Merge Official Source

2025-01-07 01:53:34 +08:00 · 2020-06-23 12:25:46 +08:00 · 2020-06-23 12:25:46 +08:00 · 6b8a947896
commit 6b8a947896
parent 34eb0d9cc1 3f27a6e640
52 changed files with 330 additions and 3843 deletions
--- a/feeds.conf.default
+++ b/feeds.conf.default
@ -1,4 +1,4 @@
 src-git packages https://github.com/project-openwrt/packages.git
 src-git luci https://github.com/project-openwrt/luci.git
-src-git routing https://github.com/project-openwrt/routing.git
-src-git telephony https://git.openwrt.org/feed/telephony.git
+src-git routing https://github.com/openwrt-routing/packages.git
+src-git telephony https://github.com/openwrt/telephony.git
--- a/include/kernel-version.mk
+++ b/include/kernel-version.mk
@ -8,11 +8,11 @@ endif

 LINUX_VERSION-4.14 = .180
 LINUX_VERSION-4.19 = .123
-LINUX_VERSION-5.4 = .46
+LINUX_VERSION-5.4 = .48

 LINUX_KERNEL_HASH-4.14.180 = 444ef973d9b6a6ea174e4a9086f0aea980d8575d13302e431ad688f22e27ed0e
 LINUX_KERNEL_HASH-4.19.123 = a79914d31a8d8c6b0e2bb0f2b143d615fe8a6c4dd2e0f36e97aa20efd69a993f
-LINUX_KERNEL_HASH-5.4.46 = 30074ff2f1a2498da391fad73fc0efaa2256416a08fff8835069b1c59ab31b8e
+LINUX_KERNEL_HASH-5.4.48 = bf20ddafcd04c114d34654bb10d1eb74f1864f3d14b676c6f0d42d60bbcf1d53

 remove_uri_prefix=$(subst git://,,$(subst http://,,$(subst https://,,$(1))))
 sanitize_uri=$(call qstrip,$(subst @,_,$(subst :,_,$(subst .,_,$(subst -,_,$(subst /,_,$(1)))))))
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=dropbear
-PKG_VERSION:=2019.78
-PKG_RELEASE:=5
+PKG_VERSION:=2020.79
+PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
 	http://matt.ucc.asn.au/dropbear/releases/ \
 	https://dropbear.nl/mirror/releases/
-PKG_HASH:=525965971272270995364a0eb01f35180d793182e63dd0b0c3eb0292291644a4
+PKG_HASH:=084f00546b1610a3422a0773e2c04cbe1a220d984209e033b548b49f379cc441

 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
@ -124,8 +124,7 @@ define Build/Configure

 	# disable legacy/unsafe methods and unused functionality
 	for OPTION in INETD_MODE DROPBEAR_CLI_NETCAT \
-	DROPBEAR_3DES DROPBEAR_DSS DROPBEAR_ENABLE_CBC_MODE \
-	DROPBEAR_SHA1_96_HMAC DROPBEAR_USE_PASSWORD_ENV; do \
+	DROPBEAR_DSS DROPBEAR_USE_PASSWORD_ENV DO_MOTD ; do \
 		echo "#define $$$$OPTION 0" >> \
 			$(PKG_BUILD_DIR)/localoptions.h; \
 	done
--- a/package/network/services/dropbear/patches/010-backport-change-address-logging.patch
+++ b/package/network/services/dropbear/patches/010-backport-change-address-logging.patch
@ -1,119 +0,0 @@
-From c153b3612b7c9f24a0f5af43618a646545ed6e22 Mon Sep 17 00:00:00 2001
-From: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
-Date: Mon, 30 Sep 2019 12:42:13 +0100
-Subject: [PATCH] Improve address logging on early exit messages
-
-Change 'Early exit' and 'Exit before auth' messages to include the IP
-address & port as part of the message.
-
-This allows log scanning utilities such as 'fail2ban' to obtain the
-offending IP address as part of the failure event instead of extracting
-the PID from the message and then scanning the log again for match
-'child connection from' messages
-
-Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
---
- svr-auth.c    | 18 +++++++-----------
- svr-session.c | 20 ++++++++++++++------
- 2 files changed, 21 insertions(+), 17 deletions(-)
-
--- a/svr-auth.c
-+++ b/svr-auth.c
-@@ -241,8 +241,7 @@ static int checkusername(const char *use
- 	}
- 
- 	if (strlen(username) != userlen) {
-		dropbear_exit("Attempted username with a null byte from %s",
-			svr_ses.addrstring);
-+		dropbear_exit("Attempted username with a null byte");
- 	}
- 
- 	if (ses.authstate.username == NULL) {
-@@ -252,8 +251,7 @@ static int checkusername(const char *use
- 	} else {
- 		/* check username hasn't changed */
- 		if (strcmp(username, ses.authstate.username) != 0) {
-			dropbear_exit("Client trying multiple usernames from %s",
-				svr_ses.addrstring);
-+			dropbear_exit("Client trying multiple usernames");
- 		}
- 	}
- 
-@@ -268,8 +266,7 @@ static int checkusername(const char *use
- 	if (!ses.authstate.pw_name) {
- 		TRACE(("leave checkusername: user '%s' doesn't exist", username))
- 		dropbear_log(LOG_WARNING,
-				"Login attempt for nonexistent user from %s",
-				svr_ses.addrstring);
-+				"Login attempt for nonexistent user");
- 		ses.authstate.checkusername_failed = 1;
- 		return DROPBEAR_FAILURE;
- 	}
-@@ -279,9 +276,8 @@ static int checkusername(const char *use
- 	if (!(DROPBEAR_SVR_MULTIUSER && uid == 0) && uid != ses.authstate.pw_uid) {
- 		TRACE(("running as nonroot, only server uid is allowed"))
- 		dropbear_log(LOG_WARNING,
-				"Login attempt with wrong user %s from %s",
-				ses.authstate.pw_name,
-				svr_ses.addrstring);
-+				"Login attempt with wrong user %s",
-+				ses.authstate.pw_name);
- 		ses.authstate.checkusername_failed = 1;
- 		return DROPBEAR_FAILURE;
- 	}
-@@ -440,8 +436,8 @@ void send_msg_userauth_failure(int parti
- 		} else {
- 			userstr = ses.authstate.pw_name;
- 		}
-		dropbear_exit("Max auth tries reached - user '%s' from %s",
-				userstr, svr_ses.addrstring);
-+		dropbear_exit("Max auth tries reached - user '%s'",
-+				userstr);
- 	}
- 	
- 	TRACE(("leave send_msg_userauth_failure"))
--- a/svr-session.c
-+++ b/svr-session.c
-@@ -149,28 +149,36 @@ void svr_session(int sock, int childpipe
- void svr_dropbear_exit(int exitcode, const char* format, va_list param) {
- 	char exitmsg[150];
- 	char fullmsg[300];
-+	char fromaddr[60];
- 	int i;
- 
- 	/* Render the formatted exit message */
- 	vsnprintf(exitmsg, sizeof(exitmsg), format, param);
- 
-+	/* svr_ses.addrstring may not be set for some early exits, or for
-+	the listener process */
-+	fromaddr[0] = '\0';
-+	if (svr_ses.addrstring) {
-+	    snprintf(fromaddr, sizeof(fromaddr), " from <%s>", svr_ses.addrstring);
-+    }
-+
- 	/* Add the prefix depending on session/auth state */
- 	if (!ses.init_done) {
- 		/* before session init */
-		snprintf(fullmsg, sizeof(fullmsg), "Early exit: %s", exitmsg);
-+		snprintf(fullmsg, sizeof(fullmsg), "Early exit%s: %s", fromaddr, exitmsg);
- 	} else if (ses.authstate.authdone) {
- 		/* user has authenticated */
- 		snprintf(fullmsg, sizeof(fullmsg),
-				"Exit (%s): %s", 
-				ses.authstate.pw_name, exitmsg);
-+				"Exit (%s)%s: %s", 
-+				ses.authstate.pw_name, fromaddr, exitmsg);
- 	} else if (ses.authstate.pw_name) {
- 		/* we have a potential user */
- 		snprintf(fullmsg, sizeof(fullmsg), 
-				"Exit before auth (user '%s', %u fails): %s",
-				ses.authstate.pw_name, ses.authstate.failcount, exitmsg);
-+				"Exit before auth%s: (user '%s', %u fails): %s",
-+				fromaddr, ses.authstate.pw_name, ses.authstate.failcount, exitmsg);
- 	} else {
- 		/* before userauth */
-		snprintf(fullmsg, sizeof(fullmsg), "Exit before auth: %s", exitmsg);
-+		snprintf(fullmsg, sizeof(fullmsg), "Exit before auth%s: %s", fromaddr, exitmsg);
- 	}
- 
- 	dropbear_log(LOG_INFO, "%s", fullmsg);
--- a/package/network/services/dropbear/patches/010-backport-disable-toom-and-karatsuba.patch
+++ b/package/network/services/dropbear/patches/010-backport-disable-toom-and-karatsuba.patch
@ -0,0 +1,17 @@
+From: Matt Johnston <matt@ucc.asn.au>
+Date: Thu, 18 Jun 2020 19:12:07 +0800
+Subject: Disable toom and karatsuba for new libtommath
+
+--- a/libtommath/tommath_class.h
+++ b/libtommath/tommath_class.h
+@@ -1312,6 +1312,10 @@
+ #undef BN_MP_KARATSUBA_SQR_C
+ #undef BN_MP_TOOM_MUL_C
+ #undef BN_MP_TOOM_SQR_C
+#undef BN_S_MP_KARATSUBA_MUL_C
+#undef BN_S_MP_KARATSUBA_SQR_C
+#undef BN_S_MP_TOOM_MUL_C
+#undef BN_S_MP_TOOM_SQR_C
+ 
+ #include "dbmalloc.h"
+ #define MP_MALLOC    m_malloc
--- a/package/network/services/dropbear/patches/020-backport-ed25519-support.patch
+++ b/package/network/services/dropbear/patches/020-backport-ed25519-support.patch
--- a/package/network/services/dropbear/patches/021-backport-chacha20-poly1305-support.patch
+++ b/package/network/services/dropbear/patches/021-backport-chacha20-poly1305-support.patch
@ -1,693 +0,0 @@
-From 3cdf9ec918b37c17e12b33e4c244944d1ee836ca Mon Sep 17 00:00:00 2001
-From: Vladislav Grishenko <themiron@mail.ru>
-Date: Mon, 6 Apr 2020 23:28:09 +0500
-Subject: [PATCH] Add Chacha20-Poly1305 authenticated encryption
-
-* Add general AEAD approach.
-* Add chacha20-poly1305@openssh.com algo using LibTomCrypt chacha and
-  poly1305 routines.
-
-Chacha20-Poly1305 is generally faster than AES256 on CPU w/o dedicated
-AES instructions, having the same key size.
-Compiling in will add ~5,5kB to binary size on x86-64.
---
- Makefile.in                                 |   2 +-
- algo.h                                      |   8 ++
- chachapoly.c                                | 148 ++++++++++++++++++++
- chachapoly.h                                |  44 ++++++
- common-algo.c                               |  11 +-
- common-kex.c                                |  44 ++++--
- default_options.h                           |   6 +
- libtomcrypt/src/headers/tomcrypt_dropbear.h |   4 +
- packet.c                                    | 145 +++++++++++++------
- session.h                                   |   4 +
- sysoptions.h                                |   8 +-
- 11 files changed, 368 insertions(+), 56 deletions(-)
- create mode 100644 chachapoly.c
- create mode 100644 chachapoly.h
-
-diff --git a/Makefile.in b/Makefile.in
-index aaf7b3b..3437cb2 100644
--- a/Makefile.in
-+++ b/Makefile.in
-@@ -53,7 +53,7 @@ CLIOBJS=cli-main.o cli-auth.o cli-authpasswd.o cli-kex.o \
- CLISVROBJS=common-session.o packet.o common-algo.o common-kex.o \
- 			common-channel.o common-chansession.o termcodes.o loginrec.o \
- 			tcp-accept.o listener.o process-packet.o dh_groups.o \
-			common-runopts.o circbuffer.o list.o netio.o
-+			common-runopts.o circbuffer.o list.o netio.o chachapoly.o
- 
- KEYOBJS=dropbearkey.o
- 
-diff --git a/algo.h b/algo.h
-index b12fb94..efd0d73 100644
--- a/algo.h
-+++ b/algo.h
-@@ -72,6 +72,14 @@ struct dropbear_cipher_mode {
- 			unsigned long len, void *cipher_state);
- 	int (*decrypt)(const unsigned char *ct, unsigned char *pt, 
- 			unsigned long len, void *cipher_state);
-+	int (*aead_crypt)(unsigned int seq,
-+			const unsigned char *in, unsigned char *out,
-+			unsigned long len, unsigned long taglen,
-+			void *cipher_state, int direction);
-+	int (*aead_getlength)(unsigned int seq,
-+			const unsigned char *in, unsigned int *outlen,
-+			unsigned long len, void *cipher_state);
-+	const struct dropbear_hash *aead_mac;
- };
- 
- struct dropbear_hash {
-diff --git a/chachapoly.c b/chachapoly.c
-new file mode 100644
-index 0000000..8fb06c5
--- /dev/null
-+++ b/chachapoly.c
-@@ -0,0 +1,148 @@
-+/*
-+ * Dropbear SSH
-+ * 
-+ * Copyright (c) 2002,2003 Matt Johnston
-+ * Copyright (c) 2020 by Vladislav Grishenko
-+ * All rights reserved.
-+ * 
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ * 
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ * 
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE. */
-+
-+#include "includes.h"
-+#include "algo.h"
-+#include "dbutil.h"
-+#include "chachapoly.h"
-+
-+#if DROPBEAR_CHACHA20POLY1305
-+
-+#define CHACHA20_KEY_LEN 32
-+#define CHACHA20_BLOCKSIZE 8
-+#define POLY1305_KEY_LEN 32
-+#define POLY1305_TAG_LEN 16
-+
-+static const struct ltc_cipher_descriptor dummy = {.name = NULL};
-+
-+static const struct dropbear_hash dropbear_chachapoly_mac =
-+	{NULL, POLY1305_KEY_LEN, POLY1305_TAG_LEN};
-+
-+const struct dropbear_cipher dropbear_chachapoly =
-+	{&dummy, CHACHA20_KEY_LEN*2, CHACHA20_BLOCKSIZE};
-+
-+static int dropbear_chachapoly_start(int UNUSED(cipher), const unsigned char* UNUSED(IV),
-+			const unsigned char *key, int keylen,
-+			int UNUSED(num_rounds), dropbear_chachapoly_state *state) {
-+	int err;
-+
-+	TRACE2(("enter dropbear_chachapoly_start"))
-+
-+	if (keylen != CHACHA20_KEY_LEN*2) {
-+		return CRYPT_ERROR;
-+	}
-+
-+	if ((err = chacha_setup(&state->chacha, key,
-+				CHACHA20_KEY_LEN, 20)) != CRYPT_OK) {
-+		return err;
-+	}
-+
-+	if ((err = chacha_setup(&state->header, key + CHACHA20_KEY_LEN,
-+				CHACHA20_KEY_LEN, 20) != CRYPT_OK)) {
-+		return err;
-+	}
-+
-+	TRACE2(("leave dropbear_chachapoly_start"))
-+	return CRYPT_OK;
-+}
-+
-+static int dropbear_chachapoly_crypt(unsigned int seq,
-+			const unsigned char *in, unsigned char *out,
-+			unsigned long len, unsigned long taglen,
-+			dropbear_chachapoly_state *state, int direction) {
-+	poly1305_state poly;
-+	unsigned char seqbuf[8], key[POLY1305_KEY_LEN], tag[POLY1305_TAG_LEN];
-+	int err;
-+
-+	TRACE2(("enter dropbear_chachapoly_crypt"))
-+
-+	if (len < 4 || taglen != POLY1305_TAG_LEN) {
-+		return CRYPT_ERROR;
-+	}
-+
-+	STORE64H((uint64_t)seq, seqbuf);
-+	chacha_ivctr64(&state->chacha, seqbuf, sizeof(seqbuf), 0);
-+	if ((err = chacha_keystream(&state->chacha, key, sizeof(key))) != CRYPT_OK) {
-+		return err;
-+	}
-+
-+	poly1305_init(&poly, key, sizeof(key));
-+	if (direction == LTC_DECRYPT) {
-+		poly1305_process(&poly, in, len);
-+		poly1305_done(&poly, tag, &taglen);
-+		if (constant_time_memcmp(in + len, tag, taglen) != 0) {
-+			return CRYPT_ERROR;
-+		}
-+	}
-+
-+	chacha_ivctr64(&state->header, seqbuf, sizeof(seqbuf), 0);
-+	if ((err = chacha_crypt(&state->header, in, 4, out)) != CRYPT_OK) {
-+		return err;
-+	}
-+
-+	chacha_ivctr64(&state->chacha, seqbuf, sizeof(seqbuf), 1);
-+	if ((err = chacha_crypt(&state->chacha, in + 4, len - 4, out + 4)) != CRYPT_OK) {
-+		return err;
-+	}
-+
-+	if (direction == LTC_ENCRYPT) {
-+		poly1305_process(&poly, out, len);
-+		poly1305_done(&poly, out + len, &taglen);
-+	}
-+
-+	TRACE2(("leave dropbear_chachapoly_crypt"))
-+	return CRYPT_OK;
-+}
-+
-+static int dropbear_chachapoly_getlength(unsigned int seq,
-+			const unsigned char *in, unsigned int *outlen,
-+			unsigned long len, dropbear_chachapoly_state *state) {
-+	unsigned char seqbuf[8], buf[4];
-+	int err;
-+
-+	TRACE2(("enter dropbear_chachapoly_getlength"))
-+
-+	if (len < sizeof(buf)) {
-+		return CRYPT_ERROR;
-+	}
-+
-+	STORE64H((uint64_t)seq, seqbuf);
-+	chacha_ivctr64(&state->header, seqbuf, sizeof(seqbuf), 0);
-+	if ((err = chacha_crypt(&state->header, in, sizeof(buf), buf)) != CRYPT_OK) {
-+		return err;
-+	}
-+
-+	LOAD32H(*outlen, buf);
-+
-+	TRACE2(("leave dropbear_chachapoly_getlength"))
-+	return CRYPT_OK;
-+}
-+
-+const struct dropbear_cipher_mode dropbear_mode_chachapoly =
-+	{(void *)dropbear_chachapoly_start, NULL, NULL,
-+	 (void *)dropbear_chachapoly_crypt,
-+	 (void *)dropbear_chachapoly_getlength, &dropbear_chachapoly_mac};
-+
-+#endif /* DROPBEAR_CHACHA20POLY1305 */
-diff --git a/chachapoly.h b/chachapoly.h
-new file mode 100644
-index 0000000..5a7c5b2
--- /dev/null
-+++ b/chachapoly.h
-@@ -0,0 +1,44 @@
-+/*
-+ * Dropbear SSH
-+ * 
-+ * Copyright (c) 2002,2003 Matt Johnston
-+ * Copyright (c) 2020 by Vladislav Grishenko
-+ * All rights reserved.
-+ * 
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ * 
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ * 
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-+ * SOFTWARE. */
-+
-+#ifndef DROPBEAR_DROPBEAR_CHACHAPOLY_H_
-+#define DROPBEAR_DROPBEAR_CHACHAPOLY_H_
-+
-+#include "includes.h"
-+#include "algo.h"
-+
-+#if DROPBEAR_CHACHA20POLY1305
-+
-+typedef struct {
-+	chacha_state chacha;
-+	chacha_state header;
-+} dropbear_chachapoly_state;
-+
-+extern const struct dropbear_cipher dropbear_chachapoly;
-+extern const struct dropbear_cipher_mode dropbear_mode_chachapoly;
-+
-+#endif /* DROPBEAR_CHACHA20POLY1305 */
-+
-+#endif /* DROPBEAR_DROPBEAR_CHACHAPOLY_H_ */
-diff --git a/common-algo.c b/common-algo.c
-index 558aad2..1436456 100644
--- a/common-algo.c
-+++ b/common-algo.c
-@@ -30,6 +30,7 @@
- #include "dh_groups.h"
- #include "ltc_prng.h"
- #include "ecc.h"
-+#include "chachapoly.h"
- 
- /* This file (algo.c) organises the ciphers which can be used, and is used to
-  * decide which ciphers/hashes/compression/signing to use during key exchange*/
-@@ -86,11 +87,11 @@ const struct dropbear_cipher dropbear_nocipher =
-  * about the symmetric_CBC vs symmetric_CTR cipher_state pointer */
- #if DROPBEAR_ENABLE_CBC_MODE
- const struct dropbear_cipher_mode dropbear_mode_cbc =
-	{(void*)cbc_start, (void*)cbc_encrypt, (void*)cbc_decrypt};
-+	{(void*)cbc_start, (void*)cbc_encrypt, (void*)cbc_decrypt, NULL, NULL, NULL};
- #endif /* DROPBEAR_ENABLE_CBC_MODE */
- 
- const struct dropbear_cipher_mode dropbear_mode_none =
-	{void_start, void_cipher, void_cipher};
-+	{void_start, void_cipher, void_cipher, NULL, NULL, NULL};
- 
- #if DROPBEAR_ENABLE_CTR_MODE
- /* a wrapper to make ctr_start and cbc_start look the same */
-@@ -101,7 +102,7 @@ static int dropbear_big_endian_ctr_start(int cipher,
- 	return ctr_start(cipher, IV, key, keylen, num_rounds, CTR_COUNTER_BIG_ENDIAN, ctr);
- }
- const struct dropbear_cipher_mode dropbear_mode_ctr =
-	{(void*)dropbear_big_endian_ctr_start, (void*)ctr_encrypt, (void*)ctr_decrypt};
-+	{(void*)dropbear_big_endian_ctr_start, (void*)ctr_encrypt, (void*)ctr_decrypt, NULL, NULL, NULL};
- #endif /* DROPBEAR_ENABLE_CTR_MODE */
- 
- /* Mapping of ssh hashes to libtomcrypt hashes, including keysize etc.
-@@ -137,6 +138,10 @@ const struct dropbear_hash dropbear_nohash =
-  * that is also supported by the server will get used. */
- 
- algo_type sshciphers[] = {
-+#if DROPBEAR_CHACHA20POLY1305
-+	{"chacha20-poly1305@openssh.com", 0, &dropbear_chachapoly, 1, &dropbear_mode_chachapoly},
-+#endif
-+
- #if DROPBEAR_ENABLE_CTR_MODE
- #if DROPBEAR_AES128
- 	{"aes128-ctr", 0, &dropbear_aes128, 1, &dropbear_mode_ctr},
-diff --git a/common-kex.c b/common-kex.c
-index 16b7e27..5e2923f 100644
--- a/common-kex.c
-+++ b/common-kex.c
-@@ -329,9 +329,12 @@ static void gen_new_keys() {
- 	hashkeys(S2C_key, sizeof(S2C_key), &hs, 'D');
- 
- 	if (ses.newkeys->recv.algo_crypt->cipherdesc != NULL) {
-		int recv_cipher = find_cipher(ses.newkeys->recv.algo_crypt->cipherdesc->name);
-		if (recv_cipher < 0)
-			dropbear_exit("Crypto error");
-+		int recv_cipher = -1;
-+		if (ses.newkeys->recv.algo_crypt->cipherdesc->name != NULL) {
-+			recv_cipher = find_cipher(ses.newkeys->recv.algo_crypt->cipherdesc->name);
-+			if (recv_cipher < 0)
-+				dropbear_exit("Crypto error");
-+		}
- 		if (ses.newkeys->recv.crypt_mode->start(recv_cipher, 
- 				recv_IV, recv_key, 
- 				ses.newkeys->recv.algo_crypt->keysize, 0, 
-@@ -341,9 +344,12 @@ static void gen_new_keys() {
- 	}
- 
- 	if (ses.newkeys->trans.algo_crypt->cipherdesc != NULL) {
-		int trans_cipher = find_cipher(ses.newkeys->trans.algo_crypt->cipherdesc->name);
-		if (trans_cipher < 0)
-			dropbear_exit("Crypto error");
-+		int trans_cipher = -1;
-+		if (ses.newkeys->trans.algo_crypt->cipherdesc->name != NULL) {
-+			trans_cipher = find_cipher(ses.newkeys->trans.algo_crypt->cipherdesc->name);
-+			if (trans_cipher < 0)
-+				dropbear_exit("Crypto error");
-+		}
- 		if (ses.newkeys->trans.crypt_mode->start(trans_cipher, 
- 				trans_IV, trans_key, 
- 				ses.newkeys->trans.algo_crypt->keysize, 0, 
-@@ -868,19 +874,29 @@ static void read_kex_algos() {
- 
- 	/* mac_algorithms_client_to_server */
- 	c2s_hash_algo = buf_match_algo(ses.payload, sshhashes, NULL, NULL);
-+#if DROPBEAR_AEAD_MODE
-+	if (((struct dropbear_cipher_mode*)c2s_cipher_algo->mode)->aead_crypt != NULL) {
-+		c2s_hash_algo = NULL;
-+	} else
-+#endif
- 	if (c2s_hash_algo == NULL) {
- 		erralgo = "mac c->s";
- 		goto error;
- 	}
-	TRACE(("hash c2s is  %s", c2s_hash_algo->name))
-+	TRACE(("hash c2s is  %s", c2s_hash_algo ? c2s_hash_algo->name : "<implicit>"))
- 
- 	/* mac_algorithms_server_to_client */
- 	s2c_hash_algo = buf_match_algo(ses.payload, sshhashes, NULL, NULL);
-+#if DROPBEAR_AEAD_MODE
-+	if (((struct dropbear_cipher_mode*)s2c_cipher_algo->mode)->aead_crypt != NULL) {
-+		s2c_hash_algo = NULL;
-+	} else
-+#endif
- 	if (s2c_hash_algo == NULL) {
- 		erralgo = "mac s->c";
- 		goto error;
- 	}
-	TRACE(("hash s2c is  %s", s2c_hash_algo->name))
-+	TRACE(("hash s2c is  %s", s2c_hash_algo ? s2c_hash_algo->name : "<implicit>"))
- 
- 	/* compression_algorithms_client_to_server */
- 	c2s_comp_algo = buf_match_algo(ses.payload, ses.compress_algos, NULL, NULL);
-@@ -925,8 +941,14 @@ static void read_kex_algos() {
- 		ses.newkeys->trans.crypt_mode =
- 			(struct dropbear_cipher_mode*)c2s_cipher_algo->mode;
- 		ses.newkeys->recv.algo_mac = 
-+#if DROPBEAR_AEAD_MODE
-+			s2c_hash_algo == NULL ? ses.newkeys->recv.crypt_mode->aead_mac :
-+#endif
- 			(struct dropbear_hash*)s2c_hash_algo->data;
- 		ses.newkeys->trans.algo_mac = 
-+#if DROPBEAR_AEAD_MODE
-+			c2s_hash_algo == NULL ? ses.newkeys->trans.crypt_mode->aead_mac :
-+#endif
- 			(struct dropbear_hash*)c2s_hash_algo->data;
- 		ses.newkeys->recv.algo_comp = s2c_comp_algo->val;
- 		ses.newkeys->trans.algo_comp = c2s_comp_algo->val;
-@@ -941,8 +963,14 @@ static void read_kex_algos() {
- 		ses.newkeys->trans.crypt_mode =
- 			(struct dropbear_cipher_mode*)s2c_cipher_algo->mode;
- 		ses.newkeys->recv.algo_mac = 
-+#if DROPBEAR_AEAD_MODE
-+			c2s_hash_algo == NULL ? ses.newkeys->recv.crypt_mode->aead_mac :
-+#endif
- 			(struct dropbear_hash*)c2s_hash_algo->data;
- 		ses.newkeys->trans.algo_mac = 
-+#if DROPBEAR_AEAD_MODE
-+			s2c_hash_algo == NULL ? ses.newkeys->trans.crypt_mode->aead_mac :
-+#endif
- 			(struct dropbear_hash*)s2c_hash_algo->data;
- 		ses.newkeys->recv.algo_comp = c2s_comp_algo->val;
- 		ses.newkeys->trans.algo_comp = s2c_comp_algo->val;
-diff --git a/default_options.h b/default_options.h
-index bafbb07..1a2ab10 100644
--- a/default_options.h
-+++ b/default_options.h
-@@ -99,6 +99,12 @@ IMPORTANT: Some options will require "make clean" after changes */
-  * and forwards compatibility */
- #define DROPBEAR_ENABLE_CTR_MODE 1
- 
-+/* Enable Chacha20-Poly1305 authenticated encryption mode. This is
-+ * generally faster than AES256 on CPU w/o dedicated AES instructions,
-+ * having the same key size.
-+ * Compiling in will add ~5,5kB to binary size on x86-64 */
-+#define DROPBEAR_CHACHA20POLY1305 1
-+
- /* Message integrity. sha2-256 is recommended as a default, 
-    sha1 for compatibility */
- #define DROPBEAR_SHA1_HMAC 1
-diff --git a/libtomcrypt/src/headers/tomcrypt_dropbear.h b/libtomcrypt/src/headers/tomcrypt_dropbear.h
-index b0ce45b..59960e5 100644
--- a/libtomcrypt/src/headers/tomcrypt_dropbear.h
-+++ b/libtomcrypt/src/headers/tomcrypt_dropbear.h
-@@ -35,6 +35,10 @@
- #define LTC_CTR_MODE
- #endif
- 
-+#if DROPBEAR_CHACHA20POLY1305
-+#define LTC_CHACHA
-+#define LTC_POLY1305
-+#endif
- 
- #if DROPBEAR_SHA512
- #define LTC_SHA512
-diff --git a/packet.c b/packet.c
-index 9fda0d6..0454726 100644
--- a/packet.c
-+++ b/packet.c
-@@ -215,7 +215,7 @@ static int read_packet_init() {
- 
- 	unsigned int maxlen;
- 	int slen;
-	unsigned int len;
-+	unsigned int len, plen;
- 	unsigned int blocksize;
- 	unsigned int macsize;
- 
-@@ -254,21 +254,35 @@ static int read_packet_init() {
- 	/* now we have the first block, need to get packet length, so we decrypt
- 	 * the first block (only need first 4 bytes) */
- 	buf_setpos(ses.readbuf, 0);
-	if (ses.keys->recv.crypt_mode->decrypt(buf_getptr(ses.readbuf, blocksize), 
-				buf_getwriteptr(ses.readbuf, blocksize),
-				blocksize,
-				&ses.keys->recv.cipher_state) != CRYPT_OK) {
-		dropbear_exit("Error decrypting");
-+#if DROPBEAR_AEAD_MODE
-+	if (ses.keys->recv.crypt_mode->aead_crypt) {
-+		if (ses.keys->recv.crypt_mode->aead_getlength(ses.recvseq,
-+					buf_getptr(ses.readbuf, blocksize), &plen,
-+					blocksize,
-+					&ses.keys->recv.cipher_state) != CRYPT_OK) {
-+			dropbear_exit("Error decrypting");
-+		}
-+		len = plen + 4 + macsize;
-+	} else
-+#endif
-+	{
-+		if (ses.keys->recv.crypt_mode->decrypt(buf_getptr(ses.readbuf, blocksize), 
-+					buf_getwriteptr(ses.readbuf, blocksize),
-+					blocksize,
-+					&ses.keys->recv.cipher_state) != CRYPT_OK) {
-+			dropbear_exit("Error decrypting");
-+		}
-+		plen = buf_getint(ses.readbuf) + 4;
-+		len = plen + macsize;
- 	}
-	len = buf_getint(ses.readbuf) + 4 + macsize;
- 
- 	TRACE2(("packet size is %u, block %u mac %u", len, blocksize, macsize))
- 
- 
- 	/* check packet length */
- 	if ((len > RECV_MAX_PACKET_LEN) ||
-		(len < MIN_PACKET_LEN + macsize) ||
-		((len - macsize) % blocksize != 0)) {
-+		(plen < blocksize) ||
-+		(plen % blocksize != 0)) {
- 		dropbear_exit("Integrity error (bad packet size %u)", len);
- 	}
- 
-@@ -294,23 +308,42 @@ void decrypt_packet() {
- 
- 	ses.kexstate.datarecv += ses.readbuf->len;
- 
-	/* we've already decrypted the first blocksize in read_packet_init */
-	buf_setpos(ses.readbuf, blocksize);
-
-	/* decrypt it in-place */
-	len = ses.readbuf->len - macsize - ses.readbuf->pos;
-	if (ses.keys->recv.crypt_mode->decrypt(
-				buf_getptr(ses.readbuf, len), 
-				buf_getwriteptr(ses.readbuf, len),
-				len,
-				&ses.keys->recv.cipher_state) != CRYPT_OK) {
-		dropbear_exit("Error decrypting");
-	}
-	buf_incrpos(ses.readbuf, len);
-+#if DROPBEAR_AEAD_MODE
-+	if (ses.keys->recv.crypt_mode->aead_crypt) {
-+		/* first blocksize is not decrypted yet */
-+		buf_setpos(ses.readbuf, 0);
-+
-+		/* decrypt it in-place */
-+		len = ses.readbuf->len - macsize - ses.readbuf->pos;
-+		if (ses.keys->recv.crypt_mode->aead_crypt(ses.recvseq,
-+					buf_getptr(ses.readbuf, len + macsize),
-+					buf_getwriteptr(ses.readbuf, len),
-+					len, macsize,
-+					&ses.keys->recv.cipher_state, LTC_DECRYPT) != CRYPT_OK) {
-+			dropbear_exit("Error decrypting");
-+		}
-+		buf_incrpos(ses.readbuf, len);
-+	} else
-+#endif
-+	{
-+		/* we've already decrypted the first blocksize in read_packet_init */
-+		buf_setpos(ses.readbuf, blocksize);
-+
-+		/* decrypt it in-place */
-+		len = ses.readbuf->len - macsize - ses.readbuf->pos;
-+		if (ses.keys->recv.crypt_mode->decrypt(
-+					buf_getptr(ses.readbuf, len), 
-+					buf_getwriteptr(ses.readbuf, len),
-+					len,
-+					&ses.keys->recv.cipher_state) != CRYPT_OK) {
-+			dropbear_exit("Error decrypting");
-+		}
-+		buf_incrpos(ses.readbuf, len);
- 
-	/* check the hmac */
-	if (checkmac() != DROPBEAR_SUCCESS) {
-		dropbear_exit("Integrity error");
-+		/* check the hmac */
-+		if (checkmac() != DROPBEAR_SUCCESS) {
-+			dropbear_exit("Integrity error");
-+		}
- 	}
- 
- 	/* get padding length */
-@@ -557,9 +590,16 @@ void encrypt_packet() {
- 	buf_setpos(ses.writepayload, 0);
- 	buf_setlen(ses.writepayload, 0);
- 
-	/* length of padding - packet length must be a multiple of blocksize,
-	 * with a minimum of 4 bytes of padding */
-	padlen = blocksize - (writebuf->len) % blocksize;
-+	/* length of padding - packet length excluding the packetlength uint32
-+	 * field in aead mode must be a multiple of blocksize, with a minimum of
-+	 * 4 bytes of padding */
-+	len = writebuf->len;
-+#if DROPBEAR_AEAD_MODE
-+	if (ses.keys->trans.crypt_mode->aead_crypt) {
-+		len -= 4;
-+	}
-+#endif
-+	padlen = blocksize - len % blocksize;
- 	if (padlen < 4) {
- 		padlen += blocksize;
- 	}
-@@ -579,23 +619,42 @@ void encrypt_packet() {
- 	buf_incrlen(writebuf, padlen);
- 	genrandom(buf_getptr(writebuf, padlen), padlen);
- 
-	make_mac(ses.transseq, &ses.keys->trans, writebuf, writebuf->len, mac_bytes);
-+#if DROPBEAR_AEAD_MODE
-+	if (ses.keys->trans.crypt_mode->aead_crypt) {
-+		/* do the actual encryption, in-place */
-+		buf_setpos(writebuf, 0);
-+		/* encrypt it in-place*/
-+		len = writebuf->len;
-+		buf_incrlen(writebuf, mac_size);
-+		if (ses.keys->trans.crypt_mode->aead_crypt(ses.transseq,
-+					buf_getptr(writebuf, len),
-+					buf_getwriteptr(writebuf, len + mac_size),
-+					len, mac_size,
-+					&ses.keys->trans.cipher_state, LTC_ENCRYPT) != CRYPT_OK) {
-+			dropbear_exit("Error encrypting");
-+		}
-+		buf_incrpos(writebuf, len + mac_size);
-+	} else
-+#endif
-+	{
-+		make_mac(ses.transseq, &ses.keys->trans, writebuf, writebuf->len, mac_bytes);
-+
-+		/* do the actual encryption, in-place */
-+		buf_setpos(writebuf, 0);
-+		/* encrypt it in-place*/
-+		len = writebuf->len;
-+		if (ses.keys->trans.crypt_mode->encrypt(
-+					buf_getptr(writebuf, len),
-+					buf_getwriteptr(writebuf, len),
-+					len,
-+					&ses.keys->trans.cipher_state) != CRYPT_OK) {
-+			dropbear_exit("Error encrypting");
-+		}
-+		buf_incrpos(writebuf, len);
- 
-	/* do the actual encryption, in-place */
-	buf_setpos(writebuf, 0);
-	/* encrypt it in-place*/
-	len = writebuf->len;
-	if (ses.keys->trans.crypt_mode->encrypt(
-				buf_getptr(writebuf, len),
-				buf_getwriteptr(writebuf, len),
-				len,
-				&ses.keys->trans.cipher_state) != CRYPT_OK) {
-		dropbear_exit("Error encrypting");
-+		/* stick the MAC on it */
-+		buf_putbytes(writebuf, mac_bytes, mac_size);
- 	}
-	buf_incrpos(writebuf, len);
-
-	/* stick the MAC on it */
-	buf_putbytes(writebuf, mac_bytes, mac_size);
- 
- 	/* Update counts */
- 	ses.kexstate.datatrans += writebuf->len;
-diff --git a/session.h b/session.h
-index e436882..a8f8914 100644
--- a/session.h
-+++ b/session.h
-@@ -41,6 +41,7 @@
- #include "chansession.h"
- #include "dbutil.h"
- #include "netio.h"
-+#include "chachapoly.h"
- 
- void common_session_init(int sock_in, int sock_out);
- void session_loop(void(*loophandler)(void)) ATTRIB_NORETURN;
-@@ -80,6 +81,9 @@ struct key_context_directional {
- 		symmetric_CBC cbc;
- #if DROPBEAR_ENABLE_CTR_MODE
- 		symmetric_CTR ctr;
-+#endif
-+#if DROPBEAR_CHACHA20POLY1305
-+		dropbear_chachapoly_state chachapoly;
- #endif
- 	} cipher_state;
- 	unsigned char mackey[MAX_MAC_LEN];
-diff --git a/sysoptions.h b/sysoptions.h
-index 2c27caf..2432779 100644
--- a/sysoptions.h
-+++ b/sysoptions.h
-@@ -92,7 +92,11 @@
- #define MD5_HASH_SIZE 16
- #define MAX_HASH_SIZE 64 /* sha512 */
- 
-+#if DROPBEAR_CHACHA20POLY1305
-+#define MAX_KEY_LEN 64 /* 2 x 256 bits for chacha20 */
-+#else
- #define MAX_KEY_LEN 32 /* 256 bits for aes256 etc */
-+#endif
- #define MAX_IV_LEN 20 /* must be same as max blocksize,  */
- 
- #if DROPBEAR_SHA2_512_HMAC
-@@ -207,6 +211,8 @@ If you test it please contact the Dropbear author */
- 
- #define DROPBEAR_TWOFISH ((DROPBEAR_TWOFISH256) || (DROPBEAR_TWOFISH128))
- 
-+#define DROPBEAR_AEAD_MODE ((DROPBEAR_CHACHA20POLY1305))
-+
- #define DROPBEAR_CLI_ANYTCPFWD ((DROPBEAR_CLI_REMOTETCPFWD) || (DROPBEAR_CLI_LOCALTCPFWD))
- 
- #define DROPBEAR_TCP_ACCEPT ((DROPBEAR_CLI_LOCALTCPFWD) || (DROPBEAR_SVR_REMOTETCPFWD))
-@@ -249,7 +255,7 @@ If you test it please contact the Dropbear author */
- #endif
- 
- #if !(DROPBEAR_AES128 || DROPBEAR_3DES || DROPBEAR_AES256 || DROPBEAR_BLOWFISH \
-      || DROPBEAR_TWOFISH256 || DROPBEAR_TWOFISH128)
-+      || DROPBEAR_TWOFISH256 || DROPBEAR_TWOFISH128 || DROPBEAR_CHACHA20POLY1305)
- 	#error "At least one encryption algorithm must be enabled. AES128 is recommended."
- #endif
- 
-- 
-2.17.1
-
--- a/package/network/services/dropbear/patches/100-pubkey_path.patch
+++ b/package/network/services/dropbear/patches/100-pubkey_path.patch
@ -1,6 +1,6 @@
 --- a/svr-authpubkey.c
 +++ b/svr-authpubkey.c
-@@ -338,14 +338,19 @@ static int checkpubkey(const char* algo,
+@@ -386,14 +386,19 @@ static int checkpubkey(const char* keyal
 		goto out;
 	}
 
@ -28,7 +28,7 @@
 
 #if DROPBEAR_SVR_MULTIUSER
 	/* open the file as the authenticating user. */
-@@ -426,27 +431,36 @@ static int checkpubkeyperms() {
+@@ -474,27 +479,36 @@ static int checkpubkeyperms() {
 		goto out;
 	}
 
--- a/package/network/services/dropbear/patches/110-change_user.patch
+++ b/package/network/services/dropbear/patches/110-change_user.patch
@ -1,6 +1,6 @@
 --- a/svr-chansession.c
 +++ b/svr-chansession.c
-@@ -953,12 +953,12 @@ static void execchild(const void *user_d
+@@ -950,12 +950,12 @@ static void execchild(const void *user_d
 	/* We can only change uid/gid as root ... */
 	if (getuid() == 0) {
 
--- a/package/network/services/dropbear/patches/160-lto-jobserver.patch
+++ b/package/network/services/dropbear/patches/160-lto-jobserver.patch
@ -1,11 +1,11 @@
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -189,17 +189,17 @@ dropbearkey: $(dropbearkeyobjs)
+@@ -199,17 +199,17 @@ dropbearkey: $(dropbearkeyobjs)
 dropbearconvert: $(dropbearconvertobjs)
 
 dropbear: $(HEADERS) $(LIBTOM_DEPS) Makefile
-	$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@
-+	+$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@
+-	$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@ $(PLUGIN_LIBS)
+	+$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS) @CRYPTLIB@ $(PLUGIN_LIBS)
 
 dbclient: $(HEADERS) $(LIBTOM_DEPS) Makefile
 -	$(CC) $(LDFLAGS) -o $@$(EXEEXT) $($@objs) $(LIBTOM_LIBS) $(LIBS)
@ -22,7 +22,7 @@
 
 
 # multi-binary compilation.
-@@ -210,7 +210,7 @@ ifeq ($(MULTI),1)
+@@ -220,7 +220,7 @@ ifeq ($(MULTI),1)
 endif
 
 dropbearmulti$(EXEEXT): $(HEADERS) $(MULTIOBJS) $(LIBTOM_DEPS) Makefile
--- a/package/network/services/dropbear/patches/901-bundled-libs-cflags.patch
+++ b/package/network/services/dropbear/patches/901-bundled-libs-cflags.patch
@ -1,6 +1,6 @@
 --- a/libtomcrypt/makefile_include.mk
 +++ b/libtomcrypt/makefile_include.mk
-@@ -75,6 +75,13 @@ endif
+@@ -94,6 +94,13 @@ endif
 
 LTC_CFLAGS += -Wno-type-limits
 
@ -14,7 +14,7 @@
 ifdef LTC_DEBUG
 $(info Debug build)
 # compile for DEBUGGING (required for ccmalloc checking!!!)
-@@ -102,6 +109,9 @@ endif
+@@ -121,6 +128,9 @@ endif
 endif # COMPILE_SMALL
 endif # COMPILE_DEBUG
 
@ -26,8 +26,8 @@
 LTC_CFLAGS += -Wno-typedef-redefinition -Wno-tautological-compare -Wno-builtin-requires-header -Wno-missing-field-initializers
 --- a/libtommath/makefile_include.mk
 +++ b/libtommath/makefile_include.mk
-@@ -37,6 +37,9 @@ CFLAGS += -Wsystem-headers -Wdeclaration
- CFLAGS += -Wstrict-prototypes -Wpointer-arith
+@@ -70,6 +70,9 @@ else
+ LTM_CFLAGS += -Wsystem-headers
 endif
 
 +ifndef OPENWRT_BUILD
@ -35,14 +35,14 @@
 +
 ifdef COMPILE_DEBUG
 #debug
- CFLAGS += -g3
-@@ -58,6 +61,9 @@ endif
+ LTM_CFLAGS += -g3
+@@ -90,6 +93,9 @@ endif
+ 
 endif # COMPILE_SIZE
- endif # COMPILE_DEBUG
 
 +  ### ! OPENWRT_BUILD
 +endif
 +
 ifneq ($(findstring clang,$(CC)),)
- CFLAGS += -Wno-typedef-redefinition -Wno-tautological-compare -Wno-builtin-requires-header
+ LTM_CFLAGS += -Wno-typedef-redefinition -Wno-tautological-compare -Wno-builtin-requires-header
 endif
--- a/target/linux/ath79/dts/ar9344_tplink_cpe610-v2.dts
+++ b/target/linux/ath79/dts/ar9344_tplink_cpe610-v2.dts
@ -0,0 +1,34 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include "ar9344_tplink_cpe.dtsi"
+
+/ {
+	model = "TP-Link CPE610 v2";
+	compatible = "tplink,cpe610-v2", "qca,ar9344";
+
+	aliases {
+		led-boot = &led_lan;
+		led-failsafe = &led_lan;
+		led-upgrade = &led_lan;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_lan: lan {
+			label = "tp-link:green:lan";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan5g {
+			label = "tp-link:green:wlan5g";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+};
+
+&eth1 {
+	compatible = "syscon", "simple-mfd";
+};
--- a/target/linux/ath79/dts/qca9531_tplink_tl-wr902ac-v1.dts
+++ b/target/linux/ath79/dts/qca9531_tplink_tl-wr902ac-v1.dts
@ -77,12 +77,14 @@

 		sw1 {
 			label = "Mode switch 1";
+			linux,input-type = <EV_SW>;
 			linux,code = <BTN_0>;
 			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
 		};

 		sw2 {
 			label = "Mode switch 2";
+			linux,input-type = <EV_SW>;
 			linux,code = <BTN_1>;
 			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
 		};
--- a/target/linux/ath79/generic/base-files/etc/board.d/01_leds
+++ b/target/linux/ath79/generic/base-files/etc/board.d/01_leds
@ -243,6 +243,9 @@ tplink,cpe510-v3)
 	ucidef_set_led_rssi "rssihigh" "RSSIHIGH" "tp-link:green:link4" "wlan0" "76" "100" "-75" "13"
 	;;
 tplink,cpe610-v1|\
+tplink,cpe610-v2)
+	ucidef_set_led_netdev "lan" "LAN" "tp-link:green:lan" "eth0"
+	;;
 tplink,tl-wr902ac-v1)
 	ucidef_set_led_netdev "lan" "LAN" "tp-link:green:lan" "eth0"
 	ucidef_set_led_netdev "internet" "Internet" "tp-link:green:internet" "eth0"
--- a/target/linux/ath79/generic/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/generic/base-files/etc/board.d/02_network
@ -39,6 +39,7 @@ ath79_setup_interfaces()
 	tplink,cpe510-v2|\
 	tplink,cpe510-v3|\
 	tplink,cpe610-v1|\
+	tplink,cpe610-v2|\
 	tplink,re350k-v1|\
 	tplink,re355-v1|\
 	tplink,re450-v1|\
--- a/target/linux/ath79/image/common-tp-link.mk
+++ b/target/linux/ath79/image/common-tp-link.mk
@ -78,6 +78,7 @@ define Device/tplink-safeloader
  $(Device/tplink-v1)
  TPLINK_HWREV := 0x0
  KERNEL := kernel-bin | append-dtb | lzma | tplink-v1-header -O
+  KERNEL_INITRAMFS := $$(KERNEL)
  IMAGE/sysupgrade.bin := append-rootfs | tplink-safeloader sysupgrade | \
 	append-metadata | check-size
  IMAGE/factory.bin := append-rootfs | tplink-safeloader factory
@ -86,6 +87,7 @@ endef
 define Device/tplink-safeloader-uimage
  $(Device/tplink-safeloader)
  KERNEL := kernel-bin | append-dtb | lzma | uImageArcher lzma
+  KERNEL_INITRAMFS := $$(KERNEL)
 endef

 define Device/tplink-safeloader-okli
@ -96,4 +98,5 @@ define Device/tplink-safeloader-okli
  COMPILE/loader-$(1).elf := loader-okli-compile
  KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49 | \
 	loader-okli $(1) 12288
+  KERNEL_INITRAMFS := $$(KERNEL)
 endef
--- a/target/linux/ath79/image/generic-tp-link.mk
+++ b/target/linux/ath79/image/generic-tp-link.mk
@ -352,6 +352,16 @@ define Device/tplink_cpe610-v1
 endef
 TARGET_DEVICES += tplink_cpe610-v1

+define Device/tplink_cpe610-v2
+  $(Device/tplink-safeloader-okli)
+  SOC := ar9344
+  IMAGE_SIZE := 7680k
+  DEVICE_MODEL := CPE610
+  DEVICE_VARIANT := v2
+  TPLINK_BOARD_ID := CPE610V2
+endef
+TARGET_DEVICES += tplink_cpe610-v2
+
 define Device/tplink_re350k-v1
  $(Device/tplink-safeloader)
  SOC := qca9558
--- a/target/linux/bcm27xx/patches-5.4/950-0001-arm-partially-revert-702b94bff3c50542a6e4ab9a4f4cef0.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0001-arm-partially-revert-702b94bff3c50542a6e4ab9a4f4cef0.patch
@ -76,7 +76,7 @@ Subject: [PATCH] arm: partially revert
 
 --- a/arch/arm/mm/proc-macros.S
 +++ b/arch/arm/mm/proc-macros.S
-@@ -335,6 +335,8 @@ ENTRY(\name\()_cache_fns)
+@@ -336,6 +336,8 @@ ENTRY(\name\()_cache_fns)
 	.long	\name\()_flush_kern_dcache_area
 	.long	\name\()_dma_map_area
 	.long	\name\()_dma_unmap_area
--- a/target/linux/bcm27xx/patches-5.4/950-0027-mm-Remove-the-PFN-busy-warning.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0027-mm-Remove-the-PFN-busy-warning.patch
@ -14,7 +14,7 @@ Signed-off-by: Eric Anholt <eric@anholt.net>

 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
-@@ -8486,8 +8486,6 @@ int alloc_contig_range(unsigned long sta
+@@ -8481,8 +8481,6 @@ int alloc_contig_range(unsigned long sta
 
 	/* Make sure the range is really isolated. */
 	if (test_pages_isolated(outer_start, end, false)) {
--- a/target/linux/bcm27xx/patches-5.4/950-0210-bcmgenet-constrain-max-DMA-burst-length.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0210-bcmgenet-constrain-max-DMA-burst-length.patch
@ -9,7 +9,7 @@ Subject: [PATCH] bcmgenet: constrain max DMA burst length

 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
 +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
-@@ -28,7 +28,7 @@
+@@ -29,7 +29,7 @@
 #define ENET_PAD		8
 #define ENET_MAX_MTU_SIZE	(ETH_DATA_LEN + ETH_HLEN + VLAN_HLEN + \
 				 ENET_BRCM_TAG_LEN + ETH_FCS_LEN + ENET_PAD)
--- a/target/linux/bcm27xx/patches-5.4/950-0211-bcmgenet-Better-coalescing-parameter-defaults.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0211-bcmgenet-Better-coalescing-parameter-defaults.patch
@ -18,7 +18,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>

 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
 +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-@@ -2148,7 +2148,7 @@ static void bcmgenet_init_tx_ring(struct
+@@ -2151,7 +2151,7 @@ static void bcmgenet_init_tx_ring(struct
 
 	bcmgenet_tdma_ring_writel(priv, index, 0, TDMA_PROD_INDEX);
 	bcmgenet_tdma_ring_writel(priv, index, 0, TDMA_CONS_INDEX);
@ -27,7 +27,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 	/* Disable rate control for now */
 	bcmgenet_tdma_ring_writel(priv, index, flow_period_val,
 				  TDMA_FLOW_PERIOD);
-@@ -3571,9 +3571,12 @@ static int bcmgenet_probe(struct platfor
+@@ -3575,9 +3575,12 @@ static int bcmgenet_probe(struct platfor
 	netif_set_real_num_rx_queues(priv->dev, priv->hw_params->rx_queues + 1);
 
 	/* Set default coalescing parameters */
--- a/target/linux/bcm27xx/patches-5.4/950-0295-net-bcmgenet-Workaround-2-for-Pi4-Ethernet-fail.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0295-net-bcmgenet-Workaround-2-for-Pi4-Ethernet-fail.patch
@ -27,9 +27,9 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>

 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
 +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-@@ -69,6 +69,10 @@
- #define GENET_RDMA_REG_OFF	(priv->hw_params->rdma_offset + \
- 				TOTAL_DESC * DMA_DESC_SIZE)
+@@ -72,6 +72,10 @@
+ /* Forward declarations */
+ static void bcmgenet_set_rx_mode(struct net_device *dev);
 
 +static bool skip_umac_reset = true;
 +module_param(skip_umac_reset, bool, 0444);
@ -38,7 +38,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 static inline void bcmgenet_writel(u32 value, void __iomem *offset)
 {
 	/* MIPS chips strapped for BE will automagically configure the
-@@ -1994,6 +1998,11 @@ static void reset_umac(struct bcmgenet_p
+@@ -1997,6 +2001,11 @@ static void reset_umac(struct bcmgenet_p
 	bcmgenet_rbuf_ctrl_set(priv, 0);
 	udelay(10);
 
--- a/target/linux/bcm27xx/patches-5.4/950-0316-kbuild-Allow-.dtbo-overlays-to-be-built-piecemeal.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0316-kbuild-Allow-.dtbo-overlays-to-be-built-piecemeal.patch
@ -24,7 +24,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>

 --- a/Makefile
 +++ b/Makefile
-@@ -1246,6 +1246,9 @@ ifneq ($(dtstree),)
+@@ -1242,6 +1242,9 @@ ifneq ($(dtstree),)
 %.dtb: include/config/kernel.release scripts_dtc
 	$(Q)$(MAKE) $(build)=$(dtstree) $(dtstree)/$@
 
--- a/target/linux/bcm27xx/patches-5.4/950-0340-drm-v3d-The-third-IRQ-is-optional.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0340-drm-v3d-The-third-IRQ-is-optional.patch
@ -13,7 +13,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>

 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
 +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-@@ -3472,7 +3472,7 @@ static int bcmgenet_probe(struct platfor
+@@ -3476,7 +3476,7 @@ static int bcmgenet_probe(struct platfor
 	priv = netdev_priv(dev);
 	priv->irq0 = platform_get_irq(pdev, 0);
 	priv->irq1 = platform_get_irq(pdev, 1);
--- a/target/linux/bcm27xx/patches-5.4/950-0451-dma-mapping-treat-dev-bus_dma_mask-as-a-DMA-limit.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0451-dma-mapping-treat-dev-bus_dma_mask-as-a-DMA-limit.patch
@ -149,7 +149,7 @@ Signed-off-by: Christoph Hellwig <hch@lst.de>
 
 --- a/drivers/acpi/arm64/iort.c
 +++ b/drivers/acpi/arm64/iort.c
-@@ -1057,8 +1057,8 @@ static int rc_dma_get_range(struct devic
+@@ -1062,8 +1062,8 @@ static int rc_dma_get_range(struct devic
  */
 void iort_dma_setup(struct device *dev, u64 *dma_addr, u64 *dma_size)
 {
@ -160,7 +160,7 @@ Signed-off-by: Christoph Hellwig <hch@lst.de>
 
 	/*
 	 * If @dev is expected to be DMA-capable then the bus code that created
-@@ -1085,19 +1085,13 @@ void iort_dma_setup(struct device *dev,
+@@ -1090,19 +1090,13 @@ void iort_dma_setup(struct device *dev,
 	}
 
 	if (!ret) {
--- a/target/linux/bcm27xx/patches-5.4/950-0460-Kbuild-Allow-.dtbo-overlays-to-be-built-adjust.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0460-Kbuild-Allow-.dtbo-overlays-to-be-built-adjust.patch
@ -15,7 +15,7 @@ Signed-off-by: Nataliya Korovkina <malus.brandywine@gmail.com>

 --- a/Makefile
 +++ b/Makefile
-@@ -1246,7 +1246,7 @@ ifneq ($(dtstree),)
+@@ -1242,7 +1242,7 @@ ifneq ($(dtstree),)
 %.dtb: include/config/kernel.release scripts_dtc
 	$(Q)$(MAKE) $(build)=$(dtstree) $(dtstree)/$@
 
--- a/target/linux/bcm27xx/patches-5.4/950-0653-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0653-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
@ -23,7 +23,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>

 --- a/drivers/spi/spi.c
 +++ b/drivers/spi/spi.c
-@@ -3032,6 +3032,7 @@ static int __spi_validate_bits_per_word(
+@@ -3034,6 +3034,7 @@ static int __spi_validate_bits_per_word(
  */
 int spi_setup(struct spi_device *spi)
 {
@ -31,7 +31,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 	unsigned	bad_bits, ugly_bits;
 	int		status;
 
-@@ -3049,6 +3050,14 @@ int spi_setup(struct spi_device *spi)
+@@ -3051,6 +3052,14 @@ int spi_setup(struct spi_device *spi)
 		(SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL |
 		 SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL)))
 		return -EINVAL;
--- a/target/linux/bcm27xx/patches-5.4/950-0697-SQUASH-spi-Demote-SPI_CS_HIGH-warning-to-KERN_DEBUG.patch
+++ b/target/linux/bcm27xx/patches-5.4/950-0697-SQUASH-spi-Demote-SPI_CS_HIGH-warning-to-KERN_DEBUG.patch
@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>

 --- a/drivers/spi/spi.c
 +++ b/drivers/spi/spi.c
-@@ -3044,8 +3044,8 @@ int spi_setup(struct spi_device *spi)
+@@ -3046,8 +3046,8 @@ int spi_setup(struct spi_device *spi)
 
 	if (ctlr->use_gpio_descriptors && ctlr->cs_gpiods &&
 	    ctlr->cs_gpiods[spi->chip_select] && !(spi->mode & SPI_CS_HIGH)) {
--- a/target/linux/bcm63xx/dts/bcm6368-adb-av4202n.dts
+++ b/target/linux/bcm63xx/dts/bcm6368-adb-av4202n.dts
@ -104,6 +104,11 @@
 	};
 };

+&pinctrl {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pinctrl_pci>;
+};
+
 &uart0 {
 	status = "okay";
 };
--- a/target/linux/bcm63xx/patches-5.4/020-v5.8-mtd-rawnand-brcmnand-fix-hamming-oob-layout.patch
+++ b/target/linux/bcm63xx/patches-5.4/020-v5.8-mtd-rawnand-brcmnand-fix-hamming-oob-layout.patch
@ -1,40 +0,0 @@
-From 130bbde4809b011faf64f99dddc14b4b01f440c3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
-Date: Tue, 12 May 2020 09:57:32 +0200
-Subject: [PATCH] mtd: rawnand: brcmnand: fix hamming oob layout
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-First 2 bytes are used in large-page nand.
-
-Fixes: ef5eeea6e911 ("mtd: nand: brcm: switch to mtd_ooblayout_ops")
-Cc: stable@vger.kernel.org
-Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
-Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
-Link: https://lore.kernel.org/linux-mtd/20200512075733.745374-2-noltari@gmail.com
---
- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 11 +++++++----
- 1 file changed, 7 insertions(+), 4 deletions(-)
-
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
-+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
-@@ -1019,11 +1019,14 @@ static int brcmnand_hamming_ooblayout_fr
- 		if (!section) {
- 			/*
- 			 * Small-page NAND use byte 6 for BBI while large-page
-			 * NAND use byte 0.
-+			 * NAND use bytes 0 and 1.
- 			 */
-			if (cfg->page_size > 512)
-				oobregion->offset++;
-			oobregion->length--;
-+			if (cfg->page_size > 512) {
-+				oobregion->offset += 2;
-+				oobregion->length -= 2;
-+			} else {
-+				oobregion->length--;
-+			}
- 		}
- 	}
- 
--- a/target/linux/generic/backport-5.4/825-v5.8-spi-rb4xx-null-pointer-bug-fix.patch
+++ b/target/linux/generic/backport-5.4/825-v5.8-spi-rb4xx-null-pointer-bug-fix.patch
@ -20,11 +20,9 @@ Signed-off-by: Christopher Hill <ch6574@gmail.com>
 drivers/spi/spi-rb4xx.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

-diff --git a/drivers/spi/spi-rb4xx.c b/drivers/spi/spi-rb4xx.c
-index 4c9620e0d18c..17e1a77dc132 100644
 --- a/drivers/spi/spi-rb4xx.c
 +++ b/drivers/spi/spi-rb4xx.c
-@@ -158,6 +158,11 @@ static int rb4xx_spi_probe(struct platform_device *pdev)
+@@ -158,6 +158,11 @@ static int rb4xx_spi_probe(struct platfo
 	master->transfer_one = rb4xx_transfer_one;
 	master->set_cs = rb4xx_set_cs;
 
@ -36,7 +34,7 @@ index 4c9620e0d18c..17e1a77dc132 100644
 	err = devm_spi_register_master(&pdev->dev, master);
 	if (err) {
 		dev_err(&pdev->dev, "failed to register SPI master\n");
-@@ -168,11 +173,6 @@ static int rb4xx_spi_probe(struct platform_device *pdev)
+@@ -168,11 +173,6 @@ static int rb4xx_spi_probe(struct platfo
 	if (err)
 		return err;
 
--- a/target/linux/generic/backport-5.4/826-v5.8-spi-rb4xx-update-driver-to-be-device-tree-aware.patch
+++ b/target/linux/generic/backport-5.4/826-v5.8-spi-rb4xx-update-driver-to-be-device-tree-aware.patch
@ -21,8 +21,6 @@ Signed-off-by: Christopher Hill <ch6574@gmail.com>
 drivers/spi/spi-rb4xx.c | 9 +++++++++
 1 file changed, 9 insertions(+)

-diff --git a/drivers/spi/spi-rb4xx.c b/drivers/spi/spi-rb4xx.c
-index 17e1a77dc132..8aa51beb4ff3 100644
 --- a/drivers/spi/spi-rb4xx.c
 +++ b/drivers/spi/spi-rb4xx.c
@@ -14,6 +14,7 @@
@ -33,7 +31,7 @@ index 17e1a77dc132..8aa51beb4ff3 100644
 
 #include <asm/mach-ath79/ar71xx_regs.h>
 
-@@ -150,6 +151,7 @@ static int rb4xx_spi_probe(struct platform_device *pdev)
+@@ -150,6 +151,7 @@ static int rb4xx_spi_probe(struct platfo
 	if (IS_ERR(ahb_clk))
 		return PTR_ERR(ahb_clk);
 
@ -41,7 +39,7 @@ index 17e1a77dc132..8aa51beb4ff3 100644
 	master->bus_num = 0;
 	master->num_chipselect = 3;
 	master->mode_bits = SPI_TX_DUAL;
-@@ -188,11 +190,18 @@ static int rb4xx_spi_remove(struct platform_device *pdev)
+@@ -188,11 +190,18 @@ static int rb4xx_spi_remove(struct platf
 	return 0;
 }
 
--- a/target/linux/generic/hack-5.4/221-module_exports.patch
+++ b/target/linux/generic/hack-5.4/221-module_exports.patch
@ -56,7 +56,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	}								\
 									\
 	/* __*init sections */						\
-@@ -865,6 +875,8 @@
+@@ -881,6 +891,8 @@
 	EXIT_TEXT							\
 	EXIT_DATA							\
 	EXIT_CALL							\
--- a/target/linux/generic/hack-5.4/902-debloat_proc.patch
+++ b/target/linux/generic/hack-5.4/902-debloat_proc.patch
@ -341,7 +341,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/ipv4/fib_trie.c
 +++ b/net/ipv4/fib_trie.c
-@@ -2844,11 +2844,13 @@ static const struct seq_operations fib_r
+@@ -2847,11 +2847,13 @@ static const struct seq_operations fib_r
 
 int __net_init fib_proc_init(struct net *net)
 {
@ -357,7 +357,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 			fib_triestat_seq_show, NULL))
 		goto out2;
 
-@@ -2859,17 +2861,21 @@ int __net_init fib_proc_init(struct net
+@@ -2862,17 +2864,21 @@ int __net_init fib_proc_init(struct net
 	return 0;
 
 out3:
--- a/target/linux/generic/pending-5.4/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
+++ b/target/linux/generic/pending-5.4/120-Fix-alloc_node_mem_map-with-ARCH_PFN_OFFSET-calcu.patch
@ -71,7 +71,7 @@ Signed-off-by: Tobias Wolf <dev-NTEO@vplace.de>

 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
-@@ -6860,7 +6860,7 @@ static void __ref alloc_node_mem_map(str
+@@ -6855,7 +6855,7 @@ static void __ref alloc_node_mem_map(str
 		mem_map = NODE_DATA(0)->node_mem_map;
 #if defined(CONFIG_HAVE_MEMBLOCK_NODE_MAP) || defined(CONFIG_FLATMEM)
 		if (page_to_pfn(mem_map) != pgdat->node_start_pfn)
--- a/target/linux/generic/pending-5.4/201-extra_optimization.patch
+++ b/target/linux/generic/pending-5.4/201-extra_optimization.patch
@ -14,7 +14,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/Makefile
 +++ b/Makefile
-@@ -701,11 +701,11 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
+@@ -697,11 +697,11 @@ KBUILD_CFLAGS	+= $(call cc-disable-warni
 KBUILD_CFLAGS	+= $(call cc-disable-warning, address-of-packed-member)
 
 ifdef CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE
--- a/target/linux/generic/pending-5.4/203-kallsyms_uncompressed.patch
+++ b/target/linux/generic/pending-5.4/203-kallsyms_uncompressed.patch
@ -106,7 +106,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		}
 --- a/scripts/link-vmlinux.sh
 +++ b/scripts/link-vmlinux.sh
-@@ -164,6 +164,10 @@ kallsyms()
+@@ -160,6 +160,10 @@ kallsyms()
 		kallsymopt="${kallsymopt} --base-relative"
 	fi
 
--- a/target/linux/generic/pending-5.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
+++ b/target/linux/generic/pending-5.4/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@ -66,7 +66,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
 static void rt_fibinfo_free(struct rtable __rcu **rtp)
 --- a/net/ipv4/fib_trie.c
 +++ b/net/ipv4/fib_trie.c
-@@ -2592,6 +2592,7 @@ static const char *const rtn_type_names[
+@@ -2595,6 +2595,7 @@ static const char *const rtn_type_names[
 	[RTN_THROW] = "THROW",
 	[RTN_NAT] = "NAT",
 	[RTN_XRESOLVE] = "XRESOLVE",
--- a/target/linux/ipq40xx/patches-5.4/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
+++ b/target/linux/ipq40xx/patches-5.4/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
@ -14,7 +14,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>

 --- a/drivers/mmc/host/sdhci-msm.c
 +++ b/drivers/mmc/host/sdhci-msm.c
-@@ -1724,7 +1724,7 @@ MODULE_DEVICE_TABLE(of, sdhci_msm_dt_mat
+@@ -1730,7 +1730,7 @@ MODULE_DEVICE_TABLE(of, sdhci_msm_dt_mat
 
 static const struct sdhci_ops sdhci_msm_ops = {
 	.reset = sdhci_reset,
--- a/target/linux/lantiq/files-5.4/arch/mips/boot/dts/lantiq/ar9_avm_fritz7312.dts
+++ b/target/linux/lantiq/files-5.4/arch/mips/boot/dts/lantiq/ar9_avm_fritz7312.dts
@ -108,6 +108,7 @@
 		phy0: ethernet-phy@0 {
 			reg = <0>;
 			reset-gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
+			max-speed = <100>;
 		};
 	};
 };
--- a/target/linux/lantiq/patches-5.4/0001-MIPS-lantiq-add-pcie-driver.patch
+++ b/target/linux/lantiq/patches-5.4/0001-MIPS-lantiq-add-pcie-driver.patch
@ -5491,7 +5491,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 					 unsigned long type);
 --- a/include/linux/pci_ids.h
 +++ b/include/linux/pci_ids.h
-@@ -1072,6 +1072,12 @@
+@@ -1076,6 +1076,12 @@
 #define PCI_DEVICE_ID_SGI_IOC3		0x0003
 #define PCI_DEVICE_ID_SGI_LITHIUM	0x1002
 
--- a/target/linux/layerscape/patches-5.4/303-core-0005-nand-raw-workaround-for-EDO-high-speed-mode.patch
+++ b/target/linux/layerscape/patches-5.4/303-core-0005-nand-raw-workaround-for-EDO-high-speed-mode.patch
@ -13,7 +13,7 @@ Signed-off-by: Han Xu <han.xu@nxp.com>

 --- a/drivers/mtd/nand/raw/nand_base.c
 +++ b/drivers/mtd/nand/raw/nand_base.c
-@@ -934,7 +934,8 @@ static int nand_init_data_interface(stru
+@@ -940,7 +940,8 @@ static int nand_init_data_interface(stru
 		modes = GENMASK(chip->onfi_timing_mode_default, 0);
 	}
 
--- a/target/linux/layerscape/patches-5.4/701-net-0213-dpaa2-eth-Add-CEETM-qdisc-support.patch
+++ b/target/linux/layerscape/patches-5.4/701-net-0213-dpaa2-eth-Add-CEETM-qdisc-support.patch
@ -1535,7 +1535,7 @@ Signed-off-by: Camelia Groza <camelia.groza@nxp.com>
 	int i;
 
 -	if (type != TC_SETUP_QDISC_MQPRIO)
-		return -EINVAL;
+-		return -EOPNOTSUPP;
 -
 	mqprio->hw = TC_MQPRIO_HW_OFFLOAD_TCS;
 	num_queues = dpaa2_eth_queue_count(priv);
--- a/target/linux/octeontx/patches-5.4/0004-PCI-add-quirk-for-Gateworks-PLX-PEX860x-switch-with-.patch
+++ b/target/linux/octeontx/patches-5.4/0004-PCI-add-quirk-for-Gateworks-PLX-PEX860x-switch-with-.patch
@ -22,7 +22,7 @@ Signed-off-by: Tim Harvey <tharvey@gateworks.com>
 #include <linux/platform_data/x86/apple.h>
 #include <linux/pm_runtime.h>
 #include <linux/switchtec.h>
-@@ -5564,3 +5565,34 @@ static void apex_pci_fixup_class(struct
+@@ -5604,3 +5605,34 @@ static void apex_pci_fixup_class(struct
 }
 DECLARE_PCI_FIXUP_CLASS_HEADER(0x1ac1, 0x089a,
 			       PCI_CLASS_NOT_DEFINED, 8, apex_pci_fixup_class);
--- a/target/linux/ramips/dts/mt7621_elecom_wrc-1900gst.dts
+++ b/target/linux/ramips/dts/mt7621_elecom_wrc-1900gst.dts
@ -7,3 +7,35 @@
 	compatible = "elecom,wrc-1900gst", "mediatek,mt7621-soc";
 	model = "ELECOM WRC-1900GST";
 };
+
+&partitions {
+	partition@50000 {
+		compatible = "denx,uimage";
+		label = "firmware";
+		reg = <0x50000 0xb00000>;
+	};
+
+	partition@b50000 {
+		label = "tm_pattern";
+		reg = <0xb50000 0x380000>;
+		read-only;
+	};
+
+	partition@ed0000 {
+		label = "tm_key";
+		reg = <0xed0000 0x80000>;
+		read-only;
+	};
+
+	partition@f50000 {
+		label = "art_block";
+		reg = <0xf50000 0x30000>;
+		read-only;
+	};
+
+	partition@f80000 {
+		label = "user_data";
+		reg = <0xf80000 0x80000>;
+		read-only;
+	};
+};
--- a/target/linux/ramips/dts/mt7621_elecom_wrc-2533gst.dts
+++ b/target/linux/ramips/dts/mt7621_elecom_wrc-2533gst.dts
@ -6,3 +6,35 @@
 	compatible = "elecom,wrc-2533gst", "mediatek,mt7621-soc";
 	model = "ELECOM WRC-2533GST";
 };
+
+&partitions {
+	partition@50000 {
+		compatible = "denx,uimage";
+		label = "firmware";
+		reg = <0x50000 0xb00000>;
+	};
+
+	partition@b50000 {
+		label = "tm_pattern";
+		reg = <0xb50000 0x380000>;
+		read-only;
+	};
+
+	partition@ed0000 {
+		label = "tm_key";
+		reg = <0xed0000 0x80000>;
+		read-only;
+	};
+
+	partition@f50000 {
+		label = "art_block";
+		reg = <0xf50000 0x30000>;
+		read-only;
+	};
+
+	partition@f80000 {
+		label = "user_data";
+		reg = <0xf80000 0x80000>;
+		read-only;
+	};
+};
--- a/target/linux/ramips/dts/mt7621_elecom_wrc-2533gst2.dts
+++ b/target/linux/ramips/dts/mt7621_elecom_wrc-2533gst2.dts
@ -0,0 +1,41 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+
+#include "mt7621_elecom_wrc-gst.dtsi"
+
+/ {
+	compatible = "elecom,wrc-2533gst2", "mediatek,mt7621-soc";
+	model = "ELECOM WRC-2533GST2";
+};
+
+&partitions {
+	partition@50000 {
+		compatible = "denx,uimage";
+		label = "firmware";
+		reg = <0x50000 0x1800000>;
+	};
+
+	partition@1850000 {
+		label = "tm_pattern";
+		reg = <0x1850000 0x400000>;
+		read-only;
+	};
+
+	partition@1c50000 {
+		label = "tm_key";
+		reg = <0x1c50000 0x100000>;
+		read-only;
+	};
+
+	partition@1d50000 {
+		label = "nvram";
+		reg = <0x1d50000 0xb0000>;
+		read-only;
+	};
+
+	partition@1e00000 {
+		label = "user_data";
+		reg = <0x1e00000 0x200000>;
+		read-only;
+	};
+};
--- a/target/linux/ramips/dts/mt7621_elecom_wrc-gst.dtsi
+++ b/target/linux/ramips/dts/mt7621_elecom_wrc-gst.dtsi
@ -11,6 +11,7 @@
 		led-failsafe = &led_power_green;
 		led-running = &led_power_green;
 		led-upgrade = &led_power_green;
+		label-mac-device = &wan;
 	};

 	chosen {
@ -92,7 +93,7 @@

 &switch0 {
 	ports {
-		port@0 {
+		wan: port@0 {
 			status = "okay";
 			label = "wan";
 			mtd-mac-address = <&factory 0xe006>;
@ -126,9 +127,9 @@
 	flash@0 {
 		compatible = "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <10000000>;
+		spi-max-frequency = <40000000>;

-		partitions {
+		partitions: partitions {
 			compatible = "fixed-partitions";
 			#address-cells = <1>;
 			#size-cells = <1>;
@ -150,36 +151,6 @@
 				reg = <0x40000 0x10000>;
 				read-only;
 			};
-
-			partition@50000 {
-				compatible = "denx,uimage";
-				label = "firmware";
-				reg = <0x50000 0xb00000>;
-			};
-
-			partition@b50000 {
-				label = "tm_pattern";
-				reg = <0xb50000 0x380000>;
-				read-only;
-			};
-
-			partition@ed0000 {
-				label = "tm_key";
-				reg = <0xed0000 0x80000>;
-				read-only;
-			};
-
-			partition@f50000 {
-				label = "art_block";
-				reg = <0xf50000 0x30000>;
-				read-only;
-			};
-
-			partition@f80000 {
-				label = "user_data";
-				reg = <0xf80000 0x80000>;
-				read-only;
-			};
 		};
 	};
 };
@ -193,7 +164,34 @@

 &pcie {
 	status = "okay";
-	/* WRC-xxxxGST has MT7615 for 2.4/5 GHz wifi, but it's not supported */
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x0000>;
+		ieee80211-freq-limit = <2400000 2500000>;
+
+		led {
+			led-sources = <0>;
+			led-active-low;
+		};
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		mediatek,mtd-eeprom = <&factory 0x8000>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		led {
+			led-sources = <0>;
+			led-active-low;
+		};
+	};
 };

 &xhci {
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@ -291,6 +291,7 @@ define Device/elecom_wrc-1900gst
  IMAGES += factory.bin
  IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
 	elecom-gst-factory WRC-1900GST 0.00
+  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware wpad-basic
 endef
 TARGET_DEVICES += elecom_wrc-1900gst

@ -302,9 +303,22 @@ define Device/elecom_wrc-2533gst
  IMAGES += factory.bin
  IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
 	elecom-gst-factory WRC-2533GST 0.00
+  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware wpad-basic
 endef
 TARGET_DEVICES += elecom_wrc-2533gst

+define Device/elecom_wrc-2533gst2
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 24576k
+  DEVICE_VENDOR := ELECOM
+  DEVICE_MODEL := WRC-2533GST2
+  IMAGES += factory.bin
+  IMAGE/factory.bin := $$(sysupgrade_bin) | check-size | \
+	elecom-gst-factory WRC-2533GST2 0.00
+  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7615-firmware wpad-basic
+endef
+TARGET_DEVICES += elecom_wrc-2533gst2
+
 define Device/firefly_firewrt
  IMAGE_SIZE := 16064k
  DEVICE_VENDOR := Firefly
--- a/target/linux/ramips/patches-5.4/0013-owrt-hack-fix-mt7688-cache-issue.patch
+++ b/target/linux/ramips/patches-5.4/0013-owrt-hack-fix-mt7688-cache-issue.patch
@ -10,15 +10,16 @@ Signed-off-by: John Crispin <blogic@openwrt.org>

 --- a/arch/mips/kernel/setup.c
 +++ b/arch/mips/kernel/setup.c
-@@ -652,7 +652,6 @@ static void __init arch_mem_init(char **
+@@ -652,8 +652,6 @@ static void __init arch_mem_init(char **
 		memblock_reserve(crashk_res.start,
 				 crashk_res.end - crashk_res.start + 1);
 #endif
 -	device_tree_init();
- 	sparse_init();
- 	plat_swiotlb_setup();
- 
-@@ -760,6 +759,7 @@ void __init setup_arch(char **cmdline_p)
+-
+ 	/*
+ 	 * In order to reduce the possibility of kernel panic when failed to
+ 	 * get IO TLB memory under CONFIG_SWIOTLB, it is better to allocate
+@@ -770,6 +768,7 @@ void __init setup_arch(char **cmdline_p)
 
 	cpu_cache_init();
 	paging_init();
--- a/target/linux/x86/patches-5.4/200-pcengines-apu2-reboot.patch
+++ b/target/linux/x86/patches-5.4/200-pcengines-apu2-reboot.patch
@ -1,6 +1,6 @@
 --- a/arch/x86/kernel/reboot.c
 +++ b/arch/x86/kernel/reboot.c
-@@ -469,6 +469,16 @@ static const struct dmi_system_id reboot
+@@ -477,6 +477,16 @@ static const struct dmi_system_id reboot
 		},
 	},
 
--- a/tools/firmware-utils/src/tplink-safeloader.c
+++ b/tools/firmware-utils/src/tplink-safeloader.c
@ -474,6 +474,46 @@ static struct device_info boards[] = {
 		.last_sysupgrade_partition = "support-list",
 	},

+	/** Firmware layout for the CPE610V2 */
+	{
+		.id     = "CPE610V2",
+		.vendor = "CPE610(TP-LINK|UN|N300-5|00000000):2.0\r\n",
+		.support_list =
+			"SupportList:\r\n"
+			"CPE610(TP-LINK|EU|N300-5|00000000):2.0\r\n"
+			"CPE610(TP-LINK|EU|N300-5|45550000):2.0\r\n"
+			"CPE610(TP-LINK|EU|N300-5|55530000):2.0\r\n"
+			"CPE610(TP-LINK|UN|N300-5|00000000):2.0\r\n"
+			"CPE610(TP-LINK|UN|N300-5|45550000):2.0\r\n"
+			"CPE610(TP-LINK|UN|N300-5|55530000):2.0\r\n"
+			"CPE610(TP-LINK|US|N300-5|55530000):2.0\r\n"
+			"CPE610(TP-LINK|UN|N300-5):2.0\r\n"
+			"CPE610(TP-LINK|EU|N300-5):2.0\r\n"
+			"CPE610(TP-LINK|US|N300-5):2.0\r\n",
+		.support_trail = '\xff',
+		.soft_ver = NULL,
+
+		.partitions = {
+			{"fs-uboot", 0x00000, 0x20000},
+			{"partition-table", 0x20000, 0x02000},
+			{"default-mac", 0x30000, 0x00020},
+			{"product-info", 0x31100, 0x00100},
+			{"signature", 0x32000, 0x00400},
+			{"os-image", 0x40000, 0x200000},
+			{"file-system", 0x240000, 0x570000},
+			{"soft-version", 0x7b0000, 0x00100},
+			{"support-list", 0x7b1000, 0x00400},
+			{"user-config", 0x7c0000, 0x10000},
+			{"default-config", 0x7d0000, 0x10000},
+			{"log", 0x7e0000, 0x10000},
+			{"radio", 0x7f0000, 0x10000},
+			{NULL, 0, 0}
+		},
+
+		.first_sysupgrade_partition = "os-image",
+		.last_sysupgrade_partition = "support-list",
+	},
+
 	{
 		.id     = "WBS210",
 		.vendor = "CPE510(TP-LINK|UN|N300-5):1.0\r\n",