docs, README: Gluon v2017.1.8

* Avoid storing non-TT-sync flags on singular entries too
* Fix multicast TT issues with bogus ROAM flags

Makefile

@@ -26,6 +26,9 @@ GLUON_RELEASE ?= $(error GLUON_RELEASE not set. GLUON_RELEASE can be set in site
 
 export GLUON_RELEASE GLUON_ATH10K_MESH GLUON_REGION GLUON_DEBUG
 
+show-release:
+	@echo '$(GLUON_RELEASE)'
+
 
 update: FORCE
 	@GLUON_SITEDIR='$(GLUON_SITEDIR)' scripts/update.sh

README.md

@@ -18,8 +18,8 @@ the future development of Gluon.
 ## Use a release!
 
 Please refrain from using the `master` branch for anything else but development purposes!
-Use the most recent release instead. You can list all relaseses by running `git tag`
-and switch to one by running `git checkout v2017.1 && make update`.
+Use the most recent release instead. You can list all releases by running `git tag`
+and switch to one by running `git checkout v2017.1.8 && make update`.
 
 If you're using the autoupdater, do not autoupdate nodes with anything but releases.
 If you upgrade using random master commits the nodes *will break* eventually.

docs/conf.py

@@ -47,16 +47,16 @@ master_doc = 'index'
 
 # General information about the project.
 project = 'Gluon'
-copyright = '2015-2017, Project Gluon'
+copyright = '2015-2018, Project Gluon'
 
 # The version info for the project you're documenting, acts as replacement for
 # |version| and |release|, also used in various other places throughout the
 # built documents.
 #
 # The short X.Y version.
-version = '2017.1'
+version = '2017.1.8'
 # The full version, including alpha/beta/rc tags.
-release = '2017.1'
+release = '2017.1.8'
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.

docs/dev/wan.rst

@@ -46,4 +46,4 @@ so the WAN DNS servers aren't leaked to the primary DNS daemon.
 *libpacketmark* is used to make the secondary DNS daemon send its requests over the WAN interface.
 
 The package ``gluon-mesh-vpn-fastd`` provides an iptables rule which will redirect all DNS requests from processes running
-with the primary group ``gluon-fastd`` to ``127.0.0.1:54``, thus making fastd use the secondary DNS daemon.
+with the primary group ``gluon-mesh-vpn`` to ``127.0.0.1:54``, thus making fastd use the secondary DNS daemon.

docs/features/dns-cache.rst

@@ -1,41 +0,0 @@
-DNS caching
-===========
-
-User experience may be greatly improved when dns is accelerated. Also, it
-seems like a good idea to keep the number of packages being exchanged
-between node and gateway as small as possible. In order to do this, a
-DNS cache may be used on a node. The dnsmasq instance listening on port
-53 on the node will be reconfigured to answer requests, use a list of
-upstream servers and a specific cache size if the options listed below are
-added to site.conf. Upstream servers are the DNS servers which are normally
-used by the nodes to resolve hostnames (e.g. gateways/supernodes).
-
-There are the following settings:
-    servers
-    cacheentries
-
-If both options are set the node will cache as much DNS records as set with
-'cacheentries' in RAM. The 'servers' list will be used to resolve the received
-DNS queries if the request cannot be answered from cache.
-If these settings do not exist, the cache is not intialized and RAM usage will not increase.
-
-When next_node.name is set, an A record and an AAAA record for the
-next-node IP address are placed in the dnsmasq configuration. This means that the content
-of next_node.name may be resolved even without upstream connectivity.
-
-::
-
-  dns = {
-    cacheentries = 5000,
-    servers = { '2001:db8::1', },
-  },
-
-  next_node = {
-    name = 'nextnode',
-    ip6 = '2001:db8:8::1',
-    ip4 = '198.51.100.1',
-  }
-
-
-The cache will be initialized during startup.
-Each cache entry will occupy about 90 bytes of RAM.

docs/features/dns-forwarder.rst

@@ -0,0 +1,26 @@
+DNS forwarder
+=============
+
+A Gluon node can be configured to act as a DNS forwarder. Requests for the
+next-node hostname can be answered locally, without querying the upstream
+resolver.
+
+**Note:** While this reduces answer time and allows to use the next-node
+hostname without upstream connectivity, this feature should not be used for
+next-node hostnames that are FQDN when the zone uses DNSSEC.
+
+One or more upstream resolvers can be configured in the *dns.servers* setting.
+When *next_node.name* is set, A and/or AAAA records for the next-node IP
+addresses are placed in the dnsmasq configuration.
+
+::
+
+  dns = {
+    servers = { '2001:db8::1', },
+  },
+
+  next_node = {
+    name = 'nextnode',
+    ip6 = '2001:db8:8::1',
+    ip4 = '198.51.100.1',
+  }

docs/index.rst

@@ -23,7 +23,7 @@ Several Freifunk communities in Germany use Gluon as the foundation of their Fre
    features/wlan-configuration
    features/private-wlan
    features/wired-mesh
-   features/dns-cache
+   features/dns-forwarder
    features/monitoring
    features/authorized-keys
    features/roles
@@ -53,7 +53,6 @@ Several Freifunk communities in Germany use Gluon as the foundation of their Fre
    :maxdepth: 1
 
    package/gluon-client-bridge
-   package/gluon-config-mode-contact-info
    package/gluon-config-mode-geo-location
    package/gluon-ebtables-filter-multicast
    package/gluon-ebtables-filter-ra-dhcp
@@ -64,7 +63,16 @@ Several Freifunk communities in Germany use Gluon as the foundation of their Fre
    :caption: Releases
    :maxdepth: 1
 
+   releases/v2017.1.8
+   releases/v2017.1.7
+   releases/v2017.1.6
+   releases/v2017.1.5
+   releases/v2017.1.4
+   releases/v2017.1.3
+   releases/v2017.1.2
+   releases/v2017.1.1
    releases/v2017.1
+   releases/v2016.2.7
    releases/v2016.2.6
    releases/v2016.2.5
    releases/v2016.2.4
@@ -126,6 +134,8 @@ ar71xx-generic
 * GL Innovations
 
   - GL-AR150
+  - GL-AR300M
+  - GL-AR750 [#ath10k]_
   - GL-iNet 6408A (v1)
   - GL-iNet 6416A (v1)
 
@@ -158,18 +168,18 @@ ar71xx-generic
 * TP-Link
 
   - Archer C5 (v1) [#ath10k]_
-  - Archer C7 (v2) [#ath10k]_
+  - Archer C7 (v2, v4) [#ath10k]_
   - CPE210 (v1.0, v1.1)
   - CPE220 (v1.1)
   - CPE510 (v1.0, v1.1)
   - CPE520 (v1.1)
-  - RE450
+  - RE450 [#ath10k]_
   - TL-WDR3500 (v1)
   - TL-WDR3600 (v1)
   - TL-WDR4300 (v1)
   - TL-WR710N (v1, v2.1)
   - TL-WR842N/ND (v1, v2, v3)
-  - TL-WR1043N/ND (v1, v2, v3, v4)
+  - TL-WR1043N/ND (v1, v2, v3, v4, v5)
   - TL-WR2543N/ND (v1)
   - WBS210 (v1.20)
   - WBS510 (v1.20)
@@ -189,6 +199,7 @@ ar71xx-generic
   - Rocket M2/M5
   - Rocket M2/M5 Ti
   - Rocket M2/M5 XW
+  - UniFi AC Mesh [#ath10k]_
   - UniFi AP
   - UniFi AP AC Lite [#ath10k]_
   - UniFi AP AC Pro [#ath10k]_
@@ -245,7 +256,7 @@ ar71xx-tiny
   - TL-WR743N/ND (v1, v2)
   - TL-WR841N/ND (v3, v5, v7, v8, v9, v10, v11, v12)
   - TL-WR843N/ND (v1)
-  - TL-WR940N (v1, v2, v3, v4)
+  - TL-WR940N (v1, v2, v3, v4, v5, v6)
   - TL-WR941ND (v2, v3, v4, v5, v6)
 
 brcm2708-bcm2708

docs/package/gluon-config-mode-contact-info.rst

@@ -1,21 +0,0 @@
-gluon-config-mode-contact-info
-==============================
-
-This package allows the user to provide contact information within config mode to be
-distributed in the mesh. You can define whether the owner contact field is
-obligatory or not in your site.conf.
-
-site.conf
----------
-
-config_mode.owner.obligatory \: optional (defaults to false)
-  If ``obligatory`` is set to ``true``, the contact info field must be supplied
-  and may not be left empty.
-
-Example::
-
-  config_mode = {
-    owner = {
-      obligatory = true
-    }
-  }

docs/releases/v2016.2.7.rst

@@ -0,0 +1,31 @@
+Gluon 2016.2.7
+==============
+
+This release only fixes a single regression introduced in Gluon v2016.2.6, and
+add support for building using Perl 5.26.
+
+Bugfixes
+~~~~~~~~
+
+* Improve sysupgrade error handling (`#1160 <https://github.com/freifunk-gluon/gluon/issues/1160>`_)
+
+  If for some reason processes don't react to SIGKILL (usually because of a kernel bug),
+  a node could hang forever in sysupgrade, requiring a power cycle. This has been
+  fixed, triggering a reboot instead.
+
+* Backport fixes to support building with Perl 5.26 or newer (`76753ed <https://github.com/freifunk-gluon/gluon/commit/76753ede0da78e24208f10675fa288247deec961>`_)
+
+Known Issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.

docs/releases/v2017.1.1.rst

@@ -0,0 +1,41 @@
+Gluon 2017.1.1
+==============
+
+Bugfixes
+~~~~~~~~
+
+* The autoupdater manifest has been extended to allow automatic upgrades from
+  old *x86-kvm* and *x86-xen_domu* systems to the new *x86-generic* image
+  (`869ceb4 <https://github.com/freifunk-gluon/gluon/commit/869ceb425cd5f9db3eafddcc52377fd94c6ba0dd>`_)
+
+* Make flash writable again on Ubiquiti PicoStations with certain bootloader
+  versions (and possibly other devices)
+  (`9a787c9 <https://github.com/freifunk-gluon/gluon/commit/9a787c9878069158151c843b8fd9aa338815d61e>`_)
+
+  Units affected by this issue running Gluon v2017.1 can't leave config mode and
+  no regular sysupgrades are possible. TFTP recovery is necessary to make them
+  work again.
+
+* Add workaround to prevent sporadic segfaults of busybox (ash) when running shell scripts on ar71xx
+  (`#1157 <https://github.com/freifunk-gluon/gluon/issues/1157>`_)
+
+* Disable batman-adv multicast optimizations to work around issue causing large
+  amounts of management traffic
+  (`819758f <https://github.com/freifunk-gluon/gluon/commit/819758f4250af8820851945ba1a6c17748b0ab4b>`_)
+
+  Multicast optimizations will be enabled again when a proper fix is available.
+
+Known issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.

docs/releases/v2017.1.2.rst

@@ -0,0 +1,84 @@
+Gluon 2017.1.2
+==============
+
+New features
+~~~~~~~~~~~~
+
+* Preserve *gw_mode* on sysupgrades (`#1196 <https://github.com/freifunk-gluon/gluon/issues/1196>`_)
+
+  When a Gluon node is used as uplink (for example by connecting it to a router with
+  a DHCP server directly, instead of using non-Gluon servers for the internet uplink),
+  the *gw_mode* must be set to *server* on that node. The changed *gw_mode* is now
+  preserved on upgrades.
+
+* Allow configuring the batman-adv routing algorithm (*BATMAN IV* or *BATMAN V*)
+  in *site.conf* (`#1185 <https://github.com/freifunk-gluon/gluon/issues/1185>`_)
+
+  *BATMAN V* still hasn't received extensive testing (and is incompatible with *BATMAN IV*).
+  This new option allows to set up *BATMAN V*-based test meshes. If unset, the routing
+  algorithm will default to *BATMAN IV*.
+
+  Configuration:
+
+  .. code-block:: lua
+
+    mesh = {
+      batman_adv = {
+        routing_algo = 'BATMAN_V'
+      }
+    }
+
+* New *show-release* Make target
+
+  The command ``make show-release`` can be used to print the release number
+  defined by *GLUON_RELEASE* to the standard output. This can be useful for build scripts
+  when a ``$(shell ...)`` expression is used in *site.mk* to generate the release
+  number.
+
+Bugfixes
+~~~~~~~~
+
+* The image build code used for some devices has been fixed, solving multiple
+  issues (`#1193 <https://github.com/freifunk-gluon/gluon/issues/1193>`_)
+
+  Problems caused by this issue include:
+
+  - sysupgrade rejecting Allnet images
+  - OpenMesh devices losing their configuration on upgrades
+
+  This is a regression introduced in Gluon v2017.1.
+
+* Improve sysupgrade error handling (`#1160 <https://github.com/freifunk-gluon/gluon/issues/1160>`_)
+
+  If for some reason processes don't react to SIGKILL (usually because of a kernel bug),
+  a node could hang forever in sysupgrade, requiring a power cycle. This has been
+  fixed, triggering a reboot instead.
+
+* Also display *gluon-config-mode:novpn* message when Tunneldigger is installed, but disabled
+  (`#1172 <https://github.com/freifunk-gluon/gluon/issues/1172>`_)
+
+  It was only displayed on nodes with fastd before.
+
+* Fix migration of enabled/disabled state between fastd and Tunneldigger
+  (`#1187 <https://github.com/freifunk-gluon/gluon/issues/1187>`_)
+
+Known issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.
+
+* Sporadic segfaults of busybox (ash) when running shell scripts on ar71xx
+  (`#1157 <https://github.com/freifunk-gluon/gluon/issues/1157>`_)
+
+  The workaround added in Gluon v2017.1.1 has greatly reduced the frequency of
+  segfaults, but did not make them disappear completely.

docs/releases/v2017.1.3.rst

@@ -0,0 +1,65 @@
+Gluon 2017.1.3
+==============
+
+The LEDE base of Gluon has been updated to v17.01.3, including various updates,
+stability improvements and security fixes. This includes some critical fixes
+to core packages like dnsmasq (see below for details); upgrading all Gluon
+nodes to v2017.1.3 is highly recommended.
+
+
+Bugfixes
+~~~~~~~~
+
+* dnsmasq has been upgraded to v2.78, fixing CVE-2017-13704, CVE-2017-14491,
+  CVE-2017-14492, CVE-2017-14493, CVE-2017-14494, 2017-CVE-14495 and
+  2017-CVE-14496
+
+  While many of the most severe (remote code execution) vulnarabilities are in
+  the DHCP component of dnsmasq, which is not active on a Gluon node unless in
+  Config Mode, CVE-2017-14491 does affect us. An attacker can cause memory
+  corruption and possibly remote code execution by deploying a malicious DNS
+  server and tricking a node into querying this server.
+
+* The Linux kernel has been upgraded to v4.4.89
+
+* Multiple security issues have been fixed in packages that are not usually part
+  of the Gluon build, including tcpdump, curl and mbedtls
+
+  Please refer to the
+  `LEDE commit log <https://git.lede-project.org/?p=source.git;a=shortlog;h=refs/heads/lede-17.01>`_
+  for details.
+
+* Filtering of multicast packets between the mesh and the *local-node* interface
+  has been fixed (`#1230 <https://github.com/freifunk-gluon/gluon/issues/1230>`_)
+
+  This issue was causing gluon-radvd to send a router advertisement to the local
+  clients whenever a router solicitation from the mesh was received. In busy
+  meshes, it would continuously send router advertisements every 3 seconds.
+
+* Reject autoupdater mirror URLs not starting with ``http://`` during build
+  (`9ab93992d1fc <https://github.com/freifunk-gluon/gluon/commit/9ab93992d1fca1b9cfa09c54d39cc92d3699055a>`_)
+
+* Fix MAC addresses on TP-Link TL-WR1043ND v4 when installing Gluon over newer
+  stock firmwares (`#1223 <https://github.com/freifunk-gluon/gluon/issues/1223>`_)
+
+
+Known issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.
+
+* Sporadic segfaults of busybox (ash) when running shell scripts on ar71xx
+  (`#1157 <https://github.com/freifunk-gluon/gluon/issues/1157>`_)
+
+  The workaround added in Gluon v2017.1.1 has greatly reduced the frequency of
+  segfaults, but did not make them disappear completely.

docs/releases/v2017.1.4.rst

@@ -0,0 +1,56 @@
+Gluon 2017.1.4
+==============
+
+Added hardware support
+~~~~~~~~~~~~~~~~~~~~~~
+
+ar71xx-generic
+^^^^^^^^^^^^^^
+
+* GL Innovations GL-AR300M
+
+
+Bugfixes
+~~~~~~~~
+
+* LEDE has been updated to the latest stable commit, including various fixes for
+  the kernel (including security updates), and making opkg work again. This also
+  includes fixes for the KRACK issue (which is irrelevant for most Gluon
+  deployments, as Gluon nodes are rarely used as WLAN clients)
+  (`b62af904bbfd <https://github.com/freifunk-gluon/gluon/commit/b62af904bbfd6360ed728fc9ae69af3d8e8db1d7>`_,
+  `ba56b41ddaf6 <https://github.com/freifunk-gluon/gluon/commit/ba56b41ddaf6033e3cdef18d30da6b34cd438e8c>`_,
+  `ad0824136e5b <https://github.com/freifunk-gluon/gluon/commit/ad0824136e5b47482e11483c50e7bc88ba2c506e>`_,
+  `017fbe88bb8a <https://github.com/freifunk-gluon/gluon/commit/017fbe88bb8a89623464b02e09178696c1d077a6>`_)
+
+* Fix DNS resolution for mesh VPN (fastd / tunneldigger) on ARM-based targets
+  (`#1245 <https://github.com/freifunk-gluon/gluon/issues/1245>`_)
+
+* Fix a build issue in *kmod-jool*
+  (`06842728233a <https://github.com/freifunk-gluon/gluon/commit/06842728233a39784c437767eb9df4167ab07a87>`_)
+
+* Fix enabling/disabling PoE Passthrough in *site.conf* or in the
+  advanced settings
+  (`7268e49a301f <https://github.com/freifunk-gluon/gluon/commit/7268e49a301fcd643a49b329bd6097a0f85bdaBb>`_,
+  `7c2636d28264 <https://github.com/freifunk-gluon/gluon/commit/7c2636d28264df20b448b0160b69f5059c40b84a>`_)
+
+
+Known issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.
+
+* Sporadic segfaults of busybox (ash) when running shell scripts on ar71xx
+  (`#1157 <https://github.com/freifunk-gluon/gluon/issues/1157>`_)
+
+  The workaround added in Gluon v2017.1.1 has greatly reduced the frequency of
+  segfaults, but it did not make them disappear completely.

docs/releases/v2017.1.5.rst

@@ -0,0 +1,57 @@
+Gluon 2017.1.5
+==============
+
+Added hardware support
+~~~~~~~~~~~~~~~~~~~~~~
+
+ar71xx-generic
+^^^^^^^^^^^^^^
+
+* TP-Link TL-WR1043N v5
+
+ramips-mt7621
+^^^^^^^^^^^^^
+
+* Ubiquiti EdgeRouter-X
+* Ubiquiti EdgeRouter-X SFP
+
+
+Bugfixes
+~~~~~~~~
+
+* Fix build with empty ``site/modules``
+  (`#1262 <https://github.com/freifunk-gluon/gluon/issues/1262>`_)
+
+* Fix Ethernet stalls at high throughput on certain devices
+  (`#1101 <https://github.com/freifunk-gluon/gluon/issues/1101>`_)
+
+* Update Tunneldigger to support connections with servers running newer kernel
+  versions (`9ed6ff752eb7 <https://github.com/freifunk-gluon/gluon/commit/9ed6ff752eb7972d90b138197641f12eeb4572fb>`_)
+
+* Fix batman-adv Bridge Loop Avoidance (BLA) with *gluon-ebtables-filter-multicast*
+  (`#1198 <https://github.com/freifunk-gluon/gluon/issues/1198>`_)
+
+
+Known issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.
+
+* Sporadic segfaults of busybox (ash) when running shell scripts on ar71xx
+  (`#1157 <https://github.com/freifunk-gluon/gluon/issues/1157>`_)
+
+  The workaround added in Gluon v2017.1.1 has greatly reduced the frequency of
+  segfaults, but it did not make them disappear completely.
+
+* Frequent reboots due to out-of-memory on weak hardware in larger meshes
+  (`#1243 <https://github.com/freifunk-gluon/gluon/issues/1243>`_)

docs/releases/v2017.1.6.rst

@@ -0,0 +1,91 @@
+Gluon 2017.1.6
+==============
+
+Bugfixes
+~~~~~~~~
+
+* Remove broken DNS cache feature
+  (`#1362 <https://github.com/freifunk-gluon/gluon/issues/1362>`_)
+
+  It was found that dnsmasq does not handle all answer records
+  equally. In particular, its cached answers are missing DNSKEY and DS
+  records, breaking DNSSEC validation on clients.
+
+  Nodes can still resolve the next-node hostname locally and will continue to
+  work as DNS forwarders. The DNS cache feature may return if dnsmasq is fixed
+  or if we switch to a different resolver.
+
+* Ensure that corefiles are stored in /tmp rather than cluttering the root
+  filesystem
+  (`00df8b76e54c <https://github.com/freifunk-gluon/gluon/commit/00df8b76e54c9bb89299df4b2ec49e972046d6b6>`_)
+
+  Nodes upgrades from Gluon v2016.2.x or earlier did not set kernel.core_pattern
+  correctly, leading to corefiles being stored in the current directory (usually
+  / for system services) in the case of crashes.
+
+  This is a regression introduced in Gluon v2017.1.
+
+* Only request a single IPv6 address instead of a prefix on the WAN interface
+  (`5db54ba78c3 <https://github.com/freifunk-gluon/gluon/commit/5db54ba78c3e245f06e4a407371608f6cb247b49>`_)
+
+* Fix signal graph on status page when there are many neighbours
+  (packages/`d1e0b6e0bdae <https://github.com/freifunk-gluon/packages/commit/d1e0b6e0bdaea14d8b9425cee6ca83087be1a905>`_)
+
+* Fix config files managed by opkg not being saved on sysupgrades on ar71xx-tiny
+  (LEDE/`17c0362178ca <https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=17c0362178caf837680a4631b8d0de94e5393448>`_,
+  LEDE/`75be005e8bdc <https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=75be005e8bdcbf86f9ad167a8737126dda98a444>`_)
+
+* Fix kernel crash in batman-adv-14
+  (`#1358 <https://github.com/freifunk-gluon/gluon/issues/1358>`_)
+
+  Starting with Gluon v2017.1, respondd could trigger a kernel crash caused by
+  a use-after-free in batman-adv-14, in particular after a gateway disappeared.
+
+  batman-adv-15 is not affected.
+
+* Increase bridge multicast querier timeout ("robustness") to avoid
+  "querier appeared/disappeared" log spam by batman-adv in the presence of
+  an external querier
+  (`e305a8c01917 <https://github.com/freifunk-gluon/gluon/commit/e305a8c019179472dbfc6fccea6c87cf40c08a75>`_)
+
+* Fix "broken pipe" log spam caused by the status page
+  (`883c32f2f1dc <https://github.com/freifunk-gluon/gluon/commit/883c32f2f1dc368626069865c07a5701e3e9bcae>`_)
+
+* Reduce memory limit of WLAN packet queues to 256KB on devices with small RAM
+  (`e63c6ca01f50 <https://github.com/freifunk-gluon/gluon/commit/e63c6ca01f50c96d76e5570faa290617a8a312b4>`_)
+
+  Will hopefully make out-of-memory crashes in busy meshes less likely.
+
+* Improve image validation for TP-Link CPE/WBS 210/510 and make it ready for
+  future images
+  (LEDE/`6577fe2198f5 <https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=6577fe2198f5c75acb1dba789941d96a036f4dae>`_)
+
+  Future OpenWrt/Gluon images will move the image metadata ("support-list") of
+  the CPE/WBS 210/510 images to a different offset. Make sysupgrade ready
+  to allow installing such images.
+
+  This change was also backported to Gluon v2016.2.x to allow direct updates
+  to future Gluon master versions without installing v2017.1.x first.
+
+* Sporadic segfaults of busybox (ash) when running shell scripts on ar71xx
+  have disappeared with the latest updates
+  (`#1157 <https://github.com/freifunk-gluon/gluon/issues/1157>`_)
+
+
+Known issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.
+
+* Frequent reboots due to out-of-memory on weak hardware in larger meshes
+  (`#1243 <https://github.com/freifunk-gluon/gluon/issues/1243>`_)

docs/releases/v2017.1.7.rst

@@ -0,0 +1,34 @@
+Gluon 2017.1.7
+==============
+
+Bugfixes
+~~~~~~~~
+
+* Fix boot failure on many Ubiquiti devices
+  (`#1370 <https://github.com/freifunk-gluon/gluon/issues/1370>`_)
+
+  A kernel update in Gluon 2017.1.6 led to boot failures on Ubiquiti Airmax M2/M5
+  (NanoStation, Bullet, etc.) if the device had been running AirOS 5.6 before
+  installing Gluon/OpenWrt. The XW hardware revision is unaffected.
+
+  While the root cause is a bug in Ubiquiti's bootloader, the issue is mitigated in
+  Gluon 2017.1.7.
+
+
+Known issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.
+
+* Frequent reboots due to out-of-memory on weak hardware in larger meshes
+  (`#1243 <https://github.com/freifunk-gluon/gluon/issues/1243>`_)

docs/releases/v2017.1.8.rst

@@ -0,0 +1,71 @@
+Gluon 2017.1.8
+==============
+
+Added hardware support
+~~~~~~~~~~~~~~~~~~~~~~
+
+ar71xx-generic
+^^^^^^^^^^^^^^
+
+* GL.iNet GL-AR750
+* TP-Link Archer C7 v4
+* Ubiquiti UniFi AC Mesh
+
+ar71xx-tiny
+^^^^^^^^^^^
+
+* TP-Link TL-WR940N v6
+
+
+Bugfixes
+~~~~~~~~
+
+* Fix refcounting issue in batman-adv leading to hangs on interface restarts
+  (`#1258 <https://github.com/freifunk-gluon/gluon/issues/1258>`_)
+
+  This fix applied to both batman-adv compat 14 (legacy) and 15.
+
+* Various batman-adv bugfixes have been backported
+  (`f5b3c0c3bc7e <https://github.com/freifunk-gluon/gluon/commit/f5b3c0c3bc7e795b4b544cbaa49e9c6ca7581ce9>`_ and
+  `5947ba300e50 <https://github.com/freifunk-gluon/gluon/commit/5947ba300e50726a8af38fb115b834172780ab26>`_,
+  fixing
+  `#1321 <https://github.com/freifunk-gluon/gluon/issues/1321>`_,
+  `#1380 <https://github.com/freifunk-gluon/gluon/issues/1380>`_,
+  `#1382 <https://github.com/freifunk-gluon/gluon/issues/1382>`_,
+  `#1419 <https://github.com/freifunk-gluon/gluon/issues/1419>`_
+  and a number of other minor issues)
+
+  The listed bugs could lead to high rates of batman-adv management traffic
+  (causing considerable load), trigger warnings about packet checksum failues
+  in certain non-standard interface configurations, and possibly other issues.
+
+
+Other changes
+~~~~~~~~~~~~~
+
+* Linux kernel has been updated to v4.4.129 (LEDE/`81573ea25924 <https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=81573ea259247f1c6c1a7a490de174d0a6c48a64>`_)
+
+* The description of the "contact information" field in the configuration wizard
+  has been extended with regard to the EU General Data Protection Regulation (GDPR)
+  (`fd355cf0ef7b <https://github.com/freifunk-gluon/gluon/commit/fd355cf0ef7ba0d1c9137bfb8fd76e87ad5d1aba>`_)
+
+  The *mandatory* site option for the contact information field has been removed.
+
+
+Known issues
+~~~~~~~~~~~~
+
+* Default TX power on many Ubiquiti devices is too high, correct offsets are unknown (`#94 <https://github.com/freifunk-gluon/gluon/issues/94>`_)
+
+  Reducing the TX power in the Advanced Settings is recommended.
+
+* The MAC address of the WAN interface is modified even when Mesh-on-WAN is disabled (`#496 <https://github.com/freifunk-gluon/gluon/issues/496>`_)
+
+  This may lead to issues in environments where a fixed MAC address is expected (like VMware when promicious mode is disallowed).
+
+* Inconsistent respondd API (`#522 <https://github.com/freifunk-gluon/gluon/issues/522>`_)
+
+  The current API is inconsistent and will be replaced eventually. The old API will still be supported for a while.
+
+* Frequent reboots due to out-of-memory on weak hardware in larger meshes
+  (`#1243 <https://github.com/freifunk-gluon/gluon/issues/1243>`_)

docs/releases/v2017.1.rst

@@ -13,6 +13,10 @@ many hacks that were required to make the build work with older OpenWrt releases
 The *output/modules* directory is now called *output/packages* and provides a
 replacement for the whole repository with target-specific packages of LEDE (in
 contrast to packages that are common for all targets of the same architecture).
+Another change to the build system makes it necessary that the same *GLUON_RELEASE*
+value that is used to build the images is also set for ``make manifest``.
+
+GCC 4.8 or newer is now required to build Gluon.
 
 **Note: There is an issue in all Gluon versions before 2016.2.6 that will
 lead to x86 systems losing their configuration when upgrading to Gluon 2017.1!**
@@ -84,8 +88,6 @@ New features
 * Add support for making nodes a DNS cache for clients
   (`#1000 <https://github.com/freifunk-gluon/gluon/issues/1000>`_)
 
-  See also: :doc:`../features/dns-cache`
-
 * Add L2TP via tunneldigger as an alternative VPN system
   (`#978 <https://github.com/freifunk-gluon/gluon/issues/978>`_)
 
@@ -127,7 +129,8 @@ site.mk
 ^^^^^^^
 
 * The *gluon-legacy* package does not exist anymore
-* All *gluon-luci-* packages have been renamed to *gluon-web-*
+* All *gluon-luci-* packages have been renamed to *gluon-web-*;
+  *gluon-luci-portconfig* is now called *gluon-web-network*
 * The *gluon-next-node* package has been merged into the Gluon core and must not
   be specified in *site.mk* anymore
 

docs/site-example/site.conf

@@ -1,4 +1,4 @@
--- This is an example site configuration for Gluon v2017.1
+-- This is an example site configuration for Gluon v2017.1.8
 --
 -- Take a look at the documentation located at
 -- http://gluon.readthedocs.org/ for details.

docs/site-example/site.mk

@@ -25,7 +25,6 @@ GLUON_SITE_PACKAGES := \
 	gluon-setup-mode \
 	gluon-status-page \
 	haveged \
-	iptables \
 	iwinfo
 
 ##	DEFAULT_GLUON_RELEASE

docs/user/getting_started.rst

@@ -8,7 +8,7 @@ Gluon's releases are managed using `Git tags`_. If you are just getting
 started with Gluon we recommend to use the latest stable release of Gluon.
 
 Take a look at the `list of gluon releases`_ and notice the latest release,
-e.g. *v2017.1*. Always get Gluon using git and don't try to download it
+e.g. *v2017.1.8*. Always get Gluon using git and don't try to download it
 as a Zip archive as the archive will be missing version information.
 
 Please keep in mind that there is no "default Gluon" build; a site configuration
@@ -43,7 +43,7 @@ Building the images
 -------------------
 
 To build Gluon, first check out the repository. Replace *RELEASE* with the
-version you'd like to checkout, e.g. *v2017.1*.
+version you'd like to checkout, e.g. *v2017.1.8*.
 
 ::
 

docs/user/site.rst

@@ -512,7 +512,7 @@ This is a non-exhaustive list of site-repos from various communities:
 * `site-ffgoe <https://github.com/freifunk-goettingen/site-ffgoe>`_ (Göttingen)
 * `site-ffgt-rhw <https://github.com/ffgtso/site-ffgt-rhw>`_ (Guetersloh)
 * `site-ffhh <https://github.com/freifunkhamburg/site-ffhh>`_ (Hamburg)
-* `site-ffho <https://git.c3pb.de/freifunk-pb/site-ffho>`_ (Hochstift)
+* `site-ffho <https://git.ffho.net/freifunkhochstift/ffho-site>`_ (Hochstift)
 * `site-ffhgw <https://github.com/lorenzo-greifswald/site-ffhgw>`_ (Greifswald)
 * `site-ffka <https://github.com/ffka/site-ffka>`_ (Karlsruhe)
 * `site-ffki <http://git.freifunk.in-kiel.de/ffki-site/>`_ (Kiel)

modules

@@ -1,18 +1,19 @@
 GLUON_FEEDS='openwrt gluon routing luci'
 
-LEDE_REPO=https://git.lede-project.org/source.git
+LEDE_REPO=https://git.openwrt.org/openwrt/openwrt.git
 LEDE_BRANCH=lede-17.01
-LEDE_COMMIT=65eec8bd5f6337956b972d07fde49eb5db9cb4a0
+LEDE_COMMIT=999bb66b20b03c753801ecebf1ec2a03c6a63c96
 
 PACKAGES_OPENWRT_REPO=https://github.com/openwrt/packages.git
 PACKAGES_OPENWRT_BRANCH=lede-17.01
-PACKAGES_OPENWRT_COMMIT=8844d7e2d4f717898c55c6345ad3b43fca52c440
+PACKAGES_OPENWRT_COMMIT=82ef2fd773987a72678a32b862f50085c3f57d56
 
 PACKAGES_GLUON_REPO=https://github.com/freifunk-gluon/packages.git
-PACKAGES_GLUON_COMMIT=71823713c0e9451d1cd459cb10309f468188eb6e
+PACKAGES_GLUON_BRANCH=v2017.1.x
+PACKAGES_GLUON_COMMIT=02363f0c9f8586e4ff20b0da249baed8d6edad95
 
 PACKAGES_ROUTING_REPO=https://github.com/openwrt-routing/packages.git
-PACKAGES_ROUTING_COMMIT=8d9d70510b2c86f7503962308846ec874f0eb39f
+PACKAGES_ROUTING_COMMIT=e656a6e0e69dd45b7caa24775bc86b6eb5dcfe7f
 
 PACKAGES_LUCI_REPO=https://github.com/openwrt/luci.git
 PACKAGES_LUCI_BRANCH=lede-17.01

package/gluon-autoupdater/check_site.lua

@@ -6,7 +6,7 @@ local function check_branch(k, _)
    local prefix = string.format('autoupdater.branches[%q].', k)
 
    need_string(prefix .. 'name')
-   need_string_array(prefix .. 'mirrors')
+   need_string_array_match(prefix .. 'mirrors', '^http://')
    need_number(prefix .. 'good_signatures')
    need_string_array_match(prefix .. 'pubkeys', '^%x+$')
 end

package/gluon-config-mode-contact-info/Makefile

@@ -39,9 +39,4 @@ define Package/gluon-config-mode-contact-info/install
 	$(call GluonInstallI18N,gluon-config-mode-contact-info,$(1))
 endef
 
-define Package/gluon-config-mode-contact-info/postinst
-#!/bin/sh
-$(call GluonCheckSite,check_site.lua)
-endef
-
 $(eval $(call BuildPackage,gluon-config-mode-contact-info))

package/gluon-config-mode-contact-info/check_site.lua

@@ -1,3 +0,0 @@
-if need_table('config_mode', nil, false) and need_table('config_mode.owner', nil, false) then
-  need_boolean('config_mode.owner.obligatory', false)
-end

package/gluon-config-mode-contact-info/i18n/de.po

@@ -16,12 +16,18 @@ msgstr "Kontakt"
 msgid ""
 "Please provide your contact information here to allow others to contact "
 "you. Note that this information will be visible <em>publicly</em> on "
-"the internet together with your node's coordinates."
+"the internet together with your node's coordinates. This means it can "
+"be downloaded and processed by anyone. This information is "
+"not required to operate a node. If you chose to enter data, it will be "
+"stored on this node and can be deleted by yourself at any time."
 msgstr ""
 "Bitte hinterlege hier einen Hinweis, um anderen zu ermöglichen, "
 "Kontakt mit dir aufzunehmen. Beachte, dass dieser Hinweis auch "
 "<em>öffentlich</em> im Internet, zusammen mit den Koordinaten "
-"deines Knotens, einsehbar sein wird."
+"deines Knotens, einsehbar sein wird. Das bedeutet, dass diese Informationen "
+"von jedem heruntergeladen und verarbeitet werden können. Für den Betrieb sind diese "
+"Informationen nicht erforderlich. Eine Speicherung erfolgt auf diesem Knoten. "
+"Die Daten können durch dich in diesem Menü eigenständig gelöscht werden."
 
 msgid "e.g. E-mail or phone number"
 msgstr "z.B. E-Mail oder Telefonnummer"

package/gluon-config-mode-contact-info/i18n/fr.po

@@ -16,11 +16,18 @@ msgstr "Informations de Contact"
 msgid ""
 "Please provide your contact information here to allow others to contact "
 "you. Note that this information will be visible <em>publicly</em> on "
-"the internet together with your node's coordinates."
+"the internet together with your node's coordinates. This means it can "
+"be downloaded and processed by anyone. This information is "
+"not required to operate a node. If you chose to enter data, it will be "
+"stored on this node and can be deleted by yourself at any time."
 msgstr ""
-"S'il vous plaît entrez ici des informations <em>publiques</em> pour "
-"permettre aux autres de vous contacter. "
-"Ces informations seront affichées en ligne, avec les coordonnées du nœud."
+"Entrez vos coordonnées ici si vous souhaitez permettre à d'autres "
+"personnes de communiquer avec vous. Ces informations seront affichées "
+"<em>en ligne</em> avec les coordonnées du nœud. Il peut être téléchargé "
+"et traité par tous. Il n'est pas obligatoire "
+"de fournir ces informations pour pouvoir opérer un nœud. Si vous avez "
+"choisi d'entrer des données, elles seront stockées sur ce nœud et vous "
+"pourrez les effacer par vous-même à tout moment."
 
 msgid "e.g. E-mail or phone number"
 msgstr "Ex : E-mail ou numéro de téléphone"

package/gluon-config-mode-contact-info/i18n/gluon-config-mode-contact-info.pot

@@ -7,7 +7,10 @@ msgstr ""
 msgid ""
 "Please provide your contact information here to allow others to contact "
 "you. Note that this information will be visible <em>publicly</em> on "
-"the internet together with your node's coordinates."
+"the internet together with your node's coordinates. This means it can be "
+"downloaded and processed by anyone. This information is "
+"not required to operate a node. If you chose to enter data, it will be "
+"stored on this node and can be deleted by yourself at any time."
 msgstr ""
 
 msgid "e.g. E-mail or phone number"

package/gluon-config-mode-contact-info/luasrc/lib/gluon/config-mode/wizard/0500-contact-info.lua

@@ -4,17 +4,18 @@ return function(form, uci)
 	local owner = uci:get_first("gluon-node-info", "owner")
 
 	local s = form:section(Section, nil, translate(
-		'Please provide your contact information here to '
-		.. 'allow others to contact you. Note that '
-		.. 'this information will be visible <em>publicly</em> '
-		.. 'on the internet together with your node\'s coordinates.'
+		'Please provide your contact information here to allow others to contact '
+		.. 'you. Note that this information will be visible <em>publicly</em> on '
+		.. 'the internet together with your node\'s coordinates. This means it can '
+		.. 'be downloaded and processed by anyone. This information is '
+		.. 'not required to operate a node. If you chose to enter data, it will be '
+		.. 'stored on this node and can be deleted by yourself at any time.'
 	))
 
 	local o = s:option(Value, "contact", translate("Contact info"), translate("e.g. E-mail or phone number"))
 	o.default = uci:get("gluon-node-info", owner, "contact")
-	o.optional = not ((site.config_mode or {}).owner or {}).obligatory
-	-- without a minimal length, an empty string will be accepted even with "optional = false"
-	o.datatype = "minlength(1)"
+	o.datatype = 'minlength(1)'
+	o.optional = true
 	function o:write(data)
 		if data then
 			uci:set("gluon-node-info", owner, "contact", data)

package/gluon-config-mode-mesh-vpn/luasrc/lib/gluon/config-mode/reboot/0100-mesh-vpn.lua

@@ -1,5 +1,6 @@
 local uci = require("simple-uci").cursor()
 local lutil = require "gluon.web.util"
+local fs = require "nixio.fs"
 
 local site = require 'gluon.site_config'
 local sysconfig = require 'gluon.sysconfig'
@@ -8,7 +9,10 @@ local util = require "gluon.util"
 local pretty_hostname = require 'pretty_hostname'
 
 
-local meshvpn_enabled = uci:get_bool("fastd", "mesh_vpn", "enabled")
+
+local has_fastd = fs.access('/lib/gluon/mesh-vpn/fastd')
+local has_tunneldigger = fs.access('/lib/gluon/mesh-vpn/tunneldigger')
+
 
 local hostname = pretty_hostname.get(uci)
 local contact = uci:get_first("gluon-node-info", "owner", "contact")
@@ -16,11 +20,20 @@ local contact = uci:get_first("gluon-node-info", "owner", "contact")
 local pubkey
 local msg
 
-if meshvpn_enabled then
-	pubkey = util.trim(lutil.exec("/etc/init.d/fastd show_key mesh_vpn"))
-	msg = _translate('gluon-config-mode:pubkey')
-else
-	msg = _translate('gluon-config-mode:novpn')
+
+if has_tunneldigger then
+	local tunneldigger_enabled = uci:get_bool("tunneldigger", "mesh_vpn", "enabled")
+	if not tunneldigger_enabled then
+		msg = _translate('gluon-config-mode:novpn')
+	end
+elseif has_fastd then
+	local fastd_enabled = uci:get_bool("fastd", "mesh_vpn", "enabled")
+	if fastd_enabled then
+		pubkey = util.trim(lutil.exec("/etc/init.d/fastd show_key mesh_vpn"))
+		msg = _translate('gluon-config-mode:pubkey')
+	else
+		msg = _translate('gluon-config-mode:novpn')
+	end
 end
 
 if not msg then return end

package/gluon-core/check_site.lua

@@ -40,11 +40,11 @@ end
 
 need_boolean('poe_passthrough', false)
 if need_table('dns', nil, false) then
-	need_number('dns.cacheentries', false)
 	need_string_array_match('dns.servers', '^[%x:]+$', false)
 end
 
 if need_table('next_node', nil, false) then
+	need_string('next_node.name', false)
 	need_string_match('next_node.ip6', '^[%x:]+$', false)
 	need_string_match('next_node.ip4', '^%d+.%d+.%d+.%d+$', false)
 end

package/gluon-core/files/etc/hotplug.d/ieee80211/01-gluon-core-codel-memusage

@@ -1,8 +1,8 @@
 #!/bin/sh
-if [ "${ACTION}" = "add" ]; then
 
+if [ "${ACTION}" = 'add' ]; then
 	RAM=$(awk '/MemTotal/ {print $2}' /proc/meminfo)
-	if [ "$RAM" -lt $((48*1024)) ]; then
-		echo "fq_memory_limit 1048576" > "/sys/kernel/debug/ieee80211/$DEVICENAME/aqm"
+	if [ "$RAM" -le $((32*1024)) ]; then
+		echo 'fq_memory_limit 262144' > "/sys/kernel/debug/ieee80211/$DEVICENAME/aqm"
 	fi
 fi

package/gluon-core/luasrc/lib/gluon/upgrade/010-primary-mac

@@ -37,7 +37,8 @@ elseif platform.match('ar71xx', 'generic', {'unifi-outdoor-plus', 'carambola2',
                                             'om2p-hs', 'om2p-hsv2', 'om2p-hsv3',
                                             'om2p-lc',
                                             'om5p', 'om5p-an',
-                                            'om5p-ac', 'om5p-acv2'}) then
+                                            'om5p-ac', 'om5p-acv2',
+                                            'archer-c7-v4'}) then
   table.insert(try_files, 1, '/sys/class/net/eth0/address')
 elseif platform.match('ar71xx', 'generic', {'archer-c5', 'archer-c7'}) then
   table.insert(try_files, 1, '/sys/class/net/eth1/address')

package/gluon-core/luasrc/lib/gluon/upgrade/110-network

@@ -5,78 +5,67 @@ local sysctl = require 'gluon.sysctl'
 local sysconfig = require 'gluon.sysconfig'
 
 
-uci:section('network', 'interface', 'wan',
-	    {
-	      ifname = sysconfig.wan_ifname,
-	      type = 'bridge',
-	      igmp_snooping = true,
-	      multicast_querier = false,
-	      peerdns = false,
-	      auto = true,
-	    }
-)
+uci:section('network', 'interface', 'wan', {
+	ifname = sysconfig.wan_ifname,
+	type = 'bridge',
+	igmp_snooping = true,
+	multicast_querier = false,
+	peerdns = false,
+	auto = true,
+})
 
 if not uci:get('network', 'wan', 'proto') then
-  uci:set('network', 'wan', 'proto', 'dhcp')
+	uci:set('network', 'wan', 'proto', 'dhcp')
 end
 
 
-uci:section('network', 'interface', 'wan6',
-	    {
-	      ifname = 'br-wan',
-	      peerdns = false,
-	      ip6table = 1,
-	      sourcefilter = false,
-	    }
-)
+uci:section('network', 'interface', 'wan6', {
+	ifname = 'br-wan',
+	peerdns = false,
+	ip6table = 1,
+	sourcefilter = false,
+	reqprefix = 'no',
+})
 
 if not uci:get('network', 'wan6', 'proto') then
-  uci:set('network', 'wan6', 'proto', 'dhcpv6')
+	uci:set('network', 'wan6', 'proto', 'dhcpv6')
 end
 
 
-uci:section('network', 'rule6', 'wan6_lookup',
-	    {
-	       mark = '0x01/0x01',
-	       lookup = 1,
-	    }
-)
+uci:section('network', 'rule6', 'wan6_lookup', {
+	mark = '0x01/0x01',
+	lookup = 1,
+})
 
-uci:section('network', 'route6', 'wan6_unreachable',
-	    {
-	       type = 'unreachable',
-	       interface = 'loopback',
-	       target = '::/0',
-	       gateway = '::',
-	       table = 1,
-	       metric = 65535,
-	    }
-)
+uci:section('network', 'route6', 'wan6_unreachable', {
+	type = 'unreachable',
+	interface = 'loopback',
+	target = '::/0',
+	gateway = '::',
+	table = 1,
+	metric = 65535,
+})
 
 uci:save('network')
 
 
-uci:section('firewall', 'rule', 'wan_igmp',
-	    {
-	       name = 'Allow-IGMP',
-	       src = 'wan',
-	       proto = 'igmp',
-	       family = 'ipv4',
-	       target = 'ACCEPT',
-	    }
-)
+uci:section('firewall', 'rule', 'wan_igmp', {
+	name = 'Allow-IGMP',
+	src = 'wan',
+	proto = 'igmp',
+	family = 'ipv4',
+	target = 'ACCEPT',
+})
 
-uci:section('firewall', 'rule', 'wan_mld',
-	    {
-	       name = 'Allow-MLD',
-	       src = 'wan',
-	       proto = 'icmp',
-	       src_ip = 'fe80::/10',
-	       icmp_type = { '130/0', '131/0', '132/0', '143/0', },
-	       family = 'ipv6',
-	       target = 'ACCEPT',
-	    }
-)
+uci:section('firewall', 'rule', 'wan_mld', {
+	name = 'Allow-MLD',
+	src = 'wan',
+	proto = 'icmp',
+	src_ip = 'fe80::/10',
+	icmp_type = { '130/0', '131/0', '132/0', '143/0', },
+	family = 'ipv6',
+	target = 'ACCEPT',
+})
 
 uci:save('firewall')
 

package/gluon-core/luasrc/lib/gluon/upgrade/130-core-pattern

@@ -0,0 +1,5 @@
+#!/usr/bin/lua
+
+local sysctl = require 'gluon.sysctl'
+
+sysctl.set('kernel.core_pattern', '/tmp/%e.%t.%p.%s.core')

package/gluon-core/luasrc/lib/gluon/upgrade/150-poe-passthrough

@@ -6,8 +6,8 @@ local site = require 'gluon.site_config'
 if (not sysconfig.gluon_version) and site.poe_passthrough then
 	local uci = require('simple-uci').cursor()
 
-  if uci:get('system', 'gpio_switch_poe_passthrough') then
-    uci:set('system', 'gpio_switch_poe_passthrough', 'value', true)
-    uci:save('system')
-  end
+	if uci:get('system', 'poe_passthrough') then
+		uci:set('system', 'poe_passthrough', 'value', true)
+		uci:save('system')
+	end
 end

package/gluon-core/luasrc/lib/gluon/upgrade/820-dns-config

@@ -13,11 +13,7 @@ else
 	uci:delete('dhcp', dnsmasq, 'server')
 end
 
-if site.dns and site.dns.cacheentries then
-	uci:set('dhcp', dnsmasq, 'cachesize', site.dns.cacheentries)
-else
-	uci:delete('dhcp', dnsmasq, 'cachesize')
-end
+uci:delete('dhcp', dnsmasq, 'cachesize')
 
 if site.next_node and site.next_node.name and site.next_node.ip4 then
 	uci:section('dhcp','domain','nextnode4',{

package/gluon-ebtables-filter-multicast/files/lib/gluon/ebtables/110-mcast-allow-arp

@@ -1,3 +1,7 @@
+# Bridge loop avoidance
+rule 'MULTICAST_OUT -p ARP --arp-opcode Reply --arp-gratuitous --arp-mac-dst ff:43:05:00:00:00/ff:ff:ff:fc:00:00 -j RETURN'
+rule 'MULTICAST_OUT -p ARP --arp-opcode Reply --arp-gratuitous --arp-mac-dst ff:43:05:05:00:00/ff:ff:ff:ff:00:00 -j RETURN'
+
 rule 'MULTICAST_OUT -p ARP --arp-opcode Reply --arp-ip-src 0.0.0.0 -j DROP'
 rule 'MULTICAST_OUT -p ARP --arp-opcode Request --arp-ip-dst 0.0.0.0 -j DROP'
 rule 'MULTICAST_OUT -p ARP -j RETURN'

package/gluon-mesh-batman-adv/check_site.lua

@@ -1,3 +1,4 @@
 if need_table('mesh', nil, false) and  need_table('mesh.batman_adv', nil, false) then
-  need_number('mesh.batman_adv.gw_sel_class', false)
+	need_number('mesh.batman_adv.gw_sel_class', false)
+	need_one_of('mesh.batman_adv.routing_algo', {'BATMAN_IV', 'BATMAN_V'}, false)
 end

package/gluon-mesh-batman-adv/files/lib/gluon/ebtables/250-next-node

@@ -1,6 +1,9 @@
 local site = require 'gluon.site_config'
 local next_node = site.next_node
 
+rule('FORWARD --logical-out br-client -i bat0 -o local-port -j DROP')
+rule('FORWARD --logical-out br-client -i local-port -o bat0 -j DROP')
+
 rule('FORWARD --logical-out br-client -o bat0 -d ' .. next_node.mac .. ' -j DROP')
 rule('OUTPUT --logical-out br-client -o bat0 -d ' .. next_node.mac .. ' -j DROP')
 rule('FORWARD --logical-out br-client -o bat0 -s ' .. next_node.mac .. ' -j DROP')

package/gluon-mesh-batman-adv/files/lib/netifd/proto/gluon_bat0.sh

@@ -41,6 +41,10 @@ proto_gluon_bat0_setup() {
 	ip link add primary0 type dummy
 	echo 1 > /proc/sys/net/ipv6/conf/primary0/disable_ipv6
 	ip link set primary0 address "$primary0_mac" mtu 1532 up
+
+	local routing_algo="$(uci -q get batman-adv.bat0.routing_algo || echo 'BATMAN_IV')"
+	(echo "$routing_algo" >/sys/module/batman_adv/parameters/routing_algo) 2>/dev/null
+
 	echo bat0 > /sys/class/net/primary0/batman_adv/mesh_iface
 
 	proto_init_update primary0 1

package/gluon-mesh-batman-adv/luasrc/lib/gluon/radvd/arguments

@@ -1,6 +1,9 @@
 #!/usr/bin/lua
+
 local site = require "gluon.site_config"
+
 io.write("-i local-node -p " .. site.prefix6)
-if site.dns and site.dns.servers then
+
+if site.dns and site.dns.servers and site.next_node and site.next_node.ip6 then
 	io.write(" --rdnss " .. site.next_node.ip6)
 end

package/gluon-mesh-batman-adv/luasrc/lib/gluon/upgrade/310-gluon-mesh-batman-adv-mesh

@@ -7,17 +7,23 @@ local util = require 'gluon.util'
 local uci = require('simple-uci').cursor()
 
 
-local gw_sel_class
+local gw_mode, gw_sel_class, routing_algo
+
+gw_mode = uci:get('batman-adv', 'bat0', 'gw_mode') or 'client'
+
 if site.mesh and site.mesh.batman_adv then
 	gw_sel_class = site.mesh.batman_adv.gw_sel_class
+	routing_algo = site.mesh.batman_adv.routing_algo
 end
 
+
 uci:delete('batman-adv', 'bat0')
 uci:section('batman-adv', 'mesh', 'bat0', {
 	orig_interval = 5000,
-	gw_mode = 'client',
+	gw_mode = gw_mode,
 	gw_sel_class = gw_sel_class,
 	hop_penalty = 15,
+	routing_algo = routing_algo,
 	multicast_mode = false,
 })
 uci:save('batman-adv')

package/gluon-mesh-batman-adv/luasrc/lib/gluon/upgrade/320-gluon-mesh-batman-adv-client-bridge

@@ -18,7 +18,7 @@ uci:section('network', 'interface', 'client', {
 	peerdns = not (site.dns and site.dns.servers),
 	sourcefilter = false,
 	keep_ra_dnslifetime = true,
-	robustness = 3,
+	robustness = 9,
 	query_interval = 2000,
 	query_response_interval = 500,
 })

package/gluon-mesh-vpn-core/luasrc/lib/gluon/upgrade/500-mesh-vpn

@@ -62,15 +62,36 @@ uci:save('firewall')
 
 -- VPN migration
 local has_fastd = fs.access('/lib/gluon/mesh-vpn/fastd')
-local fastd_enabled = uci:get_bool("fastd", "mesh_vpn", "enabled")
+local fastd_enabled = uci:get('fastd', 'mesh_vpn', 'enabled')
 
 local has_tunneldigger = fs.access('/lib/gluon/mesh-vpn/tunneldigger')
-local tunneldigger_enabled = uci:get_bool("tunneldigger", "mesh_vpn", "enabled")
+local tunneldigger_enabled = uci:get('tunneldigger', 'mesh_vpn', 'enabled')
 
-local enabled = fastd_enabled or tunneldigger_enabled or false
+local enabled
 
-uci:set("fastd", "mesh_vpn", "enabled", has_fastd and enabled)
-uci:save("fastd")
+-- If the installed VPN package has its enabled state set, keep the value
+if has_fastd and fastd_enabled then
+	enabled = fastd_enabled == '1'
+elseif has_tunneldigger and tunneldigger_enabled then
+	enabled = tunneldigger_enabled == '1'
+-- Otherwise, migrate the other package's value if any is set
+elseif fastd_enabled or tunneldigger_enabled then
+	enabled = fastd_enabled == '1' or tunneldigger_enabled == '1'
+-- If nothing is set, use the default
+else
+	enabled = site.mesh_vpn.enabled or false
+end
 
-uci:set("tunneldigger", "mesh_vpn", "enabled", has_tunneldigger and enabled)
-uci:save("tunneldigger")
+if has_fastd then
+	uci:set('fastd', 'mesh_vpn', 'enabled', enabled)
+else
+	uci:delete('fastd', 'mesh_vpn')
+end
+uci:save('fastd')
+
+if has_tunneldigger then
+	uci:set('tunneldigger', 'mesh_vpn', 'enabled', enabled)
+else
+	uci:delete('tunneldigger', 'mesh_vpn')
+end
+uci:save('tunneldigger')

package/gluon-mesh-vpn-fastd/luasrc/lib/gluon/upgrade/400-mesh-vpn-fastd

@@ -6,11 +6,6 @@ local util = require 'gluon.util'
 local uci = require('simple-uci').cursor()
 
 
-local enabled = uci:get('fastd', 'mesh_vpn', 'enabled')
-if enabled == nil then
-	enabled = site.mesh_vpn.enabled or false
-end
-
 local syslog_level = uci:get('fastd', 'mesh_vpn', 'syslog_level') or 'verbose'
 
 local methods
@@ -40,7 +35,6 @@ end
 
 
 uci:section('fastd', 'fastd', 'mesh_vpn', {
-	enabled = enabled,
 	group = 'gluon-mesh-vpn',
 	syslog_level = syslog_level,
 	interface = 'mesh-vpn',

package/gluon-mesh-vpn-tunneldigger/luasrc/lib/gluon/upgrade/400-mesh-vpn-tunneldigger

@@ -6,18 +6,17 @@ local util = require 'gluon.util'
 local uci = require('simple-uci').cursor()
 
 
-local enabled = uci:get('tunneldigger', 'mesh_vpn', 'enabled')
-if enabled == nil then
-	if uci:get_first('tunneldigger', 'broker', 'interface') == "mesh-vpn" then
+local enabled
+
+-- Delete old broker config section (remove in 2019)
+if not uci:get('tunneldigger', 'mesh_vpn') then
+	if uci:get_first('tunneldigger', 'broker', 'interface') == 'mesh-vpn' then
 		enabled = uci:get_first('tunneldigger', 'broker', 'enabled')
 	end
-end
-if enabled == nil then
-	enabled = site.mesh_vpn.enabled or false
-end
 
--- Delete old broker config section
-if not uci:get('tunneldigger', 'mesh_vpn') then
+	-- In the usual case (no migration from old tunneldigger package), the
+	-- enabled state is set in the 500-mesh-vpn script
+
 	uci:delete_all('tunneldigger', 'broker')
 end
 

package/gluon-status-page-api/files/lib/gluon/status-page/www/cgi-bin/dyn/neighbours-nodeinfo

@@ -8,6 +8,6 @@ badrequest() {
 
 echo 'Access-Control-Allow-Origin: *'
 
-batctl if | cut -d: -f1 | grep -qxF "$QUERY_STRING" || badrequest
+( batctl if | cut -d: -f1 | grep -qxF "$QUERY_STRING" ) 2>/dev/null || badrequest
 
 exec /usr/bin/gluon-neighbour-info -s neighbour -i "$QUERY_STRING" -d ff02::2:1001 -p 1001 -r nodeinfo

package/gluon-status-page-api/files/lib/gluon/status-page/www/cgi-bin/dyn/stations

@@ -8,7 +8,7 @@ badrequest() {
 
 echo 'Access-Control-Allow-Origin: *'
 
-batctl if | cut -d: -f1 | grep -qxF "$QUERY_STRING" || badrequest
+( batctl if | cut -d: -f1 | grep -qxF "$QUERY_STRING" ) 2>/dev/null || badrequest
 
 CMD="exec /lib/gluon/status-page/providers/stations '$QUERY_STRING'"
 

package/gluon-web-admin/i18n/de.po

@@ -17,7 +17,7 @@ msgid "Advanced settings"
 msgstr "Erweiterte Einstellungen"
 
 msgid ""
-"Alternatively, you can set a password to access you node. Please choose a "
+"Alternatively, you can set a password to access your node. Please choose a "
 "secure password you don't use anywhere else.<br /><br />If you set an empty "
 "password, login via password will be disabled. This is the default."
 msgstr ""

package/gluon-web-admin/i18n/fr.po

@@ -17,7 +17,7 @@ msgid "Advanced settings"
 msgstr "Paramètres avancés"
 
 msgid ""
-"Alternatively, you can set a password to access you node. Please choose a "
+"Alternatively, you can set a password to access your node. Please choose a "
 "secure password you don't use anywhere else.<br /><br />If you set an empty "
 "password, login via password will be disabled. This is the default."
 msgstr ""

package/gluon-web-admin/i18n/gluon-web-admin.pot

@@ -8,7 +8,7 @@ msgid "Advanced settings"
 msgstr ""
 
 msgid ""
-"Alternatively, you can set a password to access you node. Please choose a "
+"Alternatively, you can set a password to access your node. Please choose a "
 "secure password you don't use anywhere else.<br /><br />If you set an empty "
 "password, login via password will be disabled. This is the default."
 msgstr ""

package/gluon-web-admin/luasrc/lib/gluon/web/model/admin/remote.lua

@@ -33,7 +33,7 @@ end
 
 local f_password = Form(translate("Password"),
 	translate(
-                "Alternatively, you can set a password to access you node. Please choose a secure password you don't use anywhere else.<br /><br />"
+                "Alternatively, you can set a password to access your node. Please choose a secure password you don't use anywhere else.<br /><br />"
                 .. "If you set an empty password, login via password will be disabled. This is the default."
 	), 'password'
 )

package/gluon-web-network/i18n/de.po

@@ -19,9 +19,12 @@ msgstr "Automatisch (RA/DHCPv6)"
 msgid "Disabled"
 msgstr "Deaktiviert"
 
-msgid "Enable PoE passthrough"
+msgid "Enable PoE Passthrough"
 msgstr "PoE-Passthrough aktivieren"
 
+msgid "Enable PoE Power Port %s"
+msgstr "PoE-Ausgabe auf Port %s aktivieren"
+
 msgid "Enable meshing on the LAN interface"
 msgstr "Mesh auf dem LAN-Port aktivieren"
 

package/gluon-web-network/i18n/fr.po

@@ -19,7 +19,10 @@ msgstr "Automatique (RA/DHCPv6)"
 msgid "Disabled"
 msgstr "Désactivé"
 
-msgid "Enable PoE passthrough"
+msgid "Enable PoE Passthrough"
+msgstr ""
+
+msgid "Enable PoE Power Port %s"
 msgstr ""
 
 msgid "Enable meshing on the LAN interface"

package/gluon-web-network/i18n/gluon-web-network.pot

@@ -10,7 +10,10 @@ msgstr ""
 msgid "Disabled"
 msgstr ""
 
-msgid "Enable PoE passthrough"
+msgid "Enable PoE Passthrough"
+msgstr ""
+
+msgid "Enable PoE Power Port %s"
 msgstr ""
 
 msgid "Enable meshing on the LAN interface"

package/gluon-web-network/luasrc/lib/gluon/web/model/admin/network.lua

@@ -104,15 +104,28 @@ if sysconfig.lan_ifname then
 	end
 end
 
-if uci:get('system', 'gpio_switch_poe_passthrough') then
-	local s = f:section(Section)
-	local poe_passthrough = s:option(Flag, "poe_passthrough", translate("Enable PoE passthrough"))
-	poe_passthrough.default = uci:get_bool("system", "gpio_switch_poe_passthrough", "value")
+local section
+uci:foreach("system", "gpio_switch", function(s)
+	if s[".name"]:match("poe") then
+		if not section then
+			section = f:section(Section)
+		end
 
-	function poe_passthrough:write(data)
-		uci:set('system', 'gpio_switch_poe_passthrough', 'value', data)
+		local port = s.name:match("^PoE Power Port(%d*)$")
+		local name
+		if port then
+			name = translatef("Enable PoE Power Port %s", port)
+		else
+			name = translate("Enable " .. s.name)
+		end
+		local poe = section:option(Flag, s[".name"], name)
+		poe.default = uci:get_bool("system", s[".name"], "value")
+
+		function poe:write(data)
+			uci:set("system", s[".name"], "value", data)
+		end
 	end
-end
+end)
 
 function f:write()
 	uci:set("network", "wan", "proto", ipv4.data)

patches/lede/0001-build-move-STAGING_DIR_HOSTPKG-and-BUILD_DIR_HOST-back-to-a-common-directory-for-all-targets.patch

@@ -47,10 +47,10 @@ index 5a403cbf41e2bbd6bdb843492639a01aff8cf75b..900dae1d4afc6007f8ac04179dd7f092
  
  define Build/Configure/Default
 diff --git a/include/host-build.mk b/include/host-build.mk
-index 70bf6e5a399615edb91edfae3c43a93504d7b5d8..6c2f91581b895bda1ee9f2ee94afc2e5c06de380 100644
+index 5fcec7ebf48361100d29c5925beaae4f36d5ac7b..485f09a6b71b881692b5ee575927397259bbac24 100644
 --- a/include/host-build.mk
 +++ b/include/host-build.mk
-@@ -122,7 +122,7 @@ ifneq ($(if $(HOST_QUILT),,$(CONFIG_AUTOREBUILD)),)
+@@ -126,7 +126,7 @@ ifneq ($(if $(HOST_QUILT),,$(CONFIG_AUTOREBUILD)),)
  endif
  
  define Host/Exports/Default
@@ -60,7 +60,7 @@ index 70bf6e5a399615edb91edfae3c43a93504d7b5d8..6c2f91581b895bda1ee9f2ee94afc2e5
    $(1) : export PKG_CONFIG_PATH=$$(STAGING_DIR_HOST)/lib/pkgconfig:$$(HOST_BUILD_PREFIX)/lib/pkgconfig
    $(1) : export PKG_CONFIG_LIBDIR=$$(HOST_BUILD_PREFIX)/lib/pkgconfig
 diff --git a/include/package.mk b/include/package.mk
-index 32485176577b040f6e4a561c5d1144509877bcdf..ea801288eadb139cc0dd2412b4c927c6bd7330e0 100644
+index e9989ab13ec81a8751ee7245639ee0b82b9a87b2..7f77c4e99b1e9b79503963c497c4c87d7af9d71a 100644
 --- a/include/package.mk
 +++ b/include/package.mk
 @@ -130,7 +130,7 @@ ifdef USE_SOURCE_DIR
@@ -73,10 +73,10 @@ index 32485176577b040f6e4a561c5d1144509877bcdf..ea801288eadb139cc0dd2412b4c927c6
    $(1) : export PATH=$$(TARGET_PATH_PKG)
    $(1) : export CONFIG_SITE:=$$(CONFIG_SITE)
 diff --git a/rules.mk b/rules.mk
-index 04fd936660bef4af49de5500cd2d7c3601c1b9f6..95b18f9e5c69de479db54c5bdb740103140dcf74 100644
+index 5710a84fe7ad24e45acb2ef62ee29eab37e8de06..b678e9bea5bc146a3c515d93003415cd21882068 100644
 --- a/rules.mk
 +++ b/rules.mk
-@@ -145,9 +145,9 @@ STAGING_DIR_ROOT:=$(STAGING_DIR)/root-$(BOARD)
+@@ -147,9 +147,9 @@ STAGING_DIR_ROOT:=$(STAGING_DIR)/root-$(BOARD)
  BUILD_LOG_DIR:=$(TOPDIR)/logs
  PKG_INFO_DIR := $(STAGING_DIR)/pkginfo
  
@@ -88,7 +88,7 @@ index 04fd936660bef4af49de5500cd2d7c3601c1b9f6..95b18f9e5c69de479db54c5bdb740103
  
  TARGET_PATH:=$(subst $(space),:,$(filter-out .,$(filter-out ./,$(subst :,$(space),$(PATH)))))
  TARGET_INIT_PATH:=$(call qstrip,$(CONFIG_TARGET_INIT_PATH))
-@@ -206,7 +206,7 @@ ifndef DUMP
+@@ -208,7 +208,7 @@ ifndef DUMP
      endif
    endif
  endif
@@ -97,7 +97,7 @@ index 04fd936660bef4af49de5500cd2d7c3601c1b9f6..95b18f9e5c69de479db54c5bdb740103
  
  ifeq ($(CONFIG_SOFT_FLOAT),y)
    SOFT_FLOAT_CONFIG_OPTION:=--with-float=soft
-@@ -232,9 +232,9 @@ export PKG_CONFIG
+@@ -234,9 +234,9 @@ export PKG_CONFIG
  
  HOSTCC:=gcc
  HOSTCXX:=g++

patches/lede/0003-base-files-disable-reset-button-handling.patch

@@ -6,7 +6,7 @@ This conflicts with our reset button usage.
 
 diff --git a/package/base-files/files/etc/rc.button/reset b/package/base-files/files/etc/rc.button/reset
 deleted file mode 100755
-index 4265767437e8eda3c758fe7f7941d7f608c95782..0000000000000000000000000000000000000000
+index 2403122ad21d1abd568337908c9d58060e87bf08..0000000000000000000000000000000000000000
 --- a/package/base-files/files/etc/rc.button/reset
 +++ /dev/null
 @@ -1,31 +0,0 @@
@@ -32,7 +32,7 @@ index 4265767437e8eda3c758fe7f7941d7f608c95782..00000000000000000000000000000000
 -		echo "REBOOT" > /dev/console
 -		sync
 -		reboot
--	elif [ "$SEEN" -gt 5 -a -n "$OVERLAY" ]
+-	elif [ "$SEEN" -ge 5 -a -n "$OVERLAY" ]
 -	then
 -		echo "FACTORY RESET" > /dev/console
 -		jffs2reset -y && reboot &

patches/lede/0006-dropbear-add-a-failsafe-mode-that-will-always-allow-password-less-root-login.patch

@@ -6,15 +6,15 @@ Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
 
 diff --git a/package/network/services/dropbear/patches/700-failsafe-mode.patch b/package/network/services/dropbear/patches/700-failsafe-mode.patch
 new file mode 100644
-index 0000000000000000000000000000000000000000..c6e45423e2dba1258549a5bfe4b5a59ac32d73d8
+index 0000000000000000000000000000000000000000..d379da0d0a7890e0a25d87e227c2e065cd2750ee
 --- /dev/null
 +++ b/package/network/services/dropbear/patches/700-failsafe-mode.patch
 @@ -0,0 +1,57 @@
 +--- a/runopts.h
 ++++ b/runopts.h
-+@@ -97,6 +97,8 @@ typedef struct svr_runopts {
-+ 	int norootpass;
++@@ -98,6 +98,8 @@ typedef struct svr_runopts {
 + 	int allowblankpass;
++ 	unsigned int maxauthtries;
 + 
 ++	int failsafe_mode;
 ++
@@ -37,7 +37,7 @@ index 0000000000000000000000000000000000000000..c6e45423e2dba1258549a5bfe4b5a59a
 ++					&& !(svr_opts.norootpass && ses.authstate.pw_uid == 0)
 ++					&& ses.authstate.pw_passwd[0] == '\0')))
 + 		{
-+			dropbear_log(LOG_NOTICE, 
++ 			dropbear_log(LOG_NOTICE, 
 + 					"Auth succeeded with blank password for '%s' from %s",
 +--- a/svr-runopts.c
 ++++ b/svr-runopts.c
@@ -47,17 +47,17 @@ index 0000000000000000000000000000000000000000..c6e45423e2dba1258549a5bfe4b5a59a
 + 					"-B		Allow blank password logins\n"
 ++					"-f		Failsafe mode: always allow password-less root login\n"
 + #endif
++ 					"-T <1 to %d> 	Maximum authentication tries (default %d)\n"
 + #ifdef ENABLE_SVR_LOCALTCPFWD
-+ 					"-j		Disable local port forwarding\n"
-+@@ -130,6 +131,7 @@ void svr_getopts(int argc, char ** argv)
++@@ -133,6 +134,7 @@ void svr_getopts(int argc, char ** argv)
 + 	svr_opts.noauthpass = 0;
 + 	svr_opts.norootpass = 0;
 + 	svr_opts.allowblankpass = 0;
 ++	svr_opts.failsafe_mode = 0;
++ 	svr_opts.maxauthtries = DEFAULT_AUTH_TRIES;
 + 	svr_opts.inetdmode = 0;
 + 	svr_opts.portcount = 0;
-+ 	svr_opts.hostkey = NULL;
-+@@ -244,6 +246,9 @@ void svr_getopts(int argc, char ** argv)
++@@ -251,6 +253,9 @@ void svr_getopts(int argc, char ** argv)
 + 				case 'B':
 + 					svr_opts.allowblankpass = 1;
 + 					break;

patches/lede/0007-rules.mk-export-STAGING_DIR_HOSTPKG.patch

@@ -5,10 +5,10 @@ Subject: rules.mk: export STAGING_DIR_HOSTPKG
 Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
 
 diff --git a/rules.mk b/rules.mk
-index 95b18f9e5c69de479db54c5bdb740103140dcf74..1b9de5f35e3890c2759ab2cdbd98ac80df942124 100644
+index b678e9bea5bc146a3c515d93003415cd21882068..16cab67d5d1b8b130a0ffddc81789e798cda338e 100644
 --- a/rules.mk
 +++ b/rules.mk
-@@ -223,7 +223,7 @@ else
+@@ -225,7 +225,7 @@ else
  endif
  
  export PATH:=$(TARGET_PATH)

patches/lede/0010-rules.mk-make-PKG_CONFIG_DEPENDS-properly-track-string-values.patch

@@ -1,24 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Fri, 24 Feb 2017 12:16:33 +0100
-Subject: rules.mk: make PKG_CONFIG_DEPENDS properly track string values
-
-The confvar macro is adjusted to not only consider if a variable has a
-value or not, but also the value itself. Instead of creating a string of
-'y' and 'n' characters, all variable names and values are concatenated
-and hashed.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/rules.mk b/rules.mk
-index 1b9de5f35e3890c2759ab2cdbd98ac80df942124..626bfca1ba73b96ee0f86a2de4afe643d83b360c 100644
---- a/rules.mk
-+++ b/rules.mk
-@@ -29,7 +29,7 @@ empty:=
- space:= $(empty) $(empty)
- comma:=,
- merge=$(subst $(space),,$(1))
--confvar=$(call merge,$(foreach v,$(1),$(if $($(v)),y,n)))
-+confvar=$(shell echo '$(foreach v,$(1),$(v)=$(subst ','\'',$($(v))))' | $(STAGING_DIR_HOST)/bin/mkhash md5)
- strip_last=$(patsubst %.$(lastword $(subst .,$(space),$(1))),%,$(1))
- 
- paren_left = (

patches/lede/0011-procd-switch-to-latest-master.patch

@@ -0,0 +1,21 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Thu, 13 Jul 2017 17:15:21 +0200
+Subject: procd: switch to latest master
+
+diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
+index b905cb25aa02c4c3f82cbc288ef15648dfd66444..5b92d79332f2ea400041586b92b570d8b633218a 100644
+--- a/package/system/procd/Makefile
++++ b/package/system/procd/Makefile
+@@ -12,9 +12,9 @@ PKG_RELEASE:=1
+ 
+ PKG_SOURCE_PROTO:=git
+ PKG_SOURCE_URL=$(LEDE_GIT)/project/procd.git
+-PKG_SOURCE_DATE:=2018-01-22
+-PKG_SOURCE_VERSION:=9a4036fb1b7412ab2ea4f360d2cc7e6a5e0fa6b5
+-PKG_MIRROR_HASH:=669f062e9c5228ef9d09cc9904d8ce4651f0b8506a6c2fff27b21e83b26f0abb
++PKG_SOURCE_DATE:=2018-01-23
++PKG_SOURCE_VERSION:=653629f19e591a0827ab39de07b4526bb119a57a
++PKG_MIRROR_HASH:=2e0c3ae45521eea456a8411c8d9ef19ed9a5ed6c0ab38b9496555625fb4ba6a2
+ CMAKE_INSTALL:=1
+ 
+ PKG_LICENSE:=GPL-2.0

patches/lede/0012-procd-update-to-git-HEAD-version.patch

@@ -1,26 +0,0 @@
-From: Hans Dedecker <dedeckeh@gmail.com>
-Date: Mon, 6 Mar 2017 17:25:44 +0100
-Subject: procd: update to git HEAD version
-
-8f218f5 procd: service gets deleted when its last instance is freed
-35209a0 procd: update modprobe path
-
-Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
-
-diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
-index fd1bca3f4b9665581f9e9ddd9b9294fa500a9d3d..43ea23aab00918a2b664e9a5da7767f90cd568db 100644
---- a/package/system/procd/Makefile
-+++ b/package/system/procd/Makefile
-@@ -12,9 +12,9 @@ PKG_RELEASE:=1
- 
- PKG_SOURCE_PROTO:=git
- PKG_SOURCE_URL=$(LEDE_GIT)/project/procd.git
--PKG_SOURCE_DATE:=2017-02-15
--PKG_SOURCE_VERSION:=5f9124103410c178d816bb5229fba7dd2286a49b
--PKG_MIRROR_HASH:=ec887b349fc60ad3882fc9eaefb5cd299d64e7d43c062df9f7b7500591ba3e85
-+PKG_SOURCE_DATE:=2017-03-05
-+PKG_SOURCE_VERSION:=8f218f5626a3cb3900dbe9801ee8ace236b0e4a5
-+PKG_MIRROR_HASH:=8ac8691888b64726453bd726fe0c98fc906540bbd2ae666dae6bea592b0b4e4d
- CMAKE_INSTALL:=1
- 
- PKG_LICENSE:=GPL-2.0

patches/lede/0013-sunxi-clean-up-modules-definitions.patch

@@ -1,128 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 4 May 2017 07:00:06 +0200
-Subject: sunxi: clean up modules definitions
-
-Module definitions for kmod-wdt-sunxi and kmod-eeprom-sunxi are removed
-(wdt-sunxi was builtin anyways; nvmem-sunxi, which is the new name of
-eeprom-sunxi is changed to builtin). As kmod-eeprom-sunxi was specified
-in DEFAULT_PACKAGES, but not available on kernel 4.4, it was breaking the
-image builder.
-
-Support for kmod-sunxi-ir is added for kernel 4.4 (it is unclear why it
-was disable before, it builds fine with with kernel 4.4).
-
-Condtionals only relevant for pre-4.4 kernels are removed from modules.mk,
-as sunxi does't support older kernels anymore.
-
-Fixes FS#755.
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/target/linux/sunxi/Makefile b/target/linux/sunxi/Makefile
-index b0bc1bab398af55b77909deccd8f059e17d96e67..3c2f14b8418e1d296a239027f6fdee9b5ba8f9b2 100644
---- a/target/linux/sunxi/Makefile
-+++ b/target/linux/sunxi/Makefile
-@@ -27,7 +27,7 @@ KERNELNAME:=zImage dtbs
- 
- include $(INCLUDE_DIR)/target.mk
- 
--DEFAULT_PACKAGES += uboot-envtools kmod-eeprom-sunxi kmod-wdt-sunxi
-+DEFAULT_PACKAGES += uboot-envtools
- DEFAULT_PACKAGES += mkf2fs e2fsprogs
- 
- $(eval $(call BuildTarget))
-diff --git a/target/linux/sunxi/config-4.4 b/target/linux/sunxi/config-4.4
-index 2253afa124ad6c3d6b9d6798dc29f68437455341..a978e9d15b8c358f69669d3afdbf4a14bba83d31 100644
---- a/target/linux/sunxi/config-4.4
-+++ b/target/linux/sunxi/config-4.4
-@@ -356,7 +356,7 @@ CONFIG_NO_HZ_COMMON=y
- CONFIG_NO_HZ_IDLE=y
- CONFIG_NR_CPUS=8
- CONFIG_NVMEM=y
--# CONFIG_NVMEM_SUNXI_SID is not set
-+CONFIG_NVMEM_SUNXI_SID=y
- CONFIG_OF=y
- CONFIG_OF_ADDRESS=y
- CONFIG_OF_EARLY_FLATTREE=y
-diff --git a/target/linux/sunxi/modules.mk b/target/linux/sunxi/modules.mk
-index 6f4991798decb4a65f615d3a7282270960a7555a..99b82a3b5f17348049458ced5823f7c90f784269 100644
---- a/target/linux/sunxi/modules.mk
-+++ b/target/linux/sunxi/modules.mk
-@@ -25,7 +25,7 @@ $(eval $(call KernelPackage,rtc-sunxi))
- define KernelPackage/sunxi-ir
-     SUBMENU:=$(OTHER_MENU)
-     TITLE:=Sunxi SoC built-in IR support (A20)
--    DEPENDS:=@TARGET_sunxi @!LINUX_4_4 +kmod-input-core 
-+    DEPENDS:=@TARGET_sunxi +kmod-input-core
-     $(call AddDepends/rtc)
-     KCONFIG:= \
- 	CONFIG_MEDIA_SUPPORT=y \
-@@ -42,22 +42,6 @@ endef
- 
- $(eval $(call KernelPackage,sunxi-ir))
- 
--define KernelPackage/eeprom-sunxi
--    SUBMENU:=$(OTHER_MENU)
--    TITLE:=AllWinner Security ID fuse support
--    DEPENDS:=@TARGET_sunxi @!LINUX_4_4
--    KCONFIG:= \
--	CONFIG_EEPROM_SUNXI_SID
--    FILES:=$(LINUX_DIR)/drivers/misc/eeprom/sunxi_sid.ko
--    AUTOLOAD:=$(call AutoLoad,50,sunxi_sid)
--endef
--
--define KernelPackage/eeprom-sunxi/description
-- Support for the AllWinner Security ID fuse support
--endef
--
--$(eval $(call KernelPackage,eeprom-sunxi))
--
- define KernelPackage/ata-sunxi
-     TITLE:=AllWinner sunXi AHCI SATA support
-     SUBMENU:=$(BLOCK_MENU)
-@@ -76,7 +60,7 @@ $(eval $(call KernelPackage,ata-sunxi))
- define KernelPackage/sun4i-emac
-   SUBMENU:=$(NETWORK_DEVICES_MENU)
-   TITLE:=AllWinner EMAC Ethernet support
--  DEPENDS:=@TARGET_sunxi +LINUX_4_4:kmod-of-mdio +LINUX_4_4:kmod-libphy
-+  DEPENDS:=@TARGET_sunxi +kmod-of-mdio +kmod-libphy
-   KCONFIG:=CONFIG_SUN4I_EMAC
-   FILES:=$(LINUX_DIR)/drivers/net/ethernet/allwinner/sun4i-emac.ko
-   AUTOLOAD:=$(call AutoProbe,sun4i-emac)
-@@ -85,35 +69,11 @@ endef
- $(eval $(call KernelPackage,sun4i-emac))
- 
- 
--define KernelPackage/wdt-sunxi
--    SUBMENU:=$(OTHER_MENU)
--    TITLE:=AllWinner sunXi Watchdog timer
--    DEPENDS:=@TARGET_sunxi
--    KCONFIG:=CONFIG_SUNXI_WATCHDOG
--    FILES:=$(LINUX_DIR)/drivers/$(WATCHDOG_DIR)/sunxi_wdt.ko
--    AUTOLOAD:=$(call AutoLoad,51,sunxi_wdt)
--endef
--
--define KernelPackage/wdt-sunxi/description
--    Kernel module for AllWinner sunXi watchdog timer.
--endef
--
--$(eval $(call KernelPackage,wdt-sunxi))
--
--
- define KernelPackage/sound-soc-sunxi
-   TITLE:=AllWinner built-in SoC sound support
--  KCONFIG:= \
--	CONFIG_SND_SUNXI_SOC_CODEC \
--	CONFIG_SND_SUN4I_CODEC
--ifeq ($(strip $(call CompareKernelPatchVer,$(KERNEL_PATCHVER),lt,4.4.0)),1)
--  FILES+=$(LINUX_DIR)/sound/soc/sunxi/sunxi-codec.ko
--  AUTOLOAD:=$(call AutoLoad,65,sunxi-codec)
--endif
--ifeq ($(strip $(call CompareKernelPatchVer,$(KERNEL_PATCHVER),ge,4.4.0)),1)
-+  KCONFIG:=CONFIG_SND_SUN4I_CODEC
-   FILES:=$(LINUX_DIR)/sound/soc/sunxi/sun4i-codec.ko
-   AUTOLOAD:=$(call AutoLoad,65,sun4i-codec)
--endif
-   DEPENDS:=@TARGET_sunxi +kmod-sound-soc-core
-   $(call AddDepends/sound)
- endef

patches/lede/0014-procd-remove-procd-nand-package.patch

@@ -12,21 +12,21 @@ as a separate package.
 Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
 
 diff --git a/package/base-files/Makefile b/package/base-files/Makefile
-index ac3fe2f52b4863260a2e8efa58dac5da6bbb9ec1..4cc3e5079b9cf25909acef92526753945ba5f9de 100644
+index 1d034fdede7598f15b1f802c47e834990e5852d9..f473ef732106eb8fa05e7c5b59df176fef33e42d 100644
 --- a/package/base-files/Makefile
 +++ b/package/base-files/Makefile
-@@ -18,7 +18,9 @@ PKG_FILE_DEPENDS:=$(PLATFORM_DIR)/ $(GENERIC_PLATFORM_DIR)/base-files/
- PKG_BUILD_DEPENDS:=usign/host
+@@ -19,7 +19,9 @@ PKG_BUILD_DEPENDS:=usign/host
  PKG_LICENSE:=GPL-2.0
  
--PKG_CONFIG_DEPENDS := CONFIG_SIGNED_PACKAGES CONFIG_TARGET_INIT_PATH CONFIG_TARGET_PREINIT_DISABLE_FAILSAFE
-+PKG_CONFIG_DEPENDS := \
+ # Extend depends from version.mk
+-PKG_CONFIG_DEPENDS += CONFIG_SIGNED_PACKAGES CONFIG_TARGET_INIT_PATH CONFIG_TARGET_PREINIT_DISABLE_FAILSAFE
++PKG_CONFIG_DEPENDS += \
 +	CONFIG_SIGNED_PACKAGES CONFIG_TARGET_INIT_PATH CONFIG_TARGET_PREINIT_DISABLE_FAILSAFE \
 +	CONFIG_NAND_SUPPORT
  
  include $(INCLUDE_DIR)/package.mk
  
-@@ -30,7 +32,7 @@ endif
+@@ -31,7 +33,7 @@ endif
  define Package/base-files
    SECTION:=base
    CATEGORY:=Base system
@@ -35,7 +35,7 @@ index ac3fe2f52b4863260a2e8efa58dac5da6bbb9ec1..4cc3e5079b9cf25909acef9252675394
    TITLE:=Base filesystem for Lede
    URL:=http://openwrt.org/
    VERSION:=$(PKG_RELEASE)-$(REVISION)
-@@ -105,9 +107,16 @@ ifdef CONFIG_SIGNED_PACKAGES
+@@ -107,9 +109,16 @@ ifdef CONFIG_SIGNED_PACKAGES
    endef
  endif
  
@@ -435,7 +435,7 @@ index 0000000000000000000000000000000000000000..6bd2005344c081df20e5a330a69e49e3
 +	nand_upgrade_stage1
 +}
 diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
-index 805583143fa865d9ffb38355f10ad300e222400e..775b9a64e172b250b3ba27e71fbf07aff46ede14 100644
+index 5b92d79332f2ea400041586b92b570d8b633218a..879f03f54b23603a360499078d7d53503875f55a 100644
 --- a/package/system/procd/Makefile
 +++ b/package/system/procd/Makefile
 @@ -22,11 +22,9 @@ PKG_LICENSE_FILES:=
@@ -492,7 +492,7 @@ index 805583143fa865d9ffb38355f10ad300e222400e..775b9a64e172b250b3ba27e71fbf07af
  ifeq ($(CONFIG_PROCD_SHOW_BOOT),y)
    CMAKE_OPTIONS += -DSHOW_BOOT_ON_CONSOLE=1
  endif
-@@ -114,7 +94,7 @@ endif
+@@ -113,7 +93,7 @@ CMAKE_OPTIONS += -DSECCOMP_SUPPORT=$(SECCOMP) -DUTRACE_SUPPORT=$(SECCOMP)
  define Package/procd/install
  	$(INSTALL_DIR) $(1)/sbin $(1)/etc $(1)/lib/functions
  

patches/lede/0015-base-files-always-use-staged-sysupgrade.patch

@@ -12,7 +12,7 @@ are killed to allow unmounting the root filesystem.
 Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
 
 diff --git a/package/base-files/files/lib/upgrade/common.sh b/package/base-files/files/lib/upgrade/common.sh
-index e3519ca2cb496ff0835a9ef87da7faf217a07964..17248c2b1decd6f92558fb89601238b55fd0f0d6 100644
+index 8c1b3b180e1ecfdd2c106dd3b8853cd487ff89b4..ef9aac709fc1619ba15eeb0aeb4a9a6a372369b2 100644
 --- a/package/base-files/files/lib/upgrade/common.sh
 +++ b/package/base-files/files/lib/upgrade/common.sh
 @@ -56,7 +56,6 @@ run_ramfs() { # <command> [...]
@@ -147,7 +147,7 @@ index e3519ca2cb496ff0835a9ef87da7faf217a07964..17248c2b1decd6f92558fb89601238b5
  }
  
  get_magic_word() {
-@@ -320,12 +308,14 @@ default_do_upgrade() {
+@@ -331,12 +319,14 @@ default_do_upgrade() {
  	fi
  }
  
@@ -166,7 +166,7 @@ index e3519ca2cb496ff0835a9ef87da7faf217a07964..17248c2b1decd6f92558fb89601238b5
  	fi
  
  	if [ "$SAVE_CONFIG" -eq 1 ] && type 'platform_copy_config' >/dev/null 2>/dev/null; then
-@@ -333,12 +323,11 @@ do_upgrade() {
+@@ -344,12 +334,11 @@ do_upgrade() {
  	fi
  
  	v "Upgrade completed"
@@ -325,7 +325,7 @@ index 0000000000000000000000000000000000000000..4e2aa3a23c3bab07a795762a30a4d4f7
 +	exec /bin/busybox ash -c "$COMMAND"
 +fi
 diff --git a/package/base-files/files/sbin/sysupgrade b/package/base-files/files/sbin/sysupgrade
-index c095ca81c50c71021af2dc04a561ac22f6b7442b..2d67371ef74b4b970076a069e97f4fd6a1e0bc95 100755
+index 71c7faa6dbc485ff33e776ff087e1aca58cfb0b0..fa08f4194daa0ee74758b9f49a23fe8dcb4b933d 100755
 --- a/package/base-files/files/sbin/sysupgrade
 +++ b/package/base-files/files/sbin/sysupgrade
 @@ -1,4 +1,7 @@
@@ -374,7 +374,7 @@ index c095ca81c50c71021af2dc04a561ac22f6b7442b..2d67371ef74b4b970076a069e97f4fd6
  	cat <<-EOF
  		-b|--create-backup and -r|--restore-backup do not perform a firmware upgrade.
  		Do not specify both -b|-r and a firmware image.
-@@ -136,14 +136,13 @@ sysupgrade_pre_upgrade="fwtool_pre_upgrade"
+@@ -155,14 +155,13 @@ sysupgrade_pre_upgrade="fwtool_pre_upgrade"
  
  include /lib/upgrade
  
@@ -390,7 +390,7 @@ index c095ca81c50c71021af2dc04a561ac22f6b7442b..2d67371ef74b4b970076a069e97f4fd6
  		return 0
  	}
  	run_hooks "$CONFFILES" $sysupgrade_init_conffiles
-@@ -184,8 +183,33 @@ type platform_check_image >/dev/null 2>/dev/null || {
+@@ -203,8 +202,33 @@ type platform_check_image >/dev/null 2>/dev/null || {
  	exit 1
  }
  
@@ -425,7 +425,7 @@ index c095ca81c50c71021af2dc04a561ac22f6b7442b..2d67371ef74b4b970076a069e97f4fd6
  		if [ $FORCE -eq 1 ]; then
  			echo "Image check '$check' failed but --force given - will update anyway!"
  			break
-@@ -211,6 +235,7 @@ elif ask_bool $SAVE_CONFIG "Keep config files over reflash"; then
+@@ -230,6 +254,7 @@ elif ask_bool $SAVE_CONFIG "Keep config files over reflash"; then
  	[ $TEST -eq 1 ] || do_save_conffiles
  	export SAVE_CONFIG=1
  else
@@ -433,7 +433,7 @@ index c095ca81c50c71021af2dc04a561ac22f6b7442b..2d67371ef74b4b970076a069e97f4fd6
  	export SAVE_CONFIG=0
  fi
  
-@@ -218,28 +243,18 @@ if [ $TEST -eq 1 ]; then
+@@ -237,28 +262,18 @@ if [ $TEST -eq 1 ]; then
  	exit 0
  fi
  

patches/lede/0016-procd-update-to-latest-git-HEAD.patch

@@ -1,35 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Mon, 29 May 2017 23:15:22 +0200
-Subject: procd: update to latest git HEAD
-
-992b796 rcS: add missing fcntl.h include
-63789e5 init: add support for sysupgrades triggered from preinit
-5b1fb35 Remove code that has become unnecessary after sysupgrade changes
-5918b6d upgraded: add support for passing a "command" argument to stage2
-056d8dd upgraded: link dynamically, chroot during exec
-7c6cf55 system: always support staged sysupgrade
-d42b21e procd/rcS: Use /dev/null as stdin
-e0098d4 service/instance: add an auto start option
-1247db1 procd: Log initscript output prefixed with script name
-8d720b2 procd: Don't use syslog before its initialization
-2555474 procd: Add missing \n in debug message
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
-index 43ea23aab00918a2b664e9a5da7767f90cd568db..805583143fa865d9ffb38355f10ad300e222400e 100644
---- a/package/system/procd/Makefile
-+++ b/package/system/procd/Makefile
-@@ -12,9 +12,9 @@ PKG_RELEASE:=1
- 
- PKG_SOURCE_PROTO:=git
- PKG_SOURCE_URL=$(LEDE_GIT)/project/procd.git
--PKG_SOURCE_DATE:=2017-03-05
--PKG_SOURCE_VERSION:=8f218f5626a3cb3900dbe9801ee8ace236b0e4a5
--PKG_MIRROR_HASH:=8ac8691888b64726453bd726fe0c98fc906540bbd2ae666dae6bea592b0b4e4d
-+PKG_SOURCE_DATE:=2017-05-29
-+PKG_SOURCE_VERSION:=992b796204caf5b0290ea4a1246b43b353b6c1d7
-+PKG_MIRROR_HASH:=effecf66ef6a7396dd26d54a5d232b4a895d9fe7aaca83063aaffc7b39a051d5
- CMAKE_INSTALL:=1
- 
- PKG_LICENSE:=GPL-2.0

patches/lede/0017-fstools-snapshot-handle-jffs2-conversion-using-upgraded.patch

@@ -8,7 +8,7 @@ by upgraded.
 Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
 
 diff --git a/package/system/fstools/Makefile b/package/system/fstools/Makefile
-index 28f68b57d6f82dd066410a577e84e32a3a54dc37..2789424c5f5fb50cc1f004d2ab5223a7fecbf53a 100644
+index 6f1f511d387e900426832f40966012bc11d53075..f2e0580912ab7d475fab576bea4fd84f0dfe6a3d 100644
 --- a/package/system/fstools/Makefile
 +++ b/package/system/fstools/Makefile
 @@ -8,7 +8,7 @@

patches/lede/0018-base-files-sysupgrade-cleanup.patch

@@ -13,7 +13,7 @@ fixed eventually to use platform_do_upgrade for that purpose.
 Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
 
 diff --git a/package/base-files/files/lib/upgrade/common.sh b/package/base-files/files/lib/upgrade/common.sh
-index 17248c2b1decd6f92558fb89601238b55fd0f0d6..fc59bf2323498d332159b00eb7ab443bfe6b147e 100644
+index ef9aac709fc1619ba15eeb0aeb4a9a6a372369b2..af7682c29e005c6ca47b91e9be2d60c359a90d05 100644
 --- a/package/base-files/files/lib/upgrade/common.sh
 +++ b/package/base-files/files/lib/upgrade/common.sh
 @@ -30,106 +30,6 @@ install_bin() { # <file> [ <symlink> ... ]
@@ -245,7 +245,7 @@ index 4e2aa3a23c3bab07a795762a30a4d4f701081934..cc8047d988e39ca9ba27d2588744aad4
 +# Exec new shell from ramfs
 +exec /bin/busybox ash -c "$COMMAND"
 diff --git a/package/base-files/files/sbin/sysupgrade b/package/base-files/files/sbin/sysupgrade
-index 2d67371ef74b4b970076a069e97f4fd6a1e0bc95..200a0e520b5df8bcc208f4d8fd731756e94294fb 100755
+index fa08f4194daa0ee74758b9f49a23fe8dcb4b933d..347860d00af27a61152703320bb210d30726db83 100755
 --- a/package/base-files/files/sbin/sysupgrade
 +++ b/package/base-files/files/sbin/sysupgrade
 @@ -1,7 +1,5 @@

patches/lede/0019-base-files-add-support-for-staged-sysupgrades-from-failsafe-mode.patch

@@ -45,10 +45,10 @@ index 3147cdc5a68a69cef6b1af6618a4e2367a143c2c..728c63b2e8aebf970cd7dff0d15518cc
  
  boot_hook_add failsafe failsafe_netlogin
 diff --git a/package/base-files/files/sbin/sysupgrade b/package/base-files/files/sbin/sysupgrade
-index 200a0e520b5df8bcc208f4d8fd731756e94294fb..809e789f9f436aaeb47a906d46c94d5952583e5a 100755
+index 347860d00af27a61152703320bb210d30726db83..4a133a65e0960619b9cd0d722b6c27ac7894de5b 100755
 --- a/package/base-files/files/sbin/sysupgrade
 +++ b/package/base-files/files/sbin/sysupgrade
-@@ -251,8 +251,16 @@ run_hooks "" $sysupgrade_pre_upgrade
+@@ -270,8 +270,16 @@ run_hooks "" $sysupgrade_pre_upgrade
  
  install_bin /sbin/upgraded
  v "Commencing upgrade. All shell sessions will be closed now."

patches/lede/0027-generic-mtd-backport-unlock-support-and-asserted-fixes-for-certain-Winbond-Spansion-flash-chips.patch

@@ -0,0 +1,139 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Tue, 20 Jun 2017 11:01:27 +0200
+Subject: generic: mtd: backport unlock support and asserted fixes for certain Winbond/Spansion flash chips
+
+diff --git a/target/linux/generic/patches-4.4/049-0001-mtd-spi-nor-wait-until-lock-unlock-operations-are-re.patch b/target/linux/generic/patches-4.4/049-0001-mtd-spi-nor-wait-until-lock-unlock-operations-are-re.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..c8aafe2ebbf7368f47e8f4d7a24dd5e45583a136
+--- /dev/null
++++ b/target/linux/generic/patches-4.4/049-0001-mtd-spi-nor-wait-until-lock-unlock-operations-are-re.patch
+@@ -0,0 +1,66 @@
++From 32321e950d8a237d7e8f3a9b76220007dfa87544 Mon Sep 17 00:00:00 2001
++Message-Id: <32321e950d8a237d7e8f3a9b76220007dfa87544.1462572686.git.mschiffer@universe-factory.net>
++From: =?UTF-8?q?Ezequiel=20Garc=C3=ADa?= <ezequiel@vanguardiasur.com.ar>
++Date: Mon, 28 Dec 2015 17:54:51 -0300
++Subject: [PATCH] mtd: spi-nor: wait until lock/unlock operations are ready
++
++On Micron and Numonyx devices, the status register write command
++(WRSR), raises a work-in-progress bit (WIP) on the status register.
++The datasheets for these devices specify that while the status
++register write is in progress, the status register WIP bit can still
++be read to check the end of the operation.
++
++This commit adds a wait_till_ready call on lock/unlock operations,
++which is required for Micron and Numonyx but should be harmless for
++others. This is needed to prevent applications from issuing erase or
++program operations before the unlock operation is completed.
++
++Reported-by: Stas Sergeev <stsp@list.ru>
++Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
++Signed-off-by: Brian Norris <computersforpeace@gmail.com>
++---
++ drivers/mtd/spi-nor/spi-nor.c | 12 ++++++++++--
++ 1 file changed, 10 insertions(+), 2 deletions(-)
++
++--- a/drivers/mtd/spi-nor/spi-nor.c
+++++ b/drivers/mtd/spi-nor/spi-nor.c
++@@ -463,6 +463,7 @@ static int stm_lock(struct spi_nor *nor,
++ 	u8 status_old, status_new;
++ 	u8 mask = SR_BP2 | SR_BP1 | SR_BP0;
++ 	u8 shift = ffs(mask) - 1, pow, val;
+++	int ret;
++ 
++ 	status_old = read_sr(nor);
++ 
++@@ -499,7 +500,10 @@ static int stm_lock(struct spi_nor *nor,
++ 		return -EINVAL;
++ 
++ 	write_enable(nor);
++-	return write_sr(nor, status_new);
+++	ret = write_sr(nor, status_new);
+++	if (ret)
+++		return ret;
+++	return spi_nor_wait_till_ready(nor);
++ }
++ 
++ /*
++@@ -513,6 +517,7 @@ static int stm_unlock(struct spi_nor *no
++ 	uint8_t status_old, status_new;
++ 	u8 mask = SR_BP2 | SR_BP1 | SR_BP0;
++ 	u8 shift = ffs(mask) - 1, pow, val;
+++	int ret;
++ 
++ 	status_old = read_sr(nor);
++ 
++@@ -547,7 +552,10 @@ static int stm_unlock(struct spi_nor *no
++ 		return -EINVAL;
++ 
++ 	write_enable(nor);
++-	return write_sr(nor, status_new);
+++	ret = write_sr(nor, status_new);
+++	if (ret)
+++		return ret;
+++	return spi_nor_wait_till_ready(nor);
++ }
++ 
++ /*
+diff --git a/target/linux/generic/patches-4.4/049-0002-mtd-spi-nor-wait-for-SR_WIP-to-clear-on-initial-unlo.patch b/target/linux/generic/patches-4.4/049-0002-mtd-spi-nor-wait-for-SR_WIP-to-clear-on-initial-unlo.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..0541c95594ec14f62b5db787f4d52d5a42777cdc
+--- /dev/null
++++ b/target/linux/generic/patches-4.4/049-0002-mtd-spi-nor-wait-for-SR_WIP-to-clear-on-initial-unlo.patch
+@@ -0,0 +1,33 @@
++From edf891ef9ab773363f8e58022a26d7d31604aed6 Mon Sep 17 00:00:00 2001
++Message-Id: <edf891ef9ab773363f8e58022a26d7d31604aed6.1462572703.git.mschiffer@universe-factory.net>
++From: Brian Norris <computersforpeace@gmail.com>
++Date: Fri, 29 Jan 2016 11:25:30 -0800
++Subject: [PATCH] mtd: spi-nor: wait for SR_WIP to clear on initial unlock
++
++Fixup a piece leftover by commit 32321e950d8a ("mtd: spi-nor: wait until
++lock/unlock operations are ready"). That commit made us wait for the WIP
++bit to settle after lock/unlock operations, but it missed the open-coded
++"unlock" that happens at probe() time.
++
++We should probably have this code utilize the unlock() routines in the
++future, to avoid duplication, but unfortunately, flash which need to be
++unlocked don't all have a proper ->flash_unlock() callback.
++
++Signed-off-by: Brian Norris <computersforpeace@gmail.com>
++Cc: Stas Sergeev <stsp@users.sourceforge.net>
++Reviewed-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
++Tested-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
++---
++ drivers/mtd/spi-nor/spi-nor.c | 1 +
++ 1 file changed, 1 insertion(+)
++
++--- a/drivers/mtd/spi-nor/spi-nor.c
+++++ b/drivers/mtd/spi-nor/spi-nor.c
++@@ -1169,6 +1169,7 @@ int spi_nor_scan(struct spi_nor *nor, co
++ 	    info->flags & SPI_NOR_HAS_LOCK) {
++ 		write_enable(nor);
++ 		write_sr(nor, 0);
+++		spi_nor_wait_till_ready(nor);
++ 	}
++ 
++ 	if (!mtd->name)
+diff --git a/target/linux/generic/patches-4.4/466-revert-mtd-spi-nor-fix-Spansion-regressions-aliased-.patch b/target/linux/generic/patches-4.4/466-revert-mtd-spi-nor-fix-Spansion-regressions-aliased-.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..7c6530a5e0e8bc144e1d4497428e3c3691c2ef22
+--- /dev/null
++++ b/target/linux/generic/patches-4.4/466-revert-mtd-spi-nor-fix-Spansion-regressions-aliased-.patch
+@@ -0,0 +1,18 @@
++--- a/drivers/mtd/spi-nor/spi-nor.c
+++++ b/drivers/mtd/spi-nor/spi-nor.c
++@@ -1161,6 +1161,7 @@ int spi_nor_scan(struct spi_nor *nor, co
++ 	    JEDEC_MFR(info) == SNOR_MFR_INTEL ||
++ 	    JEDEC_MFR(info) == SNOR_MFR_MACRONIX ||
++ 	    JEDEC_MFR(info) == SNOR_MFR_SST ||
+++	    JEDEC_MFR(info) == SNOR_MFR_WINBOND ||
++ 	    info->flags & SPI_NOR_HAS_LOCK) {
++ 		write_enable(nor);
++ 		write_sr(nor, 0);
++@@ -1178,6 +1179,7 @@ int spi_nor_scan(struct spi_nor *nor, co
++ 
++ 	/* NOR protection support for STmicro/Micron chips and similar */
++ 	if (JEDEC_MFR(info) == SNOR_MFR_MICRON ||
+++	    JEDEC_MFR(info) == SNOR_MFR_WINBOND ||
++ 		info->flags & SPI_NOR_HAS_LOCK) {
++ 		nor->flash_lock = stm_lock;
++ 		nor->flash_unlock = stm_unlock;

patches/lede/0028-busybox-compile-with-debug-information.patch

@@ -0,0 +1,22 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Mon, 3 Jul 2017 01:40:32 +0200
+Subject: busybox: compile with debug information
+
+The added debug information is stripped of during packaging, so it does not
+increase the package size. It does however slightly change offsets in the
+code, preventing the weird ash segfaults we've been seeing. Also, if the
+issue returns, we'll have debug information matching the coredumps.
+
+diff --git a/package/utils/busybox/Makefile b/package/utils/busybox/Makefile
+index 0d370863653e280165c8083061799af97d031169..5d73e817b3c67225bd3fb4e5b7d86e290db7397b 100644
+--- a/package/utils/busybox/Makefile
++++ b/package/utils/busybox/Makefile
+@@ -91,6 +91,8 @@ ifdef CONFIG_BUSYBOX_DEFAULT_NSLOOKUP_LEDE
+   endif
+ endif
+ 
++TARGET_CFLAGS += -g
++
+ define Build/Compile
+ 	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
+ 		CC="$(TARGET_CC)" \

patches/lede/0029-Revert-scripts-package-metadata.pl-inhibit-compile-deps-on-missing-build-types.patch

@@ -0,0 +1,88 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Tue, 9 Jan 2018 16:31:07 +0100
+Subject: Revert "scripts/package-metadata.pl: inhibit compile deps on missing build types"
+
+This reverts commit b616aa6db7a9952c182ab49d7942fb67c09803d5. The change
+conflicts with our PROVIDES fix and is not strictly necessary for Gluon.
+
+diff --git a/scripts/package-metadata.pl b/scripts/package-metadata.pl
+index c49d132912828531c7125787f4f53d7130323123..2da32c770ef3333bfcc18922ede556f9734510c7 100755
+--- a/scripts/package-metadata.pl
++++ b/scripts/package-metadata.pl
+@@ -460,27 +460,20 @@ sub gen_package_mk() {
+ 			next unless $pkg->{"builddepends/$type"};
+ 			foreach my $dep (@{$pkg->{"builddepends/$type"}}) {
+ 				my $suffix = "";
+-				my $deptype = "";
+ 				my $condition;
+ 
+ 				if ($dep =~ /^(.+):(.+)/) {
+ 					$condition = $1;
+ 					$dep = $2;
+ 				}
+-				if ($dep =~ /^(.+)\/(.+)/) {
++				if ($dep =~ /^(.+)(\/.+)/) {
+ 					$dep = $1;
+-					$deptype = $2;
+-					$suffix = "/$2";
++					$suffix = $2;
+ 				}
+ 
+ 				my $idx = "";
+ 				my $pkg_dep = $package{$dep};
+ 				if (defined($pkg_dep) && defined($pkg_dep->{src})) {
+-					unless (!$deptype || grep { $_ eq $deptype } @{$pkg_dep->{buildtypes}}) {
+-						warn sprintf "WARNING: Makefile '%s' has a %s build dependency on '%s/%s' but '%s' does not implement a '%s' build type\n",
+-							$pkg->{makefile}, $type, $pkg_dep->{src}, $deptype, $pkg_dep->{makefile}, $deptype;
+-						next;
+-					}
+ 					$idx = $pkg_dep->{subdir}.$pkg_dep->{src};
+ 				} elsif (defined($srcpackage{$dep})) {
+ 					$idx = $subdir{$dep}.$dep;
+@@ -506,16 +499,14 @@ sub gen_package_mk() {
+ 			my $condition;
+ 			my $prefix = "";
+ 			my $suffix = "";
+-			my $deptype = "";
+ 
+ 			if ($deps =~ /^(.+):(.+)/) {
+ 				$condition = $1;
+ 				$deps = $2;
+ 			}
+-			if ($deps =~ /^(.+)\/(.+)/) {
++			if ($deps =~ /^(.+)(\/.+)/) {
+ 				$deps = $1;
+-				$deptype = $2;
+-				$suffix = "/$2";
++				$suffix = $2;
+ 			}
+ 
+ 			my $pkg_dep = $package{$deps};
+@@ -530,17 +521,7 @@ sub gen_package_mk() {
+ 			foreach my $dep (@deps) {
+ 				$pkg_dep = $package{$deps};
+ 				if (defined $pkg_dep->{src}) {
+-					unless (!$deptype || grep { $_ eq $deptype } @{$pkg_dep->{buildtypes}}) {
+-						warn sprintf "WARNING: Makefile '%s' has a build dependency on '%s/%s' but '%s' does not implement a '%s' build type\n",
+-							$pkg->{makefile}, $pkg_dep->{src}, $deptype, $pkg_dep->{makefile}, $deptype;
+-						next;
+-					}
+-					unless ($pkg->{src} ne $pkg_dep->{sec}.$suffix) {
+-						warn sprintf "WARNING: Makefile '%s' has a build dependency on itself\n",
+-							$pkg->{makefile};
+-						next;
+-					}
+-					$idx = $pkg_dep->{subdir}.$pkg_dep->{src};
++					($pkg->{src} ne $pkg_dep->{src}.$suffix) and $idx = $pkg_dep->{subdir}.$pkg_dep->{src};
+ 				} elsif (defined($srcpackage{$dep})) {
+ 					$idx = $subdir{$dep}.$dep;
+ 				}
+@@ -592,7 +573,7 @@ ifndef DUMP_TARGET_DB
+ 	( \\
+ $cmds \\
+ 	) > \$@
+-
++	
+ ifneq (\$(IMAGEOPT)\$(CONFIG_IMAGEOPT),)
+   package/preconfig: \$(TARGET_DIR)/etc/uci-defaults/$preconfig
+ endif

patches/lede/0029-procd-update-to-latest-git-HEAD.patch

@@ -1,25 +0,0 @@
-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Tue, 30 May 2017 07:29:25 +0200
-Subject: procd: update to latest git HEAD
-
-e7bb2c8 upgraded: define __GNU_SOURCE
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
-index 775b9a64e172b250b3ba27e71fbf07aff46ede14..f9d2f4d34f866a169eb1665ac2699c54422c3c4b 100644
---- a/package/system/procd/Makefile
-+++ b/package/system/procd/Makefile
-@@ -12,9 +12,9 @@ PKG_RELEASE:=1
- 
- PKG_SOURCE_PROTO:=git
- PKG_SOURCE_URL=$(LEDE_GIT)/project/procd.git
--PKG_SOURCE_DATE:=2017-05-29
--PKG_SOURCE_VERSION:=992b796204caf5b0290ea4a1246b43b353b6c1d7
--PKG_MIRROR_HASH:=effecf66ef6a7396dd26d54a5d232b4a895d9fe7aaca83063aaffc7b39a051d5
-+PKG_SOURCE_DATE:=2017-05-30
-+PKG_SOURCE_VERSION:=e7bb2c8d631862e1535cf6eead18387f02a69ad2
-+PKG_MIRROR_HASH:=97bb96aba2db4730fd8b2edeb15f94e18caa6017d9e50a73777c14532154cade
- CMAKE_INSTALL:=1
- 
- PKG_LICENSE:=GPL-2.0

patches/lede/0030-base-files-upgrade-correctly-handle-nand_do_upgrade-argument-passed-from-preupgrade.patch

@@ -0,0 +1,33 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Mon, 10 Jul 2017 10:35:19 +0200
+Subject: base-files: upgrade: correctly handle nand_do_upgrade argument passed from preupgrade
+
+Fixes: 30f61a34b4cf "base-files: always use staged sysupgrade"
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/package/base-files/files/lib/upgrade/common.sh b/package/base-files/files/lib/upgrade/common.sh
+index af7682c29e005c6ca47b91e9be2d60c359a90d05..6ccd84c5a95348124412adc8bf41d3fa4894435a 100644
+--- a/package/base-files/files/lib/upgrade/common.sh
++++ b/package/base-files/files/lib/upgrade/common.sh
+@@ -222,7 +222,7 @@ default_do_upgrade() {
+ do_upgrade_stage2() {
+ 	v "Performing system upgrade..."
+ 	if [ -n "$do_upgrade" ]; then
+-		$do_upgrade "$IMAGE"
++		eval "$do_upgrade"
+ 	elif type 'platform_do_upgrade' >/dev/null 2>/dev/null; then
+ 		platform_do_upgrade "$IMAGE"
+ 	else
+diff --git a/package/base-files/files/lib/upgrade/nand.sh b/package/base-files/files/lib/upgrade/nand.sh
+index 1e69c8f9657b39adf2a2c33bd9bac9303bcbc3d7..72f0fe0e10312e74ce085ad53f0adceb921fd013 100644
+--- a/package/base-files/files/lib/upgrade/nand.sh
++++ b/package/base-files/files/lib/upgrade/nand.sh
+@@ -289,7 +289,7 @@ nand_do_upgrade() {
+ 		# hook; this piece of code handles scripts that haven't been
+ 		# updated. All scripts should gradually move to call nand_do_upgrade
+ 		# from platform_do_upgrade instead.
+-		export do_upgrade=nand_do_upgrade
++		export do_upgrade="nand_do_upgrade '$1'"
+ 		return
+ 	fi
+ 

patches/lede/0031-base-files-upgrade-don-t-loop-forever-trying-to-kill-processes.patch

@@ -0,0 +1,42 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Thu, 13 Jul 2017 00:19:32 +0200
+Subject: base-files: upgrade: don't loop forever trying to kill processes
+
+When processes don't die on SIGKILL (usually because of kernel bugs), it's
+better to give up instead of looping forever.
+
+upgraded will trigger a reboot in this case (and if this fails, a hardware
+watchdog will eventually time out and reset the system, if present).
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/package/base-files/files/lib/upgrade/stage2 b/package/base-files/files/lib/upgrade/stage2
+index bdbb8926643287f48a4ae62c5d1d4b4a29130859..097ad63adfecdd70019acaa5b652d2056e774c3f 100755
+--- a/package/base-files/files/lib/upgrade/stage2
++++ b/package/base-files/files/lib/upgrade/stage2
+@@ -87,6 +87,8 @@ switch_to_ramfs() {
+ }
+ 
+ kill_remaining() { # [ <signal> [ <loop> ] ]
++	local loop_limit=10
++
+ 	local sig="${1:-TERM}"
+ 	local loop="${2:-0}"
+ 	local run=true
+@@ -117,8 +119,15 @@ kill_remaining() { # [ <signal> [ <loop> ] ]
+ 
+ 			[ $loop -eq 1 ] && run=true
+ 		done
++
++		let loop_limit--
++		[ $loop_limit -eq 0 ] && {
++			echo
++			echo "Failed to kill all processes."
++			exit 1
++		}
+ 	done
+-	echo ""
++	echo
+ }
+ 
+ 

patches/lede/0032-bcm53xx-upgrade-fix-RAMFS_COPY_.patch

@@ -0,0 +1,39 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Sat, 10 Jun 2017 16:14:54 +0200
+Subject: bcm53xx: upgrade: fix RAMFS_COPY_*
+
+Fixes: 30f61a34b4cf "base-files: always use staged sysupgrade"
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/package/base-files/files/lib/upgrade/stage2 b/package/base-files/files/lib/upgrade/stage2
+index 097ad63adfecdd70019acaa5b652d2056e774c3f..8cc8c8b34e9f349f1d1283ac00f9782b52ab01c1 100755
+--- a/package/base-files/files/lib/upgrade/stage2
++++ b/package/base-files/files/lib/upgrade/stage2
+@@ -48,7 +48,7 @@ switch_to_ramfs() {
+ 		/bin/sleep /bin/zcat /usr/bin/bzcat /usr/bin/printf /usr/bin/wc \
+ 		/bin/cut /usr/bin/printf /bin/sync /bin/mkdir /bin/rmdir	\
+ 		/bin/rm /usr/bin/basename /bin/kill /bin/chmod /usr/bin/find \
+-		/bin/mknod /bin/touch
++		/bin/mknod /bin/touch /bin/sed
+ 
+ 	install_bin /sbin/mtd
+ 	install_bin /sbin/mount_root
+diff --git a/target/linux/bcm53xx/base-files/lib/upgrade/platform.sh b/target/linux/bcm53xx/base-files/lib/upgrade/platform.sh
+index f2e007db22fa8fde93bf0dd58b359f6515e0445c..6a9e4950450cb896db7ebb3eb901b5cf51030295 100644
+--- a/target/linux/bcm53xx/base-files/lib/upgrade/platform.sh
++++ b/target/linux/bcm53xx/base-files/lib/upgrade/platform.sh
+@@ -1,3 +1,5 @@
++RAMFS_COPY_BIN='/usr/bin/osafeloader /usr/bin/oseama'
++
+ PART_NAME=firmware
+ 
+ # $(1): file to read magic from
+@@ -260,8 +262,6 @@ platform_pre_upgrade_seama() {
+ }
+ 
+ platform_pre_upgrade() {
+-	export RAMFS_COPY_BIN="${RAMFS_COPY_BIN} /usr/bin/osafeloader /usr/bin/oseama /bin/sed"
+-
+ 	local file_type=$(platform_identify "$1")
+ 
+ 	[ "$(platform_flash_type)" != "nand" ] && return

patches/lede/0033-ipq806x-upgrade-fix-RAMFS_COPY_.patch

@@ -0,0 +1,68 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Mon, 10 Jul 2017 18:03:39 +0200
+Subject: ipq806x: upgrade: fix RAMFS_COPY_*
+
+RAMFS_COPY_* are moved to platform.sh toplevel. The unneeded
+linksys_preupgrade function is removed, and the nand_do_upgrade call is
+moved to platform_do_upgrade.
+
+Fixes: 30f61a34b4cf "base-files: always use staged sysupgrade"
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/target/linux/ipq806x/base-files/lib/upgrade/linksys.sh b/target/linux/ipq806x/base-files/lib/upgrade/linksys.sh
+index 12f25efdae87979e79a252237f735932cb66d42f..0234ce0a51a0a92dcd719102f83e19686442574a 100644
+--- a/target/linux/ipq806x/base-files/lib/upgrade/linksys.sh
++++ b/target/linux/ipq806x/base-files/lib/upgrade/linksys.sh
+@@ -99,12 +99,3 @@ platform_do_upgrade_linksys() {
+ 		fi
+ 	}
+ }
+-
+-linksys_preupgrade() {
+-	export RAMFS_COPY_BIN="${RAMFS_COPY_BIN} /usr/sbin/fw_printenv /usr/sbin/fw_setenv"
+-	export RAMFS_COPY_BIN="${RAMFS_COPY_BIN} /bin/mkdir /bin/touch"
+-	export RAMFS_COPY_DATA="${RAMFS_COPY_DATA} /etc/fw_env.config /var/lock/fw_printenv.lock"
+-
+-}
+-
+-append sysupgrade_pre_upgrade linksys_preupgrade
+diff --git a/target/linux/ipq806x/base-files/lib/upgrade/platform.sh b/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
+index c3741f9ff242cddb3c185c2f638c7b4dff781e1b..6455b57cfb1346b7cc9e103065080d8ae92edc19 100644
+--- a/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
++++ b/target/linux/ipq806x/base-files/lib/upgrade/platform.sh
+@@ -3,11 +3,14 @@
+ PART_NAME=firmware
+ REQUIRE_IMAGE_METADATA=1
+ 
++RAMFS_COPY_BIN='/usr/sbin/fw_printenv /usr/sbin/fw_setenv'
++RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
++
+ platform_check_image() {
+ 	return 0;
+ }
+ 
+-platform_pre_upgrade() {
++platform_do_upgrade() {
+ 	local board=$(ipq806x_board_name)
+ 
+ 	case "$board" in
+@@ -17,18 +20,8 @@ platform_pre_upgrade() {
+ 	r7500 |\
+ 	r7500v2 |\
+ 	r7800)
+-		nand_do_upgrade "$1"
+-		;;
+-	ea8500)
+-		linksys_preupgrade "$1"
++		nand_do_upgrade "$ARGV"
+ 		;;
+-	esac
+-}
+-
+-platform_do_upgrade() {
+-	local board=$(ipq806x_board_name)
+-
+-	case "$board" in
+ 	c2600)
+ 		PART_NAME="os-image:rootfs"
+ 		MTD_CONFIG_ARGS="-s 0x200000"

patches/lede/0034-kirkwood-upgrade-fix-RAMFS_COPY_.patch

@@ -0,0 +1,60 @@
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Mon, 10 Jul 2017 18:16:23 +0200
+Subject: kirkwood: upgrade: fix RAMFS_COPY_*
+
+RAMFS_COPY_* are moved to platform.sh toplevel. The nand_do_upgrade call is
+moved to platform_do_upgrade.
+
+Fixes: 30f61a34b4cf "base-files: always use staged sysupgrade"
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/target/linux/kirkwood/base-files/lib/upgrade/linksys.sh b/target/linux/kirkwood/base-files/lib/upgrade/linksys.sh
+index 13a8f1cb554462acf39a59c9d5c1e6cd4ec222f5..dde3bd1b2190d68ce54e6c2883a45032d58599b2 100644
+--- a/target/linux/kirkwood/base-files/lib/upgrade/linksys.sh
++++ b/target/linux/kirkwood/base-files/lib/upgrade/linksys.sh
+@@ -69,11 +69,3 @@ platform_do_upgrade_linksys() {
+ 		fi
+ 	}
+ }
+-
+-linksys_preupgrade() {
+-	export RAMFS_COPY_BIN="${RAMFS_COPY_BIN} /usr/sbin/fw_printenv /usr/sbin/fw_setenv"
+-	export RAMFS_COPY_BIN="${RAMFS_COPY_BIN} /bin/mkdir /bin/touch"
+-	export RAMFS_COPY_DATA="${RAMFS_COPY_DATA} /etc/fw_env.config /var/lock/fw_printenv.lock"
+-}
+-
+-append sysupgrade_pre_upgrade linksys_preupgrade
+diff --git a/target/linux/kirkwood/base-files/lib/upgrade/platform.sh b/target/linux/kirkwood/base-files/lib/upgrade/platform.sh
+index e7c6a1120a90147380f4fcf644eb7078c1bc1659..c8c66c1b9d67759305ee836f9d84b9a2968a9493 100644
+--- a/target/linux/kirkwood/base-files/lib/upgrade/platform.sh
++++ b/target/linux/kirkwood/base-files/lib/upgrade/platform.sh
+@@ -1,5 +1,8 @@
+ . /lib/kirkwood.sh
+ 
++RAMFS_COPY_BIN='/usr/sbin/fw_printenv /usr/sbin/fw_setenv'
++RAMFS_COPY_DATA='/etc/fw_env.config /var/lock/fw_printenv.lock'
++
+ platform_check_image() {
+ 	[ "$#" -gt 1 ] && return 1
+ 	local board="$(kirkwood_board_name)"
+@@ -33,19 +36,7 @@ platform_do_upgrade() {
+ 		platform_do_upgrade_linksys "$ARGV"
+ 		;;
+ 	*)
+-		default_do_upgrade "$@"
+-		;;
+-	esac
+-}
+-
+-platform_pre_upgrade() {
+-	local board=$(kirkwood_board_name)
+-
+-	case "$board" in
+-	"linksys-audi"|\
+-	"linksys-viper") ;;
+-	*)
+-		nand_do_upgrade $1
++		nand_do_upgrade "$ARGV"
+ 		;;
+ 	esac
+ }

patches/lede/0035-ar71xx-add-uImageArcher-to-tp-link.mk.patch

@@ -0,0 +1,29 @@
+From: Andreas Ziegler <github@andreas-ziegler.de>
+Date: Sun, 6 Aug 2017 16:27:53 +0200
+Subject: ar71xx: add uImageArcher to tp-link.mk
+
+backport from e39dc8d823c86559eedbbdcee5f5c14b827fed0f
+ar71xx: add support to TP-Link Archer C59v1 and C60v1
+
+Based-on-patch-by: Henryk Heisig <hyniu@o2.pl>
+Signed-off-by: Andreas Ziegler <github@andreas-ziegler.de>
+
+diff --git a/target/linux/ar71xx/image/tp-link.mk b/target/linux/ar71xx/image/tp-link.mk
+index b76ed02ca394fc1a8b15218d64b5dc722552bbfd..9cd6c6372ac8f7e509a0a2422616097c1c19edf6 100644
+--- a/target/linux/ar71xx/image/tp-link.mk
++++ b/target/linux/ar71xx/image/tp-link.mk
+@@ -45,6 +45,14 @@ define Build/mktplinkfw-kernel
+ 	@mv $@.new $@
+ endef
+ 
++define Build/uImageArcher
++	mkimage -A $(LINUX_KARCH) \
++		-O linux -T kernel \
++		-C $(1) -a $(KERNEL_LOADADDR) -e $(if $(KERNEL_ENTRY),$(KERNEL_ENTRY),$(KERNEL_LOADADDR)) \
++		-n '$(call toupper,$(LINUX_KARCH)) LEDE Linux-$(LINUX_VERSION)' -d $@ $@.new
++	@mv $@.new $@
++endef
++
+ define Device/tplink
+   TPLINK_HWREV := 0x1
+   TPLINK_HEADER_VERSION := 1

patches/lede/0036-ar71xx-add-support-for-TP-Link-Archer-C25-v1.patch

@@ -0,0 +1,444 @@
+From: Ludwig Thomeczek <ledesrc@wxorx.net>
+Date: Sat, 22 Apr 2017 18:21:47 +0200
+Subject: ar71xx: add support for TP-Link Archer C25 v1
+
+The TP-Link Archer C25 is a low-cost dual-band router.
+
+Specification:
+
+- CPU: Atheros QCA9561 775 MHz
+- RAM: 64 MB
+- Flash: 8 MB
+- Wifi: 3x3 2.4 GHz (integrated), 1x1 5 GHz QCA9887
+- NET: 5x 10/100 Mbps Ethernet
+
+Some LEDs are controlled by an additional 74HC595 chip.
+
+Signed-off-by: Ludwig Thomeczek <ledesrc@wxorx.net>
+[minor code style fixes, boards alphabetical order fixes,
+reworked commit message]
+Signed-off-by: Piotr Dymacz <pepe2k@gmail.com>
+
+diff --git a/target/linux/ar71xx/base-files/etc/board.d/01_leds b/target/linux/ar71xx/base-files/etc/board.d/01_leds
+index 833522f27b61ac2208c2862bc0f29f34dea5e701..e1efb561b33da4dcfcb82ee953cd888170476dfb 100755
+--- a/target/linux/ar71xx/base-files/etc/board.d/01_leds
++++ b/target/linux/ar71xx/base-files/etc/board.d/01_leds
+@@ -53,6 +53,15 @@ ap121f)
+ 	ucidef_set_led_netdev "lan" "LAN" "$board:green:lan" "eth0"
+ 	ucidef_set_led_wlan "wlan" "WLAN" "$board:green:wlan" "phy0tpt"
+ 	;;
++archer-c25-v1)
++	ucidef_set_led_netdev "wan" "WAN" "$board:green:wan" "eth0"
++	ucidef_set_led_wlan "wlan" "WLAN" "$board:green:wlan2g" "phy1tpt"
++	ucidef_set_led_wlan "wlan5g" "WLAN5G" "$board:green:wlan5g" "phy0tpt"
++	ucidef_set_led_switch "lan1" "LAN1" "$board:green:lan1" "switch0" "0x10"
++	ucidef_set_led_switch "lan2" "LAN2" "$board:green:lan2" "switch0" "0x08"
++	ucidef_set_led_switch "lan3" "LAN3" "$board:green:lan3" "switch0" "0x04"
++	ucidef_set_led_switch "lan4" "LAN4" "$board:green:lan4" "switch0" "0x02"
++	;;
+ arduino-yun)
+ 	ucidef_set_led_wlan "wlan" "WLAN" "arduino:blue:wlan" "phy0tpt"
+ 	ucidef_set_led_usbdev "usb" "USB" "arduino:white:usb" "1-1.1"
+diff --git a/target/linux/ar71xx/base-files/etc/board.d/02_network b/target/linux/ar71xx/base-files/etc/board.d/02_network
+index 6d8a5c3d0a86a627663dee6e2905e03d5dec99fb..cefb7413eac6ffc50e67f1eaf63def749314428b 100755
+--- a/target/linux/ar71xx/base-files/etc/board.d/02_network
++++ b/target/linux/ar71xx/base-files/etc/board.d/02_network
+@@ -122,6 +122,7 @@ ar71xx_setup_interfaces()
+ 	a60|\
+ 	alfa-ap96|\
+ 	alfa-nx|\
++	archer-c25-v1|\
+ 	dr344|\
+ 	gl-ar150|\
+ 	gl-ar300m|\
+diff --git a/target/linux/ar71xx/base-files/etc/diag.sh b/target/linux/ar71xx/base-files/etc/diag.sh
+index bc2fc2f774c4f2f0bbfa6e43d9b9a55e9b63153d..38cc5d7853c79f2a7800a387310a95abb3b4de1b 100644
+--- a/target/linux/ar71xx/base-files/etc/diag.sh
++++ b/target/linux/ar71xx/base-files/etc/diag.sh
+@@ -50,6 +50,7 @@ get_status_led() {
+ 	ap135-020)
+ 		status_led="ap135:green:status"
+ 		;;
++	archer-c25-v1|\
+ 	mr12|\
+ 	mr16|\
+ 	nbg6616|\
+diff --git a/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+index b3e23c9a8f8c56870ef36fb55ae52e6b5ea61134..68f90de802ddd18e09a1da39c0d56292eea9489c 100644
+--- a/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
++++ b/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+@@ -92,6 +92,7 @@ case "$FIRMWARE" in
+ 		ath10kcal_extract "art" 20480 2116
+ 		ath10kcal_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) -2)
+ 		;;
++	archer-c25-v1|\
+ 	tl-wdr6500-v2)
+ 		ath10kcal_extract "art" 20480 2116
+ 		ath10kcal_patch_mac $(macaddr_add $(cat /sys/class/net/eth1/address) -2)
+diff --git a/target/linux/ar71xx/base-files/lib/ar71xx.sh b/target/linux/ar71xx/base-files/lib/ar71xx.sh
+index 170c6f01b4310c4d6c261e9ba97af8786b21c93b..fc7d862c2911e96f76622cbed23e99863814da63 100755
+--- a/target/linux/ar71xx/base-files/lib/ar71xx.sh
++++ b/target/linux/ar71xx/base-files/lib/ar71xx.sh
+@@ -463,6 +463,9 @@ ar71xx_board_detect() {
+ 	*AP90Q)
+ 		name="ap90q"
+ 		;;
++	*"Archer C25 v1")
++		name="archer-c25-v1"
++		;;
+ 	*"Archer C5")
+ 		name="archer-c5"
+ 		;;
+diff --git a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
+index d2dc88127c02746cdecc4ced28f33548f35d037c..6258713dd0e3325ab109689f0ed3b51e27c41f89 100755
+--- a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
++++ b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
+@@ -214,6 +214,7 @@ platform_check_image() {
+ 	ap121f|\
+ 	ap132|\
+ 	ap90q|\
++	archer-c25-v1|\
+ 	bullet-m|\
+ 	c-55|\
+ 	carambola2|\
+diff --git a/target/linux/ar71xx/config-4.4 b/target/linux/ar71xx/config-4.4
+index a8622454b421c1c74a8a71134b53c50399114aa5..e10401d42ae06506f82f2f5538fbc7df79fd4c65 100644
+--- a/target/linux/ar71xx/config-4.4
++++ b/target/linux/ar71xx/config-4.4
+@@ -51,6 +51,7 @@ CONFIG_ATH79_MACH_AP152=y
+ # CONFIG_ATH79_MACH_AP81 is not set
+ CONFIG_ATH79_MACH_AP90Q=y
+ CONFIG_ATH79_MACH_AP96=y
++CONFIG_ATH79_MACH_ARCHER_C25_V1=y
+ CONFIG_ATH79_MACH_ARCHER_C7=y
+ CONFIG_ATH79_MACH_ARDUINO_YUN=y
+ CONFIG_ATH79_MACH_AW_NR580=y
+diff --git a/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt b/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
+index 58d7e435362e0bac105e8183206e593329e4ae96..fb2afb965c4641df7cdcaf0920f2d56b3717fa9b 100644
+--- a/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
++++ b/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
+@@ -1234,6 +1234,16 @@ config ATH79_MACH_BSB
+ 	select ATH79_DEV_USB
+ 	select ATH79_DEV_WMAC
+ 
++config ATH79_MACH_ARCHER_C25_V1
++	bool "TP-LINK Archer C25 v1 support"
++	select SOC_QCA956X
++	select ATH79_DEV_AP9X_PCI if PCI
++	select ATH79_DEV_ETH
++	select ATH79_DEV_GPIO_BUTTONS
++	select ATH79_DEV_LEDS_GPIO
++	select ATH79_DEV_M25P80
++	select ATH79_DEV_WMAC
++
+ config ATH79_MACH_ARCHER_C7
+ 	bool "TP-LINK Archer C5/C7/TL-WDR4900 v2 board support"
+ 	select SOC_QCA955X
+diff --git a/target/linux/ar71xx/files/arch/mips/ath79/Makefile b/target/linux/ar71xx/files/arch/mips/ath79/Makefile
+index 7aee76019552e14ebdbf7bea357859dedb1a5bbb..3365a43ce16fc77b3212b39b92081efe678e8803 100644
+--- a/target/linux/ar71xx/files/arch/mips/ath79/Makefile
++++ b/target/linux/ar71xx/files/arch/mips/ath79/Makefile
+@@ -56,6 +56,7 @@ obj-$(CONFIG_ATH79_MACH_AP147)			+= mach-ap147.o
+ obj-$(CONFIG_ATH79_MACH_AP152)			+= mach-ap152.o
+ obj-$(CONFIG_ATH79_MACH_AP90Q)			+= mach-ap90q.o
+ obj-$(CONFIG_ATH79_MACH_AP96)			+= mach-ap96.o
++obj-$(CONFIG_ATH79_MACH_ARCHER_C25_V1)		+= mach-archer-c25-v1.o
+ obj-$(CONFIG_ATH79_MACH_ARCHER_C7)		+= mach-archer-c7.o
+ obj-$(CONFIG_ATH79_MACH_ARDUINO_YUN)		+= mach-arduino-yun.o
+ obj-$(CONFIG_ATH79_MACH_AW_NR580)		+= mach-aw-nr580.o
+diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-archer-c25-v1.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-archer-c25-v1.c
+new file mode 100644
+index 0000000000000000000000000000000000000000..a0f001cb49af5aa501c6825c40f3a98ab99503b2
+--- /dev/null
++++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-archer-c25-v1.c
+@@ -0,0 +1,227 @@
++/*
++ *  TP-Link Archer C25 v1 board support
++ *
++ *  Copyright (C) 2017 Ludwig Thomeczek <ledesrc@wxorx.net>
++ *  based on mach-archer-c60/C59-v1.c
++ *  Copyright (C) 2016 Henryk Heisig <hyniu@o2.pl>
++ *
++ *  This program is free software; you can redistribute it and/or modify it
++ *  under the terms of the GNU General Public License version 2 as published
++ *  by the Free Software Foundation.
++ */
++#include <linux/platform_device.h>
++#include <linux/ath9k_platform.h>
++#include <linux/ar8216_platform.h>
++#include <asm/mach-ath79/ar71xx_regs.h>
++#include <linux/gpio.h>
++
++#include "common.h"
++#include "dev-m25p80.h"
++#include "machtypes.h"
++#include "pci.h"
++#include "dev-ap9x-pci.h"
++#include "dev-eth.h"
++#include "dev-gpio-buttons.h"
++#include "dev-leds-gpio.h"
++#include "dev-spi.h"
++#include "dev-usb.h"
++#include "dev-wmac.h"
++#include <linux/spi/spi_gpio.h>
++#include <linux/spi/74x164.h>
++
++#define ARCHER_C25_GPIO_SHIFT_OE	21 /* OE,   Output Enable */
++#define ARCHER_C25_GPIO_SHIFT_SER	14 /* DS,   Data Serial Input */
++#define ARCHER_C25_GPIO_SHIFT_SRCLK	15 /* SHCP, Shift Reg Clock Input */
++#define ARCHER_C25_GPIO_SHIFT_SRCLR	19 /* MR,   Master Reset */
++#define ARCHER_C25_GPIO_SHIFT_RCLK	16 /* STCP, Storage Reg Clock Input */
++
++#define ARCHER_C25_74HC_GPIO_BASE		QCA956X_GPIO_COUNT
++#define ARCHER_C25_74HC_GPIO_LED_WAN_AMBER	27
++#define ARCHER_C25_74HC_GPIO_LED_WAN_GREEN	28
++#define ARCHER_C25_74HC_GPIO_LED_WLAN2		29
++#define ARCHER_C25_74HC_GPIO_LED_WLAN5		30
++#define ARCHER_C25_74HC_GPIO_LED_LAN1		23
++#define ARCHER_C25_74HC_GPIO_LED_LAN2		24
++#define ARCHER_C25_74HC_GPIO_LED_LAN3		25
++#define ARCHER_C25_74HC_GPIO_LED_LAN4		26
++
++#define ARCHER_C25_V1_SSR_BIT_0			0
++#define ARCHER_C25_V1_SSR_BIT_1			1
++#define ARCHER_C25_V1_SSR_BIT_2			2
++#define ARCHER_C25_V1_SSR_BIT_3			3
++#define ARCHER_C25_V1_SSR_BIT_4			4
++#define ARCHER_C25_V1_SSR_BIT_5			5
++#define ARCHER_C25_V1_SSR_BIT_6			6
++#define ARCHER_C25_V1_SSR_BIT_7			7
++
++
++#define ARCHER_C25_V1_KEYS_POLL_INTERVAL	20
++#define ARCHER_C25_V1_KEYS_DEBOUNCE_INTERVAL	\
++					(3 * ARCHER_C25_V1_KEYS_POLL_INTERVAL)
++
++#define ARCHER_C25_V1_GPIO_BTN_RESET		1
++#define ARCHER_C25_V1_GPIO_BTN_RFKILL		22
++
++#define ARCHER_C25_V1_GPIO_LED_POWER		17
++#define ARCHER_C25_V1_GPIO_LED_WPS		2
++
++#define ARCHER_C25_V1_WMAC_CALDATA_OFFSET	0x1000
++
++static struct spi_gpio_platform_data archer_c25_v1_spi_data = {
++	.sck		= ARCHER_C25_GPIO_SHIFT_SRCLK,
++	.miso		= SPI_GPIO_NO_MISO,
++	.mosi		= ARCHER_C25_GPIO_SHIFT_SER,
++	.num_chipselect	= 1,
++};
++
++static u8 archer_c25_v1_ssr_initdata[] __initdata = {
++	BIT(ARCHER_C25_V1_SSR_BIT_7) |
++	BIT(ARCHER_C25_V1_SSR_BIT_6) |
++	BIT(ARCHER_C25_V1_SSR_BIT_5) |
++	BIT(ARCHER_C25_V1_SSR_BIT_4) |
++	BIT(ARCHER_C25_V1_SSR_BIT_3) |
++	BIT(ARCHER_C25_V1_SSR_BIT_2) |
++	BIT(ARCHER_C25_V1_SSR_BIT_1)
++};
++
++static struct gen_74x164_chip_platform_data archer_c25_v1_ssr_data = {
++	.base = ARCHER_C25_74HC_GPIO_BASE,
++	.num_registers = ARRAY_SIZE(archer_c25_v1_ssr_initdata),
++	.init_data = archer_c25_v1_ssr_initdata,
++};
++
++static struct platform_device archer_c25_v1_spi_device = {
++	.name		= "spi_gpio",
++	.id		= 1,
++	.dev = {
++		.platform_data = &archer_c25_v1_spi_data,
++	},
++};
++
++static struct spi_board_info archer_c25_v1_spi_info[] = {
++	{
++		.bus_num		= 1,
++		.chip_select		= 0,
++		.max_speed_hz		= 10000000,
++		.modalias		= "74x164",
++		.platform_data		= &archer_c25_v1_ssr_data,
++		.controller_data	= (void *) ARCHER_C25_GPIO_SHIFT_RCLK,
++	},
++};
++
++static struct gpio_led archer_c25_v1_leds_gpio[] __initdata = {
++	{
++		.name		= "archer-c25-v1:green:power",
++		.gpio		= ARCHER_C25_V1_GPIO_LED_POWER,
++		.active_low	= 1,
++	}, {
++		.name		= "archer-c25-v1:green:wps",
++		.gpio		= ARCHER_C25_V1_GPIO_LED_WPS,
++		.active_low	= 1,
++	}, {
++		.name		= "archer-c25-v1:green:wlan2g",
++		.gpio		= ARCHER_C25_74HC_GPIO_LED_WLAN2,
++		.active_low	= 1,
++	}, {
++		.name		= "archer-c25-v1:green:wlan5g",
++		.gpio		= ARCHER_C25_74HC_GPIO_LED_WLAN5,
++		.active_low	= 1,
++	}, {
++		.name		= "archer-c25-v1:green:lan1",
++		.gpio		= ARCHER_C25_74HC_GPIO_LED_LAN1,
++		.active_low	= 1,
++	}, {
++		.name		= "archer-c25-v1:green:lan2",
++		.gpio		= ARCHER_C25_74HC_GPIO_LED_LAN2,
++		.active_low	= 1,
++	}, {
++		.name		= "archer-c25-v1:green:lan3",
++		.gpio		= ARCHER_C25_74HC_GPIO_LED_LAN3,
++		.active_low	= 1,
++	}, {
++		.name		= "archer-c25-v1:green:lan4",
++		.gpio		= ARCHER_C25_74HC_GPIO_LED_LAN4,
++		.active_low	= 1,
++	}, {
++		.name		= "archer-c25-v1:green:wan",
++		.gpio		=  ARCHER_C25_74HC_GPIO_LED_WAN_GREEN,
++		.active_low	= 1,
++	}, {
++		.name		= "archer-c25-v1:amber:wan",
++		.gpio		=  ARCHER_C25_74HC_GPIO_LED_WAN_AMBER,
++		.active_low	= 1,
++	},
++};
++
++static struct gpio_keys_button archer_c25_v1_gpio_keys[] __initdata = {
++	{
++		.desc			= "Reset button",
++		.type			= EV_KEY,
++		.code			= KEY_RESTART,
++		.debounce_interval	= ARCHER_C25_V1_KEYS_DEBOUNCE_INTERVAL,
++		.gpio			= ARCHER_C25_V1_GPIO_BTN_RESET,
++		.active_low		= 1,
++	}, {
++		.desc			= "RFKILL button",
++		.type			= EV_KEY,
++		.code			= KEY_RFKILL,
++		.debounce_interval	= ARCHER_C25_V1_KEYS_DEBOUNCE_INTERVAL,
++		.gpio			= ARCHER_C25_V1_GPIO_BTN_RFKILL,
++		.active_low		= 1,
++	},
++};
++
++static void __init archer_c25_v1_setup(void)
++{
++	u8 *mac = (u8 *) KSEG1ADDR(0x1f7e0008);
++	u8 *art = (u8 *) KSEG1ADDR(0x1f7f0000);
++
++	ath79_register_m25p80(NULL);
++
++	spi_register_board_info(archer_c25_v1_spi_info,
++				ARRAY_SIZE(archer_c25_v1_spi_info));
++
++	platform_device_register(&archer_c25_v1_spi_device);
++
++	gpio_request_one(ARCHER_C25_GPIO_SHIFT_OE,
++			 GPIOF_OUT_INIT_LOW | GPIOF_EXPORT_DIR_FIXED,
++			 "LED control");
++
++	gpio_request_one(ARCHER_C25_GPIO_SHIFT_SRCLR,
++			 GPIOF_OUT_INIT_HIGH | GPIOF_EXPORT_DIR_FIXED,
++			 "LED reset");
++
++	ath79_register_leds_gpio(-1, ARRAY_SIZE(archer_c25_v1_leds_gpio),
++				 archer_c25_v1_leds_gpio);
++
++	ath79_register_gpio_keys_polled(-1, ARCHER_C25_V1_KEYS_POLL_INTERVAL,
++					ARRAY_SIZE(archer_c25_v1_gpio_keys),
++					archer_c25_v1_gpio_keys);
++
++	ath79_register_mdio(0, 0x0);
++	ath79_register_mdio(1, 0x0);
++
++	ath79_init_mac(ath79_eth0_data.mac_addr, mac, 0);
++	ath79_init_mac(ath79_eth1_data.mac_addr, mac, 1);
++
++	/* WAN port */
++	ath79_eth0_data.phy_if_mode = PHY_INTERFACE_MODE_MII;
++	ath79_eth0_data.speed = SPEED_100;
++	ath79_eth0_data.duplex = DUPLEX_FULL;
++	ath79_eth0_data.phy_mask = BIT(4);
++	ath79_register_eth(0);
++
++	/* LAN ports */
++	ath79_eth1_data.phy_if_mode = PHY_INTERFACE_MODE_GMII;
++	ath79_eth1_data.speed = SPEED_1000;
++	ath79_eth1_data.duplex = DUPLEX_FULL;
++	ath79_switch_data.phy_poll_mask |= BIT(4);
++	ath79_switch_data.phy4_mii_en = 1;
++	ath79_register_eth(1);
++
++	ath79_register_wmac(art + ARCHER_C25_V1_WMAC_CALDATA_OFFSET, mac);
++	ap91_pci_init(NULL, NULL);
++}
++
++MIPS_MACHINE(ATH79_MACH_ARCHER_C25_V1, "ARCHER-C25-V1", "TP-LINK Archer C25 v1",
++	     archer_c25_v1_setup);
+diff --git a/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h b/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
+index a12685cd11a7a6cefe9b69991a5e41db55ccea85..8864e0deda57b926e88dceebd26056a2f8099380 100644
+--- a/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
++++ b/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
+@@ -40,6 +40,7 @@ enum ath79_mach_type {
+ 	ATH79_MACH_AP152,			/* Atheros AP152 reference board */
+ 	ATH79_MACH_AP90Q,			/* YunCore AP90Q */
+ 	ATH79_MACH_AP96,			/* Atheros AP96 */
++	ATH79_MACH_ARCHER_C25_V1,		/* TP-LINK Archer C25 V1 board */
+ 	ATH79_MACH_ARCHER_C5,			/* TP-LINK Archer C5 board */
+ 	ATH79_MACH_ARCHER_C7,			/* TP-LINK Archer C7 board */
+ 	ATH79_MACH_ARCHER_C7_V2,		/* TP-LINK Archer C7 V2 board */
+diff --git a/target/linux/ar71xx/image/tp-link.mk b/target/linux/ar71xx/image/tp-link.mk
+index 9cd6c6372ac8f7e509a0a2422616097c1c19edf6..6933654e575a1ef2c92e4c656696a479cba4c594 100644
+--- a/target/linux/ar71xx/image/tp-link.mk
++++ b/target/linux/ar71xx/image/tp-link.mk
+@@ -103,6 +103,22 @@ $(Device/tplink)
+   IMAGE_SIZE := 15872k
+ endef
+ 
++define Device/archer-c25-v1
++  DEVICE_TITLE := TP-LINK Archer C25 v1
++  DEVICE_PACKAGES := kmod-ath10k ath10k-firmware-qca9887
++  BOARDNAME := ARCHER-C25-V1
++  TPLINK_BOARD_NAME := ARCHER-C25-V1
++  DEVICE_PROFILE := ARCHERC25V1
++  IMAGE_SIZE := 7808k
++  LOADER_TYPE := elf
++  KERNEL := kernel-bin | patch-cmdline | lzma | uImageArcher lzma
++  IMAGES := sysupgrade.bin factory.bin
++  IMAGE/sysupgrade.bin := append-rootfs | tplink-safeloader sysupgrade
++  IMAGE/factory.bin := append-rootfs | tplink-safeloader factory
++  MTDPARTS := spi0.0:128k(factory-uboot)ro,64k(u-boot)ro,1536k(kernel),6272k(rootfs),128k(config)ro,64k(art)ro,7808k@0x30000(firmware)
++endef
++TARGET_DEVICES += archer-c25-v1
++
+ define Device/cpe510-520
+   DEVICE_TITLE := TP-LINK CPE510/520
+   DEVICE_PACKAGES := rssileds
+diff --git a/target/linux/ar71xx/mikrotik/config-default b/target/linux/ar71xx/mikrotik/config-default
+index f8d255fd87b8c53511b34b42f4117422218219fe..376835a703f91532300d0dd7c8ef66704acc6e05 100644
+--- a/target/linux/ar71xx/mikrotik/config-default
++++ b/target/linux/ar71xx/mikrotik/config-default
+@@ -16,6 +16,7 @@
+ # CONFIG_ATH79_MACH_AP152 is not set
+ # CONFIG_ATH79_MACH_AP90Q is not set
+ # CONFIG_ATH79_MACH_AP96 is not set
++# CONFIG_ATH79_MACH_ARCHER_C25_V1 is not set
+ # CONFIG_ATH79_MACH_ARCHER_C7 is not set
+ # CONFIG_ATH79_MACH_ARDUINO_YUN is not set
+ # CONFIG_ATH79_MACH_AW_NR580 is not set
+diff --git a/target/linux/ar71xx/nand/config-default b/target/linux/ar71xx/nand/config-default
+index c1b5e61c3e9e5f02979584f72621f5e54cde2e36..62be218e33cc6366ea89f363983f36523c419650 100644
+--- a/target/linux/ar71xx/nand/config-default
++++ b/target/linux/ar71xx/nand/config-default
+@@ -9,6 +9,7 @@
+ # CONFIG_ATH79_MACH_AP136 is not set
+ # CONFIG_ATH79_MACH_AP147 is not set
+ # CONFIG_ATH79_MACH_AP96 is not set
++# CONFIG_ATH79_MACH_ARCHER_C25_V1 is not set
+ # CONFIG_ATH79_MACH_ARCHER_C7 is not set
+ # CONFIG_ATH79_MACH_AW_NR580 is not set
+ # CONFIG_ATH79_MACH_CAP324 is not set

patches/lede/0037-firmware-utils-tplink-safeloader-add-TP-Link-Archer-C25-v1.patch

@@ -0,0 +1,102 @@
+From: Ludwig Thomeczek <ledesrc@wxorx.net>
+Date: Sat, 13 May 2017 11:40:48 +0200
+Subject: firmware-utils: tplink-safeloader: add TP-Link Archer C25 v1
+
+This adds the necessary firmware layout definitions for the Archer C25.
+It has an addtional partition containing some static data ("extra-para")
+without which no factory flash is possible, therefore put_data() has been
+added.
+
+Signed-off-by: Ludwig Thomeczek <ledesrc@wxorx.net>
+
+diff --git a/tools/firmware-utils/src/tplink-safeloader.c b/tools/firmware-utils/src/tplink-safeloader.c
+index 4e3d2058b286fb7220e5a8308dcdfb25626a1b59..7617566829e159ae9fec00d5de95919a0fb234c6 100644
+--- a/tools/firmware-utils/src/tplink-safeloader.c
++++ b/tools/firmware-utils/src/tplink-safeloader.c
+@@ -293,6 +293,48 @@ static struct device_info boards[] = {
+ 		.last_sysupgrade_partition = "file-system"
+ 	},
+ 
++	/** Firmware layout for the C25v1 */
++	{
++		.id = "ARCHER-C25-V1",
++		.support_list =
++			"SupportList:\n"
++			"{product_name:ArcherC25,product_ver:1.0.0,special_id:00000000}\n"
++			"{product_name:ArcherC25,product_ver:1.0.0,special_id:55530000}\n"
++			"{product_name:ArcherC25,product_ver:1.0.0,special_id:45550000}\n",
++		.support_trail = '\x00',
++		.soft_ver = "soft_ver:1.0.0\n",
++
++		/**
++		    We use a bigger os-image partition than the stock images (and thus
++		    smaller file-system), as our kernel doesn't fit in the stock firmware's
++		    1MB os-image.
++		*/
++		.partitions = {
++			{"factory-boot", 0x00000, 0x20000},
++			{"fs-uboot", 0x20000, 0x10000},
++			{"os-image", 0x30000, 0x180000},	/* Stock: base 0x30000 size 0x100000 */
++			{"file-system", 0x1b0000, 0x620000},	/* Stock: base 0x130000 size 0x6a0000 */
++			{"user-config", 0x7d0000, 0x04000},
++			{"default-mac", 0x7e0000, 0x00100},
++			{"device-id", 0x7e0100, 0x00100},
++			{"extra-para", 0x7e0200, 0x00100},
++			{"pin", 0x7e0300, 0x00100},
++			{"support-list", 0x7e0400, 0x00400},
++			{"soft-version", 0x7e0800, 0x00400},
++			{"product-info", 0x7e0c00, 0x01400},
++			{"partition-table", 0x7e2000, 0x01000},
++			{"profile", 0x7e3000, 0x01000},
++			{"default-config", 0x7e4000, 0x04000},
++			{"merge-config", 0x7ec000, 0x02000},
++			{"qos-db", 0x7ee000, 0x02000},
++			{"radio", 0x7f0000, 0x10000},
++			{NULL, 0, 0}
++		},
++
++		.first_sysupgrade_partition = "os-image",
++		.last_sysupgrade_partition = "file-system",
++	},
++
+ 	/** Firmware layout for the C5 */
+ 	{
+ 		.id = "ARCHER-C5-V2",
+@@ -615,6 +657,15 @@ static struct image_partition_entry read_file(const char *part_name, const char
+ 	return entry;
+ }
+ 
++/** Creates a new image partition from arbitrary data */
++static struct image_partition_entry put_data(const char *part_name, const char *datain, size_t len) {
++
++	struct image_partition_entry entry = alloc_image_partition(part_name, len);
++
++	memcpy(entry.data, datain, len);
++
++	return entry;
++}
+ 
+ /**
+    Copies a list of image partitions into an image buffer and generates the image partition table while doing so
+@@ -796,7 +847,8 @@ static void build_image(const char *output,
+ 		bool add_jffs2_eof,
+ 		bool sysupgrade,
+ 		const struct device_info *info) {
+-	struct image_partition_entry parts[6] = {};
++
++	struct image_partition_entry parts[7] = {};
+ 
+ 	parts[0] = make_partition_table(info->partitions);
+ 	parts[1] = make_soft_version(rev);
+@@ -804,6 +856,11 @@ static void build_image(const char *output,
+ 	parts[3] = read_file("os-image", kernel_image, false);
+ 	parts[4] = read_file("file-system", rootfs_image, add_jffs2_eof);
+ 
++	if (strcasecmp(info->id, "ARCHER-C25-V1") == 0) {
++		const char mdat[11] = {0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00};
++		parts[5] = put_data("extra-para", mdat, 11);
++	}
++
+ 	size_t len;
+ 	void *image;
+ 	if (sysupgrade)

patches/lede/0038-firmware-utils-tplink-safeloader-support-strings-as-soft_version.patch

@@ -0,0 +1,152 @@
+From: Jan Niehusmann <jan@gondor.com>
+Date: Fri, 19 May 2017 09:42:24 +0200
+Subject: firmware-utils: tplink-safeloader: support strings as soft_version
+
+Some TP-Link routers (C25, C59, C60) contain a version string instead
+of a binary structure in the soft_version partition.
+
+Flashing LEDE from the original firmware's GUI, this version string
+taken from the soft_ver partition of the firmware image is written to
+the router's config partition.
+
+When using tftp recovery to go back to the original Archer C25 firmware,
+a version check compares that version to the version of the firmware to
+be flashed.
+
+Without proper contents in the config partition, reverting to the
+original firmware fails.
+
+Therefore, write the string "soft_ver:1.0.0\n" to that soft_ver
+partition.
+
+Signed-off-by: Jan Niehusmann <jan@gondor.com>
+
+diff --git a/tools/firmware-utils/src/tplink-safeloader.c b/tools/firmware-utils/src/tplink-safeloader.c
+index 7617566829e159ae9fec00d5de95919a0fb234c6..24684268b1a3fe491c4eb876a5ebefc700f2e56e 100644
+--- a/tools/firmware-utils/src/tplink-safeloader.c
++++ b/tools/firmware-utils/src/tplink-safeloader.c
+@@ -75,6 +75,7 @@ struct device_info {
+ 	const char *vendor;
+ 	const char *support_list;
+ 	char support_trail;
++	const char *soft_ver;
+ 	const struct flash_partition_entry partitions[MAX_PARTITIONS+1];
+ 	const char *first_sysupgrade_partition;
+ 	const char *last_sysupgrade_partition;
+@@ -130,6 +131,7 @@ static struct device_info boards[] = {
+ 			"CPE220(TP-LINK|US|N300-2):1.1\r\n"
+ 			"CPE220(TP-LINK|EU|N300-2):1.1\r\n",
+ 		.support_trail = '\xff',
++		.soft_ver = NULL,
+ 
+ 		.partitions = {
+ 			{"fs-uboot", 0x00000, 0x20000},
+@@ -167,6 +169,7 @@ static struct device_info boards[] = {
+ 			"CPE520(TP-LINK|US|N300-5):1.1\r\n"
+ 			"CPE520(TP-LINK|EU|N300-5):1.1\r\n",
+ 		.support_trail = '\xff',
++		.soft_ver = NULL,
+ 
+ 		.partitions = {
+ 			{"fs-uboot", 0x00000, 0x20000},
+@@ -198,6 +201,7 @@ static struct device_info boards[] = {
+ 			"WBS210(TP-LINK|US|N300-2):1.20\r\n"
+ 			"WBS210(TP-LINK|EU|N300-2):1.20\r\n",
+ 		.support_trail = '\xff',
++		.soft_ver = NULL,
+ 
+ 		.partitions = {
+ 			{"fs-uboot", 0x00000, 0x20000},
+@@ -229,6 +233,7 @@ static struct device_info boards[] = {
+ 			"WBS510(TP-LINK|US|N300-5):1.20\r\n"
+ 			"WBS510(TP-LINK|EU|N300-5):1.20\r\n",
+ 		.support_trail = '\xff',
++		.soft_ver = NULL,
+ 
+ 		.partitions = {
+ 			{"fs-uboot", 0x00000, 0x20000},
+@@ -259,6 +264,7 @@ static struct device_info boards[] = {
+ 			"SupportList:\r\n"
+ 			"{product_name:Archer C2600,product_ver:1.0.0,special_id:00000000}\r\n",
+ 		.support_trail = '\x00',
++		.soft_ver = NULL,
+ 
+ 		.partitions = {
+ 			{"SBL1", 0x00000, 0x20000},
+@@ -345,6 +351,7 @@ static struct device_info boards[] = {
+ 			"product_ver:2.0.0,"
+ 			"special_id:00000000}\r\n",
+ 		.support_trail = '\x00',
++		.soft_ver = NULL,
+ 
+ 		.partitions = {
+ 			{"fs-uboot", 0x00000, 0x40000},
+@@ -379,6 +386,7 @@ static struct device_info boards[] = {
+ 			"product_ver:1.0.0,"
+ 			"special_id:00000000}\n",
+ 		.support_trail = '\x00',
++		.soft_ver = NULL,
+ 
+ 		.partitions = {
+ 			{"fs-uboot", 0x00000, 0x40000},
+@@ -411,6 +419,7 @@ static struct device_info boards[] = {
+ 			"SupportList:\r\n"
+ 			"EAP120(TP-LINK|UN|N300-2):1.0\r\n",
+ 		.support_trail = '\xff',
++		.soft_ver = NULL,
+ 
+ 		.partitions = {
+ 			{"fs-uboot", 0x00000, 0x20000},
+@@ -440,6 +449,7 @@ static struct device_info boards[] = {
+ 			"SupportList:\n"
+ 			"{product_name:TL-WR1043ND,product_ver:4.0.0,special_id:45550000}\n",
+ 		.support_trail = '\x00',
++		.soft_ver = NULL,
+ 
+ 		/**
+ 		    We use a bigger os-image partition than the stock images (and thus
+@@ -483,6 +493,7 @@ static struct device_info boards[] = {
+ 			"{product_name:RE450,product_ver:1.0.0,special_id:4B520000}\r\n"
+ 			"{product_name:RE450,product_ver:1.0.0,special_id:55534100}\r\n",
+ 		.support_trail = '\x00',
++		.soft_ver = NULL,
+ 
+ 		/**
+ 		   The flash partition table for RE450;
+@@ -611,6 +622,23 @@ static struct image_partition_entry make_soft_version(uint32_t rev) {
+ 	return entry;
+ }
+ 
++static struct image_partition_entry make_soft_version_from_string(const char *soft_ver) {
++	/** String length _including_ the terminating zero byte */
++	uint32_t ver_len = strlen(soft_ver) + 1;
++	/** Partition contains 64 bit header, the version string, and one additional null byte */
++	size_t partition_len = 2*sizeof(uint32_t) + ver_len + 1;
++	struct image_partition_entry entry = alloc_image_partition("soft-version", partition_len);
++
++	uint32_t *len = (uint32_t *)entry.data;
++	len[0] = htonl(ver_len);
++	len[1] = 0;
++	memcpy(&len[2], soft_ver, ver_len);
++
++	entry.data[partition_len - 1] = 0;
++
++	return entry;
++}
++
+ /** Generates the support-list partition */
+ static struct image_partition_entry make_support_list(const struct device_info *info) {
+ 	size_t len = strlen(info->support_list);
+@@ -851,7 +879,11 @@ static void build_image(const char *output,
+ 	struct image_partition_entry parts[7] = {};
+ 
+ 	parts[0] = make_partition_table(info->partitions);
+-	parts[1] = make_soft_version(rev);
++	if (info->soft_ver)
++		parts[1] = make_soft_version_from_string(info->soft_ver);
++	else
++		parts[1] = make_soft_version(rev);
++
+ 	parts[2] = make_support_list(info);
+ 	parts[3] = read_file("os-image", kernel_image, false);
+ 	parts[4] = read_file("file-system", rootfs_image, add_jffs2_eof);

patches/lede/0039-add-CONFIG_GPIO_74X164-and-CONFIG_SPI_GPIO-for-Archer-C25.patch

@@ -0,0 +1,30 @@
+From: Andreas Ziegler <github@andreas-ziegler.de>
+Date: Thu, 3 Aug 2017 03:34:19 +0200
+Subject: add CONFIG_GPIO_74X164 and CONFIG_SPI_GPIO for Archer C25
+
+backport from e39dc8d823c86559eedbbdcee5f5c14b827fed0f
+introduced for Archer C59/C60
+
+Based-on-patch-by: Henryk Heisig <hyniu@o2.pl>
+Signed-off-by: Andreas Ziegler <github@andreas-ziegler.de>
+
+diff --git a/target/linux/ar71xx/config-4.4 b/target/linux/ar71xx/config-4.4
+index e10401d42ae06506f82f2f5538fbc7df79fd4c65..c82fcf09228be7063967f2517e0942651234afb8 100644
+--- a/target/linux/ar71xx/config-4.4
++++ b/target/linux/ar71xx/config-4.4
+@@ -272,6 +272,7 @@ CONFIG_GENERIC_TIME_VSYSCALL=y
+ CONFIG_GPIOLIB=y
+ CONFIG_GPIOLIB_IRQCHIP=y
+ CONFIG_GPIO_DEVRES=y
++CONFIG_GPIO_74X164=y
+ # CONFIG_GPIO_LATCH is not set
+ CONFIG_GPIO_NXP_74HC153=y
+ CONFIG_GPIO_PCF857X=y
+@@ -429,6 +430,7 @@ CONFIG_SOC_QCA956X=y
+ CONFIG_SPI=y
+ CONFIG_SPI_ATH79=y
+ CONFIG_SPI_BITBANG=y
++CONFIG_SPI_GPIO=y
+ CONFIG_SPI_MASTER=y
+ # CONFIG_SPI_RB4XX is not set
+ # CONFIG_SPI_VSC7385 is not set

patches/lede/0040-ramips-use-GPIO_ACTIVE-macros-in-UBNT-ERX.dts.patch

@@ -0,0 +1,35 @@
+From: Sven Roederer <devel-sven@geroedel.de>
+Date: Fri, 5 May 2017 22:18:44 +0200
+Subject: ramips: use GPIO_ACTIVE macros in UBNT-ERX.dts
+
+- reorder includes
+- use GPIO_ACTIVE_LOW macro instead of hardcoded "1"
+
+Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
+
+diff --git a/target/linux/ramips/dts/UBNT-ERX.dts b/target/linux/ramips/dts/UBNT-ERX.dts
+index 0b2da95b30f0e181e1929502b8ef1aa50a684f69..cf86bbb7e67b1c521c279367ee9e99fee88fae85 100644
+--- a/target/linux/ramips/dts/UBNT-ERX.dts
++++ b/target/linux/ramips/dts/UBNT-ERX.dts
+@@ -1,9 +1,10 @@
+-#include <dt-bindings/input/input.h>
+-
+ /dts-v1/;
+ 
+ #include "mt7621.dtsi"
+ 
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/input.h>
++
+ / {
+ 	model = "UBNT-ERX";
+ 
+@@ -24,7 +25,7 @@
+ 
+ 		reset {
+ 			label = "reset";
+-			gpios = <&gpio0 12 1>;
++			gpios = <&gpio0 12 GPIO_ACTIVE_LOW>;
+ 			linux,code = <KEY_RESTART>;
+ 		};
+ 	};

patches/lede/0041-ramips-add-support-for-Ubiquiti-EdgeRouter-X-SFP.patch

@@ -0,0 +1,413 @@
+From: Sven Roederer <devel-sven@geroedel.de>
+Date: Mon, 29 May 2017 11:24:49 +0200
+Subject: ramips: add support for Ubiquiti EdgeRouter X-SFP
+
+This patch adds support for the Ubiquiti EdgeRouter X-SFP and
+improves support for the EdgeRouter X (PoE-passthrough).
+
+Specification:
+- SoC: MediaTek MT7621AT
+- Flash: 256 MiB
+- RAM: 265 MiB
+- Ethernet: 5 x LAN (1000 Mbps)
+- UART: 1 x UART on PCB (3.3V, RX, TX, GND) - 57600 8N1
+- EdgeRouter X:
+  - 1 x PoE-Passtrough (Eth4)
+  - powered by Wallwart or passive PoE
+- EdgeRouter X-SFP:
+  - 5 x PoE-Out (24V, passive)
+  - 1 x SFP (unknown status)
+  - powered by Wallwart (24V)
+
+Doesn't work:
+* SoC has crypto engine but no open driver.
+* SoC has nat acceleration, but no open driver.
+* This router has 2MB spi flash soldered in but MT
+  nand/spi drivers do not support pin sharing,
+  so it is not accessable and disabled. Stock
+  firmware could read it and it was empty.
+
+Installation
+
+via vendor firmware:
+- build an Initrd-image (> 3MiB) and upload the factory-image
+- initrd can have luci-mod-failsafe
+- flash final firmware via LuCI / sysupgrade on rebooted system
+
+via TFTP:
+- stop uboot into tftp-load into option "1"
+- upload factory.bin image
+
+Signed-off-by: Sven Roederer <devel-sven@geroedel.de>
+
+diff --git a/target/linux/ramips/base-files/etc/board.d/02_network b/target/linux/ramips/base-files/etc/board.d/02_network
+index 17d25b1954e69d6d2a02ad94885cb54486fc904c..5a4042339c6761703578e014612062ac78babd9d 100755
+--- a/target/linux/ramips/base-files/etc/board.d/02_network
++++ b/target/linux/ramips/base-files/etc/board.d/02_network
+@@ -145,6 +145,7 @@ ramips_setup_interfaces()
+ 	rb750gr3|\
+ 	rt-n14u|\
+ 	ubnt-erx|\
++	ubnt-erx-sfp|\
+ 	ur-326n4g|\
+ 	wrtnode|\
+ 	wrtnode2p | \
+diff --git a/target/linux/ramips/base-files/etc/board.d/03_gpio_switches b/target/linux/ramips/base-files/etc/board.d/03_gpio_switches
+new file mode 100755
+index 0000000000000000000000000000000000000000..859dfb31f51244e69d3dce5fc80b329cb57729f3
+--- /dev/null
++++ b/target/linux/ramips/base-files/etc/board.d/03_gpio_switches
+@@ -0,0 +1,25 @@
++#!/bin/sh
++
++. /lib/functions/uci-defaults.sh
++. /lib/ramips.sh
++
++board_config_update
++
++board=$(ramips_board_name)
++
++case "$board" in
++ubnt-erx)
++	ucidef_add_gpio_switch "poe_passthrough" "PoE Passthrough" "0"
++	;;
++ubnt-erx-sfp)
++	ucidef_add_gpio_switch "poe_power_port0" "PoE Power Port0" "496"
++	ucidef_add_gpio_switch "poe_power_port1" "PoE Power Port1" "497"
++	ucidef_add_gpio_switch "poe_power_port2" "PoE Power Port2" "498"
++	ucidef_add_gpio_switch "poe_power_port3" "PoE Power Port3" "499"
++	ucidef_add_gpio_switch "poe_power_port4" "PoE Power Port4" "500"
++	;;
++esac
++
++board_config_flush
++
++exit 0
+diff --git a/target/linux/ramips/base-files/lib/ramips.sh b/target/linux/ramips/base-files/lib/ramips.sh
+index 17ada648931f16d3e85630dd341defb89ba50d6f..b1091f66b2897a19bd01d4a26a1b3647656fa62b 100755
+--- a/target/linux/ramips/base-files/lib/ramips.sh
++++ b/target/linux/ramips/base-files/lib/ramips.sh
+@@ -466,6 +466,9 @@ ramips_board_detect() {
+ 	*"UBNT-ERX")
+ 		name="ubnt-erx"
+ 		;;
++	*"UBNT-ERX-SFP")
++		name="ubnt-erx-sfp"
++		;;
+ 	*"UR-326N4G")
+ 		name="ur-326n4g"
+ 		;;
+diff --git a/target/linux/ramips/base-files/lib/upgrade/platform.sh b/target/linux/ramips/base-files/lib/upgrade/platform.sh
+index a5cca2080d3b96cef92286b1b15f4f8832d9f8c5..d3efc2dd37ed855a1c0e966e448b67ae73324d5f 100755
+--- a/target/linux/ramips/base-files/lib/upgrade/platform.sh
++++ b/target/linux/ramips/base-files/lib/upgrade/platform.sh
+@@ -234,7 +234,8 @@ platform_check_image() {
+ 		}
+ 		return 0
+ 		;;
+-	ubnt-erx)
++	ubnt-erx|\
++	ubnt-erx-sfp)
+ 		nand_do_platform_check "$board" "$1"
+ 		return $?;
+ 		;;
+@@ -248,7 +249,8 @@ platform_nand_pre_upgrade() {
+ 	local board=$(ramips_board_name)
+ 
+ 	case "$board" in
+-	ubnt-erx)
++	ubnt-erx|\
++	ubnt-erx-sfp)
+ 		platform_upgrade_ubnt_erx "$ARGV"
+ 		;;
+ 	esac
+@@ -258,7 +260,8 @@ platform_do_upgrade() {
+ 	local board=$(ramips_board_name)
+ 
+ 	case "$board" in
+-    	ubnt-erx)
++	ubnt-erx|\
++	ubnt-erx-sfp)
+ 		nand_do_upgrade "$ARGV"
+ 		;;
+ 	*)
+diff --git a/target/linux/ramips/dts/UBNT-ER-e50.dtsi b/target/linux/ramips/dts/UBNT-ER-e50.dtsi
+new file mode 100644
+index 0000000000000000000000000000000000000000..b38c7194942db9f0a713fd8f707b53820d07c78e
+--- /dev/null
++++ b/target/linux/ramips/dts/UBNT-ER-e50.dtsi
+@@ -0,0 +1,106 @@
++#include "mt7621.dtsi"
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/input.h>
++
++/ {
++	compatible = "ubiquiti,edgerouterx";
++
++	memory@0 {
++		device_type = "memory";
++		reg = <0x0 0x10000000>;
++	};
++
++	chosen {
++		bootargs = "console=ttyS0,57600";
++	};
++
++	gpio-keys-polled {
++		compatible = "gpio-keys-polled";
++		#address-cells = <1>;
++		#size-cells = <0>;
++		poll-interval = <20>;
++
++		reset {
++			label = "reset";
++			gpios = <&gpio0 12 GPIO_ACTIVE_LOW>;
++			linux,code = <KEY_RESTART>;
++		};
++	};
++};
++
++&ethernet {
++	mtd-mac-address = <&factory 0x22>;
++};
++
++&nand {
++	status = "okay";
++
++	partition@0 {
++		label = "u-boot";
++		reg = <0x0 0x80000>;
++		read-only;
++	};
++
++	partition@80000 {
++		label = "u-boot-env";
++		reg = <0x80000 0x60000>;
++		read-only;
++	};
++
++	factory: partition@e0000 {
++		label = "factory";
++		reg = <0xe0000 0x60000>;
++	};
++
++	partition@140000 {
++		label = "kernel1";
++		reg = <0x140000 0x300000>;
++	};
++
++	partition@440000 {
++		label = "kernel2";
++		reg = <0x440000 0x300000>;
++	};
++
++	partition@740000 {
++		label = "ubi";
++		reg = <0x740000 0xf7c0000>;
++	};
++};
++
++&pinctrl {
++	state_default: pinctrl0 {
++		gpio {
++			ralink,group = "uart2", "uart3", "i2c", "pcie", "rgmii2", "jtag";
++			ralink,function = "gpio";
++		};
++	};
++};
++
++&spi0 {
++	/* This board has 2Mb spi flash soldered in and visible
++	   from manufacturer's firmware.
++	   But this SoC shares spi and nand pins,
++	   and current driver does't handle this sharing well */
++	status = "disabled";
++
++	m25p80@0 {
++		#address-cells = <1>;
++		#size-cells = <1>;
++		compatible = "jedec,spi-nor";
++		reg = <1>;
++		spi-max-frequency = <10000000>;
++		m25p,chunked-io = <32>;
++
++		partition@0 {
++			label = "spi";
++			reg = <0x0 0x200000>;
++			read-only;
++		};
++	};
++};
++
++&xhci {
++	status = "disabled";
++};
+diff --git a/target/linux/ramips/dts/UBNT-ERX-SFP.dts b/target/linux/ramips/dts/UBNT-ERX-SFP.dts
+new file mode 100644
+index 0000000000000000000000000000000000000000..ca26d817211e5a5a20a7da926cd2aee726875780
+--- /dev/null
++++ b/target/linux/ramips/dts/UBNT-ERX-SFP.dts
+@@ -0,0 +1,24 @@
++/dts-v1/;
++
++#include "UBNT-ER-e50.dtsi"
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	model = "UBNT-ERX-SFP";
++	compatible = "ubiquiti,edgerouterx-sfp";
++
++	i2c-gpio {
++		compatible = "i2c-gpio";
++		gpios = <&gpio0 3 GPIO_ACTIVE_HIGH /* sda */
++		         &gpio0 4 GPIO_ACTIVE_HIGH /* scl */
++		        >;
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		pca9555@25 {
++			compatible = "pca9555";
++			reg = <0x25>;
++		};
++	};
++};
+diff --git a/target/linux/ramips/dts/UBNT-ERX.dts b/target/linux/ramips/dts/UBNT-ERX.dts
+index cf86bbb7e67b1c521c279367ee9e99fee88fae85..556d1156c352f76a94c6e39bc3b58c88f08815be 100644
+--- a/target/linux/ramips/dts/UBNT-ERX.dts
++++ b/target/linux/ramips/dts/UBNT-ERX.dts
+@@ -1,108 +1,7 @@
+ /dts-v1/;
+ 
+-#include "mt7621.dtsi"
+-
+-#include <dt-bindings/gpio/gpio.h>
+-#include <dt-bindings/input/input.h>
++#include "UBNT-ER-e50.dtsi"
+ 
+ / {
+ 	model = "UBNT-ERX";
+-
+-	memory@0 {
+-		device_type = "memory";
+-		reg = <0x0 0x10000000>;
+-	};
+-
+-	chosen {
+-		bootargs = "console=ttyS0,57600";
+-	};
+-
+-	gpio-keys-polled {
+-		compatible = "gpio-keys-polled";
+-		#address-cells = <1>;
+-		#size-cells = <0>;
+-		poll-interval = <20>;
+-
+-		reset {
+-			label = "reset";
+-			gpios = <&gpio0 12 GPIO_ACTIVE_LOW>;
+-			linux,code = <KEY_RESTART>;
+-		};
+-	};
+-};
+-
+-&ethernet {
+-	mtd-mac-address = <&factory 0x22>;
+-};
+-
+-&nand {
+-	status = "okay";
+-
+-	partition@0 {
+-		label = "u-boot";
+-		reg = <0x0 0x80000>;
+-		read-only;
+-	};
+-
+-	partition@80000 {
+-		label = "u-boot-env";
+-		reg = <0x80000 0x60000>;
+-		read-only;
+-	};
+-
+-	factory: partition@e0000 {
+-		label = "factory";
+-		reg = <0xe0000 0x60000>;
+-	};
+-
+-	partition@140000 {
+-		label = "kernel1";
+-		reg = <0x140000 0x300000>;
+-	};
+-
+-	partition@440000 {
+-		label = "kernel2";
+-		reg = <0x440000 0x300000>;
+-	};
+-
+-	partition@740000 {
+-		label = "ubi";
+-		reg = <0x740000 0xf7c0000>;
+-	};
+-};
+-
+-&pinctrl {
+-	state_default: pinctrl0 {
+-		gpio {
+-			ralink,group = "uart2", "uart3", "i2c", "pcie", "rgmii2", "jtag";
+-			ralink,function = "gpio";
+-		};
+-	};
+-};
+-
+-&spi0 {
+-	/* This board has 2Mb spi flash soldered in and visible
+-	   from manufacturer's firmware.
+-	   But this SoC shares spi and nand pins,
+-	   and current driver does't handle this sharing well */
+-	status = "disabled";
+-
+-	m25p80@0 {
+-		#address-cells = <1>;
+-		#size-cells = <1>;
+-		compatible = "jedec,spi-nor";
+-		reg = <1>;
+-		spi-max-frequency = <10000000>;
+-		m25p,chunked-io = <32>;
+-
+-		partition@0 {
+-			label = "spi";
+-			reg = <0x0 0x200000>;
+-			read-only;
+-		};
+-	};
+-};
+-
+-&xhci {
+-	status = "disabled";
+ };
+diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
+index 15ea9a13b6310b1454b5b3b92cd8ed30ee6255b3..8218bea84410536151a216cd2cc0300369ad977a 100644
+--- a/target/linux/ramips/image/mt7621.mk
++++ b/target/linux/ramips/image/mt7621.mk
+@@ -144,6 +144,19 @@ define Device/ubnt-erx
+ endef
+ TARGET_DEVICES += ubnt-erx
+ 
++define Device/ubnt-erx-sfp
++  DTS := UBNT-ERX-SFP
++  FILESYSTEMS := squashfs
++  KERNEL_SIZE := 3145728
++  KERNEL := $(KERNEL_DTB) | uImage lzma
++  IMAGES := sysupgrade.tar
++  KERNEL_INITRAMFS := $$(KERNEL) | ubnt-erx-factory-image $(KDIR)/tmp/$$(KERNEL_INITRAMFS_PREFIX)-factory.tar
++  IMAGE/sysupgrade.tar := sysupgrade-tar | append-metadata
++  DEVICE_TITLE := Ubiquiti EdgeRouter X-SFP
++  DEVICE_PACKAGES := -kmod-mt76 -kmod-rt2x00-lib -kmod-mac80211 -kmod-cfg80211 -wpad-mini -iwinfo kmod-i2c-algo-pca kmod-gpio-pca953x kmod-i2c-gpio-custom
++endef
++TARGET_DEVICES += ubnt-erx-sfp
++
+ define Device/vr500
+   DTS := VR500
+   IMAGE_SIZE := 66453504

patches/lede/0042-ar71xx-add-support-for-TP-Link-TL-WR1043N-v5.patch

@@ -0,0 +1,367 @@
+From: Tim Thorpe <tim@tfthorpe.net>
+Date: Mon, 25 Sep 2017 04:38:49 -0500
+Subject: ar71xx: add support for TP-Link TL-WR1043N v5
+
+TP-Link TL-WR1043N v5 appears to be identical to the TL-WR1043ND v4,
+except that the USB port has been removed and there is no longer a
+removable antenna option.
+
+The software is more in line with the Archer series in that it uses a
+nested bootloader scheme.
+
+Specifications:
+
+ - QCA9563 at 775 MHz
+ - 64 MB RAM
+ - 16 MB flash
+ - 3 (non-detachable) Antennas / 450 Mbit
+ - 1x/4x WAN/LAN Gbps Ethernet (QCA8337)
+ - reset and Wi-Fi buttons
+
+Signed-off-by: Tim Thorpe <tim@tfthorpe.net>
+Signed-off-by: Ludwig Thomeczek <ledesrc@wxorx.net>
+
+diff --git a/target/linux/ar71xx/base-files/etc/board.d/01_leds b/target/linux/ar71xx/base-files/etc/board.d/01_leds
+index e1efb561b33da4dcfcb82ee953cd888170476dfb..e67b5e38561e841b88e486341950c52e1d454322 100755
+--- a/target/linux/ar71xx/base-files/etc/board.d/01_leds
++++ b/target/linux/ar71xx/base-files/etc/board.d/01_leds
+@@ -666,14 +666,20 @@ tl-wr1043nd-v2)
+ 	ucidef_set_led_usbdev "usb" "USB" "tp-link:green:usb" "1-1"
+ 	ucidef_set_led_wlan "wlan" "WLAN" "tp-link:green:wlan" "phy0tpt"
+ 	;;
++tl-wr1043n-v5|\
+ tl-wr1043nd-v4)
+-	ucidef_set_led_usbdev "usb" "USB" "tp-link:green:usb" "1-1"
+ 	ucidef_set_led_wlan "wlan" "WLAN" "tp-link:green:wlan" "phy0tpt"
+ 	ucidef_set_led_switch "wan" "WAN" "tp-link:green:wan" "switch0" "0x20"
+ 	ucidef_set_led_switch "lan1" "LAN1" "tp-link:green:lan1" "switch0" "0x10"
+ 	ucidef_set_led_switch "lan2" "LAN2" "tp-link:green:lan2" "switch0" "0x08"
+ 	ucidef_set_led_switch "lan3" "LAN3" "tp-link:green:lan3" "switch0" "0x04"
+ 	ucidef_set_led_switch "lan4" "LAN4" "tp-link:green:lan4" "switch0" "0x02"
++
++	case "$board" in
++	tl-wr1043nd-v4)
++		ucidef_set_led_usbdev "usb" "USB" "tp-link:green:usb" "1-1"
++		;;
++	esac
+ 	;;
+ tl-wr2543n)
+ 	ucidef_set_led_usbdev "usb" "USB" "tp-link:green:usb" "1-1"
+diff --git a/target/linux/ar71xx/base-files/etc/board.d/02_network b/target/linux/ar71xx/base-files/etc/board.d/02_network
+index cefb7413eac6ffc50e67f1eaf63def749314428b..454abe6a5005621967dd96e0282e7bce2a0b127e 100755
+--- a/target/linux/ar71xx/base-files/etc/board.d/02_network
++++ b/target/linux/ar71xx/base-files/etc/board.d/02_network
+@@ -243,7 +243,8 @@ ar71xx_setup_interfaces()
+ 	mynet-n750|\
+ 	sr3200|\
+ 	wndr3700v4|\
+-	wndr4300)
++	wndr4300|\
++	tl-wr1043n-v5)
+ 		ucidef_add_switch "switch0" \
+ 			"0@eth0" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan"
+ 		;;
+@@ -487,6 +488,7 @@ ar71xx_setup_macs()
+ 		lan_mac=$(mtd_get_mac_binary caldata 0)
+ 		wan_mac=$(mtd_get_mac_binary caldata 6)
+ 		;;
++	tl-wr1043n-v5|\
+ 	tl-wr1043nd-v4)
+ 		lan_mac=$(mtd_get_mac_binary product-info 8)
+ 		wan_mac=$(macaddr_add "$lan_mac" 1)
+diff --git a/target/linux/ar71xx/base-files/etc/diag.sh b/target/linux/ar71xx/base-files/etc/diag.sh
+index 38cc5d7853c79f2a7800a387310a95abb3b4de1b..61db387c9ecefd7090c25a5f5d75fdbf65a44d65 100644
+--- a/target/linux/ar71xx/base-files/etc/diag.sh
++++ b/target/linux/ar71xx/base-files/etc/diag.sh
+@@ -359,6 +359,7 @@ get_status_led() {
+ 	tl-wdr3320-v2|\
+ 	tl-wdr3500|\
+ 	tl-wr1041n-v2|\
++	tl-wr1043n-v5|\
+ 	tl-wr1043nd|\
+ 	tl-wr1043nd-v2|\
+ 	tl-wr1043nd-v4|\
+diff --git a/target/linux/ar71xx/base-files/lib/ar71xx.sh b/target/linux/ar71xx/base-files/lib/ar71xx.sh
+index fc7d862c2911e96f76622cbed23e99863814da63..8f8158bac8a28db4f4f15ce5c37f48a21084dc03 100755
+--- a/target/linux/ar71xx/base-files/lib/ar71xx.sh
++++ b/target/linux/ar71xx/base-files/lib/ar71xx.sh
+@@ -947,6 +947,9 @@ ar71xx_board_detect() {
+ 	*"TL-WR1043ND v4")
+ 		name="tl-wr1043nd-v4"
+ 		;;
++	*"TL-WR1043N v5")
++		name="tl-wr1043n-v5"
++		;;
+ 	*TL-WR2543N*)
+ 		name="tl-wr2543n"
+ 		;;
+diff --git a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
+index 6258713dd0e3325ab109689f0ed3b51e27c41f89..774e3c8964ef724d1efbae56434aeaa9f1c298a4 100755
+--- a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
++++ b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
+@@ -269,6 +269,7 @@ platform_check_image() {
+ 	tew-712br|\
+ 	tew-732br|\
+ 	tew-823dru|\
++	tl-wr1043n-v5|\
+ 	unifi-outdoor|\
+ 	unifiac-lite|\
+ 	unifiac-pro|\
+diff --git a/target/linux/ar71xx/config-4.4 b/target/linux/ar71xx/config-4.4
+index c82fcf09228be7063967f2517e0942651234afb8..57b6d2e541d7ef9dea8570ba8de72164d97b9775 100644
+--- a/target/linux/ar71xx/config-4.4
++++ b/target/linux/ar71xx/config-4.4
+@@ -181,6 +181,7 @@ CONFIG_ATH79_MACH_TL_WR1041N_V2=y
+ CONFIG_ATH79_MACH_TL_WR1043ND=y
+ CONFIG_ATH79_MACH_TL_WR1043ND_V2=y
+ CONFIG_ATH79_MACH_TL_WR1043ND_V4=y
++CONFIG_ATH79_MACH_TL_WR1043N_V5=y
+ CONFIG_ATH79_MACH_TL_WR2543N=y
+ CONFIG_ATH79_MACH_TL_WR703N=y
+ CONFIG_ATH79_MACH_TL_WR720N_V3=y
+diff --git a/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt b/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
+index fb2afb965c4641df7cdcaf0920f2d56b3717fa9b..7ad5419f51ec9909d8b59f33178221a7d81ec184 100644
+--- a/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
++++ b/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
+@@ -1564,6 +1564,15 @@ config ATH79_MACH_TL_WR1041N_V2
+ 	select ATH79_DEV_USB
+ 	select ATH79_DEV_WMAC
+ 
++config ATH79_MACH_TL_WR1043N_V5
++	bool "TP-LINK TL-WR1043N v5 support"
++	select SOC_QCA956X
++	select ATH79_DEV_ETH
++	select ATH79_DEV_GPIO_BUTTONS
++	select ATH79_DEV_LEDS_GPIO
++	select ATH79_DEV_M25P80
++	select ATH79_DEV_WMAC
++
+ config ATH79_MACH_TL_WR1043ND
+ 	bool "TP-LINK TL-WR1043ND support"
+ 	select SOC_AR913X
+diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr1043nd-v4.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr1043nd-v4.c
+index b1539c5d71a61806b88c50f1a78f6a27d98d7a2d..450819a9e6baa997dab2dfba4c5a19261aae9664 100644
+--- a/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr1043nd-v4.c
++++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-tl-wr1043nd-v4.c
+@@ -5,6 +5,7 @@
+  *  Copyright (C) 2016 Matthias Schiffer <mschiffer@universe-factory.net>
+  *  Copyright (C) 2016 Andreas Ziegler <github@andreas-ziegler.de>
+  *  Copyright (C) 2016 Ludwig Thomeczek <ledesrc@wxorx.net>
++ *  Copyright (C) 2017 Tim Thorpe <tim@tfthorpe.net>
+  *
+  *  Derived from: mach-dir-869-a1.c
+  *
+@@ -62,6 +63,8 @@
+ #define TL_WR1043_V4_EEPROM_ADDR		0x1fff0000
+ #define TL_WR1043_V4_WMAC_CALDATA_OFFSET	0x1000
+ 
++#define TL_WR1043N_V5_MAC_LOCATION		0x1ff00008
++
+ static struct gpio_led tl_wr1043nd_v4_leds_gpio[] __initdata = {
+ 	{
+ 		.name		= "tp-link:green:wps",
+@@ -188,3 +191,82 @@ static void __init tl_wr1043nd_v4_setup(void)
+ 
+ MIPS_MACHINE(ATH79_MACH_TL_WR1043ND_V4, "TL-WR1043ND-v4",
+ 	     "TP-LINK TL-WR1043ND v4", tl_wr1043nd_v4_setup);
++
++static struct gpio_led tl_wr1043n_v5_leds_gpio[] __initdata = {
++	{
++		.name		= "tp-link:green:wps",
++		.gpio		= TL_WR1043_V4_GPIO_LED_WPS,
++		.active_low	= 1,
++	},
++	{
++		.name		= "tp-link:green:system",
++		.gpio		= TL_WR1043_V4_GPIO_LED_SYSTEM,
++		.active_low	= 1,
++	},
++	{
++		.name		= "tp-link:green:wlan",
++		.gpio		= TL_WR1043_V4_GPIO_LED_WLAN,
++		.active_low	= 1,
++	},
++	{
++		.name		= "tp-link:green:wan",
++		.gpio		= TL_WR1043_V4_GPIO_LED_WAN,
++		.active_low	= 1,
++	},
++	{
++		.name		= "tp-link:green:lan1",
++		.gpio		= TL_WR1043_V4_GPIO_LED_LAN1,
++		.active_low	= 1,
++	},
++	{
++		.name		= "tp-link:green:lan2",
++		.gpio		= TL_WR1043_V4_GPIO_LED_LAN2,
++		.active_low	= 1,
++	},
++	{
++		.name		= "tp-link:green:lan3",
++		.gpio		= TL_WR1043_V4_GPIO_LED_LAN3,
++		.active_low	= 1,
++	},
++	{
++		.name		= "tp-link:green:lan4",
++		.gpio		= TL_WR1043_V4_GPIO_LED_LAN4,
++		.active_low	= 1,
++	},
++};
++
++/* The 1043Nv5 is identical to the 1043NDv4,
++ *  only missing the usb and small firmware layout changes  */
++static void __init tl_wr1043nv5_setup(void)
++{
++	u8 *art = (u8 *) KSEG1ADDR(TL_WR1043_V4_EEPROM_ADDR);
++	u8 *mac = (u8 *) KSEG1ADDR(TL_WR1043N_V5_MAC_LOCATION);
++
++	ath79_register_m25p80(NULL);
++
++	ath79_register_leds_gpio(-1, ARRAY_SIZE(tl_wr1043n_v5_leds_gpio),
++				 tl_wr1043n_v5_leds_gpio);
++	ath79_register_gpio_keys_polled(-1, TL_WR1043_V4_KEYS_POLL_INTERVAL,
++					ARRAY_SIZE(tl_wr1043nd_v4_gpio_keys),
++					tl_wr1043nd_v4_gpio_keys);
++
++	platform_device_register(&ath79_mdio0_device);
++
++	mdiobus_register_board_info(tl_wr1043nd_v4_mdio0_info,
++				    ARRAY_SIZE(tl_wr1043nd_v4_mdio0_info));
++
++	ath79_register_wmac(art + TL_WR1043_V4_WMAC_CALDATA_OFFSET, mac);
++
++	ath79_init_mac(ath79_eth0_data.mac_addr, mac, 0);
++
++	/* GMAC0 is connected to an AR8337 switch */
++	ath79_eth0_data.phy_if_mode = PHY_INTERFACE_MODE_SGMII;
++	ath79_eth0_data.speed = SPEED_1000;
++	ath79_eth0_data.duplex = DUPLEX_FULL;
++	ath79_eth0_data.phy_mask = BIT(0);
++	ath79_eth0_data.mii_bus_dev = &ath79_mdio0_device.dev;
++	ath79_register_eth(0);
++}
++
++MIPS_MACHINE(ATH79_MACH_TL_WR1043N_V5, "TL-WR1043N-v5", "TP-LINK TL-WR1043N v5",
++	     tl_wr1043nv5_setup);
+diff --git a/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h b/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
+index 8864e0deda57b926e88dceebd26056a2f8099380..9cb4a7f2e1df641232289721b676a9b0149c76e5 100644
+--- a/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
++++ b/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
+@@ -214,6 +214,7 @@ enum ath79_mach_type {
+ 	ATH79_MACH_TL_WDR6500_V2,		/* TP-LINK TL-WDR6500 v2 */
+ 	ATH79_MACH_TL_WPA8630,			/* TP-Link TL-WPA8630 */
+ 	ATH79_MACH_TL_WR1041N_V2,		/* TP-LINK TL-WR1041N v2 */
++	ATH79_MACH_TL_WR1043N_V5,		/* TP-LINK TL-WR1043N v5 */
+ 	ATH79_MACH_TL_WR1043ND,			/* TP-LINK TL-WR1043ND */
+ 	ATH79_MACH_TL_WR1043ND_V2,		/* TP-LINK TL-WR1043ND v2 */
+ 	ATH79_MACH_TL_WR1043ND_V4,		/* TP-LINK TL-WR1043ND v4 */
+diff --git a/target/linux/ar71xx/image/tp-link.mk b/target/linux/ar71xx/image/tp-link.mk
+index 6933654e575a1ef2c92e4c656696a479cba4c594..5be7cbfbd4ab7d73d679d52d2581459250e04302 100644
+--- a/target/linux/ar71xx/image/tp-link.mk
++++ b/target/linux/ar71xx/image/tp-link.mk
+@@ -858,7 +858,22 @@ define Device/tl-wr1043nd-v4
+     IMAGE/sysupgrade.bin := append-rootfs | tplink-safeloader sysupgrade
+     IMAGE/factory.bin := append-rootfs | tplink-safeloader factory
+ endef
+-TARGET_DEVICES += tl-wr1043nd-v1 tl-wr1043nd-v2 tl-wr1043nd-v3 tl-wr1043nd-v4
++
++define Device/tl-wr1043n-v5
++  DEVICE_TITLE := TP-LINK TL-WR1043N v5
++  BOARDNAME := TL-WR1043N-v5
++  SUPPORTED_DEVICES := tl-wr1043n-v5
++  DEVICE_PROFILE := TLWR1043
++  MTDPARTS := spi0.0:128k(factory-uboot)ro,128k(u-boot)ro,15104k(firmware),128k(product-info)ro,640k(config)ro,64k(partition-table)ro,128k(logs)ro,64k(art)ro
++  IMAGE_SIZE := 15104k
++  KERNEL := kernel-bin | patch-cmdline | lzma | uImageArcher lzma
++  IMAGES := sysupgrade.bin factory.bin
++  IMAGE/sysupgrade.bin := append-rootfs | tplink-safeloader sysupgrade | \
++	append-metadata | check-size $$$$(IMAGE_SIZE)
++  IMAGE/factory.bin := append-rootfs | tplink-safeloader factory
++  TPLINK_BOARD_NAME := TLWR1043NV5
++endef
++TARGET_DEVICES += tl-wr1043nd-v1 tl-wr1043nd-v2 tl-wr1043nd-v3 tl-wr1043nd-v4 tl-wr1043n-v5
+ 
+ define Device/tl-wr2543-v1
+     $(Device/tplink-8mlzma)
+diff --git a/target/linux/ar71xx/mikrotik/config-default b/target/linux/ar71xx/mikrotik/config-default
+index 376835a703f91532300d0dd7c8ef66704acc6e05..f5af38a726f5ce33391223a4dbeb2fc0a8cac613 100644
+--- a/target/linux/ar71xx/mikrotik/config-default
++++ b/target/linux/ar71xx/mikrotik/config-default
+@@ -143,6 +143,7 @@ CONFIG_ATH79_MACH_RBSXTLITE=y
+ # CONFIG_ATH79_MACH_TL_WDR6500_V2 is not set
+ # CONFIG_ATH79_MACH_TL_WPA8630 is not set
+ # CONFIG_ATH79_MACH_TL_WR1041N_V2 is not set
++# CONFIG_ATH79_MACH_TL_WR1043N_V5 is not set
+ # CONFIG_ATH79_MACH_TL_WR1043ND is not set
+ # CONFIG_ATH79_MACH_TL_WR1043ND_V2 is not set
+ # CONFIG_ATH79_MACH_TL_WR1043ND_V4 is not set
+diff --git a/target/linux/ar71xx/nand/config-default b/target/linux/ar71xx/nand/config-default
+index 62be218e33cc6366ea89f363983f36523c419650..5c18f5d594d625f91ff10e21ddc5af2b3b4d768f 100644
+--- a/target/linux/ar71xx/nand/config-default
++++ b/target/linux/ar71xx/nand/config-default
+@@ -52,6 +52,7 @@
+ # CONFIG_ATH79_MACH_TL_WDR3500 is not set
+ # CONFIG_ATH79_MACH_TL_WDR4300 is not set
+ # CONFIG_ATH79_MACH_TL_WR1041N_V2 is not set
++# CONFIG_ATH79_MACH_TL_WR1043N_V5 is not set
+ # CONFIG_ATH79_MACH_TL_WR1043ND is not set
+ # CONFIG_ATH79_MACH_TL_WR1043ND_V4 is not set
+ # CONFIG_ATH79_MACH_TL_WR2543N is not set
+diff --git a/tools/firmware-utils/src/tplink-safeloader.c b/tools/firmware-utils/src/tplink-safeloader.c
+index 24684268b1a3fe491c4eb876a5ebefc700f2e56e..478d5d8e9b43bbe37694732c138048c8fe8d807c 100644
+--- a/tools/firmware-utils/src/tplink-safeloader.c
++++ b/tools/firmware-utils/src/tplink-safeloader.c
+@@ -478,6 +478,42 @@ static struct device_info boards[] = {
+ 		.last_sysupgrade_partition = "file-system"
+ 	},
+ 
++	/** Firmware layout for the TL-WR1043 v5 */
++	{
++		.id     = "TLWR1043NV5",
++		.vendor = "",
++		.support_list =
++			"SupportList:\n"
++			"{product_name:TL-WR1043N,product_ver:5.0.0,special_id:45550000}\n"
++			"{product_name:TL-WR1043N,product_ver:5.0.0,special_id:55530000}\n",
++		.support_trail = '\x00',
++		.soft_ver = "soft_ver:1.0.0\n",
++		.partitions = {
++			{"factory-boot", 0x00000, 0x20000},
++			{"fs-uboot", 0x20000, 0x20000},
++			{"os-image", 0x40000, 0x180000},
++			{"file-system", 0x1c0000, 0xd40000},
++			{"default-mac", 0xf00000, 0x00200},
++			{"pin", 0xf00200, 0x00200},
++			{"device-id", 0xf00400, 0x00100},
++			{"product-info", 0xf00500, 0x0fb00},
++			{"soft-version", 0xf10000, 0x01000},
++			{"extra-para", 0xf11000, 0x01000},
++			{"support-list", 0xf12000, 0x0a000},
++			{"profile", 0xf1c000, 0x04000},
++			{"default-config", 0xf20000, 0x10000},
++			{"user-config", 0xf30000, 0x40000},
++			{"qos-db", 0xf70000, 0x40000},
++			{"certificate", 0xfb0000, 0x10000},
++			{"partition-table", 0xfc0000, 0x10000},
++			{"log", 0xfd0000, 0x20000},
++			{"radio", 0xff0000, 0x10000},
++			{NULL, 0, 0}
++		},
++		.first_sysupgrade_partition = "os-image",
++		.last_sysupgrade_partition = "file-system"
++	},
++
+ 	/** Firmware layout for the RE450 */
+ 	{
+ 		.id = "RE450",
+@@ -888,7 +924,9 @@ static void build_image(const char *output,
+ 	parts[3] = read_file("os-image", kernel_image, false);
+ 	parts[4] = read_file("file-system", rootfs_image, add_jffs2_eof);
+ 
+-	if (strcasecmp(info->id, "ARCHER-C25-V1") == 0) {
++	/* Some devices need the extra-para partition to accept the firmware */
++	if (strcasecmp(info->id, "ARCHER-C25-V1") == 0 ||
++	    strcasecmp(info->id, "TLWR1043NV5") == 0) {
+ 		const char mdat[11] = {0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00};
+ 		parts[5] = put_data("extra-para", mdat, 11);
+ 	}