OpenWrt v18.06.8: adjust config defaults

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

feeds.conf.default

@@ -1,4 +1,4 @@
-src-git packages https://git.openwrt.org/feed/packages.git^b0df5d33652220a384593d7b52a8453b022b8f9b
+src-git packages https://git.openwrt.org/feed/packages.git^c05ea69d6d4f503c9bf69fd3d5e551e21c434084
-src-git luci https://git.openwrt.org/project/luci.git^868abc1a564ca8366bbb018a967923cbdc5ee27a
+src-git luci https://git.openwrt.org/project/luci.git^41e2258d6dc1ebe8d3874ae6d6b13db49cff2c5c
-src-git routing https://git.openwrt.org/feed/routing.git^9fa2b249cc286176f07efe343fd9518b383462fc
+src-git routing https://git.openwrt.org/feed/routing.git^0e63ef9276bf41c0d4176127f9f047343b8ffe32
 src-git telephony https://git.openwrt.org/feed/telephony.git^8ecbdabc7c5cadbe571eb947f5cd333a5a785010

include/kernel-version.mk

@@ -2,11 +2,11 @@
 
 LINUX_RELEASE?=1
 
-LINUX_VERSION-4.9 = .208
+LINUX_VERSION-4.9 = .214
-LINUX_VERSION-4.14 = .162
+LINUX_VERSION-4.14 = .171
 
-LINUX_KERNEL_HASH-4.9.208 = b7ad1c9841d671d026c55a4c91c77205f8b488ca5f980f838591c68662e0525a
+LINUX_KERNEL_HASH-4.9.214 = b47f093dac7034c7c4722e80042c05e4ef53c14a4f28aa992117a127d2b1e483
-LINUX_KERNEL_HASH-4.14.162 = f65170224cd4359ce8b2793b492bd8127abdd0b91350484e001bce13f0c98b4b
+LINUX_KERNEL_HASH-4.14.171 = 4fe02489e4b4a187eccf0ef87df6100534c9d485e76d876b1fa247c7635332a0
 
 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
 sanitize_uri=$(call qstrip,$(subst @,_,$(subst :,_,$(subst .,_,$(subst -,_,$(subst /,_,$(1)))))))

include/version.mk

@@ -26,13 +26,13 @@ PKG_CONFIG_DEPENDS += \
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))
 
 VERSION_NUMBER:=$(call qstrip,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),18.06.6)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),18.06.8)
 
 VERSION_CODE:=$(call qstrip,$(CONFIG_VERSION_CODE))
-VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r7957-d81a8a3e29)
+VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r7989-82fbd85747)
 
 VERSION_REPO:=$(call qstrip,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.openwrt.org/releases/18.06.6)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),http://downloads.openwrt.org/releases/18.06.8)
 
 VERSION_DIST:=$(call qstrip,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),OpenWrt)

package/base-files/image-config.in

@@ -183,7 +183,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "http://downloads.openwrt.org/releases/18.06.6"
+		default "http://downloads.openwrt.org/releases/18.06.8"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:

package/kernel/lantiq/ltq-ptm/Makefile

@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ltq-ptm
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/ltq-ptm-$(BUILD_VARIANT)
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>

package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c

@@ -334,6 +334,9 @@ static int ptm_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         dma_cache_wback((unsigned long)skb->data, skb->len);
     }
 
+    /* make the skb unowned */
+    skb_orphan(skb);
+
     *(struct sk_buff **)((unsigned int)skb->data - byteoff - sizeof(struct sk_buff *)) = skb;
     /*  write back to physical memory   */
     dma_cache_wback((unsigned long)skb->data - byteoff - sizeof(struct sk_buff *), skb->len + byteoff + sizeof(struct sk_buff *));

package/libs/libubox/Makefile

@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libubox
-PKG_RELEASE=2
+PKG_RELEASE=4
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/libubox.git

package/libs/libubox/patches/0001-blobmsg_json-fix-possible-uninitialized-struct-membe.patch

@@ -0,0 +1,39 @@
+From 2acfe84e4c871fb994c38c9f2508eb9ebd296b74 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Tue, 19 Nov 2019 17:34:25 +0100
+Subject: blobmsg_json: fix possible uninitialized struct member
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+clang-10 analyzer reports following:
+
+ blobmsg_json.c:285:2: warning: The expression is an uninitialized value. The computed value will also be garbage
+         s->indent_level++;
+         ^~~~~~~~~~~~~~~~~
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg_json.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/blobmsg_json.c
++++ b/blobmsg_json.c
+@@ -316,7 +316,7 @@ static void setup_strbuf(struct strbuf *
+ 
+ char *blobmsg_format_json_with_cb(struct blob_attr *attr, bool list, blobmsg_json_format_t cb, void *priv, int indent)
+ {
+-	struct strbuf s;
++	struct strbuf s = {0};
+ 	bool array;
+ 	char *ret;
+ 
+@@ -350,7 +350,7 @@ char *blobmsg_format_json_with_cb(struct
+ 
+ char *blobmsg_format_json_value_with_cb(struct blob_attr *attr, blobmsg_json_format_t cb, void *priv, int indent)
+ {
+-	struct strbuf s;
++	struct strbuf s = {0};
+ 	char *ret;
+ 
+ 	setup_strbuf(&s, attr, cb, priv, indent);

package/libs/libubox/patches/0002-jshn-fix-off-by-one-in-jshn_parse_file.patch

@@ -0,0 +1,39 @@
+From f27853d71a2cb99ec5de3881716a14611ada307c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Sat, 23 Nov 2019 22:48:25 +0100
+Subject: jshn: fix off by one in jshn_parse_file
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes following error:
+
+ Invalid read of size 1
+   at 0x4C32D04: strlen
+   by 0x5043367: json_tokener_parse_ex
+   by 0x5045316: json_tokener_parse_verbose
+   by 0x504537D: json_tokener_parse
+   by 0x401AB1: jshn_parse (jshn.c:179)
+   by 0x40190D: jshn_parse_file (jshn.c:370)
+   by 0x40190D: main (jshn.c:434)
+ Address 0x5848c4c is 0 bytes after a block of size 1,036 alloc'd
+   at 0x4C2FB0F: malloc
+   by 0x4018E2: jshn_parse_file (jshn.c:357)
+   by 0x4018E2: main (jshn.c:434)
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ jshn.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/jshn.c
++++ b/jshn.c
+@@ -384,7 +384,7 @@ int main(int argc, char **argv)
+ 				close(fd);
+ 				return 3;
+ 			}
+-			if (!(fbuf = malloc(sb.st_size))) {
++			if (!(fbuf = calloc(1, sb.st_size+1))) {
+ 				fprintf(stderr, "Error allocating memory for %s\n", optarg);
+ 				close(fd);
+ 				return 3;

package/libs/libubox/patches/0003-blob-refactor-attr-parsing-into-separate-function.patch

@@ -0,0 +1,97 @@
+From af2a074160e32692b570f8a3562b4370d38f34e7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Mon, 9 Dec 2019 13:53:27 +0100
+Subject: blob: refactor attr parsing into separate function
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Making blob_parse easier to review.
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blob.c | 61 +++++++++++++++++++++++++++++++++-------------------------
+ 1 file changed, 35 insertions(+), 26 deletions(-)
+
+--- a/blob.c
++++ b/blob.c
+@@ -217,44 +217,53 @@ blob_check_type(const void *ptr, unsigne
+ 	return true;
+ }
+ 
+-int
+-blob_parse(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max)
++static int
++blob_parse_attr(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max)
+ {
+-	struct blob_attr *pos;
+ 	int found = 0;
+-	int rem;
++	int id = blob_id(attr);
++	size_t len = blob_len(attr);
+ 
+-	memset(data, 0, sizeof(struct blob_attr *) * max);
+-	blob_for_each_attr(pos, attr, rem) {
+-		int id = blob_id(pos);
+-		int len = blob_len(pos);
++	if (id >= max)
++		return 0;
+ 
+-		if (id >= max)
+-			continue;
++	if (info) {
++		int type = info[id].type;
+ 
+-		if (info) {
+-			int type = info[id].type;
++		if (type < BLOB_ATTR_LAST) {
++			if (!blob_check_type(blob_data(attr), len, type))
++				return 0;
++		}
+ 
+-			if (type < BLOB_ATTR_LAST) {
+-				if (!blob_check_type(blob_data(pos), len, type))
+-					continue;
+-			}
++		if (info[id].minlen && len < info[id].minlen)
++			return 0;
+ 
+-			if (info[id].minlen && len < info[id].minlen)
+-				continue;
++		if (info[id].maxlen && len > info[id].maxlen)
++			return 0;
+ 
+-			if (info[id].maxlen && len > info[id].maxlen)
+-				continue;
++		if (info[id].validate && !info[id].validate(&info[id], attr))
++			return 0;
++	}
+ 
+-			if (info[id].validate && !info[id].validate(&info[id], pos))
+-				continue;
+-		}
++	if (!data[id])
++		found++;
+ 
+-		if (!data[id])
+-			found++;
++	data[id] = attr;
++	return found;
++}
+ 
+-		data[id] = pos;
++int
++blob_parse(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max)
++{
++	struct blob_attr *pos;
++	int found = 0;
++	size_t rem;
++
++	memset(data, 0, sizeof(struct blob_attr *) * max);
++	blob_for_each_attr(pos, attr, rem) {
++		found += blob_parse_attr(pos, data, info, max);
+ 	}
++
+ 	return found;
+ }
+ 

package/libs/libubox/patches/0004-blob-introduce-blob_parse_untrusted.patch

@@ -0,0 +1,78 @@
+From b6a0a070f2e14808e835c2fcfa3820a55041902f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Mon, 9 Dec 2019 14:11:45 +0100
+Subject: blob: introduce blob_parse_untrusted
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+blob_parse can be only used on trusted input as it has no possibility to
+check the length of the provided input buffer, which might lead to
+undefined behaviour and/or crashes when supplied with malformed,
+corrupted or otherwise specially crafted input.
+
+So this introduces blob_parse_untrusted variant which expects additional
+input buffer length argument and thus should be able to process also
+inputs from untrusted sources.
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blob.c | 24 ++++++++++++++++++++++++
+ blob.h |  7 +++++++
+ 2 files changed, 31 insertions(+)
+
+--- a/blob.c
++++ b/blob.c
+@@ -253,6 +253,30 @@ blob_parse_attr(struct blob_attr *attr,
+ }
+ 
+ int
++blob_parse_untrusted(struct blob_attr *attr, size_t attr_len, struct blob_attr **data, const struct blob_attr_info *info, int max)
++{
++	struct blob_attr *pos;
++	size_t len = 0;
++	int found = 0;
++	size_t rem;
++
++	if (!attr || attr_len < sizeof(struct blob_attr))
++		return 0;
++
++	len = blob_raw_len(attr);
++	if (len != attr_len)
++		return 0;
++
++	memset(data, 0, sizeof(struct blob_attr *) * max);
++	blob_for_each_attr_len(pos, attr, len, rem) {
++		found += blob_parse_attr(pos, rem, data, info, max);
++	}
++
++	return found;
++}
++
++/* use only on trusted input, otherwise consider blob_parse_untrusted */
++int
+ blob_parse(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max)
+ {
+ 	struct blob_attr *pos;
+--- a/blob.h
++++ b/blob.h
+@@ -199,6 +199,7 @@ extern void blob_nest_end(struct blob_bu
+ extern struct blob_attr *blob_put(struct blob_buf *buf, int id, const void *ptr, unsigned int len);
+ extern bool blob_check_type(const void *ptr, unsigned int len, int type);
+ extern int blob_parse(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max);
++extern int blob_parse_untrusted(struct blob_attr *attr, size_t attr_len, struct blob_attr **data, const struct blob_attr_info *info, int max);
+ extern struct blob_attr *blob_memdup(struct blob_attr *attr);
+ extern struct blob_attr *blob_put_raw(struct blob_buf *buf, const void *ptr, unsigned int len);
+ 
+@@ -254,5 +255,11 @@ blob_put_u64(struct blob_buf *buf, int i
+ 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+ 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
++#define blob_for_each_attr_len(pos, attr, attr_len, rem) \
++	for (rem = attr ? blob_len(attr) : 0, \
++	     pos = (struct blob_attr *) (attr ? blob_data(attr) : NULL); \
++	     rem >= sizeof(struct blob_attr) && rem < attr_len && (blob_pad_len(pos) <= rem) && \
++	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
++	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
+ #endif

package/libs/libubox/patches/0005-blob-fix-OOB-access-in-blob_check_type.patch

@@ -0,0 +1,78 @@
+From 7425d421340594f50c717ff7129b6ee71280a447 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Mon, 9 Dec 2019 15:27:16 +0100
+Subject: blob: fix OOB access in blob_check_type
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Found by fuzzer:
+
+ ERROR: AddressSanitizer: SEGV on unknown address 0x602100000455
+ The signal is caused by a READ memory access.
+     #0 in blob_check_type blob.c:214:43
+     #1 in blob_parse_attr blob.c:234:9
+     #2 in blob_parse_untrusted blob.c:272:12
+     #3 in fuzz_blob_parse tests/fuzzer/test-blob-parse-fuzzer.c:34:2
+     #4 in LLVMFuzzerTestOneInput tests/fuzzer/test-blob-parse-fuzzer.c:39:2
+
+Caused by following line:
+
+	if (type == BLOB_ATTR_STRING && data[len - 1] != 0)
+
+where len was pointing outside of the data buffer.
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blob.c | 23 ++++++++++++++++++-----
+ 1 file changed, 18 insertions(+), 5 deletions(-)
+
+--- a/blob.c
++++ b/blob.c
+@@ -218,20 +218,33 @@ blob_check_type(const void *ptr, unsigne
+ }
+ 
+ static int
+-blob_parse_attr(struct blob_attr *attr, struct blob_attr **data, const struct blob_attr_info *info, int max)
++blob_parse_attr(struct blob_attr *attr, size_t attr_len, struct blob_attr **data, const struct blob_attr_info *info, int max)
+ {
++	int id;
++	size_t len;
+ 	int found = 0;
+-	int id = blob_id(attr);
+-	size_t len = blob_len(attr);
++	size_t data_len;
+ 
++	if (!attr || attr_len < sizeof(struct blob_attr))
++		return 0;
++
++	id = blob_id(attr);
+ 	if (id >= max)
+ 		return 0;
+ 
++	len = blob_raw_len(attr);
++	if (len > attr_len || len < sizeof(struct blob_attr))
++		return 0;
++
++	data_len = blob_len(attr);
++	if (data_len > len)
++		return 0;
++
+ 	if (info) {
+ 		int type = info[id].type;
+ 
+ 		if (type < BLOB_ATTR_LAST) {
+-			if (!blob_check_type(blob_data(attr), len, type))
++			if (!blob_check_type(blob_data(attr), data_len, type))
+ 				return 0;
+ 		}
+ 
+@@ -285,7 +298,7 @@ blob_parse(struct blob_attr *attr, struc
+ 
+ 	memset(data, 0, sizeof(struct blob_attr *) * max);
+ 	blob_for_each_attr(pos, attr, rem) {
+-		found += blob_parse_attr(pos, data, info, max);
++		found += blob_parse_attr(pos, rem, data, info, max);
+ 	}
+ 
+ 	return found;

package/libs/libubox/patches/0006-blobmsg-fix-heap-buffer-overflow-in-blobmsg_parse.patch

@@ -0,0 +1,32 @@
+From 0773eef13674964d890420673d2501342979d8bf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Tue, 10 Dec 2019 12:02:40 +0100
+Subject: blobmsg: fix heap buffer overflow in blobmsg_parse
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes following error found by the fuzzer:
+
+ ==29774==ERROR: AddressSanitizer: heap-buffer-overflow
+ READ of size 1 at 0x6020004f1c56 thread T0
+     #0 strcmp sanitizer_common_interceptors.inc:442:3
+     #1 blobmsg_parse blobmsg.c:168:8
+
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/blobmsg.c
++++ b/blobmsg.c
+@@ -52,6 +52,9 @@ bool blobmsg_check_attr(const struct blo
+ 
+ 	id = blob_id(attr);
+ 	len = blobmsg_data_len(attr);
++	if (len > blob_raw_len(attr))
++		return false;
++
+ 	data = blobmsg_data(attr);
+ 
+ 	if (id > BLOBMSG_TYPE_LAST)

package/libs/libubox/patches/0007-Ensure-blob_attr-length-check-does-not-perform-out-o.patch

@@ -0,0 +1,51 @@
+From cec3ed2550073abbfe0f1f6131c44f90c9d05aa8 Mon Sep 17 00:00:00 2001
+From: Tobias Schramm <tobleminer@gmail.com>
+Date: Wed, 28 Nov 2018 13:39:29 +0100
+Subject: Ensure blob_attr length check does not perform out of bounds reads
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Before there might have been as little as one single byte left which
+would result in 3 bytes of blob_attr->id_len being out of bounds.
+
+Acked-by: Yousong Zhou <yszhou4tech@gmail.com>
+Signed-off-by: Tobias Schramm <tobleminer@gmail.com>
+[line wrapped < 72 chars]
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blob.h    | 4 ++--
+ blobmsg.h | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/blob.h
++++ b/blob.h
+@@ -243,7 +243,7 @@ blob_put_u64(struct blob_buf *buf, int i
+ 
+ #define __blob_for_each_attr(pos, attr, rem) \
+ 	for (pos = (struct blob_attr *) attr; \
+-	     rem > 0 && (blob_pad_len(pos) <= rem) && \
++	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
+ 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+ 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
+@@ -251,7 +251,7 @@ blob_put_u64(struct blob_buf *buf, int i
+ #define blob_for_each_attr(pos, attr, rem) \
+ 	for (rem = attr ? blob_len(attr) : 0, \
+ 	     pos = (struct blob_attr *) (attr ? blob_data(attr) : NULL); \
+-	     rem > 0 && (blob_pad_len(pos) <= rem) && \
++	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
+ 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+ 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
+--- a/blobmsg.h
++++ b/blobmsg.h
+@@ -266,7 +266,7 @@ int blobmsg_printf(struct blob_buf *buf,
+ #define blobmsg_for_each_attr(pos, attr, rem) \
+ 	for (rem = attr ? blobmsg_data_len(attr) : 0, \
+ 	     pos = (struct blob_attr *) (attr ? blobmsg_data(attr) : NULL); \
+-	     rem > 0 && (blob_pad_len(pos) <= rem) && \
++	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
+ 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+ 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 

package/libs/libubox/patches/0008-Replace-use-of-blobmsg_check_attr-by-blobmsg_check_a.patch

@@ -0,0 +1,132 @@
+From 8b6a401638317906b6d9039417c1c19ea8cfeab0 Mon Sep 17 00:00:00 2001
+From: Tobias Schramm <tobleminer@gmail.com>
+Date: Tue, 13 Nov 2018 04:16:12 +0100
+Subject: Replace use of blobmsg_check_attr by blobmsg_check_attr_len
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+blobmsg_check_attr_len adds a length limit specifying the max offset
+from attr that can be read safely.
+
+Signed-off-by: Tobias Schramm <tobleminer@gmail.com>
+[rebased and reworked, line wrapped commit message, _safe -> _len]
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 59 +++++++++++++++++++++++++++++++++++++++++++------------
+ blobmsg.h |  2 ++
+ 2 files changed, 48 insertions(+), 13 deletions(-)
+
+--- a/blobmsg.c
++++ b/blobmsg.c
+@@ -33,37 +33,70 @@ blobmsg_namelen(const struct blobmsg_hdr
+ 
+ bool blobmsg_check_attr(const struct blob_attr *attr, bool name)
+ {
++	return blobmsg_check_attr_len(attr, name, blob_raw_len(attr));
++}
++
++static bool blobmsg_check_name(const struct blob_attr *attr, size_t len, bool name)
++{
++	char *limit = (char *) attr + len;
+ 	const struct blobmsg_hdr *hdr;
+-	const char *data;
+-	int id, len;
+ 
+-	if (blob_len(attr) < sizeof(struct blobmsg_hdr))
++	hdr = blob_data(attr);
++	if (name && !hdr->namelen)
+ 		return false;
+ 
+-	hdr = (void *) attr->data;
+-	if (!hdr->namelen && name)
++	if ((char *) hdr->name + blobmsg_namelen(hdr) > limit)
+ 		return false;
+ 
+-	if (blobmsg_namelen(hdr) > blob_len(attr) - sizeof(struct blobmsg_hdr))
++	if (blobmsg_namelen(hdr) > (blob_len(attr) - sizeof(struct blobmsg_hdr)))
+ 		return false;
+ 
+ 	if (hdr->name[blobmsg_namelen(hdr)] != 0)
+ 		return false;
+ 
+-	id = blob_id(attr);
+-	len = blobmsg_data_len(attr);
+-	if (len > blob_raw_len(attr))
+-		return false;
++	return true;
++}
++
++static const char* blobmsg_check_data(const struct blob_attr *attr, size_t len, size_t *data_len)
++{
++	char *limit = (char *) attr + len;
++	const char *data;
++
++	*data_len = blobmsg_data_len(attr);
++	if (*data_len > blob_raw_len(attr))
++		return NULL;
+ 
+ 	data = blobmsg_data(attr);
++	if (data + *data_len > limit)
++		return NULL;
+ 
++	return data;
++}
++
++bool blobmsg_check_attr_len(const struct blob_attr *attr, bool name, size_t len)
++{
++	const char *data;
++	size_t data_len;
++	int id;
++
++	if (len < sizeof(struct blob_attr))
++		return false;
++
++	if (!blobmsg_check_name(attr, len, name))
++		return false;
++
++	id = blob_id(attr);
+ 	if (id > BLOBMSG_TYPE_LAST)
+ 		return false;
+ 
+ 	if (!blob_type[id])
+ 		return true;
+ 
+-	return blob_check_type(data, len, blob_type[id]);
++	data = blobmsg_check_data(attr, len, &data_len);
++	if (!data)
++		return false;
++
++	return blob_check_type(data, data_len, blob_type[id]);
+ }
+ 
+ int blobmsg_check_array(const struct blob_attr *attr, int type)
+@@ -114,7 +147,7 @@ int blobmsg_parse_array(const struct blo
+ 		    blob_id(attr) != policy[i].type)
+ 			continue;
+ 
+-		if (!blobmsg_check_attr(attr, false))
++		if (!blobmsg_check_attr_len(attr, false, len))
+ 			return -1;
+ 
+ 		if (tb[i])
+@@ -161,7 +194,7 @@ int blobmsg_parse(const struct blobmsg_p
+ 			if (blobmsg_namelen(hdr) != pslen[i])
+ 				continue;
+ 
+-			if (!blobmsg_check_attr(attr, true))
++			if (!blobmsg_check_attr_len(attr, true, len))
+ 				return -1;
+ 
+ 			if (tb[i])
+--- a/blobmsg.h
++++ b/blobmsg.h
+@@ -107,6 +107,8 @@ static inline int blobmsg_len(const stru
+ bool blobmsg_check_attr(const struct blob_attr *attr, bool name);
+ bool blobmsg_check_attr_list(const struct blob_attr *attr, int type);
+ 
++bool blobmsg_check_attr_len(const struct blob_attr *attr, bool name, size_t len);
++
+ /*
+  * blobmsg_check_array: validate array/table and return size
+  *

package/libs/libubox/patches/0009-blobmsg-add-_len-variants-for-all-attribute-checking.patch

@@ -0,0 +1,157 @@
+From ad29d0304983e283d4aec4ee5462942eaf5c03ac Mon Sep 17 00:00:00 2001
+From: Tobias Schramm <tobleminer@gmail.com>
+Date: Thu, 15 Nov 2018 03:42:48 +0100
+Subject: blobmsg: add _len variants for all attribute checking methods
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Introduce _len variants of blobmsg attribute checking functions which
+aims to provide safer implementation as those functions should limit all
+memory accesses performed on the blob to the range [attr, attr + len]
+(upper bound non inclusive) and thus should be suited for checking of
+untrusted blob attributes.
+
+While at it add some comments in order to make it clear.
+
+Signed-off-by: Tobias Schramm <tobleminer@gmail.com>
+[_safe -> _len, blobmsg_check_array_len fix, commit subject/desc facelift]
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 21 ++++++++++++++++++---
+ blobmsg.h | 55 ++++++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 72 insertions(+), 4 deletions(-)
+
+--- a/blobmsg.c
++++ b/blobmsg.c
+@@ -101,11 +101,21 @@ bool blobmsg_check_attr_len(const struct
+ 
+ int blobmsg_check_array(const struct blob_attr *attr, int type)
+ {
++	return blobmsg_check_array_len(attr, type, blob_raw_len(attr));
++}
++
++int blobmsg_check_array_len(const struct blob_attr *attr, int type, size_t len)
++{
+ 	struct blob_attr *cur;
+ 	bool name;
+-	int rem;
+ 	int size = 0;
+ 
++	if (type > BLOBMSG_TYPE_LAST)
++		return -1;
++
++	if (!blobmsg_check_attr_len(attr, false, len))
++		return -1;
++
+ 	switch (blobmsg_type(attr)) {
+ 	case BLOBMSG_TYPE_TABLE:
+ 		name = true;
+@@ -117,11 +127,11 @@ int blobmsg_check_array(const struct blo
+ 		return -1;
+ 	}
+ 
+-	blobmsg_for_each_attr(cur, attr, rem) {
++	__blobmsg_for_each_attr(cur, attr, len) {
+ 		if (type != BLOBMSG_TYPE_UNSPEC && blobmsg_type(cur) != type)
+ 			return -1;
+ 
+-		if (!blobmsg_check_attr(cur, name))
++		if (!blobmsg_check_attr_len(cur, name, len))
+ 			return -1;
+ 
+ 		size++;
+@@ -135,6 +145,11 @@ bool blobmsg_check_attr_list(const struc
+ 	return blobmsg_check_array(attr, type) >= 0;
+ }
+ 
++bool blobmsg_check_attr_list_len(const struct blob_attr *attr, int type, size_t len)
++{
++	return blobmsg_check_array_len(attr, type, len) >= 0;
++}
++
+ int blobmsg_parse_array(const struct blobmsg_policy *policy, int policy_len,
+ 			struct blob_attr **tb, void *data, unsigned int len)
+ {
+--- a/blobmsg.h
++++ b/blobmsg.h
+@@ -104,19 +104,66 @@ static inline int blobmsg_len(const stru
+ 	return blobmsg_data_len(attr);
+ }
+ 
++/*
++ * blobmsg_check_attr: validate a list of attributes
++ *
++ * This method may be used with trusted data only. Providing
++ * malformed blobs will cause out of bounds memory access.
++ */
+ bool blobmsg_check_attr(const struct blob_attr *attr, bool name);
+-bool blobmsg_check_attr_list(const struct blob_attr *attr, int type);
+ 
++/*
++ * blobmsg_check_attr_len: validate a list of attributes
++ *
++ * This method should be safer implementation of blobmsg_check_attr.
++ * It will limit all memory access performed on the blob to the
++ * range [attr, attr + len] (upper bound non inclusive) and is
++ * thus suited for checking of untrusted blob attributes.
++ */
+ bool blobmsg_check_attr_len(const struct blob_attr *attr, bool name, size_t len);
+ 
+ /*
++ * blobmsg_check_attr_list: validate a list of attributes
++ *
++ * This method may be used with trusted data only. Providing
++ * malformed blobs will cause out of bounds memory access.
++ */
++bool blobmsg_check_attr_list(const struct blob_attr *attr, int type);
++
++/*
++ * blobmsg_check_attr_list_len: validate a list of untrusted attributes
++ *
++ * This method should be safer implementation of blobmsg_check_attr_list.
++ * It will limit all memory access performed on the blob to the
++ * range [attr, attr + len] (upper bound non inclusive) and is
++ * thus suited for checking of untrusted blob attributes.
++ */
++bool blobmsg_check_attr_list_len(const struct blob_attr *attr, int type, size_t len);
++
++/*
+  * blobmsg_check_array: validate array/table and return size
+  *
+  * Checks if all elements of an array or table are valid and have
+  * the specified type. Returns the number of elements in the array
++ *
++ * This method may be used with trusted data only. Providing
++ * malformed blobs will cause out of bounds memory access.
+  */
+ int blobmsg_check_array(const struct blob_attr *attr, int type);
+ 
++/*
++ * blobmsg_check_array_len: validate untrusted array/table and return size
++ *
++ * Checks if all elements of an array or table are valid and have
++ * the specified type. Returns the number of elements in the array.
++ *
++ * This method should be safer implementation of blobmsg_check_array.
++ * It will limit all memory access performed on the blob to the
++ * range [attr, attr + len] (upper bound non inclusive) and is
++ * thus suited for checking of untrusted blob attributes.
++ */
++int blobmsg_check_array_len(const struct blob_attr *attr, int type, size_t len);
++
+ int blobmsg_parse(const struct blobmsg_policy *policy, int policy_len,
+                   struct blob_attr **tb, void *data, unsigned int len);
+ int blobmsg_parse_array(const struct blobmsg_policy *policy, int policy_len,
+@@ -271,5 +318,11 @@ int blobmsg_printf(struct blob_buf *buf,
+ 	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
+ 	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
+ 	     rem -= blob_pad_len(pos), pos = blob_next(pos))
++
++#define __blobmsg_for_each_attr(pos, attr, rem) \
++	for (pos = (struct blob_attr *) (attr ? blobmsg_data(attr) : NULL); \
++	     rem >= sizeof(struct blob_attr) && (blob_pad_len(pos) <= rem) && \
++	     (blob_pad_len(pos) >= sizeof(struct blob_attr)); \
++	     rem -= blob_pad_len(pos), pos = blob_next(pos))
+ 
+ #endif

package/libs/libubox/patches/0010-blobmsg-fix-array-out-of-bounds-GCC-10-warning.patch

@@ -0,0 +1,39 @@
+From 44d9e85ef058fbb9981d53218cafdc451afa5535 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Wed, 25 Dec 2019 10:27:59 +0100
+Subject: blobmsg: fix array out of bounds GCC 10 warning
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fixes following warning reported by GCC 10.0.0 20191203:
+
+ blobmsg.c:234:2: error: 'strcpy' offset 6 from the object at 'attr' is out of the bounds of referenced subobject 'name' with type 'uint8_t[0]' {aka 'unsigned char[0]'} at offset 6 [-Werror=array-bounds]
+   234 |  strcpy((char *) hdr->name, (const char *)name);
+       |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+ In file included from blobmsg.c:16:
+ blobmsg.h:42:10: note: subobject 'name' declared here
+    42 |  uint8_t name[];
+       |          ^~~~
+
+Reported-by: Khem Raj <raj.khem@gmail.com>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/blobmsg.c
++++ b/blobmsg.c
+@@ -246,7 +246,10 @@ blobmsg_new(struct blob_buf *buf, int ty
+ 	attr->id_len |= be32_to_cpu(BLOB_ATTR_EXTENDED);
+ 	hdr = blob_data(attr);
+ 	hdr->namelen = cpu_to_be16(namelen);
+-	strcpy((char *) hdr->name, (const char *)name);
++
++	memcpy(hdr->name, name, namelen);
++	hdr->name[namelen] = '\0';
++
+ 	pad_end = *data = blobmsg_data(attr);
+ 	pad_start = (char *) &hdr->name[namelen];
+ 	if (pad_start < pad_end)

package/libs/libubox/patches/0011-blobmsg-fix-wrong-payload-len-passed-from-blobmsg_ch.patch

@@ -0,0 +1,38 @@
+From d0f05d5e6873b30315127d47abbf4ac9f3c8bfb7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Sat, 28 Dec 2019 19:00:39 +0100
+Subject: blobmsg: fix wrong payload len passed from blobmsg_check_array
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fix incorrect use of blob_raw_len() on passed blobmsg to
+blobmsg_check_array_len()  introduced in commit b0e21553ae8c ("blobmsg:
+add _len variants for all attribute checking methods") by using correct
+blobmsg_len().
+
+This wrong (higher) length was then for example causing issues in
+procd's instance_config_parse_command() where blobmsg_check_attr_list()
+was failing sanity checking of service command, thus resulting in the
+startup failures of some services like collectd, nlbwmon and samba4.
+
+Ref: http://lists.infradead.org/pipermail/openwrt-devel/2019-December/020840.html
+Fixes: b0e21553ae8c ("blobmsg: add _len variants for all attribute checking methods")
+Reported-by: Hannu Nyman <hannu.nyman@welho.com>
+Tested-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/blobmsg.c
++++ b/blobmsg.c
+@@ -101,7 +101,7 @@ bool blobmsg_check_attr_len(const struct
+ 
+ int blobmsg_check_array(const struct blob_attr *attr, int type)
+ {
+-	return blobmsg_check_array_len(attr, type, blob_raw_len(attr));
++	return blobmsg_check_array_len(attr, type, blobmsg_len(attr));
+ }
+ 
+ int blobmsg_check_array_len(const struct blob_attr *attr, int type, size_t len)

package/libs/libubox/patches/0012-jshn-prefer-snprintf-usage.patch

@@ -0,0 +1,61 @@
+From 31778937b4153492955495e550435c8bbf7cfde8 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Tue, 14 Jan 2020 08:55:34 +0100
+Subject: jshn: prefer snprintf usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Better safe than sorry.
+
+Reviewed-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ jshn.c | 16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+--- a/jshn.c
++++ b/jshn.c
+@@ -68,7 +68,7 @@ static int add_json_array(struct array_l
+ 	int ret;
+ 
+ 	for (i = 0, len = array_list_length(a); i < len; i++) {
+-		sprintf(seq, "%d", i);
++		snprintf(seq, sizeof(seq), "%d", i);
+ 		ret = add_json_element(seq, array_list_get_idx(a, i));
+ 		if (ret)
+ 			return ret;
+@@ -197,25 +197,27 @@ static char *getenv_avl(const char *key)
+ static char *get_keys(const char *prefix)
+ {
+ 	char *keys;
++	size_t len = var_prefix_len + strlen(prefix) + sizeof("K_") + 1;
+ 
+-	keys = alloca(var_prefix_len + strlen(prefix) + sizeof("K_") + 1);
+-	sprintf(keys, "%sK_%s", var_prefix, prefix);
++	keys = alloca(len);
++	snprintf(keys, len, "%sK_%s", var_prefix, prefix);
+ 	return getenv_avl(keys);
+ }
+ 
+ static void get_var(const char *prefix, const char **name, char **var, char **type)
+ {
+ 	char *tmpname, *varname;
++	size_t len = var_prefix_len + strlen(prefix) + 1 + strlen(*name) + 1 + sizeof("T_");
+ 
+-	tmpname = alloca(var_prefix_len + strlen(prefix) + 1 + strlen(*name) + 1 + sizeof("T_"));
++	tmpname = alloca(len);
+ 
+-	sprintf(tmpname, "%s%s_%s", var_prefix, prefix, *name);
++	snprintf(tmpname, len, "%s%s_%s", var_prefix, prefix, *name);
+ 	*var = getenv_avl(tmpname);
+ 
+-	sprintf(tmpname, "%sT_%s_%s", var_prefix, prefix, *name);
++	snprintf(tmpname, len, "%sT_%s_%s", var_prefix, prefix, *name);
+ 	*type = getenv_avl(tmpname);
+ 
+-	sprintf(tmpname, "%sN_%s_%s", var_prefix, prefix, *name);
++	snprintf(tmpname, len, "%sN_%s_%s", var_prefix, prefix, *name);
+ 	varname = getenv_avl(tmpname);
+ 	if (varname)
+ 		*name = varname;

package/libs/libubox/patches/0013-blobmsg-blobmsg_vprintf-prefer-vsnprintf.patch

@@ -0,0 +1,38 @@
+From 935bb933e4a74de7326a4373340fd50655712334 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Tue, 14 Jan 2020 08:57:05 +0100
+Subject: blobmsg: blobmsg_vprintf: prefer vsnprintf
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Better safe than sorry and while at it add handling of possible
+*printf() failures.
+
+Reviewed-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/blobmsg.c
++++ b/blobmsg.c
+@@ -296,10 +296,17 @@ blobmsg_vprintf(struct blob_buf *buf, co
+ 	len = vsnprintf(&cbuf, sizeof(cbuf), format, arg2);
+ 	va_end(arg2);
+ 
++	if (len < 0)
++		return -1;
++
+ 	sbuf = blobmsg_alloc_string_buffer(buf, name, len + 1);
+ 	if (!sbuf)
+ 		return -1;
+-	ret = vsprintf(sbuf, format, arg);
++
++	ret = vsnprintf(sbuf, len + 1, format, arg);
++	if (ret < 0)
++		return -1;
++
+ 	blobmsg_add_string_buffer(buf);
+ 
+ 	return ret;

package/libs/libubox/patches/0014-blobmsg_json-fix-int16-serialization.patch

@@ -0,0 +1,41 @@
+From 1cc755d7c3989b399bf0c60535a858d22819ca27 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Sun, 12 Jan 2020 22:40:18 +0100
+Subject: blobmsg_json: fix int16 serialization
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+int16 blobmsg type is currently being serialized as uint16_t due to
+missing cast during JSON output.
+
+Following blobmsg content:
+
+ bar-min: -32768 (i16)
+ bar-max: 32767 (i16)
+
+Produces following JSON:
+
+ { "bar-min":32768,"bar-max":32767 }
+
+Whereas one would expect:
+
+ { "bar-min":-32768,"bar-max":32767 }
+
+Reviewed-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg_json.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/blobmsg_json.c
++++ b/blobmsg_json.c
+@@ -250,7 +250,7 @@ static void blobmsg_format_element(struc
+ 		sprintf(buf, "%s", *(uint8_t *)data ? "true" : "false");
+ 		break;
+ 	case BLOBMSG_TYPE_INT16:
+-		sprintf(buf, "%d", be16_to_cpu(*(uint16_t *)data));
++		sprintf(buf, "%d", (int16_t) be16_to_cpu(*(uint16_t *)data));
+ 		break;
+ 	case BLOBMSG_TYPE_INT32:
+ 		sprintf(buf, "%d", (int32_t) be32_to_cpu(*(uint32_t *)data));

package/libs/libubox/patches/0015-blobmsg_json-prefer-snprintf-usage.patch

@@ -0,0 +1,66 @@
+From 0e330ec3662795aea42ac36ecf7a9f32a249c36d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20=C5=A0tetiar?= <ynezz@true.cz>
+Date: Tue, 14 Jan 2020 09:05:02 +0100
+Subject: blobmsg_json: prefer snprintf usage
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Better safe than sorry and while at it prefer use of PRId16 and PRId32
+formatting constants as well.
+
+Reviewed-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg_json.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/blobmsg_json.c
++++ b/blobmsg_json.c
+@@ -203,7 +203,7 @@ static void blobmsg_format_string(struct
+ 		buf[1] = escape;
+ 
+ 		if (escape == 'u') {
+-			sprintf(buf + 4, "%02x", (unsigned char) *p);
++			snprintf(buf + 4, sizeof(buf) - 4, "%02x", (unsigned char) *p);
+ 			len = 6;
+ 		} else {
+ 			len = 2;
+@@ -220,7 +220,7 @@ static void blobmsg_format_json_list(str
+ static void blobmsg_format_element(struct strbuf *s, struct blob_attr *attr, bool without_name, bool head)
+ {
+ 	const char *data_str;
+-	char buf[32];
++	char buf[317];
+ 	void *data;
+ 	int len;
+ 
+@@ -244,22 +244,22 @@ static void blobmsg_format_element(struc
+ 	data_str = buf;
+ 	switch(blob_id(attr)) {
+ 	case BLOBMSG_TYPE_UNSPEC:
+-		sprintf(buf, "null");
++		snprintf(buf, sizeof(buf), "null");
+ 		break;
+ 	case BLOBMSG_TYPE_BOOL:
+-		sprintf(buf, "%s", *(uint8_t *)data ? "true" : "false");
++		snprintf(buf, sizeof(buf), "%s", *(uint8_t *)data ? "true" : "false");
+ 		break;
+ 	case BLOBMSG_TYPE_INT16:
+-		sprintf(buf, "%d", (int16_t) be16_to_cpu(*(uint16_t *)data));
++		snprintf(buf, sizeof(buf), "%" PRId16, (int16_t) be16_to_cpu(*(uint16_t *)data));
+ 		break;
+ 	case BLOBMSG_TYPE_INT32:
+-		sprintf(buf, "%d", (int32_t) be32_to_cpu(*(uint32_t *)data));
++		snprintf(buf, sizeof(buf), "%" PRId32, (int32_t) be32_to_cpu(*(uint32_t *)data));
+ 		break;
+ 	case BLOBMSG_TYPE_INT64:
+-		sprintf(buf, "%" PRId64, (int64_t) be64_to_cpu(*(uint64_t *)data));
++		snprintf(buf, sizeof(buf), "%" PRId64, (int64_t) be64_to_cpu(*(uint64_t *)data));
+ 		break;
+ 	case BLOBMSG_TYPE_DOUBLE:
+-		sprintf(buf, "%lf", blobmsg_get_double(attr));
++		snprintf(buf, sizeof(buf), "%lf", blobmsg_get_double(attr));
+ 		break;
+ 	case BLOBMSG_TYPE_STRING:
+ 		blobmsg_format_string(s, data);

package/libs/libubox/patches/0016-blobmsg-blobmsg_parse-and-blobmsg_parse_array-oob-re.patch

@@ -0,0 +1,110 @@
+From 6289e2d29883d5d9510b6a15c18c597478967a42 Mon Sep 17 00:00:00 2001
+From: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>
+Date: Sun, 12 Jan 2020 12:26:18 +0100
+Subject: blobmsg: blobmsg_parse and blobmsg_parse_array oob read fixes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fix out of bounds read in blobmsg_parse and blobmsg_check_name. The
+out of bounds read happens because blob_attr and blobmsg_hdr have
+flexible array members, whose size is 0 in the corresponding sizeofs.
+For example the __blob_for_each_attr macro checks whether rem >=
+sizeof(struct blob_attr). However, what LibFuzzer discovered was,
+if the input data was only 4 bytes, the data would be casted to blob_attr,
+and later on blob_data(attr) would be called even though attr->data was empty.
+The same issue could appear with data larger than 4 bytes, where data
+wasn't empty, but contained only the start of the blobmsg_hdr struct,
+and blobmsg_hdr name was empty. The bugs were discovered by fuzzing
+blobmsg_parse and blobmsg_array_parse with LibFuzzer.
+
+CC: Luka Perkov <luka.perkov@sartura.hr>
+Reviewed-by: Jo-Philipp Wich <jo@mein.io>
+Signed-off-by: Juraj Vijtiuk <juraj.vijtiuk@sartura.hr>
+[refactored some checks, added fuzz inputs, adjusted unit test results]
+Signed-off-by: Petr Štetiar <ynezz@true.cz>
+---
+ blobmsg.c | 40 ++++++++++++++++++++++++++++++++--------
+ 1 file changed, 32 insertions(+), 8 deletions(-)
+
+--- a/blobmsg.c
++++ b/blobmsg.c
+@@ -36,16 +36,38 @@ bool blobmsg_check_attr(const struct blo
+ 	return blobmsg_check_attr_len(attr, name, blob_raw_len(attr));
+ }
+ 
++static const struct blobmsg_hdr* blobmsg_hdr_from_blob(const struct blob_attr *attr, size_t len)
++{
++	if (len < sizeof(struct blob_attr) + sizeof(struct blobmsg_hdr))
++		return NULL;
++
++	return blob_data(attr);
++}
++
++static bool blobmsg_hdr_valid_namelen(const struct blobmsg_hdr *hdr, size_t len)
++{
++	if (len < sizeof(struct blob_attr) + sizeof(struct blobmsg_hdr) + blobmsg_namelen(hdr) + 1)
++		return false;
++
++	return true;
++}
++
+ static bool blobmsg_check_name(const struct blob_attr *attr, size_t len, bool name)
+ {
+ 	char *limit = (char *) attr + len;
+ 	const struct blobmsg_hdr *hdr;
+ 
+-	hdr = blob_data(attr);
++	hdr = blobmsg_hdr_from_blob(attr, len);
++	if (!hdr)
++		return false;
++
+ 	if (name && !hdr->namelen)
+ 		return false;
+ 
+-	if ((char *) hdr->name + blobmsg_namelen(hdr) > limit)
++	if (name && !blobmsg_hdr_valid_namelen(hdr, len))
++		return false;
++
++	if ((char *) hdr->name + blobmsg_namelen(hdr) + 1 > limit)
+ 		return false;
+ 
+ 	if (blobmsg_namelen(hdr) > (blob_len(attr) - sizeof(struct blobmsg_hdr)))
+@@ -79,9 +101,6 @@ bool blobmsg_check_attr_len(const struct
+ 	size_t data_len;
+ 	int id;
+ 
+-	if (len < sizeof(struct blob_attr))
+-		return false;
+-
+ 	if (!blobmsg_check_name(attr, len, name))
+ 		return false;
+ 
+@@ -176,11 +195,10 @@ int blobmsg_parse_array(const struct blo
+ 	return 0;
+ }
+ 
+-
+ int blobmsg_parse(const struct blobmsg_policy *policy, int policy_len,
+                   struct blob_attr **tb, void *data, unsigned int len)
+ {
+-	struct blobmsg_hdr *hdr;
++	const struct blobmsg_hdr *hdr;
+ 	struct blob_attr *attr;
+ 	uint8_t *pslen;
+ 	int i;
+@@ -197,7 +215,13 @@ int blobmsg_parse(const struct blobmsg_p
+ 	}
+ 
+ 	__blob_for_each_attr(attr, data, len) {
+-		hdr = blob_data(attr);
++		hdr = blobmsg_hdr_from_blob(attr, len);
++		if (!hdr)
++			return -1;
++
++		if (!blobmsg_hdr_valid_namelen(hdr, len))
++			return -1;
++
+ 		for (i = 0; i < policy_len; i++) {
+ 			if (!policy[i].name)
+ 				continue;

package/libs/libubox/patches/0017-blobmsg-fix-wrong-payload-len-passed-from-blobmsg_ch.patch

@@ -0,0 +1,33 @@
+From 75e300aeec25e032a9778bea34c713969960d1f0 Mon Sep 17 00:00:00 2001
+From: Chris Nisbet <nischris@gmail.com>
+Date: Wed, 12 Feb 2020 21:00:31 +1300
+Subject: [PATCH] blobmsg: fix wrong payload len passed from
+ blobmsg_check_array
+
+Fix incorrect use of blobmsg_len() on passed blobmsg to
+blobmsg_check_array_len() introduced in commit 379cd33d1992
+("fix wrong payload len passed from blobmsg_check_array") by using correct
+blob_len().
+
+By using blobmsg_len() a value too small was passed to blobmsg_check_array()
+which could lead to this function returning an error when there is none.
+
+Fixes: 379cd33d1992 ("fix wrong payload len passed from blobmsg_check_array")
+Signed-off-by: Chris Nisbet <nischris@gmail.com>
+[add fixes tag, rewrap commit message]
+Signed-off-by: Jo-Philipp Wich <jo@mein.io>
+---
+ blobmsg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/blobmsg.c
++++ b/blobmsg.c
+@@ -120,7 +120,7 @@ bool blobmsg_check_attr_len(const struct
+ 
+ int blobmsg_check_array(const struct blob_attr *attr, int type)
+ {
+-	return blobmsg_check_array_len(attr, type, blobmsg_len(attr));
++	return blobmsg_check_array_len(attr, type, blob_len(attr));
+ }
+ 
+ int blobmsg_check_array_len(const struct blob_attr *attr, int type, size_t len)

package/libs/mbedtls/Makefile

@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mbedtls
-PKG_VERSION:=2.16.3
+PKG_VERSION:=2.16.4
 PKG_RELEASE:=1
 PKG_USE_MIPS16:=0
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-gpl.tgz
 PKG_SOURCE_URL:=https://tls.mbed.org/download/
-PKG_HASH:=fd01fe4b289116df7781d05e1ef712b6c98823c5334f4a27404f13a8d066ef6a
+PKG_HASH:=5fdb9c43ab43fd9bcc3631508170b089ede7b86dd655253a93cb0ffeb42309f3
 
 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPL-2.0+

package/libs/mbedtls/patches/200-config.patch

@@ -17,7 +17,7 @@
  
  /**
   * \def MBEDTLS_CIPHER_NULL_CIPHER
-@@ -750,19 +750,19 @@
+@@ -757,19 +757,19 @@
   *
   * Comment macros to disable the curve and functions for it
   */
@@ -46,7 +46,7 @@
  
  /**
   * \def MBEDTLS_ECP_NIST_OPTIM
-@@ -811,7 +811,7 @@
+@@ -818,7 +818,7 @@
   *
   * Comment this macro to disable deterministic ECDSA.
   */
@@ -55,7 +55,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
-@@ -864,7 +864,7 @@
+@@ -871,7 +871,7 @@
   *             See dhm.h for more details.
   *
   */
@@ -64,7 +64,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
-@@ -884,7 +884,7 @@
+@@ -891,7 +891,7 @@
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA
   *      MBEDTLS_TLS_ECDHE_PSK_WITH_RC4_128_SHA
   */
@@ -73,7 +73,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED
-@@ -909,7 +909,7 @@
+@@ -916,7 +916,7 @@
   *      MBEDTLS_TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA
   *      MBEDTLS_TLS_RSA_PSK_WITH_RC4_128_SHA
   */
@@ -82,7 +82,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
-@@ -1043,7 +1043,7 @@
+@@ -1050,7 +1050,7 @@
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384
   */
@@ -91,7 +91,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
-@@ -1067,7 +1067,7 @@
+@@ -1074,7 +1074,7 @@
   *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384
   */
@@ -100,7 +100,7 @@
  
  /**
   * \def MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
-@@ -1171,7 +1171,7 @@
+@@ -1178,7 +1178,7 @@
   * This option is only useful if both MBEDTLS_SHA256_C and
   * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used.
   */
@@ -109,7 +109,7 @@
  
  /**
   * \def MBEDTLS_ENTROPY_NV_SEED
-@@ -1266,14 +1266,14 @@
+@@ -1273,14 +1273,14 @@
   * Uncomment this macro to disable the use of CRT in RSA.
   *
   */
@@ -126,7 +126,7 @@
  
  /**
   * \def MBEDTLS_SHA256_SMALLER
-@@ -1289,7 +1289,7 @@
+@@ -1296,7 +1296,7 @@
   *
   * Uncomment to enable the smaller implementation of SHA256.
   */
@@ -135,7 +135,7 @@
  
  /**
   * \def MBEDTLS_SSL_ALL_ALERT_MESSAGES
-@@ -1427,7 +1427,7 @@
+@@ -1434,7 +1434,7 @@
   *          configuration of this extension).
   *
   */
@@ -144,7 +144,7 @@
  
  /**
   * \def MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO
-@@ -1602,7 +1602,7 @@
+@@ -1609,7 +1609,7 @@
   *
   * Comment this macro to disable support for SSL session tickets
   */
@@ -153,7 +153,7 @@
  
  /**
   * \def MBEDTLS_SSL_EXPORT_KEYS
-@@ -1632,7 +1632,7 @@
+@@ -1639,7 +1639,7 @@
   *
   * Comment this macro to disable support for truncated HMAC in SSL
   */
@@ -162,7 +162,7 @@
  
  /**
   * \def MBEDTLS_SSL_TRUNCATED_HMAC_COMPAT
-@@ -1691,7 +1691,7 @@
+@@ -1698,7 +1698,7 @@
   *
   * Comment this to disable run-time checking and save ROM space
   */
@@ -171,7 +171,7 @@
  
  /**
   * \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
-@@ -2021,7 +2021,7 @@
+@@ -2028,7 +2028,7 @@
   *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256
   *      MBEDTLS_TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256
   */
@@ -180,7 +180,7 @@
  
  /**
   * \def MBEDTLS_ARIA_C
-@@ -2087,7 +2087,7 @@
+@@ -2094,7 +2094,7 @@
   * This module enables the AES-CCM ciphersuites, if other requisites are
   * enabled as well.
   */
@@ -189,7 +189,7 @@
  
  /**
   * \def MBEDTLS_CERTS_C
-@@ -2099,7 +2099,7 @@
+@@ -2106,7 +2106,7 @@
   *
   * This module is used for testing (ssl_client/server).
   */
@@ -198,7 +198,7 @@
  
  /**
   * \def MBEDTLS_CHACHA20_C
-@@ -2108,7 +2108,7 @@
+@@ -2115,7 +2115,7 @@
   *
   * Module:  library/chacha20.c
   */
@@ -207,7 +207,7 @@
  
  /**
   * \def MBEDTLS_CHACHAPOLY_C
-@@ -2119,7 +2119,7 @@
+@@ -2126,7 +2126,7 @@
   *
   * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C
   */
@@ -216,7 +216,7 @@
  
  /**
   * \def MBEDTLS_CIPHER_C
-@@ -2174,7 +2174,7 @@
+@@ -2185,7 +2185,7 @@
   *
   * This module provides debugging functions.
   */
@@ -225,7 +225,7 @@
  
  /**
   * \def MBEDTLS_DES_C
-@@ -2203,7 +2203,7 @@
+@@ -2214,7 +2214,7 @@
   * \warning   DES is considered a weak cipher and its use constitutes a
   *            security risk. We recommend considering stronger ciphers instead.
   */
@@ -234,7 +234,7 @@
  
  /**
   * \def MBEDTLS_DHM_C
-@@ -2366,7 +2366,7 @@
+@@ -2377,7 +2377,7 @@
   * This module adds support for the Hashed Message Authentication Code
   * (HMAC)-based key derivation function (HKDF).
   */
@@ -243,7 +243,7 @@
  
  /**
   * \def MBEDTLS_HMAC_DRBG_C
-@@ -2380,7 +2380,7 @@
+@@ -2391,7 +2391,7 @@
   *
   * Uncomment to enable the HMAC_DRBG random number geerator.
   */
@@ -252,7 +252,7 @@
  
  /**
   * \def MBEDTLS_NIST_KW_C
-@@ -2676,7 +2676,7 @@
+@@ -2687,7 +2687,7 @@
   *
   * This module enables abstraction of common (libc) functions.
   */
@@ -261,7 +261,7 @@
  
  /**
   * \def MBEDTLS_POLY1305_C
-@@ -2686,7 +2686,7 @@
+@@ -2697,7 +2697,7 @@
   * Module:  library/poly1305.c
   * Caller:  library/chachapoly.c
   */
@@ -270,7 +270,7 @@
  
  /**
   * \def MBEDTLS_RIPEMD160_C
-@@ -2697,7 +2697,7 @@
+@@ -2708,7 +2708,7 @@
   * Caller:  library/md.c
   *
   */
@@ -279,7 +279,7 @@
  
  /**
   * \def MBEDTLS_RSA_C
-@@ -2804,7 +2804,7 @@
+@@ -2815,7 +2815,7 @@
   *
   * Requires: MBEDTLS_CIPHER_C
   */
@@ -288,7 +288,7 @@
  
  /**
   * \def MBEDTLS_SSL_CLI_C
-@@ -2904,7 +2904,7 @@
+@@ -2915,7 +2915,7 @@
   *
   * This module provides run-time version information.
   */
@@ -297,7 +297,7 @@
  
  /**
   * \def MBEDTLS_X509_USE_C
-@@ -3014,7 +3014,7 @@
+@@ -3025,7 +3025,7 @@
   * Module:  library/xtea.c
   * Caller:
   */

package/network/services/hostapd/Makefile

@@ -88,9 +88,6 @@ DRIVER_MAKEOPTS= \
 	CONFIG_IEEE80211AC=$(HOSTAPD_IEEE80211AC) \
 	CONFIG_DRIVER_WEXT=$(CONFIG_DRIVER_WEXT_SUPPORT) \
 
-space :=
-space +=
-
 ifeq ($(LOCAL_VARIANT),full)
   DRIVER_MAKEOPTS += CONFIG_IEEE80211W=$(CONFIG_DRIVER_11W_SUPPORT)
 endif

package/network/services/ppp/Makefile

@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ppp
 PKG_VERSION:=2.4.7
-PKG_RELEASE:=12
+PKG_RELEASE:=13
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://download.samba.org/pub/ppp/

package/network/services/ppp/patches/700-radius-Prevent-buffer-overflow-in-rc_mksid.patch

@@ -0,0 +1,30 @@
+From 858976b1fc3107f1261aae337831959b511b83c2 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Sat, 4 Jan 2020 12:01:32 +1100
+Subject: [PATCH] radius: Prevent buffer overflow in rc_mksid()
+
+On some systems getpid() can return a value greater than 65535.
+Increase the size of buf[] to allow for this, and use slprintf()
+to make sure we never overflow it.
+
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+---
+ pppd/plugins/radius/util.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pppd/plugins/radius/util.c b/pppd/plugins/radius/util.c
+index 6f976a712951..740131e8377c 100644
+--- a/pppd/plugins/radius/util.c
++++ b/pppd/plugins/radius/util.c
+@@ -73,9 +73,9 @@ void rc_mdelay(int msecs)
+ char *
+ rc_mksid (void)
+ {
+-  static char buf[15];
++  static char buf[32];
+   static unsigned short int cnt = 0;
+-  sprintf (buf, "%08lX%04X%02hX",
++  slprintf(buf, sizeof(buf), "%08lX%04X%02hX",
+ 	   (unsigned long int) time (NULL),
+ 	   (unsigned int) getpid (),
+ 	   cnt & 0xFF);

package/network/services/ppp/patches/701-pppd-Fix-bounds-check-in-EAP-code.patch

@@ -0,0 +1,37 @@
+From 8d7970b8f3db727fe798b65f3377fe6787575426 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Mon, 3 Feb 2020 15:53:28 +1100
+Subject: [PATCH] pppd: Fix bounds check in EAP code
+
+Given that we have just checked vallen < len, it can never be the case
+that vallen >= len + sizeof(rhostname).  This fixes the check so we
+actually avoid overflowing the rhostname array.
+
+Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+---
+ pppd/eap.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/pppd/eap.c b/pppd/eap.c
+index 94407f56a336..1b93db01aebd 100644
+--- a/pppd/eap.c
++++ b/pppd/eap.c
+@@ -1420,7 +1420,7 @@ int len;
+ 		}
+ 
+ 		/* Not so likely to happen. */
+-		if (vallen >= len + sizeof (rhostname)) {
++		if (len - vallen >= sizeof (rhostname)) {
+ 			dbglog("EAP: trimming really long peer name down");
+ 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
+ 			rhostname[sizeof (rhostname) - 1] = '\0';
+@@ -1846,7 +1846,7 @@ int len;
+ 		}
+ 
+ 		/* Not so likely to happen. */
+-		if (vallen >= len + sizeof (rhostname)) {
++		if (len - vallen >= sizeof (rhostname)) {
+ 			dbglog("EAP: trimming really long peer name down");
+ 			BCOPY(inp + vallen, rhostname, sizeof (rhostname) - 1);
+ 			rhostname[sizeof (rhostname) - 1] = '\0';

package/network/services/ppp/patches/702-pppd-Ignore-received-EAP-messages-when-not-doing-EAP.patch

@@ -0,0 +1,61 @@
+From 8d45443bb5c9372b4c6a362ba2f443d41c5636af Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@ozlabs.org>
+Date: Mon, 3 Feb 2020 16:31:42 +1100
+Subject: [PATCH] pppd: Ignore received EAP messages when not doing EAP
+
+This adds some basic checks to the subroutines of eap_input to check
+that we have requested or agreed to doing EAP authentication before
+doing any processing on the received packet.  The motivation is to
+make it harder for a malicious peer to disrupt the operation of pppd
+by sending unsolicited EAP packets.  Note that eap_success() already
+has a check that the EAP client state is reasonable, and does nothing
+(apart from possibly printing a debug message) if not.
+
+Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
+---
+ pppd/eap.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/pppd/eap.c b/pppd/eap.c
+index 1b93db01aebd..082e95343120 100644
+--- a/pppd/eap.c
++++ b/pppd/eap.c
+@@ -1328,6 +1328,12 @@ int len;
+ 	int fd;
+ #endif /* USE_SRP */
+ 
++	/*
++	 * Ignore requests if we're not open
++	 */
++	if (esp->es_client.ea_state <= eapClosed)
++		return;
++
+ 	/*
+ 	 * Note: we update es_client.ea_id *only if* a Response
+ 	 * message is being generated.  Otherwise, we leave it the
+@@ -1736,6 +1742,12 @@ int len;
+ 	u_char dig[SHA_DIGESTSIZE];
+ #endif /* USE_SRP */
+ 
++	/*
++	 * Ignore responses if we're not open
++	 */
++	if (esp->es_server.ea_state <= eapClosed)
++		return;
++
+ 	if (esp->es_server.ea_id != id) {
+ 		dbglog("EAP: discarding Response %d; expected ID %d", id,
+ 		    esp->es_server.ea_id);
+@@ -2047,6 +2059,12 @@ u_char *inp;
+ int id;
+ int len;
+ {
++	/*
++	 * Ignore failure messages if we're not open
++	 */
++	if (esp->es_client.ea_state <= eapClosed)
++		return;
++
+ 	if (!eap_client_active(esp)) {
+ 		dbglog("EAP unexpected failure message in state %s (%d)",
+ 		    eap_state_name(esp->es_client.ea_state),

package/network/services/uhttpd/Makefile

@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git
-PKG_SOURCE_DATE:=2019-12-22
+PKG_SOURCE_DATE:=2020-02-12
-PKG_SOURCE_VERSION:=5f9ae5738372aaa3a6be2f0a278933563d3f191a
+PKG_SOURCE_VERSION:=2ee323c01079248baa9465969df9e25b5fb68cdf
-PKG_MIRROR_HASH:=16977c2d7e68f6db3241f874df625af9bd3bafa06fe4499ecb3561c825321e5d
+PKG_MIRROR_HASH:=ebec09286cf5f977cac893931a5a4f27ba891db88d5e44a9b0de9446ae431527
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=ISC
 

package/network/utils/ethtool/Makefile

@@ -23,7 +23,7 @@ PKG_FIXUP:=autoreconf
 PKG_INSTALL:=1
 PKG_BUILD_PARALLEL:=1
 
-PKG_CONFIG_DEPENDS:=ETHTOOL_PRETTY_DUMP
+PKG_CONFIG_DEPENDS:=CONFIG_ETHTOOL_PRETTY_DUMP
 
 include $(INCLUDE_DIR)/package.mk
 

package/system/opkg/Makefile

@@ -14,9 +14,9 @@ PKG_FLAGS:=essential
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://git.openwrt.org/project/opkg-lede.git
-PKG_SOURCE_DATE:=2019-06-14
+PKG_SOURCE_DATE:=2020-01-25
-PKG_SOURCE_VERSION:=dcbc142e51f5f5f2fb9e4e44657e013d3c36a52b
+PKG_SOURCE_VERSION:=c09fe2098718807ddbca13ee36e3e38801822946
-PKG_MIRROR_HASH:=fca7e71dd06f0d5ee0af0d0a493d641d4d5d7e403d64c67879a462a020aa2299
+PKG_MIRROR_HASH:=b2fba519fb3bf2da2e325a33eee951b85c7c1886e48ebaac3892435a71ae33d5
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING

target/linux/apm821xx/patches-4.14/023-0007-crypto-crypto4xx-Fix-wrong-ppc4xx_trng_probe-ppc4xx_.patch

@@ -1,39 +0,0 @@
-From 6e88098ca43a3d80ae86908f7badba683c8a0d84 Mon Sep 17 00:00:00 2001
-From: Corentin Labbe <clabbe@baylibre.com>
-Date: Wed, 23 Jan 2019 11:24:18 +0000
-Subject: [PATCH 07/15] crypto: crypto4xx - Fix wrong
- ppc4xx_trng_probe()/ppc4xx_trng_remove() arguments
-
-When building without CONFIG_HW_RANDOM_PPC4XX, I hit the following build failure:
-drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_probe':
-drivers/crypto/amcc/crypto4xx_core.c:1407:20: error: passing argument 1 of 'ppc4xx_trng_probe' from incompatible pointer type [-Werror=incompatible-pointer-types]
-In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
-drivers/crypto/amcc/crypto4xx_trng.h:28:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
-drivers/crypto/amcc/crypto4xx_core.c: In function 'crypto4xx_remove':
-drivers/crypto/amcc/crypto4xx_core.c:1434:21: error: passing argument 1 of 'ppc4xx_trng_remove' from incompatible pointer type [-Werror=incompatible-pointer-types]
-In file included from drivers/crypto/amcc/crypto4xx_core.c:50:0:
-drivers/crypto/amcc/crypto4xx_trng.h:30:20: note: expected 'struct crypto4xx_device *' but argument is of type 'struct crypto4xx_core_device *'
-
-This patch fix the needed argument of ppc4xx_trng_probe()/ppc4xx_trng_remove() in that case.
-
-Fixes: 5343e674f32f ("crypto4xx: integrate ppc4xx-rng into crypto4xx")
-Signed-off-by: Corentin Labbe <clabbe@baylibre.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
----
- drivers/crypto/amcc/crypto4xx_trng.h | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/crypto/amcc/crypto4xx_trng.h
-+++ b/drivers/crypto/amcc/crypto4xx_trng.h
-@@ -26,9 +26,9 @@ void ppc4xx_trng_probe(struct crypto4xx_
- void ppc4xx_trng_remove(struct crypto4xx_core_device *core_dev);
- #else
- static inline void ppc4xx_trng_probe(
--	struct crypto4xx_device *dev __maybe_unused) { }
-+	struct crypto4xx_core_device *dev __maybe_unused) { }
- static inline void ppc4xx_trng_remove(
--	struct crypto4xx_device *dev __maybe_unused) { }
-+	struct crypto4xx_core_device *dev __maybe_unused) { }
- #endif
- 
- #endif

target/linux/ar71xx/patches-4.9/450-gpio-nxp-74hc153-gpio-chip-driver.patch

@@ -1,6 +1,6 @@
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
-@@ -1214,4 +1214,12 @@ config GPIO_VIPERBOARD
+@@ -1215,4 +1215,12 @@ config GPIO_VIPERBOARD
  
  endmenu
  

target/linux/ar71xx/patches-4.9/451-gpio-74x164-improve-platform-device-support.patch

@@ -109,7 +109,7 @@
 +#endif
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
-@@ -1155,7 +1155,6 @@ menu "SPI GPIO expanders"
+@@ -1156,7 +1156,6 @@ menu "SPI GPIO expanders"
  
  config GPIO_74X164
  	tristate "74x164 serial-in/parallel-out 8-bits shift register"

target/linux/ar71xx/patches-4.9/452-gpio-add-gpio-latch-driver.patch

@@ -1,6 +1,6 @@
 --- a/drivers/gpio/Kconfig
 +++ b/drivers/gpio/Kconfig
-@@ -1221,4 +1221,9 @@ config GPIO_NXP_74HC153
+@@ -1222,4 +1222,9 @@ config GPIO_NXP_74HC153
  	  Platform driver for NXP 74HC153 Dual 4-input Multiplexer. This
  	  provides a GPIO interface supporting input mode only.
  

target/linux/ar71xx/patches-4.9/910-unaligned_access_hacks.patch

@@ -795,7 +795,7 @@
  
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
-@@ -3926,14 +3926,16 @@ static bool tcp_parse_aligned_timestamp(
+@@ -3934,14 +3934,16 @@ static bool tcp_parse_aligned_timestamp(
  {
  	const __be32 *ptr = (const __be32 *)(th + 1);
  
@@ -869,7 +869,7 @@
   * No flags defined yet.
 --- a/net/core/utils.c
 +++ b/net/core/utils.c
-@@ -321,8 +321,14 @@ void inet_proto_csum_replace16(__sum16 *
+@@ -338,8 +338,14 @@ void inet_proto_csum_replace16(__sum16 *
  			       bool pseudohdr)
  {
  	__be32 diff[] = {

target/linux/ath25/patches-4.14/130-watchdog.patch

@@ -212,7 +212,7 @@
 +MODULE_ALIAS("platform:" DRIVER_NAME);
 --- a/drivers/watchdog/Kconfig
 +++ b/drivers/watchdog/Kconfig
-@@ -1646,6 +1646,13 @@ config PIC32_DMT
+@@ -1647,6 +1647,13 @@ config PIC32_DMT
  	  To compile this driver as a loadable module, choose M here.
  	  The module will be called pic32-dmt.
  

target/linux/bcm53xx/patches-4.14/400-mtd-spi-nor-detect-JEDEC-incompatible-w25q128-using-.patch

@@ -13,7 +13,7 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
 
 --- a/drivers/mtd/spi-nor/spi-nor.c
 +++ b/drivers/mtd/spi-nor/spi-nor.c
-@@ -1220,6 +1220,18 @@ static const struct flash_info *spi_nor_
+@@ -1225,6 +1225,18 @@ static const struct flash_info *spi_nor_
  	}
  	dev_err(nor->dev, "unrecognized JEDEC id bytes: %02x, %02x, %02x\n",
  		id[0], id[1], id[2]);

target/linux/brcm2708/patches-4.9/950-0031-Add-dwc_otg-driver.patch

@@ -696,7 +696,7 @@ Signed-off-by: Noralf Trønnes <noralf@tronnes.org>
  }
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -5095,7 +5095,7 @@ static void port_event(struct usb_hub *h
+@@ -5096,7 +5096,7 @@ static void port_event(struct usb_hub *h
  	if (portchange & USB_PORT_STAT_C_OVERCURRENT) {
  		u16 status = 0, unused;
  

target/linux/brcm2708/patches-4.9/950-0090-OF-DT-Overlay-configfs-interface.patch

@@ -88,8 +88,8 @@ Signed-off-by: Slawomir Stepien <sst@poczta.fm>
 +make sense for developers (since it avoids problems with namespaces).
 --- a/drivers/of/Kconfig
 +++ b/drivers/of/Kconfig
-@@ -112,4 +112,11 @@ config OF_OVERLAY
+@@ -116,4 +116,11 @@ config OF_DMA_DEFAULT_COHERENT
- config OF_NUMA
+ 	# arches should select this if DMA is coherent by default for OF devices
  	bool
  
 +config OF_CONFIGFS

target/linux/brcm47xx/base-files/etc/board.d/01_network

@@ -166,11 +166,17 @@ configure_by_model() {
 		;;
 
 	"Asus RT-N16"* | \
-	"Linksys E3000 V1")
+	"Linksys E3000 V1" | \
+	"Netgear WNR3500 V2")
 		ucidef_add_switch "switch0" \
 			"0:wan" "1:lan:4" "2:lan:3" "3:lan:2" "4:lan:1" "8@eth0"
 		;;
 
+	"Netgear WN2500RP V1")
+		ucidef_add_switch "switch0" \
+			"0:lan:4" "1:lan:3" "2:lan:2" "3:lan:1" "5@eth0"
+		;;
+
 	*)
 		configure_by_boardtype "$boardtype" "$boardnum"
 		;;

target/linux/brcm47xx/patches-4.14/209-b44-register-adm-switch.patch

@@ -19,7 +19,7 @@ Subject: [PATCH 210/210] b44: register adm switch
  
  #include <linux/uaccess.h>
  #include <asm/io.h>
-@@ -2248,6 +2250,69 @@ static void b44_adjust_link(struct net_d
+@@ -2251,6 +2253,69 @@ static void b44_adjust_link(struct net_d
  	}
  }
  
@@ -89,7 +89,7 @@ Subject: [PATCH 210/210] b44: register adm switch
  static int b44_register_phy_one(struct b44 *bp)
  {
  	struct mii_bus *mii_bus;
-@@ -2283,6 +2348,9 @@ static int b44_register_phy_one(struct b
+@@ -2286,6 +2351,9 @@ static int b44_register_phy_one(struct b
  	if (!mdiobus_is_registered_device(bp->mii_bus, bp->phy_addr) &&
  	    (sprom->boardflags_lo & (B44_BOARDFLAG_ROBO | B44_BOARDFLAG_ADM))) {
  
@@ -99,7 +99,7 @@ Subject: [PATCH 210/210] b44: register adm switch
  		dev_info(sdev->dev,
  			 "could not find PHY at %i, use fixed one\n",
  			 bp->phy_addr);
-@@ -2477,6 +2545,7 @@ static void b44_remove_one(struct ssb_de
+@@ -2480,6 +2548,7 @@ static void b44_remove_one(struct ssb_de
  	unregister_netdev(dev);
  	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
  		b44_unregister_phy_one(bp);

target/linux/brcm47xx/patches-4.14/210-b44_phy_fix.patch

@@ -43,7 +43,7 @@
  
  	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
  		return 0;
-@@ -2178,6 +2203,8 @@ static int b44_get_invariants(struct b44
+@@ -2181,6 +2206,8 @@ static int b44_get_invariants(struct b44
  	 * valid PHY address. */
  	bp->phy_addr &= 0x1F;
  

target/linux/brcm47xx/patches-4.14/831-old_gpio_wdt.patch

@@ -4,7 +4,7 @@ Signed-off-by: Mathias Adam <m.adam--openwrt@adamis.de>
 
 --- a/drivers/watchdog/Kconfig
 +++ b/drivers/watchdog/Kconfig
-@@ -1472,6 +1472,15 @@ config WDT_MTX1
+@@ -1473,6 +1473,15 @@ config WDT_MTX1
  	  Hardware driver for the MTX-1 boards. This is a watchdog timer that
  	  will reboot the machine after a 100 seconds timer expired.
  

target/linux/brcm47xx/patches-4.9/209-b44-register-adm-switch.patch

@@ -19,7 +19,7 @@ Subject: [PATCH 210/210] b44: register adm switch
  
  #include <asm/uaccess.h>
  #include <asm/io.h>
-@@ -2250,6 +2252,69 @@ static void b44_adjust_link(struct net_d
+@@ -2253,6 +2255,69 @@ static void b44_adjust_link(struct net_d
  	}
  }
  
@@ -89,7 +89,7 @@ Subject: [PATCH 210/210] b44: register adm switch
  static int b44_register_phy_one(struct b44 *bp)
  {
  	struct mii_bus *mii_bus;
-@@ -2285,6 +2350,9 @@ static int b44_register_phy_one(struct b
+@@ -2288,6 +2353,9 @@ static int b44_register_phy_one(struct b
  	if (!mdiobus_is_registered_device(bp->mii_bus, bp->phy_addr) &&
  	    (sprom->boardflags_lo & (B44_BOARDFLAG_ROBO | B44_BOARDFLAG_ADM))) {
  
@@ -99,7 +99,7 @@ Subject: [PATCH 210/210] b44: register adm switch
  		dev_info(sdev->dev,
  			 "could not find PHY at %i, use fixed one\n",
  			 bp->phy_addr);
-@@ -2476,6 +2544,7 @@ static void b44_remove_one(struct ssb_de
+@@ -2479,6 +2547,7 @@ static void b44_remove_one(struct ssb_de
  	unregister_netdev(dev);
  	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
  		b44_unregister_phy_one(bp);

target/linux/brcm47xx/patches-4.9/210-b44_phy_fix.patch

@@ -43,7 +43,7 @@
  
  	if (bp->flags & B44_FLAG_EXTERNAL_PHY)
  		return 0;
-@@ -2180,6 +2205,8 @@ static int b44_get_invariants(struct b44
+@@ -2183,6 +2208,8 @@ static int b44_get_invariants(struct b44
  	 * valid PHY address. */
  	bp->phy_addr &= 0x1F;
  

target/linux/brcm63xx/patches-4.14/102-MIPS-BCM63XX-move-code-touching-the-USB-private-regi.patch

@@ -23,10 +23,10 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
 +++ b/arch/mips/bcm63xx/Makefile
 @@ -2,7 +2,7 @@
  obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
- 		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
+ 		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
--		   dev-wdt.o dev-usb-usbd.o
+-		   dev-usb-usbd.o
-+		   dev-wdt.o dev-usb-usbd.o usb-common.o
++		   dev-usb-usbd.o usb-common.o
  obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
  
  obj-y		+= boards/

target/linux/brcm63xx/patches-4.14/105-MIPS-BCM63XX-add-support-for-the-on-chip-OHCI-contro.patch

@@ -23,10 +23,10 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
 +++ b/arch/mips/bcm63xx/Makefile
 @@ -2,7 +2,7 @@
  obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
- 		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
+ 		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
--		   dev-wdt.o dev-usb-usbd.o usb-common.o
+-		   dev-usb-usbd.o usb-common.o
-+		   dev-wdt.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o
++		   dev-usb-ohci.o dev-usb-usbd.o usb-common.o
  obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
  
  obj-y		+= boards/

target/linux/brcm63xx/patches-4.14/106-MIPS-BCM63XX-register-OHCI-controller-if-board-enabl.patch

@@ -16,7 +16,7 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
 
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -28,6 +28,7 @@
+@@ -27,6 +27,7 @@
  #include <bcm63xx_dev_hsspi.h>
  #include <bcm63xx_dev_pcmcia.h>
  #include <bcm63xx_dev_spi.h>
@@ -24,13 +24,13 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
  #include <bcm63xx_dev_usb_usbd.h>
  #include <board_bcm963xx.h>
  
-@@ -898,6 +899,9 @@ int __init board_register_devices(void)
+@@ -881,6 +882,9 @@ int __init board_register_devices(void)
  	if (board.has_usbd)
  		bcm63xx_usbd_register(&board.usbd);
  
 +	if (board.has_ohci0)
 +		bcm63xx_ohci_register();
 +
- 	if (board.has_dsp)
+ 	/* Generate MAC address for WLAN and register our SPROM,
- 		bcm63xx_dsp_register(&board.dsp);
+ 	 * do this after registering enet devices
- 
+ 	 */

target/linux/brcm63xx/patches-4.14/108-MIPS-BCM63XX-add-support-for-the-on-chip-EHCI-contro.patch

@@ -21,13 +21,12 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
 
 --- a/arch/mips/bcm63xx/Makefile
 +++ b/arch/mips/bcm63xx/Makefile
-@@ -2,7 +2,8 @@
+@@ -2,7 +2,7 @@
  obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
- 		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
+ 		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
--		   dev-wdt.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o
+-		   dev-usb-ohci.o dev-usb-usbd.o usb-common.o
-+		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
++		   dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o
-+		   usb-common.o
  obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
  
  obj-y		+= boards/

target/linux/brcm63xx/patches-4.14/109-MIPS-BCM63XX-register-EHCI-controller-if-board-enabl.patch

@@ -16,7 +16,7 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
 
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -28,6 +28,7 @@
+@@ -27,6 +27,7 @@
  #include <bcm63xx_dev_hsspi.h>
  #include <bcm63xx_dev_pcmcia.h>
  #include <bcm63xx_dev_spi.h>
@@ -24,7 +24,7 @@ Signed-off-by: Florian Fainelli <florian@openwrt.org>
  #include <bcm63xx_dev_usb_ohci.h>
  #include <bcm63xx_dev_usb_usbd.h>
  #include <board_bcm963xx.h>
-@@ -899,6 +900,9 @@ int __init board_register_devices(void)
+@@ -882,6 +883,9 @@ int __init board_register_devices(void)
  	if (board.has_usbd)
  		bcm63xx_usbd_register(&board.usbd);
  

target/linux/brcm63xx/patches-4.14/207-MIPS-BCM63XX-move-device-registration-code-into-its-.patch

@@ -24,7 +24,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  obj-$(CONFIG_BOARD_BCM963XX)		+= board_bcm963xx.o
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -12,34 +12,21 @@
+@@ -12,33 +12,21 @@
  #include <linux/init.h>
  #include <linux/kernel.h>
  #include <linux/string.h>
@@ -39,7 +39,6 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  #include <bcm63xx_nvram.h>
 -#include <bcm63xx_dev_pci.h>
 -#include <bcm63xx_dev_enet.h>
--#include <bcm63xx_dev_dsp.h>
 -#include <bcm63xx_dev_flash.h>
 -#include <bcm63xx_dev_hsspi.h>
 -#include <bcm63xx_dev_pcmcia.h>
@@ -61,7 +60,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  /*
   * known 3368 boards
   */
-@@ -712,52 +699,6 @@ static const struct board_info __initcon
+@@ -695,52 +683,6 @@ static const struct board_info __initcon
  };
  
  /*
@@ -114,7 +113,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
   * early init callback, read nvram data from flash and checksum it
   */
  void __init board_prom_init(void)
-@@ -802,140 +743,15 @@ void __init board_prom_init(void)
+@@ -785,137 +727,15 @@ void __init board_prom_init(void)
  		if (strncmp(board_name, bcm963xx_boards[i]->name, 16))
  			continue;
  		/* copy, board desc array is marked initdata */
@@ -144,7 +143,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 -		bcm63xx_pci_enabled = 1;
 -		if (BCMCPU_IS_6348())
 -			val |= GPIO_MODE_6348_G2_PCI;
--	}
+ 	}
 -#endif
 -
 -	if (board.has_pccard) {
@@ -225,9 +224,6 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 -	if (board.has_ohci0)
 -		bcm63xx_ohci_register();
 -
--	if (board.has_dsp)
--		bcm63xx_dsp_register(&board.dsp);
--
 -	/* Generate MAC address for WLAN and register our SPROM,
 -	 * do this after registering enet devices
 -	 */
@@ -238,7 +234,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 -		if (ssb_arch_register_fallback_sprom(
 -				&bcm63xx_get_fallback_sprom) < 0)
 -			pr_err("failed to register fallback SPROM\n");
- 	}
+-	}
 -#endif
 -
 -	bcm63xx_spi_register();

target/linux/brcm63xx/patches-4.14/208-MIPS-BCM63XX-pass-a-mac-addresss-allocator-to-board-.patch

@@ -17,7 +17,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -743,7 +743,8 @@ void __init board_prom_init(void)
+@@ -727,7 +727,8 @@ void __init board_prom_init(void)
  		if (strncmp(board_name, bcm963xx_boards[i]->name, 16))
  			continue;
  		/* copy, board desc array is marked initdata */

target/linux/brcm63xx/patches-4.14/309-cfe_version_mod.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -723,10 +723,20 @@ void __init board_prom_init(void)
+@@ -707,10 +707,20 @@ void __init board_prom_init(void)
  
  	/* dump cfe version */
  	cfe = boot_addr + BCM963XX_CFE_VERSION_OFFSET;

target/linux/brcm63xx/patches-4.14/339-MIPS-BCM63XX-add-support-for-BCM63268.patch

@@ -35,7 +35,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  source "arch/mips/bcm63xx/boards/Kconfig"
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -713,7 +713,7 @@ void __init board_prom_init(void)
+@@ -697,7 +697,7 @@ void __init board_prom_init(void)
  	/* read base address of boot chip select (0)
  	 * 6328/6362 do not have MPI but boot from a fixed address
  	 */

target/linux/brcm63xx/patches-4.14/341-MIPS-BCM63XX-add-support-for-BCM6318.patch

@@ -35,7 +35,7 @@ Subject: [PATCH 51/53] MIPS: BCM63XX: add support for BCM6318
  	select SYS_HAS_CPU_BMIPS4350
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -713,7 +713,7 @@ void __init board_prom_init(void)
+@@ -697,7 +697,7 @@ void __init board_prom_init(void)
  	/* read base address of boot chip select (0)
  	 * 6328/6362 do not have MPI but boot from a fixed address
  	 */

target/linux/brcm63xx/patches-4.14/350-MIPS-BCM63XX-support-settings-num-usbh-ports.patch

@@ -1,13 +1,13 @@
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -42,6 +42,7 @@ struct board_info {
+@@ -40,6 +40,7 @@ struct board_info {
  
  	/* USB config */
  	struct bcm63xx_usbd_platform_data usbd;
 +	unsigned int num_usbh_ports:2;
  
- 	/* DSP config */
+ 	/* GPIO LEDs */
- 	struct bcm63xx_dsp_platform_data dsp;
+ 	struct gpio_led leds[5];
 --- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_usb_ehci.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_usb_ehci.h
 @@ -1,6 +1,6 @@

target/linux/brcm63xx/patches-4.14/351-set-board-usbh-ports.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -592,6 +592,7 @@ static struct board_info __initdata boar
+@@ -576,6 +576,7 @@ static struct board_info __initdata boar
  	.has_ohci0 = 1,
  	.has_pccard = 1,
  	.has_ehci0 = 1,

target/linux/brcm63xx/patches-4.14/354-MIPS-BCM63XX-allow-building-support-for-more-than-on.patch

@@ -36,7 +36,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 +endmenu
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -702,7 +702,7 @@ static const struct board_info __initcon
+@@ -686,7 +686,7 @@ static const struct board_info __initcon
  /*
   * early init callback, read nvram data from flash and checksum it
   */

target/linux/brcm63xx/patches-4.14/356-MIPS-BCM63XX-move-fallback-sprom-support-into-its-ow.patch

@@ -20,12 +20,13 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 --- a/arch/mips/bcm63xx/Makefile
 +++ b/arch/mips/bcm63xx/Makefile
-@@ -3,7 +3,7 @@ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o
+@@ -2,7 +2,8 @@
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
- 		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
+ 		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
--		   usb-common.o
+-		   dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o
-+		   usb-common.o sprom.o
++		   dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o \
++		   sprom.o
  obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
  
  obj-y		+= boards/

target/linux/brcm63xx/patches-4.14/357-MIPS-BCM63XX-use-platform-data-for-the-sprom.patch

@@ -75,15 +75,15 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  #endif
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -8,6 +8,7 @@
+@@ -7,6 +7,7 @@
+ #include <linux/leds.h>
  #include <bcm63xx_dev_enet.h>
  #include <bcm63xx_dev_usb_usbd.h>
- #include <bcm63xx_dev_dsp.h>
 +#include <bcm63xx_fallback_sprom.h>
  
  /*
   * flash mapping
-@@ -55,6 +56,9 @@ struct board_info {
+@@ -50,6 +51,9 @@ struct board_info {
  
  	/* External PHY reset GPIO flags from gpio.h */
  	unsigned long ephy_reset_gpio_flags;

target/linux/brcm63xx/patches-4.14/358-MIPS-BCM63XX-make-fallback-sprom-optional.patch

@@ -42,7 +42,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  
  	.enet0 = {
  		.has_phy		= 1,
-@@ -324,6 +327,7 @@ static struct board_info __initdata boar
+@@ -316,6 +319,7 @@ static struct board_info __initdata boar
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
@@ -50,7 +50,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  
  	.enet0 = {
  		.has_phy		= 1,
-@@ -378,6 +382,7 @@ static struct board_info __initdata boar
+@@ -370,6 +374,7 @@ static struct board_info __initdata boar
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
@@ -58,7 +58,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  
  	.enet0 = {
  		.has_phy		= 1,
-@@ -436,6 +441,7 @@ static struct board_info __initdata boar
+@@ -420,6 +425,7 @@ static struct board_info __initdata boar
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
@@ -66,7 +66,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  
  	.enet0 = {
  		.has_phy		= 1,
-@@ -459,6 +465,7 @@ static struct board_info __initdata boar
+@@ -443,6 +449,7 @@ static struct board_info __initdata boar
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
@@ -74,7 +74,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  
  	.enet0 = {
  		.has_phy		= 1,
-@@ -477,6 +484,7 @@ static struct board_info __initdata boar
+@@ -461,6 +468,7 @@ static struct board_info __initdata boar
  
  	.has_uart0			= 1,
  	.has_pci			= 1,
@@ -82,7 +82,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	.has_ohci0			= 1,
  
  	.has_enet0			= 1,
-@@ -499,6 +507,7 @@ static struct board_info __initdata boar
+@@ -483,6 +491,7 @@ static struct board_info __initdata boar
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
@@ -90,7 +90,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  
  	.enet0 = {
  		.has_phy		= 1,
-@@ -525,6 +534,7 @@ static struct board_info __initdata boar
+@@ -509,6 +518,7 @@ static struct board_info __initdata boar
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
@@ -98,7 +98,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  
  	.enet0 = {
  		.has_phy		= 1,
-@@ -577,6 +587,7 @@ static struct board_info __initdata boar
+@@ -561,6 +571,7 @@ static struct board_info __initdata boar
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
@@ -106,7 +106,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  
  	.enet0 = {
  		.has_phy		= 1,
-@@ -648,6 +659,7 @@ static struct board_info __initdata boar
+@@ -632,6 +643,7 @@ static struct board_info __initdata boar
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
@@ -130,8 +130,8 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	bcm63xx_spi_register();
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -35,6 +35,7 @@ struct board_info {
+@@ -33,6 +33,7 @@ struct board_info {
- 	unsigned int	has_dsp:1;
+ 	unsigned int	has_usbd:1;
  	unsigned int	has_uart0:1;
  	unsigned int	has_uart1:1;
 +	unsigned int	use_fallback_sprom:1;

target/linux/brcm63xx/patches-4.14/368-MIPS-BCM63XX-add-support-for-matching-the-board_info.patch

@@ -16,7 +16,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -711,6 +711,10 @@ static const struct board_info __initcon
+@@ -695,6 +695,10 @@ static const struct board_info __initcon
  #endif
  };
  
@@ -27,7 +27,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  /*
   * early init callback, read nvram data from flash and checksum it
   */
-@@ -722,6 +726,7 @@ void __init board_bcm963xx_init(void)
+@@ -706,6 +710,7 @@ void __init board_bcm963xx_init(void)
  	char *board_name = NULL;
  	u32 val;
  	struct bcm_hcs *hcs;
@@ -35,7 +35,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  
  	/* read base address of boot chip select (0)
  	 * 6328/6362 do not have MPI but boot from a fixed address
-@@ -761,6 +766,16 @@ void __init board_bcm963xx_init(void)
+@@ -745,6 +750,16 @@ void __init board_bcm963xx_init(void)
  	} else {
  		board_name = bcm63xx_nvram_get_name();
  	}

target/linux/brcm63xx/patches-4.14/369-MIPS-BCM63XX-populate-the-compatible-to-board_info-l.patch

@@ -14,7 +14,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -712,6 +712,48 @@ static const struct board_info __initcon
+@@ -696,6 +696,48 @@ static const struct board_info __initcon
  };
  
  static struct of_device_id const bcm963xx_boards_dt[] = {

target/linux/brcm63xx/patches-4.14/377-MIPS-BCM63XX-register-lookup-for-ephy-reset-gpio.patch

@@ -116,7 +116,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  #include <linux/leds.h>
  #include <bcm63xx_dev_enet.h>
  #include <bcm63xx_dev_usb_usbd.h>
-@@ -55,8 +56,8 @@ struct board_info {
+@@ -50,8 +51,8 @@ struct board_info {
  	/* External PHY reset GPIO */
  	unsigned int ephy_reset_gpio;
  

target/linux/brcm63xx/patches-4.14/390-MIPS-BCM63XX-do-not-register-SPI-controllers.patch

@@ -35,15 +35,18 @@ Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
  	bcm63xx_led_data.num_leds = ARRAY_SIZE(board.leds);
 --- a/arch/mips/bcm63xx/Makefile
 +++ b/arch/mips/bcm63xx/Makefile
-@@ -1,7 +1,7 @@
+@@ -1,9 +1,8 @@
  # SPDX-License-Identifier: GPL-2.0
  obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
--		   dev-pcmcia.o dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o \
+-		   dev-rng.o dev-spi.o dev-hsspi.o dev-uart.o dev-wdt.o \
-+		   dev-pcmcia.o dev-rng.o dev-uart.o \
+-		   dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o usb-common.o \
- 		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
+-		   sprom.o
- 		   usb-common.o sprom.o
++		   dev-rng.o dev-uart.o dev-wdt.o dev-usb-ehci.o \
++		   dev-usb-ohci.o dev-usb-usbd.o usb-common.o sprom.o
  obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
+ 
+ obj-y		+= boards/
 --- a/arch/mips/bcm63xx/dev-hsspi.c
 +++ /dev/null
 @@ -1,48 +0,0 @@

target/linux/brcm63xx/patches-4.14/391-MIPS-BCM63XX-do-not-register-uart.patch

@@ -3,12 +3,12 @@
 @@ -1,7 +1,7 @@
  # SPDX-License-Identifier: GPL-2.0
  obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
--		   dev-pcmcia.o dev-rng.o dev-uart.o \
+-		   dev-rng.o dev-uart.o dev-wdt.o dev-usb-ehci.o \
-+		   dev-pcmcia.o dev-rng.o \
++		   dev-rng.o dev-wdt.o dev-usb-ehci.o \
- 		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
+ 		   dev-usb-ohci.o dev-usb-usbd.o usb-common.o sprom.o
- 		   usb-common.o sprom.o
  obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
+ 
 --- a/arch/mips/bcm63xx/dev-uart.c
 +++ /dev/null
 @@ -1,76 +0,0 @@
@@ -98,17 +98,6 @@
 -int bcm63xx_uart_register(unsigned int id);
 -
 -#endif /* BCM63XX_DEV_UART_H_ */
---- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-+++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -34,8 +34,6 @@ struct board_info {
- 	unsigned int	has_ehci0:1;
- 	unsigned int	has_usbd:1;
- 	unsigned int	has_dsp:1;
--	unsigned int	has_uart0:1;
--	unsigned int	has_uart1:1;
- 	unsigned int	use_fallback_sprom:1;
- 
- 	/* ethernet config */
 --- a/arch/mips/bcm63xx/boards/board_common.c
 +++ b/arch/mips/bcm63xx/boards/board_common.c
 @@ -20,7 +20,6 @@
@@ -193,7 +182,7 @@
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
-@@ -323,7 +313,6 @@ static struct board_info __initdata boar
+@@ -315,7 +305,6 @@ static struct board_info __initdata boar
  	.name				= "96348GW-11",
  	.expected_cpu_id		= 0x6348,
  
@@ -201,7 +190,7 @@
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
-@@ -378,7 +367,6 @@ static struct board_info __initdata boar
+@@ -370,7 +359,6 @@ static struct board_info __initdata boar
  	.name				= "96348GW",
  	.expected_cpu_id		= 0x6348,
  
@@ -209,7 +198,7 @@
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
-@@ -437,7 +425,6 @@ static struct board_info __initdata boar
+@@ -421,7 +409,6 @@ static struct board_info __initdata boar
  	.name				= "F@ST2404",
  	.expected_cpu_id		= 0x6348,
  
@@ -217,7 +206,7 @@
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
-@@ -482,7 +469,6 @@ static struct board_info __initdata boar
+@@ -466,7 +453,6 @@ static struct board_info __initdata boar
  	.name				= "DV201AMR",
  	.expected_cpu_id		= 0x6348,
  
@@ -225,7 +214,7 @@
  	.has_pci			= 1,
  	.use_fallback_sprom		= 1,
  	.has_ohci0			= 1,
-@@ -503,7 +489,6 @@ static struct board_info __initdata boar
+@@ -487,7 +473,6 @@ static struct board_info __initdata boar
  	.name				= "96348GW-A",
  	.expected_cpu_id		= 0x6348,
  
@@ -233,7 +222,7 @@
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
-@@ -530,7 +515,6 @@ static struct board_info __initdata boar
+@@ -514,7 +499,6 @@ static struct board_info __initdata boar
  	.name				= "96358VW",
  	.expected_cpu_id		= 0x6358,
  
@@ -241,7 +230,7 @@
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
-@@ -583,7 +567,6 @@ static struct board_info __initdata boar
+@@ -567,7 +551,6 @@ static struct board_info __initdata boar
  	.name				= "96358VW2",
  	.expected_cpu_id		= 0x6358,
  
@@ -249,7 +238,7 @@
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
-@@ -633,7 +616,6 @@ static struct board_info __initdata boar
+@@ -617,7 +600,6 @@ static struct board_info __initdata boar
  	.name				= "AGPF-S0",
  	.expected_cpu_id		= 0x6358,
  
@@ -257,3 +246,14 @@
  	.has_enet0			= 1,
  	.has_enet1			= 1,
  	.has_pci			= 1,
+--- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
++++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+@@ -32,8 +32,6 @@ struct board_info {
+ 	unsigned int	has_ohci0:1;
+ 	unsigned int	has_ehci0:1;
+ 	unsigned int	has_usbd:1;
+-	unsigned int	has_uart0:1;
+-	unsigned int	has_uart1:1;
+ 	unsigned int	use_fallback_sprom:1;
+ 
+ 	/* ethernet config */

target/linux/brcm63xx/patches-4.14/392-MIPS-BCM63XX-remove-leds-and-buttons.patch

@@ -169,11 +169,10 @@ Subject: [PATCH] MIPS: BCM63XX: remove leds and buttons
  };
  
  static struct board_info __initdata board_96348gw_10 = {
-@@ -278,35 +153,6 @@ static struct board_info __initdata boar
+@@ -271,34 +146,6 @@ static struct board_info __initdata boar
- 		.cs			= 2,
+ 	.has_pccard			= 1,
- 		.ext_irq		= 2,
+ 	.has_ehci0			= 1,
- 	},
+ 
--
 -	.leds = {
 -		{
 -			.name		= "adsl-fail",
@@ -205,7 +204,7 @@ Subject: [PATCH] MIPS: BCM63XX: remove leds and buttons
  };
  
  static struct board_info __initdata board_96348gw_11 = {
-@@ -332,35 +178,6 @@ static struct board_info __initdata boar
+@@ -324,35 +171,6 @@ static struct board_info __initdata boar
  	.has_ohci0 = 1,
  	.has_pccard = 1,
  	.has_ehci0 = 1,
@@ -241,11 +240,10 @@ Subject: [PATCH] MIPS: BCM63XX: remove leds and buttons
  };
  
  static struct board_info __initdata board_96348gw = {
-@@ -390,35 +207,6 @@ static struct board_info __initdata boar
+@@ -375,34 +193,6 @@ static struct board_info __initdata boar
- 		.ext_irq		= 2,
+ 
- 		.cs			= 2,
+ 	.has_ohci0 = 1,
- 	},
+ 
--
 -	.leds = {
 -		{
 -			.name		= "adsl-fail",
@@ -277,7 +275,7 @@ Subject: [PATCH] MIPS: BCM63XX: remove leds and buttons
  };
  
  static struct board_info __initdata board_FAST2404 = {
-@@ -534,33 +322,6 @@ static struct board_info __initdata boar
+@@ -518,33 +308,6 @@ static struct board_info __initdata boar
  	.has_ohci0 = 1,
  	.has_pccard = 1,
  	.has_ehci0 = 1,
@@ -311,7 +309,7 @@ Subject: [PATCH] MIPS: BCM63XX: remove leds and buttons
  };
  
  static struct board_info __initdata board_96358vw2 = {
-@@ -587,29 +348,6 @@ static struct board_info __initdata boar
+@@ -571,29 +334,6 @@ static struct board_info __initdata boar
  	.has_pccard = 1,
  	.has_ehci0 = 1,
  	.num_usbh_ports			= 2,

target/linux/brcm63xx/patches-4.14/413-BCM63XX-allow-providing-fixup-data-in-board-data.patch

@@ -39,15 +39,15 @@ Subject: [PATCH 58/72] BCM63XX: allow providing fixup data in board data
  
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -10,6 +10,7 @@
+@@ -9,6 +9,7 @@
+ #include <bcm63xx_dev_enet.h>
  #include <bcm63xx_dev_usb_usbd.h>
- #include <bcm63xx_dev_dsp.h>
  #include <bcm63xx_fallback_sprom.h>
 +#include <pci_ath9k_fixup.h>
  
  /*
   * flash mapping
-@@ -17,6 +18,11 @@
+@@ -16,6 +17,11 @@
  #define BCM963XX_CFE_VERSION_OFFSET	0x570
  #define BCM963XX_NVRAM_OFFSET		0x580
  
@@ -59,9 +59,9 @@ Subject: [PATCH 58/72] BCM63XX: allow providing fixup data in board data
  /*
   * board definition
   */
-@@ -35,6 +41,10 @@ struct board_info {
+@@ -33,6 +39,10 @@ struct board_info {
+ 	unsigned int	has_ehci0:1;
  	unsigned int	has_usbd:1;
- 	unsigned int	has_dsp:1;
  	unsigned int	use_fallback_sprom:1;
 +	unsigned int	has_caldata:2;
 +

target/linux/brcm63xx/patches-4.14/416-BCM63XX-add-a-fixup-for-ath9k-devices.patch

@@ -13,12 +13,14 @@ Subject: [PATCH 61/72] BCM63XX: add a fixup for ath9k devices
 
 --- a/arch/mips/bcm63xx/Makefile
 +++ b/arch/mips/bcm63xx/Makefile
-@@ -3,7 +3,7 @@ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o
+@@ -1,8 +1,8 @@
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+ # SPDX-License-Identifier: GPL-2.0
- 		   dev-pcmcia.o dev-rng.o \
+ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
--		   usb-common.o sprom.o
+-		   dev-rng.o dev-wdt.o dev-usb-ehci.o \
-+		   pci-ath9k-fixup.o usb-common.o sprom.o
+-		   dev-usb-ohci.o dev-usb-usbd.o usb-common.o sprom.o
++		   dev-rng.o dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o \
++		   dev-usb-usbd.o pci-ath9k-fixup.o usb-common.o sprom.o
  obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
  
  obj-y		+= boards/

target/linux/brcm63xx/patches-4.14/420-BCM63XX-add-endian-check-for-ath9k.patch

@@ -11,7 +11,7 @@
  #endif /* _PCI_ATH9K_FIXUP */
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -21,6 +21,7 @@
+@@ -20,6 +20,7 @@
  struct ath9k_caldata {
  	unsigned int	slot;
  	u32		caldata_offset;

target/linux/brcm63xx/patches-4.14/421-BCM63XX-add-led-pin-for-ath9k.patch

@@ -30,7 +30,7 @@
  		return;
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -22,6 +22,8 @@ struct ath9k_caldata {
+@@ -21,6 +21,8 @@ struct ath9k_caldata {
  	unsigned int	slot;
  	u32		caldata_offset;
  	unsigned int	endian_check:1;

target/linux/brcm63xx/patches-4.14/422-BCM63XX-add-a-fixup-for-rt2x00-devices.patch

@@ -17,12 +17,13 @@ Subject: [PATCH 72/72] 446-BCM63XX-add-a-fixup-for-rt2x00-devices
 
 --- a/arch/mips/bcm63xx/Makefile
 +++ b/arch/mips/bcm63xx/Makefile
-@@ -3,7 +3,7 @@ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o
+@@ -2,7 +2,8 @@
- 		   setup.o timer.o dev-dsp.o dev-enet.o dev-flash.o \
+ obj-y		+= clk.o cpu.o cs.o gpio.o irq.o nvram.o prom.o reset.o \
- 		   dev-pcmcia.o dev-rng.o \
+ 		   setup.o timer.o dev-enet.o dev-flash.o dev-pcmcia.o \
- 		   dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o dev-usb-usbd.o \
+ 		   dev-rng.o dev-wdt.o dev-usb-ehci.o dev-usb-ohci.o \
--		   pci-ath9k-fixup.o usb-common.o sprom.o
+-		   dev-usb-usbd.o pci-ath9k-fixup.o usb-common.o sprom.o
-+		   pci-ath9k-fixup.o pci-rt2x00-fixup.o usb-common.o sprom.o
++		   dev-usb-usbd.o pci-ath9k-fixup.o pci-rt2x00-fixup.o \
++		   usb-common.o sprom.o
  obj-$(CONFIG_EARLY_PRINTK)	+= early_printk.o
  
  obj-y		+= boards/
@@ -136,15 +137,15 @@ Subject: [PATCH 72/72] 446-BCM63XX-add-a-fixup-for-rt2x00-devices
 +
 --- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
 +++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
-@@ -11,6 +11,7 @@
+@@ -10,6 +10,7 @@
- #include <bcm63xx_dev_dsp.h>
+ #include <bcm63xx_dev_usb_usbd.h>
  #include <bcm63xx_fallback_sprom.h>
  #include <pci_ath9k_fixup.h>
 +#include <pci_rt2x00_fixup.h>
  
  /*
   * flash mapping
-@@ -18,12 +19,16 @@
+@@ -17,12 +18,16 @@
  #define BCM963XX_CFE_VERSION_OFFSET	0x570
  #define BCM963XX_NVRAM_OFFSET		0x580
  
@@ -162,7 +163,7 @@ Subject: [PATCH 72/72] 446-BCM63XX-add-a-fixup-for-rt2x00-devices
  };
  
  /*
-@@ -47,7 +52,7 @@ struct board_info {
+@@ -45,7 +50,7 @@ struct board_info {
  	unsigned int	has_caldata:2;
  
  	/* wifi calibration data config */

target/linux/brcm63xx/patches-4.14/427-boards_probe_switch.patch

@@ -27,7 +27,7 @@
  		.force_speed_100	= 1,
  		.force_duplex_full	= 1,
  	},
-@@ -170,6 +176,8 @@ static struct board_info __initdata boar
+@@ -163,6 +169,8 @@ static struct board_info __initdata boar
  	},
  
  	.enet1 = {
@@ -36,7 +36,7 @@
  		.force_speed_100	= 1,
  		.force_duplex_full	= 1,
  	},
-@@ -194,6 +202,8 @@ static struct board_info __initdata boar
+@@ -187,6 +195,8 @@ static struct board_info __initdata boar
  		.use_internal_phy	= 1,
  	},
  	.enet1 = {
@@ -45,7 +45,7 @@
  		.force_speed_100	= 1,
  		.force_duplex_full	= 1,
  	},
-@@ -224,6 +234,8 @@ static struct board_info __initdata boar
+@@ -210,6 +220,8 @@ static struct board_info __initdata boar
  	},
  
  	.enet1 = {
@@ -54,7 +54,7 @@
  		.force_speed_100	= 1,
  		.force_duplex_full	= 1,
  	},
-@@ -247,6 +259,8 @@ static struct board_info __initdata boar
+@@ -233,6 +245,8 @@ static struct board_info __initdata boar
  		.use_internal_phy	= 1,
  	},
  	.enet1 = {
@@ -63,7 +63,7 @@
  		.force_speed_100	= 1,
  		.force_duplex_full	= 1,
  	},
-@@ -268,6 +282,8 @@ static struct board_info __initdata boar
+@@ -254,6 +268,8 @@ static struct board_info __initdata boar
  		.use_internal_phy	= 1,
  	},
  	.enet1 = {
@@ -72,7 +72,7 @@
  		.force_speed_100	= 1,
  		.force_duplex_full	= 1,
  	},
-@@ -287,6 +303,8 @@ static struct board_info __initdata boar
+@@ -273,6 +289,8 @@ static struct board_info __initdata boar
  		.use_internal_phy	= 1,
  	},
  	.enet1 = {
@@ -81,7 +81,7 @@
  		.force_speed_100	= 1,
  		.force_duplex_full	= 1,
  	},
-@@ -314,6 +332,8 @@ static struct board_info __initdata boar
+@@ -300,6 +318,8 @@ static struct board_info __initdata boar
  	},
  
  	.enet1 = {
@@ -90,7 +90,7 @@
  		.force_speed_100	= 1,
  		.force_duplex_full	= 1,
  	},
-@@ -339,6 +359,8 @@ static struct board_info __initdata boar
+@@ -325,6 +345,8 @@ static struct board_info __initdata boar
  	},
  
  	.enet1 = {
@@ -99,7 +99,7 @@
  		.force_speed_100	= 1,
  		.force_duplex_full	= 1,
  	},
-@@ -364,6 +386,8 @@ static struct board_info __initdata boar
+@@ -350,6 +372,8 @@ static struct board_info __initdata boar
  	},
  
  	.enet1 = {
@@ -108,7 +108,7 @@
  		.force_speed_100	= 1,
  		.force_duplex_full	= 1,
  	},
-@@ -387,6 +411,8 @@ static struct board_info __initdata boar
+@@ -373,6 +397,8 @@ static struct board_info __initdata boar
  	},
  
  	.enet1 = {

target/linux/brcm63xx/patches-4.14/499-allow_better_context_for_board_patches.patch

@@ -36,7 +36,7 @@
  
  /*
   * known 6348 boards
-@@ -311,7 +311,7 @@ static struct board_info __initdata boar
+@@ -297,7 +297,7 @@ static struct board_info __initdata boar
  
  	.has_ohci0 = 1,
  };
@@ -45,7 +45,7 @@
  
  /*
   * known 6358 boards
-@@ -419,7 +419,7 @@ static struct board_info __initdata boar
+@@ -405,7 +405,7 @@ static struct board_info __initdata boar
  
  	.has_ohci0			= 1,
  };

target/linux/brcm63xx/patches-4.14/500-board-D4PW.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -311,6 +311,21 @@ static struct board_info __initdata boar
+@@ -297,6 +297,21 @@ static struct board_info __initdata boar
  
  	.has_ohci0 = 1,
  };
@@ -22,7 +22,7 @@
  #endif /* CONFIG_BCM63XX_CPU_6348 */
  
  /*
-@@ -447,6 +462,7 @@ static const struct board_info __initcon
+@@ -433,6 +448,7 @@ static const struct board_info __initcon
  	&board_DV201AMR,
  	&board_96348gw_a,
  	&board_rta1025w_16,
@@ -30,7 +30,7 @@
  #endif
  
  #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -478,6 +494,7 @@ static struct of_device_id const bcm963x
+@@ -464,6 +480,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "brcm,bcm96348gw-10", .data = &board_96348gw_10, },
  	{ .compatible = "brcm,bcm96348gw-11", .data = &board_96348gw_11, },
  	{ .compatible = "brcm,bcm96348gw-a", .data = &board_96348gw_a, },

target/linux/brcm63xx/patches-4.14/501-board-NB4.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -434,6 +434,60 @@ static struct board_info __initdata boar
+@@ -420,6 +420,60 @@ static struct board_info __initdata boar
  
  	.has_ohci0			= 1,
  };
@@ -61,7 +61,7 @@
  #endif /* CONFIG_BCM63XX_CPU_6358 */
  
  /*
-@@ -470,6 +524,8 @@ static const struct board_info __initcon
+@@ -456,6 +510,8 @@ static const struct board_info __initcon
  	&board_96358vw2,
  	&board_AGPFS0,
  	&board_DWVS0,
@@ -70,7 +70,7 @@
  #endif
  };
  
-@@ -511,6 +567,8 @@ static struct of_device_id const bcm963x
+@@ -497,6 +553,8 @@ static struct of_device_id const bcm963x
  	{ .compatible = "pirelli,a226m", .data = &board_DWVS0, },
  	{ .compatible = "pirelli,a226m-fwb", .data = &board_DWVS0, },
  	{ .compatible = "pirelli,agpf-s0", .data = &board_AGPFS0, },

target/linux/brcm63xx/patches-4.14/502-board-96338W2_E7T.patch

@@ -21,7 +21,7 @@
  #endif /* CONFIG_BCM63XX_CPU_6338 */
  
  /*
-@@ -503,6 +517,7 @@ static const struct board_info __initcon
+@@ -489,6 +503,7 @@ static const struct board_info __initcon
  #ifdef CONFIG_BCM63XX_CPU_6338
  	&board_96338gw,
  	&board_96338w,
@@ -29,7 +29,7 @@
  #endif
  #ifdef CONFIG_BCM63XX_CPU_6345
  	&board_96345gw2,
-@@ -540,6 +555,7 @@ static struct of_device_id const bcm963x
+@@ -526,6 +541,7 @@ static struct of_device_id const bcm963x
  #ifdef CONFIG_BCM63XX_CPU_6338
  	{ .compatible = "brcm,bcm96338gw", .data = &board_96338gw, },
  	{ .compatible = "brcm,bcm96338w", .data = &board_96338w, },

target/linux/brcm63xx/patches-4.14/503-board-CPVA642.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -401,6 +401,25 @@ static struct board_info __initdata boar
+@@ -387,6 +387,25 @@ static struct board_info __initdata boar
  	.num_usbh_ports			= 2,
  };
  
@@ -26,7 +26,7 @@
  static struct board_info __initdata board_AGPFS0 = {
  	.name				= "AGPF-S0",
  	.expected_cpu_id		= 0x6358,
-@@ -538,6 +557,7 @@ static const struct board_info __initcon
+@@ -524,6 +543,7 @@ static const struct board_info __initcon
  	&board_96358vw,
  	&board_96358vw2,
  	&board_AGPFS0,
@@ -34,7 +34,7 @@
  	&board_DWVS0,
  	&board_nb4_ser_r0,
  	&board_nb4_fxc_r1,
-@@ -585,6 +605,7 @@ static struct of_device_id const bcm963x
+@@ -571,6 +591,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "pirelli,agpf-s0", .data = &board_AGPFS0, },
  	{ .compatible = "sfr,nb4-ser-r0", .data = &board_nb4_ser_r0, },
  	{ .compatible = "sfr,nb4-fxc-r1", .data = &board_nb4_fxc_r1, },

target/linux/brcm63xx/patches-4.14/504-board_dsl_274xb_rev_c.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -468,6 +468,22 @@ static struct board_info __initdata boar
+@@ -454,6 +454,22 @@ static struct board_info __initdata boar
  	.has_ohci0			= 1,
  };
  
@@ -23,7 +23,7 @@
  static struct board_info __initdata board_nb4_ser_r0 = {
  	.name				= "NB4-SER-r0",
  	.expected_cpu_id		= 0x6358,
-@@ -559,6 +575,7 @@ static const struct board_info __initcon
+@@ -545,6 +561,7 @@ static const struct board_info __initcon
  	&board_AGPFS0,
  	&board_CPVA642,
  	&board_DWVS0,
@@ -31,7 +31,7 @@
  	&board_nb4_ser_r0,
  	&board_nb4_fxc_r1,
  #endif
-@@ -598,6 +615,7 @@ static struct of_device_id const bcm963x
+@@ -584,6 +601,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "alcatel,rg100a", .data = &board_96358vw2, },
  	{ .compatible = "brcm,bcm96358vw", .data = &board_96358vw, },
  	{ .compatible = "brcm,bcm96358vw2", .data = &board_96358vw2, },

target/linux/brcm63xx/patches-4.14/505-board_spw500v.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -340,6 +340,44 @@ static struct board_info __initdata boar
+@@ -326,6 +326,44 @@ static struct board_info __initdata boar
  		.force_duplex_full	= 1,
  	},
  };
@@ -45,7 +45,7 @@
  #endif /* CONFIG_BCM63XX_CPU_6348 */
  
  /*
-@@ -567,6 +605,7 @@ static const struct board_info __initcon
+@@ -553,6 +591,7 @@ static const struct board_info __initcon
  	&board_96348gw_a,
  	&board_rta1025w_16,
  	&board_96348_D4PW,
@@ -53,7 +53,7 @@
  #endif
  
  #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -608,6 +647,7 @@ static struct of_device_id const bcm963x
+@@ -594,6 +633,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "dynalink,rta1025w", .data = &board_rta1025w_16, },
  	{ .compatible = "netgear,dg834gtpn", .data = &board_96348gw_10, },
  	{ .compatible = "sagem,f@st2404", .data = &board_FAST2404, },

target/linux/brcm63xx/patches-4.14/506-board_gw6200_gw6000.patch

@@ -1,7 +1,7 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -233,6 +233,64 @@ static struct board_info __initdata boar
+@@ -219,6 +219,64 @@ static struct board_info __initdata boar
- 	},
+ 
  };
  
 +static struct board_info __initdata board_gw6200 = {
@@ -65,7 +65,7 @@
  static struct board_info __initdata board_FAST2404 = {
  	.name				= "F@ST2404",
  	.expected_cpu_id		= 0x6348,
-@@ -598,6 +656,8 @@ static const struct board_info __initcon
+@@ -584,6 +642,8 @@ static const struct board_info __initcon
  #ifdef CONFIG_BCM63XX_CPU_6348
  	&board_96348r,
  	&board_96348gw,
@@ -74,7 +74,7 @@
  	&board_96348gw_10,
  	&board_96348gw_11,
  	&board_FAST2404,
-@@ -648,6 +708,8 @@ static struct of_device_id const bcm963x
+@@ -634,6 +694,8 @@ static struct of_device_id const bcm963x
  	{ .compatible = "netgear,dg834gtpn", .data = &board_96348gw_10, },
  	{ .compatible = "sagem,f@st2404", .data = &board_FAST2404, },
  	{ .compatible = "t-com,spw500v", .data = &board_spw500v, },

target/linux/brcm63xx/patches-4.14/507-board-MAGIC.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -436,6 +436,39 @@ static struct board_info __initdata boar
+@@ -422,6 +422,39 @@ static struct board_info __initdata boar
  		.num_board_fixups	= ARRAY_SIZE(spw500v_fixups),
  	},
  };
@@ -40,7 +40,7 @@
  #endif /* CONFIG_BCM63XX_CPU_6348 */
  
  /*
-@@ -666,6 +699,7 @@ static const struct board_info __initcon
+@@ -652,6 +685,7 @@ static const struct board_info __initcon
  	&board_rta1025w_16,
  	&board_96348_D4PW,
  	&board_spw500v,
@@ -48,7 +48,7 @@
  #endif
  
  #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -710,6 +744,7 @@ static struct of_device_id const bcm963x
+@@ -696,6 +730,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "t-com,spw500v", .data = &board_spw500v, },
  	{ .compatible = "tecom,gw6000", .data = &board_gw6000, },
  	{ .compatible = "tecom,gw6200", .data = &board_gw6200, },

target/linux/brcm63xx/patches-4.14/508-board_hw553.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -666,6 +666,32 @@ static struct board_info __initdata boar
+@@ -652,6 +652,32 @@ static struct board_info __initdata boar
  	.has_ehci0 = 1,
  	.num_usbh_ports			= 2,
  };
@@ -33,7 +33,7 @@
  #endif /* CONFIG_BCM63XX_CPU_6358 */
  
  /*
-@@ -711,6 +737,7 @@ static const struct board_info __initcon
+@@ -697,6 +723,7 @@ static const struct board_info __initcon
  	&board_dsl_274xb_rev_c,
  	&board_nb4_ser_r0,
  	&board_nb4_fxc_r1,
@@ -41,7 +41,7 @@
  #endif
  };
  
-@@ -754,6 +781,7 @@ static struct of_device_id const bcm963x
+@@ -740,6 +767,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "brcm,bcm96358vw2", .data = &board_96358vw2, },
  	{ .compatible = "d-link,dsl-274xb-c2", .data = &board_dsl_274xb_rev_c, },
  	{ .compatible = "d-link,dsl-2650u", .data = &board_96358vw2, },

target/linux/brcm63xx/patches-4.14/509-board_rta1320_16m.patch

@@ -21,7 +21,7 @@
  #endif /* CONFIG_BCM63XX_CPU_6338 */
  
  /*
-@@ -708,6 +722,7 @@ static const struct board_info __initcon
+@@ -694,6 +708,7 @@ static const struct board_info __initcon
  	&board_96338gw,
  	&board_96338w,
  	&board_96338w2_e7t,
@@ -29,7 +29,7 @@
  #endif
  #ifdef CONFIG_BCM63XX_CPU_6345
  	&board_96345gw2,
-@@ -752,6 +767,7 @@ static struct of_device_id const bcm963x
+@@ -738,6 +753,7 @@ static struct of_device_id const bcm963x
  #ifdef CONFIG_BCM63XX_CPU_6338
  	{ .compatible = "brcm,bcm96338gw", .data = &board_96338gw, },
  	{ .compatible = "brcm,bcm96338w", .data = &board_96338w, },

target/linux/brcm63xx/patches-4.14/510-board_spw303v.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -706,6 +706,20 @@ static struct board_info __initdata boar
+@@ -692,6 +692,20 @@ static struct board_info __initdata boar
  		.pci_dev			= 1,
  	},
  };
@@ -21,7 +21,7 @@
  #endif /* CONFIG_BCM63XX_CPU_6358 */
  
  /*
-@@ -753,6 +767,7 @@ static const struct board_info __initcon
+@@ -739,6 +753,7 @@ static const struct board_info __initcon
  	&board_nb4_ser_r0,
  	&board_nb4_fxc_r1,
  	&board_HW553,
@@ -29,7 +29,7 @@
  #endif
  };
  
-@@ -804,6 +819,7 @@ static struct of_device_id const bcm963x
+@@ -790,6 +805,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "pirelli,agpf-s0", .data = &board_AGPFS0, },
  	{ .compatible = "sfr,nb4-ser-r0", .data = &board_nb4_ser_r0, },
  	{ .compatible = "sfr,nb4-fxc-r1", .data = &board_nb4_fxc_r1, },

target/linux/brcm63xx/patches-4.14/511-board_V2500V.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -483,6 +483,26 @@ static struct board_info __initdata boar
+@@ -469,6 +469,26 @@ static struct board_info __initdata boar
  		.ext_irq		= 2,
  	},
  };
@@ -27,7 +27,7 @@
  #endif /* CONFIG_BCM63XX_CPU_6348 */
  
  /*
-@@ -755,6 +775,7 @@ static const struct board_info __initcon
+@@ -741,6 +761,7 @@ static const struct board_info __initcon
  	&board_96348_D4PW,
  	&board_spw500v,
  	&board_96348sv,
@@ -35,7 +35,7 @@
  #endif
  
  #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -794,6 +815,7 @@ static struct of_device_id const bcm963x
+@@ -780,6 +801,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "brcm,bcm96348gw-10", .data = &board_96348gw_10, },
  	{ .compatible = "brcm,bcm96348gw-11", .data = &board_96348gw_11, },
  	{ .compatible = "brcm,bcm96348gw-a", .data = &board_96348gw_a, },
@@ -43,7 +43,7 @@
  	{ .compatible = "d-link,dsl-2640b-b", .data = &board_96348_D4PW, },
  	{ .compatible = "davolink,dv-201amr", .data = &board_DV201AMR, },
  	{ .compatible = "dynalink,rta1025w", .data = &board_rta1025w_16, },
-@@ -853,6 +875,22 @@ void __init board_bcm963xx_init(void)
+@@ -839,6 +861,22 @@ void __init board_bcm963xx_init(void)
  		val &= MPI_CSBASE_BASE_MASK;
  	}
  	boot_addr = (u8 *)KSEG1ADDR(val);

target/linux/brcm63xx/patches-4.14/512-board_BTV2110.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -216,6 +216,24 @@ static struct board_info __initdata boar
+@@ -209,6 +209,24 @@ static struct board_info __initdata boar
  	.has_ehci0 = 1,
  };
  
@@ -25,7 +25,7 @@
  static struct board_info __initdata board_96348gw = {
  	.name				= "96348GW",
  	.expected_cpu_id		= 0x6348,
-@@ -776,6 +794,7 @@ static const struct board_info __initcon
+@@ -762,6 +780,7 @@ static const struct board_info __initcon
  	&board_spw500v,
  	&board_96348sv,
  	&board_V2500V_BB,
@@ -33,7 +33,7 @@
  #endif
  
  #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -815,6 +834,7 @@ static struct of_device_id const bcm963x
+@@ -801,6 +820,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "brcm,bcm96348gw-10", .data = &board_96348gw_10, },
  	{ .compatible = "brcm,bcm96348gw-11", .data = &board_96348gw_11, },
  	{ .compatible = "brcm,bcm96348gw-a", .data = &board_96348gw_a, },

target/linux/brcm63xx/patches-4.14/514-board_ct536_ct5621.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -234,6 +234,33 @@ static struct board_info __initdata boar
+@@ -227,6 +227,33 @@ static struct board_info __initdata boar
  };
  
  
@@ -34,7 +34,7 @@
  static struct board_info __initdata board_96348gw = {
  	.name				= "96348GW",
  	.expected_cpu_id		= 0x6348,
-@@ -795,6 +822,7 @@ static const struct board_info __initcon
+@@ -781,6 +808,7 @@ static const struct board_info __initcon
  	&board_96348sv,
  	&board_V2500V_BB,
  	&board_V2110,
@@ -42,7 +42,7 @@
  #endif
  
  #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -836,6 +864,8 @@ static struct of_device_id const bcm963x
+@@ -822,6 +850,8 @@ static struct of_device_id const bcm963x
  	{ .compatible = "brcm,bcm96348gw-a", .data = &board_96348gw_a, },
  	{ .compatible = "bt,v2110", .data = &board_V2110, },
  	{ .compatible = "bt,v2500v-bb", .data = &board_V2500V_BB, },

target/linux/brcm63xx/patches-4.14/515-board_DWV-S0_fixes.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -674,6 +674,7 @@ static struct board_info __initdata boar
+@@ -660,6 +660,7 @@ static struct board_info __initdata boar
  	},
  
  	.has_ohci0			= 1,

target/linux/brcm63xx/patches-4.14/516-board_96348A-122.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -261,6 +261,30 @@ static struct board_info __initdata boar
+@@ -254,6 +254,30 @@ static struct board_info __initdata boar
  	},
  };
  
@@ -31,7 +31,7 @@
  static struct board_info __initdata board_96348gw = {
  	.name				= "96348GW",
  	.expected_cpu_id		= 0x6348,
-@@ -824,6 +848,7 @@ static const struct board_info __initcon
+@@ -810,6 +834,7 @@ static const struct board_info __initcon
  	&board_V2500V_BB,
  	&board_V2110,
  	&board_ct536_ct5621,
@@ -39,7 +39,7 @@
  #endif
  
  #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -866,6 +891,7 @@ static struct of_device_id const bcm963x
+@@ -852,6 +877,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "bt,v2110", .data = &board_V2110, },
  	{ .compatible = "bt,v2500v-bb", .data = &board_V2500V_BB, },
  	{ .compatible = "comtrend,ct-536+", .data = &board_ct536_ct5621, },

target/linux/brcm63xx/patches-4.14/519_board_CPVA502plus.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -233,6 +233,33 @@ static struct board_info __initdata boar
+@@ -226,6 +226,33 @@ static struct board_info __initdata boar
  	},
  };
  
@@ -34,7 +34,7 @@
  
  static struct board_info __initdata board_ct536_ct5621 = {
  	.name				= "CT536_CT5621",
-@@ -849,6 +876,7 @@ static const struct board_info __initcon
+@@ -835,6 +862,7 @@ static const struct board_info __initcon
  	&board_V2110,
  	&board_ct536_ct5621,
  	&board_96348A_122,
@@ -42,7 +42,7 @@
  #endif
  
  #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -901,6 +929,7 @@ static struct of_device_id const bcm963x
+@@ -887,6 +915,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "t-com,spw500v", .data = &board_spw500v, },
  	{ .compatible = "tecom,gw6000", .data = &board_gw6000, },
  	{ .compatible = "tecom,gw6200", .data = &board_gw6200, },

target/linux/brcm63xx/patches-4.14/520-bcm63xx-add-support-for-96368MVWG-board.patch

@@ -10,7 +10,7 @@ Subject: [PATCH 32/63] bcm63xx: add support for 96368MVWG board.
 
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -840,6 +840,58 @@ static struct board_info __initdata boar
+@@ -826,6 +826,58 @@ static struct board_info __initdata boar
  #endif /* CONFIG_BCM63XX_CPU_6358 */
  
  /*
@@ -69,7 +69,7 @@ Subject: [PATCH 32/63] bcm63xx: add support for 96368MVWG board.
   * all boards
   */
  static const struct board_info __initconst *bcm963xx_boards[] = {
-@@ -891,6 +943,10 @@ static const struct board_info __initcon
+@@ -877,6 +929,10 @@ static const struct board_info __initcon
  	&board_HW553,
  	&board_spw303v,
  #endif
@@ -80,7 +80,7 @@ Subject: [PATCH 32/63] bcm63xx: add support for 96368MVWG board.
  };
  
  static struct of_device_id const bcm963xx_boards_dt[] = {
-@@ -951,6 +1007,7 @@ static struct of_device_id const bcm963x
+@@ -937,6 +993,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "telsey,cpva642", .data = &board_CPVA642, },
  #endif
  #ifdef CONFIG_BCM63XX_CPU_6368

target/linux/brcm63xx/patches-4.14/521-bcm63xx-add-support-for-96368MVNgr-board.patch

@@ -9,7 +9,7 @@ Subject: [PATCH 33/63] bcm63xx: add support for 96368MVNgr board.
 
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -889,6 +889,45 @@ static struct board_info __initdata boar
+@@ -875,6 +875,45 @@ static struct board_info __initdata boar
  	.has_ohci0 = 1,
  	.has_ehci0 = 1,
  };
@@ -55,7 +55,7 @@ Subject: [PATCH 33/63] bcm63xx: add support for 96368MVNgr board.
  #endif /* CONFIG_BCM63XX_CPU_6368 */
  
  /*
-@@ -946,6 +985,7 @@ static const struct board_info __initcon
+@@ -932,6 +971,7 @@ static const struct board_info __initcon
  
  #ifdef CONFIG_BCM63XX_CPU_6368
  	&board_96368mvwg,
@@ -63,7 +63,7 @@ Subject: [PATCH 33/63] bcm63xx: add support for 96368MVNgr board.
  #endif
  };
  
-@@ -1007,6 +1047,7 @@ static struct of_device_id const bcm963x
+@@ -993,6 +1033,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "telsey,cpva642", .data = &board_CPVA642, },
  #endif
  #ifdef CONFIG_BCM63XX_CPU_6368

target/linux/brcm63xx/patches-4.14/523-MIPS-BCM63XX-add-963281TAN-reference-board.patch

@@ -50,7 +50,7 @@ Subject: [PATCH] MIPS: BCM63XX: add 963281TAN reference board
  #endif /* CONFIG_BCM63XX_CPU_6328 */
  
  /*
-@@ -966,6 +1000,7 @@ static const struct board_info __initcon
+@@ -952,6 +986,7 @@ static const struct board_info __initcon
  #endif
  #ifdef CONFIG_BCM63XX_CPU_6328
  	&board_96328avng,
@@ -58,7 +58,7 @@ Subject: [PATCH] MIPS: BCM63XX: add 963281TAN reference board
  #endif
  #ifdef CONFIG_BCM63XX_CPU_6338
  	&board_96338gw,
-@@ -1022,6 +1057,7 @@ static struct of_device_id const bcm963x
+@@ -1008,6 +1043,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "netgear,cvg834g", .data = &board_cvg834g, },
  #endif
  #ifdef CONFIG_BCM63XX_CPU_6328

target/linux/brcm63xx/patches-4.14/524-board_dsl_274xb_rev_f.patch

@@ -62,7 +62,7 @@ Subject: [PATCH 70/79] MIPS: BCM63XX: Add board definition for D-Link
  #endif /* CONFIG_BCM63XX_CPU_6328 */
  
  /*
-@@ -1001,6 +1046,7 @@ static const struct board_info __initcon
+@@ -987,6 +1032,7 @@ static const struct board_info __initcon
  #ifdef CONFIG_BCM63XX_CPU_6328
  	&board_96328avng,
  	&board_963281TAN,
@@ -70,7 +70,7 @@ Subject: [PATCH 70/79] MIPS: BCM63XX: Add board definition for D-Link
  #endif
  #ifdef CONFIG_BCM63XX_CPU_6338
  	&board_96338gw,
-@@ -1059,6 +1105,7 @@ static struct of_device_id const bcm963x
+@@ -1045,6 +1091,7 @@ static struct of_device_id const bcm963x
  #ifdef CONFIG_BCM63XX_CPU_6328
  	{ .compatible = "brcm,bcm963281TAN", .data = &board_963281TAN, },
  	{ .compatible = "brcm,bcm96328avng", .data = &board_96328avng, },

target/linux/brcm63xx/patches-4.14/525-board_96348w3.patch

@@ -1,6 +1,6 @@
 --- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
 +++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
-@@ -600,6 +600,24 @@ static struct board_info __initdata boar
+@@ -586,6 +586,24 @@ static struct board_info __initdata boar
  	.has_ohci0 = 1,
  };
  
@@ -25,7 +25,7 @@
  static struct board_info __initdata board_96348_D4PW = {
  	.name				= "D-4P-W",
  	.expected_cpu_id		= 0x6348,
-@@ -1076,6 +1094,7 @@ static const struct board_info __initcon
+@@ -1062,6 +1080,7 @@ static const struct board_info __initcon
  	&board_ct536_ct5621,
  	&board_96348A_122,
  	&board_CPVA502plus,
@@ -33,7 +33,7 @@
  #endif
  
  #ifdef CONFIG_BCM63XX_CPU_6358
-@@ -1131,6 +1150,7 @@ static struct of_device_id const bcm963x
+@@ -1117,6 +1136,7 @@ static struct of_device_id const bcm963x
  	{ .compatible = "davolink,dv-201amr", .data = &board_DV201AMR, },
  	{ .compatible = "dynalink,rta1025w", .data = &board_rta1025w_16, },
  	{ .compatible = "netgear,dg834gtpn", .data = &board_96348gw_10, },