OpenWrt v18.06.8: adjust config defaults

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
libubox: backport blobmsg_check_array() fix
2020-02-27 22:32:54 +01:00 · 2020-02-27 22:25:59 +01:00 · 2020-02-26 16:42:06 +01:00 · 2020-02-26 16:41:48 +01:00 · 2020-02-26 16:23:05 +01:00 · 2020-02-24 14:21:08 +01:00
201 changed files with 1885 additions and 634 deletions
--- a/feeds.conf.default
+++ b/feeds.conf.default
@@ -1,4 +1,4 @@
-src-git packages https://git.openwrt.org/feed/packages.git^b0df5d33652220a384593d7b52a8453b022b8f9b
-src-git luci https://git.openwrt.org/project/luci.git^868abc1a564ca8366bbb018a967923cbdc5ee27a
-src-git routing https://git.openwrt.org/feed/routing.git^9fa2b249cc286176f07efe343fd9518b383462fc
+src-git packages https://git.openwrt.org/feed/packages.git^c05ea69d6d4f503c9bf69fd3d5e551e21c434084
+src-git luci https://git.openwrt.org/project/luci.git^41e2258d6dc1ebe8d3874ae6d6b13db49cff2c5c
+src-git routing https://git.openwrt.org/feed/routing.git^0e63ef9276bf41c0d4176127f9f047343b8ffe32
 src-git telephony https://git.openwrt.org/feed/telephony.git^8ecbdabc7c5cadbe571eb947f5cd333a5a785010
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@@ -2,11 +2,11 @@

 LINUX_RELEASE?=1

-LINUX_VERSION-4.9 = .208
-LINUX_VERSION-4.14 = .162
+LINUX_VERSION-4.9 = .214
+LINUX_VERSION-4.14 = .171

-LINUX_KERNEL_HASH-4.9.208 = b7ad1c9841d671d026c55a4c91c77205f8b488ca5f980f838591c68662e0525a
-LINUX_KERNEL_HASH-4.14.162 = f65170224cd4359ce8b2793b492bd8127abdd0b91350484e001bce13f0c98b4b
+LINUX_KERNEL_HASH-4.9.214 = b47f093dac7034c7c4722e80042c05e4ef53c14a4f28aa992117a127d2b1e483
+LINUX_KERNEL_HASH-4.14.171 = 4fe02489e4b4a187eccf0ef87df6100534c9d485e76d876b1fa247c7635332a0

 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
 sanitize_uri=$(call qstrip,$(subst @,_,$(subst :,_,$(subst .,_,$(subst -,_,$(subst /,_,$(1)))))))
--- a/include/version.mk
+++ b/include/version.mk
@@ -26,13 +26,13 @@ PKG_CONFIG_DEPENDS += \
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))

 VERSION_NUMBER:=$(call qstrip,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),18.06.6)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),18.06.8)

 VERSION_CODE:=$(call qstrip,$(CONFIG_VERSION_CODE))
-VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r7957-d81a8a3e29)
+VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r7989-82fbd85747)

 VERSION_REPO:=$(call qstrip,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.openwrt.org/releases/18.06.6)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.openwrt.org/releases/18.06.8)

 VERSION_DIST:=$(call qstrip,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),OpenWrt)
--- a/package/base-files/image-config.in
+++ b/package/base-files/image-config.in
@@ -183,7 +183,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "http://downloads.openwrt.org/releases/18.06.6"
+		default "http://downloads.openwrt.org/releases/18.06.8"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:
--- a/package/kernel/lantiq/ltq-ptm/Makefile
+++ b/package/kernel/lantiq/ltq-ptm/Makefile
@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=ltq-ptm
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/ltq-ptm-$(BUILD_VARIANT)

 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
--- a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
+++ b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
@@ -334,6 +334,9 @@ static int ptm_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
        dma_cache_wback((unsigned long)skb->data, skb->len);
    }

+    /* make the skb unowned */
+    skb_orphan(skb);
+
    *(struct sk_buff **)((unsigned int)skb->data - byteoff - sizeof(struct sk_buff *)) = skb;
    /*  write back to physical memory   */
    dma_cache_wback((unsigned long)skb->data - byteoff - sizeof(struct sk_buff *), skb->len + byteoff + sizeof(struct sk_buff *));
--- a/package/libs/libubox/Makefile
+++ b/package/libs/libubox/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=libubox
-PKG_RELEASE=2
+PKG_RELEASE=4

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/libubox.git
--- a/package/libs/libubox/patches/0001-blobmsg_json-fix-possible-uninitialized-struct-membe.patch
+++ b/package/libs/libubox/patches/0001-blobmsg_json-fix-possible-uninitialized-struct-membe.patch
@@ -0,0 +1,39 @@
+From 2acfe84e4c871fb994c38c9f2508eb9ebd296b74 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Tue, 19 Nov 2019 17:34:25 +0100
+Subject: blobmsg_json: fix possible uninitialized struct member
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+clang-10 analyzer reports following:
+
+ blobmsg_json.c:285:2: warning: The expression is an uninitialized value. The computed value will also be garbage
+         s->indent_level++;
+         ^~~~~~~~~~~~~~~~~
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg_json.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/blobmsg_json.c
+++ b/blobmsg_json.c
+@@ -316,7 +316,7 @@ static void setup_strbuf(struct strbuf *
+ 
+ char *blobmsg_format_json_with_cb(struct blob_attr *attr, bool list, blobmsg_json_format_t cb, void *priv, int indent)
+ {
+-	struct strbuf s;
+	struct strbuf s = {0};
+ 	bool array;
+ 	char *ret;
+ 
+@@ -350,7 +350,7 @@ char *blobmsg_format_json_with_cb(struct
+ 
+ char *blobmsg_format_json_value_with_cb(struct blob_attr *attr, blobmsg_json_format_t cb, void *priv, int indent)
+ {
+-	struct strbuf s;
+	struct strbuf s = {0};
+ 	char *ret;
+ 
+ 	setup_strbuf(&s, attr, cb, priv, indent);
--- a/package/libs/libubox/patches/0002-jshn-fix-off-by-one-in-jshn_parse_file.patch
+++ b/package/libs/libubox/patches/0002-jshn-fix-off-by-one-in-jshn_parse_file.patch
@@ -0,0 +1,39 @@
+From f27853d71a2cb99ec5de3881716a14611ada307c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Sat, 23 Nov 2019 22:48:25 +0100
+Subject: jshn: fix off by one in jshn_parse_file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes following error:
+
+ Invalid read of size 1
+   at 0x4C32D04: strlen
+   by 0x5043367: json_tokener_parse_ex
+   by 0x5045316: json_tokener_parse_verbose
+   by 0x504537D: json_tokener_parse
+   by 0x401AB1: jshn_parse (jshn.c:179)
+   by 0x40190D: jshn_parse_file (jshn.c:370)
+   by 0x40190D: main (jshn.c:434)
+ Address 0x5848c4c is 0 bytes after a block of size 1,036 alloc'd
+   at 0x4C2FB0F: malloc
+   by 0x4018E2: jshn_parse_file (jshn.c:357)
+   by 0x4018E2: main (jshn.c:434)
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ jshn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/jshn.c
+++ b/jshn.c
+@@ -384,7 +384,7 @@ int main(int argc, char **argv)
+ 				close(fd);
+ 				return 3;
+ 			}
+-			if (!(fbuf = malloc(sb.st_size))) {
+			if (!(fbuf = calloc(1, sb.st_size+1))) {
+ 				fprintf(stderr, "Error allocating memory for %s\n", optarg);
+ 				close(fd);
+ 				return 3;
--- a/package/libs/libubox/patches/0003-blob-refactor-attr-parsing-into-separate-function.patch
+++ b/package/libs/libubox/patches/0003-blob-refactor-attr-parsing-into-separate-function.patch
@@ -0,0 +1,97 @@
+From af2a074160e32692b570f8a3562b4370d38f34e7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Mon, 9 Dec 2019 13:53:27 +0100
+Subject: blob: refactor attr parsing into separate function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Making blob_parse easier to review.
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blob.c | 61 +++++++++++++++++++++++++++++++++-------------------------
+ 1 file changed, 35 insertions(+), 26 deletions(-)
+
+--- a/blob.c
+++ b/blob.c
+@@ -217,44 +217,53 @@ blob_check_type(const void *ptr, unsigne
+ 	return true;
+ }
+ 
+-int
+-blob_parse(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max)
+static int
+blob_parse_attr(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max)
+ {
+-	struct blob_attr *pos;
+ 	int found = 0;
+-	int rem;
+	int id = blob_id(attr);
+	size_t len = blob_len(attr);
+ 
+-	memset(data, 0, sizeof(struct blob_attr *) * max);
+-	blob_for_each_attr(pos, attr, rem) {
+-		int id = blob_id(pos);
+-		int len = blob_len(pos);
+	if (id >= max)
+		return 0;
+ 
+-		if (id >= max)
+-			continue;
+	if (info) {
+		int type = info[id].type;
+ 
+-		if (info) {
+-			int type = info[id].type;
+		if (type < BLOB_ATTR_LAST) {
+			if (!blob_check_type(blob_data(attr), len, type))
+				return 0;
+		}
+ 
+-			if (type < BLOB_ATTR_LAST) {
+-				if (!blob_check_type(blob_data(pos), len, type))
+-					continue;
+-			}
+		if (info[id].minlen && len < info[id].minlen)
+			return 0;
+ 
+-			if (info[id].minlen && len < info[id].minlen)
+-				continue;
+		if (info[id].maxlen && len > info[id].maxlen)
+			return 0;
+ 
+-			if (info[id].maxlen && len > info[id].maxlen)
+-				continue;
+		if (info[id].validate && !info[id].validate(&info[id], attr))
+			return 0;
+	}
+ 
+-			if (info[id].validate && !info[id].validate(&info[id], pos))
+-				continue;
+-		}
+	if (!data[id])
+		found++;
+ 
+-		if (!data[id])
+-			found++;
+	data[id] = attr;
+	return found;
+}
+ 
+-		data[id] = pos;
+int
+blob_parse(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max)
+{
+	struct blob_attr *pos;
+	int found = 0;
+	size_t rem;
+
+	memset(data, 0, sizeof(struct blob_attr *) * max);
+	blob_for_each_attr(pos, attr, rem) {
+		found += blob_parse_attr(pos, data, info, max);
+ 	}
+
+ 	return found;
+ }
+ 
--- a/package/libs/libubox/patches/0004-blob-introduce-blob_parse_untrusted.patch
+++ b/package/libs/libubox/patches/0004-blob-introduce-blob_parse_untrusted.patch
@@ -0,0 +1,78 @@
+From b6a0a070f2e14808e835c2fcfa3820a55041902f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Mon, 9 Dec 2019 14:11:45 +0100
+Subject: blob: introduce blob_parse_untrusted
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+blob_parse can be only used on trusted input as it has no possibility to
+check the length of the provided input buffer, which might lead to
+undefined behaviour and/or crashes when supplied with malformed,
+corrupted or otherwise specially crafted input.
+
+So this introduces blob_parse_untrusted variant which expects additional
+input buffer length argument and thus should be able to process also
+inputs from untrusted sources.
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blob.c | 24 ++++++++++++++++++++++++
+ blob.h |  7 +++++++
+ 2 files changed, 31 insertions(+)
+
+--- a/blob.c
+++ b/blob.c
+@@ -253,6 +253,30 @@ blob_parse_attr(struct blob_attr *attr,
+ }
+ 
+ int
+blob_parse_untrusted(struct blob_attr *attr, size_t attr_len, struct blob_attr **data, const struct blob_attr_info *info, int max)
+{
+	struct blob_attr *pos;
+	size_t len = 0;
+	int found = 0;
+	size_t rem;
+
+	if (!attr || attr_len < sizeof(struct blob_attr))
+		return 0;
+
+	len = blob_raw_len(attr);
+	if (len != attr_len)
+		return 0;
+
+	memset(data, 0, sizeof(struct blob_attr *) * max);
+	blob_for_each_attr_len(pos, attr, len, rem) {
+		found += blob_parse_attr(pos, rem, data, info, max);
+	}
+
+	return found;
+}
+
+/* use only on trusted input, otherwise consider blob_parse_untrusted */
+int
+ blob_parse(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max)
+ {
+ 	struct blob_attr *pos;
+--- a/blob.h
+++ b/blob.h
+@@ -199,6 +199,7 @@ extern void blob_nest_end(struct blob_bu
+ extern struct blob_attr *blob_put(struct blob_buf *buf, int id, const void *ptr, unsigned int len);
+ extern bool blob_check_type(const void *ptr, unsigned int len, int type);
+ extern int blob_parse(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max);
+extern int blob_parse_untrusted(struct blob_attr *attr, size_t attr_len, struct blob_attr **data, const struct blob_attr_info *info, int max);
+ extern struct blob_attr *blob_memdup(struct blob_attr *attr);
+ extern struct blob_attr *blob_put_raw(struct blob_buf *buf, const void *ptr, unsigned int len);
+ 
+@@ -254,5 +255,11 @@ blob_put_u64(struct blob_buf *buf, int i
+ 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+ 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
+#define blob_for_each_attr_len(pos, attr, attr_len, rem) \
+	for (rem = attr ? blob_len(attr) : 0, \
+	     pos = (struct blob_attr *) (attr ? blob_data(attr) : NULL); \
+	     rem >= sizeof(struct blob_attr) && rem < attr_len && (blob_pad_len(pos) <= rem) && \
+	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
+ #endif
--- a/package/libs/libubox/patches/0005-blob-fix-OOB-access-in-blob_check_type.patch
+++ b/package/libs/libubox/patches/0005-blob-fix-OOB-access-in-blob_check_type.patch
@@ -0,0 +1,78 @@
+From 7425d421340594f50c717ff7129b6ee71280a447 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Mon, 9 Dec 2019 15:27:16 +0100
+Subject: blob: fix OOB access in blob_check_type
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Found by fuzzer:
+
+ ERROR: AddressSanitizer: SEGV on unknown address 0x602100000455
+ The signal is caused by a READ memory access.
+     #0 in blob_check_type blob.c:214:43
+     #1 in blob_parse_attr blob.c:234:9
+     #2 in blob_parse_untrusted blob.c:272:12
+     #3 in fuzz_blob_parse tests/fuzzer/test-blob-parse-fuzzer.c:34:2
+     #4 in LLVMFuzzerTestOneInput tests/fuzzer/test-blob-parse-fuzzer.c:39:2
+
+Caused by following line:
+
+	if (type == BLOB_ATTR_STRING && data[len - 1] != 0)
+
+where len was pointing outside of the data buffer.
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blob.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/blob.c
+++ b/blob.c
+@@ -218,20 +218,33 @@ blob_check_type(const void *ptr, unsigne
+ }
+ 
+ static int
+-blob_parse_attr(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max)
+blob_parse_attr(struct blob_attr *attr, size_t attr_len, struct blob_attr **data, const struct blob_attr_info *info, int max)
+ {
+	int id;
+	size_t len;
+ 	int found = 0;
+-	int id = blob_id(attr);
+-	size_t len = blob_len(attr);
+	size_t data_len;
+ 
+	if (!attr || attr_len < sizeof(struct blob_attr))
+		return 0;
+
+	id = blob_id(attr);
+ 	if (id >= max)
+ 		return 0;
+ 
+	len = blob_raw_len(attr);
+	if (len > attr_len || len < sizeof(struct blob_attr))
+		return 0;
+
+	data_len = blob_len(attr);
+	if (data_len > len)
+		return 0;
+
+ 	if (info) {
+ 		int type = info[id].type;
+ 
+ 		if (type < BLOB_ATTR_LAST) {
+-			if (!blob_check_type(blob_data(attr), len, type))
+			if (!blob_check_type(blob_data(attr), data_len, type))
+ 				return 0;
+ 		}
+ 
+@@ -285,7 +298,7 @@ blob_parse(struct blob_attr *attr, struc
+ 
+ 	memset(data, 0, sizeof(struct blob_attr *) * max);
+ 	blob_for_each_attr(pos, attr, rem) {
+-		found += blob_parse_attr(pos, data, info, max);
+		found += blob_parse_attr(pos, rem, data, info, max);
+ 	}
+ 
+ 	return found;
--- a/package/libs/libubox/patches/0006-blobmsg-fix-heap-buffer-overflow-in-blobmsg_parse.patch
+++ b/package/libs/libubox/patches/0006-blobmsg-fix-heap-buffer-overflow-in-blobmsg_parse.patch
@@ -0,0 +1,32 @@
+From 0773eef13674964d890420673d2501342979d8bf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Tue, 10 Dec 2019 12:02:40 +0100
+Subject: blobmsg: fix heap buffer overflow in blobmsg_parse
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes following error found by the fuzzer:
+
+ ==29774==ERROR: AddressSanitizer: heap-buffer-overflow
+ READ of size 1 at 0x6020004f1c56 thread T0
+     #0 strcmp sanitizer_common_interceptors.inc:442:3
+     #1 blobmsg_parse blobmsg.c:168:8
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/blobmsg.c
+++ b/blobmsg.c
+@@ -52,6 +52,9 @@ bool blobmsg_check_attr(const struct blo
+ 
+ 	id = blob_id(attr);
+ 	len = blobmsg_data_len(attr);
+	if (len > blob_raw_len(attr))
+		return false;
+
+ 	data = blobmsg_data(attr);
+ 
+ 	if (id > BLOBMSG_TYPE_LAST)
--- a/package/libs/libubox/patches/0007-Ensure-blob_attr-length-check-does-not-perform-out-o.patch
+++ b/package/libs/libubox/patches/0007-Ensure-blob_attr-length-check-does-not-perform-out-o.patch
@@ -0,0 +1,51 @@
+From cec3ed2550073abbfe0f1f6131c44f90c9d05aa8 Mon Sep 17 00:00:00 2001
+From: Tobias Schramm <tobleminer@gmail.com>
+Date: Wed, 28 Nov 2018 13:39:29 +0100
+Subject: Ensure blob_attr length check does not perform out of bounds reads
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Before there might have been as little as one single byte left which
+would result in 3 bytes of blob_attr->id_len being out of bounds.
+
+Acked-by: Yousong Zhou <yszhou4tech@gmail.com>
+Signed-off-by: Tobias Schramm <tobleminer@gmail.com>
+[line wrapped < 72 chars]
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blob.h    | 4 ++--
+ blobmsg.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/blob.h
+++ b/blob.h
+@@ -243,7 +243,7 @@ blob_put_u64(struct blob_buf *buf, int i
+ 
+ #define __blob_for_each_attr(pos, attr, rem) \
+ 	for (pos = (struct blob_attr *) attr; \
+-	     rem > 0 && (blob_pad_len(pos) <= rem) && \
+	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
+ 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+ 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
+@@ -251,7 +251,7 @@ blob_put_u64(struct blob_buf *buf, int i
+ #define blob_for_each_attr(pos, attr, rem) \
+ 	for (rem = attr ? blob_len(attr) : 0, \
+ 	     pos = (struct blob_attr *) (attr ? blob_data(attr) : NULL); \
+-	     rem > 0 && (blob_pad_len(pos) <= rem) && \
+	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
+ 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+ 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
+--- a/blobmsg.h
+++ b/blobmsg.h
+@@ -266,7 +266,7 @@ int blobmsg_printf(struct blob_buf *buf,
+ #define blobmsg_for_each_attr(pos, attr, rem) \
+ 	for (rem = attr ? blobmsg_data_len(attr) : 0, \
+ 	     pos = (struct blob_attr *) (attr ? blobmsg_data(attr) : NULL); \
+-	     rem > 0 && (blob_pad_len(pos) <= rem) && \
+	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
+ 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+ 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
--- a/package/libs/libubox/patches/0008-Replace-use-of-blobmsg_check_attr-by-blobmsg_check_a.patch
+++ b/package/libs/libubox/patches/0008-Replace-use-of-blobmsg_check_attr-by-blobmsg_check_a.patch
@@ -0,0 +1,132 @@
+From 8b6a401638317906b6d9039417c1c19ea8cfeab0 Mon Sep 17 00:00:00 2001
+From: Tobias Schramm <tobleminer@gmail.com>
+Date: Tue, 13 Nov 2018 04:16:12 +0100
+Subject: Replace use of blobmsg_check_attr by blobmsg_check_attr_len
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+blobmsg_check_attr_len adds a length limit specifying the max offset
+from attr that can be read safely.
+
+Signed-off-by: Tobias Schramm <tobleminer@gmail.com>
+[rebased and reworked, line wrapped commit message, _safe -> _len]
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 59 +++++++++++++++++++++++++++++++++++++++++++------------
+ blobmsg.h |  2 ++
+ 2 files changed, 48 insertions(+), 13 deletions(-)
+
+--- a/blobmsg.c
+++ b/blobmsg.c
+@@ -33,37 +33,70 @@ blobmsg_namelen(const struct blobmsg_hdr
+ 
+ bool blobmsg_check_attr(const struct blob_attr *attr, bool name)
+ {
+	return blobmsg_check_attr_len(attr, name, blob_raw_len(attr));
+}
+
+static bool blobmsg_check_name(const struct blob_attr *attr, size_t len, bool name)
+{
+	char *limit = (char *) attr + len;
+ 	const struct blobmsg_hdr *hdr;
+-	const char *data;
+-	int id, len;
+ 
+-	if (blob_len(attr) < sizeof(struct blobmsg_hdr))
+	hdr = blob_data(attr);
+	if (name && !hdr->namelen)
+ 		return false;
+ 
+-	hdr = (void *) attr->data;
+-	if (!hdr->namelen && name)
+	if ((char *) hdr->name + blobmsg_namelen(hdr) > limit)
+ 		return false;
+ 
+-	if (blobmsg_namelen(hdr) > blob_len(attr) - sizeof(struct blobmsg_hdr))
+	if (blobmsg_namelen(hdr) > (blob_len(attr) - sizeof(struct blobmsg_hdr)))
+ 		return false;
+ 
+ 	if (hdr->name[blobmsg_namelen(hdr)] != 0)
+ 		return false;
+ 
+-	id = blob_id(attr);
+-	len = blobmsg_data_len(attr);
+-	if (len > blob_raw_len(attr))
+-		return false;
+	return true;
+}
+
+static const char* blobmsg_check_data(const struct blob_attr *attr, size_t len, size_t *data_len)
+{
+	char *limit = (char *) attr + len;
+	const char *data;
+
+	*data_len = blobmsg_data_len(attr);
+	if (*data_len > blob_raw_len(attr))
+		return NULL;
+ 
+ 	data = blobmsg_data(attr);
+	if (data + *data_len > limit)
+		return NULL;
+ 
+	return data;
+}
+
+bool blobmsg_check_attr_len(const struct blob_attr *attr, bool name, size_t len)
+{
+	const char *data;
+	size_t data_len;
+	int id;
+
+	if (len < sizeof(struct blob_attr))
+		return false;
+
+	if (!blobmsg_check_name(attr, len, name))
+		return false;
+
+	id = blob_id(attr);
+ 	if (id > BLOBMSG_TYPE_LAST)
+ 		return false;
+ 
+ 	if (!blob_type[id])
+ 		return true;
+ 
+-	return blob_check_type(data, len, blob_type[id]);
+	data = blobmsg_check_data(attr, len, &data_len);
+	if (!data)
+		return false;
+
+	return blob_check_type(data, data_len, blob_type[id]);
+ }
+ 
+ int blobmsg_check_array(const struct blob_attr *attr, int type)
+@@ -114,7 +147,7 @@ int blobmsg_parse_array(const struct blo
+ 		    blob_id(attr) != policy[i].type)
+ 			continue;
+ 
+-		if (!blobmsg_check_attr(attr, false))
+		if (!blobmsg_check_attr_len(attr, false, len))
+ 			return -1;
+ 
+ 		if (tb[i])
+@@ -161,7 +194,7 @@ int blobmsg_parse(const struct blobmsg_p
+ 			if (blobmsg_namelen(hdr) != pslen[i])
+ 				continue;
+ 
+-			if (!blobmsg_check_attr(attr, true))
+			if (!blobmsg_check_attr_len(attr, true, len))
+ 				return -1;
+ 
+ 			if (tb[i])
+--- a/blobmsg.h
+++ b/blobmsg.h
+@@ -107,6 +107,8 @@ static inline int blobmsg_len(const stru
+ bool blobmsg_check_attr(const struct blob_attr *attr, bool name);
+ bool blobmsg_check_attr_list(const struct blob_attr *attr, int type);
+ 
+bool blobmsg_check_attr_len(const struct blob_attr *attr, bool name, size_t len);
+
+ /*
+  * blobmsg_check_array: validate array/table and return size
+  *
--- a/package/libs/libubox/patches/0009-blobmsg-add-_len-variants-for-all-attribute-checking.patch
+++ b/package/libs/libubox/patches/0009-blobmsg-add-_len-variants-for-all-attribute-checking.patch
@@ -0,0 +1,157 @@
+From ad29d0304983e283d4aec4ee5462942eaf5c03ac Mon Sep 17 00:00:00 2001
+From: Tobias Schramm <tobleminer@gmail.com>
+Date: Thu, 15 Nov 2018 03:42:48 +0100
+Subject: blobmsg: add _len variants for all attribute checking methods
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Introduce _len variants of blobmsg attribute checking functions which
+aims to provide safer implementation as those functions should limit all
+memory accesses performed on the blob to the range [attr, attr + len]
+(upper bound non inclusive) and thus should be suited for checking of
+untrusted blob attributes.
+
+While at it add some comments in order to make it clear.
+
+Signed-off-by: Tobias Schramm <tobleminer@gmail.com>
+[_safe -> _len, blobmsg_check_array_len fix, commit subject/desc facelift]
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 21 ++++++++++++++++++---
+ blobmsg.h | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 72 insertions(+), 4 deletions(-)
+
+--- a/blobmsg.c
+++ b/blobmsg.c
+@@ -101,11 +101,21 @@ bool blobmsg_check_attr_len(const struct
+ 
+ int blobmsg_check_array(const struct blob_attr *attr, int type)
+ {
+	return blobmsg_check_array_len(attr, type, blob_raw_len(attr));
+}
+
+int blobmsg_check_array_len(const struct blob_attr *attr, int type, size_t len)
+{
+ 	struct blob_attr *cur;
+ 	bool name;
+-	int rem;
+ 	int size = 0;
+ 
+	if (type > BLOBMSG_TYPE_LAST)
+		return -1;
+
+	if (!blobmsg_check_attr_len(attr, false, len))
+		return -1;
+
+ 	switch (blobmsg_type(attr)) {
+ 	case BLOBMSG_TYPE_TABLE:
+ 		name = true;
+@@ -117,11 +127,11 @@ int blobmsg_check_array(const struct blo
+ 		return -1;
+ 	}
+ 
+-	blobmsg_for_each_attr(cur, attr, rem) {
+	__blobmsg_for_each_attr(cur, attr, len) {
+ 		if (type != BLOBMSG_TYPE_UNSPEC && blobmsg_type(cur) != type)
+ 			return -1;
+ 
+-		if (!blobmsg_check_attr(cur, name))
+		if (!blobmsg_check_attr_len(cur, name, len))
+ 			return -1;
+ 
+ 		size++;
+@@ -135,6 +145,11 @@ bool blobmsg_check_attr_list(const struc
+ 	return blobmsg_check_array(attr, type) >= 0;
+ }
+ 
+bool blobmsg_check_attr_list_len(const struct blob_attr *attr, int type, size_t len)
+{
+	return blobmsg_check_array_len(attr, type, len) >= 0;
+}
+
+ int blobmsg_parse_array(const struct blobmsg_policy *policy, int policy_len,
+ 			struct blob_attr **tb, void *data, unsigned int len)
+ {
+--- a/blobmsg.h
+++ b/blobmsg.h
+@@ -104,19 +104,66 @@ static inline int blobmsg_len(const stru
+ 	return blobmsg_data_len(attr);
+ }
+ 
+/*
+ * blobmsg_check_attr: validate a list of attributes
+ *
+ * This method may be used with trusted data only. Providing
+ * malformed blobs will cause out of bounds memory access.
+ */
+ bool blobmsg_check_attr(const struct blob_attr *attr, bool name);
+-bool blobmsg_check_attr_list(const struct blob_attr *attr, int type);
+ 
+/*
+ * blobmsg_check_attr_len: validate a list of attributes
+ *
+ * This method should be safer implementation of blobmsg_check_attr.
+ * It will limit all memory access performed on the blob to the
+ * range [attr, attr + len] (upper bound non inclusive) and is
+ * thus suited for checking of untrusted blob attributes.
+ */
+ bool blobmsg_check_attr_len(const struct blob_attr *attr, bool name, size_t len);
+ 
+ /*
+ * blobmsg_check_attr_list: validate a list of attributes
+ *
+ * This method may be used with trusted data only. Providing
+ * malformed blobs will cause out of bounds memory access.
+ */
+bool blobmsg_check_attr_list(const struct blob_attr *attr, int type);
+
+/*
+ * blobmsg_check_attr_list_len: validate a list of untrusted attributes
+ *
+ * This method should be safer implementation of blobmsg_check_attr_list.
+ * It will limit all memory access performed on the blob to the
+ * range [attr, attr + len] (upper bound non inclusive) and is
+ * thus suited for checking of untrusted blob attributes.
+ */
+bool blobmsg_check_attr_list_len(const struct blob_attr *attr, int type, size_t len);
+
+/*
+  * blobmsg_check_array: validate array/table and return size
+  *
+  * Checks if all elements of an array or table are valid and have
+  * the specified type. Returns the number of elements in the array
+ *
+ * This method may be used with trusted data only. Providing
+ * malformed blobs will cause out of bounds memory access.
+  */
+ int blobmsg_check_array(const struct blob_attr *attr, int type);
+ 
+/*
+ * blobmsg_check_array_len: validate untrusted array/table and return size
+ *
+ * Checks if all elements of an array or table are valid and have
+ * the specified type. Returns the number of elements in the array.
+ *
+ * This method should be safer implementation of blobmsg_check_array.
+ * It will limit all memory access performed on the blob to the
+ * range [attr, attr + len] (upper bound non inclusive) and is
+ * thus suited for checking of untrusted blob attributes.
+ */
+int blobmsg_check_array_len(const struct blob_attr *attr, int type, size_t len);
+
+ int blobmsg_parse(const struct blobmsg_policy *policy, int policy_len,
+                   struct blob_attr **tb, void *data, unsigned int len);
+ int blobmsg_parse_array(const struct blobmsg_policy *policy, int policy_len,
+@@ -271,5 +318,11 @@ int blobmsg_printf(struct blob_buf *buf,
+ 	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
+ 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+ 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+
+#define __blobmsg_for_each_attr(pos, attr, rem) \
+	for (pos = (struct blob_attr *) (attr ? blobmsg_data(attr) : NULL); \
+	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
+	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
+ #endif
--- a/package/libs/libubox/patches/0010-blobmsg-fix-array-out-of-bounds-GCC-10-warning.patch
+++ b/package/libs/libubox/patches/0010-blobmsg-fix-array-out-of-bounds-GCC-10-warning.patch
@@ -0,0 +1,39 @@
+From 44d9e85ef058fbb9981d53218cafdc451afa5535 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Wed, 25 Dec 2019 10:27:59 +0100
+Subject: blobmsg: fix array out of bounds GCC 10 warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes following warning reported by GCC 10.0.0 20191203:
+
+ blobmsg.c:234:2: error: 'strcpy' offset 6 from the object at 'attr' is out of the bounds of referenced subobject 'name' with type 'uint8_t[0]' {aka 'unsigned char[0]'} at offset 6 [-Werror=array-bounds]
+   234 |  strcpy((char *) hdr->name, (const char *)name);
+       |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+ In file included from blobmsg.c:16:
+ blobmsg.h:42:10: note: subobject 'name' declared here
+    42 |  uint8_t name[];
+       |          ^~~~
+
+Reported-by: Khem Raj <raj.khem@gmail.com>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/blobmsg.c
+++ b/blobmsg.c
+@@ -246,7 +246,10 @@ blobmsg_new(struct blob_buf *buf, int ty
+ 	attr->id_len |= be32_to_cpu(BLOB_ATTR_EXTENDED);
+ 	hdr = blob_data(attr);
+ 	hdr->namelen = cpu_to_be16(namelen);
+-	strcpy((char *) hdr->name, (const char *)name);
+
+	memcpy(hdr->name, name, namelen);
+	hdr->name[namelen] = '\0';
+
+ 	pad_end = *data = blobmsg_data(attr);
+ 	pad_start = (char *) &hdr->name[namelen];
+ 	if (pad_start < pad_end)
--- a/package/libs/libubox/patches/0011-blobmsg-fix-wrong-payload-len-passed-from-blobmsg_ch.patch
+++ b/package/libs/libubox/patches/0011-blobmsg-fix-wrong-payload-len-passed-from-blobmsg_ch.patch
@@ -0,0 +1,38 @@
+From d0f05d5e6873b30315127d47abbf4ac9f3c8bfb7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Sat, 28 Dec 2019 19:00:39 +0100
+Subject: blobmsg: fix wrong payload len passed from blobmsg_check_array
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fix incorrect use of blob_raw_len() on passed blobmsg to
+blobmsg_check_array_len()  introduced in commit b0e21553ae8c ("blobmsg:
+add _len variants for all attribute checking methods") by using correct
+blobmsg_len().
+
+This wrong (higher) length was then for example causing issues in
+procd's instance_config_parse_command() where blobmsg_check_attr_list()
+was failing sanity checking of service command, thus resulting in the
+startup failures of some services like collectd, nlbwmon and samba4.
+
+Ref: http://lists.infradead.org/pipermail/openwrt-devel/2019-December/020840.html
+Fixes: b0e21553ae8c ("blobmsg: add _len variants for all attribute checking methods")
+Reported-by: Hannu Nyman <hannu.nyman@welho.com>
+Tested-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/blobmsg.c
+++ b/blobmsg.c
+@@ -101,7 +101,7 @@ bool blobmsg_check_attr_len(const struct
+ 
+ int blobmsg_check_array(const struct blob_attr *attr, int type)
+ {
+-	return blobmsg_check_array_len(attr, type, blob_raw_len(attr));
+	return blobmsg_check_array_len(attr, type, blobmsg_len(attr));
+ }
+ 
+ int blobmsg_check_array_len(const struct blob_attr *attr, int type, size_t len)
--- a/package/libs/libubox/patches/0012-jshn-prefer-snprintf-usage.patch
+++ b/package/libs/libubox/patches/0012-jshn-prefer-snprintf-usage.patch
@@ -0,0 +1,61 @@
+From 31778937b4153492955495e550435c8bbf7cfde8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Tue, 14 Jan 2020 08:55:34 +0100
+Subject: jshn: prefer snprintf usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Better safe than sorry.
+
+Reviewed-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ jshn.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/jshn.c
+++ b/jshn.c
+@@ -68,7 +68,7 @@ static int add_json_array(struct array_l
+ 	int ret;
+ 
+ 	for (i = 0, len = array_list_length(a); i < len; i++) {
+-		sprintf(seq, "%d", i);
+		snprintf(seq, sizeof(seq), "%d", i);
+ 		ret = add_json_element(seq, array_list_get_idx(a, i));
+ 		if (ret)
+ 			return ret;
+@@ -197,25 +197,27 @@ static char *getenv_avl(const char *key)
+ static char *get_keys(const char *prefix)
+ {
+ 	char *keys;
+	size_t len = var_prefix_len + strlen(prefix) + sizeof("K_") + 1;
+ 
+-	keys = alloca(var_prefix_len + strlen(prefix) + sizeof("K_") + 1);
+-	sprintf(keys, "%sK_%s", var_prefix, prefix);
+	keys = alloca(len);
+	snprintf(keys, len, "%sK_%s", var_prefix, prefix);
+ 	return getenv_avl(keys);
+ }
+ 
+ static void get_var(const char *prefix, const char **name, char **var, char **type)
+ {
+ 	char *tmpname, *varname;
+	size_t len = var_prefix_len + strlen(prefix) + 1 + strlen(*name) + 1 + sizeof("T_");
+ 
+-	tmpname = alloca(var_prefix_len + strlen(prefix) + 1 + strlen(*name) + 1 + sizeof("T_"));
+	tmpname = alloca(len);
+ 
+-	sprintf(tmpname, "%s%s_%s", var_prefix, prefix, *name);
+	snprintf(tmpname, len, "%s%s_%s", var_prefix, prefix, *name);
+ 	*var = getenv_avl(tmpname);
+ 
+-	sprintf(tmpname, "%sT_%s_%s", var_prefix, prefix, *name);
+	snprintf(tmpname, len, "%sT_%s_%s", var_prefix, prefix, *name);
+ 	*type = getenv_avl(tmpname);
+ 
+-	sprintf(tmpname, "%sN_%s_%s", var_prefix, prefix, *name);
+	snprintf(tmpname, len, "%sN_%s_%s", var_prefix, prefix, *name);
+ 	varname = getenv_avl(tmpname);
+ 	if (varname)
+ 		*name = varname;
--- a/package/libs/libubox/patches/0013-blobmsg-blobmsg_vprintf-prefer-vsnprintf.patch
+++ b/package/libs/libubox/patches/0013-blobmsg-blobmsg_vprintf-prefer-vsnprintf.patch
@@ -0,0 +1,38 @@
+From 935bb933e4a74de7326a4373340fd50655712334 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Tue, 14 Jan 2020 08:57:05 +0100
+Subject: blobmsg: blobmsg_vprintf: prefer vsnprintf
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Better safe than sorry and while at it add handling of possible
+*printf() failures.
+
+Reviewed-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/blobmsg.c
+++ b/blobmsg.c
+@@ -296,10 +296,17 @@ blobmsg_vprintf(struct blob_buf *buf, co
+ 	len = vsnprintf(&cbuf, sizeof(cbuf), format, arg2);
+ 	va_end(arg2);
+ 
+	if (len < 0)
+		return -1;
+
+ 	sbuf = blobmsg_alloc_string_buffer(buf, name, len + 1);
+ 	if (!sbuf)
+ 		return -1;
+-	ret = vsprintf(sbuf, format, arg);
+
+	ret = vsnprintf(sbuf, len + 1, format, arg);
+	if (ret < 0)
+		return -1;
+
+ 	blobmsg_add_string_buffer(buf);
+ 
+ 	return ret;
--- a/package/libs/libubox/patches/0014-blobmsg_json-fix-int16-serialization.patch
+++ b/package/libs/libubox/patches/0014-blobmsg_json-fix-int16-serialization.patch
@@ -0,0 +1,41 @@
+From 1cc755d7c3989b399bf0c60535a858d22819ca27 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Sun, 12 Jan 2020 22:40:18 +0100
+Subject: blobmsg_json: fix int16 serialization
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+int16 blobmsg type is currently being serialized as uint16_t due to
+missing cast during JSON output.
+
+Following blobmsg content:
+
+ bar-min: -32768 (i16)
+ bar-max: 32767 (i16)
+
+Produces following JSON:
+
+ { "bar-min":32768,"bar-max":32767 }
+
+Whereas one would expect:
+
+ { "bar-min":-32768,"bar-max":32767 }
+
+Reviewed-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg_json.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/blobmsg_json.c
+++ b/blobmsg_json.c
+@@ -250,7 +250,7 @@ static void blobmsg_format_element(struc
+ 		sprintf(buf, "%s", *(uint8_t *)data ? "true" : "false");
+ 		break;
+ 	case BLOBMSG_TYPE_INT16:
+-		sprintf(buf, "%d", be16_to_cpu(*(uint16_t *)data));
+		sprintf(buf, "%d", (int16_t) be16_to_cpu(*(uint16_t *)data));
+ 		break;
+ 	case BLOBMSG_TYPE_INT32:
+ 		sprintf(buf, "%d", (int32_t) be32_to_cpu(*(uint32_t *)data));
--- a/package/libs/libubox/patches/0015-blobmsg_json-prefer-snprintf-usage.patch
+++ b/package/libs/libubox/patches/0015-blobmsg_json-prefer-snprintf-usage.patch
@@ -0,0 +1,66 @@
+From 0e330ec3662795aea42ac36ecf7a9f32a249c36d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Tue, 14 Jan 2020 09:05:02 +0100
+Subject: blobmsg_json: prefer snprintf usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Better safe than sorry and while at it prefer use of PRId16 and PRId32
+formatting constants as well.
+
+Reviewed-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg_json.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/blobmsg_json.c
+++ b/blobmsg_json.c
+@@ -203,7 +203,7 @@ static void blobmsg_format_string(struct
+ 		buf[1] = escape;
+ 
+ 		if (escape == 'u') {
+-			sprintf(buf + 4, "%02x", (unsigned char) *p);
+			snprintf(buf + 4, sizeof(buf) - 4, "%02x", (unsigned char) *p);
+ 			len = 6;
+ 		} else {
+ 			len = 2;
+@@ -220,7 +220,7 @@ static void blobmsg_format_json_list(str
+ static void blobmsg_format_element(struct strbuf *s, struct blob_attr *attr, bool without_name, bool head)
+ {
+ 	const char *data_str;
+-	char buf[32];
+	char buf[317];
+ 	void *data;
+ 	int len;
+ 
+@@ -244,22 +244,22 @@ static void blobmsg_format_element(struc
+ 	data_str = buf;
+ 	switch(blob_id(attr)) {
+ 	case BLOBMSG_TYPE_UNSPEC:
+-		sprintf(buf, "null");
+		snprintf(buf, sizeof(buf), "null");
+ 		break;
+ 	case BLOBMSG_TYPE_BOOL:
+-		sprintf(buf, "%s", *(uint8_t *)data ? "true" : "false");
+		snprintf(buf, sizeof(buf), "%s", *(uint8_t *)data ? "true" : "false");
+ 		break;
+ 	case BLOBMSG_TYPE_INT16:
+-		sprintf(buf, "%d", (int16_t) be16_to_cpu(*(uint16_t *)data));
+		snprintf(buf, sizeof(buf), "%" PRId16, (int16_t) be16_to_cpu(*(uint16_t *)data));
+ 		break;
+ 	case BLOBMSG_TYPE_INT32:
+-		sprintf(buf, "%d", (int32_t) be32_to_cpu(*(uint32_t *)data));
+		snprintf(buf, sizeof(buf), "%" PRId32, (int32_t) be32_to_cpu(*(uint32_t *)data));
+ 		break;
+ 	case BLOBMSG_TYPE_INT64:
+-		sprintf(buf, "%" PRId64, (int64_t) be64_to_cpu(*(uint64_t *)data));
+		snprintf(buf, sizeof(buf), "%" PRId64, (int64_t) be64_to_cpu(*(uint64_t *)data));
+ 		break;
+ 	case BLOBMSG_TYPE_DOUBLE:
+-		sprintf(buf, "%lf", blobmsg_get_double(attr));
+		snprintf(buf, sizeof(buf), "%lf", blobmsg_get_double(attr));
+ 		break;
+ 	case BLOBMSG_TYPE_STRING:
+ 		blobmsg_format_string(s, data);
--- a/package/libs/libubox/patches/0016-blobmsg-blobmsg_parse-and-blobmsg_parse_array-oob-re.patch
+++ b/package/libs/libubox/patches/0016-blobmsg-blobmsg_parse-and-blobmsg_parse_array-oob-re.patch
@@ -0,0 +1,110 @@
+From 6289e2d29883d5d9510b6a15c18c597478967a42 Mon Sep 17 00:00:00 2001
+From: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>
+Date: Sun, 12 Jan 2020 12:26:18 +0100
+Subject: blobmsg: blobmsg_parse and blobmsg_parse_array oob read fixes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fix out of bounds read in blobmsg_parse and blobmsg_check_name. The
+out of bounds read happens because blob_attr and blobmsg_hdr have
+flexible array members, whose size is 0 in the corresponding sizeofs.
+For example the __blob_for_each_attr macro checks whether rem >=
+sizeof(struct blob_attr). However, what LibFuzzer discovered was,
+if the input data was only 4 bytes, the data would be casted to blob_attr,
+and later on blob_data(attr) would be called even though attr->data was empty.
+The same issue could appear with data larger than 4 bytes, where data
+wasn't empty, but contained only the start of the blobmsg_hdr struct,
+and blobmsg_hdr name was empty. The bugs were discovered by fuzzing
+blobmsg_parse and blobmsg_array_parse with LibFuzzer.
+
+CC: Luka Perkov <luka.perkov@sartura.hr>
+Reviewed-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>
+[refactored some checks, added fuzz inputs, adjusted unit test results]
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 40 ++++++++++++++++++++++++++++++++--------
+ 1 file changed, 32 insertions(+), 8 deletions(-)
+
+--- a/blobmsg.c
+++ b/blobmsg.c
+@@ -36,16 +36,38 @@ bool blobmsg_check_attr(const struct blo
+ 	return blobmsg_check_attr_len(attr, name, blob_raw_len(attr));
+ }
+ 
+static const struct blobmsg_hdr* blobmsg_hdr_from_blob(const struct blob_attr *attr, size_t len)
+{
+	if (len < sizeof(struct blob_attr) + sizeof(struct blobmsg_hdr))
+		return NULL;
+
+	return blob_data(attr);
+}
+
+static bool blobmsg_hdr_valid_namelen(const struct blobmsg_hdr *hdr, size_t len)
+{
+	if (len < sizeof(struct blob_attr) + sizeof(struct blobmsg_hdr) + blobmsg_namelen(hdr) + 1)
+		return false;
+
+	return true;
+}
+
+ static bool blobmsg_check_name(const struct blob_attr *attr, size_t len, bool name)
+ {
+ 	char *limit = (char *) attr + len;
+ 	const struct blobmsg_hdr *hdr;
+ 
+-	hdr = blob_data(attr);
+	hdr = blobmsg_hdr_from_blob(attr, len);
+	if (!hdr)
+		return false;
+
+ 	if (name && !hdr->namelen)
+ 		return false;
+ 
+-	if ((char *) hdr->name + blobmsg_namelen(hdr) > limit)
+	if (name && !blobmsg_hdr_valid_namelen(hdr, len))
+		return false;
+
+	if ((char *) hdr->name + blobmsg_namelen(hdr) + 1 > limit)
+ 		return false;
+ 
+ 	if (blobmsg_namelen(hdr) > (blob_len(attr) - sizeof(struct blobmsg_hdr)))
+@@ -79,9 +101,6 @@ bool blobmsg_check_attr_len(const struct
+ 	size_t data_len;
+ 	int id;
+ 
+-	if (len < sizeof(struct blob_attr))
+-		return false;
+-
+ 	if (!blobmsg_check_name(attr, len, name))
+ 		return false;
+ 
+@@ -176,11 +195,10 @@ int blobmsg_parse_array(const struct blo
+ 	return 0;
+ }
+ 
+-
+ int blobmsg_parse(const struct blobmsg_policy *policy, int policy_len,
+                   struct blob_attr **tb, void *data, unsigned int len)
+ {
+-	struct blobmsg_hdr *hdr;
+	const struct blobmsg_hdr *hdr;
+ 	struct blob_attr *attr;
+ 	uint8_t *pslen;
+ 	int i;
+@@ -197,7 +215,13 @@ int blobmsg_parse(const struct blobmsg_p
+ 	}
+ 
+ 	__blob_for_each_attr(attr, data, len) {
+-		hdr = blob_data(attr);
+		hdr = blobmsg_hdr_from_blob(attr, len);
+		if (!hdr)
+			return -1;
+
+		if (!blobmsg_hdr_valid_namelen(hdr, len))
+			return -1;
+
+ 		for (i = 0; i < policy_len; i++) {
+ 			if (!policy[i].name)
+ 				continue;
--- a/package/libs/libubox/patches/0017-blobmsg-fix-wrong-payload-len-passed-from-blobmsg_ch.patch
+++ b/package/libs/libubox/patches/0017-blobmsg-fix-wrong-payload-len-passed-from-blobmsg_ch.patch
@@ -0,0 +1,33 @@
+From 75e300aeec25e032a9778bea34c713969960d1f0 Mon Sep 17 00:00:00 2001
+From: Chris Nisbet <nischris@gmail.com>
+Date: Wed, 12 Feb 2020 21:00:31 +1300
+Subject: [PATCH] blobmsg: fix wrong payload len passed from
+ blobmsg_check_array
+
+Fix incorrect use of blobmsg_len() on passed blobmsg to
+blobmsg_check_array_len() introduced in commit 379cd33d1992
+("fix wrong payload len passed from blobmsg_check_array") by using correct
+blob_len().
+
+By using blobmsg_len() a value too small was passed to blobmsg_check_array()
+which could lead to this function returning an error when there is none.
+
+Fixes: 379cd33d1992 ("fix wrong payload len passed from blobmsg_check_array")
+Signed-off-by: Chris Nisbet <nischris@gmail.com>
+[add fixes tag, rewrap commit message]
+Signed-off-by: Jo-Philipp Wich <jo@mein.io>
+---
+ blobmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/blobmsg.c
+++ b/blobmsg.c
+@@ -120,7 +120,7 @@ bool blobmsg_check_attr_len(const struct
+ 
+ int blobmsg_check_array(const struct blob_attr *attr, int type)
+ {
+-	return blobmsg_check_array_len(attr, type, blobmsg_len(attr));
+	return blobmsg_check_array_len(attr, type, blob_len(attr));
+ }
+ 
+ int blobmsg_check_array_len(const struct blob_attr *attr, int type, size_t len)
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=mbedtls
-PKG_VERSION:=2.16.3
+PKG_VERSION:=2.16.4
 PKG_RELEASE:=1
 PKG_USE_MIPS16:=0

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-gpl.tgz
 PKG_SOURCE_URL:=https://tls.mbed.org/download/
-PKG_HASH:=fd01fe4b289116df7781d05e1ef712b6c98823c5334f4a27404f13a8d066ef6a
+PKG_HASH:=5fdb9c43ab43fd9bcc3631508170b089ede7b86dd655253a93cb0ffeb42309f3

 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPL-2.0+
--- a/package/libs/mbedtls/patches/200-config.patch
+++ b/package/libs/mbedtls/patches/200-config.patch
@@ -17,7 +17,7 @@
 
 /**
  * \def MBEDTLS_CIPHER_NULL_CIPHER
-@@ -750,19 +750,19 @@
+@@ -757,19 +757,19 @@
  *
  * Comment macros to disable the curve and functions for it
  */
@@ -46,7 +46,7 @@
 
 /**
  * \def MBEDTLS_ECP_NIST_OPTIM
-@@ -811,7 +811,7 @@
+@@ -818,7 +818,7 @@
  *
  * Comment this macro to disable deterministic ECDSA.
  */
@@ -55,7 +55,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
-@@ -864,7 +864,7 @@
+@@ -871,7 +871,7 @@
  *             See dhm.h for more details.
  *
  */
@@ -64,7 +64,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
-@@ -884,7 +884,7 @@
+@@ -891,7 +891,7 @@
  *      MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
  *      MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
  */
@@ -73,7 +73,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
-@@ -909,7 +909,7 @@
+@@ -916,7 +916,7 @@
  *      MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
  *      MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
  */
@@ -82,7 +82,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
-@@ -1043,7 +1043,7 @@
+@@ -1050,7 +1050,7 @@
  *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
  *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
  */
@@ -91,7 +91,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
-@@ -1067,7 +1067,7 @@
+@@ -1074,7 +1074,7 @@
  *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
  *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
  */
@@ -100,7 +100,7 @@
 
 /**
  * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
-@@ -1171,7 +1171,7 @@
+@@ -1178,7 +1178,7 @@
  * This option is only useful if both MBEDTLS_SHA256_C and
  * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
  */
@@ -109,7 +109,7 @@
 
 /**
  * \def MBEDTLS_ENTROPY_NV_SEED
-@@ -1266,14 +1266,14 @@
+@@ -1273,14 +1273,14 @@
  * Uncomment this macro to disable the use of CRT in RSA.
  *
  */
@@ -126,7 +126,7 @@
 
 /**
  * \def MBEDTLS_SHA256_SMALLER
-@@ -1289,7 +1289,7 @@
+@@ -1296,7 +1296,7 @@
  *
  * Uncomment to enable the smaller implementation of SHA256.
  */
@@ -135,7 +135,7 @@
 
 /**
  * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES
-@@ -1427,7 +1427,7 @@
+@@ -1434,7 +1434,7 @@
  *          configuration of this extension).
  *
  */
@@ -144,7 +144,7 @@
 
 /**
  * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
-@@ -1602,7 +1602,7 @@
+@@ -1609,7 +1609,7 @@
  *
  * Comment this macro to disable support for SSL session tickets
  */
@@ -153,7 +153,7 @@
 
 /**
  * \def MBEDTLS_SSL_EXPORT_KEYS
-@@ -1632,7 +1632,7 @@
+@@ -1639,7 +1639,7 @@
  *
  * Comment this macro to disable support for truncated HMAC in SSL
  */
@@ -162,7 +162,7 @@
 
 /**
  * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT
-@@ -1691,7 +1691,7 @@
+@@ -1698,7 +1698,7 @@
  *
  * Comment this to disable run-time checking and save ROM space
  */
@@ -171,7 +171,7 @@
 
 /**
  * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
-@@ -2021,7 +2021,7 @@
+@@ -2028,7 +2028,7 @@
  *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
  *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
  */
@@ -180,7 +180,7 @@
 
 /**
  * \def MBEDTLS_ARIA_C
-@@ -2087,7 +2087,7 @@
+@@ -2094,7 +2094,7 @@
  * This module enables the AES-CCM ciphersuites, if other requisites are
  * enabled as well.
  */
@@ -189,7 +189,7 @@
 
 /**
  * \def MBEDTLS_CERTS_C
-@@ -2099,7 +2099,7 @@
+@@ -2106,7 +2106,7 @@
  *
  * This module is used for testing (ssl_client/server).
  */
@@ -198,7 +198,7 @@
 
 /**
  * \def MBEDTLS_CHACHA20_C
-@@ -2108,7 +2108,7 @@
+@@ -2115,7 +2115,7 @@
  *
  * Module:  library/chacha20.c
  */
@@ -207,7 +207,7 @@
 
 /**
  * \def MBEDTLS_CHACHAPOLY_C
-@@ -2119,7 +2119,7 @@
+@@ -2126,7 +2126,7 @@
  *
  * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C
  */
@@ -216,7 +216,7 @@
 
 /**
  * \def MBEDTLS_CIPHER_C
-@@ -2174,7 +2174,7 @@
+@@ -2185,7 +2185,7 @@
  *
  * This module provides debugging functions.
  */
@@ -225,7 +225,7 @@
 
 /**
  * \def MBEDTLS_DES_C
-@@ -2203,7 +2203,7 @@
+@@ -2214,7 +2214,7 @@
  * \warning   DES is considered a weak cipher and its use constitutes a
  *            security risk. We recommend considering stronger ciphers instead.
  */
@@ -234,7 +234,7 @@
 
 /**
  * \def MBEDTLS_DHM_C
-@@ -2366,7 +2366,7 @@
+@@ -2377,7 +2377,7 @@
  * This module adds support for the Hashed Message Authentication Code
  * (HMAC)-based key derivation function (HKDF).
  */
@@ -243,7 +243,7 @@
 
 /**
  * \def MBEDTLS_HMAC_DRBG_C
-@@ -2380,7 +2380,7 @@
+@@ -2391,7 +2391,7 @@
  *
  * Uncomment to enable the HMAC_DRBG random number geerator.
  */
@@ -252,7 +252,7 @@
 
 /**
  * \def MBEDTLS_NIST_KW_C
-@@ -2676,7 +2676,7 @@
+@@ -2687,7 +2687,7 @@
  *
  * This module enables abstraction of common (libc) functions.
  */
@@ -261,7 +261,7 @@
 
 /**
  * \def MBEDTLS_POLY1305_C
-@@ -2686,7 +2686,7 @@
+@@ -2697,7 +2697,7 @@
  * Module:  library/poly1305.c
  * Caller:  library/chachapoly.c
  */
@@ -270,7 +270,7 @@
 
 /**
  * \def MBEDTLS_RIPEMD160_C
-@@ -2697,7 +2697,7 @@
+@@ -2708,7 +2708,7 @@
  * Caller:  library/md.c
  *
  */
@@ -279,7 +279,7 @@
 
 /**
  * \def MBEDTLS_RSA_C
-@@ -2804,7 +2804,7 @@
+@@ -2815,7 +2815,7 @@
  *
  * Requires: MBEDTLS_CIPHER_C
  */
@@ -288,7 +288,7 @@
 
 /**
  * \def MBEDTLS_SSL_CLI_C
-@@ -2904,7 +2904,7 @@
+@@ -2915,7 +2915,7 @@
  *
  * This module provides run-time version information.
  */
@@ -297,7 +297,7 @@
 
 /**
  * \def MBEDTLS_X509_USE_C
-@@ -3014,7 +3014,7 @@
+@@ -3025,7 +3025,7 @@
  * Module:  library/xtea.c
  * Caller:
  */
--- a/package/network/services/hostapd/Makefile
+++ b/package/network/services/hostapd/Makefile
@@ -88,9 +88,6 @@ DRIVER_MAKEOPTS= \
 	CONFIG_IEEE80211AC=$(HOSTAPD_IEEE80211AC) \
 	CONFIG_DRIVER_WEXT=$(CONFIG_DRIVER_WEXT_SUPPORT) \

-space :=
-space +=
-
 ifeq ($(LOCAL_VARIANT),full)
  DRIVER_MAKEOPTS += CONFIG_IEEE80211W=$(CONFIG_DRIVER_11W_SUPPORT)
 endif
--- a/package/network/services/ppp/Makefile
+++ b/package/network/services/ppp/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=ppp
 PKG_VERSION:=2.4.7
-PKG_RELEASE:=12
+PKG_RELEASE:=13

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://download.samba.org/pub/ppp/
--- a/package/network/services/ppp/patches/700-radius-Prevent-buffer-overflow-in-rc_mksid.patch
+++ b/package/network/services/ppp/patches/700-radius-Prevent-buffer-overflow-in-rc_mksid.patch
@@ -0,0 +1,30 @@
+From 858976b1fc3107f1261aae337831959b511b83c2 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Sat, 4 Jan 2020 12:01:32 +1100
+Subject: [PATCH] radius: Prevent buffer overflow in rc_mksid()
+
+On some systems getpid() can return a value greater than 65535.
+Increase the size of buf[] to allow for this, and use slprintf()
+to make sure we never overflow it.
+
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+---
+ pppd/plugins/radius/util.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pppd/plugins/radius/util.c b/pppd/plugins/radius/util.c
+index 6f976a712951..740131e8377c 100644
+--- a/pppd/plugins/radius/util.c
+++ b/pppd/plugins/radius/util.c
+@@ -73,9 +73,9 @@ void rc_mdelay(int msecs)
+ char *
+ rc_mksid (void)
+ {
+-  static char buf[15];
+  static char buf[32];
+   static unsigned short int cnt = 0;
+-  sprintf (buf, "%08lX%04X%02hX",
+  slprintf(buf, sizeof(buf), "%08lX%04X%02hX",
+ 	   (unsigned long int) time (NULL),
+ 	   (unsigned int) getpid (),
+ 	   cnt & 0xFF);
--- a/package/network/services/ppp/patches/701-pppd-Fix-bounds-check-in-EAP-code.patch
+++ b/package/network/services/ppp/patches/701-pppd-Fix-bounds-check-in-EAP-code.patch
@@ -0,0 +1,37 @@
+From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Mon, 3 Feb 2020 15:53:28 +1100
+Subject: [PATCH] pppd: Fix bounds check in EAP code
+
+Given that we have just checked vallen < len, it can never be the case
+that vallen >= len + sizeof(rhostname).  This fixes the check so we
+actually avoid overflowing the rhostname array.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+---
+ pppd/eap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pppd/eap.c b/pppd/eap.c
+index 94407f56a336..1b93db01aebd 100644
+--- a/pppd/eap.c
+++ b/pppd/eap.c
+@@ -1420,7 +1420,7 @@ int len;
+ 		}
+ 
+ 		/* Not so likely to happen. */
+-		if (vallen >= len + sizeof (rhostname)) {
+		if (len - vallen >= sizeof (rhostname)) {
+ 			dbglog("EAP: trimming really long peer name down");
+ 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
+ 			rhostname[sizeof (rhostname) - 1] = '\0';
+@@ -1846,7 +1846,7 @@ int len;
+ 		}
+ 
+ 		/* Not so likely to happen. */
+-		if (vallen >= len + sizeof (rhostname)) {
+		if (len - vallen >= sizeof (rhostname)) {
+ 			dbglog("EAP: trimming really long peer name down");
+ 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
+ 			rhostname[sizeof (rhostname) - 1] = '\0';
--- a/package/network/services/ppp/patches/702-pppd-Ignore-received-EAP-messages-when-not-doing-EAP.patch
+++ b/package/network/services/ppp/patches/702-pppd-Ignore-received-EAP-messages-when-not-doing-EAP.patch
@@ -0,0 +1,61 @@
+From 8d45443bb5c9372b4c6a362ba2f443d41c5636af Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Mon, 3 Feb 2020 16:31:42 +1100
+Subject: [PATCH] pppd: Ignore received EAP messages when not doing EAP
+
+This adds some basic checks to the subroutines of eap_input to check
+that we have requested or agreed to doing EAP authentication before
+doing any processing on the received packet.  The motivation is to
+make it harder for a malicious peer to disrupt the operation of pppd
+by sending unsolicited EAP packets.  Note that eap_success() already
+has a check that the EAP client state is reasonable, and does nothing
+(apart from possibly printing a debug message) if not.
+
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+---
+ pppd/eap.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/pppd/eap.c b/pppd/eap.c
+index 1b93db01aebd..082e95343120 100644
+--- a/pppd/eap.c
+++ b/pppd/eap.c
+@@ -1328,6 +1328,12 @@ int len;
+ 	int fd;
+ #endif /* USE_SRP */
+ 
+	/*
+	 * Ignore requests if we're not open
+	 */
+	if (esp->es_client.ea_state <= eapClosed)
+		return;
+
+ 	/*
+ 	 * Note: we update es_client.ea_id *only if* a Response
+ 	 * message is being generated.  Otherwise, we leave it the
+@@ -1736,6 +1742,12 @@ int len;
+ 	u_char dig[SHA_DIGESTSIZE];
+ #endif /* USE_SRP */
+ 
+	/*
+	 * Ignore responses if we're not open
+	 */
+	if (esp->es_server.ea_state <= eapClosed)
+		return;
+
+ 	if (esp->es_server.ea_id != id) {
+ 		dbglog("EAP: discarding Response %d; expected ID %d", id,
+ 		    esp->es_server.ea_id);
+@@ -2047,6 +2059,12 @@ u_char *inp;
+ int id;
+ int len;
+ {
+	/*
+	 * Ignore failure messages if we're not open
+	 */
+	if (esp->es_client.ea_state <= eapClosed)
+		return;
+
+ 	if (!eap_client_active(esp)) {
+ 		dbglog("EAP unexpected failure message in state %s (%d)",
+ 		    eap_state_name(esp->es_client.ea_state),
--- a/package/network/services/uhttpd/Makefile
+++ b/package/network/services/uhttpd/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git
-PKG_SOURCE_DATE:=2019-12-22
-PKG_SOURCE_VERSION:=5f9ae5738372aaa3a6be2f0a278933563d3f191a
-PKG_MIRROR_HASH:=16977c2d7e68f6db3241f874df625af9bd3bafa06fe4499ecb3561c825321e5d
+PKG_SOURCE_DATE:=2020-02-12
+PKG_SOURCE_VERSION:=2ee323c01079248baa9465969df9e25b5fb68cdf
+PKG_MIRROR_HASH:=ebec09286cf5f977cac893931a5a4f27ba891db88d5e44a9b0de9446ae431527
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=ISC

--- a/package/network/utils/ethtool/Makefile
+++ b/package/network/utils/ethtool/Makefile
@@ -23,7 +23,7 @@ PKG_FIXUP:=autoreconf
 PKG_INSTALL:=1
 PKG_BUILD_PARALLEL:=1

-PKG_CONFIG_DEPENDS:=ETHTOOL_PRETTY_DUMP
+PKG_CONFIG_DEPENDS:=CONFIG_ETHTOOL_PRETTY_DUMP

 include $(INCLUDE_DIR)/package.mk

--- a/package/system/opkg/Makefile
+++ b/package/system/opkg/Makefile
@@ -14,9 +14,9 @@ PKG_FLAGS:=essential

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://git.openwrt.org/project/opkg-lede.git
-PKG_SOURCE_DATE:=2019-06-14
-PKG_SOURCE_VERSION:=dcbc142e51f5f5f2fb9e4e44657e013d3c36a52b
-PKG_MIRROR_HASH:=fca7e71dd06f0d5ee0af0d0a493d641d4d5d7e403d64c67879a462a020aa2299
+PKG_SOURCE_DATE:=2020-01-25
+PKG_SOURCE_VERSION:=c09fe2098718807ddbca13ee36e3e38801822946
+PKG_MIRROR_HASH:=b2fba519fb3bf2da2e325a33eee951b85c7c1886e48ebaac3892435a71ae33d5

 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING
--- a/target/linux/apm821xx/patches-4.14/023-0007-crypto-crypto4xx-Fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
+++ b/target/linux/apm821xx/patches-4.14/023-0007-crypto-crypto4xx-Fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch
@@ -1,39 +0,0 @@
-From 6e88098ca43a3d80ae86908f7badba683c8a0d84 Mon Sep 17 00:00:00 2001
-From: Corentin Labbe <clabbe@baylibre.com>
-Date: Wed, 23 Jan 2019 11:24:18 +0000
-Subject: [PATCH 07/15] crypto: crypto4xx - Fix wrong
- ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
-
-When building without CONFIG_HW_RANDOM_PPC4XX, I hit the following build failure:
-drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_probe':
-drivers/crypto/amcc/crypto4xx_core.c:1407:20: error: passing argument 1 of 'ppc4xx_trng_probe' from incompatible pointer type [-Werror=incompatible-pointer-types]
-In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
-drivers/crypto/amcc/crypto4xx_trng.h:28:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
-drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_remove':
-drivers/crypto/amcc/crypto4xx_core.c:1434:21: error: passing argument 1 of 'ppc4xx_trng_remove' from incompatible pointer type [-Werror=incompatible-pointer-types]
-In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
-drivers/crypto/amcc/crypto4xx_trng.h:30:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
-
-This patch fix the needed argument of ppc4xx_trng_probe()/ppc4xx_trng_remove() in that case.
-
-Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
-Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
---
- drivers/crypto/amcc/crypto4xx_trng.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
--- a/drivers/crypto/amcc/crypto4xx_trng.h
-+++ b/drivers/crypto/amcc/crypto4xx_trng.h
-@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_
- void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev);
- #else
- static inline void ppc4xx_trng_probe(
-	struct crypto4xx_device *dev __maybe_unused) { }
-+	struct crypto4xx_core_device *dev __maybe_unused) { }
- static inline void ppc4xx_trng_remove(
-	struct crypto4xx_device *dev __maybe_unused) { }
-+	struct crypto4xx_core_device *dev __maybe_unused) { }
- #endif
- 
- #endif
--- a/target/linux/ar71xx/patches-4.9/450-gpio-nxp-74hc153-gpio-chip-driver.patch
+++ b/target/linux/ar71xx/patches-4.9/450-gpio-nxp-74hc153-gpio-chip-driver.patch
@@ -1,6 +1,6 @@
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
-@@ -1214,4 +1214,12 @@ config GPIO_VIPERBOARD
+@@ -1215,4 +1215,12 @@ config GPIO_VIPERBOARD
 
 endmenu
 
--- a/target/linux/ar71xx/patches-4.9/451-gpio-74x164-improve-platform-device-support.patch
+++ b/target/linux/ar71xx/patches-4.9/451-gpio-74x164-improve-platform-device-support.patch
@@ -109,7 +109,7 @@
 +#endif
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
-@@ -1155,7 +1155,6 @@ menu "SPI GPIO expanders"
+@@ -1156,7 +1156,6 @@ menu "SPI GPIO expanders"
 
 config GPIO_74X164
 	tristate "74x164 serial-in/parallel-out 8-bits shift register"
--- a/target/linux/ar71xx/patches-4.9/452-gpio-add-gpio-latch-driver.patch
+++ b/target/linux/ar71xx/patches-4.9/452-gpio-add-gpio-latch-driver.patch
@@ -1,6 +1,6 @@
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
-@@ -1221,4 +1221,9 @@ config GPIO_NXP_74HC153
+@@ -1222,4 +1222,9 @@ config GPIO_NXP_74HC153
 	  Platform driver for NXP 74HC153 Dual 4-input Multiplexer. This
 	  provides a GPIO interface supporting input mode only.
 
--- a/target/linux/ar71xx/patches-4.9/910-unaligned_access_hacks.patch
+++ b/target/linux/ar71xx/patches-4.9/910-unaligned_access_hacks.patch
@@ -795,7 +795,7 @@
 
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
-@@ -3926,14 +3926,16 @@ static bool tcp_parse_aligned_timestamp(
+@@ -3934,14 +3934,16 @@ static bool tcp_parse_aligned_timestamp(
 {
 	const __be32 *ptr = (const __be32 *)(th + 1);
 
@@ -869,7 +869,7 @@
  * No flags defined yet.
 --- a/net/core/utils.c
 +++ b/net/core/utils.c
-@@ -321,8 +321,14 @@ void inet_proto_csum_replace16(__sum16 *
+@@ -338,8 +338,14 @@ void inet_proto_csum_replace16(__sum16 *
 			       bool pseudohdr)
 {
 	__be32 diff[] = {
--- a/target/linux/ath25/patches-4.14/130-watchdog.patch
+++ b/target/linux/ath25/patches-4.14/130-watchdog.patch
@@ -212,7 +212,7 @@
 +MODULE_ALIAS("platform:" DRIVER_NAME);
 --- a/drivers/watchdog/Kconfig
 +++ b/drivers/watchdog/Kconfig
-@@ -1646,6 +1646,13 @@ config PIC32_DMT
+@@ -1647,6 +1647,13 @@ config PIC32_DMT
 	  To compile this driver as a loadable module, choose M here.
 	  The module will be called pic32-dmt.
 
--- a/target/linux/bcm53xx/patches-4.14/400-mtd-spi-nor-detect-JEDEC-incompatible-w25q128-using-.patch
+++ b/target/linux/bcm53xx/patches-4.14/400-mtd-spi-nor-detect-JEDEC-incompatible-w25q128-using-.patch
@@ -13,7 +13,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

 --- a/drivers/mtd/spi-nor/spi-nor.c
 +++ b/drivers/mtd/spi-nor/spi-nor.c
-@@ -1220,6 +1220,18 @@ static const struct flash_info *spi_nor_
+@@ -1225,6 +1225,18 @@ static const struct flash_info *spi_nor_
 	}
 	dev_err(nor->dev, "unrecognized JEDEC id bytes: %02x, %02x, %02x\n",
 		id[0], id[1], id[2]);
--- a/target/linux/brcm2708/patches-4.9/950-0031-Add-dwc_otg-driver.patch
+++ b/target/linux/brcm2708/patches-4.9/950-0031-Add-dwc_otg-driver.patch
@@ -696,7 +696,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
 }
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -5095,7 +5095,7 @@ static void port_event(struct usb_hub *h
+@@ -5096,7 +5096,7 @@ static void port_event(struct usb_hub *h
 	if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
 		u16 status = 0, unused;
 
--- a/target/linux/brcm2708/patches-4.9/950-0090-OF-DT-Overlay-configfs-interface.patch
+++ b/target/linux/brcm2708/patches-4.9/950-0090-OF-DT-Overlay-configfs-interface.patch
@@ -88,8 +88,8 @@ Signed-off-by: Slawomir Stepien <sst@poczta.fm>
 +make sense for developers (since it avoids problems with namespaces).
 --- a/drivers/of/Kconfig
 +++ b/drivers/of/Kconfig
-@@ -112,4 +112,11 @@ config OF_OVERLAY
- config OF_NUMA
+@@ -116,4 +116,11 @@ config OF_DMA_DEFAULT_COHERENT
+ 	# arches should select this if DMA is coherent by default for OF devices
 	bool
 
 +config OF_CONFIGFS
--- a/target/linux/brcm47xx/base-files/etc/board.d/01_network
+++ b/target/linux/brcm47xx/base-files/etc/board.d/01_network
@@ -166,11 +166,17 @@ configure_by_model() {
 		;;

 	"Asus RT-N16"* | \
-	"Linksys E3000 V1")
+	"Linksys E3000 V1" | \
+	"Netgear WNR3500 V2")
 		ucidef_add_switch "switch0" \
 			"0:wan" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1" "8@eth0"
 		;;

+	"Netgear WN2500RP V1")
+		ucidef_add_switch "switch0" \
+			"0:lan:4" "1:lan:3" "2:lan:2" "3:lan:1" "5@eth0"
+		;;
+
 	*)
 		configure_by_boardtype "$boardtype" "$boardnum"
 		;;
--- a/target/linux/brcm47xx/patches-4.14/209-b44-register-adm-switch.patch
+++ b/target/linux/brcm47xx/patches-4.14/209-b44-register-adm-switch.patch
@@ -19,7 +19,7 @@ Subject: [PATCH 210/210] b44: register adm switch
 
 #include <linux/uaccess.h>
 #include <asm/io.h>
-@@ -2248,6 +2250,69 @@ static void b44_adjust_link(struct net_d
+@@ -2251,6 +2253,69 @@ static void b44_adjust_link(struct net_d
 	}
 }
 
@@ -89,7 +89,7 @@ Subject: [PATCH 210/210] b44: register adm switch
 static int b44_register_phy_one(struct b44 *bp)
 {
 	struct mii_bus *mii_bus;
-@@ -2283,6 +2348,9 @@ static int b44_register_phy_one(struct b
+@@ -2286,6 +2351,9 @@ static int b44_register_phy_one(struct b
 	if (!mdiobus_is_registered_device(bp->mii_bus, bp->phy_addr) &&
 	    (sprom->boardflags_lo & (B44_BOARDFLAG_ROBO | B44_BOARDFLAG_ADM))) {
 
@@ -99,7 +99,7 @@ Subject: [PATCH 210/210] b44: register adm switch
 		dev_info(sdev->dev,
 			 "could not find PHY at %i, use fixed one\n",
 			 bp->phy_addr);
-@@ -2477,6 +2545,7 @@ static void b44_remove_one(struct ssb_de
+@@ -2480,6 +2548,7 @@ static void b44_remove_one(struct ssb_de
 	unregister_netdev(dev);
 	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
 		b44_unregister_phy_one(bp);
--- a/target/linux/brcm47xx/patches-4.14/210-b44_phy_fix.patch
+++ b/target/linux/brcm47xx/patches-4.14/210-b44_phy_fix.patch
@@ -43,7 +43,7 @@
 
 	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
 		return 0;
-@@ -2178,6 +2203,8 @@ static int b44_get_invariants(struct b44
+@@ -2181,6 +2206,8 @@ static int b44_get_invariants(struct b44
 	 * valid PHY address. */
 	bp->phy_addr &= 0x1F;
 
--- a/target/linux/brcm47xx/patches-4.14/831-old_gpio_wdt.patch
+++ b/target/linux/brcm47xx/patches-4.14/831-old_gpio_wdt.patch
@@ -4,7 +4,7 @@ Signed-off-by: Mathias Adam <m.adam--openwrt@adamis.de>

 --- a/drivers/watchdog/Kconfig
 +++ b/drivers/watchdog/Kconfig
-@@ -1472,6 +1472,15 @@ config WDT_MTX1
+@@ -1473,6 +1473,15 @@ config WDT_MTX1
 	  Hardware driver for the MTX-1 boards. This is a watchdog timer that
 	  will reboot the machine after a 100 seconds timer expired.
 
--- a/target/linux/brcm47xx/patches-4.9/209-b44-register-adm-switch.patch
+++ b/target/linux/brcm47xx/patches-4.9/209-b44-register-adm-switch.patch
@@ -19,7 +19,7 @@ Subject: [PATCH 210/210] b44: register adm switch
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
-@@ -2250,6 +2252,69 @@ static void b44_adjust_link(struct net_d
+@@ -2253,6 +2255,69 @@ static void b44_adjust_link(struct net_d
 	}
 }
 
@@ -89,7 +89,7 @@ Subject: [PATCH 210/210] b44: register adm switch
 static int b44_register_phy_one(struct b44 *bp)
 {
 	struct mii_bus *mii_bus;
-@@ -2285,6 +2350,9 @@ static int b44_register_phy_one(struct b
+@@ -2288,6 +2353,9 @@ static int b44_register_phy_one(struct b
 	if (!mdiobus_is_registered_device(bp->mii_bus, bp->phy_addr) &&
 	    (sprom->boardflags_lo & (B44_BOARDFLAG_ROBO | B44_BOARDFLAG_ADM))) {
 
@@ -99,7 +99,7 @@ Subject: [PATCH 210/210] b44: register adm switch
 		dev_info(sdev->dev,
 			 "could not find PHY at %i, use fixed one\n",
 			 bp->phy_addr);
-@@ -2476,6 +2544,7 @@ static void b44_remove_one(struct ssb_de
+@@ -2479,6 +2547,7 @@ static void b44_remove_one(struct ssb_de
 	unregister_netdev(dev);
 	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
 		b44_unregister_phy_one(bp);
--- a/target/linux/brcm47xx/patches-4.9/210-b44_phy_fix.patch
+++ b/target/linux/brcm47xx/patches-4.9/210-b44_phy_fix.patch
@@ -43,7 +43,7 @@
 
 	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
 		return 0;
-@@ -2180,6 +2205,8 @@ static int b44_get_invariants(struct b44
+@@ -2183,6 +2208,8 @@ static int b44_get_invariants(struct b44
 	 * valid PHY address. */
 	bp->phy_addr &= 0x1F;
 
--- a/target/linux/brcm63xx/patches-4.14/102-MIPS-BCM63XX-move-code-touching-the-USB-private-regi.patch
+++ b/target/linux/brcm63xx/patches-4.14/102-MIPS-BCM63XX-move-code-touching-the-USB-private-regi.patch
@@ -23,10 +23,10 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
 +++ b/arch/mips/bcm63xx/Makefile
@@ -2,7 +2,7 @@
 obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
- 		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
-		   dev-wdt.o dev-usb-usbd.o
-+		   dev-wdt.o dev-usb-usbd.o usb-common.o
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
+ 		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
+-		   dev-usb-usbd.o
+		   dev-usb-usbd.o usb-common.o
 obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
 
 obj-y		+= boards/
--- a/target/linux/brcm63xx/patches-4.14/105-MIPS-BCM63XX-add-support-for-the-on-chip-OHCI-contro.patch
+++ b/target/linux/brcm63xx/patches-4.14/105-MIPS-BCM63XX-add-support-for-the-on-chip-OHCI-contro.patch
@@ -23,10 +23,10 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
 +++ b/arch/mips/bcm63xx/Makefile
@@ -2,7 +2,7 @@
 obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
- 		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
-		   dev-wdt.o dev-usb-usbd.o usb-common.o
-+		   dev-wdt.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
+ 		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
+-		   dev-usb-usbd.o usb-common.o
+		   dev-usb-ohci.o dev-usb-usbd.o usb-common.o
 obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
 
 obj-y		+= boards/
--- a/target/linux/brcm63xx/patches-4.14/106-MIPS-BCM63XX-register-OHCI-controller-if-board-enabl.patch
+++ b/target/linux/brcm63xx/patches-4.14/106-MIPS-BCM63XX-register-OHCI-controller-if-board-enabl.patch
@@ -16,7 +16,7 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>

 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -28,6 +28,7 @@
+@@ -27,6 +27,7 @@
 #include <bcm63xx_dev_hsspi.h>
 #include <bcm63xx_dev_pcmcia.h>
 #include <bcm63xx_dev_spi.h>
@@ -24,13 +24,13 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
 #include <bcm63xx_dev_usb_usbd.h>
 #include <board_bcm963xx.h>
 
-@@ -898,6 +899,9 @@ int __init board_register_devices(void)
+@@ -881,6 +882,9 @@ int __init board_register_devices(void)
 	if (board.has_usbd)
 		bcm63xx_usbd_register(&board.usbd);
 
 +	if (board.has_ohci0)
 +		bcm63xx_ohci_register();
 +
- 	if (board.has_dsp)
- 		bcm63xx_dsp_register(&board.dsp);
- 
+ 	/* Generate MAC address for WLAN and register our SPROM,
+ 	 * do this after registering enet devices
+ 	 */
--- a/target/linux/brcm63xx/patches-4.14/108-MIPS-BCM63XX-add-support-for-the-on-chip-EHCI-contro.patch
+++ b/target/linux/brcm63xx/patches-4.14/108-MIPS-BCM63XX-add-support-for-the-on-chip-EHCI-contro.patch
@@ -21,13 +21,12 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>

 --- a/arch/mips/bcm63xx/Makefile
 +++ b/arch/mips/bcm63xx/Makefile
-@@ -2,7 +2,8 @@
+@@ -2,7 +2,7 @@
 obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
- 		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
-		   dev-wdt.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o
-+		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
-+		   usb-common.o
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
+ 		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
+-		   dev-usb-ohci.o dev-usb-usbd.o usb-common.o
+		   dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o
 obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
 
 obj-y		+= boards/
--- a/target/linux/brcm63xx/patches-4.14/109-MIPS-BCM63XX-register-EHCI-controller-if-board-enabl.patch
+++ b/target/linux/brcm63xx/patches-4.14/109-MIPS-BCM63XX-register-EHCI-controller-if-board-enabl.patch
@@ -16,7 +16,7 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>

 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -28,6 +28,7 @@
+@@ -27,6 +27,7 @@
 #include <bcm63xx_dev_hsspi.h>
 #include <bcm63xx_dev_pcmcia.h>
 #include <bcm63xx_dev_spi.h>
@@ -24,7 +24,7 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
 #include <bcm63xx_dev_usb_ohci.h>
 #include <bcm63xx_dev_usb_usbd.h>
 #include <board_bcm963xx.h>
-@@ -899,6 +900,9 @@ int __init board_register_devices(void)
+@@ -882,6 +883,9 @@ int __init board_register_devices(void)
 	if (board.has_usbd)
 		bcm63xx_usbd_register(&board.usbd);
 
--- a/target/linux/brcm63xx/patches-4.14/207-MIPS-BCM63XX-move-device-registration-code-into-its-.patch
+++ b/target/linux/brcm63xx/patches-4.14/207-MIPS-BCM63XX-move-device-registration-code-into-its-.patch
@@ -24,7 +24,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 obj-$(CONFIG_BOARD_BCM963XX)		+= board_bcm963xx.o
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -12,34 +12,21 @@
+@@ -12,33 +12,21 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -39,7 +39,6 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 #include <bcm63xx_nvram.h>
 -#include <bcm63xx_dev_pci.h>
 -#include <bcm63xx_dev_enet.h>
-#include <bcm63xx_dev_dsp.h>
 -#include <bcm63xx_dev_flash.h>
 -#include <bcm63xx_dev_hsspi.h>
 -#include <bcm63xx_dev_pcmcia.h>
@@ -61,7 +60,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 /*
  * known 3368 boards
  */
-@@ -712,52 +699,6 @@ static const struct board_info __initcon
+@@ -695,52 +683,6 @@ static const struct board_info __initcon
 };
 
 /*
@@ -114,7 +113,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  * early init callback, read nvram data from flash and checksum it
  */
 void __init board_prom_init(void)
-@@ -802,140 +743,15 @@ void __init board_prom_init(void)
+@@ -785,137 +727,15 @@ void __init board_prom_init(void)
 		if (strncmp(board_name, bcm963xx_boards[i]->name, 16))
 			continue;
 		/* copy, board desc array is marked initdata */
@@ -144,7 +143,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 -		bcm63xx_pci_enabled = 1;
 -		if (BCMCPU_IS_6348())
 -			val |= GPIO_MODE_6348_G2_PCI;
-	}
+ 	}
 -#endif
 -
 -	if (board.has_pccard) {
@@ -225,9 +224,6 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 -	if (board.has_ohci0)
 -		bcm63xx_ohci_register();
 -
-	if (board.has_dsp)
-		bcm63xx_dsp_register(&board.dsp);
-
 -	/* Generate MAC address for WLAN and register our SPROM,
 -	 * do this after registering enet devices
 -	 */
@@ -238,7 +234,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 -		if (ssb_arch_register_fallback_sprom(
 -				&bcm63xx_get_fallback_sprom) < 0)
 -			pr_err("failed to register fallback SPROM\n");
- 	}
+-	}
 -#endif
 -
 -	bcm63xx_spi_register();
--- a/target/linux/brcm63xx/patches-4.14/208-MIPS-BCM63XX-pass-a-mac-addresss-allocator-to-board-.patch
+++ b/target/linux/brcm63xx/patches-4.14/208-MIPS-BCM63XX-pass-a-mac-addresss-allocator-to-board-.patch
@@ -17,7 +17,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>

 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -743,7 +743,8 @@ void __init board_prom_init(void)
+@@ -727,7 +727,8 @@ void __init board_prom_init(void)
 		if (strncmp(board_name, bcm963xx_boards[i]->name, 16))
 			continue;
 		/* copy, board desc array is marked initdata */
--- a/target/linux/brcm63xx/patches-4.14/309-cfe_version_mod.patch
+++ b/target/linux/brcm63xx/patches-4.14/309-cfe_version_mod.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -723,10 +723,20 @@ void __init board_prom_init(void)
+@@ -707,10 +707,20 @@ void __init board_prom_init(void)
 
 	/* dump cfe version */
 	cfe = boot_addr + BCM963XX_CFE_VERSION_OFFSET;
--- a/target/linux/brcm63xx/patches-4.14/339-MIPS-BCM63XX-add-support-for-BCM63268.patch
+++ b/target/linux/brcm63xx/patches-4.14/339-MIPS-BCM63XX-add-support-for-BCM63268.patch
@@ -35,7 +35,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 source "arch/mips/bcm63xx/boards/Kconfig"
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -713,7 +713,7 @@ void __init board_prom_init(void)
+@@ -697,7 +697,7 @@ void __init board_prom_init(void)
 	/* read base address of boot chip select (0)
 	 * 6328/6362 do not have MPI but boot from a fixed address
 	 */
--- a/target/linux/brcm63xx/patches-4.14/341-MIPS-BCM63XX-add-support-for-BCM6318.patch
+++ b/target/linux/brcm63xx/patches-4.14/341-MIPS-BCM63XX-add-support-for-BCM6318.patch
@@ -35,7 +35,7 @@ Subject: [PATCH 51/53] MIPS: BCM63XX: add support for BCM6318
 	select SYS_HAS_CPU_BMIPS4350
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -713,7 +713,7 @@ void __init board_prom_init(void)
+@@ -697,7 +697,7 @@ void __init board_prom_init(void)
 	/* read base address of boot chip select (0)
 	 * 6328/6362 do not have MPI but boot from a fixed address
 	 */
--- a/target/linux/brcm63xx/patches-4.14/350-MIPS-BCM63XX-support-settings-num-usbh-ports.patch
+++ b/target/linux/brcm63xx/patches-4.14/350-MIPS-BCM63XX-support-settings-num-usbh-ports.patch
@@ -1,13 +1,13 @@
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -42,6 +42,7 @@ struct board_info {
+@@ -40,6 +40,7 @@ struct board_info {
 
 	/* USB config */
 	struct bcm63xx_usbd_platform_data usbd;
 +	unsigned int num_usbh_ports:2;
 
- 	/* DSP config */
- 	struct bcm63xx_dsp_platform_data dsp;
+ 	/* GPIO LEDs */
+ 	struct gpio_led leds[5];
 --- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_usb_ehci.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_usb_ehci.h
@@ -1,6 +1,6 @@
--- a/target/linux/brcm63xx/patches-4.14/351-set-board-usbh-ports.patch
+++ b/target/linux/brcm63xx/patches-4.14/351-set-board-usbh-ports.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -592,6 +592,7 @@ static struct board_info __initdata boar
+@@ -576,6 +576,7 @@ static struct board_info __initdata boar
 	.has_ohci0 = 1,
 	.has_pccard = 1,
 	.has_ehci0 = 1,
--- a/target/linux/brcm63xx/patches-4.14/354-MIPS-BCM63XX-allow-building-support-for-more-than-on.patch
+++ b/target/linux/brcm63xx/patches-4.14/354-MIPS-BCM63XX-allow-building-support-for-more-than-on.patch
@@ -36,7 +36,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 +endmenu
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -702,7 +702,7 @@ static const struct board_info __initcon
+@@ -686,7 +686,7 @@ static const struct board_info __initcon
 /*
  * early init callback, read nvram data from flash and checksum it
  */
--- a/target/linux/brcm63xx/patches-4.14/356-MIPS-BCM63XX-move-fallback-sprom-support-into-its-ow.patch
+++ b/target/linux/brcm63xx/patches-4.14/356-MIPS-BCM63XX-move-fallback-sprom-support-into-its-ow.patch
@@ -20,12 +20,13 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>

 --- a/arch/mips/bcm63xx/Makefile
 +++ b/arch/mips/bcm63xx/Makefile
-@@ -3,7 +3,7 @@ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
- 		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
- 		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
-		   usb-common.o
-+		   usb-common.o sprom.o
+@@ -2,7 +2,8 @@
+ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
+ 		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
+-		   dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o
+		   dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o \
+		   sprom.o
 obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
 
 obj-y		+= boards/
--- a/target/linux/brcm63xx/patches-4.14/357-MIPS-BCM63XX-use-platform-data-for-the-sprom.patch
+++ b/target/linux/brcm63xx/patches-4.14/357-MIPS-BCM63XX-use-platform-data-for-the-sprom.patch
@@ -75,15 +75,15 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 #endif
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -8,6 +8,7 @@
+@@ -7,6 +7,7 @@
+ #include <linux/leds.h>
 #include <bcm63xx_dev_enet.h>
 #include <bcm63xx_dev_usb_usbd.h>
- #include <bcm63xx_dev_dsp.h>
 +#include <bcm63xx_fallback_sprom.h>
 
 /*
  * flash mapping
-@@ -55,6 +56,9 @@ struct board_info {
+@@ -50,6 +51,9 @@ struct board_info {
 
 	/* External PHY reset GPIO flags from gpio.h */
 	unsigned long ephy_reset_gpio_flags;
--- a/target/linux/brcm63xx/patches-4.14/358-MIPS-BCM63XX-make-fallback-sprom-optional.patch
+++ b/target/linux/brcm63xx/patches-4.14/358-MIPS-BCM63XX-make-fallback-sprom-optional.patch
@@ -42,7 +42,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 	.enet0 = {
 		.has_phy		= 1,
-@@ -324,6 +327,7 @@ static struct board_info __initdata boar
+@@ -316,6 +319,7 @@ static struct board_info __initdata boar
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
@@ -50,7 +50,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 	.enet0 = {
 		.has_phy		= 1,
-@@ -378,6 +382,7 @@ static struct board_info __initdata boar
+@@ -370,6 +374,7 @@ static struct board_info __initdata boar
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
@@ -58,7 +58,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 	.enet0 = {
 		.has_phy		= 1,
-@@ -436,6 +441,7 @@ static struct board_info __initdata boar
+@@ -420,6 +425,7 @@ static struct board_info __initdata boar
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
@@ -66,7 +66,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 	.enet0 = {
 		.has_phy		= 1,
-@@ -459,6 +465,7 @@ static struct board_info __initdata boar
+@@ -443,6 +449,7 @@ static struct board_info __initdata boar
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
@@ -74,7 +74,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 	.enet0 = {
 		.has_phy		= 1,
-@@ -477,6 +484,7 @@ static struct board_info __initdata boar
+@@ -461,6 +468,7 @@ static struct board_info __initdata boar
 
 	.has_uart0			= 1,
 	.has_pci			= 1,
@@ -82,7 +82,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 	.has_ohci0			= 1,
 
 	.has_enet0			= 1,
-@@ -499,6 +507,7 @@ static struct board_info __initdata boar
+@@ -483,6 +491,7 @@ static struct board_info __initdata boar
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
@@ -90,7 +90,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 	.enet0 = {
 		.has_phy		= 1,
-@@ -525,6 +534,7 @@ static struct board_info __initdata boar
+@@ -509,6 +518,7 @@ static struct board_info __initdata boar
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
@@ -98,7 +98,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 	.enet0 = {
 		.has_phy		= 1,
-@@ -577,6 +587,7 @@ static struct board_info __initdata boar
+@@ -561,6 +571,7 @@ static struct board_info __initdata boar
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
@@ -106,7 +106,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 	.enet0 = {
 		.has_phy		= 1,
-@@ -648,6 +659,7 @@ static struct board_info __initdata boar
+@@ -632,6 +643,7 @@ static struct board_info __initdata boar
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
@@ -130,8 +130,8 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 	bcm63xx_spi_register();
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -35,6 +35,7 @@ struct board_info {
- 	unsigned int	has_dsp:1;
+@@ -33,6 +33,7 @@ struct board_info {
+ 	unsigned int	has_usbd:1;
 	unsigned int	has_uart0:1;
 	unsigned int	has_uart1:1;
 +	unsigned int	use_fallback_sprom:1;
--- a/target/linux/brcm63xx/patches-4.14/368-MIPS-BCM63XX-add-support-for-matching-the-board_info.patch
+++ b/target/linux/brcm63xx/patches-4.14/368-MIPS-BCM63XX-add-support-for-matching-the-board_info.patch
@@ -16,7 +16,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>

 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -711,6 +711,10 @@ static const struct board_info __initcon
+@@ -695,6 +695,10 @@ static const struct board_info __initcon
 #endif
 };
 
@@ -27,7 +27,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 /*
  * early init callback, read nvram data from flash and checksum it
  */
-@@ -722,6 +726,7 @@ void __init board_bcm963xx_init(void)
+@@ -706,6 +710,7 @@ void __init board_bcm963xx_init(void)
 	char *board_name = NULL;
 	u32 val;
 	struct bcm_hcs *hcs;
@@ -35,7 +35,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 	/* read base address of boot chip select (0)
 	 * 6328/6362 do not have MPI but boot from a fixed address
-@@ -761,6 +766,16 @@ void __init board_bcm963xx_init(void)
+@@ -745,6 +750,16 @@ void __init board_bcm963xx_init(void)
 	} else {
 		board_name = bcm63xx_nvram_get_name();
 	}
--- a/target/linux/brcm63xx/patches-4.14/369-MIPS-BCM63XX-populate-the-compatible-to-board_info-l.patch
+++ b/target/linux/brcm63xx/patches-4.14/369-MIPS-BCM63XX-populate-the-compatible-to-board_info-l.patch
@@ -14,7 +14,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>

 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -712,6 +712,48 @@ static const struct board_info __initcon
+@@ -696,6 +696,48 @@ static const struct board_info __initcon
 };
 
 static struct of_device_id const bcm963xx_boards_dt[] = {
--- a/target/linux/brcm63xx/patches-4.14/377-MIPS-BCM63XX-register-lookup-for-ephy-reset-gpio.patch
+++ b/target/linux/brcm63xx/patches-4.14/377-MIPS-BCM63XX-register-lookup-for-ephy-reset-gpio.patch
@@ -116,7 +116,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 #include <linux/leds.h>
 #include <bcm63xx_dev_enet.h>
 #include <bcm63xx_dev_usb_usbd.h>
-@@ -55,8 +56,8 @@ struct board_info {
+@@ -50,8 +51,8 @@ struct board_info {
 	/* External PHY reset GPIO */
 	unsigned int ephy_reset_gpio;
 
--- a/target/linux/brcm63xx/patches-4.14/390-MIPS-BCM63XX-do-not-register-SPI-controllers.patch
+++ b/target/linux/brcm63xx/patches-4.14/390-MIPS-BCM63XX-do-not-register-SPI-controllers.patch
@@ -35,15 +35,18 @@ Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
 	bcm63xx_led_data.num_leds = ARRAY_SIZE(board.leds);
 --- a/arch/mips/bcm63xx/Makefile
 +++ b/arch/mips/bcm63xx/Makefile
-@@ -1,7 +1,7 @@
+@@ -1,9 +1,8 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
-		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
-+		   dev-pcmcia.o dev-rng.o dev-uart.o \
- 		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
- 		   usb-common.o sprom.o
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
+-		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
+-		   dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o \
+-		   sprom.o
+		   dev-rng.o dev-uart.o dev-wdt.o dev-usb-ehci.o \
+		   dev-usb-ohci.o dev-usb-usbd.o usb-common.o sprom.o
 obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
+ 
+ obj-y		+= boards/
 --- a/arch/mips/bcm63xx/dev-hsspi.c
 +++ /dev/null
@@ -1,48 +0,0 @@
--- a/target/linux/brcm63xx/patches-4.14/391-MIPS-BCM63XX-do-not-register-uart.patch
+++ b/target/linux/brcm63xx/patches-4.14/391-MIPS-BCM63XX-do-not-register-uart.patch
@@ -3,12 +3,12 @@
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
-		   dev-pcmcia.o dev-rng.o dev-uart.o \
-+		   dev-pcmcia.o dev-rng.o \
- 		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
- 		   usb-common.o sprom.o
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
+-		   dev-rng.o dev-uart.o dev-wdt.o dev-usb-ehci.o \
+		   dev-rng.o dev-wdt.o dev-usb-ehci.o \
+ 		   dev-usb-ohci.o dev-usb-usbd.o usb-common.o sprom.o
 obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
+ 
 --- a/arch/mips/bcm63xx/dev-uart.c
 +++ /dev/null
@@ -1,76 +0,0 @@
@@ -98,17 +98,6 @@
 -int bcm63xx_uart_register(unsigned int id);
 -
 -#endif /* BCM63XX_DEV_UART_H_ */
--- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-+++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -34,8 +34,6 @@ struct board_info {
- 	unsigned int	has_ehci0:1;
- 	unsigned int	has_usbd:1;
- 	unsigned int	has_dsp:1;
-	unsigned int	has_uart0:1;
-	unsigned int	has_uart1:1;
- 	unsigned int	use_fallback_sprom:1;
- 
- 	/* ethernet config */
 --- a/arch/mips/bcm63xx/boards/board_common.c
 +++ b/arch/mips/bcm63xx/boards/board_common.c
@@ -20,7 +20,6 @@
@@ -193,7 +182,7 @@
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
-@@ -323,7 +313,6 @@ static struct board_info __initdata boar
+@@ -315,7 +305,6 @@ static struct board_info __initdata boar
 	.name				= "96348GW-11",
 	.expected_cpu_id		= 0x6348,
 
@@ -201,7 +190,7 @@
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
-@@ -378,7 +367,6 @@ static struct board_info __initdata boar
+@@ -370,7 +359,6 @@ static struct board_info __initdata boar
 	.name				= "96348GW",
 	.expected_cpu_id		= 0x6348,
 
@@ -209,7 +198,7 @@
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
-@@ -437,7 +425,6 @@ static struct board_info __initdata boar
+@@ -421,7 +409,6 @@ static struct board_info __initdata boar
 	.name				= "F@ST2404",
 	.expected_cpu_id		= 0x6348,
 
@@ -217,7 +206,7 @@
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
-@@ -482,7 +469,6 @@ static struct board_info __initdata boar
+@@ -466,7 +453,6 @@ static struct board_info __initdata boar
 	.name				= "DV201AMR",
 	.expected_cpu_id		= 0x6348,
 
@@ -225,7 +214,7 @@
 	.has_pci			= 1,
 	.use_fallback_sprom		= 1,
 	.has_ohci0			= 1,
-@@ -503,7 +489,6 @@ static struct board_info __initdata boar
+@@ -487,7 +473,6 @@ static struct board_info __initdata boar
 	.name				= "96348GW-A",
 	.expected_cpu_id		= 0x6348,
 
@@ -233,7 +222,7 @@
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
-@@ -530,7 +515,6 @@ static struct board_info __initdata boar
+@@ -514,7 +499,6 @@ static struct board_info __initdata boar
 	.name				= "96358VW",
 	.expected_cpu_id		= 0x6358,
 
@@ -241,7 +230,7 @@
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
-@@ -583,7 +567,6 @@ static struct board_info __initdata boar
+@@ -567,7 +551,6 @@ static struct board_info __initdata boar
 	.name				= "96358VW2",
 	.expected_cpu_id		= 0x6358,
 
@@ -249,7 +238,7 @@
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
-@@ -633,7 +616,6 @@ static struct board_info __initdata boar
+@@ -617,7 +600,6 @@ static struct board_info __initdata boar
 	.name				= "AGPF-S0",
 	.expected_cpu_id		= 0x6358,
 
@@ -257,3 +246,14 @@
 	.has_enet0			= 1,
 	.has_enet1			= 1,
 	.has_pci			= 1,
+--- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+@@ -32,8 +32,6 @@ struct board_info {
+ 	unsigned int	has_ohci0:1;
+ 	unsigned int	has_ehci0:1;
+ 	unsigned int	has_usbd:1;
+-	unsigned int	has_uart0:1;
+-	unsigned int	has_uart1:1;
+ 	unsigned int	use_fallback_sprom:1;
+ 
+ 	/* ethernet config */
--- a/target/linux/brcm63xx/patches-4.14/392-MIPS-BCM63XX-remove-leds-and-buttons.patch
+++ b/target/linux/brcm63xx/patches-4.14/392-MIPS-BCM63XX-remove-leds-and-buttons.patch
@@ -169,11 +169,10 @@ Subject: [PATCH] MIPS: BCM63XX: remove leds and buttons
 };
 
 static struct board_info __initdata board_96348gw_10 = {
-@@ -278,35 +153,6 @@ static struct board_info __initdata boar
- 		.cs			= 2,
- 		.ext_irq		= 2,
- 	},
-
+@@ -271,34 +146,6 @@ static struct board_info __initdata boar
+ 	.has_pccard			= 1,
+ 	.has_ehci0			= 1,
+ 
 -	.leds = {
 -		{
 -			.name		= "adsl-fail",
@@ -205,7 +204,7 @@ Subject: [PATCH] MIPS: BCM63XX: remove leds and buttons
 };
 
 static struct board_info __initdata board_96348gw_11 = {
-@@ -332,35 +178,6 @@ static struct board_info __initdata boar
+@@ -324,35 +171,6 @@ static struct board_info __initdata boar
 	.has_ohci0 = 1,
 	.has_pccard = 1,
 	.has_ehci0 = 1,
@@ -241,11 +240,10 @@ Subject: [PATCH] MIPS: BCM63XX: remove leds and buttons
 };
 
 static struct board_info __initdata board_96348gw = {
-@@ -390,35 +207,6 @@ static struct board_info __initdata boar
- 		.ext_irq		= 2,
- 		.cs			= 2,
- 	},
-
+@@ -375,34 +193,6 @@ static struct board_info __initdata boar
+ 
+ 	.has_ohci0 = 1,
+ 
 -	.leds = {
 -		{
 -			.name		= "adsl-fail",
@@ -277,7 +275,7 @@ Subject: [PATCH] MIPS: BCM63XX: remove leds and buttons
 };
 
 static struct board_info __initdata board_FAST2404 = {
-@@ -534,33 +322,6 @@ static struct board_info __initdata boar
+@@ -518,33 +308,6 @@ static struct board_info __initdata boar
 	.has_ohci0 = 1,
 	.has_pccard = 1,
 	.has_ehci0 = 1,
@@ -311,7 +309,7 @@ Subject: [PATCH] MIPS: BCM63XX: remove leds and buttons
 };
 
 static struct board_info __initdata board_96358vw2 = {
-@@ -587,29 +348,6 @@ static struct board_info __initdata boar
+@@ -571,29 +334,6 @@ static struct board_info __initdata boar
 	.has_pccard = 1,
 	.has_ehci0 = 1,
 	.num_usbh_ports			= 2,
--- a/target/linux/brcm63xx/patches-4.14/413-BCM63XX-allow-providing-fixup-data-in-board-data.patch
+++ b/target/linux/brcm63xx/patches-4.14/413-BCM63XX-allow-providing-fixup-data-in-board-data.patch
@@ -39,15 +39,15 @@ Subject: [PATCH 58/72] BCM63XX: allow providing fixup data in board data
 
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -10,6 +10,7 @@
+@@ -9,6 +9,7 @@
+ #include <bcm63xx_dev_enet.h>
 #include <bcm63xx_dev_usb_usbd.h>
- #include <bcm63xx_dev_dsp.h>
 #include <bcm63xx_fallback_sprom.h>
 +#include <pci_ath9k_fixup.h>
 
 /*
  * flash mapping
-@@ -17,6 +18,11 @@
+@@ -16,6 +17,11 @@
 #define BCM963XX_CFE_VERSION_OFFSET	0x570
 #define BCM963XX_NVRAM_OFFSET		0x580
 
@@ -59,9 +59,9 @@ Subject: [PATCH 58/72] BCM63XX: allow providing fixup data in board data
 /*
  * board definition
  */
-@@ -35,6 +41,10 @@ struct board_info {
+@@ -33,6 +39,10 @@ struct board_info {
+ 	unsigned int	has_ehci0:1;
 	unsigned int	has_usbd:1;
- 	unsigned int	has_dsp:1;
 	unsigned int	use_fallback_sprom:1;
 +	unsigned int	has_caldata:2;
 +
--- a/target/linux/brcm63xx/patches-4.14/416-BCM63XX-add-a-fixup-for-ath9k-devices.patch
+++ b/target/linux/brcm63xx/patches-4.14/416-BCM63XX-add-a-fixup-for-ath9k-devices.patch
@@ -13,12 +13,14 @@ Subject: [PATCH 61/72] BCM63XX: add a fixup for ath9k devices

 --- a/arch/mips/bcm63xx/Makefile
 +++ b/arch/mips/bcm63xx/Makefile
-@@ -3,7 +3,7 @@ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
- 		   dev-pcmcia.o dev-rng.o \
- 		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
-		   usb-common.o sprom.o
-+		   pci-ath9k-fixup.o usb-common.o sprom.o
+@@ -1,8 +1,8 @@
+ # SPDX-License-Identifier: GPL-2.0
+ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
+-		   dev-rng.o dev-wdt.o dev-usb-ehci.o \
+-		   dev-usb-ohci.o dev-usb-usbd.o usb-common.o sprom.o
+		   dev-rng.o dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o \
+		   dev-usb-usbd.o pci-ath9k-fixup.o usb-common.o sprom.o
 obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
 
 obj-y		+= boards/
--- a/target/linux/brcm63xx/patches-4.14/420-BCM63XX-add-endian-check-for-ath9k.patch
+++ b/target/linux/brcm63xx/patches-4.14/420-BCM63XX-add-endian-check-for-ath9k.patch
@@ -11,7 +11,7 @@
 #endif /* _PCI_ATH9K_FIXUP */
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -21,6 +21,7 @@
+@@ -20,6 +20,7 @@
 struct ath9k_caldata {
 	unsigned int	slot;
 	u32		caldata_offset;
--- a/target/linux/brcm63xx/patches-4.14/421-BCM63XX-add-led-pin-for-ath9k.patch
+++ b/target/linux/brcm63xx/patches-4.14/421-BCM63XX-add-led-pin-for-ath9k.patch
@@ -30,7 +30,7 @@
 		return;
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -22,6 +22,8 @@ struct ath9k_caldata {
+@@ -21,6 +21,8 @@ struct ath9k_caldata {
 	unsigned int	slot;
 	u32		caldata_offset;
 	unsigned int	endian_check:1;
--- a/target/linux/brcm63xx/patches-4.14/422-BCM63XX-add-a-fixup-for-rt2x00-devices.patch
+++ b/target/linux/brcm63xx/patches-4.14/422-BCM63XX-add-a-fixup-for-rt2x00-devices.patch
@@ -17,12 +17,13 @@ Subject: [PATCH 72/72] 446-BCM63XX-add-a-fixup-for-rt2x00-devices

 --- a/arch/mips/bcm63xx/Makefile
 +++ b/arch/mips/bcm63xx/Makefile
-@@ -3,7 +3,7 @@ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
- 		   dev-pcmcia.o dev-rng.o \
- 		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
-		   pci-ath9k-fixup.o usb-common.o sprom.o
-+		   pci-ath9k-fixup.o pci-rt2x00-fixup.o usb-common.o sprom.o
+@@ -2,7 +2,8 @@
+ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
+ 		   dev-rng.o dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o \
+-		   dev-usb-usbd.o pci-ath9k-fixup.o usb-common.o sprom.o
+		   dev-usb-usbd.o pci-ath9k-fixup.o pci-rt2x00-fixup.o \
+		   usb-common.o sprom.o
 obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
 
 obj-y		+= boards/
@@ -136,15 +137,15 @@ Subject: [PATCH 72/72] 446-BCM63XX-add-a-fixup-for-rt2x00-devices
 +
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -11,6 +11,7 @@
- #include <bcm63xx_dev_dsp.h>
+@@ -10,6 +10,7 @@
+ #include <bcm63xx_dev_usb_usbd.h>
 #include <bcm63xx_fallback_sprom.h>
 #include <pci_ath9k_fixup.h>
 +#include <pci_rt2x00_fixup.h>
 
 /*
  * flash mapping
-@@ -18,12 +19,16 @@
+@@ -17,12 +18,16 @@
 #define BCM963XX_CFE_VERSION_OFFSET	0x570
 #define BCM963XX_NVRAM_OFFSET		0x580
 
@@ -162,7 +163,7 @@ Subject: [PATCH 72/72] 446-BCM63XX-add-a-fixup-for-rt2x00-devices
 };
 
 /*
-@@ -47,7 +52,7 @@ struct board_info {
+@@ -45,7 +50,7 @@ struct board_info {
 	unsigned int	has_caldata:2;
 
 	/* wifi calibration data config */
--- a/target/linux/brcm63xx/patches-4.14/427-boards_probe_switch.patch
+++ b/target/linux/brcm63xx/patches-4.14/427-boards_probe_switch.patch
@@ -27,7 +27,7 @@
 		.force_speed_100	= 1,
 		.force_duplex_full	= 1,
 	},
-@@ -170,6 +176,8 @@ static struct board_info __initdata boar
+@@ -163,6 +169,8 @@ static struct board_info __initdata boar
 	},
 
 	.enet1 = {
@@ -36,7 +36,7 @@
 		.force_speed_100	= 1,
 		.force_duplex_full	= 1,
 	},
-@@ -194,6 +202,8 @@ static struct board_info __initdata boar
+@@ -187,6 +195,8 @@ static struct board_info __initdata boar
 		.use_internal_phy	= 1,
 	},
 	.enet1 = {
@@ -45,7 +45,7 @@
 		.force_speed_100	= 1,
 		.force_duplex_full	= 1,
 	},
-@@ -224,6 +234,8 @@ static struct board_info __initdata boar
+@@ -210,6 +220,8 @@ static struct board_info __initdata boar
 	},
 
 	.enet1 = {
@@ -54,7 +54,7 @@
 		.force_speed_100	= 1,
 		.force_duplex_full	= 1,
 	},
-@@ -247,6 +259,8 @@ static struct board_info __initdata boar
+@@ -233,6 +245,8 @@ static struct board_info __initdata boar
 		.use_internal_phy	= 1,
 	},
 	.enet1 = {
@@ -63,7 +63,7 @@
 		.force_speed_100	= 1,
 		.force_duplex_full	= 1,
 	},
-@@ -268,6 +282,8 @@ static struct board_info __initdata boar
+@@ -254,6 +268,8 @@ static struct board_info __initdata boar
 		.use_internal_phy	= 1,
 	},
 	.enet1 = {
@@ -72,7 +72,7 @@
 		.force_speed_100	= 1,
 		.force_duplex_full	= 1,
 	},
-@@ -287,6 +303,8 @@ static struct board_info __initdata boar
+@@ -273,6 +289,8 @@ static struct board_info __initdata boar
 		.use_internal_phy	= 1,
 	},
 	.enet1 = {
@@ -81,7 +81,7 @@
 		.force_speed_100	= 1,
 		.force_duplex_full	= 1,
 	},
-@@ -314,6 +332,8 @@ static struct board_info __initdata boar
+@@ -300,6 +318,8 @@ static struct board_info __initdata boar
 	},
 
 	.enet1 = {
@@ -90,7 +90,7 @@
 		.force_speed_100	= 1,
 		.force_duplex_full	= 1,
 	},
-@@ -339,6 +359,8 @@ static struct board_info __initdata boar
+@@ -325,6 +345,8 @@ static struct board_info __initdata boar
 	},
 
 	.enet1 = {
@@ -99,7 +99,7 @@
 		.force_speed_100	= 1,
 		.force_duplex_full	= 1,
 	},
-@@ -364,6 +386,8 @@ static struct board_info __initdata boar
+@@ -350,6 +372,8 @@ static struct board_info __initdata boar
 	},
 
 	.enet1 = {
@@ -108,7 +108,7 @@
 		.force_speed_100	= 1,
 		.force_duplex_full	= 1,
 	},
-@@ -387,6 +411,8 @@ static struct board_info __initdata boar
+@@ -373,6 +397,8 @@ static struct board_info __initdata boar
 	},
 
 	.enet1 = {
--- a/target/linux/brcm63xx/patches-4.14/499-allow_better_context_for_board_patches.patch
+++ b/target/linux/brcm63xx/patches-4.14/499-allow_better_context_for_board_patches.patch
@@ -36,7 +36,7 @@
 
 /*
  * known 6348 boards
-@@ -311,7 +311,7 @@ static struct board_info __initdata boar
+@@ -297,7 +297,7 @@ static struct board_info __initdata boar
 
 	.has_ohci0 = 1,
 };
@@ -45,7 +45,7 @@
 
 /*
  * known 6358 boards
-@@ -419,7 +419,7 @@ static struct board_info __initdata boar
+@@ -405,7 +405,7 @@ static struct board_info __initdata boar
 
 	.has_ohci0			= 1,
 };
--- a/target/linux/brcm63xx/patches-4.14/500-board-D4PW.patch
+++ b/target/linux/brcm63xx/patches-4.14/500-board-D4PW.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -311,6 +311,21 @@ static struct board_info __initdata boar
+@@ -297,6 +297,21 @@ static struct board_info __initdata boar
 
 	.has_ohci0 = 1,
 };
@@ -22,7 +22,7 @@
 #endif /* CONFIG_BCM63XX_CPU_6348 */
 
 /*
-@@ -447,6 +462,7 @@ static const struct board_info __initcon
+@@ -433,6 +448,7 @@ static const struct board_info __initcon
 	&board_DV201AMR,
 	&board_96348gw_a,
 	&board_rta1025w_16,
@@ -30,7 +30,7 @@
 #endif
 
 #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -478,6 +494,7 @@ static struct of_device_id const bcm963x
+@@ -464,6 +480,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "brcm,bcm96348gw-10", .data = &board_96348gw_10, },
 	{ .compatible = "brcm,bcm96348gw-11", .data = &board_96348gw_11, },
 	{ .compatible = "brcm,bcm96348gw-a", .data = &board_96348gw_a, },
--- a/target/linux/brcm63xx/patches-4.14/501-board-NB4.patch
+++ b/target/linux/brcm63xx/patches-4.14/501-board-NB4.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -434,6 +434,60 @@ static struct board_info __initdata boar
+@@ -420,6 +420,60 @@ static struct board_info __initdata boar
 
 	.has_ohci0			= 1,
 };
@@ -61,7 +61,7 @@
 #endif /* CONFIG_BCM63XX_CPU_6358 */
 
 /*
-@@ -470,6 +524,8 @@ static const struct board_info __initcon
+@@ -456,6 +510,8 @@ static const struct board_info __initcon
 	&board_96358vw2,
 	&board_AGPFS0,
 	&board_DWVS0,
@@ -70,7 +70,7 @@
 #endif
 };
 
-@@ -511,6 +567,8 @@ static struct of_device_id const bcm963x
+@@ -497,6 +553,8 @@ static struct of_device_id const bcm963x
 	{ .compatible = "pirelli,a226m", .data = &board_DWVS0, },
 	{ .compatible = "pirelli,a226m-fwb", .data = &board_DWVS0, },
 	{ .compatible = "pirelli,agpf-s0", .data = &board_AGPFS0, },
--- a/target/linux/brcm63xx/patches-4.14/502-board-96338W2_E7T.patch
+++ b/target/linux/brcm63xx/patches-4.14/502-board-96338W2_E7T.patch
@@ -21,7 +21,7 @@
 #endif /* CONFIG_BCM63XX_CPU_6338 */
 
 /*
-@@ -503,6 +517,7 @@ static const struct board_info __initcon
+@@ -489,6 +503,7 @@ static const struct board_info __initcon
 #ifdef CONFIG_BCM63XX_CPU_6338
 	&board_96338gw,
 	&board_96338w,
@@ -29,7 +29,7 @@
 #endif
 #ifdef CONFIG_BCM63XX_CPU_6345
 	&board_96345gw2,
-@@ -540,6 +555,7 @@ static struct of_device_id const bcm963x
+@@ -526,6 +541,7 @@ static struct of_device_id const bcm963x
 #ifdef CONFIG_BCM63XX_CPU_6338
 	{ .compatible = "brcm,bcm96338gw", .data = &board_96338gw, },
 	{ .compatible = "brcm,bcm96338w", .data = &board_96338w, },
--- a/target/linux/brcm63xx/patches-4.14/503-board-CPVA642.patch
+++ b/target/linux/brcm63xx/patches-4.14/503-board-CPVA642.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -401,6 +401,25 @@ static struct board_info __initdata boar
+@@ -387,6 +387,25 @@ static struct board_info __initdata boar
 	.num_usbh_ports			= 2,
 };
 
@@ -26,7 +26,7 @@
 static struct board_info __initdata board_AGPFS0 = {
 	.name				= "AGPF-S0",
 	.expected_cpu_id		= 0x6358,
-@@ -538,6 +557,7 @@ static const struct board_info __initcon
+@@ -524,6 +543,7 @@ static const struct board_info __initcon
 	&board_96358vw,
 	&board_96358vw2,
 	&board_AGPFS0,
@@ -34,7 +34,7 @@
 	&board_DWVS0,
 	&board_nb4_ser_r0,
 	&board_nb4_fxc_r1,
-@@ -585,6 +605,7 @@ static struct of_device_id const bcm963x
+@@ -571,6 +591,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "pirelli,agpf-s0", .data = &board_AGPFS0, },
 	{ .compatible = "sfr,nb4-ser-r0", .data = &board_nb4_ser_r0, },
 	{ .compatible = "sfr,nb4-fxc-r1", .data = &board_nb4_fxc_r1, },
--- a/target/linux/brcm63xx/patches-4.14/504-board_dsl_274xb_rev_c.patch
+++ b/target/linux/brcm63xx/patches-4.14/504-board_dsl_274xb_rev_c.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -468,6 +468,22 @@ static struct board_info __initdata boar
+@@ -454,6 +454,22 @@ static struct board_info __initdata boar
 	.has_ohci0			= 1,
 };
 
@@ -23,7 +23,7 @@
 static struct board_info __initdata board_nb4_ser_r0 = {
 	.name				= "NB4-SER-r0",
 	.expected_cpu_id		= 0x6358,
-@@ -559,6 +575,7 @@ static const struct board_info __initcon
+@@ -545,6 +561,7 @@ static const struct board_info __initcon
 	&board_AGPFS0,
 	&board_CPVA642,
 	&board_DWVS0,
@@ -31,7 +31,7 @@
 	&board_nb4_ser_r0,
 	&board_nb4_fxc_r1,
 #endif
-@@ -598,6 +615,7 @@ static struct of_device_id const bcm963x
+@@ -584,6 +601,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "alcatel,rg100a", .data = &board_96358vw2, },
 	{ .compatible = "brcm,bcm96358vw", .data = &board_96358vw, },
 	{ .compatible = "brcm,bcm96358vw2", .data = &board_96358vw2, },
--- a/target/linux/brcm63xx/patches-4.14/505-board_spw500v.patch
+++ b/target/linux/brcm63xx/patches-4.14/505-board_spw500v.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -340,6 +340,44 @@ static struct board_info __initdata boar
+@@ -326,6 +326,44 @@ static struct board_info __initdata boar
 		.force_duplex_full	= 1,
 	},
 };
@@ -45,7 +45,7 @@
 #endif /* CONFIG_BCM63XX_CPU_6348 */
 
 /*
-@@ -567,6 +605,7 @@ static const struct board_info __initcon
+@@ -553,6 +591,7 @@ static const struct board_info __initcon
 	&board_96348gw_a,
 	&board_rta1025w_16,
 	&board_96348_D4PW,
@@ -53,7 +53,7 @@
 #endif
 
 #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -608,6 +647,7 @@ static struct of_device_id const bcm963x
+@@ -594,6 +633,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "dynalink,rta1025w", .data = &board_rta1025w_16, },
 	{ .compatible = "netgear,dg834gtpn", .data = &board_96348gw_10, },
 	{ .compatible = "sagem,f@st2404", .data = &board_FAST2404, },
--- a/target/linux/brcm63xx/patches-4.14/506-board_gw6200_gw6000.patch
+++ b/target/linux/brcm63xx/patches-4.14/506-board_gw6200_gw6000.patch
@@ -1,7 +1,7 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -233,6 +233,64 @@ static struct board_info __initdata boar
- 	},
+@@ -219,6 +219,64 @@ static struct board_info __initdata boar
+ 
 };
 
 +static struct board_info __initdata board_gw6200 = {
@@ -65,7 +65,7 @@
 static struct board_info __initdata board_FAST2404 = {
 	.name				= "F@ST2404",
 	.expected_cpu_id		= 0x6348,
-@@ -598,6 +656,8 @@ static const struct board_info __initcon
+@@ -584,6 +642,8 @@ static const struct board_info __initcon
 #ifdef CONFIG_BCM63XX_CPU_6348
 	&board_96348r,
 	&board_96348gw,
@@ -74,7 +74,7 @@
 	&board_96348gw_10,
 	&board_96348gw_11,
 	&board_FAST2404,
-@@ -648,6 +708,8 @@ static struct of_device_id const bcm963x
+@@ -634,6 +694,8 @@ static struct of_device_id const bcm963x
 	{ .compatible = "netgear,dg834gtpn", .data = &board_96348gw_10, },
 	{ .compatible = "sagem,f@st2404", .data = &board_FAST2404, },
 	{ .compatible = "t-com,spw500v", .data = &board_spw500v, },
--- a/target/linux/brcm63xx/patches-4.14/507-board-MAGIC.patch
+++ b/target/linux/brcm63xx/patches-4.14/507-board-MAGIC.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -436,6 +436,39 @@ static struct board_info __initdata boar
+@@ -422,6 +422,39 @@ static struct board_info __initdata boar
 		.num_board_fixups	= ARRAY_SIZE(spw500v_fixups),
 	},
 };
@@ -40,7 +40,7 @@
 #endif /* CONFIG_BCM63XX_CPU_6348 */
 
 /*
-@@ -666,6 +699,7 @@ static const struct board_info __initcon
+@@ -652,6 +685,7 @@ static const struct board_info __initcon
 	&board_rta1025w_16,
 	&board_96348_D4PW,
 	&board_spw500v,
@@ -48,7 +48,7 @@
 #endif
 
 #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -710,6 +744,7 @@ static struct of_device_id const bcm963x
+@@ -696,6 +730,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "t-com,spw500v", .data = &board_spw500v, },
 	{ .compatible = "tecom,gw6000", .data = &board_gw6000, },
 	{ .compatible = "tecom,gw6200", .data = &board_gw6200, },
--- a/target/linux/brcm63xx/patches-4.14/508-board_hw553.patch
+++ b/target/linux/brcm63xx/patches-4.14/508-board_hw553.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -666,6 +666,32 @@ static struct board_info __initdata boar
+@@ -652,6 +652,32 @@ static struct board_info __initdata boar
 	.has_ehci0 = 1,
 	.num_usbh_ports			= 2,
 };
@@ -33,7 +33,7 @@
 #endif /* CONFIG_BCM63XX_CPU_6358 */
 
 /*
-@@ -711,6 +737,7 @@ static const struct board_info __initcon
+@@ -697,6 +723,7 @@ static const struct board_info __initcon
 	&board_dsl_274xb_rev_c,
 	&board_nb4_ser_r0,
 	&board_nb4_fxc_r1,
@@ -41,7 +41,7 @@
 #endif
 };
 
-@@ -754,6 +781,7 @@ static struct of_device_id const bcm963x
+@@ -740,6 +767,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "brcm,bcm96358vw2", .data = &board_96358vw2, },
 	{ .compatible = "d-link,dsl-274xb-c2", .data = &board_dsl_274xb_rev_c, },
 	{ .compatible = "d-link,dsl-2650u", .data = &board_96358vw2, },
--- a/target/linux/brcm63xx/patches-4.14/509-board_rta1320_16m.patch
+++ b/target/linux/brcm63xx/patches-4.14/509-board_rta1320_16m.patch
@@ -21,7 +21,7 @@
 #endif /* CONFIG_BCM63XX_CPU_6338 */
 
 /*
-@@ -708,6 +722,7 @@ static const struct board_info __initcon
+@@ -694,6 +708,7 @@ static const struct board_info __initcon
 	&board_96338gw,
 	&board_96338w,
 	&board_96338w2_e7t,
@@ -29,7 +29,7 @@
 #endif
 #ifdef CONFIG_BCM63XX_CPU_6345
 	&board_96345gw2,
-@@ -752,6 +767,7 @@ static struct of_device_id const bcm963x
+@@ -738,6 +753,7 @@ static struct of_device_id const bcm963x
 #ifdef CONFIG_BCM63XX_CPU_6338
 	{ .compatible = "brcm,bcm96338gw", .data = &board_96338gw, },
 	{ .compatible = "brcm,bcm96338w", .data = &board_96338w, },
--- a/target/linux/brcm63xx/patches-4.14/510-board_spw303v.patch
+++ b/target/linux/brcm63xx/patches-4.14/510-board_spw303v.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -706,6 +706,20 @@ static struct board_info __initdata boar
+@@ -692,6 +692,20 @@ static struct board_info __initdata boar
 		.pci_dev			= 1,
 	},
 };
@@ -21,7 +21,7 @@
 #endif /* CONFIG_BCM63XX_CPU_6358 */
 
 /*
-@@ -753,6 +767,7 @@ static const struct board_info __initcon
+@@ -739,6 +753,7 @@ static const struct board_info __initcon
 	&board_nb4_ser_r0,
 	&board_nb4_fxc_r1,
 	&board_HW553,
@@ -29,7 +29,7 @@
 #endif
 };
 
-@@ -804,6 +819,7 @@ static struct of_device_id const bcm963x
+@@ -790,6 +805,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "pirelli,agpf-s0", .data = &board_AGPFS0, },
 	{ .compatible = "sfr,nb4-ser-r0", .data = &board_nb4_ser_r0, },
 	{ .compatible = "sfr,nb4-fxc-r1", .data = &board_nb4_fxc_r1, },
--- a/target/linux/brcm63xx/patches-4.14/511-board_V2500V.patch
+++ b/target/linux/brcm63xx/patches-4.14/511-board_V2500V.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -483,6 +483,26 @@ static struct board_info __initdata boar
+@@ -469,6 +469,26 @@ static struct board_info __initdata boar
 		.ext_irq		= 2,
 	},
 };
@@ -27,7 +27,7 @@
 #endif /* CONFIG_BCM63XX_CPU_6348 */
 
 /*
-@@ -755,6 +775,7 @@ static const struct board_info __initcon
+@@ -741,6 +761,7 @@ static const struct board_info __initcon
 	&board_96348_D4PW,
 	&board_spw500v,
 	&board_96348sv,
@@ -35,7 +35,7 @@
 #endif
 
 #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -794,6 +815,7 @@ static struct of_device_id const bcm963x
+@@ -780,6 +801,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "brcm,bcm96348gw-10", .data = &board_96348gw_10, },
 	{ .compatible = "brcm,bcm96348gw-11", .data = &board_96348gw_11, },
 	{ .compatible = "brcm,bcm96348gw-a", .data = &board_96348gw_a, },
@@ -43,7 +43,7 @@
 	{ .compatible = "d-link,dsl-2640b-b", .data = &board_96348_D4PW, },
 	{ .compatible = "davolink,dv-201amr", .data = &board_DV201AMR, },
 	{ .compatible = "dynalink,rta1025w", .data = &board_rta1025w_16, },
-@@ -853,6 +875,22 @@ void __init board_bcm963xx_init(void)
+@@ -839,6 +861,22 @@ void __init board_bcm963xx_init(void)
 		val &= MPI_CSBASE_BASE_MASK;
 	}
 	boot_addr = (u8 *)KSEG1ADDR(val);
--- a/target/linux/brcm63xx/patches-4.14/512-board_BTV2110.patch
+++ b/target/linux/brcm63xx/patches-4.14/512-board_BTV2110.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -216,6 +216,24 @@ static struct board_info __initdata boar
+@@ -209,6 +209,24 @@ static struct board_info __initdata boar
 	.has_ehci0 = 1,
 };
 
@@ -25,7 +25,7 @@
 static struct board_info __initdata board_96348gw = {
 	.name				= "96348GW",
 	.expected_cpu_id		= 0x6348,
-@@ -776,6 +794,7 @@ static const struct board_info __initcon
+@@ -762,6 +780,7 @@ static const struct board_info __initcon
 	&board_spw500v,
 	&board_96348sv,
 	&board_V2500V_BB,
@@ -33,7 +33,7 @@
 #endif
 
 #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -815,6 +834,7 @@ static struct of_device_id const bcm963x
+@@ -801,6 +820,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "brcm,bcm96348gw-10", .data = &board_96348gw_10, },
 	{ .compatible = "brcm,bcm96348gw-11", .data = &board_96348gw_11, },
 	{ .compatible = "brcm,bcm96348gw-a", .data = &board_96348gw_a, },
--- a/target/linux/brcm63xx/patches-4.14/514-board_ct536_ct5621.patch
+++ b/target/linux/brcm63xx/patches-4.14/514-board_ct536_ct5621.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -234,6 +234,33 @@ static struct board_info __initdata boar
+@@ -227,6 +227,33 @@ static struct board_info __initdata boar
 };
 
 
@@ -34,7 +34,7 @@
 static struct board_info __initdata board_96348gw = {
 	.name				= "96348GW",
 	.expected_cpu_id		= 0x6348,
-@@ -795,6 +822,7 @@ static const struct board_info __initcon
+@@ -781,6 +808,7 @@ static const struct board_info __initcon
 	&board_96348sv,
 	&board_V2500V_BB,
 	&board_V2110,
@@ -42,7 +42,7 @@
 #endif
 
 #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -836,6 +864,8 @@ static struct of_device_id const bcm963x
+@@ -822,6 +850,8 @@ static struct of_device_id const bcm963x
 	{ .compatible = "brcm,bcm96348gw-a", .data = &board_96348gw_a, },
 	{ .compatible = "bt,v2110", .data = &board_V2110, },
 	{ .compatible = "bt,v2500v-bb", .data = &board_V2500V_BB, },
--- a/target/linux/brcm63xx/patches-4.14/515-board_DWV-S0_fixes.patch
+++ b/target/linux/brcm63xx/patches-4.14/515-board_DWV-S0_fixes.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -674,6 +674,7 @@ static struct board_info __initdata boar
+@@ -660,6 +660,7 @@ static struct board_info __initdata boar
 	},
 
 	.has_ohci0			= 1,
--- a/target/linux/brcm63xx/patches-4.14/516-board_96348A-122.patch
+++ b/target/linux/brcm63xx/patches-4.14/516-board_96348A-122.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -261,6 +261,30 @@ static struct board_info __initdata boar
+@@ -254,6 +254,30 @@ static struct board_info __initdata boar
 	},
 };
 
@@ -31,7 +31,7 @@
 static struct board_info __initdata board_96348gw = {
 	.name				= "96348GW",
 	.expected_cpu_id		= 0x6348,
-@@ -824,6 +848,7 @@ static const struct board_info __initcon
+@@ -810,6 +834,7 @@ static const struct board_info __initcon
 	&board_V2500V_BB,
 	&board_V2110,
 	&board_ct536_ct5621,
@@ -39,7 +39,7 @@
 #endif
 
 #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -866,6 +891,7 @@ static struct of_device_id const bcm963x
+@@ -852,6 +877,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "bt,v2110", .data = &board_V2110, },
 	{ .compatible = "bt,v2500v-bb", .data = &board_V2500V_BB, },
 	{ .compatible = "comtrend,ct-536+", .data = &board_ct536_ct5621, },
--- a/target/linux/brcm63xx/patches-4.14/519_board_CPVA502plus.patch
+++ b/target/linux/brcm63xx/patches-4.14/519_board_CPVA502plus.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -233,6 +233,33 @@ static struct board_info __initdata boar
+@@ -226,6 +226,33 @@ static struct board_info __initdata boar
 	},
 };
 
@@ -34,7 +34,7 @@
 
 static struct board_info __initdata board_ct536_ct5621 = {
 	.name				= "CT536_CT5621",
-@@ -849,6 +876,7 @@ static const struct board_info __initcon
+@@ -835,6 +862,7 @@ static const struct board_info __initcon
 	&board_V2110,
 	&board_ct536_ct5621,
 	&board_96348A_122,
@@ -42,7 +42,7 @@
 #endif
 
 #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -901,6 +929,7 @@ static struct of_device_id const bcm963x
+@@ -887,6 +915,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "t-com,spw500v", .data = &board_spw500v, },
 	{ .compatible = "tecom,gw6000", .data = &board_gw6000, },
 	{ .compatible = "tecom,gw6200", .data = &board_gw6200, },
--- a/target/linux/brcm63xx/patches-4.14/520-bcm63xx-add-support-for-96368MVWG-board.patch
+++ b/target/linux/brcm63xx/patches-4.14/520-bcm63xx-add-support-for-96368MVWG-board.patch
@@ -10,7 +10,7 @@ Subject: [PATCH 32/63] bcm63xx: add support for 96368MVWG board.

 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -840,6 +840,58 @@ static struct board_info __initdata boar
+@@ -826,6 +826,58 @@ static struct board_info __initdata boar
 #endif /* CONFIG_BCM63XX_CPU_6358 */
 
 /*
@@ -69,7 +69,7 @@ Subject: [PATCH 32/63] bcm63xx: add support for 96368MVWG board.
  * all boards
  */
 static const struct board_info __initconst *bcm963xx_boards[] = {
-@@ -891,6 +943,10 @@ static const struct board_info __initcon
+@@ -877,6 +929,10 @@ static const struct board_info __initcon
 	&board_HW553,
 	&board_spw303v,
 #endif
@@ -80,7 +80,7 @@ Subject: [PATCH 32/63] bcm63xx: add support for 96368MVWG board.
 };
 
 static struct of_device_id const bcm963xx_boards_dt[] = {
-@@ -951,6 +1007,7 @@ static struct of_device_id const bcm963x
+@@ -937,6 +993,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "telsey,cpva642", .data = &board_CPVA642, },
 #endif
 #ifdef CONFIG_BCM63XX_CPU_6368
--- a/target/linux/brcm63xx/patches-4.14/521-bcm63xx-add-support-for-96368MVNgr-board.patch
+++ b/target/linux/brcm63xx/patches-4.14/521-bcm63xx-add-support-for-96368MVNgr-board.patch
@@ -9,7 +9,7 @@ Subject: [PATCH 33/63] bcm63xx: add support for 96368MVNgr board.

 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -889,6 +889,45 @@ static struct board_info __initdata boar
+@@ -875,6 +875,45 @@ static struct board_info __initdata boar
 	.has_ohci0 = 1,
 	.has_ehci0 = 1,
 };
@@ -55,7 +55,7 @@ Subject: [PATCH 33/63] bcm63xx: add support for 96368MVNgr board.
 #endif /* CONFIG_BCM63XX_CPU_6368 */
 
 /*
-@@ -946,6 +985,7 @@ static const struct board_info __initcon
+@@ -932,6 +971,7 @@ static const struct board_info __initcon
 
 #ifdef CONFIG_BCM63XX_CPU_6368
 	&board_96368mvwg,
@@ -63,7 +63,7 @@ Subject: [PATCH 33/63] bcm63xx: add support for 96368MVNgr board.
 #endif
 };
 
-@@ -1007,6 +1047,7 @@ static struct of_device_id const bcm963x
+@@ -993,6 +1033,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "telsey,cpva642", .data = &board_CPVA642, },
 #endif
 #ifdef CONFIG_BCM63XX_CPU_6368
--- a/target/linux/brcm63xx/patches-4.14/523-MIPS-BCM63XX-add-963281TAN-reference-board.patch
+++ b/target/linux/brcm63xx/patches-4.14/523-MIPS-BCM63XX-add-963281TAN-reference-board.patch
@@ -50,7 +50,7 @@ Subject: [PATCH] MIPS: BCM63XX: add 963281TAN reference board
 #endif /* CONFIG_BCM63XX_CPU_6328 */
 
 /*
-@@ -966,6 +1000,7 @@ static const struct board_info __initcon
+@@ -952,6 +986,7 @@ static const struct board_info __initcon
 #endif
 #ifdef CONFIG_BCM63XX_CPU_6328
 	&board_96328avng,
@@ -58,7 +58,7 @@ Subject: [PATCH] MIPS: BCM63XX: add 963281TAN reference board
 #endif
 #ifdef CONFIG_BCM63XX_CPU_6338
 	&board_96338gw,
-@@ -1022,6 +1057,7 @@ static struct of_device_id const bcm963x
+@@ -1008,6 +1043,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "netgear,cvg834g", .data = &board_cvg834g, },
 #endif
 #ifdef CONFIG_BCM63XX_CPU_6328
--- a/target/linux/brcm63xx/patches-4.14/524-board_dsl_274xb_rev_f.patch
+++ b/target/linux/brcm63xx/patches-4.14/524-board_dsl_274xb_rev_f.patch
@@ -62,7 +62,7 @@ Subject: [PATCH 70/79] MIPS: BCM63XX: Add board definition for D-Link
 #endif /* CONFIG_BCM63XX_CPU_6328 */
 
 /*
-@@ -1001,6 +1046,7 @@ static const struct board_info __initcon
+@@ -987,6 +1032,7 @@ static const struct board_info __initcon
 #ifdef CONFIG_BCM63XX_CPU_6328
 	&board_96328avng,
 	&board_963281TAN,
@@ -70,7 +70,7 @@ Subject: [PATCH 70/79] MIPS: BCM63XX: Add board definition for D-Link
 #endif
 #ifdef CONFIG_BCM63XX_CPU_6338
 	&board_96338gw,
-@@ -1059,6 +1105,7 @@ static struct of_device_id const bcm963x
+@@ -1045,6 +1091,7 @@ static struct of_device_id const bcm963x
 #ifdef CONFIG_BCM63XX_CPU_6328
 	{ .compatible = "brcm,bcm963281TAN", .data = &board_963281TAN, },
 	{ .compatible = "brcm,bcm96328avng", .data = &board_96328avng, },
--- a/target/linux/brcm63xx/patches-4.14/525-board_96348w3.patch
+++ b/target/linux/brcm63xx/patches-4.14/525-board_96348w3.patch
@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -600,6 +600,24 @@ static struct board_info __initdata boar
+@@ -586,6 +586,24 @@ static struct board_info __initdata boar
 	.has_ohci0 = 1,
 };
 
@@ -25,7 +25,7 @@
 static struct board_info __initdata board_96348_D4PW = {
 	.name				= "D-4P-W",
 	.expected_cpu_id		= 0x6348,
-@@ -1076,6 +1094,7 @@ static const struct board_info __initcon
+@@ -1062,6 +1080,7 @@ static const struct board_info __initcon
 	&board_ct536_ct5621,
 	&board_96348A_122,
 	&board_CPVA502plus,
@@ -33,7 +33,7 @@
 #endif
 
 #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -1131,6 +1150,7 @@ static struct of_device_id const bcm963x
+@@ -1117,6 +1136,7 @@ static struct of_device_id const bcm963x
 	{ .compatible = "davolink,dv-201amr", .data = &board_DV201AMR, },
 	{ .compatible = "dynalink,rta1025w", .data = &board_rta1025w_16, },
 	{ .compatible = "netgear,dg834gtpn", .data = &board_96348gw_10, },
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jo-Philipp Wich	c3bd1321de	OpenWrt v18.06.8: adjust config defaults Signed-off-by: Jo-Philipp Wich <jo@mein.io>	2020-02-27 22:32:54 +01:00
Jo-Philipp Wich	82fbd85747	libubox: backport blobmsg_check_array() fix Fixes: FS#2833 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit `955634b473`)	2020-02-27 22:25:59 +01:00
Petr Štetiar	4c1779ac2c	ppp: backport security fixes 8d45443bb5c9 pppd: Ignore received EAP messages when not doing EAP 8d7970b8f3db pppd: Fix bounds check in EAP code 858976b1fc31 radius: Prevent buffer overflow in rc_mksid() Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit `215598fd03`) Fixes: CVE-2020-8597 Signed-off-by: Jo-Philipp Wich <jo@mein.io>	2020-02-26 16:42:06 +01:00
Jo-Philipp Wich	cd262f59cb	Revert "ppp: backport security fixes" This reverts commit `cc78f934a9` since it didn't contain a reference to the CVE it addresses. The next commit will re-add the commit including a CVE reference in its commit message. Signed-off-by: Jo-Philipp Wich <jo@mein.io>	2020-02-26 16:41:48 +01:00
Jo-Philipp Wich	ed3c3048b8	uhttpd: update to latest Git HEAD 2ee323c file: poke ustream after starting deferred program Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit `04069fde19`)	2020-02-26 16:23:05 +01:00
Koen Vandeputte	fafe99b62d	kernel: bump 4.14 to 4.14.171 Refreshed all patches. Fixes: - CVE-2013-1798 Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-02-24 14:21:08 +01:00
Koen Vandeputte	bfee12cec6	kernel: bump 4.9 to 4.9.214 Refreshed all patches. Fixes: - CVE-2013-1798 Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-02-24 14:21:08 +01:00
Petr Štetiar	cc78f934a9	ppp: backport security fixes 8d45443bb5c9 pppd: Ignore received EAP messages when not doing EAP 8d7970b8f3db pppd: Fix bounds check in EAP code 858976b1fc31 radius: Prevent buffer overflow in rc_mksid() Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit `215598fd03`)	2020-02-20 09:39:31 +01:00
Jo-Philipp Wich	05062462f1	hostapd: remove erroneous $(space) redefinition The $(space) definition in the hostapd Makefile ceased to work with GNU Make 4.3 and later, leading to syntax errors in the generated Kconfig files. Drop the superfluous redefinition and reuse the working $(space) declaration from rules.mk to fix this issue. Fixes: GH#2713 Ref: https://github.com/openwrt/openwrt/pull/2713#issuecomment-583722469 Reported-by: Karel Kočí <cynerd@email.cz> Suggested-by: Jonas Gorski <jonas.gorski@gmail.com> Tested-by: Shaleen Jain <shaleen@jain.sh> Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit `766e778226`)	2020-02-08 11:54:23 +01:00
Koen Vandeputte	6b10354b3c	kernel: add support for GD25D05 SPI NOR This chip is used on newer RB912UAG-5HPnD r2 boards: Before: [ 0.642553] m25p80 spi0.0: unrecognized JEDEC id bytes: c8, 40, 10 [ 0.649381] NAND flash driver for the RouterBOARD 91x series After: [ 0.641714] m25p80 spi0.0: found gd25d05, expected m25p80 [ 0.649916] m25p80 spi0.0: gd25d05 (64 Kbytes) [ 0.655122] Creating 4 MTD partitions on "spi0.0": [ 0.660164] 0x000000000000-0x00000000c000 : "routerboot" [ 0.667782] 0x00000000c000-0x00000000d000 : "hard_config" [ 0.675073] 0x00000000d000-0x00000000e000 : "bios" [ 0.682613] 0x00000000e000-0x00000000f000 : "soft_config" [ 0.690304] NAND flash driver for the RouterBOARD 91x series Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-02-04 18:12:19 +01:00
Koen Vandeputte	4eba86820f	kernel: bump 4.14 to 4.14.169 Refreshed all patches. Fixes: - CVE-2019-14896 - CVE-2019-14897 Remove upstreamed: - 023-0007-crypto-crypto4xx-Fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch Altered patches: - 102-MIPS-BCM63XX-move-code-touching-the-USB-private-regi.patch - 105-MIPS-BCM63XX-add-support-for-the-on-chip-OHCI-contro.patch - 106-MIPS-BCM63XX-register-OHCI-controller-if-board-enabl.patch - 108-MIPS-BCM63XX-add-support-for-the-on-chip-EHCI-contro.patch - 207-MIPS-BCM63XX-move-device-registration-code-into-its-.patch - 350-MIPS-BCM63XX-support-settings-num-usbh-ports.patch - 356-MIPS-BCM63XX-move-fallback-sprom-support-into-its-ow.patch - 390-MIPS-BCM63XX-do-not-register-SPI-controllers.patch - 391-MIPS-BCM63XX-do-not-register-uart.patch - 392-MIPS-BCM63XX-remove-leds-and-buttons.patch - 416-BCM63XX-add-a-fixup-for-ath9k-devices.patch - 422-BCM63XX-add-a-fixup-for-rt2x00-devices.patch - Compile-tested on: brcm63xx, cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-02-04 18:12:19 +01:00
Koen Vandeputte	c236071859	kernel: bump 4.9 to 4.9.212 Refreshed all patches. Fixes: - CVE-2019-14896 - CVE-2019-14897 Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-02-04 18:12:19 +01:00
Jo-Philipp Wich	6bfde67581	OpenWrt v18.06.7: revert to branch defaults Signed-off-by: Jo-Philipp Wich <jo@mein.io>	2020-01-29 17:13:25 +01:00
Jo-Philipp Wich	1b5c116233	OpenWrt v18.06.7: adjust config defaults Signed-off-by: Jo-Philipp Wich <jo@mein.io>	2020-01-29 17:13:21 +01:00
Jo-Philipp Wich	ca47026b7d	opkg: update to latest Git HEAD 80d161e opkg: Fix -Wformat-overflow warning c09fe20 libopkg: fix skipping of leading whitespace when parsing checksums Fixes: CVE-2020-7982 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit `c69c20c667`)	2020-01-29 17:06:05 +01:00
Hauke Mehrtens	cc0a54e332	libubox: backport security patches This backports some security relevant patches from libubox master. These patches should not change the existing API and ABI so that old applications still work like before without any recompilation. Application can now also use more secure APIs. The new more secure interfaces are also available, but not used. OpenWrt master and 19.07 already have these patches by using a more recent libubox version. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>	2020-01-27 21:44:28 +01:00
Martin Schiller	ebafb746f0	lantiq: ltq-ptm: vr9: fix skb handling in ptm_hard_start_xmit() Call skb_orphan(skb) to call the owner's destructor function and make the skb unowned. This is necessary to prevent sk_wmem_alloc of a socket from overflowing, which leads to ENOBUFS errors on application level. Signed-off-by: Martin Schiller <ms@dev.tdt.de> (cherry picked from commit `996f02e5ba`)	2020-01-26 22:12:54 +01:00
Josef Schlehofer	0591348b3d	tools/expat: Update to version 2.2.9 Fixes two CVEs: - CVE-2019-15903 (Fix heap overflow triggered by XML_GetCurrentLineNumber) - CVE-2018-20843 (Fix extraction of namespace prefixes from XML names) Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> (cherry picked from commit `b4af2c689f`)	2020-01-26 22:12:50 +01:00
Magnus Kroken	f51d1c3b7c	mbedtls: update to 2.16.4 Fixes side channel vulnerabilities in mbed TLS' implementation of ECDSA. Release announcement: https://tls.mbed.org/tech-updates/releases/mbedtls-2.16.4-and-2.7.13-released Security advisory: https://tls.mbed.org/tech-updates/security-advisories/mbedtls-security-advisory-2019-12 Fixes: * CVE-2019-18222: Side channel attack on ECDSA Signed-off-by: Magnus Kroken <mkroken@gmail.com> (cherry picked from commit `6e96fd9047`)	2020-01-26 20:25:47 +01:00
Koen Vandeputte	153a044c95	kernel: bump 4.14 to 4.14.167 Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-01-24 13:18:01 +01:00
Koen Vandeputte	c15a039e62	kernel: bump 4.9 to 4.9.211 Refreshed all patches. Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-01-24 13:18:01 +01:00
Stephan Knauss	02f9582e89	kirkwood: fix HDD LED labels for Zyxel NSA325 in 01_leds Change the LED labels for hdd1/hdd2 in 01_leds to match their counterpart in DTS. Signed-off-by: Stephan Knauss <openwrt@stephans-server.de> [improve commit title and message] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit `fbf297be38`)	2020-01-21 14:06:24 +01:00
Walter Sonius	04474c7d22	brcm47xx: fix switch port order for Netgear WN2500RP V1 The Netgear WN2500RP V1 switch0 already works for LAN however the port order for the LAN ports is inverted. Correct physical port order watched from the back of the device is: 4 / 3 / 2 / 1 WAN port is absent on this device and therefore removed from switch config. Signed-off-by: Walter Sonius <walterav1984@gmail.com> [move block to maintain alphabetic sorting] Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de> (cherry picked from commit `098cbc68ee`)	2020-01-21 14:04:55 +01:00
Walter Sonius	99ab40c842	brcm47xx: fix switch port order for Netgear WNR3500 V2 The Netgear WNR3500 V2 switch0 already works for WAN/LAN however the port order for the LAN ports is inverted. Correct physical port order watched from the back of the device is: Internet / 4 / 3 / 2 / 1 this resembles the Linksys E3000 V1. Verfied with imagebuilder edit FILES=/etc/board.d/01_network Signed-off-by: Walter Sonius <walterav1984@gmail.com> (cherry picked from commit `cf2f1fc687`)	2020-01-21 14:03:56 +01:00
DENG Qingfang	3a3ca3230f	ramips: fix HiWiFi HC5962 switch configuration HC5962 has only 3 LAN ports, switch port 0 is unused Signed-off-by: DENG Qingfang <dengqf6@mail2.sysu.edu.cn> (backported from commit `68f49df315`) Signed-off-by: Adrian Schmutzler <freifunk@adrianschmutzler.de>	2020-01-21 13:59:44 +01:00
Koen Vandeputte	5c7225c26b	kernel: bump 4.14 to 4.14.166 Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-01-20 13:44:38 +01:00
Koen Vandeputte	8441794f9a	kernel: bump 4.14 to 4.14.165 Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-01-20 13:44:38 +01:00
Koen Vandeputte	a634830004	kernel: bump 4.9 to 4.9.210 Refreshed all patches. Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-01-20 13:44:38 +01:00
Koen Vandeputte	7c42a9b6b1	kernel: bump 4.14 to 4.14.164 Refreshed all patches. Compile-tested on: cns3xxx Runtime-tested on: cns3xxx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-01-20 13:44:38 +01:00
Koen Vandeputte	891bba8f77	kernel: bump 4.9 to 4.9.209 Refreshed all patches. Compile-tested on: ar71xx Runtime-tested on: ar71xx Signed-off-by: Koen Vandeputte <koen.vandeputte@ncentric.com>	2020-01-20 13:44:38 +01:00
Matthias Schiffer	ab9d1bf608	ethtool: fix PKG_CONFIG_DEPENDS Add missing CONFIG_ prefix. Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net> (cherry picked from commit `41c19dd542`)	2020-01-07 21:42:48 +01:00
Hauke Mehrtens	46c2674225	OpenWrt v18.06.6: revert to branch defaults Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>	2020-01-06 21:50:26 +01:00