	};
+
+	qca8075_5: ethernet-phy@1c {
+		compatible = "ethernet-phy-ieee802.3-c22";
+		reg = <0x1c>;
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_cpu_bmp = <0x1>;
+	switch_lan_bmp = <0x3e>;
+	switch_wan_bmp = <0x40>;
+	switch_mac_mode = <0xb>;
+	switch_mac_mode1 = <0xd>;
+	switch_mac_mode2 = <0xd>;
+	bm_tick_mode = <0>;
+	tm_tick_mode = <0>;
+
+	qcom,port_phyinfo {
+		port@0 {
+			port_id = <1>;
+			phy_address = <0x18>;
+		};
+
+		port@1 {
+			port_id = <2>;
+			phy_address = <0x19>;
+		};
+
+		port@2 {
+			port_id = <3>;
+			phy_address = <0x1a>;
+		};
+
+		port@3 {
+			port_id = <4>;
+			phy_address = <0x1b>;
+		};
+
+		port@4 {
+			port_id = <5>;
+			ethernet-phy-ieee802.3-c45;
+			phy_address = <0x0>;
+		};
+
+		port@5 {
+			port_id = <6>;
+			ethernet-phy-ieee802.3-c45;
+			phy_address = <0x8>;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_2>;
+	label = "lan4";
+	nvmem-cells = <&macaddr_appsblenv_ethaddr>;
+	nvmem-cell-names = "mac-address-ascii";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_3>;
+	label = "lan3";
+	nvmem-cells = <&macaddr_appsblenv_ethaddr>;
+	nvmem-cell-names = "mac-address-ascii";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_4>;
+	label = "lan2";
+	nvmem-cells = <&macaddr_appsblenv_ethaddr>;
+	nvmem-cell-names = "mac-address-ascii";
+};
+
+&dp5_syn {
+	status = "okay";
+	phy-handle = <&aqr113c_1>;
+	label = "wan";
+	nvmem-cells = <&macaddr_appsblenv_ethaddr>;
+	nvmem-cell-names = "mac-address-ascii";
+};
+
+&dp6_syn {
+	status = "okay";
+	phy-handle = <&aqr113c_2>;
+	label = "lan1";
+	nvmem-cells = <&macaddr_appsblenv_ethaddr>;
+	nvmem-cell-names = "mac-address-ascii";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&usb_0 {
+	status = "okay";
+
+	vbus-supply = <&reg_usb_vbus>;
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "Buffalo-WXR-5950AX12";
+};

target/linux/ipq807x/image/generic.mk

@@ -17,6 +17,19 @@ define Device/UbiFit
 	IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
 
+define Device/buffalo_wxr-5950ax12
+	$(call Device/FitImage)
+	$(call Device/UbiFit)
+	DEVICE_VENDOR := Buffalo
+	DEVICE_MODEL := WXR-5950AX12
+	BLOCKSIZE := 128k
+	PAGESIZE := 2048
+	DEVICE_DTS_CONFIG := config@hk01
+	SOC := ipq8074
+	DEVICE_PACKAGES := ipq-wifi-buffalo_wxr-5950ax12
+endef
+TARGET_DEVICES += buffalo_wxr-5950ax12
+
 define Device/dynalink_dl-wrx36
 	$(call Device/FitImage)
 	$(call Device/UbiFit)

target/linux/ipq807x/patches-5.15/0072-v6.0-phy-qcom-qmp-pcie-make-pipe-clock-rate-configurable.patch

@@ -27,7 +27,7 @@ Signed-off-by: Vinod Koul <vkoul@kernel.org>
  	/* true, if PCS block has no separate SW_RESET register */
  	bool no_pcs_sw_reset;
  };
-@@ -5138,8 +5141,15 @@ static int phy_pipe_clk_register(struct
+@@ -5139,8 +5142,15 @@ static int phy_pipe_clk_register(struct
  
  	init.ops = &clk_fixed_rate_ops;
  

target/linux/ipq807x/patches-5.15/0073-v6.0-phy-qcom-qmp-pcie-add-IPQ8074-PCIe-Gen3-QMP-PHY-supp.patch

@@ -151,7 +151,7 @@ Signed-off-by: Vinod Koul <vkoul@kernel.org>
  static const struct qmp_phy_init_tbl sdm845_qmp_pcie_serdes_tbl[] = {
  	QMP_PHY_INIT_CFG(QSERDES_V3_COM_BIAS_EN_CLKBUFLR_EN, 0x14),
  	QMP_PHY_INIT_CFG(QSERDES_V3_COM_CLK_SELECT, 0x30),
-@@ -3167,6 +3294,36 @@ static const struct qmp_phy_cfg ipq8074_
+@@ -3168,6 +3295,36 @@ static const struct qmp_phy_cfg ipq8074_
  	.pwrdn_delay_max	= 1005,		/* us */
  };
  
@@ -188,7 +188,7 @@ Signed-off-by: Vinod Koul <vkoul@kernel.org>
  static const struct qmp_phy_cfg ipq6018_pciephy_cfg = {
  	.type			= PHY_TYPE_PCIE,
  	.nlanes			= 1,
-@@ -5543,6 +5700,9 @@ static const struct of_device_id qcom_qm
+@@ -5571,6 +5728,9 @@ static const struct of_device_id qcom_qm
  		.compatible = "qcom,ipq8074-qmp-pcie-phy",
  		.data = &ipq8074_pciephy_cfg,
  	}, {

target/linux/mediatek/dts/mt7622-xiaomi-redmi-router-ax6s.dts

@@ -295,7 +295,6 @@
 			 */
 			partition@2c0000 {
 				label = "kernel";
-				compatible = "denx,fit";
 				reg = <0x2c0000 0x400000>;
 			};
 

target/linux/ramips/dts/mt7621_asus_rt-ax54.dts

@@ -0,0 +1,186 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "asus,rt-ax54", "mediatek,mt7621-soc";
+	model = "ASUS RT-AX54";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+		bootargs-override = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			label = "blue:power";
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+		};
+
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		key-restart {
+			label = "reset";
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		key-wps {
+			label = "wps";
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+};
+
+&nand {
+	status = "okay";
+
+	mediatek,nmbm;
+	mediatek,bmt-max-ratio = <1>;
+	mediatek,bmt-max-reserved-blocks = <64>;
+	mediatek,bmt-remap-range = <0x000000 0x7e0000>;
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "u-boot";
+			reg = <0x0 0x80000>;
+			read-only;
+		};
+
+		/*
+		 * u-boot gets split here while keeping u-boot read-only,
+		 * which allows safe usage of fw_setenv
+		 */
+		partition@80000 {
+			label = "u-boot-env";
+			reg = <0x80000 0x60000>;
+		};
+
+		partition@e0000 {
+			label = "nvram";
+			reg = <0xe0000 0x100000>;
+			read-only;
+		};
+
+		factory: partition@1e0000 {
+			label = "factory";
+			reg = <0x1e0000 0x100000>;
+			read-only;
+
+			compatible = "nvmem-cells";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			macaddr_factory_4: macaddr@4 {
+				reg = <0x4 0x6>;
+			};
+		};
+
+		factory2: partition@2e0000 {
+			label = "factory2";
+			reg = <0x2e0000 0x100000>;
+			read-only;
+		};
+
+		partition@3e0000 {
+			label = "kernel";
+			reg = <0x3e0000 0x400000>;
+		};
+
+		partition@7e0000 {
+			label = "ubi";
+			reg = <0x7e0000 0x7020000>;
+		};
+
+		/* Last 8M are reserved for NMBM management (bad blocks) */
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		mediatek,disable-radar-background;
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_factory_4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio {
+	ethphy4: ethernet-phy@4 {
+		reg = <4>;
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan4";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan1";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart2", "uart3", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+

target/linux/ramips/image/mt7621.mk

@@ -338,6 +338,31 @@ define Device/asus_rt-ax53u
 endef
 TARGET_DEVICES += asus_rt-ax53u
 
+define Device/asus_rt-ax54
+  $(Device/dsa-migration)
+  DEVICE_VENDOR := ASUS
+  DEVICE_MODEL := RT-AX54
+  DEVICE_ALT0_VENDOR := ASUS
+  DEVICE_ALT0_MODEL := RT-AX54
+  DEVICE_ALT1_VENDOR := ASUS
+  DEVICE_ALT1_MODEL := RT-AX54HP
+  DEVICE_ALT2_VENDOR := ASUS
+  DEVICE_ALT2_MODEL := RT-AX1800HP
+  DEVICE_ALT3_VENDOR := ASUS
+  DEVICE_ALT3_MODEL := RT-AX1800S
+  IMAGE_SIZE := 51200k
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_SIZE := 4096k
+  IMAGES += factory.bin
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | append-ubi | \
+	check-size
+  DEVICE_PACKAGES := kmod-mt7915-firmware uboot-envtools 
+endef
+TARGET_DEVICES += asus_rt-ax54
+
 define Device/beeline_smartbox-flash
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)

target/linux/ramips/mt7621/base-files/etc/board.d/01_leds

@@ -24,6 +24,10 @@ asus,rt-ax53u)
 	ucidef_set_led_wlan "wlan2g" "WiFi 2.4GHz" "mt76-phy0" "phy0tpt"
 	ucidef_set_led_wlan "wlan5g" "WiFi 5GHz" "mt76-phy1" "phy1tpt"
 	;;
+asus,rt-ax54)
+	ucidef_set_led_wlan "wlan2g" "WiFi 2.4GHz" "mt76-phy0" "phy0tpt"
+	ucidef_set_led_wlan "wlan5g" "WiFi 5GHz" "mt76-phy1" "phy1tpt"
+	;;
 asus,rt-n56u-b1)
 	ucidef_set_led_netdev "lan" "LAN link" "blue:lan" "br-lan"
 	ucidef_set_led_netdev "wan" "WAN link" "blue:wan" "wan"

target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh

@@ -56,6 +56,7 @@ platform_do_upgrade() {
 	asus,rt-ac65p|\
 	asus,rt-ac85p|\
 	asus,rt-ax53u|\
+	asus,rt-ax54|\
 	beeline,smartbox-flash|\
 	beeline,smartbox-giga|\
 	beeline,smartbox-turbo|\

target/linux/realtek/dts-5.10/rtl8382_apresia_aplgs120gtss.dts

@@ -0,0 +1,270 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "apresia,aplgs120gtss", "realtek,rtl8382-soc";
+	model = "APRESIA ApresiaLightGS120GT-SS";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x10000000>;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: led-0 {
+			label = "green:pwr";
+			gpios = <&gpio0 0 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led-1 {
+			label = "red:loop";
+			gpios = <&gpio1 10 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_FAULT;
+		};
+
+		/* LED chip is soldered, but no hole on the case */
+		led-2 {
+			label = "green:unused";
+			gpios = <&gpio1 36 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <20>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio1 33 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio1 34 GPIO_ACTIVE_LOW>;
+		open-source;
+	};
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <0>;
+	};
+
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 2 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 7 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	i2c2: i2c-gpio-2 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 11 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	i2c3: i2c-gpio-3 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 22 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 23 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	/* 4x TX-Disable lines are provided by RTL8214FC */
+	sfp0: sfp-p17 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 8 GPIO_ACTIVE_LOW>;
+	};
+
+	sfp1: sfp-p18 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 3 GPIO_ACTIVE_LOW>;
+	};
+
+	sfp2: sfp-p19 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c3>;
+		los-gpio = <&gpio1 25 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 24 GPIO_ACTIVE_LOW>;
+	};
+
+	sfp3: sfp-p20 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c2>;
+		los-gpio = <&gpio1 14 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 13 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&gpio0 {
+	rtl8231_reset {
+		gpio-hog;
+		gpios = <1 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "rtl8231-reset";
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x80000 0x40000>;
+			};
+
+			partition@c0000 {
+				label = "u-boot-env2";
+				reg = <0xc0000 0x40000>;
+			};
+
+			partition@100000 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				label = "firmware";
+				reg = <0x100000 0xe80000>;
+				openwrt,ih-magic = <0x12345000>;
+			};
+
+			partition@f80000 {
+				label = "firmware2";
+				reg = <0xf80000 0xe80000>;
+			};
+
+			partition@1e00000 {
+				label = "jffs2";
+				reg = <0x1e00000 0x200000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		EXTERNAL_SFP_PHY_FULL(24, 0)
+		EXTERNAL_SFP_PHY_FULL(25, 1)
+		EXTERNAL_SFP_PHY_FULL(26, 2)
+		EXTERNAL_SFP_PHY_FULL(27, 3)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(24, 17, qsgmii)
+		SWITCH_PORT(25, 18, qsgmii)
+		SWITCH_PORT(26, 19, qsgmii)
+		SWITCH_PORT(27, 20, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};

target/linux/realtek/dts-5.15/rtl8382_apresia_aplgs120gtss.dts

@@ -0,0 +1,270 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl838x.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "apresia,aplgs120gtss", "realtek,rtl8382-soc";
+	model = "APRESIA ApresiaLightGS120GT-SS";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x10000000>;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: led-0 {
+			label = "green:pwr";
+			gpios = <&gpio0 0 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+		};
+
+		led-1 {
+			label = "red:loop";
+			gpios = <&gpio1 10 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_FAULT;
+		};
+
+		/* LED chip is soldered, but no hole on the case */
+		led-2 {
+			label = "green:unused";
+			gpios = <&gpio1 36 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <20>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio1 33 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	gpio-restart {
+		compatible = "gpio-restart";
+		gpios = <&gpio1 34 GPIO_ACTIVE_LOW>;
+		open-source;
+	};
+
+	gpio1: rtl8231-gpio {
+		compatible = "realtek,rtl8231-gpio";
+		#gpio-cells = <2>;
+		gpio-controller;
+		indirect-access-bus-id = <0>;
+	};
+
+	i2c0: i2c-gpio-0 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 1 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 2 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	i2c1: i2c-gpio-1 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 7 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	i2c2: i2c-gpio-2 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 11 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	i2c3: i2c-gpio-3 {
+		compatible = "i2c-gpio";
+		sda-gpios = <&gpio1 22 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		scl-gpios = <&gpio1 23 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
+		i2c-gpio,delay-us = <2>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+
+	/* 4x TX-Disable lines are provided by RTL8214FC */
+	sfp0: sfp-p17 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c1>;
+		los-gpio = <&gpio1 9 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 8 GPIO_ACTIVE_LOW>;
+	};
+
+	sfp1: sfp-p18 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c0>;
+		los-gpio = <&gpio1 4 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 3 GPIO_ACTIVE_LOW>;
+	};
+
+	sfp2: sfp-p19 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c3>;
+		los-gpio = <&gpio1 25 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 24 GPIO_ACTIVE_LOW>;
+	};
+
+	sfp3: sfp-p20 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c2>;
+		los-gpio = <&gpio1 14 GPIO_ACTIVE_HIGH>;
+		mod-def0-gpio = <&gpio1 13 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&gpio0 {
+	rtl8231_reset {
+		gpio-hog;
+		gpios = <1 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "rtl8231-reset";
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "u-boot-env";
+				reg = <0x80000 0x40000>;
+			};
+
+			partition@c0000 {
+				label = "u-boot-env2";
+				reg = <0xc0000 0x40000>;
+			};
+
+			partition@100000 {
+				compatible = "openwrt,uimage", "denx,uimage";
+				label = "firmware";
+				reg = <0x100000 0xe80000>;
+				openwrt,ih-magic = <0x12345000>;
+			};
+
+			partition@f80000 {
+				label = "firmware2";
+				reg = <0xf80000 0xe80000>;
+			};
+
+			partition@1e00000 {
+				label = "jffs2";
+				reg = <0x1e00000 0x200000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ethernet0 {
+	mdio-bus {
+		compatible = "realtek,rtl838x-mdio";
+		regmap = <&ethernet0>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		EXTERNAL_PHY(0)
+		EXTERNAL_PHY(1)
+		EXTERNAL_PHY(2)
+		EXTERNAL_PHY(3)
+		EXTERNAL_PHY(4)
+		EXTERNAL_PHY(5)
+		EXTERNAL_PHY(6)
+		EXTERNAL_PHY(7)
+
+		INTERNAL_PHY(8)
+		INTERNAL_PHY(9)
+		INTERNAL_PHY(10)
+		INTERNAL_PHY(11)
+		INTERNAL_PHY(12)
+		INTERNAL_PHY(13)
+		INTERNAL_PHY(14)
+		INTERNAL_PHY(15)
+
+		EXTERNAL_SFP_PHY_FULL(24, 0)
+		EXTERNAL_SFP_PHY_FULL(25, 1)
+		EXTERNAL_SFP_PHY_FULL(26, 2)
+		EXTERNAL_SFP_PHY_FULL(27, 3)
+	};
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(24, 17, qsgmii)
+		SWITCH_PORT(25, 18, qsgmii)
+		SWITCH_PORT(26, 19, qsgmii)
+		SWITCH_PORT(27, 20, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};

target/linux/realtek/files-5.10/drivers/net/dsa/rtl83xx/common.c

@@ -1286,6 +1286,8 @@ static void rtl83xx_net_event_work_do(struct work_struct *work)
 	struct rtl838x_switch_priv *priv = net_work->priv;
 
 	rtl83xx_l3_nexthop_update(priv, net_work->gw_addr, net_work->mac);
+
+	kfree(net_work);
 }
 
 static int rtl83xx_netevent_event(struct notifier_block *this,
@@ -1299,13 +1301,6 @@ static int rtl83xx_netevent_event(struct notifier_block *this,
 
 	priv = container_of(this, struct rtl838x_switch_priv, ne_nb);
 
-	net_work = kzalloc(sizeof(*net_work), GFP_ATOMIC);
-	if (!net_work)
-		return NOTIFY_BAD;
-
-	INIT_WORK(&net_work->work, rtl83xx_net_event_work_do);
-	net_work->priv = priv;
-
 	switch (event) {
 	case NETEVENT_NEIGH_UPDATE:
 		if (n->tbl != &arp_tbl)
@@ -1314,10 +1309,16 @@ static int rtl83xx_netevent_event(struct notifier_block *this,
 		port = rtl83xx_port_dev_lower_find(dev, priv);
 		if (port < 0 || !(n->nud_state & NUD_VALID)) {
 			pr_debug("%s: Neigbour invalid, not updating\n", __func__);
-			kfree(net_work);
 			return NOTIFY_DONE;
 		}
 
+		net_work = kzalloc(sizeof(*net_work), GFP_ATOMIC);
+		if (!net_work)
+			return NOTIFY_BAD;
+
+		INIT_WORK(&net_work->work, rtl83xx_net_event_work_do);
+		net_work->priv = priv;
+
 		net_work->mac = ether_addr_to_u64(n->ha);
 		net_work->gw_addr = *(__be32 *) n->primary_key;
 

target/linux/realtek/files-5.15/drivers/net/dsa/rtl83xx/common.c

@@ -1282,6 +1282,8 @@ static void rtl83xx_net_event_work_do(struct work_struct *work)
 	struct rtl838x_switch_priv *priv = net_work->priv;
 
 	rtl83xx_l3_nexthop_update(priv, net_work->gw_addr, net_work->mac);
+
+	kfree(net_work);
 }
 
 static int rtl83xx_netevent_event(struct notifier_block *this,
@@ -1295,13 +1297,6 @@ static int rtl83xx_netevent_event(struct notifier_block *this,
 
 	priv = container_of(this, struct rtl838x_switch_priv, ne_nb);
 
-	net_work = kzalloc(sizeof(*net_work), GFP_ATOMIC);
-	if (!net_work)
-		return NOTIFY_BAD;
-
-	INIT_WORK(&net_work->work, rtl83xx_net_event_work_do);
-	net_work->priv = priv;
-
 	switch (event) {
 	case NETEVENT_NEIGH_UPDATE:
 		if (n->tbl != &arp_tbl)
@@ -1310,10 +1305,16 @@ static int rtl83xx_netevent_event(struct notifier_block *this,
 		port = rtl83xx_port_dev_lower_find(dev, priv);
 		if (port < 0 || !(n->nud_state & NUD_VALID)) {
 			pr_debug("%s: Neigbour invalid, not updating\n", __func__);
-			kfree(net_work);
 			return NOTIFY_DONE;
 		}
 
+		net_work = kzalloc(sizeof(*net_work), GFP_ATOMIC);
+		if (!net_work)
+			return NOTIFY_BAD;
+
+		INIT_WORK(&net_work->work, rtl83xx_net_event_work_do);
+		net_work->priv = priv;
+
 		net_work->mac = ether_addr_to_u64(n->ha);
 		net_work->gw_addr = *(__be32 *) n->primary_key;
 

target/linux/realtek/image/Makefile

@@ -6,11 +6,12 @@ include $(INCLUDE_DIR)/image.mk
 KERNEL_LOADADDR = 0x80100000
 
 DEVICE_VARS += \
+        CAMEO_BOARD_MODEL \
         CAMEO_BOARD_VERSION \
         CAMEO_CUSTOMER_SIGNATURE \
         CAMEO_KERNEL_PART \
+        CAMEO_KERNEL_PART_SIZE \
         CAMEO_ROOTFS_PART \
-        DLINK_KERNEL_PART_SIZE \
         H3C_DEVICE_ID \
         H3C_PRODUCT_ID \
         ZYXEL_VERS
@@ -23,25 +24,25 @@ define Build/zyxel-vers
        done ) >> $@
 endef
 
-define Build/dlink-cameo
+define Build/cameo-tag
-	$(SCRIPT_DIR)/cameo-tag.py $@ $(DLINK_KERNEL_PART_SIZE)
+	$(SCRIPT_DIR)/cameo-tag.py $@ $(CAMEO_KERNEL_PART_SIZE)
 endef
 
-define Build/dlink-version
+define Build/cameo-version
 	echo -n "OpenWrt" >> $@
 	dd if=/dev/zero bs=25 count=1 >> $@
 endef
 
-define Build/dlink-headers
+define Build/cameo-headers
-        dd if=$@ bs=$(DLINK_KERNEL_PART_SIZE) count=1 of=$@.kernel_part; \
+        dd if=$@ bs=$(CAMEO_KERNEL_PART_SIZE) count=1 of=$@.kernel_part; \
-        dd if=$@ bs=$(DLINK_KERNEL_PART_SIZE) skip=1 of=$@.rootfs_part; \
+        dd if=$@ bs=$(CAMEO_KERNEL_PART_SIZE) skip=1 of=$@.rootfs_part; \
         $(SCRIPT_DIR)/cameo-imghdr.py $@.kernel_part $@.kernel_part.hex \
-                "$(DEVICE_MODEL)" os $(CAMEO_KERNEL_PART) \
+                "$(CAMEO_BOARD_MODEL)" os $(CAMEO_KERNEL_PART) \
                 $(CAMEO_CUSTOMER_SIGNATURE) \
                 $(CAMEO_BOARD_VERSION) \
                 $(KERNEL_LOADADDR); \
         $(SCRIPT_DIR)/cameo-imghdr.py $@.rootfs_part $@.rootfs_part.hex \
-                "$(DEVICE_MODEL)" squashfs $(CAMEO_ROOTFS_PART) \
+                "$(CAMEO_BOARD_MODEL)" squashfs $(CAMEO_ROOTFS_PART) \
                 $(CAMEO_CUSTOMER_SIGNATURE) \
                 $(CAMEO_BOARD_VERSION); \
         cat $@.kernel_part.hex $@.rootfs_part.hex > $@

target/linux/realtek/image/common.mk

@@ -1,19 +1,13 @@
 # SPDX-License-Identifier: GPL-2.0-only
 
-define Device/d-link_dgs-1210
+define Device/cameo-fw
-  IMAGE_SIZE := 13824k
+  CAMEO_BOARD_MODEL = $$(DEVICE_MODEL)
-  DEVICE_VENDOR := D-Link
-  DLINK_KERNEL_PART_SIZE := 1572864
   KERNEL := \
 	kernel-bin | \
 	append-dtb | \
 	libdeflate-gzip | \
 	uImage gzip | \
-	dlink-cameo
+	cameo-tag
-  CAMEO_KERNEL_PART := 2
-  CAMEO_ROOTFS_PART := 3
-  CAMEO_CUSTOMER_SIGNATURE := 2
-  CAMEO_BOARD_VERSION := 32
   IMAGES += factory_image1.bin
   IMAGE/factory_image1.bin := \
 	append-kernel | \
@@ -22,8 +16,19 @@ define Device/d-link_dgs-1210
 	pad-rootfs | \
 	pad-to 16 | \
 	check-size | \
-	dlink-version | \
+	cameo-version | \
-	dlink-headers
+	cameo-headers
+endef
+
+define Device/d-link_dgs-1210
+  $(Device/cameo-fw)
+  IMAGE_SIZE := 13824k
+  DEVICE_VENDOR := D-Link
+  CAMEO_KERNEL_PART_SIZE := 1572864
+  CAMEO_KERNEL_PART := 2
+  CAMEO_ROOTFS_PART := 3
+  CAMEO_CUSTOMER_SIGNATURE := 2
+  CAMEO_BOARD_VERSION := 32
 endef
 
 define Device/hpe_1920

target/linux/realtek/image/rtl838x.mk

@@ -12,6 +12,22 @@ define Device/allnet_all-sg8208m
 endef
 TARGET_DEVICES += allnet_all-sg8208m
 
+define Device/apresia_aplgs120gtss
+  $(Device/cameo-fw)
+  SOC := rtl8382
+  IMAGE_SIZE := 14848k
+  DEVICE_VENDOR := APRESIA
+  DEVICE_MODEL := ApresiaLightGS120GT-SS
+  UIMAGE_MAGIC := 0x12345000
+  CAMEO_KERNEL_PART_SIZE := 1572864
+  CAMEO_KERNEL_PART := 3
+  CAMEO_ROOTFS_PART := 4
+  CAMEO_CUSTOMER_SIGNATURE := 2
+  CAMEO_BOARD_MODEL := APLGS120GTSS
+  CAMEO_BOARD_VERSION := 4
+endef
+TARGET_DEVICES += apresia_aplgs120gtss
+
 define Device/d-link_dgs-1210-10mp-f
   $(Device/d-link_dgs-1210)
   SOC := rtl8380

target/toolchain/files/wrapper.sh

@@ -46,7 +46,7 @@ TOOLCHAIN_BIN_DIR="$REALNAME_DIR/"
 export PATH="$TOOLCHAIN_BIN_DIR":$PATH
 export GCC_HONOUR_COPTS
 
-TOOLCHAIN_SYSROOT="$TOOLCHAIN_BIN_DIR/../.."
+TOOLCHAIN_SYSROOT="$TOOLCHAIN_BIN_DIR/.."
 if [ ! -d "$TOOLCHAIN_SYSROOT" ]; then
 	echo "Error: Unable to determine sysroot (looking for $TOOLCHAIN_SYSROOT)!" >&2
 	exit 1
@@ -57,8 +57,8 @@ fi
 
 case $TOOLCHAIN_PLATFORM in
 	gnu|glibc|uclibc|musl)
-		GCC_SYSROOT_FLAGS="--sysroot=$TOOLCHAIN_SYSROOT -Wl,-rpath=$TOOLCHAIN_SYSROOT/lib:$TOOLCHAIN_SYSROOT/usr/lib"
+		GCC_SYSROOT_FLAGS="--sysroot=$TOOLCHAIN_SYSROOT -Wl,-rpath-link=$TOOLCHAIN_SYSROOT/lib:$TOOLCHAIN_SYSROOT/usr/lib"
-		LD_SYSROOT_FLAGS="-rpath=$TOOLCHAIN_SYSROOT/lib:$TOOLCHAIN_SYSROOT/usr/lib"
+		LD_SYSROOT_FLAGS="-rpath-link=$TOOLCHAIN_SYSROOT/lib:$TOOLCHAIN_SYSROOT/usr/lib"
 		;;
 	*)
 		GCC_SYSROOT_FLAGS=""

toolchain/glibc/common.mk

@@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=glibc
-PKG_VERSION:=2.36
+PKG_VERSION:=2.37
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=3aae843e9e9e6a2502e98ff44d2671b20a023f8e
+PKG_SOURCE_VERSION:=d8e1a7590d375159fb5aac07ad8111ab4699e994
-PKG_MIRROR_HASH:=29bdd6ca699f297de500ea457741d0706d57a69836fa7d45e6cc2cc20484cad4
+PKG_MIRROR_HASH:=4ea04f4b5cdd5567e11defe6f8947c168382fc0a22abe121bb43f4bb83615237
 PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.xz
 

tools/e2fsprogs/Makefile

@@ -9,8 +9,8 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=e2fsprogs
 PKG_CPE_ID:=cpe:/a:e2fsprogs_project:e2fsprogs
-PKG_VERSION:=1.46.6
+PKG_VERSION:=1.47.0
-PKG_HASH:=a77517f19ff5e4e97ede63536566865dd5d48654e13fc145f5f2249ef7c4f4fc
+PKG_HASH:=144af53f2bbd921cef6f8bea88bb9faddca865da3fbc657cc9b4d2001097d5db
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz

tools/fakeroot/Makefile

@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=fakeroot
-PKG_VERSION:=1.30.1
+PKG_VERSION:=1.29
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)_$(PKG_VERSION).orig.tar.gz
 PKG_SOURCE_URL:=@DEBIAN/pool/main/f/fakeroot
-PKG_HASH:=32ebb1f421aca0db7141c32a8c104eb95d2b45c393058b9435fbf903dd2b6a75
+PKG_HASH:=8fbbafb780c9173e3ace4a04afbc1d900f337f3216883939f5c7db3431be7c20
 PKG_LICENSE:=GPL-3.0-or-later
 PKG_LICENSE_FILES:=COPYING
 PKG_FIXUP:=autoreconf

tools/fakeroot/patches/600-macOS.patch

@@ -24,7 +24,7 @@
  #include <spawn.h>
 --- a/wrapfunc.inp
 +++ b/wrapfunc.inp
-@@ -50,9 +50,11 @@ getattrlist$UNIX2003;int;(const char *pa
+@@ -48,9 +48,11 @@ getattrlist$UNIX2003;int;(const char *pa
  #endif
  #endif
  #if MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_X_VERSION_10_5
@@ -36,7 +36,7 @@
  posix_spawn;int;(pid_t * __restrict pid, const char * __restrict path, const posix_spawn_file_actions_t *file_actions, const posix_spawnattr_t * __restrict attrp, char *const argv[ __restrict], char *const envp[ __restrict]);(pid, path, file_actions, attrp, argv, envp)
  posix_spawnp;int;(pid_t * __restrict pid, const char * __restrict path, const posix_spawn_file_actions_t *file_actions, const posix_spawnattr_t * __restrict attrp, char *const argv[ __restrict], char *const envp[ __restrict]);(pid, path, file_actions, attrp, argv, envp)
  #endif
-@@ -231,7 +233,7 @@ facl;int;(int fd, int cmd, int cnt, void
+@@ -229,7 +231,7 @@ facl;int;(int fd, int cmd, int cnt, void
  #ifdef HAVE_FTS_READ
  fts_read;FTSENT *;(FTS *ftsp);(ftsp)
  #ifdef __APPLE__
@@ -45,7 +45,7 @@
  fts_read$INODE64;FTSENT *;(FTS *ftsp);(ftsp)
  #endif
  #endif /* ifdef __APPLE__ */
-@@ -239,7 +241,7 @@ fts_read$INODE64;FTSENT *;(FTS *ftsp);(f
+@@ -237,7 +239,7 @@ fts_read$INODE64;FTSENT *;(FTS *ftsp);(f
  #ifdef HAVE_FTS_CHILDREN
  fts_children;FTSENT *;(FTS *ftsp, int options);(ftsp, options)
  #ifdef __APPLE__