Merge commit '859ff7a978aea150588e7e21a1333884ab85739f' into istoreos-24.10

# Conflicts: # package/libs/mbedtls/Makefile # package/libs/openssl/Makefile
2025-10-22 11:23:51 +08:00 · 2025-10-22 11:23:51 +08:00 · 9e81eb178f
commit 9e81eb178f
parent 9e01d2a6a8 859ff7a978
150 changed files with 3804 additions and 1705 deletions
--- a/include/download.mk
+++ b/include/download.mk
@ -232,7 +232,9 @@ define DownloadMethod/rawgit
 	echo "Generating formal git archive (apply .gitattributes rules)" && \
 	(cd $(SUBDIR) && git config core.abbrev 8 && \
 	git archive --format=tar HEAD --output=../$(SUBDIR).tar.git) && \
-	$(if $(filter skip,$(SUBMODULES)),true,$(TAR) --ignore-failed-read -C $(SUBDIR) -f $(SUBDIR).tar.git -r .git .gitmodules 2>/dev/null) && \
+	$(if $(filter skip,$(SUBMODULES)),true, \
+		$(TAR) --numeric-owner --owner=0 --group=0 --ignore-failed-read -C $(SUBDIR) -f $(SUBDIR).tar.git -r .git .gitmodules 2>/dev/null \
+	) && \
 	rm -rf $(SUBDIR) && mkdir $(SUBDIR) && \
 	$(TAR) -C $(SUBDIR) -xf $(SUBDIR).tar.git && \
 	(cd $(SUBDIR) && $(if $(filter skip,$(SUBMODULES)),true,git submodule update --init --recursive -- $(SUBMODULES) && \
--- a/include/kernel-6.6
+++ b/include/kernel-6.6
@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .104
-LINUX_KERNEL_HASH-6.6.104 = 2a772f9d661afabaaddcdfd1116239acb2d943377aceab9e0baed2b7a915e36a
+LINUX_VERSION-6.6 = .110
+LINUX_KERNEL_HASH-6.6.110 = 1bf20daf5543b8759f325e55fb0da4913715e68741627a13380e66aaf219fb1d
--- a/package/base-files/files/sbin/sysupgrade
+++ b/package/base-files/files/sbin/sysupgrade
@ -20,6 +20,7 @@ CONF_IMAGE=
 CONF_BACKUP_LIST=0
 CONF_BACKUP=
 CONF_RESTORE=
+USE_CURR_PART=0
 NEED_IMAGE=
 HELP=0
 TEST=0
@ -50,6 +51,7 @@ while [ -n "$1" ]; do
 		-r|--restore-backup) CONF_RESTORE="$2" NEED_IMAGE=1; shift;;
 		-l|--list-backup) CONF_BACKUP_LIST=1;;
 		-f) CONF_IMAGE="$2"; shift;;
+		-s) USE_CURR_PART=1;;
 		-F|--force) export FORCE=1;;
 		-T|--test) TEST=1;;
 		-h|--help) HELP=1; break;;
@ -79,6 +81,7 @@ upgrade-option:
 	-p           do not attempt to restore the partition table after flash.
 	-k           include in backup a list of current installed packages at
 	             $INSTALLED_PACKAGES
+	-s           stay on current partition (for dual firmware devices)
 	-T | --test
 	             Verify image and config .tar.gz but do not actually flash.
 	-F | --force
@ -416,6 +419,7 @@ else
 	json_add_string command "$COMMAND"
 	json_add_object options
 	json_add_int save_partitions "$SAVE_PARTITIONS"
+	[ $USE_CURR_PART -eq 1 ] && json_add_boolean use_curr_part 1
 	json_close_object

 	ubus call system sysupgrade "$(json_dump)"
--- a/package/boot/uboot-envtools/files/ramips
+++ b/package/boot/uboot-envtools/files/ramips
@ -22,6 +22,7 @@ engenius,esr600h|\
 hongdian,h8922-v30|\
 linksys,re7000|\
 meig,slt866|\
+qding,qc202|\
 sitecom,wlr-4100-v1-002|\
 zyxel,keenetic-lite-iii-a)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x1000" "0x1000"
--- a/package/boot/uboot-mediatek/patches/160-net-phy-add-support-for-Airoha-ethernet-PHY-driver.patch
+++ b/package/boot/uboot-mediatek/patches/160-net-phy-add-support-for-Airoha-ethernet-PHY-driver.patch
--- a/package/boot/uboot-mediatek/patches/442-add-bpi-r3-mini.patch
+++ b/package/boot/uboot-mediatek/patches/442-add-bpi-r3-mini.patch
@ -503,7 +503,7 @@
 +		compatible = "ethernet-phy-id03a2.a411";
 +		reg = <14>;
 +
-+		airoha,rx-pol-reverse;
+		airoha,pnswap-rx;
 +
 +		reset-gpios = <&gpio 49 GPIO_ACTIVE_LOW>;
 +		reset-assert-us = <10000>;
--- a/package/firmware/ipq-wifi/Makefile
+++ b/package/firmware/ipq-wifi/Makefile
@ -6,9 +6,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/firmware/qca-wireless.git
-PKG_SOURCE_DATE:=2025-08-25
-PKG_SOURCE_VERSION:=a510502e7922b0a61e455e43479a62e7d27cf3ba
-PKG_MIRROR_HASH:=0b8120ce09fdd9176e77b65f2c0866e14aa580ba7e6dd9440f37011418346be7
+PKG_SOURCE_DATE:=2025-10-17
+PKG_SOURCE_VERSION:=a1529e183333e38bdc95dc8d9317b7af2bec0dcd
+PKG_MIRROR_HASH:=30ce8f808424602cba556e106cb16080ef29d6d45a9d9018e04664598460eb2f
 PKG_FLAGS:=nonshared

 include $(INCLUDE_DIR)/package.mk
@ -55,7 +55,9 @@ ALLWIFIBOARDS:= \
 	skspruce_wia3300-20 \
 	spectrum_sax1v1k \
 	tplink_eap660hd-v1 \
+	tplink_archer-c59-v1 \
 	tplink_archer-c6-v2 \
+	tplink_archer-c60-v1 \
 	wallys_dr40x9 \
 	xiaomi_aiot-ac2350 \
 	xiaomi_ax3600 \
@ -187,7 +189,9 @@ $(eval $(call generate-ipq-wifi-package,redmi_ax6,Redmi AX6))
 $(eval $(call generate-ipq-wifi-package,skspruce_wia3300-20,SKSpruce WIA3300-20))
 $(eval $(call generate-ipq-wifi-package,spectrum_sax1v1k,Spectrum SAX1V1K))
 $(eval $(call generate-ipq-wifi-package,tplink_eap660hd-v1,TP-Link EAP660 HD v1))
+$(eval $(call generate-ipq-wifi-package,tplink_archer-c59-v1,TP-Link Archer C59 V1))
 $(eval $(call generate-ipq-wifi-package,tplink_archer-c6-v2,TP-Link Archer C6 V2))
+$(eval $(call generate-ipq-wifi-package,tplink_archer-c60-v1,TP-Link Archer C60 V1))
 $(eval $(call generate-ipq-wifi-package,wallys_dr40x9,Wallys DR40X9))
 $(eval $(call generate-ipq-wifi-package,xiaomi_aiot-ac2350,Xiaomi AIoT AC2350))
 $(eval $(call generate-ipq-wifi-package,xiaomi_ax3600,Xiaomi AX3600))
--- a/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c
+++ b/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c
@ -185,7 +185,7 @@ static void *g_xdata_addr = NULL;
 static u32 *mei_arc_swap_buff = NULL;	//  holding swap pages

 extern void ltq_mask_and_ack_irq(struct irq_data *d);
-static void inline MEI_MASK_AND_ACK_IRQ(int x)
+static inline void MEI_MASK_AND_ACK_IRQ(int x)
 {
 	struct irq_data d;
 	d.hwirq = x;
@ -1178,7 +1178,7 @@ DSL_BSP_AdslLedSet (DSL_DEV_Device_t * dev, DSL_DEV_LedId_t led_number, DSL_DEV_
 * \param       CMVMSG          The pointer to message buffer.
 * \ingroup     Internal
 */
-void
+static void
 makeCMV (u8 opcode, u8 group, u16 address, u16 index, int size, u16 * data, u16 *CMVMSG)
 {
        memset (CMVMSG, 0, MSG_LENGTH * 2);
@ -2451,7 +2451,7 @@ IFX_MEI_IoctlCopyTo (int from_kernel, char *dest, char *from, int size)
 	return ret;
 }

-int
+static int
 IFX_MEI_Ioctls (DSL_DEV_Device_t * pDev, int from_kernel, unsigned int command, unsigned long lon)
 {
 	int i = 0;
--- a/package/kernel/lantiq/ltq-adsl-mei/src/ifxmips_mei_interface.h
+++ b/package/kernel/lantiq/ltq-adsl-mei/src/ifxmips_mei_interface.h
@ -618,6 +618,9 @@ extern DSL_DEV_MeiError_t DSL_BSP_Showtime(DSL_DEV_Device_t *, DSL_uint32_t, DSL
 extern int DSL_BSP_ATMLedCBRegister( int (*ifx_adsl_ledcallback)(void));
 extern DSL_DEV_MeiError_t DSL_BSP_MemoryDebugAccess(DSL_DEV_Device_t *, DSL_BSP_MemoryAccessType_t, DSL_uint32_t, DSL_uint32_t *, DSL_uint32_t);
 extern volatile DSL_DEV_Device_t *adsl_dev;
+extern int DSL_BSP_ATMLedCBUnregister (int (*ifx_adsl_ledcallback) (void));
+extern int ifx_mei_atm_led_blink(void);
+extern int ifx_mei_atm_showtime_check(int *is_showtime, struct port_cell_info *port_cell, void **xdata_addr);

 /**
 *    Dummy structure by now to show mechanism of extended data that will be
--- a/package/kernel/lantiq/ltq-adsl/patches/411-add-missing-header-platform_device.h.patch
+++ b/package/kernel/lantiq/ltq-adsl/patches/411-add-missing-header-platform_device.h.patch
@ -0,0 +1,25 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 20:01:14 +0800
+Subject: [PATCH] add missing header platform_device.h
+
+Fix compilation error:
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xway/ltq-dsl-danube/drv_dsl_cpe_api-3.24.4.4/src/common/drv_dsl_cpe_os_linux.c:1155:15: error: variable 'ltq_adsl_driver' has initializer but incomplete type
+ 1155 | static struct platform_driver ltq_adsl_driver = {
+      |               ^~~~~~~~~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/common/drv_dsl_cpe_os_linux.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/common/drv_dsl_cpe_os_linux.c
+++ b/src/common/drv_dsl_cpe_os_linux.c
+@@ -13,6 +13,7 @@
+ #define DSL_INTERN
+ #include <linux/kthread.h>
+ #include <linux/of_platform.h>
+#include <linux/platform_device.h>
+ 
+ #include "drv_dsl_cpe_api.h"
+ #include "drv_dsl_cpe_api_ioctl.h"
--- a/package/kernel/lantiq/ltq-adsl/patches/412-silence-missing-prototypes-warnings.patch
+++ b/package/kernel/lantiq/ltq-adsl/patches/412-silence-missing-prototypes-warnings.patch
@ -0,0 +1,32 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 20:58:09 +0800
+Subject: [PATCH] silence missing-prototypes warnings
+
+This patch silences various missing-prototypes build warnings on
+6.12 kernel.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/Makefile.am | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/src/Makefile.am
+++ b/src/Makefile.am
+@@ -299,6 +299,8 @@ if KERNEL_2_6
+ 
+ drv_dsl_cpe_api_OBJS = "$(subst .c,.o,$(filter %.c,$(drv_dsl_cpe_api_SOURCES)))"
+ 
+PKGFIX_CFLAGS = -Wno-error=missing-prototypes
+
+ drv_dsl_cpe_api.ko: $(drv_dsl_cpe_api_SOURCES)
+ 	@echo "drv_dsl_cpe_api: Making Linux 2.6.x kernel object"
+ 	if test ! -e common/drv_dsl_cpe_api.c ; then \
+@@ -311,7 +313,7 @@ drv_dsl_cpe_api.ko: $(drv_dsl_cpe_api_SO
+ 	@echo "# drv_dsl_cpe_api: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
+ 	@echo "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
+ 	@echo "$(subst .ko,,$@)-y := $(drv_dsl_cpe_api_OBJS)"	>> $(PWD)/Kbuild
+-	@echo "EXTRA_CFLAGS := -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
+	@echo "EXTRA_CFLAGS := -DHAVE_CONFIG_H $(drv_dsl_cpe_api_CFLAGS) $(PKGFIX_CFLAGS) $(DSL_DRIVER_INCL_PATH) $(IFXOS_INCLUDE_PATH) -I@abs_srcdir@/include -I$(PWD)/include"	>> $(PWD)/Kbuild
+ 	$(MAKE) ARCH=@KERNEL_ARCH@ -C @KERNEL_BUILD_PATH@ O=@KERNEL_BUILD_PATH@ M=$(PWD) modules
+ 
+ clean-generic:
--- a/package/kernel/lantiq/ltq-atm/patches/100-ltq_atm-fix-compillation-warning.patch
+++ b/package/kernel/lantiq/ltq-atm/patches/100-ltq_atm-fix-compillation-warning.patch
@ -1,12 +0,0 @@
--- a/ltq_atm.c
-+++ b/ltq_atm.c
-@@ -338,7 +338,8 @@ static int ppe_ioctl(struct atm_dev *dev
- 		break;
- 
- 	case PPE_ATM_MIB_VCC:   /*  VCC related MIB */
-		copy_from_user(&mib_vcc, arg, sizeof(mib_vcc));
-+		if (copy_from_user(&mib_vcc, arg, sizeof(mib_vcc)))
-+			return -EFAULT;
- 		conn = find_vpivci(mib_vcc.vpi, mib_vcc.vci);
- 		if (conn >= 0) {
- 			mib_vcc.mib_vcc.aal5VccCrcErrors     = g_atm_priv_data.conn[conn].aal5_vcc_crc_err;
--- a/package/kernel/lantiq/ltq-atm/src/ifxmips_atm_amazon_se.c
+++ b/package/kernel/lantiq/ltq-atm/src/ifxmips_atm_amazon_se.c
@ -254,7 +254,7 @@ static inline int pp32_download_code(u32 *code_src, unsigned int code_dword_len,
 * ####################################
 */

-extern void ase_fw_ver(unsigned int *major, unsigned int *minor)
+static void ase_fw_ver(unsigned int *major, unsigned int *minor)
 {
    ASSERT(major != NULL, "pointer is NULL");
    ASSERT(minor != NULL, "pointer is NULL");
@ -263,7 +263,7 @@ extern void ase_fw_ver(unsigned int *major, unsigned int *minor)
    *minor = FW_VER_ID->minor;
 }

-int ase_init(struct platform_device *pdev)
+static int ase_init(struct platform_device *pdev)
 {
    init_pmu();

@ -280,7 +280,7 @@ int ase_init(struct platform_device *pdev)
    return 0;
 }

-void ase_shutdown(void)
+static void ase_shutdown(void)
 {
    uninit_pmu();
 }
@ -294,7 +294,7 @@ void ase_shutdown(void)
 *    int  --- 0: Success
 *             else:        Error Code
 */
-int ase_start(int pp32)
+static int ase_start(int pp32)
 {
    int ret;

@ -320,7 +320,7 @@ int ase_start(int pp32)
 *  Output:
 *    none
 */
-void ase_stop(int pp32)
+static void ase_stop(int pp32)
 {
    /*  halt PP32   */
    IFX_REG_W32(DBG_CTRL_STOP, PP32_DBG_CTRL);
--- a/package/kernel/lantiq/ltq-atm/src/ifxmips_atm_ar9.c
+++ b/package/kernel/lantiq/ltq-atm/src/ifxmips_atm_ar9.c
@ -185,7 +185,7 @@ static inline int pp32_download_code(u32 *code_src, unsigned int code_dword_len,
    return 0;
 }

-void ar9_fw_ver(unsigned int *major, unsigned int *minor)
+static void ar9_fw_ver(unsigned int *major, unsigned int *minor)
 {
    ASSERT(major != NULL, "pointer is NULL");
    ASSERT(minor != NULL, "pointer is NULL");
@ -194,7 +194,7 @@ void ar9_fw_ver(unsigned int *major, unsigned int *minor)
    *minor = FW_VER_ID->minor;
 }

-int ar9_init(struct platform_device *pdev)
+static int ar9_init(struct platform_device *pdev)
 {
 	init_pmu();
 	reset_ppe(pdev);
@ -205,7 +205,7 @@ int ar9_init(struct platform_device *pdev)
 	return 0;
 }

-void ar9_shutdown(void)
+static void ar9_shutdown(void)
 {
 	ltq_pmu_disable(IFX_PMU_MODULE_PPE_SLL01 |
 		IFX_PMU_MODULE_PPE_TC |
@ -215,7 +215,7 @@ void ar9_shutdown(void)
 		IFX_PMU_MODULE_DSL_DFE);
 }

-int ar9_start(int pp32)
+static int ar9_start(int pp32)
 {
 	int ret;

@ -231,7 +231,7 @@ int ar9_start(int pp32)
 	return 0;
 }

-void ar9_stop(int pp32)
+static void ar9_stop(int pp32)
 {
 	IFX_REG_W32(DBG_CTRL_STOP, PP32_DBG_CTRL(0));
 }
--- a/package/kernel/lantiq/ltq-atm/src/ifxmips_atm_danube.c
+++ b/package/kernel/lantiq/ltq-atm/src/ifxmips_atm_danube.c
@ -198,7 +198,7 @@ static void danube_shutdown(void)
 {
 }

-int danube_start(int pp32)
+static int danube_start(int pp32)
 {
 	int ret;

@ -218,7 +218,7 @@ int danube_start(int pp32)
 	return 0;
 }

-void danube_stop(int pp32)
+static void danube_stop(int pp32)
 {
 	IFX_REG_W32(DBG_CTRL_STOP_SET(1), PP32_DBG_CTRL);
 }
--- a/package/kernel/lantiq/ltq-atm/src/ltq_atm.c
+++ b/package/kernel/lantiq/ltq-atm/src/ltq_atm.c
@ -36,6 +36,7 @@
 #include <linux/init.h>
 #include <linux/ioctl.h>
 #include <linux/atmdev.h>
+#include <linux/mod_devicetable.h>
 #include <linux/platform_device.h>
 #include <linux/of_device.h>
 #include <linux/atm.h>
@ -338,7 +339,8 @@ static int ppe_ioctl(struct atm_dev *dev, unsigned int cmd, void *arg)
 		break;

 	case PPE_ATM_MIB_VCC:   /*  VCC related MIB */
-		copy_from_user(&mib_vcc, arg, sizeof(mib_vcc));
+		if (copy_from_user(&mib_vcc, arg, sizeof(mib_vcc)))
+			return -EFAULT;
 		conn = find_vpivci(mib_vcc.vpi, mib_vcc.vci);
 		if (conn >= 0) {
 			mib_vcc.mib_vcc.aal5VccCrcErrors     = g_atm_priv_data.conn[conn].aal5_vcc_crc_err;
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_aes.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_aes.c
@ -148,7 +148,7 @@ extern int disable_multiblock;
 *  \param key_len key lengths of 16, 24 and 32 bytes supported  
 *  \return -EINVAL - bad key length, 0 - SUCCESS
 */                                 
-int aes_set_key (struct crypto_tfm *tfm, const u8 *in_key, unsigned int key_len)
+static int aes_set_key (struct crypto_tfm *tfm, const u8 *in_key, unsigned int key_len)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(tfm);

@ -177,7 +177,7 @@ int aes_set_key (struct crypto_tfm *tfm, const u8 *in_key, unsigned int key_len)
 *  \param key_len key lengths of 16, 24 and 32 bytes supported
 *  \return -EINVAL - bad key length, 0 - SUCCESS
 */
-int aes_set_key_skcipher (struct crypto_skcipher *tfm, const u8 *in_key, unsigned int key_len)
+static int aes_set_key_skcipher (struct crypto_skcipher *tfm, const u8 *in_key, unsigned int key_len)
 {
    return aes_set_key(crypto_skcipher_tfm(tfm), in_key, key_len);
 }
@ -189,7 +189,7 @@ int aes_set_key_skcipher (struct crypto_skcipher *tfm, const u8 *in_key, unsigne
 *  \param ctx_arg crypto algo context  
 *  \return
 */
-void aes_set_key_hw (void *ctx_arg)
+static void aes_set_key_hw (void *ctx_arg)
 {
    /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
    volatile struct aes_t *aes = (volatile struct aes_t *) AES_START;
@ -343,7 +343,7 @@ void ifx_deu_aes (void *ctx_arg, u8 *out_arg, const u8 *in_arg,
 *  \return 0 - SUCCESS
 *          -EINVAL - bad key length
 */                                 
-int ctr_rfc3686_aes_set_key (struct crypto_tfm *tfm, const uint8_t *in_key, unsigned int key_len)
+static int ctr_rfc3686_aes_set_key (struct crypto_tfm *tfm, const uint8_t *in_key, unsigned int key_len)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(tfm);

@ -376,7 +376,7 @@ int ctr_rfc3686_aes_set_key (struct crypto_tfm *tfm, const uint8_t *in_key, unsi
 *  \return 0 - SUCCESS
 *          -EINVAL - bad key length
 */
-int ctr_rfc3686_aes_set_key_skcipher (struct crypto_skcipher *tfm, const uint8_t *in_key, unsigned int key_len)
+static int ctr_rfc3686_aes_set_key_skcipher (struct crypto_skcipher *tfm, const uint8_t *in_key, unsigned int key_len)
 {
    return ctr_rfc3686_aes_set_key(crypto_skcipher_tfm(tfm), in_key, key_len);
 }
@ -413,7 +413,7 @@ int ctr_rfc3686_aes_set_key_skcipher (struct crypto_skcipher *tfm, const uint8_t
 *  \param encdec 1 for encrypt; 0 for decrypt  
 *  \param inplace not used  
 */                                 
-void ifx_deu_aes_ecb (void *ctx, uint8_t *dst, const uint8_t *src,
+static void ifx_deu_aes_ecb (void *ctx, uint8_t *dst, const uint8_t *src,
        uint8_t *iv, size_t nbytes, int encdec, int inplace)
 {
     ifx_deu_aes (ctx, dst, src, NULL, nbytes, encdec, 0);
@ -430,7 +430,7 @@ void ifx_deu_aes_ecb (void *ctx, uint8_t *dst, const uint8_t *src,
 *  \param encdec 1 for encrypt; 0 for decrypt  
 *  \param inplace not used  
 */                                 
-void ifx_deu_aes_cbc (void *ctx, uint8_t *dst, const uint8_t *src,
+static void ifx_deu_aes_cbc (void *ctx, uint8_t *dst, const uint8_t *src,
        uint8_t *iv, size_t nbytes, int encdec, int inplace)
 {
     ifx_deu_aes (ctx, dst, src, iv, nbytes, encdec, 1);
@ -447,7 +447,7 @@ void ifx_deu_aes_cbc (void *ctx, uint8_t *dst, const uint8_t *src,
 *  \param encdec 1 for encrypt; 0 for decrypt  
 *  \param inplace not used  
 */                                 
-void ifx_deu_aes_ofb (void *ctx, uint8_t *dst, const uint8_t *src,
+static void ifx_deu_aes_ofb (void *ctx, uint8_t *dst, const uint8_t *src,
        uint8_t *iv, size_t nbytes, int encdec, int inplace)
 {
     ifx_deu_aes (ctx, dst, src, iv, nbytes, encdec, 2);
@ -464,7 +464,7 @@ void ifx_deu_aes_ofb (void *ctx, uint8_t *dst, const uint8_t *src,
 *  \param encdec 1 for encrypt; 0 for decrypt  
 *  \param inplace not used  
 */                                 
-void ifx_deu_aes_cfb (void *ctx, uint8_t *dst, const uint8_t *src,
+static void ifx_deu_aes_cfb (void *ctx, uint8_t *dst, const uint8_t *src,
        uint8_t *iv, size_t nbytes, int encdec, int inplace)
 {
     ifx_deu_aes (ctx, dst, src, iv, nbytes, encdec, 3);
@ -481,7 +481,7 @@ void ifx_deu_aes_cfb (void *ctx, uint8_t *dst, const uint8_t *src,
 *  \param encdec 1 for encrypt; 0 for decrypt  
 *  \param inplace not used  
 */                                 
-void ifx_deu_aes_ctr (void *ctx, uint8_t *dst, const uint8_t *src,
+static void ifx_deu_aes_ctr (void *ctx, uint8_t *dst, const uint8_t *src,
        uint8_t *iv, size_t nbytes, int encdec, int inplace)
 {
     ifx_deu_aes (ctx, dst, src, iv, nbytes, encdec, 4);
@ -494,7 +494,7 @@ void ifx_deu_aes_ctr (void *ctx, uint8_t *dst, const uint8_t *src,
 *  \param out output bytestream
 *  \param in input bytestream
 */
-void ifx_deu_aes_encrypt (struct crypto_tfm *tfm, uint8_t *out, const uint8_t *in)
+static void ifx_deu_aes_encrypt (struct crypto_tfm *tfm, uint8_t *out, const uint8_t *in)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(tfm);
    ifx_deu_aes (ctx, out, in, NULL, AES_BLOCK_SIZE,
@ -508,7 +508,7 @@ void ifx_deu_aes_encrypt (struct crypto_tfm *tfm, uint8_t *out, const uint8_t *i
 *  \param out output bytestream
 *  \param in input bytestream
 */
-void ifx_deu_aes_decrypt (struct crypto_tfm *tfm, uint8_t *out, const uint8_t *in)
+static void ifx_deu_aes_decrypt (struct crypto_tfm *tfm, uint8_t *out, const uint8_t *in)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(tfm);
    ifx_deu_aes (ctx, out, in, NULL, AES_BLOCK_SIZE,
@ -544,7 +544,7 @@ struct crypto_alg ifxdeu_aes_alg = {
 *  \param req skcipher request
 *  \return err
 */
-int ecb_aes_encrypt(struct skcipher_request *req)
+static int ecb_aes_encrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -570,7 +570,7 @@ int ecb_aes_encrypt(struct skcipher_request *req)
 *  \param req skcipher request
 *  \return err
 */
-int ecb_aes_decrypt(struct skcipher_request *req)
+static int ecb_aes_decrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -615,7 +615,7 @@ struct skcipher_alg ifxdeu_ecb_aes_alg = {
 *  \param req skcipher request
 *  \return err
 */
-int cbc_aes_encrypt(struct skcipher_request *req)
+static int cbc_aes_encrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -642,7 +642,7 @@ int cbc_aes_encrypt(struct skcipher_request *req)
 *  \param req skcipher request
 *  \return err
 */
-int cbc_aes_decrypt(struct skcipher_request *req)
+static int cbc_aes_decrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -694,7 +694,7 @@ struct skcipher_alg ifxdeu_cbc_aes_alg = {
 *  \param encdec 1 for encrypt; 0 for decrypt
 *
 */
-void ifx_deu_aes_xts (void *ctx_arg, u8 *out_arg, const u8 *in_arg,
+static void ifx_deu_aes_xts (void *ctx_arg, u8 *out_arg, const u8 *in_arg,
        u8 *iv_arg, size_t nbytes, int encdec)
 {
    /*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */
@ -797,7 +797,7 @@ void ifx_deu_aes_xts (void *ctx_arg, u8 *out_arg, const u8 *in_arg,
 *  \param req skcipher request
 *  \return err
 */
-int xts_aes_encrypt(struct skcipher_request *req)
+static int xts_aes_encrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -853,7 +853,7 @@ int xts_aes_encrypt(struct skcipher_request *req)
 *  \param req skcipher request
 *  \return err
 */
-int xts_aes_decrypt(struct skcipher_request *req)
+static int xts_aes_decrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -911,7 +911,7 @@ int xts_aes_decrypt(struct skcipher_request *req)
 *  \param key_len key lengths of 16, 24 and 32 bytes supported
 *  \return -EINVAL - bad key length, 0 - SUCCESS
 */
-int xts_aes_set_key_skcipher (struct crypto_skcipher *tfm, const u8 *in_key, unsigned int key_len)
+static int xts_aes_set_key_skcipher (struct crypto_skcipher *tfm, const u8 *in_key, unsigned int key_len)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(crypto_skcipher_tfm(tfm));
    unsigned int keylen = (key_len / 2);
@ -958,7 +958,7 @@ struct skcipher_alg ifxdeu_xts_aes_alg = {
 *  \param req skcipher request
 *  \return err
 */
-int ofb_aes_encrypt(struct skcipher_request *req)
+static int ofb_aes_encrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -991,7 +991,7 @@ int ofb_aes_encrypt(struct skcipher_request *req)
 *  \param req skcipher request
 *  \return err
 */
-int ofb_aes_decrypt(struct skcipher_request *req)
+static int ofb_aes_decrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -1046,7 +1046,7 @@ struct skcipher_alg ifxdeu_ofb_aes_alg = {
 *  \param req skcipher request
 *  \return err
 */
-int cfb_aes_encrypt(struct skcipher_request *req)
+static int cfb_aes_encrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -1079,7 +1079,7 @@ int cfb_aes_encrypt(struct skcipher_request *req)
 *  \param req skcipher request
 *  \return err
 */
-int cfb_aes_decrypt(struct skcipher_request *req)
+static int cfb_aes_decrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -1134,7 +1134,7 @@ struct skcipher_alg ifxdeu_cfb_aes_alg = {
 *  \param req skcipher request
 *  \return err
 */
-int ctr_basic_aes_encrypt(struct skcipher_request *req)
+static int ctr_basic_aes_encrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -1167,7 +1167,7 @@ int ctr_basic_aes_encrypt(struct skcipher_request *req)
 *  \param req skcipher request
 *  \return err
 */
-int ctr_basic_aes_decrypt(struct skcipher_request *req)
+static int ctr_basic_aes_decrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -1221,7 +1221,7 @@ struct skcipher_alg ifxdeu_ctr_basic_aes_alg = {
 *  \param req skcipher request
 *  \return err
 */
-int ctr_rfc3686_aes_encrypt(struct skcipher_request *req)
+static int ctr_rfc3686_aes_encrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -1264,7 +1264,7 @@ int ctr_rfc3686_aes_encrypt(struct skcipher_request *req)
 *  \param req skcipher request
 *  \return err
 */
-int ctr_rfc3686_aes_decrypt(struct skcipher_request *req)
+static int ctr_rfc3686_aes_decrypt(struct skcipher_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -1576,7 +1576,7 @@ static struct shash_alg ifxdeu_cbcmac_aes_alg = {
 *  \param key_len key lengths of 16, 24 and 32 bytes supported
 *  \return -EINVAL - bad key length, 0 - SUCCESS
 */
-int aes_set_key_aead (struct crypto_aead *aead, const u8 *in_key, unsigned int key_len)
+static int aes_set_key_aead (struct crypto_aead *aead, const u8 *in_key, unsigned int key_len)
 {
    struct aes_ctx *ctx = crypto_aead_ctx(aead);
    int err;
@ -1601,7 +1601,7 @@ int aes_set_key_aead (struct crypto_aead *aead, const u8 *in_key, unsigned int k
 *  \param in_key input authsize
 *  \return -EINVAL - bad authsize length, 0 - SUCCESS
 */
-int gcm_aes_setauthsize (struct crypto_aead *aead, unsigned int authsize)
+static int gcm_aes_setauthsize (struct crypto_aead *aead, unsigned int authsize)
 {
    return crypto_gcm_check_authsize(authsize);
 }
@ -1612,7 +1612,7 @@ int gcm_aes_setauthsize (struct crypto_aead *aead, unsigned int authsize)
 *  \param req aead request
 *  \return err
 */
-int gcm_aes_encrypt(struct aead_request *req)
+static int gcm_aes_encrypt(struct aead_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
@ -1726,7 +1726,7 @@ int gcm_aes_encrypt(struct aead_request *req)
 *  \param req aead request
 *  \return err
 */
-int gcm_aes_decrypt(struct aead_request *req)
+static int gcm_aes_decrypt(struct aead_request *req)
 {
    struct aes_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
    struct skcipher_walk walk;
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_des.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_des.c
@ -126,7 +126,7 @@ extern int disable_deudma;
 *  \param key input key  
 *  \param keylen key length  
 */                                 
-int des_setkey(struct crypto_tfm *tfm, const u8 *key,
+static int des_setkey(struct crypto_tfm *tfm, const u8 *key,
                      unsigned int keylen)
 {
        struct ifx_deu_des_ctx *dctx = crypto_tfm_ctx(tfm);
@ -161,7 +161,7 @@ int des_setkey(struct crypto_tfm *tfm, const u8 *key,
 *  \param key_len key lengths of 16, 24 and 32 bytes supported
 *  \return -EINVAL - bad key length, 0 - SUCCESS
 */
-int des_setkey_skcipher (struct crypto_skcipher *tfm, const u8 *in_key, unsigned int key_len)
+static int des_setkey_skcipher (struct crypto_skcipher *tfm, const u8 *in_key, unsigned int key_len)
 {
    return des_setkey(crypto_skcipher_tfm(tfm), in_key, key_len);
 }
@ -296,7 +296,7 @@ void ifx_deu_des (void *ctx_arg, u8 *out_arg, const u8 *in_arg,
 *  \param encdec 1 for encrypt; 0 for decrypt  
 *  \param inplace not used  
 */
-void ifx_deu_des_ecb (void *ctx, uint8_t *dst, const uint8_t *src,
+static void ifx_deu_des_ecb (void *ctx, uint8_t *dst, const uint8_t *src,
                uint8_t *iv, size_t nbytes, int encdec, int inplace)
 {
     ifx_deu_des (ctx, dst, src, NULL, nbytes, encdec, 0);
@ -313,7 +313,7 @@ void ifx_deu_des_ecb (void *ctx, uint8_t *dst, const uint8_t *src,
 *  \param encdec 1 for encrypt; 0 for decrypt  
 *  \param inplace not used  
 */                                 
-void ifx_deu_des_cbc (void *ctx, uint8_t *dst, const uint8_t *src,
+static void ifx_deu_des_cbc (void *ctx, uint8_t *dst, const uint8_t *src,
                uint8_t *iv, size_t nbytes, int encdec, int inplace)
 {
     ifx_deu_des (ctx, dst, src, iv, nbytes, encdec, 1);
@ -330,11 +330,13 @@ void ifx_deu_des_cbc (void *ctx, uint8_t *dst, const uint8_t *src,
 *  \param encdec 1 for encrypt; 0 for decrypt  
 *  \param inplace not used  
 */                                 
-void ifx_deu_des_ofb (void *ctx, uint8_t *dst, const uint8_t *src,
+/*
+static void ifx_deu_des_ofb (void *ctx, uint8_t *dst, const uint8_t *src,
                uint8_t *iv, size_t nbytes, int encdec, int inplace)
 {
     ifx_deu_des (ctx, dst, src, iv, nbytes, encdec, 2);
 }
+*/

 /*! \fn void ifx_deu_des_cfb (void *ctx, uint8_t *dst, const uint8_t *src, uint8_t *iv, size_t nbytes, int encdec, int inplace)
    \ingroup IFX_DES_FUNCTIONS
@ -347,11 +349,13 @@ void ifx_deu_des_ofb (void *ctx, uint8_t *dst, const uint8_t *src,
    \param encdec 1 for encrypt; 0 for decrypt  
    \param inplace not used  
 */                                 
-void ifx_deu_des_cfb (void *ctx, uint8_t *dst, const uint8_t *src,
+/*
+static void ifx_deu_des_cfb (void *ctx, uint8_t *dst, const uint8_t *src,
                uint8_t *iv, size_t nbytes, int encdec, int inplace)
 {
     ifx_deu_des (ctx, dst, src, iv, nbytes, encdec, 3);
 }
+*/

 /*! \fn void ifx_deu_des_ctr (void *ctx, uint8_t *dst, const uint8_t *src, uint8_t *iv, size_t nbytes, int encdec, int inplace)
 *  \ingroup IFX_DES_FUNCTIONS
@ -364,11 +368,13 @@ void ifx_deu_des_cfb (void *ctx, uint8_t *dst, const uint8_t *src,
 *  \param encdec 1 for encrypt; 0 for decrypt  
 *  \param inplace not used  
 */                                 
+/*
 void ifx_deu_des_ctr (void *ctx, uint8_t *dst, const uint8_t *src,
                uint8_t *iv, size_t nbytes, int encdec, int inplace)
 {
     ifx_deu_des (ctx, dst, src, iv, nbytes, encdec, 4);
 }
+*/

 /*! \fn void ifx_deu_des_encrypt (struct crypto_tfm *tfm, uint8_t *out, const uint8_t *in)
 *  \ingroup IFX_DES_FUNCTIONS
@ -377,7 +383,7 @@ void ifx_deu_des_ctr (void *ctx, uint8_t *dst, const uint8_t *src,
 *  \param out output bytestream  
 *  \param in input bytestream  
 */                                               
-void ifx_deu_des_encrypt (struct crypto_tfm *tfm, uint8_t * out, const uint8_t * in)
+static void ifx_deu_des_encrypt (struct crypto_tfm *tfm, uint8_t * out, const uint8_t * in)
 {
     struct ifx_deu_des_ctx *ctx = crypto_tfm_ctx(tfm);
     ifx_deu_des (ctx, out, in, NULL, DES_BLOCK_SIZE,
@ -392,7 +398,7 @@ void ifx_deu_des_encrypt (struct crypto_tfm *tfm, uint8_t * out, const uint8_t *
 *  \param out output bytestream  
 *  \param in input bytestream  
 */                                               
-void ifx_deu_des_decrypt (struct crypto_tfm *tfm, uint8_t * out, const uint8_t * in)
+static void ifx_deu_des_decrypt (struct crypto_tfm *tfm, uint8_t * out, const uint8_t * in)
 {
     struct ifx_deu_des_ctx *ctx = crypto_tfm_ctx(tfm);
     ifx_deu_des (ctx, out, in, NULL, DES_BLOCK_SIZE,
@ -420,7 +426,7 @@ void ifx_deu_des_decrypt (struct crypto_tfm *tfm, uint8_t * out, const uint8_t *
 *  \param key input key  
 *  \param keylen key length  
 */                                 
-int des3_ede_setkey(struct crypto_tfm *tfm, const u8 *key,
+static int des3_ede_setkey(struct crypto_tfm *tfm, const u8 *key,
                    unsigned int keylen)
 {
        struct ifx_deu_des_ctx *dctx = crypto_tfm_ctx(tfm);
@ -454,7 +460,7 @@ int des3_ede_setkey(struct crypto_tfm *tfm, const u8 *key,
 *  \param key input key
 *  \param keylen key length
 */
-int des3_ede_setkey_skcipher(struct crypto_skcipher *tfm, const u8 *key,
+static int des3_ede_setkey_skcipher(struct crypto_skcipher *tfm, const u8 *key,
                    unsigned int keylen)
 {
        return des3_ede_setkey(crypto_skcipher_tfm(tfm), key, keylen);
@ -508,7 +514,7 @@ struct crypto_alg ifxdeu_des3_ede_alg = {
 *  \param req skcipher request
 *  \return err
 */
-int ecb_des_encrypt(struct skcipher_request *req)
+static int ecb_des_encrypt(struct skcipher_request *req)
 {
        struct ifx_deu_des_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
        struct skcipher_walk walk;
@ -534,7 +540,7 @@ int ecb_des_encrypt(struct skcipher_request *req)
 *  \param req skcipher request
 *  \return err
 */
-int ecb_des_decrypt(struct skcipher_request *req)
+static int ecb_des_decrypt(struct skcipher_request *req)
 {
        struct ifx_deu_des_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
        struct skcipher_walk walk;
@ -599,7 +605,7 @@ struct skcipher_alg ifxdeu_ecb_des3_ede_alg = {
 *  \param req skcipher request
 *  \return err
 */
-int cbc_des_encrypt(struct skcipher_request *req)
+static int cbc_des_encrypt(struct skcipher_request *req)
 {
        struct ifx_deu_des_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
        struct skcipher_walk walk;
@ -627,7 +633,7 @@ int cbc_des_encrypt(struct skcipher_request *req)
 *  \param req skcipher request
 *  \return err
 */
-int cbc_des_decrypt(struct skcipher_request *req)
+static int cbc_des_decrypt(struct skcipher_request *req)
 {
        struct ifx_deu_des_ctx *ctx = crypto_tfm_ctx(req->base.tfm);
        struct skcipher_walk walk;
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu_ar9.h
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu_ar9.h
@ -304,4 +304,7 @@ struct deu_dma_t {
 	} controlr;
 };

+u32 input_swap(u32 input);
+void chip_version(void);
+
 #endif /* IFXMIPS_DEU_AR9_H */
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu_danube.h
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu_danube.h
@ -255,4 +255,6 @@ struct deu_dma_t {
 	} controlr;
 };

+u32 input_swap(u32 input);
+
 #endif  /* IFXMIPS_DEU_DANUBE_H */
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu_vr9.h
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu_vr9.h
@ -321,4 +321,7 @@ struct deu_dma_t {
 	} controlr;
 };

+u32 input_swap(u32 input);
+void chip_version(void);
+
 #endif /* IFXMIPS_DEU_VR9_H */
--- a/package/kernel/lantiq/ltq-ifxos/patches/101-add-missing-prototype-for-IFX_Var_Fifo_getRoom.patch
+++ b/package/kernel/lantiq/ltq-ifxos/patches/101-add-missing-prototype-for-IFX_Var_Fifo_getRoom.patch
@ -0,0 +1,26 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Wed, 7 May 2025 20:24:34 +0800
+Subject: [PATCH] add missing prototype for IFX_Var_Fifo_getRoom()
+
+Fix build warning on 6.12 kernel:
+
+/home/db/owrt/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx_generic/ifxos-ugw_8.5.2.10/src/common/ifx_fifo.c:532:14: error: no previous prototype for 'IFX_Var_Fifo_getRoom' [-Werror=missing-prototypes]
+  532 | IFX_uint32_t IFX_Var_Fifo_getRoom (IFX_VFIFO *pFifo)
+      |              ^~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/include/ifx_fifo.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/src/include/ifx_fifo.h
+++ b/src/include/ifx_fifo.h
+@@ -104,6 +104,8 @@ extern IFX_int8_t   IFX_Var_Fifo_isFull
+                            IFX_VFIFO *pFifo);
+ extern IFX_uint32_t IFX_Var_Fifo_getCount(
+                            IFX_VFIFO *pFifo);
+extern IFX_uint32_t IFX_Var_Fifo_getRoom(
+                           IFX_VFIFO *pFifo);
+ 
+ #ifdef __cplusplus
+ }
--- a/package/kernel/lantiq/ltq-ptm/patches/100-fix-compilation-warning-debugfs.patch
+++ b/package/kernel/lantiq/ltq-ptm/patches/100-fix-compilation-warning-debugfs.patch
@ -1,6 +1,6 @@
 --- a/ifxmips_ptm_adsl.c
 +++ b/ifxmips_ptm_adsl.c
-@@ -175,9 +175,11 @@ static INLINE void mailbox_signal(unsign
+@@ -177,9 +177,11 @@ static INLINE void mailbox_signal(unsign
  */
 static INLINE void proc_file_create(void);
 static INLINE void proc_file_delete(void);
@ -12,7 +12,7 @@
 #if defined(ENABLE_FW_PROC) && ENABLE_FW_PROC
   static int proc_read_genconf(char *, char **, off_t, int, int *, void *);
 #endif
-@@ -896,6 +898,7 @@ static INLINE void proc_file_delete(void
+@@ -927,6 +929,7 @@ static INLINE void proc_file_delete(void
     remove_proc_entry("driver/ifx_ptm", NULL);
 }
 
@ -20,7 +20,7 @@
 static int proc_read_version(char *buf, char **start, off_t offset, int count, int *eof, void *data)
 {
     int len = 0;
-@@ -970,8 +973,9 @@ static int proc_write_wanmib(struct file
+@@ -1001,8 +1004,9 @@ static int proc_write_wanmib(struct file
 
     return count;
 }
--- a/package/kernel/lantiq/ltq-ptm/patches/101-fix-more-compilation-warning-debugfs.patch
+++ b/package/kernel/lantiq/ltq-ptm/patches/101-fix-more-compilation-warning-debugfs.patch
@ -1,6 +1,6 @@
 --- a/ifxmips_ptm_adsl.c
 +++ b/ifxmips_ptm_adsl.c
-@@ -180,7 +180,7 @@ static int proc_read_version(char *, cha
+@@ -182,7 +182,7 @@ static int proc_read_version(char *, cha
 static int proc_read_wanmib(char *, char **, off_t, int, int *, void *);
 static int proc_write_wanmib(struct file *, const char *, unsigned long, void *);
 #endif
@ -9,7 +9,7 @@
   static int proc_read_genconf(char *, char **, off_t, int, int *, void *);
 #endif
 #if defined(ENABLE_DBG_PROC) && ENABLE_DBG_PROC
-@@ -191,8 +191,8 @@ static int proc_write_wanmib(struct file
+@@ -193,8 +193,8 @@ static int proc_write_wanmib(struct file
 /*
  *  Proc Help Functions
  */
@ -19,7 +19,7 @@
   static INLINE int strincmp(const char *, const char *, int);
 #endif
 static INLINE int ifx_ptm_version(char *);
-@@ -1166,8 +1166,6 @@ static int proc_write_dbg(struct file *f
+@@ -1197,8 +1197,6 @@ static int proc_write_dbg(struct file *f
     return count;
 }
 
@ -28,7 +28,7 @@
 static INLINE int stricmp(const char *p1, const char *p2)
 {
     int c1, c2;
-@@ -1185,7 +1183,6 @@ static INLINE int stricmp(const char *p1
+@@ -1216,7 +1214,6 @@ static INLINE int stricmp(const char *p1
     return *p1 - *p2;
 }
 
--- a/package/kernel/lantiq/ltq-ptm/patches/102-fix-missing-prototypes-warning.patch
+++ b/package/kernel/lantiq/ltq-ptm/patches/102-fix-missing-prototypes-warning.patch
@ -0,0 +1,26 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 02:34:14 +0800
+Subject: [PATCH] fix missing-prototypes warning
+
+Fix the build warning on 6.12 kernel:
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/ltq-ptm-vr9/ltq-ptm/ifxmips_ptm_vdsl.c:64:15: error: no previous prototype for 'cgu_get_pp32_clock' [-Werror=missing-prototypes]
+   64 | unsigned long cgu_get_pp32_clock(void)
+      |               ^~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ ifxmips_ptm_vdsl.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/ifxmips_ptm_vdsl.c
+++ b/ifxmips_ptm_vdsl.c
+@@ -61,7 +61,7 @@ static void *g_xdata_addr = NULL;
+ 
+ #define ENABLE_TMP_DBG                          0
+ 
+-unsigned long cgu_get_pp32_clock(void)
+static unsigned long cgu_get_pp32_clock(void)
+ {
+ 	struct clk *c = clk_get_ppe();
+ 	unsigned long rate = clk_get_rate(c);
--- a/package/kernel/lantiq/ltq-ptm/patches/103-add-missing-header-mod_devicetable.h.patch
+++ b/package/kernel/lantiq/ltq-ptm/patches/103-add-missing-header-mod_devicetable.h.patch
@ -0,0 +1,26 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 02:36:31 +0800
+Subject: [PATCH] add missing header mod_devicetable.h
+
+Fix compilation error:
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/ltq-ptm-vr9/ltq-ptm/ifxmips_ptm_vdsl.c:969:34: error: array type has incomplete element type 'struct of_device_id'
+  969 | static const struct of_device_id ltq_ptm_match[] = {
+      |                                  ^~~~~~~~~~~~~
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/ltq-ptm-vr9/ltq-ptm/ifxmips_ptm_vdsl.c:969:34: error: 'ltq_ptm_match' defined but not used [-Werror=unused-variable]
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ ifxmips_ptm_vdsl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/ifxmips_ptm_vdsl.c
+++ b/ifxmips_ptm_vdsl.c
+@@ -34,6 +34,7 @@
+ #include <linux/interrupt.h>
+ #include <linux/netdevice.h>
+ #include <linux/platform_device.h>
+#include <linux/mod_devicetable.h>
+ #include <linux/of_device.h>
+ 
+ #include "ifxmips_ptm_vdsl.h"
--- a/package/kernel/lantiq/ltq-ptm/patches/104-add-missing-header-mod_devicetable.h.patch
+++ b/package/kernel/lantiq/ltq-ptm/patches/104-add-missing-header-mod_devicetable.h.patch
@ -0,0 +1,25 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 21:16:08 +0800
+Subject: [PATCH] add missing header "mod_devicetable.h"
+
+Fix compilation error:
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xway/ltq-ptm-danube/ltq-ptm/ifxmips_ptm_adsl.c:1433:34: error: array type has incomplete element type 'struct of_device_id'
+ 1433 | static const struct of_device_id ltq_ptm_match[] = {
+      |                                  ^~~~~~~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ ifxmips_ptm_adsl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/ifxmips_ptm_adsl.c
+++ b/ifxmips_ptm_adsl.c
+@@ -43,6 +43,7 @@
+ #include <linux/ioctl.h>
+ #include <linux/etherdevice.h>
+ #include <linux/interrupt.h>
+#include <linux/mod_devicetable.h>
+ #include <linux/netdevice.h>
+ #include <linux/platform_device.h>
+ #include <linux/of_device.h>
--- a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c
+++ b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c
@ -46,6 +46,8 @@
 #include <linux/netdevice.h>
 #include <linux/platform_device.h>
 #include <linux/of_device.h>
+#include <linux/uaccess.h>
+#include <linux/capability.h>
 #include <asm/io.h>

 /*
@ -463,56 +465,85 @@ static int ptm_ioctl(struct net_device *dev, struct ifreq *ifr, void __user *dat
 {
    int ndev;

+    if (!capable(CAP_NET_ADMIN))
+        return -EPERM;
+
    for ( ndev = 0; ndev < ARRAY_SIZE(g_net_dev) && g_net_dev[ndev] != dev; ndev++ );
    ASSERT(ndev >= 0 && ndev < ARRAY_SIZE(g_net_dev), "ndev = %d (wrong value)", ndev);

    switch ( cmd )
    {
    case IFX_PTM_MIB_CW_GET:
-        ((PTM_CW_IF_ENTRY_T *)data)->ifRxNoIdleCodewords   = WAN_MIB_TABLE[ndev].wrx_nonidle_cw;
-        ((PTM_CW_IF_ENTRY_T *)data)->ifRxIdleCodewords     = WAN_MIB_TABLE[ndev].wrx_idle_cw;
-        ((PTM_CW_IF_ENTRY_T *)data)->ifRxCodingViolation   = WAN_MIB_TABLE[ndev].wrx_err_cw;
-        ((PTM_CW_IF_ENTRY_T *)data)->ifTxNoIdleCodewords   = 0;
-        ((PTM_CW_IF_ENTRY_T *)data)->ifTxIdleCodewords     = 0;
+        {
+            PTM_CW_IF_ENTRY_T tmp = {0};
+
+            tmp.ifRxNoIdleCodewords   = WAN_MIB_TABLE[ndev].wrx_nonidle_cw;
+            tmp.ifRxIdleCodewords     = WAN_MIB_TABLE[ndev].wrx_idle_cw;
+            tmp.ifRxCodingViolation   = WAN_MIB_TABLE[ndev].wrx_err_cw;
+            tmp.ifTxNoIdleCodewords   = 0;
+            tmp.ifTxIdleCodewords     = 0;
+
+            if (copy_to_user(data, &tmp, sizeof(tmp)))
+                return -EFAULT;
+        }
        break;
    case IFX_PTM_MIB_FRAME_GET:
-        ((PTM_FRAME_MIB_T *)data)->RxCorrect   = WAN_MIB_TABLE[ndev].wrx_correct_pdu;
-        ((PTM_FRAME_MIB_T *)data)->TC_CrcError = WAN_MIB_TABLE[ndev].wrx_tccrc_err_pdu;
-        ((PTM_FRAME_MIB_T *)data)->RxDropped   = WAN_MIB_TABLE[ndev].wrx_nodesc_drop_pdu + WAN_MIB_TABLE[ndev].wrx_len_violation_drop_pdu;
-        ((PTM_FRAME_MIB_T *)data)->TxSend      = WAN_MIB_TABLE[ndev].wtx_total_pdu;
+        {
+            PTM_FRAME_MIB_T tmp = {0};
+    
+            tmp.RxCorrect   = WAN_MIB_TABLE[ndev].wrx_correct_pdu;
+            tmp.TC_CrcError = WAN_MIB_TABLE[ndev].wrx_tccrc_err_pdu;
+            tmp.RxDropped   = WAN_MIB_TABLE[ndev].wrx_nodesc_drop_pdu + WAN_MIB_TABLE[ndev].wrx_len_violation_drop_pdu;
+            tmp.TxSend      = WAN_MIB_TABLE[ndev].wtx_total_pdu;
+            if (copy_to_user(data, &tmp, sizeof(tmp)))
+                return -EFAULT;
+        }
        break;
    case IFX_PTM_CFG_GET:
-        ((IFX_PTM_CFG_T *)data)->RxEthCrcPresent = CFG_ETH_EFMTC_CRC->rx_eth_crc_present;
-        ((IFX_PTM_CFG_T *)data)->RxEthCrcCheck   = CFG_ETH_EFMTC_CRC->rx_eth_crc_check;
-        ((IFX_PTM_CFG_T *)data)->RxTcCrcCheck    = CFG_ETH_EFMTC_CRC->rx_tc_crc_check;
-        ((IFX_PTM_CFG_T *)data)->RxTcCrcLen      = CFG_ETH_EFMTC_CRC->rx_tc_crc_len;
-        ((IFX_PTM_CFG_T *)data)->TxEthCrcGen     = CFG_ETH_EFMTC_CRC->tx_eth_crc_gen;
-        ((IFX_PTM_CFG_T *)data)->TxTcCrcGen      = CFG_ETH_EFMTC_CRC->tx_tc_crc_gen;
-        ((IFX_PTM_CFG_T *)data)->TxTcCrcLen      = CFG_ETH_EFMTC_CRC->tx_tc_crc_len;
+        {
+            IFX_PTM_CFG_T tmp = {0};
+
+            tmp.RxEthCrcPresent = CFG_ETH_EFMTC_CRC->rx_eth_crc_present;
+            tmp.RxEthCrcCheck   = CFG_ETH_EFMTC_CRC->rx_eth_crc_check;
+            tmp.RxTcCrcCheck    = CFG_ETH_EFMTC_CRC->rx_tc_crc_check;
+            tmp.RxTcCrcLen      = CFG_ETH_EFMTC_CRC->rx_tc_crc_len;
+            tmp.TxEthCrcGen     = CFG_ETH_EFMTC_CRC->tx_eth_crc_gen;
+            tmp.TxTcCrcGen      = CFG_ETH_EFMTC_CRC->tx_tc_crc_gen;
+            tmp.TxTcCrcLen      = CFG_ETH_EFMTC_CRC->tx_tc_crc_len;
+            if (copy_to_user(data, &tmp, sizeof(tmp)))
+                return -EFAULT;
+        }
        break;
    case IFX_PTM_CFG_SET:
-        CFG_ETH_EFMTC_CRC->rx_eth_crc_present   = ((IFX_PTM_CFG_T *)data)->RxEthCrcPresent ? 1 : 0;
-        CFG_ETH_EFMTC_CRC->rx_eth_crc_check     = ((IFX_PTM_CFG_T *)data)->RxEthCrcCheck ? 1 : 0;
-        if ( ((IFX_PTM_CFG_T *)data)->RxTcCrcCheck && (((IFX_PTM_CFG_T *)data)->RxTcCrcLen == 16 || ((IFX_PTM_CFG_T *)data)->RxTcCrcLen == 32) )
        {
-            CFG_ETH_EFMTC_CRC->rx_tc_crc_check  = 1;
-            CFG_ETH_EFMTC_CRC->rx_tc_crc_len    = ((IFX_PTM_CFG_T *)data)->RxTcCrcLen;
-        }
-        else
-        {
-            CFG_ETH_EFMTC_CRC->rx_tc_crc_check  = 0;
-            CFG_ETH_EFMTC_CRC->rx_tc_crc_len    = 0;
-        }
-        CFG_ETH_EFMTC_CRC->tx_eth_crc_gen       = ((IFX_PTM_CFG_T *)data)->TxEthCrcGen ? 1 : 0;
-        if ( ((IFX_PTM_CFG_T *)data)->TxTcCrcGen && (((IFX_PTM_CFG_T *)data)->TxTcCrcLen == 16 || ((IFX_PTM_CFG_T *)data)->TxTcCrcLen == 32) )
-        {
-            CFG_ETH_EFMTC_CRC->tx_tc_crc_gen    = 1;
-            CFG_ETH_EFMTC_CRC->tx_tc_crc_len    = ((IFX_PTM_CFG_T *)data)->TxTcCrcLen;
-        }
-        else
-        {
-            CFG_ETH_EFMTC_CRC->tx_tc_crc_gen    = 0;
-            CFG_ETH_EFMTC_CRC->tx_tc_crc_len    = 0;
+            IFX_PTM_CFG_T cfg = {0};
+
+            if (copy_from_user(&cfg, data, sizeof(cfg)))
+                return -EFAULT;
+
+            CFG_ETH_EFMTC_CRC->rx_eth_crc_present   = cfg.RxEthCrcPresent ? 1 : 0;
+            CFG_ETH_EFMTC_CRC->rx_eth_crc_check     = cfg.RxEthCrcCheck ? 1 : 0;
+            if ( cfg.RxTcCrcCheck && (cfg.RxTcCrcLen == 16 || cfg.RxTcCrcLen == 32) )
+            {
+                CFG_ETH_EFMTC_CRC->rx_tc_crc_check  = 1;
+                CFG_ETH_EFMTC_CRC->rx_tc_crc_len    = cfg.RxTcCrcLen;
+            }
+            else
+            {
+                CFG_ETH_EFMTC_CRC->rx_tc_crc_check  = 0;
+                CFG_ETH_EFMTC_CRC->rx_tc_crc_len    = 0;
+            }
+            CFG_ETH_EFMTC_CRC->tx_eth_crc_gen       = cfg.TxEthCrcGen ? 1 : 0;
+            if ( cfg.TxTcCrcGen && (cfg.TxTcCrcLen == 16 || cfg.TxTcCrcLen == 32) )
+            {
+                CFG_ETH_EFMTC_CRC->tx_tc_crc_gen    = 1;
+                CFG_ETH_EFMTC_CRC->tx_tc_crc_len    = cfg.TxTcCrcLen;
+            }
+            else
+            {
+                CFG_ETH_EFMTC_CRC->tx_tc_crc_gen    = 0;
+                CFG_ETH_EFMTC_CRC->tx_tc_crc_len    = 0;
+            }
        }
        break;
    default:
--- a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
+++ b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
@ -381,14 +381,24 @@ static int ptm_ioctl(struct net_device *dev, struct ifreq *ifr, void __user *dat
 {
    ASSERT(dev == g_net_dev[0], "incorrect device");

+    if (!capable(CAP_NET_ADMIN))
+        return -EPERM;
+
    switch ( cmd )
    {
    case IFX_PTM_MIB_CW_GET:
-	((PTM_CW_IF_ENTRY_T *)data)->ifRxNoIdleCodewords   = IFX_REG_R32(DREG_AR_CELL0) + IFX_REG_R32(DREG_AR_CELL1);
-        ((PTM_CW_IF_ENTRY_T *)data)->ifRxIdleCodewords     = IFX_REG_R32(DREG_AR_IDLE_CNT0) + IFX_REG_R32(DREG_AR_IDLE_CNT1);
-        ((PTM_CW_IF_ENTRY_T *)data)->ifRxCodingViolation   = IFX_REG_R32(DREG_AR_CVN_CNT0) + IFX_REG_R32(DREG_AR_CVN_CNT1) + IFX_REG_R32(DREG_AR_CVNP_CNT0) + IFX_REG_R32(DREG_AR_CVNP_CNT1);
-        ((PTM_CW_IF_ENTRY_T *)data)->ifTxNoIdleCodewords   = IFX_REG_R32(DREG_AT_CELL0) + IFX_REG_R32(DREG_AT_CELL1);
-        ((PTM_CW_IF_ENTRY_T *)data)->ifTxIdleCodewords     = IFX_REG_R32(DREG_AT_IDLE_CNT0) + IFX_REG_R32(DREG_AT_IDLE_CNT1);
+        {
+            PTM_CW_IF_ENTRY_T tmp = {0};
+
+            tmp.ifRxNoIdleCodewords   = IFX_REG_R32(DREG_AR_CELL0) + IFX_REG_R32(DREG_AR_CELL1);
+            tmp.ifRxIdleCodewords     = IFX_REG_R32(DREG_AR_IDLE_CNT0) + IFX_REG_R32(DREG_AR_IDLE_CNT1);
+            tmp.ifRxCodingViolation   = IFX_REG_R32(DREG_AR_CVN_CNT0) + IFX_REG_R32(DREG_AR_CVN_CNT1) + IFX_REG_R32(DREG_AR_CVNP_CNT0) + IFX_REG_R32(DREG_AR_CVNP_CNT1);
+            tmp.ifTxNoIdleCodewords   = IFX_REG_R32(DREG_AT_CELL0) + IFX_REG_R32(DREG_AT_CELL1);
+            tmp.ifTxIdleCodewords     = IFX_REG_R32(DREG_AT_IDLE_CNT0) + IFX_REG_R32(DREG_AT_IDLE_CNT1);
+
+            if (copy_to_user(data, &tmp, sizeof(tmp)))
+                return -EFAULT;
+        }
        break;
    case IFX_PTM_MIB_FRAME_GET:
 	{
@ -401,38 +411,50 @@ static int ptm_ioctl(struct net_device *dev, struct ifreq *ifr, void __user *dat
            for ( i = 0; i < 8; i++ )
                tmp.TxSend    += WAN_TX_MIB_TABLE(i)->wtx_total_pdu;

-            *((PTM_FRAME_MIB_T *)data) = tmp;
+            if (copy_to_user(data, &tmp, sizeof(tmp)))
+                return -EFAULT;
        }
        break;
    case IFX_PTM_CFG_GET:
-	//  use bear channel 0 preemption gamma interface settings
-        ((IFX_PTM_CFG_T *)data)->RxEthCrcPresent = 1;
-        ((IFX_PTM_CFG_T *)data)->RxEthCrcCheck   = RX_GAMMA_ITF_CFG(0)->rx_eth_fcs_ver_dis == 0 ? 1 : 0;
-        ((IFX_PTM_CFG_T *)data)->RxTcCrcCheck    = RX_GAMMA_ITF_CFG(0)->rx_tc_crc_ver_dis == 0 ? 1 : 0;;
-        ((IFX_PTM_CFG_T *)data)->RxTcCrcLen      = RX_GAMMA_ITF_CFG(0)->rx_tc_crc_size == 0 ? 0 : (RX_GAMMA_ITF_CFG(0)->rx_tc_crc_size * 16);
-        ((IFX_PTM_CFG_T *)data)->TxEthCrcGen     = TX_GAMMA_ITF_CFG(0)->tx_eth_fcs_gen_dis == 0 ? 1 : 0;
-        ((IFX_PTM_CFG_T *)data)->TxTcCrcGen      = TX_GAMMA_ITF_CFG(0)->tx_tc_crc_size == 0 ? 0 : 1;
-        ((IFX_PTM_CFG_T *)data)->TxTcCrcLen      = TX_GAMMA_ITF_CFG(0)->tx_tc_crc_size == 0 ? 0 : (TX_GAMMA_ITF_CFG(0)->tx_tc_crc_size * 16);
+        {
+            IFX_PTM_CFG_T tmp = {0};
+
+            //  use bear channel 0 preemption gamma interface settings
+            tmp.RxEthCrcPresent = 1;
+            tmp.RxEthCrcCheck   = RX_GAMMA_ITF_CFG(0)->rx_eth_fcs_ver_dis == 0 ? 1 : 0;
+            tmp.RxTcCrcCheck    = RX_GAMMA_ITF_CFG(0)->rx_tc_crc_ver_dis == 0 ? 1 : 0;
+            tmp.RxTcCrcLen      = RX_GAMMA_ITF_CFG(0)->rx_tc_crc_size == 0 ? 0 : (RX_GAMMA_ITF_CFG(0)->rx_tc_crc_size * 16);
+            tmp.TxEthCrcGen     = TX_GAMMA_ITF_CFG(0)->tx_eth_fcs_gen_dis == 0 ? 1 : 0;
+            tmp.TxTcCrcGen      = TX_GAMMA_ITF_CFG(0)->tx_tc_crc_size == 0 ? 0 : 1;
+            tmp.TxTcCrcLen      = TX_GAMMA_ITF_CFG(0)->tx_tc_crc_size == 0 ? 0 : (TX_GAMMA_ITF_CFG(0)->tx_tc_crc_size * 16);
+
+            if (copy_to_user(data, &tmp, sizeof(tmp)))
+                return -EFAULT;
+        }
        break;
    case IFX_PTM_CFG_SET:
 	{
+            IFX_PTM_CFG_T cfg;
            int i;

+            if (copy_from_user(&cfg, data, sizeof(cfg)))
+                return -EFAULT;
+
            for ( i = 0; i < 4; i++ ) {
-                RX_GAMMA_ITF_CFG(i)->rx_eth_fcs_ver_dis = ((IFX_PTM_CFG_T *)data)->RxEthCrcCheck ? 0 : 1;
+                RX_GAMMA_ITF_CFG(i)->rx_eth_fcs_ver_dis = cfg.RxEthCrcCheck ? 0 : 1;

-                RX_GAMMA_ITF_CFG(0)->rx_tc_crc_ver_dis = ((IFX_PTM_CFG_T *)data)->RxTcCrcCheck ? 0 : 1;
+                RX_GAMMA_ITF_CFG(0)->rx_tc_crc_ver_dis = cfg.RxTcCrcCheck ? 0 : 1;

-                switch ( ((IFX_PTM_CFG_T *)data)->RxTcCrcLen ) {
+                switch ( cfg.RxTcCrcLen ) {
                    case 16: RX_GAMMA_ITF_CFG(0)->rx_tc_crc_size = 1; break;
                    case 32: RX_GAMMA_ITF_CFG(0)->rx_tc_crc_size = 2; break;
                    default: RX_GAMMA_ITF_CFG(0)->rx_tc_crc_size = 0;
                }

-                TX_GAMMA_ITF_CFG(0)->tx_eth_fcs_gen_dis = ((IFX_PTM_CFG_T *)data)->TxEthCrcGen ? 0 : 1;
+                TX_GAMMA_ITF_CFG(0)->tx_eth_fcs_gen_dis = cfg.TxEthCrcGen ? 0 : 1;

-                if ( ((IFX_PTM_CFG_T *)data)->TxTcCrcGen ) {
-                    switch ( ((IFX_PTM_CFG_T *)data)->TxTcCrcLen ) {
+                if ( cfg.TxTcCrcGen ) {
+                    switch ( cfg.TxTcCrcLen ) {
                        case 16: TX_GAMMA_ITF_CFG(0)->tx_tc_crc_size = 1; break;
                        case 32: TX_GAMMA_ITF_CFG(0)->tx_tc_crc_size = 2; break;
                        default: TX_GAMMA_ITF_CFG(0)->tx_tc_crc_size = 0;
--- a/package/kernel/lantiq/ltq-tapi/patches/616-fix-missing-prototypes-warnings.patch
+++ b/package/kernel/lantiq/ltq-tapi/patches/616-fix-missing-prototypes-warnings.patch
@ -0,0 +1,56 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Thu, 8 May 2025 23:30:39 +0800
+Subject: [PATCH] fix missing prototypes warnings
+
+This patch fixes various missing-prototypes build warnings on
+6.12 kernel:
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_tapi-3.13.0/src/drv_tapi_event.c:2815:13: error: no previous prototype for 'IFX_TAPI_EventWrpBufferPool_ElementCountGet' [-Werror=missing-prototypes]
+ 2815 | IFX_int32_t IFX_TAPI_EventWrpBufferPool_ElementCountGet(IFX_void_t)
+      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_tapi-3.13.0/src/drv_tapi_event.c:2844:13: error: no previous prototype for 'IFX_TAPI_EventWrpBufferPool_ElementAvailCountGet' [-Werror=missing-prototypes]
+ 2844 | IFX_int32_t IFX_TAPI_EventWrpBufferPool_ElementAvailCountGet(IFX_void_t)
+      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_tapi-3.13.0/src/drv_tapi_fxo.c:145:13: error: no previous prototype for 'TAPI_FXO_DAA_Ioctl' [-Werror=missing-prototypes]
+  145 | IFX_int32_t TAPI_FXO_DAA_Ioctl (TAPI_CHANNEL *pChannel,
+      |             ^~~~~~~~~~~~~~~~~~
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_tapi-3.13.0/src/drv_tapi_fxo.c:291:13: error: no previous prototype for 'TAPI_FXO_SmartSlic_Ioctl' [-Werror=missing-prototypes]
+  291 | IFX_int32_t TAPI_FXO_SmartSlic_Ioctl(TAPI_CHANNEL *pChannel,
+      |             ^~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/drv_tapi_event.h | 3 +++
+ src/drv_tapi_fxo.c   | 4 ++--
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/src/drv_tapi_event.h
+++ b/src/drv_tapi_event.h
+@@ -24,4 +24,7 @@
+ #define IFX_EVENT_DISABLE 1
+ #define IFX_EVENT_ENABLE 0
+ 
+IFX_int32_t IFX_TAPI_EventWrpBufferPool_ElementCountGet(IFX_void_t);
+IFX_int32_t IFX_TAPI_EventWrpBufferPool_ElementAvailCountGet(IFX_void_t);
+
+ #endif /* _DRV_TAPIEVENT_H */
+--- a/src/drv_tapi_fxo.c
+++ b/src/drv_tapi_fxo.c
+@@ -142,7 +142,7 @@ IFX_return_t IFX_TAPI_FXO_Event_Dispatch
+    \remarks
+       This function is called if DAA TAPI plugin is used for FXO handling.
+ */
+-IFX_int32_t TAPI_FXO_DAA_Ioctl (TAPI_CHANNEL *pChannel,
+static IFX_int32_t TAPI_FXO_DAA_Ioctl (TAPI_CHANNEL *pChannel,
+                                 IFX_uint32_t cmd,
+                                 IFX_ulong_t arg)
+ {
+@@ -288,7 +288,7 @@ IFX_int32_t TAPI_FXO_DAA_Ioctl (TAPI_CHA
+       This function is called if LL driver is used for FXO ioctl handling.
+       Used on systems which have SmartSLIC with fused FXO line(s).
+ */
+-IFX_int32_t TAPI_FXO_SmartSlic_Ioctl(TAPI_CHANNEL *pChannel,
+static IFX_int32_t TAPI_FXO_SmartSlic_Ioctl(TAPI_CHANNEL *pChannel,
+                                      IFX_uint32_t cmd,
+                                      IFX_ulong_t arg)
+ {
--- a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/132-add-missing-prototype-for-ifx_mei_atm_led_blink.patch
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/132-add-missing-prototype-for-ifx_mei_atm_led_blink.patch
@ -0,0 +1,24 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Wed, 7 May 2025 21:57:39 +0800
+Subject: [PATCH] add missing prototype for ifx_mei_atm_led_blink()
+
+Fix build warning on 6.12 kernel:
+/home/db/owrt/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx_generic/dsl_cpe_mei-ugw_8.5.2.10/src/drv_mei_cpe_api_atm_ptm_intern.c:658:5: error: no previous prototype for 'ifx_mei_atm_led_blink' [-Werror=missing-prototypes]
+  658 | int ifx_mei_atm_led_blink(void)
+      |     ^~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/drv_mei_cpe_api_atm_ptm_intern.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/drv_mei_cpe_api_atm_ptm_intern.h
+++ b/src/drv_mei_cpe_api_atm_ptm_intern.h
+@@ -91,6 +91,7 @@ extern IFX_int32_t MEI_InternalLineTCMod
+                               IFX_int8_t nInstance,
+                               IFX_boolean_t bPowerUp,
+                               IFX_boolean_t bKillMEIControlThread);
+int ifx_mei_atm_led_blink(void);
+ 
+ #ifdef PPA_SUPPORTS_CALLBACKS
+ extern int ppa_callback_set(e_ltq_mei_cb_type type, void *func);
--- a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/133-convert-platform-driver-.remove-to-.remove_new.patch
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/133-convert-platform-driver-.remove-to-.remove_new.patch
@ -0,0 +1,43 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Wed, 7 May 2025 22:07:16 +0800
+Subject: [PATCH] convert platform driver .remove to .remove_new
+
+Fix build error on 6.12 kernel:
+
+/home/db/owrt/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx_generic/dsl_cpe_mei-ugw_8.5.2.10/src/drv_mei_cpe_linux.c:2270:14: error: initialization of 'void (*)(struct platform_device *)' from incompatible pointer type 'int (*)(struct platform_device *)' [-Wincompatible-pointer-types]
+ 2270 |    .remove = ltq_dsl_cpe_mei_remove,
+      |              ^~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/drv_mei_cpe_linux.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/src/drv_mei_cpe_linux.c
+++ b/src/drv_mei_cpe_linux.c
+@@ -2234,7 +2234,7 @@ static int dev_found = 0;
+ /* containt the number of devices registered in module_init */
+ static int dev_registered = 0;
+ 
+-static int ltq_dsl_cpe_mei_remove(struct platform_device *pdev)
+static void ltq_dsl_cpe_mei_remove(struct platform_device *pdev)
+ {
+    /* clear platform */
+    MEI_DEVICE_CFG_VALUE_SET(platform, e_MEI_DEV_PLATFORM_CONFIG_UNKNOWN);
+@@ -2244,7 +2244,6 @@ static int ltq_dsl_cpe_mei_remove(struct
+         dev_registered--;
+     }
+ #endif
+-   return 0;
+ }
+ 
+ static const struct of_device_id ltq_dsl_cpe_mei_match[] = {
+@@ -2267,7 +2266,7 @@ static struct platform_driver ltq_dsl_cp
+       .owner          = THIS_MODULE,
+       .of_match_table = ltq_dsl_cpe_mei_match,
+    },
+-   .remove = ltq_dsl_cpe_mei_remove,
+   .remove_new = ltq_dsl_cpe_mei_remove,
+ };
+ 
+ static int ltq_dsl_cpe_mei_reboot_notifier(struct notifier_block *nb,
--- a/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/134-fix-ignored-qualifiers-build-warning.patch
+++ b/package/kernel/lantiq/ltq-vdsl-vr11-mei/patches/134-fix-ignored-qualifiers-build-warning.patch
@ -0,0 +1,50 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Wed, 7 May 2025 22:53:48 +0800
+Subject: [PATCH] fix ignored-qualifiers build warnings
+
+This patch fixes the following build warnings:
+
+/home/db/owrt/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx_generic/dsl_cpe_mei-ugw_8.5.2.10/src/drv_mei_cpe_mei_access_vrx.c:41:15: error: type qualifiers ignored on function return type [-Werror=ignored-qualifiers]
+   41 | static inline volatile IFX_uint32_t MEI_RCU_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+      |               ^~~~~~~~
+/home/db/owrt/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx_generic/dsl_cpe_mei-ugw_8.5.2.10/src/drv_mei_cpe_mei_access_vrx.c:55:15: error: type qualifiers ignored on function return type [-Werror=ignored-qualifiers]
+   55 | static inline volatile IFX_uint32_t MEI_CGU_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+      |               ^~~~~~~~
+/home/db/owrt/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx_generic/dsl_cpe_mei-ugw_8.5.2.10/src/drv_mei_cpe_mei_access_vrx.c:63:15: error: type qualifiers ignored on function return type [-Werror=ignored-qualifiers]
+   63 | static inline volatile IFX_uint32_t MEI_RCU_Slave_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+      |               ^~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/drv_mei_cpe_mei_access_vrx.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/src/drv_mei_cpe_mei_access_vrx.c
+++ b/src/drv_mei_cpe_mei_access_vrx.c
+@@ -38,7 +38,7 @@
+    Local macro definition
+    ========================================================================= */
+ 
+-static inline volatile IFX_uint32_t MEI_RCU_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+static inline IFX_uint32_t MEI_RCU_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+ {
+    IFX_uint32_t ret = 0;
+    if (MEI_DEVICE_CFG_IS_PLATFORM(e_MEI_DEV_PLATFORM_CONFIG_VR9))
+@@ -52,7 +52,7 @@ static inline volatile IFX_uint32_t MEI_
+    return ret;
+ }
+ #if (MEI_SUPPORT_DEVICE_VR11 == 1)
+-static inline volatile IFX_uint32_t MEI_CGU_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+static inline IFX_uint32_t MEI_CGU_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+ {
+    IFX_uint32_t ret = 0;
+    ret = (MEI_DRV_PCIE_VIRT_MEMBASE_GET(pMeiDrvCntrl) | MEI_CGU_OFFSET);
+@@ -60,7 +60,7 @@ static inline volatile IFX_uint32_t MEI_
+ }
+ #endif
+ 
+-static inline volatile IFX_uint32_t MEI_RCU_Slave_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+static inline IFX_uint32_t MEI_RCU_Slave_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+ {
+    IFX_uint32_t ret = 0;
+    if (MEI_DEVICE_CFG_IS_PLATFORM(e_MEI_DEV_PLATFORM_CONFIG_VR9))
--- a/package/kernel/lantiq/ltq-vdsl-vr11/patches/301-fix-missing-prototypes-warnings.patch
+++ b/package/kernel/lantiq/ltq-vdsl-vr11/patches/301-fix-missing-prototypes-warnings.patch
@ -0,0 +1,172 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Wed, 7 May 2025 23:22:11 +0800
+Subject: [PATCH] fix missing prototypes warnings
+
+This patch fixes various missing-prototypes build warnings on
+6.12 kernel.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/bnd/drv_dsl_cpe_api_bnd_vrx.c   |  2 +-
+ src/common/drv_dsl_cpe_api.c        | 16 ++++++++--------
+ src/common/drv_dsl_cpe_os_linux.c   |  4 ++--
+ src/device/drv_dsl_cpe_device_vrx.c |  2 +-
+ src/g997/drv_dsl_cpe_api_g997_vrx.c |  1 +
+ src/include/drv_dsl_cpe_intern.h    |  6 +++---
+ 6 files changed, 16 insertions(+), 15 deletions(-)
+
+--- a/src/bnd/drv_dsl_cpe_api_bnd_vrx.c
+++ b/src/bnd/drv_dsl_cpe_api_bnd_vrx.c
+@@ -75,7 +75,7 @@ static DSL_Error_t DSL_DRV_BND_VRX_HsCon
+    - DSL_SUCCESS in case of success
+    - DSL_ERROR if operation failed
+ */
+-DSL_Error_t DSL_DRV_BND_VRX_PafHsStatusGet(
+static DSL_Error_t DSL_DRV_BND_VRX_PafHsStatusGet(
+    DSL_Context_t *pContext,
+    DSL_BND_VRX_PafHsStatus_t *pData)
+ {
+--- a/src/common/drv_dsl_cpe_api.c
+++ b/src/common/drv_dsl_cpe_api.c
+@@ -3873,7 +3873,7 @@ DSL_Error_t DSL_DRV_LoopLengthStatusGet(
+    return nErrCode;
+ }
+ 
+-DSL_Error_t DSL_DRV_RetxStatisticsGet(
+static DSL_Error_t DSL_DRV_RetxStatisticsGet(
+    DSL_IN DSL_Context_t *pContext,
+    DSL_IN_OUT DSL_ReTxStatistics_t *pData)
+ {
+@@ -4053,7 +4053,7 @@ DSL_Error_t DSL_DRV_SystemInterfaceConfi
+    \ref DSL_FIO_SYSTEM_INTERFACE_STATUS_GET
+ */
+ #ifdef INCLUDE_DSL_SYSTEM_INTERFACE
+-DSL_Error_t DSL_DRV_SystemInterfaceStatusGet(
+static DSL_Error_t DSL_DRV_SystemInterfaceStatusGet(
+    DSL_Context_t *pContext,
+    DSL_SystemInterfaceStatus_t *pData)
+ {
+@@ -5593,7 +5593,7 @@ DSL_Error_t DSL_DRV_DBG_DebugFeatureConf
+ #endif /* DSL_DEBUG_DISABLE*/
+ 
+ #ifdef INCLUDE_DSL_FILTER_DETECTION
+-DSL_Error_t DSL_DRV_FilterDetectionDataGet(
+static DSL_Error_t DSL_DRV_FilterDetectionDataGet(
+    DSL_IN DSL_Context_t *pContext,
+    DSL_OUT DSL_FilterDetection_t *pData)
+ {
+@@ -5742,7 +5742,7 @@ DSL_Error_t DSL_DRV_FilterDetectionBasic
+ }
+ #endif /* INCLUDE_DSL_FILTER_DETECTION */
+ 
+-DSL_Error_t DSL_DRV_HybridSelectionDataGet(
+static DSL_Error_t DSL_DRV_HybridSelectionDataGet(
+    DSL_IN DSL_Context_t *pContext,
+    DSL_OUT DSL_HybridSelection_t *pData)
+ {
+@@ -5804,7 +5804,7 @@ DSL_Error_t DSL_DRV_HybridSelectionDataG
+    return nErrCode;
+ }
+ 
+-DSL_Error_t DSL_DRV_OlrStatisticsGet(
+static DSL_Error_t DSL_DRV_OlrStatisticsGet(
+    DSL_IN DSL_Context_t *pContext,
+    DSL_OUT DSL_OlrStatistics_t *pData)
+ {
+@@ -5932,7 +5932,7 @@ DSL_void_t DSL_DRV_InitDataFree(
+ #endif /* INCLUDE_DSL_INIT_DATA_PREPARE*/
+ }
+ 
+-DSL_Error_t DSL_DRV_IoctlHandleHelperCall(
+static DSL_Error_t DSL_DRV_IoctlHandleHelperCall(
+    DSL_OpenContext_t *pOpenCtx,
+    DSL_Context_t *pContext,
+    DSL_boolean_t bIsInKernel,
+@@ -6573,7 +6573,7 @@ DSL_Error_t DSL_DRV_T1413_XTUR_VendorRev
+    return nErrCode;
+ }
+ 
+-DSL_Error_t DSL_DRV_PSDCalibrationConfigGet(
+static DSL_Error_t DSL_DRV_PSDCalibrationConfigGet(
+    DSL_IN DSL_Context_t *pContext,
+    DSL_IN_OUT DSL_PSDCalibration_t *pData)
+ {
+@@ -6608,7 +6608,7 @@ DSL_Error_t DSL_DRV_PSDCalibrationConfig
+    return nErrCode;
+ }
+ 
+-DSL_Error_t DSL_DRV_PSDCalibrationConfigSet(
+static DSL_Error_t DSL_DRV_PSDCalibrationConfigSet(
+    DSL_IN DSL_Context_t *pContext,
+    DSL_IN_OUT DSL_PSDCalibration_t *pData)
+ {
+--- a/src/common/drv_dsl_cpe_os_linux.c
+++ b/src/common/drv_dsl_cpe_os_linux.c
+@@ -1341,7 +1341,7 @@ static void DSL_DRV_NlSendMsg(DSL_char_t
+ #endif
+ 
+ /* Entry point of driver */
+-int __init DSL_ModuleInit(void)
+static int __init DSL_ModuleInit(void)
+ {
+    DSL_int_t i;
+ 
+@@ -1457,7 +1457,7 @@ void DSL_ModuleCleanup(void)
+    return;
+ }
+ 
+-void __exit DSL_ModuleExit(void)
+static void __exit DSL_ModuleExit(void)
+ {
+    printk("DSL: Unloading module" DSL_DRV_CRLF);
+ 
+--- a/src/device/drv_dsl_cpe_device_vrx.c
+++ b/src/device/drv_dsl_cpe_device_vrx.c
+@@ -6914,7 +6914,7 @@ DSL_Error_t DSL_DRV_VRX_ShowtimeMeasurem
+    return nErrCode;
+ }
+ 
+-DSL_Error_t DSL_DRV_VRX_ShowtimeBasicMFDMeasurementUpdate(DSL_Context_t *pContext)
+static DSL_Error_t DSL_DRV_VRX_ShowtimeBasicMFDMeasurementUpdate(DSL_Context_t *pContext)
+ {
+    DSL_Error_t nErrCode = DSL_SUCCESS;
+    ACK_MFD_InitResultsGet_t sInitResultAck = { 0 };
+--- a/src/g997/drv_dsl_cpe_api_g997_vrx.c
+++ b/src/g997/drv_dsl_cpe_api_g997_vrx.c
+@@ -11,6 +11,7 @@
+ #define DSL_INTERN
+ 
+ #include "drv_dsl_cpe_api.h"
+#include "drv_dsl_cpe_device_g997.h"
+ 
+ #ifdef INCLUDE_DSL_CPE_API_VRX
+ 
+--- a/src/include/drv_dsl_cpe_intern.h
+++ b/src/include/drv_dsl_cpe_intern.h
+@@ -1151,7 +1151,7 @@ DSL_Error_t DSL_DRV_InteropFeatureConfig
+    For a detailed description please refer to the equivalent ioctl
+    \ref DSL_FIO_RETX_STATISTICS_GET
+ */
+-#ifdef INCLUDE_DSL_CPE_API_DANUBE
+#if defined(INCLUDE_DSL_CPE_API_DANUBE) && 0
+ #ifndef SWIG_TMP
+ DSL_Error_t DSL_DRV_RetxStatisticsGet(
+    DSL_IN DSL_Context_t *pContext,
+@@ -1436,7 +1436,7 @@ DSL_Error_t DSL_DRV_SystemInterfaceConfi
+    For a detailed description please refer to the equivalent ioctl
+    \ref DSL_FIO_FILTER_DETECTION_DATA_GET
+ */
+-#if defined(INCLUDE_DSL_CPE_API_DANUBE) && defined(INCLUDE_DSL_FILTER_DETECTION)
+#if defined(INCLUDE_DSL_CPE_API_DANUBE) && defined(INCLUDE_DSL_FILTER_DETECTION) && 0
+ #ifndef SWIG_TMP
+ DSL_Error_t DSL_DRV_FilterDetectionDataGet(
+    DSL_IN DSL_Context_t *pContext,
+@@ -1462,7 +1462,7 @@ DSL_Error_t DSL_DRV_FilterDetectionBasic
+    For a detailed description please refer to the equivalent ioctl
+    \ref DSL_FIO_HYBRID_SELECTION_DATA_GET
+ */
+-#ifdef INCLUDE_DSL_CPE_API_DANUBE
+#if defined(INCLUDE_DSL_CPE_API_DANUBE) && 0
+ #ifndef SWIG_TMP
+ DSL_Error_t DSL_DRV_HybridSelectionDataGet(
+    DSL_IN DSL_Context_t *pContext,
--- a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/100-compat.patch
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/100-compat.patch
@ -313,17 +313,22 @@
 
 #if (MEI_EXPORT_INTERNAL_API == 1) && (MEI_DRV_ATM_PTM_INTERFACE_ENABLE == 1)
 
-@@ -59,8 +58,21 @@ extern IFX_int32_t MEI_InternalTcReset(
+@@ -58,9 +57,26 @@ extern IFX_int32_t MEI_InternalTcRequest
+ extern IFX_int32_t MEI_InternalTcReset(
                               MEI_DYN_CNTRL_T        *pMeiDynCntrl,
                               MEI_TC_Reset_t         *pArgTcReset);
- 
+struct port_cell_info;
+extern int ifx_mei_atm_showtime_check(int *is_showtime,
+                              struct port_cell_info *port_cell,
+                              void **xdata_addr);
+
 +#if 1
 +#include <lantiq_atm.h>
 +typedef enum {
 +	LTQ_MEI_SHOWTIME_ENTER,
 +	LTQ_MEI_SHOWTIME_EXIT
 +} e_ltq_mei_cb_type;
-+
+ 
 +typedef void (*ltq_mei_atm_showtime_enter_t)(IFX_uint8_t, struct port_cell_info *, void *);
 +typedef void (*ltq_mei_atm_showtime_exit_t)(IFX_uint8_t);
 +
--- a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/405-convert-platform-driver-.remove-to-.remove_new.patch
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/405-convert-platform-driver-.remove-to-.remove_new.patch
@ -0,0 +1,41 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 00:54:48 +0800
+Subject: [PATCH] convert platform driver .remove to .remove_new
+
+Fix compilation error on 6.12 kernel:
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_mei_cpe-1.5.17.6/src/drv_mei_cpe_linux.c:2073:23: error: initialization of 'void (*)(struct platform_device *)' from incompatible pointer type 'int (*)(struct platform_device *)' [-Wincompatible-pointer-types]
+ 2073 |    .remove = __exit_p(ltq_dsl_cpe_mei_remove),
+      |                       ^~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/drv_mei_cpe_linux.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/src/drv_mei_cpe_linux.c
+++ b/src/drv_mei_cpe_linux.c
+@@ -2048,13 +2048,12 @@ static int MEI_InstallProcEntry(unsigned
+ #endif
+ 
+ #if (LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0))
+-static int __exit ltq_dsl_cpe_mei_remove(struct platform_device *pdev)
+static void __exit ltq_dsl_cpe_mei_remove(struct platform_device *pdev)
+ {
+    MEI_module_exit();
+ 
+    /* clear platform */
+    MEI_DEVICE_CFG_VALUE_SET(platform, e_MEI_DEV_PLATFORM_CONFIG_UNKNOWN);
+-   return 0;
+ }
+ 
+ static const struct of_device_id ltq_dsl_cpe_mei_match[] = {
+@@ -2070,7 +2069,7 @@ static struct platform_driver ltq_dsl_cp
+       .owner          = THIS_MODULE,
+       .of_match_table = ltq_dsl_cpe_mei_match,
+    },
+-   .remove = __exit_p(ltq_dsl_cpe_mei_remove),
+   .remove_new = __exit_p(ltq_dsl_cpe_mei_remove),
+ };
+ 
+ static int __init ltq_dsl_cpe_mei_probe(struct platform_device *pdev)
--- a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/406-fix-ignored-qualifiers-build-warnings.patch
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/406-fix-ignored-qualifiers-build-warnings.patch
@ -0,0 +1,38 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 00:58:00 +0800
+Subject: [PATCH] fix ignored-qualifiers build warnings
+
+This patch fixes the following build warnings:
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_mei_cpe-1.5.17.6/src/drv_mei_cpe_mei_access_vrx.c:41:15: error: type qualifiers ignored on function return type [-Werror=ignored-qualifiers]
+   41 | static inline volatile IFX_uint32_t MEI_RCU_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+      |               ^~~~~~~~
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_mei_cpe-1.5.17.6/src/drv_mei_cpe_mei_access_vrx.c:56:15: error: type qualifiers ignored on function return type [-Werror=ignored-qualifiers]
+   56 | static inline volatile IFX_uint32_t MEI_RCU_Slave_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+      |               ^~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/drv_mei_cpe_mei_access_vrx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/src/drv_mei_cpe_mei_access_vrx.c
+++ b/src/drv_mei_cpe_mei_access_vrx.c
+@@ -38,7 +38,7 @@
+    Local macro definition
+    ========================================================================= */
+ 
+-static inline volatile IFX_uint32_t MEI_RCU_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+static inline IFX_uint32_t MEI_RCU_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+ {
+    IFX_uint32_t ret = 0;
+    if (MEI_DEVICE_CFG_IS_PLATFORM(e_MEI_DEV_PLATFORM_CONFIG_VR9))
+@@ -53,7 +53,7 @@ static inline volatile IFX_uint32_t MEI_
+    return ret;
+ }
+ 
+-static inline volatile IFX_uint32_t MEI_RCU_Slave_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+static inline IFX_uint32_t MEI_RCU_Slave_get(MEI_MEI_DRV_CNTRL_T *pMeiDrvCntrl)
+ {
+    IFX_uint32_t ret = 0;
+    if (MEI_DEVICE_CFG_IS_PLATFORM(e_MEI_DEV_PLATFORM_CONFIG_VR9))
--- a/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/407-fix-missing-prototypes-warnings.patch
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/patches/407-fix-missing-prototypes-warnings.patch
@ -0,0 +1,53 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 01:10:32 +0800
+Subject: [PATCH] fix missing prototypes warnings
+
+This patch fixes various missing-prototypes build warnings on
+6.12 kernel.
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_mei_cpe-1.5.17.6/src/drv_mei_cpe_api_atm_ptm_intern.c:314:5: error: no previous prototype for 'ifx_mei_atm_led_blink' [-Werror=missing-prototypes]
+  314 | int ifx_mei_atm_led_blink(void)
+      |     ^~~~~~~~~~~~~~~~~~~~~
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_mei_cpe-1.5.17.6/src/drv_mei_cpe_api_atm_ptm_intern.c:325:5: error: no previous prototype for 'ltq_ifx_mei_atm_showtime_enter_compat' [-Werror=missing-prototypes]
+  325 | int ltq_ifx_mei_atm_showtime_enter_compat(IFX_uint8_t dslLineNum,
+      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_mei_cpe-1.5.17.6/src/drv_mei_cpe_api_atm_ptm_intern.c:334:5: error: no previous prototype for 'ltq_ifx_mei_atm_showtime_exit_compat' [-Werror=missing-prototypes]
+  334 | int ltq_ifx_mei_atm_showtime_exit_compat(IFX_uint8_t dslLineNum) {
+      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/drv_mei_cpe_api_atm_ptm_intern.c | 4 ++--
+ src/drv_mei_cpe_api_atm_ptm_intern.h | 1 +
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/src/drv_mei_cpe_api_atm_ptm_intern.c
+++ b/src/drv_mei_cpe_api_atm_ptm_intern.c
+@@ -322,7 +322,7 @@ int ifx_mei_atm_led_blink(void)
+ int (*ifx_mei_atm_showtime_enter)(struct port_cell_info *, void *) = NULL;
+ int (*ifx_mei_atm_showtime_exit)(void) = NULL;
+ 
+-int ltq_ifx_mei_atm_showtime_enter_compat(IFX_uint8_t dslLineNum,
+static int ltq_ifx_mei_atm_showtime_enter_compat(IFX_uint8_t dslLineNum,
+ 				      struct port_cell_info *cellInfo,
+ 				      void *xdata) {
+ 	if (ifx_mei_atm_showtime_enter)
+@@ -331,7 +331,7 @@ int ltq_ifx_mei_atm_showtime_enter_compa
+ 	return -e_MEI_ERR_OP_FAILED;
+ }
+ 
+-int ltq_ifx_mei_atm_showtime_exit_compat(IFX_uint8_t dslLineNum) {
+static int ltq_ifx_mei_atm_showtime_exit_compat(IFX_uint8_t dslLineNum) {
+ 	if (ifx_mei_atm_showtime_exit)
+ 		return ifx_mei_atm_showtime_exit();
+ 
+--- a/src/drv_mei_cpe_api_atm_ptm_intern.h
+++ b/src/drv_mei_cpe_api_atm_ptm_intern.h
+@@ -61,6 +61,7 @@ struct port_cell_info;
+ extern int ifx_mei_atm_showtime_check(int *is_showtime,
+                               struct port_cell_info *port_cell,
+                               void **xdata_addr);
+extern int ifx_mei_atm_led_blink(void);
+ 
+ #if 1
+ #include <lantiq_atm.h>
--- a/package/kernel/lantiq/ltq-vdsl-vr9/patches/303-fix-missing-prototypes-warning.patch
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/patches/303-fix-missing-prototypes-warning.patch
@ -0,0 +1,100 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 02:48:52 +0800
+Subject: [PATCH] fix missing-prototypes warning
+
+This patch fixes various missing-prototypes build warnings on
+6.12 kernel.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/common/drv_dsl_cpe_api.c        | 12 ++++++------
+ src/common/drv_dsl_cpe_os_linux.c   |  4 ++--
+ src/g997/drv_dsl_cpe_api_g997_vrx.c |  1 +
+ 3 files changed, 9 insertions(+), 8 deletions(-)
+
+--- a/src/common/drv_dsl_cpe_api.c
+++ b/src/common/drv_dsl_cpe_api.c
+@@ -2871,7 +2871,7 @@ DSL_Error_t DSL_DRV_LoopLengthStatusGet(
+    return nErrCode;
+ }
+ 
+-DSL_Error_t DSL_DRV_RetxStatisticsGet(
+static DSL_Error_t DSL_DRV_RetxStatisticsGet(
+    DSL_IN DSL_Context_t *pContext,
+    DSL_IN_OUT DSL_ReTxStatistics_t *pData)
+ {
+@@ -3044,7 +3044,7 @@ DSL_Error_t DSL_DRV_SystemInterfaceConfi
+    \ref DSL_FIO_SYSTEM_INTERFACE_STATUS_GET
+ */
+ #ifdef INCLUDE_DSL_SYSTEM_INTERFACE
+-DSL_Error_t DSL_DRV_SystemInterfaceStatusGet(
+static DSL_Error_t DSL_DRV_SystemInterfaceStatusGet(
+    DSL_Context_t *pContext,
+    DSL_SystemInterfaceStatus_t *pData)
+ {
+@@ -4372,7 +4372,7 @@ DSL_Error_t DSL_DRV_DBG_DebugFeatureConf
+ #endif /* DSL_DEBUG_DISABLE*/
+ 
+ #ifdef INCLUDE_DSL_FILTER_DETECTION
+-DSL_Error_t DSL_DRV_FilterDetectionDataGet(
+static DSL_Error_t DSL_DRV_FilterDetectionDataGet(
+    DSL_IN DSL_Context_t *pContext,
+    DSL_OUT DSL_FilterDetection_t *pData)
+ {
+@@ -4422,7 +4422,7 @@ DSL_Error_t DSL_DRV_FilterDetectionDataG
+ }
+ #endif /* INCLUDE_DSL_FILTER_DETECTION */
+ 
+-DSL_Error_t DSL_DRV_HybridSelectionDataGet(
+static DSL_Error_t DSL_DRV_HybridSelectionDataGet(
+    DSL_IN DSL_Context_t *pContext,
+    DSL_OUT DSL_HybridSelection_t *pData)
+ {
+@@ -4476,7 +4476,7 @@ DSL_Error_t DSL_DRV_HybridSelectionDataG
+    return nErrCode;
+ }
+ 
+-DSL_Error_t DSL_DRV_OlrStatisticsGet(
+static DSL_Error_t DSL_DRV_OlrStatisticsGet(
+    DSL_IN DSL_Context_t *pContext,
+    DSL_OUT DSL_OlrStatistics_t *pData)
+ {
+@@ -4596,7 +4596,7 @@ DSL_void_t DSL_DRV_InitDataFree(
+ #endif /* INCLUDE_DSL_INIT_DATA_PREPARE*/
+ }
+ 
+-DSL_Error_t DSL_DRV_IoctlHandleHelperCall(
+static DSL_Error_t DSL_DRV_IoctlHandleHelperCall(
+    DSL_OpenContext_t *pOpenCtx,
+    DSL_Context_t *pContext,
+    DSL_boolean_t bIsInKernel,
+--- a/src/common/drv_dsl_cpe_os_linux.c
+++ b/src/common/drv_dsl_cpe_os_linux.c
+@@ -1214,7 +1214,7 @@ static struct class *dsl_class;
+ static dev_t dsl_devt;
+ 
+ /* Entry point of driver */
+-int __init DSL_ModuleInit(void)
+static int __init DSL_ModuleInit(void)
+ {
+    DSL_int_t i;
+ 
+@@ -1262,7 +1262,7 @@ int __init DSL_ModuleInit(void)
+    return 0;
+ }
+ 
+-void __exit DSL_ModuleCleanup(void)
+static void __exit DSL_ModuleCleanup(void)
+ {
+    printk("Module will be unloaded"DSL_DRV_CRLF);
+ 
+--- a/src/g997/drv_dsl_cpe_api_g997_vrx.c
+++ b/src/g997/drv_dsl_cpe_api_g997_vrx.c
+@@ -11,6 +11,7 @@
+ #define DSL_INTERN
+ 
+ #include "drv_dsl_cpe_api.h"
+#include "drv_dsl_cpe_device_g997.h"
+ 
+ #ifdef INCLUDE_DSL_CPE_API_VRX
+ 
--- a/package/kernel/lantiq/ltq-vmmc/patches/021-ignore-missing-prototypes-warning.patch
+++ b/package/kernel/lantiq/ltq-vmmc/patches/021-ignore-missing-prototypes-warning.patch
@ -0,0 +1,29 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 08:22:25 +0800
+Subject: [PATCH] ignore missing-prototypes warning
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/Makefile.am | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/src/Makefile.am
+++ b/src/Makefile.am
+@@ -226,6 +226,8 @@ install-exec-hook: $(bin_PROGRAMS)
+ if KERNEL_2_6
+ drv_vmmc_OBJS = "$(subst .c,.o, $(drv_vmmc_SOURCES) $(nodist_drv_vmmc_SOURCES))"
+ 
+PKGFIX_CFLAGS = -Wno-error=missing-prototypes
+
+ drv_vmmc.ko: $(drv_vmmc_SOURCES) $(EXTRA_DIST)
+ 	@echo "Making Linux 2.6.x kernel object"
+ 	@for f in $(drv_vmmc_SOURCES) $(nodist_drv_vmmc_SOURCES) ; do \
+@@ -238,7 +240,7 @@ drv_vmmc.ko: $(drv_vmmc_SOURCES) $(EXTRA
+ 	@echo "# drv_vmmc: Generated to build Linux 2.6.x kernel object" > $(PWD)/Kbuild
+ 	@echo "obj-m := $(subst .ko,.o,$@)"			>> $(PWD)/Kbuild
+ 	@echo "$(subst .ko,,$@)-y := $(drv_vmmc_OBJS)"	>> $(PWD)/Kbuild
+-	@echo "EXTRA_CFLAGS := -DHAVE_CONFIG_H $(drv_vmmc_CFLAGS) $(INCLUDES)"	>> $(PWD)/Kbuild
+	@echo "EXTRA_CFLAGS := -DHAVE_CONFIG_H $(drv_vmmc_CFLAGS) $(PKGFIX_CFLAGS) $(INCLUDES)" >> $(PWD)/Kbuild
+ 	$(MAKE) ARCH=@KERNEL_ARCH@ -C @KERNEL_BUILD_PATH@ O=@KERNEL_BUILD_PATH@ M=$(PWD) modules
+ 
+ clean-generic:
--- a/package/kernel/lantiq/ltq-vmmc/patches/500-ar9_vr9.patch
+++ b/package/kernel/lantiq/ltq-vmmc/patches/500-ar9_vr9.patch
@ -18,7 +18,7 @@
 #include "drv_mps_vmmc_dbg.h"
 #include "drv_mps_vmmc_device.h"
 
-+const void (*ifx_bsp_basic_mps_decrypt)(unsigned int addr, int n) = NULL;
+void (*ifx_bsp_basic_mps_decrypt)(unsigned int addr, int n) = NULL;
 +
 +#define IFX_MPS_SRAM IFXMIPS_MPS_SRAM
 +
@ -106,13 +106,13 @@
       pFWDwnld->length -= sizeof(IFX_uint32_t);
 +      switch(ltq_soc_type()) {
 +   	   case SOC_TYPE_AR9:
-+		   ifx_bsp_basic_mps_decrypt = (const void (*)(unsigned int, int))0xbf0017c4;
+		   ifx_bsp_basic_mps_decrypt = (void (*)(unsigned int, int))0xbf0017c4;
 +		   break;
 +	   case SOC_TYPE_VR9:
-+		   ifx_bsp_basic_mps_decrypt = (const void (*)(unsigned int, int))0xbf001ea4;
+		   ifx_bsp_basic_mps_decrypt = (void (*)(unsigned int, int))0xbf001ea4;
 +		   break;
 +	   case SOC_TYPE_VR9_2:
-+		   ifx_bsp_basic_mps_decrypt = (const void (*)(unsigned int, int))0xbf001f38;
+		   ifx_bsp_basic_mps_decrypt = (void (*)(unsigned int, int))0xbf001f38;
 +		   break;
 +      }
 +      if (ifx_bsp_basic_mps_decrypt)
--- a/package/kernel/lantiq/ltq-vmmc/patches/606-fix-version-macro-definition-conflicts-on-6.12-kerne.patch
+++ b/package/kernel/lantiq/ltq-vmmc/patches/606-fix-version-macro-definition-conflicts-on-6.12-kerne.patch
@ -0,0 +1,143 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Thu, 8 May 2025 23:53:01 +0800
+Subject: [PATCH] fix version macro definition conflicts on 6.12 kernel
+
+Add LANTIQ prefix before MIN/MAX to fix:
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_vmmc-1.9.0/src/drv_vmmc_init.c:91:9: error: "MAX" redefined [-Werror]
+   91 | #define MAX(x,y) ((x) > (y) ? (x) : (y))
+      |         ^~~
+./include/linux/minmax.h:330:9: note: this is the location of the previous definition
+  330 | #define MAX(a,b) __cmp(max,a,b)
+      |         ^~~
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_vmmc-1.9.0/src/drv_vmmc_init_cap.c:42:9: error: "MIN" redefined [-Werror]
+   42 | #define MIN(x,y) ({ (x) < (y) ? (x) : (y); })
+      |         ^~~
+./include/linux/minmax.h:329:9: note: this is the location of the previous definition
+  329 | #define MIN(a,b) __cmp(min,a,b)
+      |         ^~~
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_vmmc-1.9.0/src/drv_vmmc_sig_cptd.c:41:9: error: "MAX" redefined [-Werror]
+   41 | #define MAX(x,y) ((x) > (y) ? (x) : (y))
+      |         ^~~
+./include/linux/minmax.h:330:9: note: this is the location of the previous definition
+  330 | #define MAX(a,b) __cmp(max,a,b)
+      |         ^~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/drv_vmmc_init.c     | 12 ++++++------
+ src/drv_vmmc_init_cap.c |  4 ++--
+ src/drv_vmmc_sig_cptd.c |  4 ++--
+ 3 files changed, 10 insertions(+), 10 deletions(-)
+
+--- a/src/drv_vmmc_init.c
+++ b/src/drv_vmmc_init.c
+@@ -88,7 +88,7 @@ CREATE_TRACE_GROUP(VMMC);
+ /** what compatible driver version */
+ #define DRV_VMMC_WHAT_STR "@(#)Lantiq VMMC device driver, version " DRV_VMMC_VER_STR
+ 
+-#define MAX(x,y) ((x) > (y) ? (x) : (y))
+#define LANTIQ_MAX(x,y) ((x) > (y) ? (x) : (y))
+ 
+ #define MPS_CH_VALID(mpsCh)      ((mpsCh >= 1 && mpsCh <= 7) ? 1 : 0)
+ 
+@@ -927,17 +927,17 @@ static IFX_int32_t VMMC_TAPI_LL_FW_Init(
+ 
+       /* Maximum number of resources, is the maximum of:
+          nALI, nPCM, nCOD, nSIG, nDECT, nLIN and nAudioCnt. */
+-      tmp1 = MAX (pDev->caps.nALI, pDev->caps.nPCM);
+-      tmp2 = MAX (pDev->caps.nCOD, pDev->caps.nSIG);
+-      pDev->caps.nMaxRes = MAX(tmp1, tmp2);
+      tmp1 = LANTIQ_MAX(pDev->caps.nALI, pDev->caps.nPCM);
+      tmp2 = LANTIQ_MAX(pDev->caps.nCOD, pDev->caps.nSIG);
+      pDev->caps.nMaxRes = LANTIQ_MAX(tmp1, tmp2);
+ #ifdef DECT_SUPPORT
+-      pDev->caps.nMaxRes = MAX(pDev->caps.nMaxRes, pDev->caps.nDECT);
+      pDev->caps.nMaxRes = LANTIQ_MAX(pDev->caps.nMaxRes, pDev->caps.nDECT);
+ #endif /* LIN_SUPPORT */
+ #ifdef LIN_SUPPORT
+-      pDev->caps.nMaxRes = MAX(pDev->caps.nMaxRes, pDev->caps.nLIN);
+      pDev->caps.nMaxRes = LANTIQ_MAX(pDev->caps.nMaxRes, pDev->caps.nLIN);
+ #endif /* LIN_SUPPORT */
+ #if (VMMC_CFG_FEATURES & VMMC_FEAT_AUDIO)
+-      pDev->caps.nMaxRes = MAX(pDev->caps.nMaxRes, pDev->caps.nAudioCnt);
+      pDev->caps.nMaxRes = LANTIQ_MAX(pDev->caps.nMaxRes, pDev->caps.nAudioCnt);
+ #endif /* (VMMC_CFG_FEATURES & VMMC_FEAT_AUDIO) */
+ 
+       if (pDev->caps.nMaxRes > VMMC_MAX_CH_NR)
+@@ -977,7 +977,7 @@ static IFX_int32_t VMMC_TAPI_LL_FW_Init(
+       nResource.DTMFRCount = pDev->caps.nDTMFD;
+       nResource.FSKGCount  = pDev->caps.nCIDS;
+       nResource.FSKRCount  = pDev->caps.nCIDR;
+-      nResource.ToneCount  = MAX(pDev->caps.nSIG, pDev->caps.nDECT);
+      nResource.ToneCount  = LANTIQ_MAX(pDev->caps.nSIG, pDev->caps.nDECT);
+       nResource.HdlcCount  = pDev->caps.nHDLC;
+       IFX_TAPI_ReportResources (pDev->pTapiDev,&nResource);
+ 
+--- a/src/drv_vmmc_init_cap.c
+++ b/src/drv_vmmc_init_cap.c
+@@ -39,7 +39,7 @@
+ /* ============================= */
+ /* Local Macros & Definitions    */
+ /* ============================= */
+-#define MIN(x,y) ({ (x) < (y) ? (x) : (y); })
+#define LANTIQ_MIN(x,y) ({ (x) < (y) ? (x) : (y); })
+ 
+ /* ============================= */
+ /* Local function declaration    */
+@@ -392,7 +392,7 @@ IFX_return_t VMMC_Get_FwCap(VMMC_DEVICE
+       /* Read the maximum length of the message that we can interpret but
+          not more than the firmware can provide. */
+       /* BLEN is the length including the header that the fw reports. */
+-      capCmd.LENGTH = MIN (capCmd.BLEN, sizeof(SYS_CAP_t));
+      capCmd.LENGTH = LANTIQ_MIN(capCmd.BLEN, sizeof(SYS_CAP_t));
+       /* Subtract the length of the header. */
+       capCmd.LENGTH -= CMD_HDR_CNT;
+       /* Read capability once more - this time with maximum length. */
+@@ -479,7 +479,7 @@ IFX_return_t VMMC_Get_FwCap(VMMC_DEVICE
+       pDev->caps.FEAT = capCmd.FEAT;
+       /* Number of UTG resources per channel (== SIG module), either 1 or 2 */
+       pDev->caps.nUtgPerCh = (capCmd.FEAT & EDSP_CAP_FEAT_UTGUD) ? 2 : 1;
+-      pDev->caps.nUtgPerCh = MIN(pDev->caps.nUtgPerCh, LL_TAPI_TONE_MAXRES);
+      pDev->caps.nUtgPerCh = LANTIQ_MIN(pDev->caps.nUtgPerCh, LL_TAPI_TONE_MAXRES);
+       /* Number of AudioChannels */
+       pDev->caps.nAudioCnt = (pDev->caps.FEAT & EDSP_CAP_FEAT_CHAUD) ? 1 : 0;
+       /* Overlays */
+--- a/src/drv_vmmc_sig_cptd.c
+++ b/src/drv_vmmc_sig_cptd.c
+@@ -38,7 +38,7 @@
+ /** define which constant is taken for cpt level calculation */
+ #define CONST_CPT                CONST_CPT_BLACKMAN
+ /* return the maximum of two scalar values */
+-#define MAX(x,y) ((x) > (y) ? (x) : (y))
+#define LANTIQ_MAX(x,y) ((x) > (y) ? (x) : (y))
+ 
+ /* ============================= */
+ /* Local function declaration    */
+@@ -511,7 +511,7 @@ static IFX_int32_t vmmc_sig_CPTD_SetCoef
+       if (nTenPercentTimeTolerance > nMaxTenPercentTimeTolerance)
+          nMaxTenPercentTimeTolerance = nTenPercentTimeTolerance;
+ 
+-      val = (IFX_uint16_t) (pTone->cadence[i] - MAX(nAbsoluteTimeTolerance,
+      val = (IFX_uint16_t) (pTone->cadence[i] - LANTIQ_MAX(nAbsoluteTimeTolerance,
+                                                     nTenPercentTimeTolerance));
+       switch (i)
+       {
+@@ -578,7 +578,7 @@ static IFX_int32_t vmmc_sig_CPTD_SetCoef
+    {
+       /* set tolerance +TIM_TOL */
+       pCmd->TIM_TOL =
+-                (2 * MAX (nAbsoluteTimeTolerance, nMaxTenPercentTimeTolerance));
+                (2 * LANTIQ_MAX(nAbsoluteTimeTolerance, nMaxTenPercentTimeTolerance));
+       /* return because nothing more to do */
+       return IFX_SUCCESS;
+    }
+@@ -605,7 +605,7 @@ static IFX_int32_t vmmc_sig_CPTD_SetCoef
+    /* set tolerance +TIM_TOL and NR of successfully fulfilled timing
+       requirement steps required to pass */
+    pCmd->TIM_TOL =
+-                (2 * MAX (nAbsoluteTimeTolerance, nMaxTenPercentTimeTolerance));
+                (2 * LANTIQ_MAX(nAbsoluteTimeTolerance, nMaxTenPercentTimeTolerance));
+    pCmd->NR = nr;
+ 
+    return IFX_SUCCESS;
--- a/package/kernel/lantiq/ltq-vmmc/patches/607-fix-unknown-type-name-errors.patch
+++ b/package/kernel/lantiq/ltq-vmmc/patches/607-fix-unknown-type-name-errors.patch
@ -0,0 +1,28 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 01:31:44 +0800
+Subject: [PATCH] fix unknown type name errors
+
+Fix compilation errors:
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_vmmc-1.9.0/src/drv_vmmc_sig.h:41:45: error: unknown type name 'IFX_TAPI_DRV_CTX_SIG_t'
+   41 | extern IFX_void_t   VMMC_SIG_Func_Register (IFX_TAPI_DRV_CTX_SIG_t *pSig);
+      |                                             ^~~~~~~~~~~~~~~~~~~~~~
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_vmmc-1.9.0/src/drv_vmmc_sig.h:43:54: error: unknown type name 'VMMC_CHANNEL'
+   43 | extern IFX_int32_t  VMMC_SIG_Allocate_Ch_Structures (VMMC_CHANNEL *pCh);
+      |                                                      ^~~~~~~~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/drv_vmmc_sig.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/drv_vmmc_sig.h
+++ b/src/drv_vmmc_sig.h
+@@ -20,6 +20,7 @@
+ /* ============================= */
+ /* Includes                      */
+ /* ============================= */
+#include "drv_vmmc_api.h"
+ #include "ifx_types.h"
+ 
+ /* ============================= */
--- a/package/kernel/lantiq/ltq-vmmc/patches/608-fix-inline-is-not-at-beginning-of-declaration.patch
+++ b/package/kernel/lantiq/ltq-vmmc/patches/608-fix-inline-is-not-at-beginning-of-declaration.patch
@ -0,0 +1,26 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 9 May 2025 01:43:41 +0800
+Subject: [PATCH] fix 'inline' is not at beginning of declaration
+
+Fix build warning on 6.12 kernel:
+
+/home/db/owrt/build_dir/target-mips_24kc_musl/linux-lantiq_xrx200/drv_vmmc-1.9.0/src/mps/drv_mps_vmmc_common.c:58:1: error: 'inline' is not at beginning of declaration [-Werror=old-style-declaration]
+   58 | static void inline bsp_mask_and_ack_irq(int x)
+      | ^~~~~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ src/mps/drv_mps_vmmc_common.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/mps/drv_mps_vmmc_common.c
+++ b/src/mps/drv_mps_vmmc_common.c
+@@ -55,7 +55,7 @@
+ #  define bsp_mask_and_ack_irq      ltq_mask_and_ack_irq
+ #else
+ extern void ltq_mask_and_ack_irq(struct irq_data *d);
+-static void inline bsp_mask_and_ack_irq(int x)
+static inline void bsp_mask_and_ack_irq(int x)
+ {
+ 	struct irq_data d;
+ 	d.hwirq = x;
--- a/package/kernel/lantiq/vrx518_ep/patches/100-compat.patch
+++ b/package/kernel/lantiq/vrx518_ep/patches/100-compat.patch
@ -1,6 +1,14 @@
 --- a/ep.c
 +++ b/ep.c
-@@ -373,23 +373,23 @@ int dc_ep_dev_info_req(int dev_idx, enum
+@@ -34,6 +34,7 @@
+ #include <linux/pci.h>
+ #include <linux/pci_regs.h>
+ #include <linux/platform_device.h>
+#include <linux/version.h>
+ 
+ #include "ep.h"
+ #include "aca.h"
+@@ -373,23 +374,23 @@ int dc_ep_dev_info_req(int dev_idx, enum
 
 	switch (module) {
 	case DC_EP_INT_PPE:
@ -31,18 +39,22 @@
 		break;
 	}
 
-@@ -466,8 +466,8 @@ static int dc_ep_msi_enable(struct pci_d
+@@ -466,8 +467,12 @@ static int dc_ep_msi_enable(struct pci_d
 		return -EIO;
 	}
 
 -	err = pci_enable_msi_exact(pdev, nvec);
 -	if (err) {
+#if (LINUX_VERSION_CODE < KERNEL_VERSION(6, 10, 0))
 +	err = pci_alloc_irq_vectors(pdev, nvec, nvec, PCI_IRQ_MSI | PCI_IRQ_LEGACY);
+#else
+	err = pci_alloc_irq_vectors(pdev, nvec, nvec, PCI_IRQ_MSI | PCI_IRQ_INTX);
+#endif
 +	if (err < 0) {
 		dev_err(&pdev->dev,
 			"%s: Failed to enable MSI interrupts error code: %d\n",
 			__func__, err);
-@@ -589,15 +589,15 @@ static int dc_ep_probe(struct pci_dev *p
+@@ -589,15 +594,15 @@ static int dc_ep_probe(struct pci_dev *p
 	/* Target structures have a limit of 32 bit DMA pointers.
 	 * DMA pointers can be wider than 32 bits by default on some systems.
 	 */
@ -61,7 +73,7 @@
 		goto err_region;
 	}
 
-@@ -654,7 +654,7 @@ static int dc_ep_probe(struct pci_dev *p
+@@ -654,7 +659,7 @@ static int dc_ep_probe(struct pci_dev *p
 		goto err_iomap;
 
 	spin_lock(&dc_ep_lock);
@ -70,7 +82,7 @@
 	spin_unlock(&dc_ep_lock);
 
 #ifndef CONFIG_OF
-@@ -715,7 +715,7 @@ static void dc_ep_remove(struct pci_dev
+@@ -715,7 +720,7 @@ static void dc_ep_remove(struct pci_dev
 	dc_ep_icu_disable(priv);
 	pci_iounmap(pdev, priv->mem);
 	pci_release_region(pdev, DC_EP_BAR_NUM);
--- a/package/kernel/lantiq/vrx518_ep/patches/101-Fix-version-macro-definition-conflicts-on-6.12-kerne.patch
+++ b/package/kernel/lantiq/vrx518_ep/patches/101-Fix-version-macro-definition-conflicts-on-6.12-kerne.patch
@ -0,0 +1,34 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Wed, 7 May 2025 19:16:16 +0800
+Subject: [PATCH] fix version macro definition conflicts on 6.12 kernel
+
+Add LANTIQ prefix to version variable names to fix:
+
+/home/db/owrt/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx_generic/vrx518_ep-2.1.0/ep.c:45:9: error: "MIN" redefined [-Werror]
+   45 | #define MIN     1
+      |         ^~~
+./include/linux/minmax.h:329:9: note: this is the location of the previous definition
+  329 | #define MIN(a,b) __cmp(min,a,b)
+      |         ^~~
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ ep.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/ep.c
+++ b/ep.c
+@@ -42,10 +42,10 @@
+ 
+ #define DC_EP_DBG
+ 
+-#define MAJ	2
+-#define MIN	1
+#define LANTIQ_MAJ	2
+#define LANTIQ_MIN	1
+ #define BUILD	0
+-#define DRV_VERSION __stringify(MAJ) "." __stringify(MIN) "." \
+#define DRV_VERSION __stringify(LANTIQ_MAJ) "." __stringify(LANTIQ_MIN) "." \
+ 	__stringify(BUILD) "-k"
+ 
+ static bool pcie_switch_exist;
--- a/package/kernel/lantiq/vrx518_tc/patches/206-dcdp-ptm_tc-allow-larger-mtu-to-support-rfc4638.patch
+++ b/package/kernel/lantiq/vrx518_tc/patches/206-dcdp-ptm_tc-allow-larger-mtu-to-support-rfc4638.patch
@ -22,9 +22,9 @@ Signed-off-by: Andrew MacIntyre <andymac@pcug.org.au>
 dcdp/ptm_tc.c | 1 +
 1 file changed, 1 insertion(+)

--- a/dcdp/ptm_tc.c	2023-12-17 16:11:22.503500398 +1100
-+++ b/dcdp/ptm_tc.c	2024-01-26 16:48:49.881623474 +1100
-@@ -657,6 +657,7 @@ static void ptm_setup(struct net_device
+--- a/dcdp/ptm_tc.c
+++ b/dcdp/ptm_tc.c
+@@ -666,6 +666,7 @@ static void ptm_setup(struct net_device
 	ether_setup(dev);
 	dev->watchdog_timeo = 10 * HZ;
 	dev->netdev_ops = &g_ptm_netdev_ops;
--- a/package/kernel/lantiq/vrx518_tc/patches/300-fix-missing-prototypes-warnings.patch
+++ b/package/kernel/lantiq/vrx518_tc/patches/300-fix-missing-prototypes-warnings.patch
@ -0,0 +1,66 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Thu, 8 May 2025 7:43:51 +0800
+Subject: [PATCH] fix missing prototypes warnings
+
+This patch fixes various missing-prototypes build warnings on
+6.12 kernel.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ dcdp/atm_tc.c           | 2 +-
+ dcdp/inc/platform.h     | 1 +
+ dcdp/platform/sw_plat.c | 1 +
+ dcdp/tc_proc.c          | 4 ++--
+ 4 files changed, 5 insertions(+), 3 deletions(-)
+
+--- a/dcdp/atm_tc.c
+++ b/dcdp/atm_tc.c
+@@ -279,7 +279,7 @@ unsigned int find_vpi(unsigned int vpi)
+  *    success: 0
+  *    failed: -1
+  */
+-unsigned int find_vpivci_from_queue_id(
+static unsigned int find_vpivci_from_queue_id(
+ 	unsigned int queue_id,
+ 	unsigned int *vpi,
+ 	unsigned int *vci)
+--- a/dcdp/inc/platform.h
+++ b/dcdp/inc/platform.h
+@@ -20,6 +20,7 @@
+   the file called "COPYING".
+ 
+ *******************************************************************************/
+struct tc_priv;
+ extern size_t plat_priv_sz(void);
+ extern int platform_init(struct tc_priv *, const char *);
+ extern void platform_exit(void);
+--- a/dcdp/platform/sw_plat.c
+++ b/dcdp/platform/sw_plat.c
+@@ -38,6 +38,7 @@
+ #include <linux/workqueue.h>
+ #include "../inc/dsl_tc.h"
+ 
+#include "../inc/platform.h"
+ #include "../inc/tc_main.h"
+ #include "../inc/reg_addr.h"
+ #include "../inc/tc_common.h"
+--- a/dcdp/tc_proc.c
+++ b/dcdp/tc_proc.c
+@@ -1945,7 +1945,7 @@ static void fwdbg_help(struct tc_comm *p
+ 	if (!cmds[i].cmd)
+ 		fwdbg_help(priv, NULL, 0, result);
+ }
+-int fw_dbg_start(struct tc_comm *priv,
+static int fw_dbg_start(struct tc_comm *priv,
+ 	char *commands[], int num, char *result)
+ {
+ 	int i;
+@@ -1964,7 +1964,7 @@ int fw_dbg_start(struct tc_comm *priv,
+ 	return 0;
+ }
+ 
+-ssize_t proc_write_fwdbg_seq(
+static ssize_t proc_write_fwdbg_seq(
+ 	struct file *file,
+ 	const char __user *buf,
+ 	size_t count,
--- a/package/kernel/linux/Makefile
+++ b/package/kernel/linux/Makefile
@ -18,6 +18,7 @@ SCAN_DEPS=modules/*.mk $(SUBTARGET_MODULES) $(TOPDIR)/include/netfilter.mk

 PKG_LICENSE:=GPL-2.0-only
 PKG_LICENSE_FILES:=COPYING
+PKG_CPE_ID:=cpe:/o:linux:linux_kernel

 export SHELL:=/bin/sh
 .ONESHELL:
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@ -10,13 +10,13 @@ include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=mac80211

-PKG_VERSION:=6.12.44
-PKG_RELEASE:=2
+PKG_VERSION:=6.12.52
+PKG_RELEASE:=1
 PKG_LICENSE:=GPL-2.0-only
 PKG_LICENSE_FILES:=COPYING

 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-PKG_HASH:=85a9f92ddba3bf2970a089e7af576c1135217c387205f4481ea9131c0c45c509
+PKG_HASH:=ed6ef4c67e08b294ed1101c7cc5ae584a5f338c99ef95362fa3921eb6d207f5d

 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(if $(BUILD_VARIANT),$(PKG_NAME)-$(BUILD_VARIANT)/)backports-$(PKG_VERSION)
--- a/package/kernel/mac80211/patches/ath10k/991-ath10k-support-flush_sta-method.patch
+++ b/package/kernel/mac80211/patches/ath10k/991-ath10k-support-flush_sta-method.patch
@ -0,0 +1,70 @@
+From: Zhi-Jun You <hujy652@gmail.com>
+Date: Wed,  6 Aug 2025 15:00:05 +0800
+Subject: [RFC PATCH] wifi: ath10k: support flush_sta method
+
+
+When a STA is marked as no longer authorized, if the driver doesn't
+implement flush_sta(), mac80211 calls ieee80211_flush_queues() to
+flush hardware queues to avoid sending unencrypted frames.
+
+This has became a problem for ath10k because ieee80211_flush_queues()
+will stop all traffic and call ath10k_flush, which waits until the
+whole HW queue is empty. In a busy environment this will trigger a
+timeout warning and stalls other STAs.
+
+Fix this by implementing flush_sta method using WMI command to flush
+frames of a specific STA.
+Flushed frames will be marked as discard in tx complete indication.
+
+ops->flush_sta will be set to NULL if htt.disable_tx_comp is set to
+true.
+
+Tested-on: QCA9984 hw1.0 PCI 10.4-3.9.0.2-00157
+
+Signed-off-by: Zhi-Jun You <hujy652@gmail.com>
+Tested-by: Florian Maurer <maurer@fh-aachen.de>
+---
+ drivers/net/wireless/ath/ath10k/mac.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -8135,6 +8135,20 @@ static void ath10k_flush(struct ieee8021
+ 	mutex_unlock(&ar->conf_mutex);
+ }
+ 
+static void ath10k_mac_op_flush_sta(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+			     struct ieee80211_sta *sta)
+{
+	struct ath10k_vif *arvif = (void *)vif->drv_priv;
+	struct ath10k *ar = hw->priv;
+	u32 bitmap = 0xFFFFFFFF;
+	int ret = 0;
+
+	ret = ath10k_wmi_peer_flush(ar, arvif->vdev_id, sta->addr, bitmap);
+	if (ret)
+		ath10k_warn(ar, "failed to flush sta (sta %pM)\n",
+			    sta->addr);
+}
+
+ /* TODO: Implement this function properly
+  * For now it is needed to reply to Probe Requests in IBSS mode.
+  * Probably we need this information from FW.
+@@ -9486,6 +9500,7 @@ static const struct ieee80211_ops ath10k
+ 	.set_rts_threshold		= ath10k_set_rts_threshold,
+ 	.set_frag_threshold		= ath10k_mac_op_set_frag_threshold,
+ 	.flush				= ath10k_flush,
+	.flush_sta			= ath10k_mac_op_flush_sta,
+ 	.tx_last_beacon			= ath10k_tx_last_beacon,
+ 	.set_antenna			= ath10k_set_antenna,
+ 	.get_antenna			= ath10k_get_antenna,
+@@ -10307,6 +10322,9 @@ int ath10k_mac_register(struct ath10k *a
+ 	if (!ar->hw_params.hw_ops->set_coverage_class)
+ 		ar->ops->set_coverage_class = NULL;
+ 
+	if (ar->htt.disable_tx_comp)
+		ar->ops->flush_sta = NULL;
+
+ 	ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
+ 			    ath10k_reg_notifier);
+ 	if (ret) {
--- a/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
+++ b/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
@ -31,7 +31,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 	{
 		.hw_rev = ATH11K_HW_IPQ8074,
 		.name = "ipq8074 hw2.0",
-@@ -2200,7 +2200,8 @@ static void ath11k_core_reset(struct wor
+@@ -2201,7 +2201,8 @@ static void ath11k_core_reset(struct wor
 static int ath11k_init_hw_params(struct ath11k_base *ab)
 {
 	const struct ath11k_hw_params *hw_params = NULL;
@ -41,7 +41,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 
 	for (i = 0; i < ARRAY_SIZE(ath11k_hw_params); i++) {
 		hw_params = &ath11k_hw_params[i];
-@@ -2216,7 +2217,31 @@ static int ath11k_init_hw_params(struct
+@@ -2217,7 +2218,31 @@ static int ath11k_init_hw_params(struct
 
 	ab->hw_params = *hw_params;
 
--- a/package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch
+++ b/package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch
@ -23,7 +23,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>

 --- a/drivers/net/wireless/ath/ath11k/reg.c
 +++ b/drivers/net/wireless/ath/ath11k/reg.c
-@@ -361,134 +361,6 @@ static u32 ath11k_map_fw_phy_flags(u32 p
+@@ -353,134 +353,6 @@ static u32 ath11k_map_fw_phy_flags(u32 p
 	return flags;
 }
 
@ -158,7 +158,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 static const char *
 ath11k_reg_get_regdom_str(enum nl80211_dfs_regions dfs_region)
 {
-@@ -639,11 +511,11 @@ ath11k_reg_ap_pwr_convert(enum ieee80211
+@@ -631,11 +503,11 @@ ath11k_reg_ap_pwr_convert(enum ieee80211
 
 struct ieee80211_regdomain *
 ath11k_reg_build_regd(struct ath11k_base *ab,
@ -172,7 +172,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 	struct cur_reg_rule *reg_rule, *reg_rule_6ghz;
 	u8 i = 0, j = 0, k = 0;
 	u8 num_rules;
-@@ -686,26 +558,26 @@ ath11k_reg_build_regd(struct ath11k_base
+@@ -678,26 +550,26 @@ ath11k_reg_build_regd(struct ath11k_base
 	}
 
 	if (!num_rules)
@ -206,7 +206,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 		   reg_info->dfs_region, num_rules);
 	/* Update reg_rules[] below. Firmware is expected to
 	 * send these rules in order(2 GHz rules first and then 5 GHz)
-@@ -744,7 +616,7 @@ ath11k_reg_build_regd(struct ath11k_base
+@@ -736,7 +608,7 @@ ath11k_reg_build_regd(struct ath11k_base
 		flags |= ath11k_map_fw_reg_flags(reg_rule->flags);
 		flags |= ath11k_map_fw_phy_flags(reg_info->phybitmap);
 
@ -215,7 +215,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 				       reg_rule->start_freq,
 				       reg_rule->end_freq, max_bw,
 				       reg_rule->ant_gain, reg_rule->reg_power,
-@@ -759,7 +631,7 @@ ath11k_reg_build_regd(struct ath11k_base
+@@ -751,7 +623,7 @@ ath11k_reg_build_regd(struct ath11k_base
 		    reg_info->dfs_region == ATH11K_DFS_REG_ETSI &&
 		    (reg_rule->end_freq > ETSI_WEATHER_RADAR_BAND_LOW &&
 		    reg_rule->start_freq < ETSI_WEATHER_RADAR_BAND_HIGH)){
@ -224,7 +224,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 							     reg_rule, &i,
 							     flags, max_bw);
 			continue;
-@@ -770,51 +642,23 @@ ath11k_reg_build_regd(struct ath11k_base
+@@ -762,37 +634,20 @@ ath11k_reg_build_regd(struct ath11k_base
 				   "\t%d. (%d - %d @ %d) (%d, %d) (%d ms) (FLAGS %d) (%d, %d)\n",
 				   i + 1, reg_rule->start_freq, reg_rule->end_freq,
 				   max_bw, reg_rule->ant_gain, reg_rule->reg_power,
@ -265,6 +265,10 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 	return new_regd;
 }
 
+@@ -844,17 +699,6 @@ void ath11k_regd_update_chan_list_work(s
+ 	}
+ }
+ 
 -static bool ath11k_reg_is_world_alpha(char *alpha)
 -{
 -	if (alpha[0] == '0' && alpha[1] == '0')
@ -279,7 +283,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 static enum wmi_vdev_type ath11k_reg_get_ar_vdev_type(struct ath11k *ar)
 {
 	struct ath11k_vif *arvif;
-@@ -837,7 +681,6 @@ int ath11k_reg_handle_chan_list(struct a
+@@ -877,7 +721,6 @@ int ath11k_reg_handle_chan_list(struct a
 				enum ieee80211_ap_reg_power power_type)
 {
 	struct ieee80211_regdomain *regd;
@ -287,7 +291,7 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 	int pdev_idx;
 	struct ath11k *ar;
 	enum wmi_vdev_type vdev_type;
-@@ -889,24 +732,14 @@ int ath11k_reg_handle_chan_list(struct a
+@@ -929,24 +772,14 @@ int ath11k_reg_handle_chan_list(struct a
 		    (char *)reg_info->alpha2, 2))
 		goto retfail;
 
@ -317,8 +321,8 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
 		goto fallback;
 --- a/drivers/net/wireless/ath/ath11k/reg.h
 +++ b/drivers/net/wireless/ath/ath11k/reg.h
-@@ -35,7 +35,7 @@ void ath11k_reg_free(struct ath11k_base
- void ath11k_regd_update_work(struct work_struct *work);
+@@ -36,7 +36,7 @@ void ath11k_regd_update_work(struct work
+ void ath11k_regd_update_chan_list_work(struct work_struct *work);
 struct ieee80211_regdomain *
 ath11k_reg_build_regd(struct ath11k_base *ab,
 -		      struct cur_regulatory_info *reg_info, bool intersect,
--- a/package/kernel/mac80211/patches/ath11k/940-ath11k-Revert-clear-the-keys-properly-when-DISABLE_K.patch
+++ b/package/kernel/mac80211/patches/ath11k/940-ath11k-Revert-clear-the-keys-properly-when-DISABLE_K.patch
@ -1,48 +0,0 @@
-From 52393e2ae12f18fb1a60578c24c46ebab292ddb6 Mon Sep 17 00:00:00 2001
-From: Rameshkumar Sundaram <quic_ramess@quicinc.com>
-Date: Mon, 28 Mar 2022 13:21:04 +0530
-Subject: [PATCH] ath11k: Revert: clear the keys properly when DISABLE_KEY
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Reverting the Upstream clear key change added as a part of
-436a4e886598 ("ath11k: clear the keys properly
-when DISABLE_KEY")
-This change exposed a race in WLAN Firmware where target asserts
-are seen frequently due FW not synchronizing ath11k host’s clear
-key commands(CIPHER changes to NONE) with frames in TX queue.
-Hence reverting this change untill FW fixes to synchronize
-ath11k host’s clear key command are available.
-
-Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
---
- drivers/net/wireless/ath/ath11k/mac.c | 4 +++-
- drivers/net/wireless/ath/ath11k/wmi.c | 3 +--
- 2 files changed, 4 insertions(+), 3 deletions(-)
-
--- a/drivers/net/wireless/ath/ath11k/mac.c
-+++ b/drivers/net/wireless/ath/ath11k/mac.c
-@@ -4222,7 +4222,9 @@ static int ath11k_install_key(struct ath
- 		return 0;
- 
- 	if (cmd == DISABLE_KEY) {
-		arg.key_cipher = WMI_CIPHER_NONE;
-+		/* TODO: Check if FW expects  value other than NONE for del */
-+		/* arg.key_cipher = WMI_CIPHER_NONE; */
-+		arg.key_len = 0;
- 		arg.key_data = NULL;
- 		goto install;
- 	}
--- a/drivers/net/wireless/ath/ath11k/wmi.c
-+++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -1854,8 +1854,7 @@ int ath11k_wmi_vdev_install_key(struct a
- 	tlv = (struct wmi_tlv *)(skb->data + sizeof(*cmd));
- 	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_BYTE) |
- 		      FIELD_PREP(WMI_TLV_LEN, key_len_aligned);
-	if (arg->key_data)
-		memcpy(tlv->value, (u8 *)arg->key_data, key_len_aligned);
-+	memcpy(tlv->value, (u8 *)arg->key_data, key_len_aligned);
- 
- 	ret = ath11k_wmi_cmd_send(wmi, skb, WMI_VDEV_INSTALL_KEY_CMDID);
- 	if (ret) {
--- a/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
+++ b/package/kernel/mac80211/patches/mwl/801-libertas-configure-sysfs-links.patch
@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2102,6 +2102,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
+@@ -2105,6 +2105,8 @@ struct wireless_dev *lbs_cfg_alloc(struc
 		goto err_wiphy_new;
 	}
 
--- a/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
+++ b/package/kernel/mac80211/patches/mwl/802-libertas-set-wireless-macaddr.patch
@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/libertas/cfg.c
 +++ b/drivers/net/wireless/marvell/libertas/cfg.c
-@@ -2179,6 +2179,8 @@ int lbs_cfg_register(struct lbs_private
+@@ -2182,6 +2182,8 @@ int lbs_cfg_register(struct lbs_private
 	wdev->wiphy->n_cipher_suites = ARRAY_SIZE(cipher_suites);
 	wdev->wiphy->reg_notifier = lbs_reg_notifier;
 
--- a/package/kernel/mac80211/patches/subsys/130-disable_auto_vif.patch
+++ b/package/kernel/mac80211/patches/subsys/130-disable_auto_vif.patch
@ -1,6 +1,6 @@
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -1585,24 +1585,6 @@ int ieee80211_register_hw(struct ieee802
+@@ -1590,24 +1590,6 @@ int ieee80211_register_hw(struct ieee802
 
 	ieee80211_check_wbrf_support(local);
 
--- a/package/kernel/mac80211/patches/subsys/330-wifi-cfg80211-add-option-for-vif-allowed-radios.patch
+++ b/package/kernel/mac80211/patches/subsys/330-wifi-cfg80211-add-option-for-vif-allowed-radios.patch
@ -246,7 +246,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 			continue;
 
 		for (i = 0; i < rdev_req->n_channels; i++) {
-@@ -3512,9 +3513,12 @@ int cfg80211_wext_siwscan(struct net_dev
+@@ -3513,9 +3514,12 @@ int cfg80211_wext_siwscan(struct net_dev
 			continue;
 
 		for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
--- a/package/kernel/mac80211/patches/subsys/342-wifi-mac80211-Support-EHT-1024-aggregation-size-in-T.patch
+++ b/package/kernel/mac80211/patches/subsys/342-wifi-mac80211-Support-EHT-1024-aggregation-size-in-T.patch
@ -26,11 +26,9 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 net/mac80211/ieee80211_i.h |  9 +++-
 5 files changed, 90 insertions(+), 48 deletions(-)

-diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
-index 456bca45ff05..05dedc45505c 100644
 --- a/include/linux/ieee80211.h
 +++ b/include/linux/ieee80211.h
-@@ -1445,6 +1445,8 @@ struct ieee80211_mgmt {
+@@ -1492,6 +1492,8 @@ struct ieee80211_mgmt {
 					__le16 status;
 					__le16 capab;
 					__le16 timeout;
@ -39,11 +37,9 @@ index 456bca45ff05..05dedc45505c 100644
 				} __packed addba_resp;
 				struct{
 					u8 action_code;
-diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
-index fe7eab4b681b..f3fbe5a4395e 100644
 --- a/net/mac80211/agg-rx.c
 +++ b/net/mac80211/agg-rx.c
-@@ -170,28 +170,63 @@ static void sta_rx_agg_reorder_timer_expired(struct timer_list *t)
+@@ -170,28 +170,63 @@ static void sta_rx_agg_reorder_timer_exp
 	rcu_read_unlock();
 }
 
@ -117,7 +113,7 @@ index fe7eab4b681b..f3fbe5a4395e 100644
 {
 	struct ieee80211_sub_if_data *sdata = sta->sdata;
 	struct ieee80211_local *local = sdata->local;
-@@ -223,8 +258,8 @@ static void ieee80211_send_addba_resp(struct sta_info *sta, u8 *da, u16 tid,
+@@ -223,8 +258,8 @@ static void ieee80211_send_addba_resp(st
 	mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
 	mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
 
@ -128,7 +124,7 @@ index fe7eab4b681b..f3fbe5a4395e 100644
 
 	ieee80211_tx_skb(sdata, skb);
 }
-@@ -233,7 +268,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
+@@ -233,7 +268,7 @@ void __ieee80211_start_rx_ba_session(str
 				     u8 dialog_token, u16 timeout,
 				     u16 start_seq_num, u16 ba_policy, u16 tid,
 				     u16 buf_size, bool tx, bool auto_seq,
@ -137,7 +133,7 @@ index fe7eab4b681b..f3fbe5a4395e 100644
 {
 	struct ieee80211_local *local = sta->sdata->local;
 	struct tid_ampdu_rx *tid_agg_rx;
-@@ -419,7 +454,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
+@@ -419,7 +454,7 @@ end:
 	if (tx)
 		ieee80211_send_addba_resp(sta, sta->sta.addr, tid,
 					  dialog_token, status, 1, buf_size,
@ -146,7 +142,7 @@ index fe7eab4b681b..f3fbe5a4395e 100644
 }
 
 void ieee80211_process_addba_request(struct ieee80211_local *local,
-@@ -428,9 +463,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
+@@ -428,9 +463,7 @@ void ieee80211_process_addba_request(str
 				     size_t len)
 {
 	u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num;
@ -157,7 +153,7 @@ index fe7eab4b681b..f3fbe5a4395e 100644
 
 	/* extract session parameters from addba request frame */
 	dialog_token = mgmt->u.action.u.addba_req.dialog_token;
-@@ -443,28 +476,17 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
+@@ -443,28 +476,17 @@ void ieee80211_process_addba_request(str
 	tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
 	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
 
@ -194,8 +190,6 @@ index fe7eab4b681b..f3fbe5a4395e 100644
 }
 
 void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
-diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
-index 04cb45cfb310..61f2cac37728 100644
 --- a/net/mac80211/agg-tx.c
 +++ b/net/mac80211/agg-tx.c
@@ -58,23 +58,24 @@
@ -228,7 +222,7 @@ index 04cb45cfb310..61f2cac37728 100644
 
 	skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
 
-@@ -93,6 +94,9 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
+@@ -93,6 +94,9 @@ static void ieee80211_send_addba_request
 	mgmt->u.action.u.addba_req.start_seq_num =
 					cpu_to_le16(start_seq_num << 4);
 
@ -238,7 +232,7 @@ index 04cb45cfb310..61f2cac37728 100644
 	ieee80211_tx_skb_tid(sdata, skb, tid, -1);
 }
 
-@@ -460,8 +464,11 @@ static void ieee80211_send_addba_with_timeout(struct sta_info *sta,
+@@ -460,8 +464,11 @@ static void ieee80211_send_addba_with_ti
 	sta->ampdu_mlme.addba_req_num[tid]++;
 	spin_unlock_bh(&sta->lock);
 
@ -251,7 +245,7 @@ index 04cb45cfb310..61f2cac37728 100644
 	} else {
 		/*
 		 * We really should use what the driver told us it will
-@@ -473,9 +480,8 @@ static void ieee80211_send_addba_with_timeout(struct sta_info *sta,
+@@ -473,9 +480,8 @@ static void ieee80211_send_addba_with_ti
 	}
 
 	/* send AddBA request */
@ -263,7 +257,7 @@ index 04cb45cfb310..61f2cac37728 100644
 
 	WARN_ON(test_and_set_bit(HT_AGG_STATE_SENT_ADDBA, &tid_tx->state));
 }
-@@ -970,6 +976,13 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
+@@ -970,6 +976,13 @@ void ieee80211_process_addba_resp(struct
 	amsdu = capab & IEEE80211_ADDBA_PARAM_AMSDU_MASK;
 	tid = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_TID_MASK);
 	buf_size = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
@ -277,11 +271,9 @@ index 04cb45cfb310..61f2cac37728 100644
 	buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
 
 	txq = sta->sta.txq[tid];
-diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
-index 1c2b7dd8976a..32390d8a9d75 100644
 --- a/net/mac80211/ht.c
 +++ b/net/mac80211/ht.c
-@@ -379,7 +379,7 @@ void ieee80211_ba_session_work(struct wiphy *wiphy, struct wiphy_work *work)
+@@ -379,7 +379,7 @@ void ieee80211_ba_session_work(struct wi
 				       sta->ampdu_mlme.tid_rx_manage_offl))
 			__ieee80211_start_rx_ba_session(sta, 0, 0, 0, 1, tid,
 							IEEE80211_MAX_AMPDU_BUF_HT,
@ -290,11 +282,9 @@ index 1c2b7dd8976a..32390d8a9d75 100644
 
 		if (test_and_clear_bit(tid + IEEE80211_NUM_TIDS,
 				       sta->ampdu_mlme.tid_rx_manage_offl))
-diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index 7dcb46120abc..752297bcde76 100644
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2111,14 +2111,19 @@ int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
+@@ -2131,14 +2131,19 @@ int ieee80211_send_smps_action(struct ie
 			       const u8 *bssid, int link_id);
 bool ieee80211_smps_is_restrictive(enum ieee80211_smps_mode smps_mode_old,
 				   enum ieee80211_smps_mode smps_mode_new);
@ -316,6 +306,3 @@ index 7dcb46120abc..752297bcde76 100644
 void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
 					 enum ieee80211_agg_stop_reason reason);
 void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
-- 
-2.39.5
-
--- a/package/kernel/mwlwifi/Makefile
+++ b/package/kernel/mwlwifi/Makefile
@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=mwlwifi
-PKG_RELEASE=1
+PKG_RELEASE=2

 PKG_LICENSE:=ISC
 PKG_LICENSE_FILES:=
--- a/package/kernel/mwlwifi/patches/030-remove-MAX-a-b-macro-to-avoid-conflict-with-kernel.h.patch
+++ b/package/kernel/mwlwifi/patches/030-remove-MAX-a-b-macro-to-avoid-conflict-with-kernel.h.patch
@ -0,0 +1,51 @@
+From 8c19700558b154b4898e49014b9a9725dabadddb Mon Sep 17 00:00:00 2001
+From: Stefan Kalscheuer <stefan@stklcode.de>
+Date: Sat, 31 May 2025 16:52:23 +0200
+Subject: [PATCH] remove MAX(a,b) macro to avoid conflict with
+ kernel.h/minmax.h
+
+Building against recent kernel versions (noticed with 6.12) and -Werror
+can fail because a macro MAX(a,b) is already defined in minmax.h or
+kernel.h before 5.10.
+
+In file included from ../mwlwifi-2025.02.06~db97edf2/hif/fwcmd.h:23,
+                 from ../mwlwifi-2025.02.06~db97edf2/core.c:25:
+../mwlwifi-2025.02.06~db97edf2/hif/hostcmd.h:1124:9: error: "MAX" redefined [-Werror]
+ 1124 | #define MAX(a, b) (((a) > (b)) ? (a) : (b))
+      |         ^~~
+In file included from usr/include/mac80211-backport/linux/minmax.h:4,
+                 from ./include/linux/kernel.h:28,
+                 from usr/include/mac80211-backport/linux/kernel.h:3,
+                 from ./include/linux/skbuff.h:13,
+                 from usr/include/mac80211-backport/linux/skbuff.h:3,
+                 from ./include/linux/if_ether.h:19,
+                 from usr/include/mac80211-backport/linux/if_ether.h:3,
+                 from ./include/linux/etherdevice.h:20,
+                 from usr/include/mac80211-backport/linux/etherdevice.h:3,
+                 from ../mwlwifi-2025.02.06~db97edf2/core.c:18:
+./include/linux/minmax.h:330:9: note: this is the location of the previous definition
+  330 | #define MAX(a,b) __cmp(max,a,b)
+      |         ^~~
+
+This macro is not used anywhere else but in the very next line, so
+instead of adding conditionals, let's expand MAX_GROUP_PER_CHANNEL_RATE
+and drop the definition of MAX.
+
+Signed-off-by: Stefan Kalscheuer <stefan@stklcode.de>
+---
+ hif/hostcmd.h | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/hif/hostcmd.h
+++ b/hif/hostcmd.h
+@@ -1121,9 +1121,8 @@ struct hostcmd_cmd_get_fw_region_code_sc
+ #define HAL_TRPC_ID_MAX_SC4        32
+ #define MAX_GROUP_PER_CHANNEL_5G   39
+ #define MAX_GROUP_PER_CHANNEL_2G   21
+-#define	MAX(a, b) (((a) > (b)) ? (a) : (b))
+ #define MAX_GROUP_PER_CHANNEL_RATE \
+-	MAX(MAX_GROUP_PER_CHANNEL_5G, MAX_GROUP_PER_CHANNEL_2G)
+	((MAX_GROUP_PER_CHANNEL_5G > MAX_GROUP_PER_CHANNEL_2G) ? MAX_GROUP_PER_CHANNEL_5G : MAX_GROUP_PER_CHANNEL_2G)
+ 
+ struct channel_power_tbl_sc4 {
+ 	u8 channel;
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@ -9,13 +9,13 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=mbedtls
 PKG_FLAGS:=hold
-PKG_VERSION:=3.6.4
-PKG_RELEASE:=1
+PKG_VERSION:=3.6.5
+PKG_RELEASE:=2
 PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL=https://github.com/Mbed-TLS/$(PKG_NAME)/releases/download/$(PKG_NAME)-$(PKG_VERSION)
-PKG_HASH:=ec35b18a6c593cf98c3e30db8b98ff93e8940a8c4e690e66b41dfc011d678110
+PKG_HASH:=4a11f1777bb95bf4ad96721cac945a26e04bf19f57d905f241fe77ebeddf46d8

 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=LICENSE
--- a/package/libs/openssl/Makefile
+++ b/package/libs/openssl/Makefile
@ -9,8 +9,8 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=openssl
 PKG_FLAGS:=hold
-PKG_VERSION:=3.0.17
-PKG_RELEASE:=4
+PKG_VERSION:=3.0.18
+PKG_RELEASE:=2
 PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto

 PKG_BUILD_PARALLEL:=1
@ -22,7 +22,7 @@ PKG_SOURCE_URL:= \
 	https://www.openssl.org/source/old/$(PKG_BASE)/ \
 	https://github.com/openssl/openssl/releases/download/$(PKG_NAME)-$(PKG_VERSION)/

-PKG_HASH:=dfdd77e4ea1b57ff3a6dbde6b0bdc3f31db5ac99e7fdd4eaf9e1fbb6ec2db8ce
+PKG_HASH:=d80c34f5cf902dccf1f1b5df5ebb86d0392e37049e5d73df1b3abae72e4ffe8b

 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE.txt
--- a/package/libs/openssl/patches/0001-Don-t-keep-the-store-open-in-by_store_ctrl_ex.patch
+++ b/package/libs/openssl/patches/0001-Don-t-keep-the-store-open-in-by_store_ctrl_ex.patch
@ -1,127 +0,0 @@
-From c0d968f0ac56ad507ab0101e537e7d530e9f0448 Mon Sep 17 00:00:00 2001
-From: Matt Caswell <matt@openssl.org>
-Date: Thu, 7 Aug 2025 17:50:17 +0100
-Subject: [PATCH] Don't keep the store open in by_store_ctrl_ex
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Previously #27529 made a change to `by_store_ctrl_ex` in order to open
-the OSSL_STORE early. The reason given in that PR is:
-
-"This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and
-get to see possible errors when the URI is loaded"
-
-That PR then kept the store open until cache_objects is called and then
-reused it. Unfortunately by the time cache_objects() is called we could be
-in a multi-threaded scenario where the X509_STORE is being shared by
-multiple threads. We then get a race condition where multiple threads are
-all using (and ultimately closing) the same `OSSL_STORE_CTX`.
-
-The purpose of keeping the `OSSL_STORE` object between by_store_ctrl_ex()
-and `cache_objects` is presumably an optimisation to avoid having to open
-the store twice. But this does not work because of the above issue.
-
-We just take the hit and open it again.
-
-Fixes #28171
-
-Reviewed-by: Tomas Mraz <tomas@openssl.org>
-Reviewed-by: Saša Nedvědický <sashan@openssl.org>
-(Merged from https://github.com/openssl/openssl/pull/28385)
---
- crypto/x509/by_store.c | 26 +++++++++++++-------------
- 1 file changed, 13 insertions(+), 13 deletions(-)
-
--- a/crypto/x509/by_store.c
-+++ b/crypto/x509/by_store.c
-@@ -17,7 +17,6 @@ typedef struct cached_store_st {
-     char *uri;
-     OSSL_LIB_CTX *libctx;
-     char *propq;
-    OSSL_STORE_CTX *ctx;
- } CACHED_STORE;
- 
- DEFINE_STACK_OF(CACHED_STORE)
-@@ -27,14 +26,12 @@ static int cache_objects(X509_LOOKUP *lc
-                          const OSSL_STORE_SEARCH *criterion, int depth)
- {
-     int ok = 0;
-    OSSL_STORE_CTX *ctx = store->ctx;
-+    OSSL_STORE_CTX *ctx;
-     X509_STORE *xstore = X509_LOOKUP_get_store(lctx);
- 
-    if (ctx == NULL
-        && (ctx = OSSL_STORE_open_ex(store->uri, store->libctx, store->propq,
-                                     NULL, NULL, NULL, NULL, NULL)) == NULL)
-+    if ((ctx = OSSL_STORE_open_ex(store->uri, store->libctx, store->propq,
-+                                  NULL, NULL, NULL, NULL, NULL)) == NULL)
-         return 0;
-    store->ctx = ctx;
- 
-     /*
-      * We try to set the criterion, but don't care if it was valid or not.
-@@ -79,7 +76,6 @@ static int cache_objects(X509_LOOKUP *lc
-                 substore.uri = (char *)OSSL_STORE_INFO_get0_NAME(info);
-                 substore.libctx = store->libctx;
-                 substore.propq = store->propq;
-                substore.ctx = NULL;
-                 ok = cache_objects(lctx, &substore, criterion, depth - 1);
-             }
-         } else {
-@@ -105,7 +101,6 @@ static int cache_objects(X509_LOOKUP *lc
-             break;
-     }
-     OSSL_STORE_close(ctx);
-    store->ctx = NULL;
- 
-     return ok;
- }
-@@ -114,7 +109,6 @@ static int cache_objects(X509_LOOKUP *lc
- static void free_store(CACHED_STORE *store)
- {
-     if (store != NULL) {
-        OSSL_STORE_close(store->ctx);
-         OPENSSL_free(store->uri);
-         OPENSSL_free(store->propq);
-         OPENSSL_free(store);
-@@ -148,6 +142,7 @@ static int by_store_ctrl_ex(X509_LOOKUP
-         {
-             STACK_OF(CACHED_STORE) *stores = X509_LOOKUP_get_method_data(ctx);
-             CACHED_STORE *store = OPENSSL_zalloc(sizeof(*store));
-+            OSSL_STORE_CTX *sctx;
- 
-             if (store == NULL) {
-                 return 0;
-@@ -157,14 +152,20 @@ static int by_store_ctrl_ex(X509_LOOKUP
-             store->libctx = libctx;
-             if (propq != NULL)
-                 store->propq = OPENSSL_strdup(propq);
-            store->ctx = OSSL_STORE_open_ex(argp, libctx, propq, NULL, NULL,
-                                           NULL, NULL, NULL);
-            if (store->ctx == NULL
-+            /*
-+             * We open this to check for errors now - so we can report those
-+             * errors early.
-+             */
-+            sctx = OSSL_STORE_open_ex(argp, libctx, propq, NULL, NULL,
-+                                      NULL, NULL, NULL);
-+            if (sctx == NULL
-                 || (propq != NULL && store->propq == NULL)
-                 || store->uri == NULL) {
-+                OSSL_STORE_close(sctx);
-                 free_store(store);
-                 return use_default;
-             }
-+            OSSL_STORE_close(sctx);
- 
-             if (stores == NULL) {
-                 stores = sk_CACHED_STORE_new_null();
-@@ -184,7 +185,6 @@ static int by_store_ctrl_ex(X509_LOOKUP
-         store.uri = (char *)argp;
-         store.libctx = libctx;
-         store.propq = (char *)propq;
-        store.ctx = NULL;
-         return cache_objects(ctx, &store, NULL, 0);
-     }
-     default:
--- a/package/network/services/odhcpd/Makefile
+++ b/package/network/services/odhcpd/Makefile
@ -12,9 +12,9 @@ PKG_RELEASE:=2

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/odhcpd.git
-PKG_MIRROR_HASH:=f6e1c18551a00e01229fa12caa7b3fe33ad82785150fedcbe615fcc651ba2876
-PKG_SOURCE_DATE:=2024-05-08
-PKG_SOURCE_VERSION:=a29882318a4ccb3ae26f7cc0145e06ad4ead224b
+PKG_MIRROR_HASH:=1ad44323f7803fdb5d1b2492d47e4b4b0fbc3d4c7c171b270422b10535c2a284
+PKG_SOURCE_DATE:=2025-10-02
+PKG_SOURCE_VERSION:=b14cf98c914d8582f18c7b263814797366fa185d

 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
@ -29,7 +29,7 @@ define Package/odhcpd/default
  SECTION:=net
  CATEGORY:=Network
  TITLE:=OpenWrt DHCPv6(-PD)/RA Server & Relay
-  DEPENDS:=+libubox +libuci +libubus +libnl-tiny
+  DEPENDS:=+libjson-c +libubox +libuci +libubus +libnl-tiny
 endef

 define Package/odhcpd/default/description
--- a/package/network/services/odhcpd/files/odhcpd.defaults
+++ b/package/network/services/odhcpd/files/odhcpd.defaults
@ -1,5 +1,14 @@
 #!/bin/sh
-uci -q get dhcp.odhcpd && exit 0
+
+if [ -n "$(uci -q get dhcp.odhcpd)" ]; then
+	if [ -z "$(uci -q get dhcp.odhcpd.piofolder)" ]; then
+		uci set dhcp.odhcpd.piofolder=/tmp/odhcpd-piofolder
+		uci commit dhcp
+	fi
+
+	exit 0
+fi
+
 touch /etc/config/dhcp

 . /usr/share/libubox/jshn.sh
@ -42,6 +51,7 @@ set dhcp.odhcpd.maindhcp=$ODHCPDONLY
 set dhcp.odhcpd.leasefile=/tmp/hosts/odhcpd
 set dhcp.odhcpd.leasetrigger=/usr/sbin/odhcpd-update
 set dhcp.odhcpd.loglevel=4
+set dhcp.odhcpd.piofolder=/tmp/odhcpd-piofolder
 set dhcp.lan.dhcpv4=$V4MODE
 set dhcp.lan.dhcpv6=$V6MODE
 set dhcp.lan.ra=$V6MODE
--- a/package/network/services/odhcpd/patches/0001-ndp-Allow-NS-loopback-for-master-iface.patch
+++ b/package/network/services/odhcpd/patches/0001-ndp-Allow-NS-loopback-for-master-iface.patch
@ -0,0 +1,61 @@
+From f0d855358b86a36efbfeb5a9de5a1d2a4d9d80fe Mon Sep 17 00:00:00 2001
+From: Haoyi Ci <cihaoyi@outlook.com>
+Date: Thu, 2 Oct 2025 16:14:05 +0800
+Subject: [PATCH] ndp: Allow NS loopback for master iface
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This commit modifies handle_solicit() in ndp.c to correct IPv6 relay
+handling of Neighbor Solicitation (NS) requests when no upstream
+solicitation is received.
+
+Background: In IPv6 relay mode, odhcpd discovers local devices only upon
+receiving upstream NS packets. If no upstream NS arrives (e.g. because the
+upstream router’s neighbor cache is still valid or no solicitation was
+ever sent), OpenWrt may attempt neighbor resolution via the master (WAN)
+interface instead of the LAN, leaving local devices undiscoverable and
+breaking connectivity.
+
+- When an NS packet is sent by the host's master interface, do not
+  immediately return; instead continue searching slave interfaces for the
+  target neighbor.
+- When odhcpd responds to NS packets, add a check to prevent replying to
+  NS packets that were sent by the host itself.
+
+Signed-off-by: Haoyi Ci cihaoyi@outlook.com
+Link: https://github.com/openwrt/odhcpd/pull/240
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ src/ndp.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/src/ndp.c
+++ b/src/ndp.c
+@@ -332,6 +332,7 @@ static void handle_solicit(void *addr, v
+ 	struct interface *c;
+ 	char ipbuf[INET6_ADDRSTRLEN];
+ 	uint8_t mac[6];
+	bool is_self_sent;
+ 
+ 	/* Solicitation is for duplicate address detection */
+ 	bool ns_is_dad = IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src);
+@@ -354,7 +355,8 @@ static void handle_solicit(void *addr, v
+ 	syslog(LOG_DEBUG, "Got a NS for %s on %s", ipbuf, iface->name);
+ 
+ 	odhcpd_get_mac(iface, mac);
+-	if (!memcmp(ll->sll_addr, mac, sizeof(mac)))
+	is_self_sent = !memcmp(ll->sll_addr, mac, sizeof(mac));
+	if (is_self_sent && !iface->master)
+ 		return; /* Looped back */
+ 
+ 	avl_for_each_element(&interfaces, c, avl) {
+@@ -366,7 +368,7 @@ static void handle_solicit(void *addr, v
+ 	/* Catch global-addressed NS and answer them manually.
+ 	 * The kernel won't answer these and cannot route them either. */
+ 	if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
+-			IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) {
+			IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) && !is_self_sent) {
+ 		bool is_proxy_neigh = netlink_get_interface_proxy_neigh(iface->ifindex,
+ 				&req->nd_ns_target) == 1;
+ 
--- a/package/network/services/odhcpd/patches/0002-router-fix-SLAAC-on-subnets-64.patch
+++ b/package/network/services/odhcpd/patches/0002-router-fix-SLAAC-on-subnets-64.patch
@ -0,0 +1,86 @@
+From 5eac9c56ff3b0a013c5241f449ca144f70bf4c02 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Tue, 7 Oct 2025 10:30:15 +0200
+Subject: [PATCH] router: fix SLAAC on subnets > 64
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ src/router.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/src/router.c
+++ b/src/router.c
+@@ -448,13 +448,13 @@ struct nd_opt_dnr_info {
+ 
+ /* IPv6 RA PIOs */
+ static struct ra_pio *router_find_ra_pio(struct interface *iface,
+-	struct nd_opt_prefix_info *p)
+	struct odhcpd_ipaddr *addr)
+ {
+ 	for (size_t i = 0; i < iface->pio_cnt; i++) {
+ 		struct ra_pio *cur_pio = &iface->pios[i];
+ 
+-		if (p->nd_opt_pi_prefix_len == cur_pio->length &&
+-			!odhcpd_bmemcmp(&p->nd_opt_pi_prefix, &cur_pio->prefix, cur_pio->length))
+		if (addr->prefix == cur_pio->length &&
+			!odhcpd_bmemcmp(&addr->addr.in6, &cur_pio->prefix, cur_pio->length))
+ 			return cur_pio;
+ 	}
+ 
+@@ -462,12 +462,12 @@ static struct ra_pio *router_find_ra_pio
+ }
+ 
+ static void router_add_ra_pio(struct interface *iface,
+-	struct nd_opt_prefix_info *p)
+	struct odhcpd_ipaddr *addr)
+ {
+ 	char ipv6_str[INET6_ADDRSTRLEN];
+ 	struct ra_pio *new_pios, *pio;
+ 
+-	pio = router_find_ra_pio(iface, p);
+	pio = router_find_ra_pio(iface, addr);
+ 	if (pio) {
+ 		if (pio->lifetime) {
+ 			pio->lifetime = 0;
+@@ -490,8 +490,8 @@ static void router_add_ra_pio(struct int
+ 	pio = &iface->pios[iface->pio_cnt];
+ 	iface->pio_cnt++;
+ 
+-	memcpy(&pio->prefix, &p->nd_opt_pi_prefix, sizeof(pio->prefix));
+-	pio->length = p->nd_opt_pi_prefix_len;
+	memcpy(&pio->prefix, &addr->addr.in6, sizeof(pio->prefix));
+	pio->length = addr->prefix;
+ 	pio->lifetime = 0;
+ 
+ 	iface->pio_update = true;
+@@ -538,10 +538,10 @@ static void router_clear_ra_pio(time_t n
+ }
+ 
+ static void router_stale_ra_pio(struct interface *iface,
+-	struct nd_opt_prefix_info *p,
+	struct odhcpd_ipaddr *addr,
+ 	time_t now)
+ {
+-	struct ra_pio *pio = router_find_ra_pio(iface, p);
+	struct ra_pio *pio = router_find_ra_pio(iface, addr);
+ 	char ipv6_str[INET6_ADDRSTRLEN];
+ 
+ 	if (!pio || pio->lifetime)
+@@ -774,12 +774,12 @@ static int send_router_advert(struct int
+ 			p->nd_opt_pi_preferred_time = 0;
+ 			p->nd_opt_pi_valid_time = 0;
+ 
+-			router_stale_ra_pio(iface, p, now);
+			router_stale_ra_pio(iface, addr, now);
+ 		} else {
+ 			p->nd_opt_pi_preferred_time = htonl(preferred_lt);
+ 			p->nd_opt_pi_valid_time = htonl(valid_lt);
+ 
+-			router_add_ra_pio(iface, p);
+			router_add_ra_pio(iface, addr);
+ 		}
+ 	}
+ 
--- a/package/network/services/odhcpd/patches/0003-ndp-fix-macOS-IPv6-compatibility-by-using-link-local-source-addresses.patch
+++ b/package/network/services/odhcpd/patches/0003-ndp-fix-macOS-IPv6-compatibility-by-using-link-local-source-addresses.patch
@ -0,0 +1,285 @@
+From d402cdae431668f55f9d82b7072b0afa3b8090df Mon Sep 17 00:00:00 2001
+From: Stephen Groat <stephen.groat@datadoghq.com>
+Date: Wed, 8 Oct 2025 11:54:51 -0700
+Subject: [PATCH] ndp: fix macOS IPv6 compatibility by using link-local source
+ addresses
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+macOS ignores NDP packets that don't originate from link-local addresses,
+causing IPv6 connectivity issues with odhcpd. This change ensures NDP
+packets (Neighbor Advertisements and ICMP Echo Requests) are sent using
+link-local source addresses for RFC 4861 compliance.
+
+Changes:
+* Add ndp_from_link_local configuration flag (defaults to true)
+* Add odhcpd_send_with_src() to allow explicit source address control
+* Add odhcpd_try_send_with_src() helper to eliminate code duplication
+* Add odhcpd_get_interface_linklocal_addr() with caching for performance
+* Update send_na() and ping6() to use link-local source addresses when
+  enabled
+* Add RFC 4861, §4.2 comments explaining the mandated behavior
+* Maintain backward compatibility with fallback behavior
+
+Fixes: openwrt/openwrt#7561 #202
+Signed-off-by: Stephen Groat <stephengroat@gmail.com>
+Link: https://github.com/openwrt/odhcpd/pull/242
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ README.md    |  1 +
+ src/config.c |  7 ++++
+ src/ndp.c    | 12 ++++---
+ src/odhcpd.c | 91 ++++++++++++++++++++++++++++++++++++++++------------
+ src/odhcpd.h | 11 +++++++
+ 5 files changed, 97 insertions(+), 25 deletions(-)
+
+--- a/README.md
+++ b/README.md
+@@ -114,6 +114,7 @@ and may also receive information from ub
+ | ra_pref64		|string	| -	| Announce PREF64 option for NAT64 prefix (RFC8781) [IPv6 prefix] |
+ | ndproxy_routing	|bool	| 1	| Learn routes from NDP |
+ | ndproxy_slave		|bool	| 0	| NDProxy external slave |
+| ndp_from_link_local	|bool	| 1	| Use link-local source addresses for NDP operations (RFC 4861, §4.2 compliance) and macOS compatibility |
+ | prefix_filter		|string	|`::/0`	| Only advertise on-link prefixes within the provided IPv6 prefix; others are filtered out. [IPv6 prefix] |
+ | ntp			|list	|`<local address>`| NTP servers to announce accepts IPv4 and IPv6 |
+ 
+--- a/src/config.c
+++ b/src/config.c
+@@ -117,6 +117,7 @@ enum {
+ 	IFACE_ATTR_PD_CER,
+ 	IFACE_ATTR_NDPROXY_ROUTING,
+ 	IFACE_ATTR_NDPROXY_SLAVE,
+	IFACE_ATTR_NDP_FROM_LINK_LOCAL,
+ 	IFACE_ATTR_PREFIX_FILTER,
+ 	IFACE_ATTR_MAX_PREFERRED_LIFETIME,
+ 	IFACE_ATTR_MAX_VALID_LIFETIME,
+@@ -171,6 +172,7 @@ static const struct blobmsg_policy iface
+ 	[IFACE_ATTR_RA_PREF64] = { .name = "ra_pref64", .type = BLOBMSG_TYPE_STRING },
+ 	[IFACE_ATTR_NDPROXY_ROUTING] = { .name = "ndproxy_routing", .type = BLOBMSG_TYPE_BOOL },
+ 	[IFACE_ATTR_NDPROXY_SLAVE] = { .name = "ndproxy_slave", .type = BLOBMSG_TYPE_BOOL },
+	[IFACE_ATTR_NDP_FROM_LINK_LOCAL] = { .name = "ndp_from_link_local", .type = BLOBMSG_TYPE_BOOL },
+ 	[IFACE_ATTR_PREFIX_FILTER] = { .name = "prefix_filter", .type = BLOBMSG_TYPE_STRING },
+ 	[IFACE_ATTR_MAX_PREFERRED_LIFETIME] = { .name = "max_preferred_lifetime", .type = BLOBMSG_TYPE_STRING },
+ 	[IFACE_ATTR_MAX_VALID_LIFETIME] = { .name = "max_valid_lifetime", .type = BLOBMSG_TYPE_STRING },
+@@ -271,6 +273,8 @@ static void set_interface_defaults(struc
+ 	iface->ra = MODE_DISABLED;
+ 	iface->ndp = MODE_DISABLED;
+ 	iface->learn_routes = 1;
+	iface->ndp_from_link_local = true;
+	iface->cached_linklocal_valid = false;
+ 	iface->dhcp_leasetime = 43200;
+ 	iface->max_preferred_lifetime = ND_PREFERRED_LIMIT;
+ 	iface->max_valid_lifetime = ND_VALID_LIMIT;
+@@ -1451,6 +1455,9 @@ int config_parse_interface(void *data, s
+ 	if ((c = tb[IFACE_ATTR_NDPROXY_SLAVE]))
+ 		iface->external = blobmsg_get_bool(c);
+ 
+	if ((c = tb[IFACE_ATTR_NDP_FROM_LINK_LOCAL]))
+		iface->ndp_from_link_local = blobmsg_get_bool(c);
+
+ 	if ((c = tb[IFACE_ATTR_PREFIX_FILTER]))
+ 		odhcpd_parse_addr6_prefix(blobmsg_get_string(c),
+ 					  &iface->pio_filter_addr,
+--- a/src/ndp.c
+++ b/src/ndp.c
+@@ -280,7 +280,7 @@ static void ndp_netevent_cb(unsigned lon
+ /* Send an ICMP-ECHO. This is less for actually pinging but for the
+  * neighbor cache to be kept up-to-date. */
+ static void ping6(struct in6_addr *addr,
+-		const struct interface *iface)
+		struct interface *iface)
+ {
+ 	struct sockaddr_in6 dest = { .sin6_family = AF_INET6, .sin6_addr = *addr , };
+ 	struct icmp6_hdr echo = { .icmp6_type = ICMP6_ECHO_REQUEST };
+@@ -291,13 +291,16 @@ static void ping6(struct in6_addr *addr,
+ 	syslog(LOG_DEBUG, "Pinging for %s on %s", ipbuf, iface->name);
+ 
+ 	netlink_setup_route(addr, 128, iface->ifindex, NULL, 128, true);
+-	odhcpd_send(iface->ndp_ping_fd, &dest, &iov, 1, iface);
+
+	/* Use link-local address as source for RFC 4861 compliance and macOS compatibility */
+	odhcpd_try_send_with_src(iface->ndp_ping_fd, &dest, &iov, 1, iface);
+
+ 	netlink_setup_route(addr, 128, iface->ifindex, NULL, 128, false);
+ }
+ 
+ /* Send a Neighbor Advertisement. */
+ static void send_na(struct in6_addr *to_addr,
+-		const struct interface *iface, struct in6_addr *for_addr,
+		struct interface *iface, struct in6_addr *for_addr,
+ 		const uint8_t *mac)
+ {
+ 	struct sockaddr_in6 dest = { .sin6_family = AF_INET6, .sin6_addr = *to_addr };
+@@ -319,7 +322,8 @@ static void send_na(struct in6_addr *to_
+ 	inet_ntop(AF_INET6, to_addr, ipbuf, sizeof(ipbuf));
+ 	syslog(LOG_DEBUG, "Answering NS to %s on %s", ipbuf, iface->ifname);
+ 
+-	odhcpd_send(iface->ndp_ping_fd, &dest, &iov, 1, iface);
+	/* Use link-local address as source for RFC 4861 compliance and macOS compatibility */
+	odhcpd_try_send_with_src(iface->ndp_ping_fd, &dest, &iov, 1, iface);
+ }
+ 
+ /* Handle solicitations */
+--- a/src/odhcpd.c
+++ b/src/odhcpd.c
+@@ -189,10 +189,10 @@ int odhcpd_get_flags(const struct interf
+ }
+ 
+ 
+-/* Forwards a packet on a specific interface */
+-ssize_t odhcpd_send(int socket, struct sockaddr_in6 *dest,
+/* Forwards a packet on a specific interface with optional source address */
+ssize_t odhcpd_send_with_src(int socket, struct sockaddr_in6 *dest,
+ 		struct iovec *iov, size_t iov_len,
+-		const struct interface *iface)
+		const struct interface *iface, const struct in6_addr *src_addr)
+ {
+ 	/* Construct headers */
+ 	uint8_t cmsg_buf[CMSG_SPACE(sizeof(struct in6_pktinfo))] = {0};
+@@ -214,6 +214,10 @@ ssize_t odhcpd_send(int socket, struct s
+ 	struct in6_pktinfo *pktinfo = (struct in6_pktinfo*)CMSG_DATA(chdr);
+ 	pktinfo->ipi6_ifindex = iface->ifindex;
+ 
+	/* Set source address if provided */
+	if (src_addr)
+		pktinfo->ipi6_addr = *src_addr;
+
+ 	/* Also set scope ID if link-local */
+ 	if (IN6_IS_ADDR_LINKLOCAL(&dest->sin6_addr)
+ 			|| IN6_IS_ADDR_MC_LINKLOCAL(&dest->sin6_addr))
+@@ -232,30 +236,75 @@ ssize_t odhcpd_send(int socket, struct s
+ 	return sent;
+ }
+ 
+/* Forwards a packet on a specific interface */
+ssize_t odhcpd_send(int socket, struct sockaddr_in6 *dest,
+		struct iovec *iov, size_t iov_len,
+		const struct interface *iface)
+{
+	return odhcpd_send_with_src(socket, dest, iov, iov_len, iface, NULL);
+}
+
+ 
+-static int odhcpd_get_linklocal_interface_address(int ifindex, struct in6_addr *lladdr)
+int odhcpd_get_interface_linklocal_addr(struct interface *iface, struct in6_addr *addr)
+ {
+-	int ret = -1;
+-	struct sockaddr_in6 addr;
+-	socklen_t alen = sizeof(addr);
+-	int sock = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
+	/* Return cached address if valid */
+	if (iface->cached_linklocal_valid) {
+		*addr = iface->cached_linklocal_addr;
+		return 0;
+	}
+ 
+-	if (sock < 0)
+-		return -1;
+	/* First try to get link-local address from interface addresses */
+	for (size_t i = 0; i < iface->addr6_len; ++i) {
+		if (IN6_IS_ADDR_LINKLOCAL(&iface->addr6[i].addr.in6)) {
+			*addr = iface->addr6[i].addr.in6;
+			/* Cache the result for future use */
+			iface->cached_linklocal_addr = *addr;
+			iface->cached_linklocal_valid = true;
+			return 0;
+		}
+	}
+ 
+-	memset(&addr, 0, sizeof(addr));
+-	addr.sin6_family = AF_INET6;
+-	inet_pton(AF_INET6, ALL_IPV6_ROUTERS, &addr.sin6_addr);
+-	addr.sin6_scope_id = ifindex;
+-
+-	if (!connect(sock, (struct sockaddr*)&addr, sizeof(addr)) &&
+-			!getsockname(sock, (struct sockaddr*)&addr, &alen)) {
+-		*lladdr = addr.sin6_addr;
+-		ret = 0;
+	/* Fallback to socket-based method */
+	struct sockaddr_in6 sockaddr;
+	socklen_t alen = sizeof(sockaddr);
+	int sock = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6);
+
+	if (sock >= 0) {
+		memset(&sockaddr, 0, sizeof(sockaddr));
+		sockaddr.sin6_family = AF_INET6;
+		inet_pton(AF_INET6, ALL_IPV6_ROUTERS, &sockaddr.sin6_addr);
+		sockaddr.sin6_scope_id = iface->ifindex;
+
+		if (!connect(sock, (struct sockaddr*)&sockaddr, sizeof(sockaddr)) &&
+				!getsockname(sock, (struct sockaddr*)&sockaddr, &alen)) {
+			*addr = sockaddr.sin6_addr;
+			/* Cache the result for future use */
+			iface->cached_linklocal_addr = *addr;
+			iface->cached_linklocal_valid = true;
+			close(sock);
+			return 0;
+		}
+		close(sock);
+ 	}
+ 
+-	close(sock);
+-	return ret;
+	return -1;
+}
+
+/* Try to send with link-local source address for RFC 4861 compliance and macOS compatibility.
+ * RFC 4861, §4.2 mandates that Neighbor Advertisement source address MUST be
+ * the link-local address assigned to the interface from which this message is sent. */
+ssize_t odhcpd_try_send_with_src(int socket, struct sockaddr_in6 *dest,
+		struct iovec *iov, size_t iov_len,
+		struct interface *iface)
+{
+	struct in6_addr src_addr;
+
+	if (iface->ndp_from_link_local && odhcpd_get_interface_linklocal_addr(iface, &src_addr) == 0) {
+		return odhcpd_send_with_src(socket, dest, iov, iov_len, iface, &src_addr);
+	} else {
+		/* Fall back to default behavior if no link-local address is available or flag is disabled */
+		return odhcpd_send(socket, dest, iov, iov_len, iface);
+	}
+ }
+ 
+ /*
+@@ -303,7 +352,7 @@ int odhcpd_get_interface_dns_addr(const
+ 		return 0;
+ 	}
+ 
+-	return odhcpd_get_linklocal_interface_address(iface->ifindex, addr);
+	return odhcpd_get_interface_linklocal_addr(iface, addr);
+ }
+ 
+ struct interface* odhcpd_get_interface_by_index(int ifindex)
+--- a/src/odhcpd.h
+++ b/src/odhcpd.h
+@@ -333,6 +333,9 @@ struct interface {
+ 
+ 	// NDP
+ 	int learn_routes;
+	bool ndp_from_link_local;
+	struct in6_addr cached_linklocal_addr;
+	bool cached_linklocal_valid;
+ 
+ 	// RA
+ 	uint8_t ra_flags;
+@@ -469,11 +472,19 @@ int odhcpd_register(struct odhcpd_event
+ int odhcpd_deregister(struct odhcpd_event *event);
+ void odhcpd_process(struct odhcpd_event *event);
+ 
+ssize_t odhcpd_send_with_src(int socket, struct sockaddr_in6 *dest,
+		struct iovec *iov, size_t iov_len,
+		const struct interface *iface, const struct in6_addr *src_addr);
+ ssize_t odhcpd_send(int socket, struct sockaddr_in6 *dest,
+ 		struct iovec *iov, size_t iov_len,
+ 		const struct interface *iface);
+ssize_t odhcpd_try_send_with_src(int socket, struct sockaddr_in6 *dest,
+		struct iovec *iov, size_t iov_len,
+		struct interface *iface);
+ int odhcpd_get_interface_dns_addr(const struct interface *iface,
+ 		struct in6_addr *addr);
+int odhcpd_get_interface_linklocal_addr(struct interface *iface,
+		struct in6_addr *addr);
+ int odhcpd_get_interface_config(const char *ifname, const char *what);
+ int odhcpd_get_mac(const struct interface *iface, uint8_t mac[6]);
+ int odhcpd_get_flags(const struct interface *iface);
--- a/package/network/services/odhcpd/patches/0004-odhcpd-fix-a-compilation-error.patch
+++ b/package/network/services/odhcpd/patches/0004-odhcpd-fix-a-compilation-error.patch
@ -0,0 +1,44 @@
+From 30780debd691aee7567784daf1fdfd8db500a485 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20H=C3=A4rdeman?= <david@hardeman.nu>
+Date: Thu, 9 Oct 2025 11:08:14 +0200
+Subject: [PATCH] odhcpd: fix a compilation error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+odhcpd_get_interface_dns_addr() calls odhcpd_get_interface_linklocal_addr(),
+the former takes a const struct interface ptr, the latter takes a non-const
+struct interface ptr.
+
+The end result is an unhappy compiler.
+
+Signed-off-by: David Härdeman <david@hardeman.nu>
+Link: https://github.com/openwrt/odhcpd/pull/272
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ src/odhcpd.c | 2 +-
+ src/odhcpd.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/src/odhcpd.c
+++ b/src/odhcpd.c
+@@ -314,7 +314,7 @@ ssize_t odhcpd_try_send_with_src(int soc
+  * - use an IPv6 ULA address if the already selected IPv6 address is not an ULA address
+  * - use the IPv6 address with the longest preferred lifetime
+  */
+-int odhcpd_get_interface_dns_addr(const struct interface *iface, struct in6_addr *addr)
+int odhcpd_get_interface_dns_addr(struct interface *iface, struct in6_addr *addr)
+ {
+ 	time_t now = odhcpd_time();
+ 	ssize_t m = -1;
+--- a/src/odhcpd.h
+++ b/src/odhcpd.h
+@@ -481,7 +481,7 @@ ssize_t odhcpd_send(int socket, struct s
+ ssize_t odhcpd_try_send_with_src(int socket, struct sockaddr_in6 *dest,
+ 		struct iovec *iov, size_t iov_len,
+ 		struct interface *iface);
+-int odhcpd_get_interface_dns_addr(const struct interface *iface,
+int odhcpd_get_interface_dns_addr(struct interface *iface,
+ 		struct in6_addr *addr);
+ int odhcpd_get_interface_linklocal_addr(struct interface *iface,
+ 		struct in6_addr *addr);
--- a/package/network/utils/ebtables/Makefile
+++ b/package/network/utils/ebtables/Makefile
@ -12,9 +12,9 @@ PKG_SOURCE_DATE:=2018-06-27
 PKG_RELEASE:=2

 PKG_SOURCE_URL:=https://git.netfilter.org/ebtables
+PKG_MIRROR_HASH:=3039d73b167c41025b1b401b647743b9c6d786613c693eef34de325b30de6d47
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=48cff25dfea5b37e16ba5dc6601e98ab140f5f99
-PKG_MIRROR_HASH:=1ee560498e1a047b329eab3dad8425ae51e7f0527e4495efb99481ca11206b37

 PKG_LICENSE:=GPL-2.0
 PKG_CPE_ID:=cpe:/a:netfilter:ebtables
--- a/package/system/ubus/Makefile
+++ b/package/system/ubus/Makefile
@ -5,10 +5,10 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ubus.git
-PKG_SOURCE_DATE:=2025-07-02
+PKG_SOURCE_DATE:=2025-10-17
 PKG_SOURCE_DATE_ABI:=2025-01-02
-PKG_SOURCE_VERSION:=5952b48e251c0ea76dfce97f129da6f18d889eda
-PKG_MIRROR_HASH:=60edfc101eaa85976d243febc368fc419fe44283bd3a743851a6bc7975e881f0
+PKG_SOURCE_VERSION:=60e04048a0e2f3e33651c19e62861b41be4c290f
+PKG_MIRROR_HASH:=2db028305ae58afe184bb01e51d3635898d84ffcd04308a73ce143c05fc7b2db
 PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE_ABI))
 CMAKE_INSTALL:=1

--- a/target/linux/ath79/dts/qca9561_tplink_archer-c59-v1.dts
+++ b/target/linux/ath79/dts/qca9561_tplink_archer-c59-v1.dts
@ -37,6 +37,7 @@
 		reg = <0x0000 0 0 0 0>;
 		nvmem-cells = <&precal_art_5000>, <&macaddr_info_8 (-1)>;
 		nvmem-cell-names = "pre-calibration", "mac-address";
+		qcom,ath10k-calibration-variant = "TP-Link-Archer-c59-v1";
 	};
 };

--- a/target/linux/ath79/dts/qca9561_tplink_archer-c60-v1.dts
+++ b/target/linux/ath79/dts/qca9561_tplink_archer-c60-v1.dts
@ -33,6 +33,7 @@
 		reg = <0x0000 0 0 0 0>;
 		nvmem-cells = <&precal_art_5000>, <&macaddr_info_8 (-1)>;
 		nvmem-cell-names = "pre-calibration", "mac-address";
+		qcom,ath10k-calibration-variant = "TP-Link-Archer-c60-v1";
 	};
 };

--- a/target/linux/ath79/image/common-nec.mk
+++ b/target/linux/ath79/image/common-nec.mk
@ -12,6 +12,7 @@ define Device/nec-netbsd-aterm
  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
  ARTIFACTS := uboot.bin
+ifeq ($(IB),)
 ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
  COMPILE := loader-$(1).bin
  COMPILE/loader-$(1).bin := loader-okli-compile
@ -19,6 +20,7 @@ ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
  ARTIFACT/initramfs-factory.bin := append-image-stage initramfs-kernel.bin | \
 	pad-to 4 skip=16 | \
 	nec-usbaterm-fw -f 0x0003 -d $$(KDIR)/loader-$(1).bin -d $$$$@ | check-size
+endif
 endif
  UBOOT_PATH := $$(STAGING_DIR_IMAGE)/$$(SOC)_nec_aterm-u-boot.bin
  ARTIFACT/uboot.bin := append-uboot | check-size 128k
--- a/target/linux/ath79/image/generic-tp-link.mk
+++ b/target/linux/ath79/image/generic-tp-link.mk
@ -79,7 +79,7 @@ define Device/tplink_archer-c59-v1
  DEVICE_VARIANT := v1
  TPLINK_BOARD_ID := ARCHER-C59-V1
  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ledtrig-usbport kmod-ath10k-ct \
-	ath10k-firmware-qca9888-ct
+	ath10k-firmware-qca9888-ct ipq-wifi-tplink_archer-c59-v1
  SUPPORTED_DEVICES += archer-c59-v1
 endef
 TARGET_DEVICES += tplink_archer-c59-v1
@ -129,7 +129,7 @@ define Device/tplink_archer-c60-v1
  DEVICE_MODEL := Archer C60
  DEVICE_VARIANT := v1
  TPLINK_BOARD_ID := ARCHER-C60-V1
-  DEVICE_PACKAGES := kmod-ath10k-ct-smallbuffers ath10k-firmware-qca9888-ct
+  DEVICE_PACKAGES := kmod-ath10k-ct-smallbuffers ath10k-firmware-qca9888-ct ipq-wifi-tplink_archer-c60-v1
  SUPPORTED_DEVICES += archer-c60-v1
 endef
 TARGET_DEVICES += tplink_archer-c60-v1
--- a/target/linux/ath79/image/generic.mk
+++ b/target/linux/ath79/image/generic.mk
@ -1370,11 +1370,13 @@ define Device/elecom_wrc-1750ghbk2-i
  DEVICE_VENDOR := ELECOM
  DEVICE_MODEL := WRC-1750GHBK2-I/C
  IMAGE_SIZE := 15808k
+ifeq ($(IB),)
 ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
  ARTIFACTS := initramfs-factory.bin
  ARTIFACT/initramfs-factory.bin := append-image initramfs-kernel.bin | \
 	pad-to 2 | edimax-header -b -s CSYS -m RN68 -f 0x70000 -S 0x01100000 | \
 	elecom-product-header WRC-1750GHBK2 | check-size
+endif
 endif
  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca988x-ct
 endef
@ -1385,12 +1387,14 @@ define Device/elecom_wrc-300ghbk2-i
  DEVICE_VENDOR := ELECOM
  DEVICE_MODEL := WRC-300GHBK2-I
  IMAGE_SIZE := 7616k
+ifeq ($(IB),)
 ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
  ARTIFACTS := initramfs-factory.bin
  ARTIFACT/initramfs-factory.bin := append-image initramfs-kernel.bin | \
 	pad-to 2 | edimax-header -b -s CSYS -m RN51 -f 0x70000 -S 0x01100000 | \
 	elecom-product-header WRC-300GHBK2-I | check-size
 endif
+endif
 endef
 TARGET_DEVICES += elecom_wrc-300ghbk2-i

--- a/target/linux/bcm27xx/patches-6.6/950-0065-cgroup-Disable-cgroup-memory-by-default.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0065-cgroup-Disable-cgroup-memory-by-default.patch
@ -17,7 +17,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>

 --- a/kernel/cgroup/cgroup.c
 +++ b/kernel/cgroup/cgroup.c
-@@ -6059,6 +6059,9 @@ int __init cgroup_init_early(void)
+@@ -6082,6 +6082,9 @@ int __init cgroup_init_early(void)
 	return 0;
 }
 
@ -27,7 +27,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 /**
  * cgroup_init - cgroup initialization
  *
-@@ -6092,6 +6095,12 @@ int __init cgroup_init(void)
+@@ -6115,6 +6118,12 @@ int __init cgroup_init(void)
 
 	cgroup_unlock();
 
@ -40,7 +40,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 	for_each_subsys(ss, ssid) {
 		if (ss->early_init) {
 			struct cgroup_subsys_state *css =
-@@ -6740,6 +6749,10 @@ static int __init cgroup_disable(char *s
+@@ -6769,6 +6778,10 @@ static int __init cgroup_disable(char *s
 			    strcmp(token, ss->legacy_name))
 				continue;
 
@ -51,7 +51,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 			static_branch_disable(cgroup_subsys_enabled_key[i]);
 			pr_info("Disabling %s control group subsystem\n",
 				ss->name);
-@@ -6758,6 +6771,31 @@ static int __init cgroup_disable(char *s
+@@ -6787,6 +6800,31 @@ static int __init cgroup_disable(char *s
 }
 __setup("cgroup_disable=", cgroup_disable);
 
--- a/target/linux/bcm27xx/patches-6.6/950-0106-Add-support-for-all-the-downstream-rpi-sound-card-dr.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0106-Add-support-for-all-the-downstream-rpi-sound-card-dr.patch
@ -17583,7 +17583,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 	 * For devices with more than one control interface, we assume the
 --- a/sound/usb/quirks.c
 +++ b/sound/usb/quirks.c
-@@ -2260,6 +2260,8 @@ static const struct usb_audio_quirk_flag
+@@ -2278,6 +2278,8 @@ static const struct usb_audio_quirk_flag
 		   QUIRK_FLAG_ALIGN_TRANSFER),
 	DEVICE_FLG(0x534d, 0x2109, /* MacroSilicon MS2109 */
 		   QUIRK_FLAG_ALIGN_TRANSFER),
--- a/target/linux/bcm27xx/patches-6.6/950-0441-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0441-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch
@ -20,7 +20,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>

 --- a/net/bluetooth/hci_sync.c
 +++ b/net/bluetooth/hci_sync.c
-@@ -4927,6 +4927,7 @@ static const struct {
+@@ -4934,6 +4934,7 @@ static const struct {
  */
 static int hci_dev_setup_sync(struct hci_dev *hdev)
 {
@ -28,7 +28,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 	int ret = 0;
 	bool invalid_bdaddr;
 	size_t i;
-@@ -4955,7 +4956,8 @@ static int hci_dev_setup_sync(struct hci
+@@ -4962,7 +4963,8 @@ static int hci_dev_setup_sync(struct hci
 			 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
 	if (!ret) {
 		if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) &&
--- a/target/linux/bcm27xx/patches-6.6/950-0475-serial-sc16is7xx-Read-modem-line-state-at-startup.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0475-serial-sc16is7xx-Read-modem-line-state-at-startup.patch
@ -16,7 +16,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>

 --- a/drivers/tty/serial/sc16is7xx.c
 +++ b/drivers/tty/serial/sc16is7xx.c
-@@ -1210,6 +1210,9 @@ static int sc16is7xx_startup(struct uart
+@@ -1200,6 +1200,9 @@ static int sc16is7xx_startup(struct uart
 	      SC16IS7XX_IER_MSI_BIT;
 	sc16is7xx_port_write(port, SC16IS7XX_IER_REG, val);
 
--- a/target/linux/bcm27xx/patches-6.6/950-0518-net-macb-Also-set-DMA-coherent-mask.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0518-net-macb-Also-set-DMA-coherent-mask.patch
@ -199,7 +199,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 	snprintf(bp->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
 		 bp->pdev->name, bp->pdev->id);
 	bp->mii_bus->priv = bp;
-@@ -1641,6 +1658,11 @@ static int macb_rx(struct macb_queue *qu
+@@ -1642,6 +1659,11 @@ static int macb_rx(struct macb_queue *qu
 
 		macb_init_rx_ring(queue);
 		queue_writel(queue, RBQP, queue->rx_ring_dma);
@ -211,7 +211,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 		macb_writel(bp, NCR, ctrl | MACB_BIT(RE));
 
-@@ -1941,8 +1963,9 @@ static irqreturn_t macb_interrupt(int ir
+@@ -1944,8 +1966,9 @@ static irqreturn_t macb_interrupt(int ir
 				queue_writel(queue, ISR, MACB_BIT(TCOMP) |
 							 MACB_BIT(TXUBR));
 
@ -222,19 +222,19 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 				wmb(); // ensure softirq can see update
 			}
 
-@@ -2397,6 +2420,11 @@ static netdev_tx_t macb_start_xmit(struc
+@@ -2401,6 +2424,11 @@ static netdev_tx_t macb_start_xmit(struc
 	skb_tx_timestamp(skb);
 
- 	spin_lock_irq(&bp->lock);
+ 	spin_lock(&bp->lock);
 +
 +	/* TSTART write might get dropped, so make the IRQ retrigger a buffer read */
 +	if (macb_readl(bp, TSR) & MACB_BIT(TGO))
 +		queue->tx_pending = 1;
 +
 	macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART));
- 	spin_unlock_irq(&bp->lock);
+ 	spin_unlock(&bp->lock);
 
-@@ -2771,6 +2799,37 @@ static void macb_configure_dma(struct ma
+@@ -2775,6 +2803,37 @@ static void macb_configure_dma(struct ma
 	}
 }
 
@ -272,7 +272,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 static void macb_init_hw(struct macb *bp)
 {
 	u32 config;
-@@ -2799,6 +2858,11 @@ static void macb_init_hw(struct macb *bp
+@@ -2803,6 +2862,11 @@ static void macb_init_hw(struct macb *bp
 	if (bp->caps & MACB_CAPS_JUMBO)
 		bp->rx_frm_len_mask = MACB_RX_JFRMLEN_MASK;
 
@ -284,7 +284,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 	macb_configure_dma(bp);
 
 	/* Enable RX partial store and forward and set watermark */
-@@ -3163,6 +3227,52 @@ static void gem_get_ethtool_strings(stru
+@@ -3167,6 +3231,52 @@ static void gem_get_ethtool_strings(stru
 	}
 }
 
@ -337,7 +337,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 static struct net_device_stats *macb_get_stats(struct net_device *dev)
 {
 	struct macb *bp = netdev_priv(dev);
-@@ -3757,6 +3867,8 @@ static const struct ethtool_ops macb_eth
+@@ -3761,6 +3871,8 @@ static const struct ethtool_ops macb_eth
 };
 
 static const struct ethtool_ops gem_ethtool_ops = {
@ -346,7 +346,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 	.get_regs_len		= macb_get_regs_len,
 	.get_regs		= macb_get_regs,
 	.get_wol		= macb_get_wol,
-@@ -3766,6 +3878,8 @@ static const struct ethtool_ops gem_etht
+@@ -3770,6 +3882,8 @@ static const struct ethtool_ops gem_etht
 	.get_ethtool_stats	= gem_get_ethtool_stats,
 	.get_strings		= gem_get_ethtool_strings,
 	.get_sset_count		= gem_get_sset_count,
@ -355,7 +355,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 	.get_link_ksettings     = macb_get_link_ksettings,
 	.set_link_ksettings     = macb_set_link_ksettings,
 	.get_ringparam		= macb_get_ringparam,
-@@ -5062,6 +5176,11 @@ static int macb_probe(struct platform_de
+@@ -5066,6 +5180,11 @@ static int macb_probe(struct platform_de
 			}
 		}
 	}
@ -367,7 +367,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 	spin_lock_init(&bp->lock);
 	spin_lock_init(&bp->stats_lock);
 
-@@ -5122,6 +5241,21 @@ static int macb_probe(struct platform_de
+@@ -5126,6 +5245,21 @@ static int macb_probe(struct platform_de
 	else
 		bp->phy_interface = interface;
 
@ -389,7 +389,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 	/* IP specific init */
 	err = init(pdev);
 	if (err)
-@@ -5198,6 +5332,19 @@ static int macb_remove(struct platform_d
+@@ -5202,6 +5336,19 @@ static int macb_remove(struct platform_d
 	return 0;
 }
 
@ -409,7 +409,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 static int __maybe_unused macb_suspend(struct device *dev)
 {
 	struct net_device *netdev = dev_get_drvdata(dev);
-@@ -5412,6 +5559,7 @@ static const struct dev_pm_ops macb_pm_o
+@@ -5416,6 +5563,7 @@ static const struct dev_pm_ops macb_pm_o
 static struct platform_driver macb_driver = {
 	.probe		= macb_probe,
 	.remove		= macb_remove,
--- a/target/linux/bcm27xx/patches-6.6/950-1218-Bluetooth-hci_sync-Fix-crash-on-NULL-parent.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1218-Bluetooth-hci_sync-Fix-crash-on-NULL-parent.patch
@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>

 --- a/net/bluetooth/hci_sync.c
 +++ b/net/bluetooth/hci_sync.c
-@@ -4927,7 +4927,8 @@ static const struct {
+@@ -4934,7 +4934,8 @@ static const struct {
  */
 static int hci_dev_setup_sync(struct hci_dev *hdev)
 {
--- a/target/linux/bcm27xx/patches-6.6/950-1349-cgroup-Use-kernel-command-line-to-disable-memory-cgr.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1349-cgroup-Use-kernel-command-line-to-disable-memory-cgr.patch
@ -148,7 +148,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
 
 --- a/kernel/cgroup/cgroup.c
 +++ b/kernel/cgroup/cgroup.c
-@@ -6059,9 +6059,6 @@ int __init cgroup_init_early(void)
+@@ -6082,9 +6082,6 @@ int __init cgroup_init_early(void)
 	return 0;
 }
 
@ -158,7 +158,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
 /**
  * cgroup_init - cgroup initialization
  *
-@@ -6095,12 +6092,6 @@ int __init cgroup_init(void)
+@@ -6118,12 +6115,6 @@ int __init cgroup_init(void)
 
 	cgroup_unlock();
 
@ -171,7 +171,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
 	for_each_subsys(ss, ssid) {
 		if (ss->early_init) {
 			struct cgroup_subsys_state *css =
-@@ -6749,10 +6740,6 @@ static int __init cgroup_disable(char *s
+@@ -6778,10 +6769,6 @@ static int __init cgroup_disable(char *s
 			    strcmp(token, ss->legacy_name))
 				continue;
 
@ -182,7 +182,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
 			static_branch_disable(cgroup_subsys_enabled_key[i]);
 			pr_info("Disabling %s control group subsystem\n",
 				ss->name);
-@@ -6786,7 +6773,7 @@ static int __init cgroup_enable(char *st
+@@ -6815,7 +6802,7 @@ static int __init cgroup_enable(char *st
 			    strcmp(token, ss->legacy_name))
 				continue;
 
--- a/target/linux/bcm27xx/patches-6.6/950-1423-net-macb-Add-support-for-Raspberry-Pi-RP1-ethernet-c.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1423-net-macb-Add-support-for-Raspberry-Pi-RP1-ethernet-c.patch
@ -15,7 +15,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>

 --- a/drivers/net/ethernet/cadence/macb_main.c
 +++ b/drivers/net/ethernet/cadence/macb_main.c
-@@ -5023,6 +5023,17 @@ static const struct macb_config versal_c
+@@ -5027,6 +5027,17 @@ static const struct macb_config versal_c
 	.usrio = &macb_default_usrio,
 };
 
@ -33,7 +33,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 static const struct of_device_id macb_dt_ids[] = {
 	{ .compatible = "cdns,at91sam9260-macb", .data = &at91sam9260_config },
 	{ .compatible = "cdns,macb" },
-@@ -5043,6 +5054,7 @@ static const struct of_device_id macb_dt
+@@ -5047,6 +5058,7 @@ static const struct of_device_id macb_dt
 	{ .compatible = "microchip,mpfs-macb", .data = &mpfs_config },
 	{ .compatible = "microchip,sama7g5-gem", .data = &sama7g5_gem_config },
 	{ .compatible = "microchip,sama7g5-emac", .data = &sama7g5_emac_config },
--- a/target/linux/bcm27xx/patches-6.6/950-1445-fixup-cgroup-Use-kernel-command-line-to-disable-memo.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1445-fixup-cgroup-Use-kernel-command-line-to-disable-memo.patch
@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>

 --- a/kernel/cgroup/cgroup.c
 +++ b/kernel/cgroup/cgroup.c
-@@ -6773,11 +6773,19 @@ static int __init cgroup_enable(char *st
+@@ -6802,11 +6802,19 @@ static int __init cgroup_enable(char *st
 			    strcmp(token, ss->legacy_name))
 				continue;
 
--- a/target/linux/bcm27xx/patches-6.6/950-1464-serial-sc16is7xx-announce-support-for-SER_RS485_RTS_.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1464-serial-sc16is7xx-announce-support-for-SER_RS485_RTS_.patch
@ -31,7 +31,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 --- a/drivers/tty/serial/sc16is7xx.c
 +++ b/drivers/tty/serial/sc16is7xx.c
-@@ -1480,7 +1480,7 @@ static int sc16is7xx_setup_mctrl_ports(s
+@@ -1470,7 +1470,7 @@ static int sc16is7xx_setup_mctrl_ports(s
 }
 
 static const struct serial_rs485 sc16is7xx_rs485_supported = {
--- a/target/linux/bcm53xx/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
+++ b/target/linux/bcm53xx/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
@ -23,7 +23,7 @@ it on BCM4708 family.
 static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
 {
 	struct xhci_plat_priv *priv = xhci_to_priv(xhci);
-+	struct platform_device*pdev = to_platform_device(dev);
+	struct platform_device *pdev = to_platform_device(dev);
 +	struct device_node *node = pdev->dev.of_node;
 
 	xhci->quirks |= priv->quirks;
@ -73,7 +73,7 @@ it on BCM4708 family.
 +	}
 +
 +	/* Free virt device */
-+	xhci_disable_and_free_slot(xhci, slot_id);
+	xhci_free_virt_device(xhci, xhci->devs[slot_id], slot_id);
 +
 +	/* We're done if controller is already running */
 +	if (readl(&xhci->op_regs->command) & CMD_RUN)
--- a/target/linux/generic/backport-6.6/0080-v6.9-smp-Avoid-setup_max_cpus_namespace_collision_shadowing.patch
+++ b/target/linux/generic/backport-6.6/0080-v6.9-smp-Avoid-setup_max_cpus_namespace_collision_shadowing.patch
@ -21,7 +21,7 @@ Cc: linux-kernel@vger.kernel.org

 --- a/include/linux/cpu.h
 +++ b/include/linux/cpu.h
-@@ -112,7 +112,7 @@ void notify_cpu_starting(unsigned int cp
+@@ -113,7 +113,7 @@ void notify_cpu_starting(unsigned int cp
 extern void cpu_maps_update_begin(void);
 extern void cpu_maps_update_done(void);
 int bringup_hibernate_cpu(unsigned int sleep_cpu);
--- a/target/linux/generic/backport-6.6/540-v6.12-ksmbd-browse-interfaces-list-on-FSCTL_QUERY_INTERFACE_INFO.patch
+++ b/target/linux/generic/backport-6.6/540-v6.12-ksmbd-browse-interfaces-list-on-FSCTL_QUERY_INTERFACE_INFO.patch
@ -0,0 +1,35 @@
+From 0fc403192dcc8def1f6284959141608ac4c86699 Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Fri, 10 Jan 2025 13:37:05 +0900
+Subject: ksmbd: browse interfaces list on FSCTL_QUERY_INTERFACE_INFO IOCTL
+
+[ Upstream commit b2d99376c5d61eb60ffdb6c503e4b6c8f9712ddd ]
+
+ksmbd.mount will give each interfaces list and bind_interfaces_only flags
+to ksmbd server. Previously, the interfaces list was sent only
+when bind_interfaces_only was enabled.
+ksmbd server browse only interfaces list given from ksmbd.conf on
+FSCTL_QUERY_INTERFACE_INFO IOCTL.
+
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Stable-dep-of: 21a4e47578d4 ("ksmbd: fix use-after-free in __smb2_lease_break_noti()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/smb/server/ksmbd_netlink.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+(limited to 'fs/smb/server/ksmbd_netlink.h')
+
+--- a/fs/smb/server/ksmbd_netlink.h
+++ b/fs/smb/server/ksmbd_netlink.h
+@@ -108,7 +108,8 @@ struct ksmbd_startup_request {
+ 	__u32	smb2_max_credits;	/* MAX credits */
+ 	__u32	smbd_max_io_size;	/* smbd read write size */
+ 	__u32	max_connections;	/* Number of maximum simultaneous connections */
+-	__u32	reserved[126];		/* Reserved room */
+	__s8	bind_interfaces_only;
+	__s8	reserved[503];		/* Reserved room */
+ 	__u32	ifc_list_sz;		/* interfaces list size */
+ 	__s8	____payload[];
+ };
--- a/target/linux/generic/backport-6.6/541-v6.18-ksmbd-add-max-ip-connections-parameter.patch
+++ b/target/linux/generic/backport-6.6/541-v6.18-ksmbd-add-max-ip-connections-parameter.patch
@ -0,0 +1,119 @@
+From d8b6dc9256762293048bf122fc11c4e612d0ef5d Mon Sep 17 00:00:00 2001
+From: Namjae Jeon <linkinjeon@kernel.org>
+Date: Wed, 1 Oct 2025 09:25:35 +0900
+Subject: ksmbd: add max ip connections parameter
+
+This parameter set the maximum number of connections per ip address.
+The default is 8.
+
+Cc: stable@vger.kernel.org
+Fixes: c0d41112f1a5 ("ksmbd: extend the connection limiting mechanism to support IPv6")
+Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+---
+ fs/smb/server/ksmbd_netlink.h |  5 +++--
+ fs/smb/server/server.h        |  1 +
+ fs/smb/server/transport_ipc.c |  3 +++
+ fs/smb/server/transport_tcp.c | 27 ++++++++++++++++-----------
+ 4 files changed, 23 insertions(+), 13 deletions(-)
+
+(limited to 'fs/smb')
+
+--- a/fs/smb/server/ksmbd_netlink.h
+++ b/fs/smb/server/ksmbd_netlink.h
+@@ -109,10 +109,11 @@ struct ksmbd_startup_request {
+ 	__u32	smbd_max_io_size;	/* smbd read write size */
+ 	__u32	max_connections;	/* Number of maximum simultaneous connections */
+ 	__s8	bind_interfaces_only;
+-	__s8	reserved[503];		/* Reserved room */
+	__u32	max_ip_connections;	/* Number of maximum connection per ip address */
+	__s8	reserved[499];		/* Reserved room */
+ 	__u32	ifc_list_sz;		/* interfaces list size */
+ 	__s8	____payload[];
+-};
+} __packed;
+ 
+ #define KSMBD_STARTUP_CONFIG_INTERFACES(s)	((s)->____payload)
+ 
+--- a/fs/smb/server/server.h
+++ b/fs/smb/server/server.h
+@@ -43,6 +43,7 @@ struct ksmbd_server_config {
+ 	unsigned int		auth_mechs;
+ 	unsigned int		max_connections;
+ 	unsigned int		max_inflight_req;
+	unsigned int		max_ip_connections;
+ 
+ 	char			*conf[SERVER_CONF_WORK_GROUP + 1];
+ };
+--- a/fs/smb/server/transport_ipc.c
+++ b/fs/smb/server/transport_ipc.c
+@@ -321,6 +321,9 @@ static int ipc_server_config_on_startup(
+ 	if (req->max_connections)
+ 		server_conf.max_connections = req->max_connections;
+ 
+	if (req->max_ip_connections)
+		server_conf.max_ip_connections = req->max_ip_connections;
+
+ 	ret = ksmbd_set_netbios_name(req->netbios_name);
+ 	ret |= ksmbd_set_server_string(req->server_string);
+ 	ret |= ksmbd_set_work_group(req->work_group);
+--- a/fs/smb/server/transport_tcp.c
+++ b/fs/smb/server/transport_tcp.c
+@@ -240,6 +240,7 @@ static int ksmbd_kthread_fn(void *p)
+ 	struct interface *iface = (struct interface *)p;
+ 	struct ksmbd_conn *conn;
+ 	int ret;
+	unsigned int max_ip_conns;
+ 
+ 	while (!kthread_should_stop()) {
+ 		mutex_lock(&iface->sock_release_lock);
+@@ -257,34 +258,38 @@ static int ksmbd_kthread_fn(void *p)
+ 			continue;
+ 		}
+ 
+		if (!server_conf.max_ip_connections)
+			goto skip_max_ip_conns_limit;
+
+ 		/*
+ 		 * Limits repeated connections from clients with the same IP.
+ 		 */
+		max_ip_conns = 0;
+ 		down_read(&conn_list_lock);
+-		list_for_each_entry(conn, &conn_list, conns_list)
+		list_for_each_entry(conn, &conn_list, conns_list) {
+ #if IS_ENABLED(CONFIG_IPV6)
+ 			if (client_sk->sk->sk_family == AF_INET6) {
+ 				if (memcmp(&client_sk->sk->sk_v6_daddr,
+-					   &conn->inet6_addr, 16) == 0) {
+-					ret = -EAGAIN;
+-					break;
+-				}
+					   &conn->inet6_addr, 16) == 0)
+					max_ip_conns++;
+ 			} else if (inet_sk(client_sk->sk)->inet_daddr ==
+-				 conn->inet_addr) {
+-				ret = -EAGAIN;
+-				break;
+-			}
+				 conn->inet_addr)
+				max_ip_conns++;
+ #else
+ 			if (inet_sk(client_sk->sk)->inet_daddr ==
+-			    conn->inet_addr) {
+			    conn->inet_addr)
+				max_ip_conns++;
+#endif
+			if (server_conf.max_ip_connections <= max_ip_conns) {
+ 				ret = -EAGAIN;
+ 				break;
+ 			}
+-#endif
+		}
+ 		up_read(&conn_list_lock);
+ 		if (ret == -EAGAIN)
+ 			continue;
+ 
+skip_max_ip_conns_limit:
+ 		if (server_conf.max_connections &&
+ 		    atomic_inc_return(&active_num_conn) >= server_conf.max_connections) {
+ 			pr_info_ratelimited("Limit the maximum number of connections(%u)\n",
--- a/target/linux/generic/backport-6.6/621-proc-fix-missing-pde_set_flags.patch
+++ b/target/linux/generic/backport-6.6/621-proc-fix-missing-pde_set_flags.patch
@ -1,121 +0,0 @@
-From: wangzijie <wangzijie1@honor.com>
-To: <akpm@linux-foundation.org>, <brauner@kernel.org>,
-	<viro@zeniv.linux.org.uk>, <adobriyan@gmail.com>,
-	<rick.p.edgecombe@intel.com>, <ast@kernel.org>,
-	<k.shutemov@gmail.com>, <jirislaby@kernel.org>,
-	<linux-fsdevel@vger.kernel.org>
-Cc: <polynomial-c@gmx.de>, <gregkh@linuxfoundation.org>,
-	<stable@vger.kernel.org>, <regressions@lists.linux.dev>,
-	wangzijie <wangzijie1@honor.com>
-Subject: [PATCH v3] proc: fix missing pde_set_flags() for net proc files
-Date: Thu, 21 Aug 2025 18:58:06 +0800	[thread overview]
-Message-ID: <20250821105806.1453833-1-wangzijie1@honor.com> (raw)
-
-To avoid potential UAF issues during module removal races, we use pde_set_flags()
-to save proc_ops flags in PDE itself before proc_register(), and then use
-pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*.
-
-However, the pde_set_flags() call was missing when creating net related proc files.
-This omission caused incorrect behavior which FMODE_LSEEK was being cleared
-inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1].
-
-Fix this by ensuring pde_set_flags() is called when register proc entry, and add
-NULL check for proc_ops in pde_set_flags().
-
-[1]: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/
-
-Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al")
-Cc: stable@vger.kernel.org
-Reported-by: Lars Wendler <polynomial-c@gmx.de>
-Signed-off-by: wangzijie <wangzijie1@honor.com>
---
-v3:
- followed by Christian's suggestion to stash pde->proc_ops in a local const variable
-v2:
- followed by Jiri's suggestion to refractor code and reformat commit message
---
- fs/proc/generic.c | 38 +++++++++++++++++++++-----------------
- 1 file changed, 21 insertions(+), 17 deletions(-)
-
--- a/fs/proc/generic.c
-+++ b/fs/proc/generic.c
-@@ -362,6 +362,25 @@ static const struct inode_operations pro
- 	.setattr	= proc_notify_change,
- };
- 
-+static void pde_set_flags(struct proc_dir_entry *pde)
-+{
-+	const struct proc_ops *proc_ops = pde->proc_ops;
-+
-+	if (!proc_ops)
-+		return;
-+
-+	if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
-+		pde->flags |= PROC_ENTRY_PERMANENT;
-+	if (proc_ops->proc_read_iter)
-+		pde->flags |= PROC_ENTRY_proc_read_iter;
-+#ifdef CONFIG_COMPAT
-+	if (proc_ops->proc_compat_ioctl)
-+		pde->flags |= PROC_ENTRY_proc_compat_ioctl;
-+#endif
-+	if (proc_ops->proc_lseek)
-+		pde->flags |= PROC_ENTRY_proc_lseek;
-+}
-+
- /* returns the registered entry, or frees dp and returns NULL on failure */
- struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
- 		struct proc_dir_entry *dp)
-@@ -369,6 +388,8 @@ struct proc_dir_entry *proc_register(str
- 	if (proc_alloc_inum(&dp->low_ino))
- 		goto out_free_entry;
- 
-+	pde_set_flags(dp);
-+
- 	write_lock(&proc_subdir_lock);
- 	dp->parent = dir;
- 	if (pde_subdir_insert(dir, dp) == false) {
-@@ -557,20 +578,6 @@ struct proc_dir_entry *proc_create_reg(c
- 	return p;
- }
- 
-static void pde_set_flags(struct proc_dir_entry *pde)
-{
-	if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
-		pde->flags |= PROC_ENTRY_PERMANENT;
-	if (pde->proc_ops->proc_read_iter)
-		pde->flags |= PROC_ENTRY_proc_read_iter;
-#ifdef CONFIG_COMPAT
-	if (pde->proc_ops->proc_compat_ioctl)
-		pde->flags |= PROC_ENTRY_proc_compat_ioctl;
-#endif
-	if (pde->proc_ops->proc_lseek)
-		pde->flags |= PROC_ENTRY_proc_lseek;
-}
-
- struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
- 		struct proc_dir_entry *parent,
- 		const struct proc_ops *proc_ops, void *data)
-@@ -581,7 +588,6 @@ struct proc_dir_entry *proc_create_data(
- 	if (!p)
- 		return NULL;
- 	p->proc_ops = proc_ops;
-	pde_set_flags(p);
- 	return proc_register(parent, p);
- }
- EXPORT_SYMBOL(proc_create_data);
-@@ -632,7 +638,6 @@ struct proc_dir_entry *proc_create_seq_p
- 	p->proc_ops = &proc_seq_ops;
- 	p->seq_ops = ops;
- 	p->state_size = state_size;
-	pde_set_flags(p);
- 	return proc_register(parent, p);
- }
- EXPORT_SYMBOL(proc_create_seq_private);
-@@ -663,7 +668,6 @@ struct proc_dir_entry *proc_create_singl
- 		return NULL;
- 	p->proc_ops = &proc_single_ops;
- 	p->single_show = show;
-	pde_set_flags(p);
- 	return proc_register(parent, p);
- }
- EXPORT_SYMBOL(proc_create_single_data);
--- a/target/linux/generic/backport-6.6/716-v6.9-02-net-phy-add-support-for-scanning-PHY-in-PHY-packages.patch
+++ b/target/linux/generic/backport-6.6/716-v6.9-02-net-phy-add-support-for-scanning-PHY-in-PHY-packages.patch
@ -143,7 +143,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 }
 --- a/drivers/net/phy/mdio_bus.c
 +++ b/drivers/net/phy/mdio_bus.c
-@@ -455,19 +455,34 @@ EXPORT_SYMBOL(of_mdio_find_bus);
+@@ -456,19 +456,34 @@ EXPORT_SYMBOL(of_mdio_find_bus);
  * found, set the of_node pointer for the mdio device. This allows
  * auto-probed phy devices to be supplied with information passed in
  * via DT.
@ -185,7 +185,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 		addr = of_mdio_parse_addr(dev, child);
 		if (addr < 0)
 			continue;
-@@ -477,9 +492,22 @@ static void of_mdiobus_link_mdiodev(stru
+@@ -478,9 +493,22 @@ static void of_mdiobus_link_mdiodev(stru
 			/* The refcount on "child" is passed to the mdio
 			 * device. Do _not_ use of_node_put(child) here.
 			 */
--- a/target/linux/generic/backport-6.6/751-01-v6.8-net-ethernet-mediatek-split-tx-and-rx-fields-in-mtk_.patch
+++ b/target/linux/generic/backport-6.6/751-01-v6.8-net-ethernet-mediatek-split-tx-and-rx-fields-in-mtk_.patch
@ -104,7 +104,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		}
 	} else {
 		nfrags += skb_shinfo(skb)->nr_frags;
-@@ -1650,7 +1650,7 @@ static struct mtk_rx_ring *mtk_get_rx_ri
+@@ -1658,7 +1658,7 @@ static struct mtk_rx_ring *mtk_get_rx_ri
 
 		ring = &eth->rx_ring[i];
 		idx = NEXT_DESP_IDX(ring->calc_idx, ring->dma_size);
@ -113,7 +113,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		if (rxd->rxd2 & RX_DMA_DONE) {
 			ring->calc_idx_update = true;
 			return ring;
-@@ -1818,7 +1818,7 @@ static int mtk_xdp_submit_frame(struct m
+@@ -1826,7 +1826,7 @@ static int mtk_xdp_submit_frame(struct m
 	}
 	htxd = txd;
 
@ -122,7 +122,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	memset(tx_buf, 0, sizeof(*tx_buf));
 	htx_buf = tx_buf;
 
-@@ -1837,7 +1837,7 @@ static int mtk_xdp_submit_frame(struct m
+@@ -1845,7 +1845,7 @@ static int mtk_xdp_submit_frame(struct m
 				goto unmap;
 
 			tx_buf = mtk_desc_to_tx_buf(ring, txd,
@ -131,7 +131,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 			memset(tx_buf, 0, sizeof(*tx_buf));
 			n_desc++;
 		}
-@@ -1875,7 +1875,7 @@ static int mtk_xdp_submit_frame(struct m
+@@ -1883,7 +1883,7 @@ static int mtk_xdp_submit_frame(struct m
 	} else {
 		int idx;
 
@ -140,7 +140,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		mtk_w32(eth, NEXT_DESP_IDX(idx, ring->dma_size),
 			MT7628_TX_CTX_IDX0);
 	}
-@@ -1886,7 +1886,7 @@ static int mtk_xdp_submit_frame(struct m
+@@ -1894,7 +1894,7 @@ static int mtk_xdp_submit_frame(struct m
 
 unmap:
 	while (htxd != txd) {
@ -149,7 +149,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		mtk_tx_unmap(eth, tx_buf, NULL, false);
 
 		htxd->txd3 = TX_DMA_LS0 | TX_DMA_OWNER_CPU;
-@@ -2017,7 +2017,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -2025,7 +2025,7 @@ static int mtk_poll_rx(struct napi_struc
 			goto rx_done;
 
 		idx = NEXT_DESP_IDX(ring->calc_idx, ring->dma_size);
@ -158,7 +158,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		data = ring->data[idx];
 
 		if (!mtk_rx_get_desc(eth, &trxd, rxd))
-@@ -2152,7 +2152,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -2160,7 +2160,7 @@ static int mtk_poll_rx(struct napi_struc
 			rxdcsum = &trxd.rxd4;
 		}
 
@ -167,7 +167,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 			skb->ip_summed = CHECKSUM_UNNECESSARY;
 		else
 			skb_checksum_none_assert(skb);
-@@ -2280,7 +2280,7 @@ static int mtk_poll_tx_qdma(struct mtk_e
+@@ -2288,7 +2288,7 @@ static int mtk_poll_tx_qdma(struct mtk_e
 			break;
 
 		tx_buf = mtk_desc_to_tx_buf(ring, desc,
@ -176,7 +176,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		if (!tx_buf->data)
 			break;
 
-@@ -2331,7 +2331,7 @@ static int mtk_poll_tx_pdma(struct mtk_e
+@@ -2339,7 +2339,7 @@ static int mtk_poll_tx_pdma(struct mtk_e
 		}
 		mtk_tx_unmap(eth, tx_buf, &bq, true);
 
@ -185,7 +185,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		ring->last_free = desc;
 		atomic_inc(&ring->free_count);
 
-@@ -2421,7 +2421,7 @@ static int mtk_napi_rx(struct napi_struc
+@@ -2429,7 +2429,7 @@ static int mtk_napi_rx(struct napi_struc
 	do {
 		int rx_done;
 
@ -194,7 +194,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 			reg_map->pdma.irq_status);
 		rx_done = mtk_poll_rx(napi, budget - rx_done_total, eth);
 		rx_done_total += rx_done;
-@@ -2437,10 +2437,10 @@ static int mtk_napi_rx(struct napi_struc
+@@ -2445,10 +2445,10 @@ static int mtk_napi_rx(struct napi_struc
 			return budget;
 
 	} while (mtk_r32(eth, reg_map->pdma.irq_status) &
@ -207,7 +207,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 	return rx_done_total;
 }
-@@ -2449,7 +2449,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -2457,7 +2457,7 @@ static int mtk_tx_alloc(struct mtk_eth *
 {
 	const struct mtk_soc_data *soc = eth->soc;
 	struct mtk_tx_ring *ring = &eth->tx_ring;
@ -216,7 +216,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	struct mtk_tx_dma_v2 *txd;
 	int ring_size;
 	u32 ofs, val;
-@@ -2572,14 +2572,14 @@ static void mtk_tx_clean(struct mtk_eth
+@@ -2580,14 +2580,14 @@ static void mtk_tx_clean(struct mtk_eth
 	}
 	if (!MTK_HAS_CAPS(soc->caps, MTK_SRAM) && ring->dma) {
 		dma_free_coherent(eth->dma_dev,
@ -233,7 +233,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 				  ring->dma_pdma, ring->phys_pdma);
 		ring->dma_pdma = NULL;
 	}
-@@ -2634,15 +2634,15 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -2642,15 +2642,15 @@ static int mtk_rx_alloc(struct mtk_eth *
 	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SRAM) ||
 	    rx_flag != MTK_RX_FLAGS_NORMAL) {
 		ring->dma = dma_alloc_coherent(eth->dma_dev,
@ -253,7 +253,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	}
 
 	if (!ring->dma)
-@@ -2653,7 +2653,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -2661,7 +2661,7 @@ static int mtk_rx_alloc(struct mtk_eth *
 		dma_addr_t dma_addr;
 		void *data;
 
@ -262,7 +262,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		if (ring->page_pool) {
 			data = mtk_page_pool_get_buff(ring->page_pool,
 						      &dma_addr, GFP_KERNEL);
-@@ -2744,7 +2744,7 @@ static void mtk_rx_clean(struct mtk_eth
+@@ -2752,7 +2752,7 @@ static void mtk_rx_clean(struct mtk_eth
 			if (!ring->data[i])
 				continue;
 
@ -271,7 +271,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 			if (!rxd->rxd1)
 				continue;
 
-@@ -2761,7 +2761,7 @@ static void mtk_rx_clean(struct mtk_eth
+@@ -2769,7 +2769,7 @@ static void mtk_rx_clean(struct mtk_eth
 
 	if (!in_sram && ring->dma) {
 		dma_free_coherent(eth->dma_dev,
@ -280,7 +280,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 				  ring->dma, ring->phys);
 		ring->dma = NULL;
 	}
-@@ -3132,7 +3132,7 @@ static void mtk_dma_free(struct mtk_eth
+@@ -3140,7 +3140,7 @@ static void mtk_dma_free(struct mtk_eth
 
 	if (!MTK_HAS_CAPS(soc->caps, MTK_SRAM) && eth->scratch_ring) {
 		dma_free_coherent(eth->dma_dev,
@ -289,7 +289,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 				  eth->scratch_ring, eth->phy_scratch_ring);
 		eth->scratch_ring = NULL;
 		eth->phy_scratch_ring = 0;
-@@ -3182,7 +3182,7 @@ static irqreturn_t mtk_handle_irq_rx(int
+@@ -3190,7 +3190,7 @@ static irqreturn_t mtk_handle_irq_rx(int
 
 	eth->rx_events++;
 	if (likely(napi_schedule_prep(&eth->rx_napi))) {
@ -298,7 +298,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		__napi_schedule(&eth->rx_napi);
 	}
 
-@@ -3208,9 +3208,9 @@ static irqreturn_t mtk_handle_irq(int ir
+@@ -3216,9 +3216,9 @@ static irqreturn_t mtk_handle_irq(int ir
 	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
 
 	if (mtk_r32(eth, reg_map->pdma.irq_mask) &
@ -310,7 +310,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 			mtk_handle_irq_rx(irq, _eth);
 	}
 	if (mtk_r32(eth, reg_map->tx_irq_mask) & MTK_TX_DONE_INT) {
-@@ -3228,10 +3228,10 @@ static void mtk_poll_controller(struct n
+@@ -3236,10 +3236,10 @@ static void mtk_poll_controller(struct n
 	struct mtk_eth *eth = mac->hw;
 
 	mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
@ -323,7 +323,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 }
 #endif
 
-@@ -3395,7 +3395,7 @@ static int mtk_open(struct net_device *d
+@@ -3403,7 +3403,7 @@ static int mtk_open(struct net_device *d
 		napi_enable(&eth->tx_napi);
 		napi_enable(&eth->rx_napi);
 		mtk_tx_irq_enable(eth, MTK_TX_DONE_INT);
@ -332,7 +332,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		refcount_set(&eth->dma_refcnt, 1);
 	}
 	else
-@@ -3479,7 +3479,7 @@ static int mtk_stop(struct net_device *d
+@@ -3487,7 +3487,7 @@ static int mtk_stop(struct net_device *d
 	mtk_gdm_config(eth, MTK_GDMA_DROP_ALL);
 
 	mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
@ -341,7 +341,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	napi_disable(&eth->tx_napi);
 	napi_disable(&eth->rx_napi);
 
-@@ -3955,9 +3955,9 @@ static int mtk_hw_init(struct mtk_eth *e
+@@ -3963,9 +3963,9 @@ static int mtk_hw_init(struct mtk_eth *e
 
 	/* FE int grouping */
 	mtk_w32(eth, MTK_TX_DONE_INT, reg_map->pdma.int_grp);
@ -353,7 +353,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	mtk_w32(eth, 0x21021000, MTK_FE_INT_GRP);
 
 	if (mtk_is_netsys_v3_or_greater(eth)) {
-@@ -5065,11 +5065,15 @@ static const struct mtk_soc_data mt2701_
+@@ -5073,11 +5073,15 @@ static const struct mtk_soc_data mt2701_
 	.required_clks = MT7623_CLKS_BITMAP,
 	.required_pctl = true,
 	.version = 1,
@ -374,7 +374,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
-@@ -5085,11 +5089,15 @@ static const struct mtk_soc_data mt7621_
+@@ -5093,11 +5097,15 @@ static const struct mtk_soc_data mt7621_
 	.offload_version = 1,
 	.hash_offset = 2,
 	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
@ -395,7 +395,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
-@@ -5107,11 +5115,15 @@ static const struct mtk_soc_data mt7622_
+@@ -5115,11 +5123,15 @@ static const struct mtk_soc_data mt7622_
 	.hash_offset = 2,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
@ -416,7 +416,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
-@@ -5128,11 +5140,15 @@ static const struct mtk_soc_data mt7623_
+@@ -5136,11 +5148,15 @@ static const struct mtk_soc_data mt7623_
 	.hash_offset = 2,
 	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
 	.disable_pll_modes = true,
@ -437,7 +437,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
-@@ -5147,11 +5163,15 @@ static const struct mtk_soc_data mt7629_
+@@ -5155,11 +5171,15 @@ static const struct mtk_soc_data mt7629_
 	.required_pctl = false,
 	.has_accounting = true,
 	.version = 1,
@ -458,7 +458,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
-@@ -5169,11 +5189,15 @@ static const struct mtk_soc_data mt7981_
+@@ -5177,11 +5197,15 @@ static const struct mtk_soc_data mt7981_
 	.hash_offset = 4,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V2_SIZE,
@ -479,7 +479,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
 		.dma_len_offset = 8,
 	},
-@@ -5191,11 +5215,15 @@ static const struct mtk_soc_data mt7986_
+@@ -5199,11 +5223,15 @@ static const struct mtk_soc_data mt7986_
 	.hash_offset = 4,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V2_SIZE,
@ -500,7 +500,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
 		.dma_len_offset = 8,
 	},
-@@ -5213,11 +5241,15 @@ static const struct mtk_soc_data mt7988_
+@@ -5221,11 +5249,15 @@ static const struct mtk_soc_data mt7988_
 	.hash_offset = 4,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V3_SIZE,
@ -521,7 +521,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
 		.dma_len_offset = 8,
 	},
-@@ -5230,11 +5262,15 @@ static const struct mtk_soc_data rt5350_
+@@ -5238,11 +5270,15 @@ static const struct mtk_soc_data rt5350_
 	.required_clks = MT7628_CLKS_BITMAP,
 	.required_pctl = false,
 	.version = 1,
--- a/target/linux/generic/backport-6.6/751-02-v6.8-net-ethernet-mediatek-use-QDMA-instead-of-ADMAv2-on-.patch
+++ b/target/linux/generic/backport-6.6/751-02-v6.8-net-ethernet-mediatek-use-QDMA-instead-of-ADMAv2-on-.patch
@ -58,7 +58,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		rxd->rxd5 = READ_ONCE(dma_rxd->rxd5);
 		rxd->rxd6 = READ_ONCE(dma_rxd->rxd6);
 	}
-@@ -2024,7 +2024,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -2032,7 +2032,7 @@ static int mtk_poll_rx(struct napi_struc
 			break;
 
 		/* find out which mac the packet come from. values start at 1 */
@ -67,7 +67,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 			u32 val = RX_DMA_GET_SPORT_V2(trxd.rxd5);
 
 			switch (val) {
-@@ -2136,7 +2136,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -2144,7 +2144,7 @@ static int mtk_poll_rx(struct napi_struc
 		skb->dev = netdev;
 		bytes += skb->len;
 
@ -76,7 +76,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 			reason = FIELD_GET(MTK_RXD5_PPE_CPU_REASON, trxd.rxd5);
 			hash = trxd.rxd5 & MTK_RXD5_FOE_ENTRY;
 			if (hash != MTK_RXD5_FOE_ENTRY)
-@@ -2690,7 +2690,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -2698,7 +2698,7 @@ static int mtk_rx_alloc(struct mtk_eth *
 
 		rxd->rxd3 = 0;
 		rxd->rxd4 = 0;
@ -85,7 +85,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 			rxd->rxd5 = 0;
 			rxd->rxd6 = 0;
 			rxd->rxd7 = 0;
-@@ -3901,7 +3901,7 @@ static int mtk_hw_init(struct mtk_eth *e
+@@ -3909,7 +3909,7 @@ static int mtk_hw_init(struct mtk_eth *e
 	else
 		mtk_hw_reset(eth);
 
@ -94,7 +94,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 		/* Set FE to PDMAv2 if necessary */
 		val = mtk_r32(eth, MTK_FE_GLO_MISC);
 		mtk_w32(eth,  val | BIT(4), MTK_FE_GLO_MISC);
-@@ -5195,11 +5195,11 @@ static const struct mtk_soc_data mt7981_
+@@ -5203,11 +5203,11 @@ static const struct mtk_soc_data mt7981_
 		.dma_len_offset = 8,
 	},
 	.rx = {
@ -110,7 +110,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	},
 };
 
-@@ -5221,11 +5221,11 @@ static const struct mtk_soc_data mt7986_
+@@ -5229,11 +5229,11 @@ static const struct mtk_soc_data mt7986_
 		.dma_len_offset = 8,
 	},
 	.rx = {
--- a/target/linux/generic/backport-6.6/752-25-v6.10-net-ethernet-mtk_eth_soc-handle-dma-buffer-size-soc-.patch
+++ b/target/linux/generic/backport-6.6/752-25-v6.10-net-ethernet-mtk_eth_soc-handle-dma-buffer-size-soc-.patch
@ -123,7 +123,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 		}
 	}
 
-@@ -2461,7 +2467,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -2469,7 +2475,7 @@ static int mtk_tx_alloc(struct mtk_eth *
 	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA))
 		ring_size = MTK_QDMA_RING_SIZE;
 	else
@ -132,7 +132,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 	ring->buf = kcalloc(ring_size, sizeof(*ring->buf),
 			       GFP_KERNEL);
-@@ -2469,8 +2475,8 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -2477,8 +2483,8 @@ static int mtk_tx_alloc(struct mtk_eth *
 		goto no_tx_mem;
 
 	if (MTK_HAS_CAPS(soc->caps, MTK_SRAM)) {
@ -143,7 +143,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 	} else {
 		ring->dma = dma_alloc_coherent(eth->dma_dev, ring_size * sz,
 					       &ring->phys, GFP_KERNEL);
-@@ -2592,6 +2598,7 @@ static void mtk_tx_clean(struct mtk_eth
+@@ -2600,6 +2606,7 @@ static void mtk_tx_clean(struct mtk_eth
 static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag)
 {
 	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
@ -151,7 +151,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 	struct mtk_rx_ring *ring;
 	int rx_data_len, rx_dma_size, tx_ring_size;
 	int i;
-@@ -2599,7 +2606,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -2607,7 +2614,7 @@ static int mtk_rx_alloc(struct mtk_eth *
 	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
 		tx_ring_size = MTK_QDMA_RING_SIZE;
 	else
@ -160,7 +160,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 	if (rx_flag == MTK_RX_FLAGS_QDMA) {
 		if (ring_no)
-@@ -2614,7 +2621,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -2622,7 +2629,7 @@ static int mtk_rx_alloc(struct mtk_eth *
 		rx_dma_size = MTK_HW_LRO_DMA_SIZE;
 	} else {
 		rx_data_len = ETH_DATA_LEN;
@ -169,7 +169,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 	}
 
 	ring->frag_size = mtk_max_frag_size(rx_data_len);
-@@ -3151,7 +3158,10 @@ static void mtk_dma_free(struct mtk_eth
+@@ -3159,7 +3166,10 @@ static void mtk_dma_free(struct mtk_eth
 			mtk_rx_clean(eth, &eth->rx_ring[i], false);
 	}
 
@ -181,7 +181,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 }
 
 static bool mtk_hw_reset_check(struct mtk_eth *eth)
-@@ -5073,11 +5083,14 @@ static const struct mtk_soc_data mt2701_
+@@ -5081,11 +5091,14 @@ static const struct mtk_soc_data mt2701_
 		.desc_size = sizeof(struct mtk_tx_dma),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
@ -196,7 +196,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
-@@ -5097,11 +5110,14 @@ static const struct mtk_soc_data mt7621_
+@@ -5105,11 +5118,14 @@ static const struct mtk_soc_data mt7621_
 		.desc_size = sizeof(struct mtk_tx_dma),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
@ -211,7 +211,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
-@@ -5123,11 +5139,14 @@ static const struct mtk_soc_data mt7622_
+@@ -5131,11 +5147,14 @@ static const struct mtk_soc_data mt7622_
 		.desc_size = sizeof(struct mtk_tx_dma),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
@ -226,7 +226,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
-@@ -5148,11 +5167,14 @@ static const struct mtk_soc_data mt7623_
+@@ -5156,11 +5175,14 @@ static const struct mtk_soc_data mt7623_
 		.desc_size = sizeof(struct mtk_tx_dma),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
@ -241,7 +241,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
-@@ -5171,11 +5193,14 @@ static const struct mtk_soc_data mt7629_
+@@ -5179,11 +5201,14 @@ static const struct mtk_soc_data mt7629_
 		.desc_size = sizeof(struct mtk_tx_dma),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
@ -256,7 +256,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
 	},
-@@ -5197,6 +5222,8 @@ static const struct mtk_soc_data mt7981_
+@@ -5205,6 +5230,8 @@ static const struct mtk_soc_data mt7981_
 		.desc_size = sizeof(struct mtk_tx_dma_v2),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
 		.dma_len_offset = 8,
@ -265,7 +265,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 	},
 	.rx = {
 		.desc_size = sizeof(struct mtk_rx_dma),
-@@ -5204,6 +5231,7 @@ static const struct mtk_soc_data mt7981_
+@@ -5212,6 +5239,7 @@ static const struct mtk_soc_data mt7981_
 		.dma_l4_valid = RX_DMA_L4_VALID_V2,
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
@ -273,7 +273,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 	},
 };
 
-@@ -5223,6 +5251,8 @@ static const struct mtk_soc_data mt7986_
+@@ -5231,6 +5259,8 @@ static const struct mtk_soc_data mt7986_
 		.desc_size = sizeof(struct mtk_tx_dma_v2),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
 		.dma_len_offset = 8,
@ -282,7 +282,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 	},
 	.rx = {
 		.desc_size = sizeof(struct mtk_rx_dma),
-@@ -5230,6 +5260,7 @@ static const struct mtk_soc_data mt7986_
+@@ -5238,6 +5268,7 @@ static const struct mtk_soc_data mt7986_
 		.dma_l4_valid = RX_DMA_L4_VALID_V2,
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
@ -290,7 +290,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 	},
 };
 
-@@ -5249,6 +5280,8 @@ static const struct mtk_soc_data mt7988_
+@@ -5257,6 +5288,8 @@ static const struct mtk_soc_data mt7988_
 		.desc_size = sizeof(struct mtk_tx_dma_v2),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
 		.dma_len_offset = 8,
@ -299,7 +299,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 	},
 	.rx = {
 		.desc_size = sizeof(struct mtk_rx_dma_v2),
-@@ -5256,6 +5289,7 @@ static const struct mtk_soc_data mt7988_
+@@ -5264,6 +5297,7 @@ static const struct mtk_soc_data mt7988_
 		.dma_l4_valid = RX_DMA_L4_VALID_V2,
 		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
 		.dma_len_offset = 8,
@ -307,7 +307,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 	},
 };
 
-@@ -5270,6 +5304,7 @@ static const struct mtk_soc_data rt5350_
+@@ -5278,6 +5312,7 @@ static const struct mtk_soc_data rt5350_
 		.desc_size = sizeof(struct mtk_tx_dma),
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
@ -315,7 +315,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 	},
 	.rx = {
 		.desc_size = sizeof(struct mtk_rx_dma),
-@@ -5277,6 +5312,7 @@ static const struct mtk_soc_data rt5350_
+@@ -5285,6 +5320,7 @@ static const struct mtk_soc_data rt5350_
 		.dma_l4_valid = RX_DMA_L4_VALID_PDMA,
 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
 		.dma_len_offset = 16,
--- a/target/linux/generic/backport-6.6/752-26-v6.10-net-ethernet-mtk_eth_soc-ppe-add-support-for-multipl.patch
+++ b/target/linux/generic/backport-6.6/752-26-v6.10-net-ethernet-mtk_eth_soc-ppe-add-support-for-multipl.patch
@ -60,7 +60,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	.ppe_base		= 0x2000,
 	.wdma_base = {
 		[0]		= 0x4800,
-@@ -2015,6 +2024,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -2023,6 +2032,7 @@ static int mtk_poll_rx(struct napi_struc
 	struct mtk_rx_dma_v2 *rxd, trxd;
 	int done = 0, bytes = 0;
 	dma_addr_t dma_addr = DMA_MAPPING_ERROR;
@ -68,7 +68,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 	while (done < budget) {
 		unsigned int pktlen, *rxdcsum;
-@@ -2058,6 +2068,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -2066,6 +2076,7 @@ static int mtk_poll_rx(struct napi_struc
 			goto release_desc;
 
 		netdev = eth->netdev[mac];
@ -76,7 +76,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 		if (unlikely(test_bit(MTK_RESETTING, &eth->state)))
 			goto release_desc;
-@@ -2181,7 +2192,7 @@ static int mtk_poll_rx(struct napi_struc
+@@ -2189,7 +2200,7 @@ static int mtk_poll_rx(struct napi_struc
 		}
 
 		if (reason == MTK_PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
@ -85,7 +85,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 		skb_record_rx_queue(skb, 0);
 		napi_gro_receive(napi, skb);
-@@ -3288,37 +3299,27 @@ static int mtk_start_dma(struct mtk_eth
+@@ -3296,37 +3307,27 @@ static int mtk_start_dma(struct mtk_eth
 	return 0;
 }
 
@ -134,7 +134,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 }
 
 
-@@ -3378,7 +3379,10 @@ static int mtk_open(struct net_device *d
+@@ -3386,7 +3387,10 @@ static int mtk_open(struct net_device *d
 {
 	struct mtk_mac *mac = netdev_priv(dev);
 	struct mtk_eth *eth = mac->hw;
@ -146,7 +146,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 	err = phylink_of_phy_connect(mac->phylink, mac->of_node, 0);
 	if (err) {
-@@ -3402,18 +3406,38 @@ static int mtk_open(struct net_device *d
+@@ -3410,18 +3414,38 @@ static int mtk_open(struct net_device *d
 		for (i = 0; i < ARRAY_SIZE(eth->ppe); i++)
 			mtk_ppe_start(eth->ppe[i]);
 
@ -190,7 +190,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 	phylink_start(mac->phylink);
 	netif_tx_start_all_queues(dev);
-@@ -3490,7 +3514,8 @@ static int mtk_stop(struct net_device *d
+@@ -3498,7 +3522,8 @@ static int mtk_stop(struct net_device *d
 	if (!refcount_dec_and_test(&eth->dma_refcnt))
 		return 0;
 
@ -200,7 +200,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 	mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
 	mtk_rx_irq_disable(eth, eth->soc->rx.irq_done_mask);
-@@ -4985,23 +5010,24 @@ static int mtk_probe(struct platform_dev
+@@ -4993,23 +5018,24 @@ static int mtk_probe(struct platform_dev
 	}
 
 	if (eth->soc->offload_version) {
@ -233,7 +233,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	}
 
 	for (i = 0; i < MTK_MAX_DEVS; i++) {
-@@ -5104,6 +5130,7 @@ static const struct mtk_soc_data mt7621_
+@@ -5112,6 +5138,7 @@ static const struct mtk_soc_data mt7621_
 	.required_pctl = false,
 	.version = 1,
 	.offload_version = 1,
@ -241,7 +241,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	.hash_offset = 2,
 	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
 	.tx = {
-@@ -5132,6 +5159,7 @@ static const struct mtk_soc_data mt7622_
+@@ -5140,6 +5167,7 @@ static const struct mtk_soc_data mt7622_
 	.required_pctl = false,
 	.version = 1,
 	.offload_version = 2,
@ -249,7 +249,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	.hash_offset = 2,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
-@@ -5160,6 +5188,7 @@ static const struct mtk_soc_data mt7623_
+@@ -5168,6 +5196,7 @@ static const struct mtk_soc_data mt7623_
 	.required_pctl = true,
 	.version = 1,
 	.offload_version = 1,
@ -257,7 +257,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	.hash_offset = 2,
 	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
 	.disable_pll_modes = true,
-@@ -5215,6 +5244,7 @@ static const struct mtk_soc_data mt7981_
+@@ -5223,6 +5252,7 @@ static const struct mtk_soc_data mt7981_
 	.required_pctl = false,
 	.version = 2,
 	.offload_version = 2,
@ -265,7 +265,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	.hash_offset = 4,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V2_SIZE,
-@@ -5244,6 +5274,7 @@ static const struct mtk_soc_data mt7986_
+@@ -5252,6 +5282,7 @@ static const struct mtk_soc_data mt7986_
 	.required_pctl = false,
 	.version = 2,
 	.offload_version = 2,
@ -273,7 +273,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 	.hash_offset = 4,
 	.has_accounting = true,
 	.foe_entry_size = MTK_FOE_ENTRY_V2_SIZE,
-@@ -5273,6 +5304,7 @@ static const struct mtk_soc_data mt7988_
+@@ -5281,6 +5312,7 @@ static const struct mtk_soc_data mt7988_
 	.required_pctl = false,
 	.version = 3,
 	.offload_version = 2,
--- a/target/linux/generic/backport-6.6/752-28-v6.10-net-ethernet-mediatek-Allow-gaps-in-MAC-allocation.patch
+++ b/target/linux/generic/backport-6.6/752-28-v6.10-net-ethernet-mediatek-Allow-gaps-in-MAC-allocation.patch
@ -21,7 +21,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>

 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3408,7 +3408,7 @@ static int mtk_open(struct net_device *d
+@@ -3416,7 +3416,7 @@ static int mtk_open(struct net_device *d
 
 		for (i = 0; i < MTK_MAX_DEVS; i++) {
 			if (!eth->netdev[i])
--- a/target/linux/generic/backport-6.6/752-30-v6.10-net-ethernet-mtk_eth_soc-implement-.-get-set-_pausep.patch
+++ b/target/linux/generic/backport-6.6/752-30-v6.10-net-ethernet-mtk_eth_soc-implement-.-get-set-_pausep.patch
@ -20,7 +20,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>

 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -4490,6 +4490,20 @@ static int mtk_set_rxnfc(struct net_devi
+@@ -4498,6 +4498,20 @@ static int mtk_set_rxnfc(struct net_devi
 	return ret;
 }
 
@ -41,7 +41,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 static u16 mtk_select_queue(struct net_device *dev, struct sk_buff *skb,
 			    struct net_device *sb_dev)
 {
-@@ -4518,8 +4532,10 @@ static const struct ethtool_ops mtk_etht
+@@ -4526,8 +4540,10 @@ static const struct ethtool_ops mtk_etht
 	.get_strings		= mtk_get_strings,
 	.get_sset_count		= mtk_get_sset_count,
 	.get_ethtool_stats	= mtk_get_ethtool_stats,
--- a/target/linux/generic/hack-6.6/901-debloat_sock_diag.patch
+++ b/target/linux/generic/hack-6.6/901-debloat_sock_diag.patch
@ -83,7 +83,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 INDIRECT_CALLABLE_DECLARE(struct dst_entry *ip6_dst_check(struct dst_entry *,
 							  u32));
 INDIRECT_CALLABLE_DECLARE(struct dst_entry *ipv4_dst_check(struct dst_entry *,
-@@ -2258,9 +2275,11 @@ static void __sk_free(struct sock *sk)
+@@ -2263,9 +2280,11 @@ static void __sk_free(struct sock *sk)
 	if (likely(sk->sk_net_refcnt))
 		sock_inuse_add(sock_net(sk), -1);
 
--- a/Show More
+++ b/Show More