From 02b359b666405a58472868b98dbd08c24621f63e Mon Sep 17 00:00:00 2001
From: Rosen Penev <rosenp@gmail.com>
Date: Mon, 12 Aug 2024 10:23:06 -0700
Subject: [PATCH 01/14] mpc85xx: fix wdr4900 ethernet

997acc7f86ca985cba52f7ea8b72f0661a1e3c52 split this PHY driver up such
that external QCA switches now use CONFIG_QCA83XX_PHY. Fix it here so
that ethernet works again.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16154
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 target/linux/mpc85xx/p1010/config-default | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/linux/mpc85xx/p1010/config-default b/target/linux/mpc85xx/p1010/config-default
index f00fb4d5fd..afa930f4b4 100644
--- a/target/linux/mpc85xx/p1010/config-default
+++ b/target/linux/mpc85xx/p1010/config-default
@@ -1,4 +1,3 @@
-CONFIG_AT803X_PHY=y
 CONFIG_BR200_WP=y
 CONFIG_CMDLINE_OVERRIDE=y
 CONFIG_FIREBOX_T10=y
@@ -21,6 +20,8 @@ CONFIG_NET_DSA_QCA8K_LEDS_SUPPORT=y
 CONFIG_NET_DSA_TAG_QCA=y
 CONFIG_NET_SWITCHDEV=y
 CONFIG_PHYLINK=y
+CONFIG_QCA83XX_PHY=y
+CONFIG_QCOM_NET_PHYLIB=y
 CONFIG_REALTEK_PHY=y
 CONFIG_RED_15W_REV1=y
 CONFIG_REGMAP=y

From c456c5592ee0f785f1345f366b3ce4b44c95ea68 Mon Sep 17 00:00:00 2001
From: Hannu Nyman <hannu.nyman@iki.fi>
Date: Sat, 3 Aug 2024 09:46:18 +0300
Subject: [PATCH 02/14] tools/cmake: Update to 3.30.2

Update cmake to version 3.30.2
Release notes: https://cmake.org/cmake/help/v3.30/release/3.30.html

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/16059
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 tools/cmake/Makefile                                       | 4 ++--
 tools/cmake/patches/110-liblzma.patch                      | 6 +++---
 tools/cmake/patches/120-curl-fix-libressl-linking.patch    | 2 +-
 tools/cmake/patches/130-bootstrap_parallel_make_flag.patch | 2 +-
 tools/cmake/patches/140-zlib.patch                         | 2 +-
 tools/cmake/patches/160-disable_xcode_generator.patch      | 4 ++--
 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/tools/cmake/Makefile b/tools/cmake/Makefile
index 89194ac5d7..c612e7e405 100644
--- a/tools/cmake/Makefile
+++ b/tools/cmake/Makefile
@@ -7,7 +7,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cmake
-PKG_VERSION:=3.29.5
+PKG_VERSION:=3.30.2
 PKG_VERSION_MAJOR:=$(word 1,$(subst ., ,$(PKG_VERSION))).$(word 2,$(subst ., ,$(PKG_VERSION)))
 PKG_RELEASE:=1
 PKG_CPE_ID:=cpe:/a:kitware:cmake
@@ -15,7 +15,7 @@ PKG_CPE_ID:=cpe:/a:kitware:cmake
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/Kitware/CMake/releases/download/v$(PKG_VERSION)/ \
 		https://cmake.org/files/v$(PKG_VERSION_MAJOR)/
-PKG_HASH:=dd63da7d763c0db455ca232f2c443f5234fe0b11f8bd6958a81d29cc987dfd6e
+PKG_HASH:=46074c781eccebc433e98f0bbfa265ca3fd4381f245ca3b140e7711531d60db2
 
 HOST_BUILD_PARALLEL:=1
 HOST_CONFIGURE_PARALLEL:=1
diff --git a/tools/cmake/patches/110-liblzma.patch b/tools/cmake/patches/110-liblzma.patch
index d7cbd434a1..4b8ec0d33f 100644
--- a/tools/cmake/patches/110-liblzma.patch
+++ b/tools/cmake/patches/110-liblzma.patch
@@ -1,8 +1,8 @@
 --- a/Modules/FindLibLZMA.cmake
 +++ b/Modules/FindLibLZMA.cmake
-@@ -58,7 +58,13 @@ The following variables are provided for
- 
- #]=======================================================================]
+@@ -61,7 +61,13 @@ The following variables are provided for
+ cmake_policy(PUSH)
+ cmake_policy(SET CMP0159 NEW) # file(STRINGS) with REGEX updates CMAKE_MATCH_<n>
  
 -find_path(LIBLZMA_INCLUDE_DIR lzma.h )
 +if(UNIX)
diff --git a/tools/cmake/patches/120-curl-fix-libressl-linking.patch b/tools/cmake/patches/120-curl-fix-libressl-linking.patch
index a46acd63da..19217343d1 100644
--- a/tools/cmake/patches/120-curl-fix-libressl-linking.patch
+++ b/tools/cmake/patches/120-curl-fix-libressl-linking.patch
@@ -20,7 +20,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
 ---
 --- a/Utilities/cmcurl/CMakeLists.txt
 +++ b/Utilities/cmcurl/CMakeLists.txt
-@@ -647,6 +647,14 @@ if(CURL_USE_OPENSSL)
+@@ -648,6 +648,14 @@ if(CURL_USE_OPENSSL)
    endif()
    set(SSL_ENABLED ON)
    set(USE_OPENSSL ON)
diff --git a/tools/cmake/patches/130-bootstrap_parallel_make_flag.patch b/tools/cmake/patches/130-bootstrap_parallel_make_flag.patch
index ffe47f9901..a2a873fcea 100644
--- a/tools/cmake/patches/130-bootstrap_parallel_make_flag.patch
+++ b/tools/cmake/patches/130-bootstrap_parallel_make_flag.patch
@@ -1,6 +1,6 @@
 --- a/bootstrap
 +++ b/bootstrap
-@@ -1493,7 +1493,10 @@ int main(){ printf("1%c", (char)0x0a); r
+@@ -1509,7 +1509,10 @@ int main(){ printf("1%c", (char)0x0a); r
  ' > "test.c"
  cmake_original_make_flags="${cmake_make_flags}"
  if test "x${cmake_parallel_make}" != "x"; then
diff --git a/tools/cmake/patches/140-zlib.patch b/tools/cmake/patches/140-zlib.patch
index 8b7b7de1b0..17334a66e0 100644
--- a/tools/cmake/patches/140-zlib.patch
+++ b/tools/cmake/patches/140-zlib.patch
@@ -1,6 +1,6 @@
 --- a/Modules/FindZLIB.cmake
 +++ b/Modules/FindZLIB.cmake
-@@ -117,10 +117,13 @@ else()
+@@ -120,10 +120,13 @@ else()
    set(ZLIB_NAMES_DEBUG zd zlibd zdlld zlibd1 zlib1d zlibstaticd zlibwapid zlibvcd zlibstatd)
  endif()
  
diff --git a/tools/cmake/patches/160-disable_xcode_generator.patch b/tools/cmake/patches/160-disable_xcode_generator.patch
index 20d1086bd4..0e29dedd9b 100644
--- a/tools/cmake/patches/160-disable_xcode_generator.patch
+++ b/tools/cmake/patches/160-disable_xcode_generator.patch
@@ -1,6 +1,6 @@
 --- a/Source/CMakeLists.txt
 +++ b/Source/CMakeLists.txt
-@@ -846,7 +846,7 @@ if(CMake_USE_XCOFF_PARSER)
+@@ -858,7 +858,7 @@ if(CMake_USE_XCOFF_PARSER)
  endif()
  
  # Xcode only works on Apple
@@ -11,7 +11,7 @@
      PRIVATE
 --- a/Source/cmake.cxx
 +++ b/Source/cmake.cxx
-@@ -132,7 +132,7 @@
+@@ -134,7 +134,7 @@
  #  include "cmGlobalGhsMultiGenerator.h"
  #endif
  

From ccc06f67168abdff5d842a706a68c6ced6ef750b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
Date: Tue, 13 Aug 2024 09:24:11 +0200
Subject: [PATCH 03/14] firmware: omnia-mcu-firmware: Bump to 4.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bump `omnia-mcu-firmware` to version 4.1.

This version fixes the following issue on boards with GD32 MCU:
* the user has old GD32 MCU bootloader and application (version 2.0)
* the user upgraded MCU application firmware to newer version (from
  2.99 to 4.0)
* the user wants to upgrade application again, but it is impossible,
  because when MCU application firmware jumps into the old MCU
  bootloader firmware (2.0), the old bootloader firmware gets stuck in
  exception
* the user has to restart the board and upgrade the bootloader firmware
  first, which is not ideal, since if bootloader firmware upgrade is
  interrupted, the board gets bricked

Therefore the `omnia-mcutool` utility version 0.3-rc3 will refuse to
upgrade MCU application firmware to versions 2.99 to 4.0 if the MCU
bootloader firmware is at version 2.0.

For users to be able to upgrade MCU application firmware on GD32
boards, they will need this new 4.1 version.

Users that already upgraded the MCU application firmware to a version
version between 2.99 and 4.0 (using a previous version of the
`omnia-mcutool` utility) have no other choice but to upgrade MCU
bootloader firmware as well.

Signed-off-by: Marek Behún <kabel@kernel.org>
Link: https://github.com/openwrt/openwrt/pull/16159
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 package/firmware/omnia-mcu-firmware/Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/firmware/omnia-mcu-firmware/Makefile b/package/firmware/omnia-mcu-firmware/Makefile
index 24455739d9..6f7bd6ca70 100644
--- a/package/firmware/omnia-mcu-firmware/Makefile
+++ b/package/firmware/omnia-mcu-firmware/Makefile
@@ -9,13 +9,13 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=omnia-mcu-firmware
 PKG_DISTNAME:=omnia_hw_ctrl
-PKG_VERSION:=4.0
+PKG_VERSION:=4.1
 PKG_RELEASE:=1
 
 PKG_SOURCE_SUBDIR:=$(PKG_DISTNAME)-binaries-v$(PKG_VERSION)
 PKG_SOURCE:=$(PKG_SOURCE_SUBDIR).tar.bz2
 PKG_SOURCE_URL:=https://gitlab.nic.cz/turris/hw/$(PKG_DISTNAME)/-/releases/v$(PKG_VERSION)/downloads/
-PKG_HASH:=64b6010f587d89c192685d152644075a5e0abf431eb069ac42981524065a0053
+PKG_HASH:=9c6a3d88ae2ca093dd35aace040f0b1eb1cb5c1141575b45623bdd64d733c59f
 
 PKG_MAINTAINER:=Marek Mojik <marek.mojik@nic.cz>
 PKG_LICENSE:=GPL-3.0-or-later

From efca89daefc0347c64209e4e588fe17536933cf6 Mon Sep 17 00:00:00 2001
From: Hannu Nyman <hannu.nyman@iki.fi>
Date: Wed, 1 May 2024 14:49:46 +0300
Subject: [PATCH 04/14] px5g-mbedtls: add subjectAltName and extendedKeyUsage
 to SSL certs

To better acommodate with the current browsers' requirements, also
self-signed certificates should have subjectAltName and
extendedKeyUsage defined in the self-signed x509 SSL certificates.

The following case sensitive options are now possible:
-addext subjectAltName=DNS:...
-addext subjectAltName=EMAIL:...
-addext subjectAltName=IP:...
-addext subjectAltName=URI:...
-addext extendedKeyUsage=serverAuth OR -addext extendedKeyUsage=any

Initial draft by Paul Donald <newtwen@gmail.com>

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/15366
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 package/utils/px5g-mbedtls/Makefile       |  2 +-
 package/utils/px5g-mbedtls/px5g-mbedtls.c | 67 ++++++++++++++++++++++-
 2 files changed, 67 insertions(+), 2 deletions(-)

diff --git a/package/utils/px5g-mbedtls/Makefile b/package/utils/px5g-mbedtls/Makefile
index 14c9f684a9..6addbbab12 100644
--- a/package/utils/px5g-mbedtls/Makefile
+++ b/package/utils/px5g-mbedtls/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=px5g-mbedtls
-PKG_RELEASE:=10
+PKG_RELEASE:=11
 PKG_LICENSE:=LGPL-2.1
 
 PKG_BUILD_FLAGS:=no-mips16
diff --git a/package/utils/px5g-mbedtls/px5g-mbedtls.c b/package/utils/px5g-mbedtls/px5g-mbedtls.c
index 85abe7dc73..63f54bd9aa 100644
--- a/package/utils/px5g-mbedtls/px5g-mbedtls.c
+++ b/package/utils/px5g-mbedtls/px5g-mbedtls.c
@@ -38,8 +38,13 @@
 #include <mbedtls/ecp.h>
 #include <mbedtls/rsa.h>
 #include <mbedtls/pk.h>
+#include <mbedtls/asn1.h>
+#include <mbedtls/oid.h>
 
-#define PX5G_VERSION "0.2"
+#define SET_OID(x, oid) \
+	do { x.len = MBEDTLS_OID_SIZE(oid); x.p = (unsigned char *) oid; } while (0)
+
+#define PX5G_VERSION "0.3"
 #define PX5G_COPY "Copyright (c) 2009 Steven Barth <steven@midlink.org>"
 #define PX5G_LICENSE "Licensed under the GNU Lesser General Public License v2.1"
 
@@ -193,6 +198,16 @@ int selfsigned(char **arg)
 	mbedtls_pk_context key;
 	mbedtls_x509write_cert cert;
 	mbedtls_mpi serial;
+	mbedtls_x509_san_list *san_list = NULL, *san_prev = NULL, *san_cur = NULL;
+	/*support
+	- MBEDTLS_X509_SAN_DNS_NAME
+	- MBEDTLS_X509_SAN_IP_ADDRESS
+	- MBEDTLS_X509_SAN_RFC822_NAME
+	- MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER
+	*/
+	mbedtls_asn1_sequence *eku = NULL, *ext_key_usage = NULL;
+	char *sanval, *santype;
+	uint8_t ipaddr[16] = { 0 };
 
 	char *subject = "";
 	unsigned int ksize = 512;
@@ -267,8 +282,56 @@ int selfsigned(char **arg)
 				oldc = delim + 1;
 			} while(*delim);
 			arg++;
+		} else if (!strcmp(*arg, "-addext") && arg[1]) {
+			mbedtls_asn1_sequence **tail = &eku;
+			if (!strncmp(arg[1], "extendedKeyUsage=", strlen("extendedKeyUsage="))) {
+				ext_key_usage = calloc(1, sizeof(mbedtls_asn1_sequence));
+				ext_key_usage->buf.tag = MBEDTLS_ASN1_OID;
+				if (!strncmp(arg[1] + strlen("extendedKeyUsage="), "serverAuth", strlen("serverAuth"))) {
+					SET_OID(ext_key_usage->buf, MBEDTLS_OID_SERVER_AUTH);
+				} else if (!strncmp(arg[1] + strlen("extendedKeyUsage="), "any", strlen("any"))) {
+					SET_OID(ext_key_usage->buf, MBEDTLS_OID_ANY_EXTENDED_KEY_USAGE);
+				} // there are other extendedKeyUsage OIDs but none conceivably useful here
+				*tail = ext_key_usage;
+				tail = &ext_key_usage->next;
+				arg++;
+			} else if (!strncmp(arg[1], "subjectAltName=", strlen("subjectAltName=")) && strchr(arg[1], ':') != NULL) {
+				santype = strchr(arg[1], '=') + 1;
+				sanval = strchr(arg[1], ':') + 1;
+				//build sAN list
+				san_cur = calloc(1, sizeof(mbedtls_x509_san_list));
+				san_cur->next = NULL;
+				if (!strncmp(santype, "DNS:", strlen("DNS:"))) {
+					san_cur->node.type = MBEDTLS_X509_SAN_DNS_NAME;
+					san_cur->node.san.unstructured_name.p = (unsigned char *) sanval;
+					san_cur->node.san.unstructured_name.len = strlen(sanval);
+				} else if (!strncmp(santype, "EMAIL:", strlen("EMAIL:"))) {
+					san_cur->node.type = MBEDTLS_X509_SAN_RFC822_NAME;
+					san_cur->node.san.unstructured_name.p = (unsigned char *) sanval;
+					san_cur->node.san.unstructured_name.len = strlen(sanval);
+				} else if (!strncmp(santype, "IP:", strlen("IP:"))) {
+					san_cur->node.type = MBEDTLS_X509_SAN_IP_ADDRESS;
+					mbedtls_x509_crt_parse_cn_inet_pton(sanval, ipaddr);
+					san_cur->node.san.unstructured_name.p = (unsigned char *) ipaddr;
+					san_cur->node.san.unstructured_name.len = sizeof(ipaddr);
+				} else if (!strncmp(santype, "URI:", strlen("URI:"))) {
+					san_cur->node.type = MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER;
+					san_cur->node.san.unstructured_name.p = (unsigned char *) sanval;
+					san_cur->node.san.unstructured_name.len = strlen(sanval);
+				}
+				else fprintf(stderr, "No match to subjectAltName content type.\n");
+			arg++;
+			}
 		}
 		arg++;
+
+		//set the pointers in our san_list linked list
+		if (san_prev == NULL) {
+			san_list = san_cur;
+		} else {
+			san_prev->next = san_cur;
+		}
+		san_prev = san_cur;
 	}
 	gen_key(&key, rsa, ksize, exp, curve, pem);
 
@@ -295,6 +358,8 @@ int selfsigned(char **arg)
 	mbedtls_x509write_crt_set_basic_constraints(&cert, 0, -1);
 	mbedtls_x509write_crt_set_subject_key_identifier(&cert);
 	mbedtls_x509write_crt_set_authority_key_identifier(&cert);
+	mbedtls_x509write_crt_set_subject_alternative_name(&cert, san_list);
+	mbedtls_x509write_crt_set_ext_key_usage(&cert, ext_key_usage);
 
 	_urandom(NULL, (void *) buf, 8);
 	for (len = 0; len < 8; len++)

From db4e8ef952f45e6b58467ffc82528cfae54dea42 Mon Sep 17 00:00:00 2001
From: Pat Fruth <pat@patfruth.com>
Date: Wed, 1 May 2024 13:50:23 +0300
Subject: [PATCH 05/14] uhttpd: Include new extensions in uhttpd self-signed
 certs

The introduction of MacOS Catalina includes new requirements for self-signed certificates.
See: https://support.apple.com/en-us/HT210176
These new requirements include the addition of two TLS server certificate extensions.
- extendedKeyUsage
- subjectAltName
The extendedKeyUsage must be set to serverAuth.
The subjectAltName must be set to the DNS name of the server.
In the absense of these new extensions, when the LUCI web interface is configured to use HTTPS and
self-signed certs, MacOS user running Google Chrome browsers will not be able to access the LUCI web enterface.
If you are generating self-signed certs which do not include that extension, Chrome will
report "NET::ERR_CERT_INVALID" instead of "NET::ERR_CERT_AUTHORITY_INVALID".  You can click through to
ignore the latter, but not the former.

This change updates the uhttpd init script to generate self-signed cert that meets the new requirements.
Signed-off-by: Pat Fruth <pat@patfruth.com>
Link: https://github.com/openwrt/openwrt/pull/15366
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 package/network/services/uhttpd/files/uhttpd.init | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/package/network/services/uhttpd/files/uhttpd.init b/package/network/services/uhttpd/files/uhttpd.init
index c4d0025d69..d9e742024d 100755
--- a/package/network/services/uhttpd/files/uhttpd.init
+++ b/package/network/services/uhttpd/files/uhttpd.init
@@ -57,7 +57,8 @@ generate_keys() {
 	[ -n "$GENKEY_CMD" ] && {
 		$GENKEY_CMD \
 			-days ${days:-730} -newkey ${KEY_OPTS} -keyout "${UHTTPD_KEY}.new" -out "${UHTTPD_CERT}.new" \
-			-subj /C="${country:-ZZ}"/ST="${state:-Somewhere}"/L="${location:-Unknown}"/O="${organization:-OpenWrt$UNIQUEID}"/CN="${commonname:-OpenWrt}"
+			-subj /C="${country:-ZZ}"/ST="${state:-Somewhere}"/L="${location:-Unknown}"/O="${organization:-OpenWrt$UNIQUEID}"/CN="${commonname:-OpenWrt}" \
+			-addext extendedKeyUsage=serverAuth -addext subjectAltName=DNS:"${commonname:-OpenWrt}"
 		sync
 		mv "${UHTTPD_KEY}.new" "${UHTTPD_KEY}"
 		mv "${UHTTPD_CERT}.new" "${UHTTPD_CERT}"

From 0b7d99147b721c9bc95e9a0caacd300227d10375 Mon Sep 17 00:00:00 2001
From: Hannu Nyman <hannu.nyman@iki.fi>
Date: Wed, 1 May 2024 13:53:34 +0300
Subject: [PATCH 06/14] uhttpd: Decrease the default validity time of
 certificate

The recommended maximum validity period is currently 397 days
and some browsers throw warning with longer periods.

Reference to
https://cabforum.org/working-groups/server/baseline-requirements/
 6.3.2 Certificate operational periods and key pair usage periods
 Subscriber Certificates issued on or after 1 September 2020
 SHOULD NOT have a Validity Period greater than 397 days and
 MUST NOT have a Validity Period greater than 398 days.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/15366
Signed-off-by: Robert Marko <robimarko@gmail.com>
---
 package/network/services/uhttpd/Makefile            | 2 +-
 package/network/services/uhttpd/files/uhttpd.config | 4 ++--
 package/network/services/uhttpd/files/uhttpd.init   | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/package/network/services/uhttpd/Makefile b/package/network/services/uhttpd/Makefile
index a373e62820..ea76fa65ea 100644
--- a/package/network/services/uhttpd/Makefile
+++ b/package/network/services/uhttpd/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=uhttpd
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git
diff --git a/package/network/services/uhttpd/files/uhttpd.config b/package/network/services/uhttpd/files/uhttpd.config
index a9b8ff3d15..ce76fe6b6b 100644
--- a/package/network/services/uhttpd/files/uhttpd.config
+++ b/package/network/services/uhttpd/files/uhttpd.config
@@ -123,8 +123,8 @@ config uhttpd main
 # Defaults for automatic certificate and key generation
 config cert defaults
 
-	# Validity time
-	option days		730
+	# Validity time, 397 days is maximum allowed by CA/Browser forum
+	option days		397
 
 	# key type: rsa or ec
 	option key_type		ec
diff --git a/package/network/services/uhttpd/files/uhttpd.init b/package/network/services/uhttpd/files/uhttpd.init
index d9e742024d..6929fef421 100755
--- a/package/network/services/uhttpd/files/uhttpd.init
+++ b/package/network/services/uhttpd/files/uhttpd.init
@@ -56,7 +56,7 @@ generate_keys() {
 	[ -x "$PX5G_BIN" ] && GENKEY_CMD="$PX5G_BIN selfsigned -der"
 	[ -n "$GENKEY_CMD" ] && {
 		$GENKEY_CMD \
-			-days ${days:-730} -newkey ${KEY_OPTS} -keyout "${UHTTPD_KEY}.new" -out "${UHTTPD_CERT}.new" \
+			-days ${days:-397} -newkey ${KEY_OPTS} -keyout "${UHTTPD_KEY}.new" -out "${UHTTPD_CERT}.new" \
 			-subj /C="${country:-ZZ}"/ST="${state:-Somewhere}"/L="${location:-Unknown}"/O="${organization:-OpenWrt$UNIQUEID}"/CN="${commonname:-OpenWrt}" \
 			-addext extendedKeyUsage=serverAuth -addext subjectAltName=DNS:"${commonname:-OpenWrt}"
 		sync

From ff553bd00c47fe5b21871bbac0538408154d85cd Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Wed, 14 Aug 2024 10:26:24 +0200
Subject: [PATCH 07/14] bmips: inteno-xg6846: Activate USB port
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some versions of the Inteno XG6846 has a USB port mounted.
For these machines the corresponing USB port nodes need to
be enabled.

Suggested-by: Henrik Ginstmark <henrik@ginstmark.se>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[reorder DTS alphabetically]
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
---
 target/linux/bmips/dts/bcm6328-inteno-xg6846.dts | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts b/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts
index 8f5b30d213..4079bfff17 100644
--- a/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts
+++ b/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts
@@ -130,6 +130,10 @@
 	};
 };
 
+&ehci {
+	status = "okay";
+};
+
 &ethernet {
 	status = "okay";
 
@@ -282,7 +286,7 @@
 	};
 };
 
-&uart0 {
+&ohci {
 	status = "okay";
 };
 
@@ -310,3 +314,11 @@
 		};
 	};
 };
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};

From fb2eabfd6b6e9e02dda659668fb91d5a02e9e652 Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Wed, 14 Aug 2024 10:26:25 +0200
Subject: [PATCH 08/14] bmips: inteno-xg6846: Add EEPROM node

For some troublesome devices it is necessary to obtain direct access
to the SFP module EEPROM so define it in the device tree.

Suggested-by: Paul Donald <newtwen@gmail.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
---
 target/linux/bmips/dts/bcm6328-inteno-xg6846.dts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts b/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts
index 4079bfff17..94e57dcb0d 100644
--- a/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts
+++ b/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts
@@ -40,6 +40,12 @@
 		scl-gpios = <&gpio 19 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
 		#address-cells = <1>;
 		#size-cells = <0>;
+
+		sfp_eeprom: eeprom@50 {
+			compatible = "atmel,24c02";
+			reg = <0x50>;
+			read-only;
+		};
 	};
 
 	/* This I2C bus is used for the external CATV connector (usually unused) */

From 2ce206f27db16f0b02b0883d75b6f318643a21e6 Mon Sep 17 00:00:00 2001
From: Linus Walleij <linus.walleij@linaro.org>
Date: Wed, 14 Aug 2024 10:26:26 +0200
Subject: [PATCH 09/14] bmips: inteno-xg6846: Add DSA LED definitions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This adds the LED definitons for the XG6846 DSA port LEDs.
These are standard properties compatible with the existing
Marvell 88e6xxx DT bindings and fully standardized so this
is fine to add. They will be used by the in-flight Marvell
88e6xxx LEDs support patch.

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[add empty lines between leds, remove default-state="off"]
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
---
 .../linux/bmips/dts/bcm6328-inteno-xg6846.dts | 108 ++++++++++++++++++
 1 file changed, 108 insertions(+)

diff --git a/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts b/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts
index 94e57dcb0d..91b771a2bd 100644
--- a/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts
+++ b/target/linux/bmips/dts/bcm6328-inteno-xg6846.dts
@@ -199,6 +199,24 @@
 				label = "lan1";
 
 				phy-handle = <&lan1phy>;
+
+				leds {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					led@0 {
+						reg = <0>;
+						color = <LED_COLOR_ID_GREEN>;
+						function = LED_FUNCTION_LAN;
+						default-state = "keep";
+					};
+
+					led@1 {
+						reg = <1>;
+						color = <LED_COLOR_ID_AMBER>;
+						function = LED_FUNCTION_LAN;
+					};
+				};
 			};
 
 			port@1 {
@@ -206,6 +224,24 @@
 				label = "lan2";
 
 				phy-handle = <&lan2phy>;
+
+				leds {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					led@0 {
+						reg = <0>;
+						color = <LED_COLOR_ID_GREEN>;
+						function = LED_FUNCTION_LAN;
+						default-state = "keep";
+					};
+
+					led@1 {
+						reg = <1>;
+						color = <LED_COLOR_ID_AMBER>;
+						function = LED_FUNCTION_LAN;
+					};
+				};
 			};
 
 			port@2 {
@@ -213,6 +249,24 @@
 				label = "lan3";
 
 				phy-handle = <&lan3phy>;
+
+				leds {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					led@0 {
+						reg = <0>;
+						color = <LED_COLOR_ID_GREEN>;
+						function = LED_FUNCTION_LAN;
+						default-state = "keep";
+					};
+
+					led@1 {
+						reg = <1>;
+						color = <LED_COLOR_ID_AMBER>;
+						function = LED_FUNCTION_LAN;
+					};
+				};
 			};
 
 			port@3 {
@@ -220,6 +274,24 @@
 				label = "lan4";
 
 				phy-handle = <&lan4phy>;
+
+				leds {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					led@0 {
+						reg = <0>;
+						color = <LED_COLOR_ID_GREEN>;
+						function = LED_FUNCTION_LAN;
+						default-state = "keep";
+					};
+
+					led@1 {
+						reg = <1>;
+						color = <LED_COLOR_ID_AMBER>;
+						function = LED_FUNCTION_LAN;
+					};
+				};
 			};
 
 			port@4 {
@@ -227,6 +299,24 @@
 				label = "ext1";
 
 				phy-handle = <&ext1phy>;
+
+				leds {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					led@0 {
+						reg = <0>;
+						color = <LED_COLOR_ID_GREEN>;
+						function = LED_FUNCTION_WAN;
+						default-state = "keep";
+					};
+
+					led@1 {
+						reg = <1>;
+						color = <LED_COLOR_ID_AMBER>;
+						function = LED_FUNCTION_WAN;
+					};
+				};
 			};
 
 			port@5 {
@@ -240,6 +330,24 @@
 					speed = <1000>;
 					full-duplex;
 				};
+
+				leds {
+					#address-cells = <1>;
+					#size-cells = <0>;
+
+					led@0 {
+						reg = <0>;
+						color = <LED_COLOR_ID_GREEN>;
+						function = LED_FUNCTION_WAN;
+						default-state = "keep";
+					};
+
+					led@1 {
+						reg = <1>;
+						color = <LED_COLOR_ID_AMBER>;
+						function = LED_FUNCTION_WAN;
+					};
+				};
 			};
 
 			port@6 {

From 63412038dc7e76d4eee10dc39e8b5c4a3762c5c5 Mon Sep 17 00:00:00 2001
From: Antonio Flores <antflores627@gmail.com>
Date: Sat, 10 Aug 2024 14:48:34 -0400
Subject: [PATCH 10/14] mac80211: add rtw89 driver

This commits adds the RTW89 driver from Realtek.
Supports the Realtek 8851BE/8852AE/8852BE/8852CE PCIe wireless chips.

Signed-off-by: Antonio Flores <antflores627@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16131
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 package/kernel/mac80211/realtek.mk | 93 +++++++++++++++++++++++++++++-
 1 file changed, 92 insertions(+), 1 deletion(-)

diff --git a/package/kernel/mac80211/realtek.mk b/package/kernel/mac80211/realtek.mk
index b53d08b24a..221158bee6 100644
--- a/package/kernel/mac80211/realtek.mk
+++ b/package/kernel/mac80211/realtek.mk
@@ -3,7 +3,8 @@ PKG_DRIVERS += \
 	rtl8192ce rtl8192se rtl8192de rtl8192cu rtl8723-common rtl8723be rtl8723bs rtl8821ae \
 	rtl8xxxu rtw88 rtw88-pci rtw88-usb rtw88-sdio rtw88-8821c rtw88-8822b rtw88-8822c \
 	rtw88-8723d rtw88-8821ce rtw88-8821cu rtw88-8822be rtw88-8822bu \
-	rtw88-8822ce rtw88-8822cu rtw88-8723de rtw88-8723ds rtw88-8723du
+	rtw88-8822ce rtw88-8822cu rtw88-8723de rtw88-8723ds rtw88-8723du \
+	rtw89 rtw89-pci rtw89-8851be rtw89-8852ae rtw89-8852be rtw89-8852ce
 
 config-$(call config_package,rtlwifi) += RTL_CARDS RTLWIFI
 config-$(call config_package,rtlwifi-pci) += RTLWIFI_PCI
@@ -46,6 +47,16 @@ config-$(call config_package,rtw88-8723du) += RTW88_8723DU
 config-$(CONFIG_PACKAGE_RTW88_DEBUG) += RTW88_DEBUG
 config-$(CONFIG_PACKAGE_RTW88_DEBUGFS) += RTW88_DEBUGFS
 
+config-$(call config_package,rtw89) += RTW89 RTW89_CORE
+config-$(call config_package,rtw89-pci) += RTW89_PCI
+config-$(call config_package,rtw89-8851be) += RTW89_8851B RTW89_8851BE
+config-$(call config_package,rtw89-8852ae) += RTW89_8852A RTW89_8852AE
+config-$(call config_package,rtw89-8852be) += RTW89_8852B RTW89_8852BE
+config-$(call config_package,rtw89-8852ce) += RTW89_8852C RTW89_8852CE
+config-$(CONFIG_PACKAGE_RTW89_DEBUG) += RTW89_DEBUG
+config-$(CONFIG_PACKAGE_RTW89_DEBUGFS) += RTW89_DEBUGFS
+config-$(CONFIG_PACKAGE_RTW89_DEBUGMSG) += RTW89_DEBUGMSG
+
 define KernelPackage/rtlwifi/config
 	config PACKAGE_RTLWIFI_DEBUG
 		bool "Realtek wireless debugging"
@@ -359,3 +370,83 @@ define KernelPackage/rtl8723bs/description
  on the 1st gen Intel Compute Stick, the CHIP and many other Intel Atom and ARM
  based devices.
 endef
+
+define KernelPackage/rtw89/config
+	config PACKAGE_RTW89_DEBUG
+		bool "Realtek wireless debugging (rtw89)"
+		depends on PACKAGE_kmod-rtw89
+		help
+		  Enable debugging output for rtw89 devices.
+
+	config PACKAGE_RTW89_DEBUGFS
+		bool "Enable rtw89 debugfs support"
+		select KERNEL_DEBUG_FS
+		depends on PACKAGE_kmod-rtw89
+		help
+		  Select this to see extensive information about
+		  the internal state of rtw89 in debugfs.
+
+	config PACKAGE_RTW89_DEBUGMSG
+		bool "Realtek rtw89 debug message support"
+		depends on PACKAGE_kmod-rtw89
+		help
+		  Enable debug message support.
+endef
+
+define KernelPackage/rtw89
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTW89 core
+  DEPENDS+= +@DRIVER_11AC_SUPPORT +@DRIVER_11AX_SUPPORT +kmod-mac80211
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw89/rtw89_core.ko
+  AUTOLOAD:=$(call AutoProbe,rtw89_core)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtw89-pci
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTW89 PCI chips support
+  DEPENDS+= @PCI_SUPPORT +kmod-rtw89
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw89/rtw89_pci.ko
+  AUTOLOAD:=$(call AutoProbe,rtw89_pci)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtw89-8851be
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8851BE support
+  DEPENDS+= +kmod-rtw89-pci +rtl8851be-firmware
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw89/rtw89_8851b.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw89/rtw89_8851be.ko
+  AUTOLOAD:=$(call AutoProbe,rtw89_8851be)
+endef
+
+define KernelPackage/rtw89-8852ae
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8852AE support
+  DEPENDS+= +kmod-rtw89-pci +rtl8852ae-firmware
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw89/rtw89_8852a.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw89/rtw89_8852ae.ko
+  AUTOLOAD:=$(call AutoProbe,rtw89_8852ae)
+endef
+
+define KernelPackage/rtw89-8852be
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8852BE support
+  DEPENDS+= +kmod-rtw89-pci +rtl8852be-firmware
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw89/rtw89_8852b.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw89/rtw89_8852be.ko
+  AUTOLOAD:=$(call AutoProbe,rtw89_8852be)
+endef
+
+define KernelPackage/rtw89-8852ce
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8852CE support
+  DEPENDS+= +kmod-rtw89-pci +rtl8852ce-firmware
+  FILES:= \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw89/rtw89_8852c.ko \
+	$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw89/rtw89_8852ce.ko
+  AUTOLOAD:=$(call AutoProbe,rtw89_8852ce)
+endef

From ced78ccb2f72c6d409d3b6610442c78f214cedf0 Mon Sep 17 00:00:00 2001
From: FUKAUMI Naoki <naoki@radxa.com>
Date: Wed, 14 Aug 2024 10:20:12 +0900
Subject: [PATCH 11/14] rockchip: fix sysupgrade for Radxa ROCK Pi S

SUPPORTED_DEVICES is required for Radxa ROCK Pi S.

Signed-off-by: FUKAUMI Naoki <naoki@radxa.com>
Link: https://github.com/openwrt/openwrt/pull/16167
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 target/linux/rockchip/image/armv8.mk | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/linux/rockchip/image/armv8.mk b/target/linux/rockchip/image/armv8.mk
index efae3285b3..b4404761bd 100644
--- a/target/linux/rockchip/image/armv8.mk
+++ b/target/linux/rockchip/image/armv8.mk
@@ -161,6 +161,7 @@ define Device/radxa_rock-pi-s
   DEVICE_VENDOR := Radxa
   DEVICE_MODEL := ROCK Pi S
   SOC := rk3308
+  SUPPORTED_DEVICES := radxa,rockpis
   BOOT_SCRIPT := rock-pi-s
   DEVICE_PACKAGES := kmod-rtw88-8723ds kmod-usb-net-cdc-ncm kmod-usb-net-rndis wpad-basic-mbedtls
 endef

From 2fbffb3643b012e37c692e8c390b916b8ad20fe3 Mon Sep 17 00:00:00 2001
From: Roland Reinl <reinlroland+github@gmail.com>
Date: Thu, 18 Jul 2024 16:10:53 +0200
Subject: [PATCH 12/14] mediatek: Add support for Linksys EA7500 v3

Specification:
- MT7629 CPU
- MT7531 switch
- MT7761N and MT7762N wifi
- 256 MB RAM
- 128 MB NAND flash with dual-boot partitions
- 2 buttons: WPS and reset
- 1 WAN port (1G)
- 4 LAN ports (1G)
- 1 USB port

Limitations (same as other MT7629/MT7761N/MT7762N devices):
- Wifi is not working
- Second core is not working (kernel error message "CPU1: failed to come online")

Disassembly:
- There are two screws under the front rubber feet and two under the label on the bottom (in the corners towards the back, you should be able to feel them).

Serial Interface:
- UART pin header is already soldered on the board. Pinning from front to back:
1 - VCC
2 - TX
3 - RX
4 - n/a
5 - GND

GPIO:
- 1 white LED, connected to GPIO 52
- 1 reset button, connected to GPIO 60
- 1 WPS button, connected to GPIO 58

MAC Adresses:
- The MAC address printed on the device label is used for LAN and WAN
- The MAC address is stored in the devinfo partition in ASCII format (hw_mac_addr=aa:bb:cc:dd:ee)
- 2.4 GHz wifi uses MAC of the device label + 1
- 5 GHz wifi uses MAC of the device label + 2

Flashing:
- OpenWrt is only runnig in the first partition of dual boot
- To ensure to be able to go back to the factory image, flash the last OEM firmware via OEM web interface. This will ensure that the OEM firmware is present on both partitions
- Because of dual boot partitions, flashing via OEM interface is not supported
- Start a TFTP server and provide the initramfs image. Default settings:
  - Router IP: 192.168.1.1
  - TFTP server IP: 192.168.1.100
  - TFTP file name: 7531.bin
- Open the device, connect UART and select " 1. System Load Linux to SDRAM via TFTP." during startup
- Adapt the settings to your environment, if required
- After initramfs is booted, flash the sysupgrade image

Return to OEM firmware:
- Run the following commands in OpenWrt to switch to the second partition
  fw_setenv boot_part 2
  fw_setenv bootimage 2
- Reboot the device. OEM firmware will start up again

Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16067
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 .../boot/uboot-envtools/files/mediatek_mt7629 |   3 +
 package/system/mtd/src/Makefile               |   2 +-
 .../mediatek/dts/mt7629-linksys-ea7500-v3.dts | 300 ++++++++++++++++++
 target/linux/mediatek/image/mt7629.mk         |  16 +
 .../mt7629/base-files/etc/board.d/02_network  |   8 +-
 .../mt7629/base-files/etc/init.d/bootcount    |   3 +
 .../mt7629/base-files/lib/upgrade/platform.sh |   5 +
 7 files changed, 335 insertions(+), 2 deletions(-)
 create mode 100644 target/linux/mediatek/dts/mt7629-linksys-ea7500-v3.dts

diff --git a/package/boot/uboot-envtools/files/mediatek_mt7629 b/package/boot/uboot-envtools/files/mediatek_mt7629
index 313fb6a448..ce09caffab 100644
--- a/package/boot/uboot-envtools/files/mediatek_mt7629
+++ b/package/boot/uboot-envtools/files/mediatek_mt7629
@@ -16,6 +16,9 @@ iptime,a6004mx|\
 netgear,ex6250-v2)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000"
 	;;
+linksys,ea7500-v3)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000" "0x20000"
+	;;
 esac
 
 config_load ubootenv
diff --git a/package/system/mtd/src/Makefile b/package/system/mtd/src/Makefile
index 57922f3309..c04affc026 100644
--- a/package/system/mtd/src/Makefile
+++ b/package/system/mtd/src/Makefile
@@ -12,7 +12,7 @@ obj.gemini = $(obj.wrgg)
 obj.brcm = trx.o
 obj.bcm47xx = $(obj.brcm)
 obj.bcm53xx = $(obj.brcm) $(obj.seama)
-obj.mediatek = $(obj.brcm)
+obj.mediatek = $(obj.brcm) linksys_bootcount.o
 obj.bcm63xx = imagetag.o
 obj.bmips = imagetag.o
 obj.ramips = $(obj.brcm) $(obj.seama) $(obj.tpl) $(obj.wrg) linksys_bootcount.o
diff --git a/target/linux/mediatek/dts/mt7629-linksys-ea7500-v3.dts b/target/linux/mediatek/dts/mt7629-linksys-ea7500-v3.dts
new file mode 100644
index 0000000000..70b7cde6d9
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7629-linksys-ea7500-v3.dts
@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include "mt7629.dtsi"
+
+/ {
+	model = "Linksys EA7500 v3";
+	compatible = "linksys,ea7500-v3", "mediatek,mt7629";
+
+	aliases {
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-override = "console=ttyS0,115200n8";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: power {
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 52 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 60 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 58 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x10000000>;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&eth_pins>;
+	pinctrl-1 = <&ephy_leds_pins>;
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&phy0>;
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		phy0: ethernet-phy@0 {
+			reg = <0>;
+		};
+
+		switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 28 0>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			interrupt-parent = <&pio>;
+			interrupts = <6 IRQ_TYPE_LEVEL_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					label = "lan1";
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan2";
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan3";
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan4";
+				};
+
+				port@6 {
+					reg = <6>;
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&bch {
+	status = "okay";
+};
+
+&snfi {
+	pinctrl-names = "default";
+	pinctrl-0 = <&serial_nand_pins>;
+	status = "okay";
+	flash@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+		nand-ecc-engine = <&snfi>;
+		mediatek,bmt-v2;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Bootloader";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "Config";
+				reg = <0x100000 0x40000>;
+			};
+
+			partition@140000 {
+				label = "Factory";
+				reg = <0x140000 0x80000>;
+				read-only;
+			};
+
+			partition@1c0000 {
+				label = "kernel";
+				reg = <0x1c0000 0x800000>;
+			};
+
+			partition@9c0000 {
+				label = "ubi";
+				reg = <0x9c0000 0x2000000>;
+			};
+
+			partition@29c0000 {
+				label = "Kernel2";
+				reg = <0x29c0000 0x2800000>;
+				read-only;
+			};
+
+			partition@51c0000 {
+				label = "devinfo";
+				reg = <0x51c0000 0x40000>;
+				read-only;
+			};
+
+			partition@5200000 {
+				label = "sysdiag";
+				reg = <0x5200000 0x100000>;
+				read-only;
+			};
+
+			partition@5300000 {
+				label = "syscfg";
+				reg = <0x5300000 0x2000000>;
+				read-only;
+			};
+
+			partition@7300000 {
+				label = "s_env";
+				reg = <0x7300000 0x40000>;
+			};
+		};
+	};
+};
+
+&pio {
+	eth_pins: eth-pins {
+		mux {
+			function = "eth";
+			groups = "mdc_mdio";
+		};
+	};
+
+	ephy_leds_pins: ephy-leds-pins {
+		mux {
+			function = "led";
+			groups = "ephy_leds";
+		};
+	};
+
+	/* Serial NAND is shared pin with SPI-NOR */
+	serial_nand_pins: serial-nand-pins {
+		mux {
+			function = "flash";
+			groups = "snfi";
+		};
+	};
+
+	uart0_pins: uart0-pins {
+		mux {
+			function = "uart";
+			groups = "uart0_txd_rxd" ;
+		};
+	};
+
+	watchdog_pins: watchdog-pins {
+		mux {
+			function = "watchdog";
+			groups = "watchdog";
+		};
+	};
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+	status = "okay";
+};
+
+&u3phy0 {
+	status = "okay";
+};
+
+&uart0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart0_pins>;
+	status = "okay";
+};
+
+&watchdog {
+	pinctrl-names = "default";
+	pinctrl-0 = <&watchdog_pins>;
+	status = "okay";
+
+	interrupt-controller;
+	#interrupt-cells = <1>;
+	interrupt-parent = <&pio>;
+	interrupts = <GIC_SPI 0x80 IRQ_TYPE_EDGE_FALLING>;
+};
diff --git a/target/linux/mediatek/image/mt7629.mk b/target/linux/mediatek/image/mt7629.mk
index 9f0ea98950..57c0a5bc54 100644
--- a/target/linux/mediatek/image/mt7629.mk
+++ b/target/linux/mediatek/image/mt7629.mk
@@ -27,6 +27,22 @@ define Device/iptime_a6004mx
 endef
 TARGET_DEVICES += iptime_a6004mx
 
+define Device/linksys_ea7500-v3
+  $(Device/uimage-lzma-loader)
+  DEVICE_VENDOR := Linksys
+  DEVICE_MODEL := EA7500
+  DEVICE_VARIANT := v3
+  DEVICE_DTS := mt7629-linksys-ea7500-v3
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-usb3 uboot-envtools
+  IMAGE_SIZE := 40m
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata | check-size
+endef
+TARGET_DEVICES += linksys_ea7500-v3
+
 define Device/netgear_ex6250-v2
   DEVICE_VENDOR := NETGEAR
   DEVICE_MODEL := EX6250
diff --git a/target/linux/mediatek/mt7629/base-files/etc/board.d/02_network b/target/linux/mediatek/mt7629/base-files/etc/board.d/02_network
index df042f8ad2..875ed34dcc 100644
--- a/target/linux/mediatek/mt7629/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/mt7629/base-files/etc/board.d/02_network
@@ -8,7 +8,8 @@ mediatek_setup_interfaces()
 	local board="$1"
 
 	case $board in
-	iptime,a6004mx)
+	iptime,a6004mx|\
+	linksys,ea7500-v3)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "eth1"
 		;;
 	mediatek,mt7629-rfb)
@@ -28,6 +29,11 @@ mediatek_setup_macs()
 	local board="$1"
 
 	case $board in
+	linksys,ea7500-v3)
+		lan_mac=$(mtd_get_mac_ascii devinfo hw_mac_addr)
+		wan_mac=$lan_mac
+		label_mac=$lan_mac
+		;;
 	netgear,ex6250-v2)
 		lan_mac=$(mtd_get_mac_ascii Config mac)
 		label_mac=$lan_mac
diff --git a/target/linux/mediatek/mt7629/base-files/etc/init.d/bootcount b/target/linux/mediatek/mt7629/base-files/etc/init.d/bootcount
index a6b8fac1d9..959944fef8 100755
--- a/target/linux/mediatek/mt7629/base-files/etc/init.d/bootcount
+++ b/target/linux/mediatek/mt7629/base-files/etc/init.d/bootcount
@@ -13,5 +13,8 @@ boot() {
 			exit 1
 		fi
 		;;
+	linksys,ea7500-v3)
+		mtd resetbc s_env || true
+		;;
 	esac
 }
diff --git a/target/linux/mediatek/mt7629/base-files/lib/upgrade/platform.sh b/target/linux/mediatek/mt7629/base-files/lib/upgrade/platform.sh
index f10ad14b49..ebd3678c2e 100755
--- a/target/linux/mediatek/mt7629/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mediatek/mt7629/base-files/lib/upgrade/platform.sh
@@ -12,6 +12,11 @@ platform_do_upgrade() {
 	iptime,a6004mx)
 		nand_do_upgrade "$1"
 		;;
+	linksys,ea7500-v3)
+		fw_setenv boot_part 1
+		fw_setenv bootimage 1
+		nand_do_upgrade "$1"
+		;;
 	*)
 		default_do_upgrade "$1"
 		;;

From b51abacb5fd465e5ce4329ec27ac516b5a2b83b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Beh=C3=BAn?= <kabel@kernel.org>
Date: Mon, 22 Jul 2024 16:57:50 +0200
Subject: [PATCH 13/14] config: kernel: Add support for configuring BTRFS to be
 built-in
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the KERNEL_BTRFS_FS config option so that targets can select
whether BTRFS support must be built-in.

Select this option (alongside KERNEL_BTRFS_FS_POSIX_ACL) from the
layerscape/armv8_64b subtarget instead of enabling it in
target/linux/layerscape/armv8_64b/config-* files.

Move disabling of CONFIG_BTRFS_FS_CHECK_INTEGRITY into generic configs.

This makes it possible for OpenWRT to be built with built-in BTRFS
support on specific boards, instead of whole targets.

Signed-off-by: Marek Behún <kabel@kernel.org>
Link: https://github.com/openwrt/openwrt/pull/15990
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 config/Config-kernel.in                      | 6 ++++++
 target/linux/generic/config-5.15             | 1 +
 target/linux/generic/config-6.1              | 1 +
 target/linux/generic/config-6.6              | 1 +
 target/linux/layerscape/armv8_64b/config-6.1 | 3 ---
 target/linux/layerscape/armv8_64b/config-6.6 | 3 ---
 target/linux/layerscape/armv8_64b/target.mk  | 1 +
 7 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/config/Config-kernel.in b/config/Config-kernel.in
index 9cedd1df12..73b26b631a 100644
--- a/config/Config-kernel.in
+++ b/config/Config-kernel.in
@@ -1238,6 +1238,12 @@ if KERNEL_IP_PNP
 
 endif
 
+config KERNEL_BTRFS_FS
+	bool "Compile the kernel with built-in BTRFS support"
+	help
+	  Say Y here if you want to make the kernel to be able to boot off a
+	  BTRFS partition.
+
 menu "Filesystem ACL and attr support options"
 	config USE_FS_ACL_ATTR
 		bool "Use filesystem ACL and attr support by default"
diff --git a/target/linux/generic/config-5.15 b/target/linux/generic/config-5.15
index 8e2223aebb..90650ac7dd 100644
--- a/target/linux/generic/config-5.15
+++ b/target/linux/generic/config-5.15
@@ -774,6 +774,7 @@ CONFIG_BROKEN_ON_SMP=y
 # CONFIG_BTRFS_ASSERT is not set
 # CONFIG_BTRFS_DEBUG is not set
 # CONFIG_BTRFS_FS is not set
+# CONFIG_BTRFS_FS_CHECK_INTEGRITY is not set
 # CONFIG_BTRFS_FS_POSIX_ACL is not set
 # CONFIG_BTRFS_FS_REF_VERIFY is not set
 # CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set
diff --git a/target/linux/generic/config-6.1 b/target/linux/generic/config-6.1
index 1b657ea214..80dcb54683 100644
--- a/target/linux/generic/config-6.1
+++ b/target/linux/generic/config-6.1
@@ -820,6 +820,7 @@ CONFIG_BROKEN_ON_SMP=y
 # CONFIG_BTRFS_ASSERT is not set
 # CONFIG_BTRFS_DEBUG is not set
 # CONFIG_BTRFS_FS is not set
+# CONFIG_BTRFS_FS_CHECK_INTEGRITY is not set
 # CONFIG_BTRFS_FS_POSIX_ACL is not set
 # CONFIG_BTRFS_FS_REF_VERIFY is not set
 # CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set
diff --git a/target/linux/generic/config-6.6 b/target/linux/generic/config-6.6
index e5c5360608..26651e077c 100644
--- a/target/linux/generic/config-6.6
+++ b/target/linux/generic/config-6.6
@@ -725,6 +725,7 @@ CONFIG_BROKEN_ON_SMP=y
 # CONFIG_BTRFS_ASSERT is not set
 # CONFIG_BTRFS_DEBUG is not set
 # CONFIG_BTRFS_FS is not set
+# CONFIG_BTRFS_FS_CHECK_INTEGRITY is not set
 # CONFIG_BTRFS_FS_POSIX_ACL is not set
 # CONFIG_BTRFS_FS_REF_VERIFY is not set
 # CONFIG_BTRFS_FS_RUN_SANITY_TESTS is not set
diff --git a/target/linux/layerscape/armv8_64b/config-6.1 b/target/linux/layerscape/armv8_64b/config-6.1
index a2a4a633af..2ebe59c7cc 100644
--- a/target/linux/layerscape/armv8_64b/config-6.1
+++ b/target/linux/layerscape/armv8_64b/config-6.1
@@ -104,9 +104,6 @@ CONFIG_BLK_MQ_VIRTIO=y
 CONFIG_BLK_PM=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
-CONFIG_BTRFS_FS=y
-# CONFIG_BTRFS_FS_CHECK_INTEGRITY is not set
-CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_CAVIUM_ERRATUM_22375=y
 CONFIG_CAVIUM_ERRATUM_23144=y
 CONFIG_CAVIUM_ERRATUM_23154=y
diff --git a/target/linux/layerscape/armv8_64b/config-6.6 b/target/linux/layerscape/armv8_64b/config-6.6
index f95b4603be..6d9d2ba2d5 100644
--- a/target/linux/layerscape/armv8_64b/config-6.6
+++ b/target/linux/layerscape/armv8_64b/config-6.6
@@ -105,9 +105,6 @@ CONFIG_BLK_MQ_VIRTIO=y
 CONFIG_BLK_PM=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
-CONFIG_BTRFS_FS=y
-# CONFIG_BTRFS_FS_CHECK_INTEGRITY is not set
-CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC=y
 CONFIG_CAVIUM_ERRATUM_22375=y
diff --git a/target/linux/layerscape/armv8_64b/target.mk b/target/linux/layerscape/armv8_64b/target.mk
index c9a61701a9..d880afa7a3 100644
--- a/target/linux/layerscape/armv8_64b/target.mk
+++ b/target/linux/layerscape/armv8_64b/target.mk
@@ -5,6 +5,7 @@
 ARCH:=aarch64
 BOARDNAME:=ARMv8 64-bit based boards
 KERNELNAME:=Image dtbs
+DEPENDS:=+@KERNEL_BTRFS_FS +@KERNEL_BTRFS_FS_POSIX_ACL
 
 define Target/Description
 	Build firmware images for NXP Layerscape ARMv8 64-bit based boards.

From 089c25f466dd496d165a02ab026fe55dbb802a8e Mon Sep 17 00:00:00 2001
From: Romanov Danila <pervokur@gmail.com>
Date: Wed, 14 Aug 2024 15:58:43 +0300
Subject: [PATCH 14/14] kernel: Fix section mismatch in ubi

Fix ubiblock_create_from_param() ubiblock_create_auto_rootfs section mismatch.
Without this, the system upgrade will not work if the kernel was compiled with clang-18.

WARNING: modpost: vmlinux: section mismatch in reference: ubiblock_notify+0x190 (section: .text) -> ubiblock_create_auto_rootfs (section: .init.text)

```
[33342.080771] Call trace:
[33342.083205]  ubiblock_create_auto_rootfs+0x0/0xd0
[33342.087902]  blocking_notifier_call_chain+0xb0/0x1a0
[33342.092857]  ubi_volume_notify+0xcc/0xdc
[33342.096773]  ubi_create_volume+0x520/0x684
[33342.100861]  ubi_cdev_ioctl+0x2ac/0x834
[33342.104688]  __arm64_sys_ioctl+0x14f0/0x15f4
[33342.108947]  invoke_syscall+0x44/0xc8
[33342.112601]  do_el0_svc+0x78/0xa8
[33342.115907]  el0_svc+0x24/0x50
[33342.118951]  el0t_64_sync_handler+0x88/0xf0
[33342.123126]  el0t_64_sync+0x150/0x154
[33342.126784] Code: ???????? ???????? ???????? ???????? (????????)
```
Signed-off-by: Romanov Danila <pervokur@gmail.com>
---
 .../491-ubi-auto-create-ubiblock-device-for-rootfs.patch        | 2 +-
 .../491-ubi-auto-create-ubiblock-device-for-rootfs.patch        | 2 +-
 .../491-ubi-auto-create-ubiblock-device-for-rootfs.patch        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/linux/generic/pending-5.15/491-ubi-auto-create-ubiblock-device-for-rootfs.patch b/target/linux/generic/pending-5.15/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
index ae53770c11..4ddd27add9 100644
--- a/target/linux/generic/pending-5.15/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
+++ b/target/linux/generic/pending-5.15/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
@@ -24,7 +24,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 +	return magic == UBIFS_NODE_MAGIC;
 +}
 +
-+static void __init ubiblock_create_auto_rootfs(void)
++static void ubiblock_create_auto_rootfs(void)
 +{
 +	int ubi_num, ret, is_ubifs;
 +	struct ubi_volume_desc *desc;
diff --git a/target/linux/generic/pending-6.1/491-ubi-auto-create-ubiblock-device-for-rootfs.patch b/target/linux/generic/pending-6.1/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
index a43da2a572..f0ea8e8cb5 100644
--- a/target/linux/generic/pending-6.1/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
+++ b/target/linux/generic/pending-6.1/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
@@ -24,7 +24,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 +	return magic == UBIFS_NODE_MAGIC;
 +}
 +
-+static void __init ubiblock_create_auto_rootfs(struct ubi_volume_info *vi)
++static void ubiblock_create_auto_rootfs(struct ubi_volume_info *vi)
 +{
 +	int ret, is_ubifs;
 +	struct ubi_volume_desc *desc;
diff --git a/target/linux/generic/pending-6.6/491-ubi-auto-create-ubiblock-device-for-rootfs.patch b/target/linux/generic/pending-6.6/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
index 6081d1d9e5..0b607faa5e 100644
--- a/target/linux/generic/pending-6.6/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
+++ b/target/linux/generic/pending-6.6/491-ubi-auto-create-ubiblock-device-for-rootfs.patch
@@ -24,7 +24,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 +	return magic == UBIFS_NODE_MAGIC;
 +}
 +
-+static void __init ubiblock_create_auto_rootfs(struct ubi_volume_info *vi)
++static void ubiblock_create_auto_rootfs(struct ubi_volume_info *vi)
 +{
 +	int ret, is_ubifs;
 +	struct ubi_volume_desc *desc;