OpenWrt v24.10.3: adjust config defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
openssl: correct PKG_LICENSE_FILES
2026-06-12 09:37:26 -04:00 · 2025-09-20 22:35:21 +02:00 · 2025-09-19 23:19:38 +02:00 · 2025-09-19 22:44:54 +02:00 · 2025-09-19 13:13:03 +02:00 · 2025-09-19 01:56:33 +02:00
444 changed files with 20527 additions and 2683 deletions
--- a/feeds.conf.default
+++ b/feeds.conf.default
@@ -1,4 +1,4 @@
-src-git packages https://git.openwrt.org/feed/packages.git^c7d1a8c1ae976bd0ad94a351d82ee8fbf16a81f0
-src-git luci https://git.openwrt.org/project/luci.git^d6b13f648339273facc07b173546ace459c1cabe
-src-git routing https://git.openwrt.org/feed/routing.git^85d040f28c21c116c905aa15a66255dde80336e7
+src-git packages https://git.openwrt.org/feed/packages.git^44cff71992c291ae11b7b37606c70db62dc0674e
+src-git luci https://git.openwrt.org/project/luci.git^923f8d991a49dc3d899fd24fc92ae7b1653ee4d0
+src-git routing https://git.openwrt.org/feed/routing.git^885ae6f9d0c0f47a1a6321e1cc7e9c7e20cc2681
 src-git telephony https://git.openwrt.org/feed/telephony.git^2a4541d46199ac96fac214d02c908402831c4dc6
--- a/include/kernel-6.6
+++ b/include/kernel-6.6
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .93
-LINUX_KERNEL_HASH-6.6.93 = 0d79ff359635e9f009f1e330deed5f3aefd8c452b80660bffdc504b877797719
+LINUX_VERSION-6.6 = .104
+LINUX_KERNEL_HASH-6.6.104 = 2a772f9d661afabaaddcdfd1116239acb2d943377aceab9e0baed2b7a915e36a
--- a/include/version.mk
+++ b/include/version.mk
@@ -23,13 +23,13 @@ PKG_CONFIG_DEPENDS += \
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))

 VERSION_NUMBER:=$(call qstrip,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),24.10.2)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),24.10.3)

 VERSION_CODE:=$(call qstrip,$(CONFIG_VERSION_CODE))
-VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r28739-d9340319c6)
+VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),r28872-daca7c049b)

 VERSION_REPO:=$(call qstrip,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/releases/24.10.2)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/releases/24.10.3)

 VERSION_DIST:=$(call qstrip,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),OpenWrt)
--- a/package/base-files/image-config.in
+++ b/package/base-files/image-config.in
@@ -190,7 +190,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "https://downloads.openwrt.org/releases/24.10.2"
+		default "https://downloads.openwrt.org/releases/24.10.3"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:
--- a/package/boot/arm-trusted-firmware-mediatek/Makefile
+++ b/package/boot/arm-trusted-firmware-mediatek/Makefile
@@ -35,6 +35,8 @@ define Trusted-Firmware-A/Default
  DRAM_USE_COMB:=
  RAM_BOOT_UART_DL:=
  USE_UBI:=
+  FIP_OFFSET:=
+  FIP_SIZE:=
 endef

 define Trusted-Firmware-A/mt7622-nor-1ddr
@@ -221,6 +223,16 @@ define Trusted-Firmware-A/mt7981-spim-nand-ddr3
  DDR_TYPE:=ddr3
 endef

+define Trusted-Firmware-A/mt7981-cudy-tr3000-v1
+  NAME:=Cudy TR3000 v1 (SPI-NAND via SPIM, DDR3)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr3
+  FIP_OFFSET:=0x3c0000
+  FIP_SIZE:=0x200000
+endef
+
 define Trusted-Firmware-A/mt7986-ram-ddr4
  NAME:=MediaTek MT7986 (RAM, DDR4)
  BOOT_DEVICE:=ram
@@ -534,6 +546,7 @@ TFA_TARGETS:= \
 	mt7981-ram-ddr4 \
 	mt7981-emmc-ddr4 \
 	mt7981-spim-nand-ddr4 \
+	mt7981-cudy-tr3000-v1 \
 	mt7986-ram-ddr3 \
 	mt7986-emmc-ddr3 \
 	mt7986-nor-ddr3 \
@@ -581,6 +594,8 @@ TFA_MAKE_FLAGS += \
 	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7622,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x80000)) \
 	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7981,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x100000)) \
 	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7986,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x200000)) \
+	$(if $(FIP_OFFSET),OVERRIDE_FIP_BASE=$(FIP_OFFSET)) \
+	$(if $(FIP_SIZE),OVERRIDE_FIP_SIZE=$(FIP_SIZE)) \
 	$(if $(RAM_BOOT_UART_DL),bl2,all)

 define Package/trusted-firmware-a-ram/install
--- a/package/boot/uboot-envtools/files/imx_cortexa53
+++ b/package/boot/uboot-envtools/files/imx_cortexa53
@@ -0,0 +1,21 @@
+[ -e /etc/config/ubootenv ] && exit 0
+
+touch /etc/config/ubootenv
+
+. /lib/uboot-envtools.sh
+. /lib/functions.sh
+
+board=$(board_name)
+
+case "$board" in
+gw,imx8m*|\
+gateworks,imx8m*)
+	# board boots from emmc boot0 hardware partition
+	ubootenv_add_uci_config /dev/mmcblk2boot0 0x3f0000 0x8000
+	ubootenv_add_uci_config /dev/mmcblk2boot0 0x3f8000 0x8000
+esac
+
+config_load ubootenv
+config_foreach ubootenv_add_app_config ubootenv
+
+exit 0
--- a/package/boot/uboot-envtools/files/mediatek_filogic
+++ b/package/boot/uboot-envtools/files/mediatek_filogic
@@ -35,6 +35,7 @@ ubootenv_add_ubi_default() {
 case "$board" in
 abt,asr3000|\
 cmcc,a10-ubootmod|\
+cudy,tr3000-v1-ubootmod|\
 h3c,magic-nx30-pro|\
 jcg,q30-pro|\
 mercusys,mr90x-v1-ubi|\
--- a/package/boot/uboot-envtools/files/qualcommax_ipq807x
+++ b/package/boot/uboot-envtools/files/qualcommax_ipq807x
@@ -29,6 +29,11 @@ edimax,cax1800)
 	[ -n "$idx" ] && \
 		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x10000" "0x20000"
 	;;
+linksys,homewrk)
+	idx="$(find_mtd_index 0:appsblenv)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x40000" "0x40000"
+	;;
 linksys,mx4200v1|\
 linksys,mx4200v2|\
 linksys,mx5300|\
--- a/package/boot/uboot-mediatek/Makefile
+++ b/package/boot/uboot-mediatek/Makefile
@@ -267,6 +267,17 @@ define U-Boot/mt7981_cmcc_rax3000m-nand
  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr4
 endef

+define U-Boot/mt7981_cudy_tr3000-v1
+  NAME:=Cudy TR3000 v1
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cudy_tr3000-v1-ubootmod
+  UBOOT_CONFIG:=mt7981_cudy_tr3000-v1
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=cudy-tr3000-v1
+  BL2_SOC:=mt7981
+  DEPENDS:=+trusted-firmware-a-mt7981-cudy-tr3000-v1
+endef
+
 define U-Boot/mt7981_glinet_gl-x3000
  NAME:=GL.iNet GL-X3000
  BUILD_SUBTARGET:=filogic
@@ -859,6 +870,7 @@ UBOOT_TARGETS := \
 	mt7981_cmcc_a10 \
 	mt7981_cmcc_rax3000m-emmc \
 	mt7981_cmcc_rax3000m-nand \
+	mt7981_cudy_tr3000-v1 \
 	mt7981_gatonetworks_gdsp \
 	mt7981_glinet_gl-x3000 \
 	mt7981_glinet_gl-xe3000 \
--- a/package/boot/uboot-mediatek/patches/445-add-cudy_tr3000-v1.patch
+++ b/package/boot/uboot-mediatek/patches/445-add-cudy_tr3000-v1.patch
@@ -0,0 +1,330 @@
+--- /dev/null
+++ b/configs/mt7981_cudy_tr3000-v1_defconfig
+@@ -0,0 +1,107 @@
+CONFIG_ARM=y
+CONFIG_SYS_HAS_NONCACHED_MEMORY=y
+CONFIG_POSITION_INDEPENDENT=y
+CONFIG_ARCH_MEDIATEK=y
+CONFIG_TEXT_BASE=0x41e00000
+CONFIG_SYS_MALLOC_F_LEN=0x4000
+CONFIG_NR_DRAM_BANKS=1
+CONFIG_DEFAULT_DEVICE_TREE="mt7981-cudy-tr3000-v1"
+CONFIG_OF_LIBFDT_OVERLAY=y
+CONFIG_TARGET_MT7981=y
+CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
+CONFIG_DEBUG_UART_BASE=0x11002000
+CONFIG_DEBUG_UART_CLOCK=40000000
+CONFIG_SYS_LOAD_ADDR=0x46000000
+CONFIG_DEBUG_UART=y
+CONFIG_FIT=y
+CONFIG_BOOTDELAY=30
+CONFIG_AUTOBOOT_KEYED=y
+CONFIG_AUTOBOOT_MENU_SHOW=y
+CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cudy-tr3000-v1.dtb"
+CONFIG_LOGLEVEL=7
+CONFIG_PRE_CONSOLE_BUFFER=y
+CONFIG_LOG=y
+CONFIG_BOARD_LATE_INIT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_SYS_PROMPT="MT7981> "
+CONFIG_CMD_CPU=y
+CONFIG_CMD_LICENSE=y
+CONFIG_CMD_BOOTMENU=y
+CONFIG_CMD_ASKENV=y
+CONFIG_CMD_ERASEENV=y
+CONFIG_CMD_ENV_FLAGS=y
+CONFIG_CMD_STRINGS=y
+CONFIG_CMD_DM=y
+CONFIG_CMD_GPIO=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_PART=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_TFTPSRV=y
+CONFIG_CMD_RARP=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_CDP=y
+CONFIG_CMD_SNTP=y
+CONFIG_CMD_DNS=y
+CONFIG_CMD_LINK_LOCAL=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_PSTORE=y
+CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
+CONFIG_CMD_UUID=y
+CONFIG_CMD_HASH=y
+CONFIG_CMD_SMC=y
+CONFIG_CMD_UBI=y
+CONFIG_CMD_UBI_RENAME=y
+CONFIG_OF_EMBED=y
+CONFIG_ENV_OVERWRITE=y
+CONFIG_ENV_IS_IN_UBI=y
+CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
+CONFIG_ENV_UBI_PART="ubi"
+CONFIG_ENV_UBI_VOLUME="ubootenv"
+CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
+CONFIG_SYS_RELOC_GD_ENV_ADDR=y
+CONFIG_USE_DEFAULT_ENV_FILE=y
+CONFIG_DEFAULT_ENV_FILE="cudy_tr3000-v1_env"
+CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
+CONFIG_VERSION_VARIABLE=y
+CONFIG_NET_RANDOM_ETHADDR=y
+CONFIG_NETCONSOLE=y
+CONFIG_USE_IPADDR=y
+CONFIG_IPADDR="192.168.1.1"
+CONFIG_USE_SERVERIP=y
+CONFIG_SERVERIP="192.168.1.254"
+CONFIG_REGMAP=y
+CONFIG_SYSCON=y
+CONFIG_BUTTON=y
+CONFIG_BUTTON_GPIO=y
+CONFIG_CLK=y
+CONFIG_GPIO_HOG=y
+CONFIG_LED=y
+CONFIG_LED_BLINK=y
+CONFIG_LED_GPIO=y
+# CONFIG_MMC is not set
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTD_UBI_FASTMAP=y
+CONFIG_PHY_FIXED=y
+CONFIG_MEDIATEK_ETH=y
+CONFIG_PHY=y
+CONFIG_PINCTRL=y
+CONFIG_PINCONF=y
+CONFIG_PINCTRL_MT7981=y
+CONFIG_POWER_DOMAIN=y
+CONFIG_MTK_POWER_DOMAIN=y
+CONFIG_DM_REGULATOR=y
+CONFIG_DM_REGULATOR_FIXED=y
+CONFIG_DM_REGULATOR_GPIO=y
+CONFIG_RAM=y
+CONFIG_DM_SERIAL=y
+CONFIG_MTK_SERIAL=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_MTK_SPIM=y
+CONFIG_ZSTD=y
+CONFIG_HEXDUMP=y
+CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
+++ b/arch/arm/dts/mt7981-cudy-tr3000-v1.dts
+@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+/dts-v1/;
+#include "mt7981.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/linux-event-codes.h>
+
+/ {
+	#address-cells = <1>;
+	#size-cells = <1>;
+	model = "Cudy TR3000 v1";
+	compatible = "mediatek,mt7981", "mediatek,mt7981-rfb";
+
+	chosen {
+		stdout-path = &uart0;
+		tick-timer = &timer0;
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0x40000000 0x20000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		button-mode {
+			label = "mode";
+			linux,code = <EV_SW>;
+			linux,input-type = <BTN_0>;
+			gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
+			debounce-interval = <60>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_status: led-0 {
+			label = "red:power";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		led-1 {
+			label = "white:status";
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+	mediatek,gmac-id = <1>;
+	phy-mode = "gmii";
+	phy-handle = <&phy0>;
+
+	mdio {
+		phy0: ethernet-phy@0 {
+			compatible = "ethernet-phy-id03a2.9461";
+			reg = <0x0>;
+			phy-mode = "gmii";
+		};
+	};
+};
+
+&pinctrl {
+	spi_flash_pins: spi0-pins-func-1 {
+		mux {
+			function = "flash";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_00>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_00>;
+		};
+	};
+};
+
+&spi0 {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+	must_tx;
+	enhance_timing;
+	dma_ext;
+	ipm_design;
+	support_quad;
+	tick_dly = <2>;
+	sample_sel = <0>;
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0 0x100000>;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "factory";
+				reg = <0x180000 0x200000>;
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x40000>;
+			};
+
+			partition@3c0000 {
+				label = "fip";
+				reg = <0x3c0000 0x200000>;
+			};
+
+			partition@5c0000 {
+				label = "ubi";
+				reg = <0x5c0000 0x7a40000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&uart0 {
+	mediatek,force-highspeed;
+	status = "okay";
+};
+
+&watchdog {
+	status = "disabled";
+};
+--- /dev/null
+++ b/cudy_tr3000-v1_env
+@@ -0,0 +1,54 @@
+ipaddr=192.168.1.1
+serverip=192.168.1.254
+loadaddr=0x46000000
+console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
+bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
+bootconf=config-1
+bootdelay=0
+bootfile=openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-initramfs-recovery.itb
+bootfile_bl2=openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-preloader.bin
+bootfile_fip=openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-bl31-uboot.fip
+bootfile_upg=openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-squashfs-sysupgrade.itb
+bootled_pwr=red:power
+bootled_rec=white:status
+bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
+bootmenu_default=0
+bootmenu_delay=0
+bootmenu_title=      [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) )
+bootmenu_0=Initialize environment.=run _firstboot
+bootmenu_0d=Run default boot command.=run boot_default
+bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
+bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
+bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
+bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
+bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return
+bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
+bootmenu_8=Reboot.=reset
+bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
+boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
+boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
+boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
+boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
+boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
+boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
+boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
+boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
+boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
+boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
+reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
+mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
+mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
+ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
+ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
+ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
+ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
+ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
+ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
+ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
+ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
+_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
+_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
+_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
+_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       [33m$ver[0m"
--- a/package/boot/uboot-rockchip/Makefile
+++ b/package/boot/uboot-rockchip/Makefile
@@ -136,6 +136,20 @@ define U-Boot/nanopi-r4s-rk3399
    friendlyarm_nanopi-r4s-enterprise
 endef

+define U-Boot/rock-4c-plus-rk3399
+  $(U-Boot/rk3399/Default)
+  NAME:=ROCK 4C+
+  BUILD_DEVICES:= \
+    radxa_rock-4c-plus
+endef
+
+define U-Boot/rock-4se-rk3399
+  $(U-Boot/rk3399/Default)
+  NAME:=ROCK 4SE
+  BUILD_DEVICES:= \
+    radxa_rock-4se
+endef
+
 define U-Boot/rock-pi-4-rk3399
  $(U-Boot/rk3399/Default)
  NAME:=Rock Pi 4
@@ -300,6 +314,8 @@ endef
 UBOOT_TARGETS := \
  nanopc-t4-rk3399 \
  nanopi-r4s-rk3399 \
+  rock-4c-plus-rk3399 \
+  rock-4se-rk3399 \
  rock-pi-4-rk3399 \
  rockpro64-rk3399 \
  rock-pi-s-rk3308 \
--- a/package/firmware/ipq-wifi/Makefile
+++ b/package/firmware/ipq-wifi/Makefile
@@ -6,9 +6,9 @@ PKG_RELEASE:=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/firmware/qca-wireless.git
-PKG_SOURCE_DATE:=2025-05-30
-PKG_SOURCE_VERSION:=fde3d2a7ce59be389224304049a4a5b9ca49a45e
-PKG_MIRROR_HASH:=2e149366118192d4976baf42ac23d22ef32e477feb111d2756a2411278b6cf46
+PKG_SOURCE_DATE:=2025-08-25
+PKG_SOURCE_VERSION:=a510502e7922b0a61e455e43479a62e7d27cf3ba
+PKG_MIRROR_HASH:=0b8120ce09fdd9176e77b65f2c0866e14aa580ba7e6dd9440f37011418346be7
 PKG_FLAGS:=nonshared

 include $(INCLUDE_DIR)/package.mk
@@ -37,6 +37,7 @@ ALLWIFIBOARDS:= \
 	dynalink_dl-wrx36 \
 	edgecore_eap102 \
 	edimax_cax1800 \
+	linksys_homewrk \
 	linksys_mx4200 \
 	linksys_mx5300 \
 	linksys_mx8500 \
@@ -56,6 +57,7 @@ ALLWIFIBOARDS:= \
 	tplink_eap660hd-v1 \
 	tplink_archer-c6-v2 \
 	wallys_dr40x9 \
+	xiaomi_aiot-ac2350 \
 	xiaomi_ax3600 \
 	xiaomi_ax9000 \
 	yyets_le1 \
@@ -96,6 +98,8 @@ define ipq-wifi-install-one
    $(call ipq-wifi-install-one-to,$(1),$(2),QCA9887/hw1.0),\
  $(if $(filter $(suffix $(1)),.QCA9984 .qca9984),\
    $(call ipq-wifi-install-one-to,$(1),$(2),QCA9984/hw1.0),\
+  $(if $(filter $(suffix $(1)),.QCA9988 .qca9988),\
+    $(call ipq-wifi-install-one-to,$(1),$(2),QCA9984/hw1.0),\
  $(if $(filter $(suffix $(1)),.QCA99X0 .qca99x0),\
    $(call ipq-wifi-install-one-to,$(1),$(2),QCA99X0/hw2.0),\
  $(if $(filter $(suffix $(1)),.IPQ6018 .ipq6018),\
@@ -105,7 +109,7 @@ define ipq-wifi-install-one
  $(if $(filter $(suffix $(1)),.QCN9074 .qcn9074),\
    $(call ipq-wifi-install-ath11-one-to,$(1),$(2),QCN9074/hw1.0),\
    $(error Unrecognized board-file suffix '$(suffix $(1))' for '$(1)')\
-  ))))))))
+  )))))))))

 endef
 # Blank line required at end of above define due to foreach context
@@ -165,6 +169,7 @@ $(eval $(call generate-ipq-wifi-package,compex_wpq873,Compex WPQ-873))
 $(eval $(call generate-ipq-wifi-package,dynalink_dl-wrx36,Dynalink DL-WRX36))
 $(eval $(call generate-ipq-wifi-package,edgecore_eap102,Edgecore EAP102))
 $(eval $(call generate-ipq-wifi-package,edimax_cax1800,Edimax CAX1800))
+$(eval $(call generate-ipq-wifi-package,linksys_homewrk,Linksys HomeWRK))
 $(eval $(call generate-ipq-wifi-package,linksys_mx4200,Linksys MX4200))
 $(eval $(call generate-ipq-wifi-package,linksys_mx5300,Linksys MX5300))
 $(eval $(call generate-ipq-wifi-package,linksys_mx8500,Linksys MX8500))
@@ -184,6 +189,7 @@ $(eval $(call generate-ipq-wifi-package,spectrum_sax1v1k,Spectrum SAX1V1K))
 $(eval $(call generate-ipq-wifi-package,tplink_eap660hd-v1,TP-Link EAP660 HD v1))
 $(eval $(call generate-ipq-wifi-package,tplink_archer-c6-v2,TP-Link Archer C6 V2))
 $(eval $(call generate-ipq-wifi-package,wallys_dr40x9,Wallys DR40X9))
+$(eval $(call generate-ipq-wifi-package,xiaomi_aiot-ac2350,Xiaomi AIoT AC2350))
 $(eval $(call generate-ipq-wifi-package,xiaomi_ax3600,Xiaomi AX3600))
 $(eval $(call generate-ipq-wifi-package,xiaomi_ax9000,Xiaomi AX9000))
 $(eval $(call generate-ipq-wifi-package,yyets_le1,YYeTs LE1))
--- a/package/firmware/wireless-regdb/Makefile
+++ b/package/firmware/wireless-regdb/Makefile
@@ -1,14 +1,14 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=wireless-regdb
-PKG_VERSION:=2025.02.20
+PKG_VERSION:=2025.07.10
 PKG_RELEASE:=1
 PKG_LICENSE:=ISC
 PKG_LICENSE_FILES:=LICENSE

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/wireless-regdb/
-PKG_HASH:=57f8e7721cf5a880c13ae0c202edbb21092a060d45f9e9c59bcd2a8272bfa456
+PKG_HASH:=a8340bcdcd1b5db6c79149879d122b170f3bb075381718d4f429ad831a6fa28d

 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>

--- a/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c
+++ b/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c
@@ -1787,6 +1787,7 @@ extern void ifx_usb_enable_afe_oc(void);
 */
 static irqreturn_t IFX_MEI_IrqHandle (int int1, void *void0)
 {
+	u32 stat;
 	u32 scratch;
 	DSL_DEV_Device_t *pDev = (DSL_DEV_Device_t *) void0;
 #if defined(CONFIG_LTQ_MEI_FW_LOOPBACK) && defined(DFE_PING_TEST)
@@ -1820,6 +1821,12 @@ static irqreturn_t IFX_MEI_IrqHandle (int int1, void *void0)
                if (dsl_bsp_event_callback[event].function)
                        (*dsl_bsp_event_callback[event].function)(pDev, event, dsl_bsp_event_callback[event].pData);
        } else { // normal message
+                IFX_MEI_LongWordReadOffset (pDev, (u32) ME_ARC2ME_STAT, &stat);
+                if (!(stat & ARC_TO_MEI_MSGAV)) {
+                        // status register indicates there is no message
+                        return IRQ_NONE;
+                }
+
                IFX_MEI_MailboxRead (pDev, DSL_DEV_PRIVATE(pDev)->CMV_RxMsg, MSG_LENGTH);
                if (DSL_DEV_PRIVATE(pDev)-> cmv_waiting == 1) {
                        DSL_DEV_PRIVATE(pDev)-> arcmsgav = 1;
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,13 +10,13 @@ include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=mac80211

-PKG_VERSION:=6.12.6
+PKG_VERSION:=6.12.44
 PKG_RELEASE:=2
 PKG_LICENSE:=GPL-2.0-only
 PKG_LICENSE_FILES:=COPYING

 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-PKG_HASH:=28ec39425a1b3270e1422d92a8131a6a3d8919cc13e8ee250c315e55d922ba68
+PKG_HASH:=85a9f92ddba3bf2970a089e7af576c1135217c387205f4481ea9131c0c45c509

 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(if $(BUILD_VARIANT),$(PKG_NAME)-$(BUILD_VARIANT)/)backports-$(PKG_VERSION)
--- a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
+++ b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
@@ -1,6 +1,6 @@
 --- a/net/wireless/reg.c
 +++ b/net/wireless/reg.c
-@@ -3364,6 +3364,8 @@ void regulatory_hint_country_ie(struct w
+@@ -3367,6 +3367,8 @@ void regulatory_hint_country_ie(struct w
 	enum environment_cap env = ENVIRON_ANY;
 	struct regulatory_request *request = NULL, *lr;
 
@@ -9,7 +9,7 @@
 	/* IE len must be evenly divisible by 2 */
 	if (country_ie_len & 0x01)
 		return;
-@@ -3615,6 +3617,7 @@ static bool is_wiphy_all_set_reg_flag(en
+@@ -3618,6 +3620,7 @@ static bool is_wiphy_all_set_reg_flag(en
 
 void regulatory_hint_disconnect(void)
 {
--- a/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>

 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3539,6 +3539,16 @@ int ath10k_core_register(struct ath10k *
+@@ -3577,6 +3577,16 @@ int ath10k_core_register(struct ath10k *
 
 	queue_work(ar->workqueue, &ar->register_work);
 
--- a/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -9919,6 +9919,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -9924,6 +9924,21 @@ static int ath10k_mac_init_rd(struct ath
 	return 0;
 }
 
@@ -22,7 +22,7 @@
 int ath10k_mac_register(struct ath10k *ar)
 {
 	static const u32 cipher_suites[] = {
-@@ -10281,6 +10296,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10286,6 +10301,12 @@ int ath10k_mac_register(struct ath10k *a
 
 	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
 
--- a/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
+++ b/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
@@ -16,7 +16,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>

 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -1315,6 +1315,10 @@ struct ath10k {
+@@ -1320,6 +1320,10 @@ struct ath10k {
 	s32 tx_power_2g_limit;
 	s32 tx_power_5g_limit;
 
@@ -40,7 +40,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 	if (ret)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -10297,7 +10297,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10302,7 +10302,7 @@ int ath10k_mac_register(struct ath10k *a
 	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
 
 #ifdef CPTCFG_MAC80211_LEDS
--- a/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
+++ b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
@@ -26,7 +26,7 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
 #include <linux/property.h>
 #include <linux/dmi.h>
 #include <linux/ctype.h>
-@@ -3411,6 +3412,8 @@ static int ath10k_core_probe_fw(struct a
+@@ -3449,6 +3450,8 @@ static int ath10k_core_probe_fw(struct a
 
 	device_get_mac_address(ar->dev, ar->mac_addr);
 
--- a/package/kernel/mac80211/patches/ath10k/988-ath10k-always-use-mac80211-loss-detection.patch
+++ b/package/kernel/mac80211/patches/ath10k/988-ath10k-always-use-mac80211-loss-detection.patch
@@ -18,7 +18,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>

 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -10089,7 +10089,6 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10094,7 +10094,6 @@ int ath10k_mac_register(struct ath10k *a
 	ieee80211_hw_set(ar->hw, CHANCTX_STA_CSA);
 	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
 	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
--- a/package/kernel/mac80211/patches/ath11k/001-wifi-ath11k-Fix-DMA-buffer-allocation-to-resolve-SWIOTLB-issues.patch
+++ b/package/kernel/mac80211/patches/ath11k/001-wifi-ath11k-Fix-DMA-buffer-allocation-to-resolve-SWIOTLB-issues.patch
@@ -1,91 +0,0 @@
-wifi: ath11k: Fix DMA buffer allocation to resolve SWIOTLB issues
-Currently, the driver allocates cacheable DMA buffers for rings like
-HAL_REO_DST and HAL_WBM2SW_RELEASE. The buffers for HAL_WBM2SW_RELEASE
-are large (1024 KiB), exceeding the SWIOTLB slot size of 256 KiB. This
-leads to "swiotlb buffer is full" error messages on systems without an
-IOMMU that use SWIOTLB, causing driver initialization failures. The driver
-calls dma_map_single() with these large buffers obtained from kzalloc(),
-resulting in ring initialization errors on systems without an IOMMU that
-use SWIOTLB.
-
-To address these issues, replace the flawed buffer allocation mechanism
-with the appropriate DMA API. Specifically, use dma_alloc_noncoherent()
-for cacheable DMA buffers, ensuring proper freeing of buffers with
-dma_free_noncoherent().
-
-Error log:
-[   10.194343] ath11k_pci 0000:04:00.0: swiotlb buffer is full (sz:1048583 bytes), total 32768 (slots), used 2529 (slots)
-[   10.194406] ath11k_pci 0000:04:00.0: failed to set up tcl_comp ring (0) :-12
-[   10.194781] ath11k_pci 0000:04:00.0: failed to init DP: -12
-
-Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
-Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
-
-Reported-by: Tim Harvey <tharvey@gateworks.com>
-Closes: https://lore.kernel.org/all/20241210041133.GA17116@lst.de/
-Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
-Tested-by: Tim Harvey <tharvey@gateworks.com>
-Link: https://patch.msgid.link/20250119164219.647059-2-quic_ppranees@quicinc.com
-Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
--- a/drivers/net/wireless/ath/ath11k/dp.c
-+++ b/drivers/net/wireless/ath/ath11k/dp.c
-@@ -1,7 +1,7 @@
- // SPDX-License-Identifier: BSD-3-Clause-Clear
- /*
-  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
-+ * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
-  */
- 
- #include <crypto/hash.h>
-@@ -104,14 +104,12 @@ void ath11k_dp_srng_cleanup(struct ath11
- 	if (!ring->vaddr_unaligned)
- 		return;
- 
-	if (ring->cached) {
-		dma_unmap_single(ab->dev, ring->paddr_unaligned, ring->size,
-				 DMA_FROM_DEVICE);
-		kfree(ring->vaddr_unaligned);
-	} else {
-+	if (ring->cached)
-+		dma_free_noncoherent(ab->dev, ring->size, ring->vaddr_unaligned,
-+				     ring->paddr_unaligned, DMA_FROM_DEVICE);
-+	else
- 		dma_free_coherent(ab->dev, ring->size, ring->vaddr_unaligned,
- 				  ring->paddr_unaligned);
-	}
- 
- 	ring->vaddr_unaligned = NULL;
- }
-@@ -249,25 +247,14 @@ int ath11k_dp_srng_setup(struct ath11k_b
- 		default:
- 			cached = false;
- 		}
-
-		if (cached) {
-			ring->vaddr_unaligned = kzalloc(ring->size, GFP_KERNEL);
-			if (!ring->vaddr_unaligned)
-				return -ENOMEM;
-
-			ring->paddr_unaligned = dma_map_single(ab->dev,
-							       ring->vaddr_unaligned,
-							       ring->size,
-							       DMA_FROM_DEVICE);
-			if (dma_mapping_error(ab->dev, ring->paddr_unaligned)) {
-				kfree(ring->vaddr_unaligned);
-				ring->vaddr_unaligned = NULL;
-				return -ENOMEM;
-			}
-		}
- 	}
- 
-	if (!cached)
-+	if (cached)
-+		ring->vaddr_unaligned = dma_alloc_noncoherent(ab->dev, ring->size,
-+							      &ring->paddr_unaligned,
-+							      DMA_FROM_DEVICE,
-+							      GFP_KERNEL);
-+	else
- 		ring->vaddr_unaligned = dma_alloc_coherent(ab->dev, ring->size,
- 							   &ring->paddr_unaligned,
- 							   GFP_KERNEL);
--- a/package/kernel/mac80211/patches/ath11k/002-wifi-ath11k-use-dma-alloc-noncoherent-for-rx-tid-buffer-allocation.patch
+++ b/package/kernel/mac80211/patches/ath11k/002-wifi-ath11k-use-dma-alloc-noncoherent-for-rx-tid-buffer-allocation.patch
@@ -1,255 +0,0 @@
-wifi: ath11k: Use dma_alloc_noncoherent for rx_tid buffer allocation
-
-Currently, the driver allocates cacheable DMA buffers for the rx_tid
-structure using kzalloc() and dma_map_single(). These buffers are
-long-lived and can persist for the lifetime of the peer, which is not
-advisable. Instead of using kzalloc() and dma_map_single() for allocating
-cacheable DMA buffers, utilize the dma_alloc_noncoherent() helper for the
-allocation of long-lived cacheable DMA buffers, such as the peer's rx_tid.
-Since dma_alloc_noncoherent() returns unaligned physical and virtual
-addresses, align them internally before use within the driver. This
-ensures proper allocation of non-coherent memory through the kernel
-helper.
-
-Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
-Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3
-
-Signed-off-by: P Praneesh <quic_ppranees@quicinc.com>
--- a/drivers/net/wireless/ath/ath11k/dp.h
-+++ b/drivers/net/wireless/ath/ath11k/dp.h
-@@ -1,7 +1,7 @@
- /* SPDX-License-Identifier: BSD-3-Clause-Clear */
- /*
-  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2023 Qualcomm Innovation Center, Inc. All rights reserved.
-+ * Copyright (c) 2021-2023, 2025 Qualcomm Innovation Center, Inc. All rights reserved.
-  */
- 
- #ifndef ATH11K_DP_H
-@@ -20,7 +20,6 @@ struct ath11k_ext_irq_grp;
- 
- struct dp_rx_tid {
- 	u8 tid;
-	u32 *vaddr;
- 	dma_addr_t paddr;
- 	u32 size;
- 	u32 ba_win_sz;
-@@ -37,6 +36,9 @@ struct dp_rx_tid {
- 	/* Timer info related to fragments */
- 	struct timer_list frag_timer;
- 	struct ath11k_base *ab;
-+	u32 *vaddr_unaligned;
-+	dma_addr_t paddr_unaligned;
-+	u32 unaligned_size;
- };
- 
- #define DP_REO_DESC_FREE_THRESHOLD  64
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
-+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -1,7 +1,7 @@
- // SPDX-License-Identifier: BSD-3-Clause-Clear
- /*
-  * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved.
- * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved.
-+ * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved.
-  */
- 
- #include <linux/ieee80211.h>
-@@ -675,11 +675,11 @@ void ath11k_dp_reo_cmd_list_cleanup(stru
- 	list_for_each_entry_safe(cmd, tmp, &dp->reo_cmd_list, list) {
- 		list_del(&cmd->list);
- 		rx_tid = &cmd->data;
-		if (rx_tid->vaddr) {
-			dma_unmap_single(ab->dev, rx_tid->paddr,
-					 rx_tid->size, DMA_BIDIRECTIONAL);
-			kfree(rx_tid->vaddr);
-			rx_tid->vaddr = NULL;
-+		if (rx_tid->vaddr_unaligned) {
-+			dma_free_noncoherent(ab->dev, rx_tid->unaligned_size,
-+					     rx_tid->vaddr_unaligned,
-+					     rx_tid->paddr_unaligned, DMA_BIDIRECTIONAL);
-+			rx_tid->vaddr_unaligned = NULL;
- 		}
- 		kfree(cmd);
- 	}
-@@ -689,11 +689,11 @@ void ath11k_dp_reo_cmd_list_cleanup(stru
- 		list_del(&cmd_cache->list);
- 		dp->reo_cmd_cache_flush_count--;
- 		rx_tid = &cmd_cache->data;
-		if (rx_tid->vaddr) {
-			dma_unmap_single(ab->dev, rx_tid->paddr,
-					 rx_tid->size, DMA_BIDIRECTIONAL);
-			kfree(rx_tid->vaddr);
-			rx_tid->vaddr = NULL;
-+		if (rx_tid->vaddr_unaligned) {
-+			dma_free_noncoherent(ab->dev, rx_tid->unaligned_size,
-+					     rx_tid->vaddr_unaligned,
-+					     rx_tid->paddr_unaligned, DMA_BIDIRECTIONAL);
-+			rx_tid->vaddr_unaligned = NULL;
- 		}
- 		kfree(cmd_cache);
- 	}
-@@ -708,11 +708,11 @@ static void ath11k_dp_reo_cmd_free(struc
- 	if (status != HAL_REO_CMD_SUCCESS)
- 		ath11k_warn(dp->ab, "failed to flush rx tid hw desc, tid %d status %d\n",
- 			    rx_tid->tid, status);
-	if (rx_tid->vaddr) {
-		dma_unmap_single(dp->ab->dev, rx_tid->paddr, rx_tid->size,
-				 DMA_BIDIRECTIONAL);
-		kfree(rx_tid->vaddr);
-		rx_tid->vaddr = NULL;
-+	if (rx_tid->vaddr_unaligned) {
-+		dma_free_noncoherent(dp->ab->dev, rx_tid->unaligned_size,
-+				     rx_tid->vaddr_unaligned,
-+				     rx_tid->paddr_unaligned, DMA_BIDIRECTIONAL);
-+		rx_tid->vaddr_unaligned = NULL;
- 	}
- }
- 
-@@ -749,10 +749,10 @@ static void ath11k_dp_reo_cache_flush(st
- 	if (ret) {
- 		ath11k_err(ab, "failed to send HAL_REO_CMD_FLUSH_CACHE cmd, tid %d (%d)\n",
- 			   rx_tid->tid, ret);
-		dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
-				 DMA_BIDIRECTIONAL);
-		kfree(rx_tid->vaddr);
-		rx_tid->vaddr = NULL;
-+		dma_free_noncoherent(ab->dev, rx_tid->unaligned_size,
-+				     rx_tid->vaddr_unaligned,
-+				     rx_tid->paddr_unaligned, DMA_BIDIRECTIONAL);
-+		rx_tid->vaddr_unaligned = NULL;
- 	}
- }
- 
-@@ -802,10 +802,10 @@ static void ath11k_dp_rx_tid_del_func(st
- 
- 	return;
- free_desc:
-	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
-			 DMA_BIDIRECTIONAL);
-	kfree(rx_tid->vaddr);
-	rx_tid->vaddr = NULL;
-+	dma_free_noncoherent(ab->dev, rx_tid->unaligned_size,
-+			     rx_tid->vaddr_unaligned,
-+			     rx_tid->paddr_unaligned, DMA_BIDIRECTIONAL);
-+	rx_tid->vaddr_unaligned = NULL;
- }
- 
- void ath11k_peer_rx_tid_delete(struct ath11k *ar,
-@@ -831,14 +831,16 @@ void ath11k_peer_rx_tid_delete(struct at
- 		if (ret != -ESHUTDOWN)
- 			ath11k_err(ar->ab, "failed to send HAL_REO_CMD_UPDATE_RX_QUEUE cmd, tid %d (%d)\n",
- 				   tid, ret);
-		dma_unmap_single(ar->ab->dev, rx_tid->paddr, rx_tid->size,
-				 DMA_BIDIRECTIONAL);
-		kfree(rx_tid->vaddr);
-		rx_tid->vaddr = NULL;
-+		dma_free_noncoherent(ar->ab->dev, rx_tid->unaligned_size,
-+				     rx_tid->vaddr_unaligned,
-+				     rx_tid->paddr_unaligned, DMA_BIDIRECTIONAL);
-+		rx_tid->vaddr_unaligned = NULL;
- 	}
- 
- 	rx_tid->paddr = 0;
-+	rx_tid->paddr_unaligned = 0;
- 	rx_tid->size = 0;
-+	rx_tid->unaligned_size = 0;
- }
- 
- static int ath11k_dp_rx_link_desc_return(struct ath11k_base *ab,
-@@ -982,10 +984,9 @@ static void ath11k_dp_rx_tid_mem_free(st
- 	if (!rx_tid->active)
- 		goto unlock_exit;
- 
-	dma_unmap_single(ab->dev, rx_tid->paddr, rx_tid->size,
-			 DMA_BIDIRECTIONAL);
-	kfree(rx_tid->vaddr);
-	rx_tid->vaddr = NULL;
-+	dma_free_noncoherent(ab->dev, rx_tid->unaligned_size, rx_tid->vaddr_unaligned,
-+			     rx_tid->paddr_unaligned, DMA_BIDIRECTIONAL);
-+	rx_tid->vaddr_unaligned = NULL;
- 
- 	rx_tid->active = false;
- 
-@@ -1000,9 +1001,8 @@ int ath11k_peer_rx_tid_setup(struct ath1
- 	struct ath11k_base *ab = ar->ab;
- 	struct ath11k_peer *peer;
- 	struct dp_rx_tid *rx_tid;
-	u32 hw_desc_sz;
-	u32 *addr_aligned;
-	void *vaddr;
-+	u32 hw_desc_sz, *vaddr;
-+	void *vaddr_unaligned;
- 	dma_addr_t paddr;
- 	int ret;
- 
-@@ -1050,37 +1050,34 @@ int ath11k_peer_rx_tid_setup(struct ath1
- 	else
- 		hw_desc_sz = ath11k_hal_reo_qdesc_size(DP_BA_WIN_SZ_MAX, tid);
- 
-	vaddr = kzalloc(hw_desc_sz + HAL_LINK_DESC_ALIGN - 1, GFP_ATOMIC);
-	if (!vaddr) {
-+	rx_tid->unaligned_size = hw_desc_sz + HAL_LINK_DESC_ALIGN - 1;
-+	vaddr_unaligned = dma_alloc_noncoherent(ab->dev, rx_tid->unaligned_size, &paddr,
-+						DMA_BIDIRECTIONAL, GFP_ATOMIC);
-+	if (!vaddr_unaligned) {
- 		spin_unlock_bh(&ab->base_lock);
- 		return -ENOMEM;
- 	}
- 
-	addr_aligned = PTR_ALIGN(vaddr, HAL_LINK_DESC_ALIGN);
-
-	ath11k_hal_reo_qdesc_setup(addr_aligned, tid, ba_win_sz,
-				   ssn, pn_type);
-
-	paddr = dma_map_single(ab->dev, addr_aligned, hw_desc_sz,
-			       DMA_BIDIRECTIONAL);
-
-	ret = dma_mapping_error(ab->dev, paddr);
-	if (ret) {
-		spin_unlock_bh(&ab->base_lock);
-		ath11k_warn(ab, "failed to setup dma map for peer %pM rx tid %d: %d\n",
-			    peer_mac, tid, ret);
-		goto err_mem_free;
-	}
-
-	rx_tid->vaddr = vaddr;
-	rx_tid->paddr = paddr;
-+	rx_tid->vaddr_unaligned = vaddr_unaligned;
-+	vaddr = PTR_ALIGN(vaddr_unaligned, HAL_LINK_DESC_ALIGN);
-+	rx_tid->paddr_unaligned = paddr;
-+	rx_tid->paddr = rx_tid->paddr_unaligned + ((unsigned long)vaddr -
-+			(unsigned long)rx_tid->vaddr_unaligned);
-+	ath11k_hal_reo_qdesc_setup(vaddr, tid, ba_win_sz, ssn, pn_type);
- 	rx_tid->size = hw_desc_sz;
- 	rx_tid->active = true;
- 
-+	/* After dma_alloc_noncoherent, vaddr is being modified for reo qdesc setup.
-+	 * Since these changes are not reflected in the device, driver now needs to
-+	 * explicitly call dma_sync_single_for_device.
-+	 */
-+	dma_sync_single_for_device(ab->dev, rx_tid->paddr,
-+				   rx_tid->size,
-+				   DMA_TO_DEVICE);
- 	spin_unlock_bh(&ab->base_lock);
- 
-	ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id, peer_mac,
-						     paddr, tid, 1, ba_win_sz);
-+	ret = ath11k_wmi_peer_rx_reorder_queue_setup(ar, vdev_id, peer_mac, rx_tid->paddr,
-+						     tid, 1, ba_win_sz);
- 	if (ret) {
- 		ath11k_warn(ar->ab, "failed to setup rx reorder queue for peer %pM tid %d: %d\n",
- 			    peer_mac, tid, ret);
-@@ -1088,12 +1085,6 @@ int ath11k_peer_rx_tid_setup(struct ath1
- 	}
- 
- 	return ret;
-
-err_mem_free:
-	kfree(rx_tid->vaddr);
-	rx_tid->vaddr = NULL;
-
-	return ret;
- }
- 
- int ath11k_dp_rx_ampdu_start(struct ath11k *ar,
--- a/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
+++ b/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
@@ -31,7 +31,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 	{
 		.hw_rev = ATH11K_HW_IPQ8074,
 		.name = "ipq8074 hw2.0",
-@@ -2147,7 +2147,8 @@ static void ath11k_core_reset(struct wor
+@@ -2200,7 +2200,8 @@ static void ath11k_core_reset(struct wor
 static int ath11k_init_hw_params(struct ath11k_base *ab)
 {
 	const struct ath11k_hw_params *hw_params = NULL;
@@ -41,7 +41,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 
 	for (i = 0; i < ARRAY_SIZE(ath11k_hw_params); i++) {
 		hw_params = &ath11k_hw_params[i];
-@@ -2163,7 +2164,31 @@ static int ath11k_init_hw_params(struct
+@@ -2216,7 +2217,31 @@ static int ath11k_init_hw_params(struct
 
 	ab->hw_params = *hw_params;
 
--- a/package/kernel/mac80211/patches/ath12k/001-wifi-ath12k-add-11d-scan-offload-support-and-handle-country-code-for-WCN7850.patch
+++ b/package/kernel/mac80211/patches/ath12k/001-wifi-ath12k-add-11d-scan-offload-support-and-handle-country-code-for-WCN7850.patch
@@ -121,7 +121,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 };
 
 static __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len)
-@@ -2364,7 +2366,10 @@ int ath12k_wmi_send_scan_start_cmd(struc
+@@ -2374,7 +2376,10 @@ int ath12k_wmi_send_scan_start_cmd(struc
 	cmd->scan_id = cpu_to_le32(arg->scan_id);
 	cmd->scan_req_id = cpu_to_le32(arg->scan_req_id);
 	cmd->vdev_id = cpu_to_le32(arg->vdev_id);
@@ -133,7 +133,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 	cmd->notify_scan_events = cpu_to_le32(arg->notify_scan_events);
 
 	ath12k_wmi_copy_scan_event_cntrl_flags(cmd, arg);
-@@ -3084,6 +3089,110 @@ out:
+@@ -3094,6 +3099,110 @@ out:
 	return ret;
 }
 
@@ -244,7 +244,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 int
 ath12k_wmi_send_twt_enable_cmd(struct ath12k *ar, u32 pdev_id)
 {
-@@ -5669,6 +5778,50 @@ static void ath12k_wmi_op_ep_tx_credits(
+@@ -5714,6 +5823,50 @@ static void ath12k_wmi_op_ep_tx_credits(
 	wake_up(&ab->wmi_ab.tx_credits_wq);
 }
 
@@ -295,7 +295,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 static void ath12k_wmi_htc_tx_complete(struct ath12k_base *ab,
 				       struct sk_buff *skb)
 {
-@@ -7270,6 +7423,9 @@ static void ath12k_wmi_op_rx(struct ath1
+@@ -7317,6 +7470,9 @@ static void ath12k_wmi_op_rx(struct ath1
 	case WMI_GTK_OFFLOAD_STATUS_EVENTID:
 		ath12k_wmi_gtk_offload_status_event(ab, skb);
 		break;
@@ -336,9 +336,9 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 struct wmi_delba_send_cmd {
 	__le32 tlv_header;
 	__le32 vdev_id;
-@@ -3945,6 +3967,16 @@ struct ath12k_wmi_eht_rate_set_params {
+@@ -3944,6 +3966,16 @@ struct ath12k_wmi_eht_rate_set_params {
+ #define REG_ALPHA2_LEN 2
 #define MAX_6G_REG_RULES 5
- #define REG_US_5G_NUM_REG_RULES 4
 
 +struct wmi_set_current_country_arg {
 +	u8 alpha2[REG_ALPHA2_LEN];
@@ -353,7 +353,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 enum wmi_start_event_param {
 	WMI_VDEV_START_RESP_EVENT = 0,
 	WMI_VDEV_RESTART_RESP_EVENT,
-@@ -5547,11 +5579,17 @@ int ath12k_wmi_send_bcn_offload_control_
+@@ -5546,11 +5578,17 @@ int ath12k_wmi_send_bcn_offload_control_
 					    u32 vdev_id, u32 bcn_ctrl_op);
 int ath12k_wmi_send_init_country_cmd(struct ath12k *ar,
 				     struct ath12k_wmi_init_country_arg *arg);
@@ -373,7 +373,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 				 struct ath12k_wmi_rx_reorder_queue_remove_arg *arg);
 --- a/drivers/net/wireless/ath/ath12k/core.c
 +++ b/drivers/net/wireless/ath/ath12k/core.c
-@@ -1014,6 +1014,7 @@ void ath12k_core_halt(struct ath12k *ar)
+@@ -1017,6 +1017,7 @@ void ath12k_core_halt(struct ath12k *ar)
 	cancel_delayed_work_sync(&ar->scan.timeout);
 	cancel_work_sync(&ar->regd_update_work);
 	cancel_work_sync(&ab->rfkill_work);
@@ -381,7 +381,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 
 	rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx], NULL);
 	synchronize_rcu();
-@@ -1021,6 +1022,34 @@ void ath12k_core_halt(struct ath12k *ar)
+@@ -1029,6 +1030,34 @@ void ath12k_core_halt(struct ath12k *ar)
 	idr_init(&ar->txmgmt_idr);
 }
 
@@ -416,7 +416,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 static void ath12k_core_pre_reconfigure_recovery(struct ath12k_base *ab)
 {
 	struct ath12k *ar;
-@@ -1045,8 +1074,10 @@ static void ath12k_core_pre_reconfigure_
+@@ -1053,8 +1082,10 @@ static void ath12k_core_pre_reconfigure_
 			ar = &ah->radio[j];
 
 			ath12k_mac_drain_tx(ar);
@@ -428,7 +428,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 			complete(&ar->scan.on_channel);
 			complete(&ar->peer_assoc_done);
 			complete(&ar->peer_delete_done);
-@@ -1312,6 +1343,7 @@ struct ath12k_base *ath12k_core_alloc(st
+@@ -1320,6 +1351,7 @@ struct ath12k_base *ath12k_core_alloc(st
 	INIT_WORK(&ab->restart_work, ath12k_core_restart);
 	INIT_WORK(&ab->reset_work, ath12k_core_reset);
 	INIT_WORK(&ab->rfkill_work, ath12k_rfkill_work);
@@ -438,7 +438,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 	init_completion(&ab->htc_suspend);
 --- a/drivers/net/wireless/ath/ath12k/core.h
 +++ b/drivers/net/wireless/ath/ath12k/core.h
-@@ -199,6 +199,12 @@ enum ath12k_scan_state {
+@@ -200,6 +200,12 @@ enum ath12k_scan_state {
 	ATH12K_SCAN_ABORTING,
 };
 
@@ -451,7 +451,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 enum ath12k_dev_flags {
 	ATH12K_CAC_RUNNING,
 	ATH12K_FLAG_CRASH_FLUSH,
-@@ -319,6 +325,8 @@ struct ath12k_vif_iter {
+@@ -320,6 +326,8 @@ struct ath12k_vif_iter {
 #define ATH12K_RX_RATE_TABLE_11AX_NUM	576
 #define ATH12K_RX_RATE_TABLE_NUM 320
 
@@ -460,7 +460,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 struct ath12k_rx_peer_rate_stats {
 	u64 ht_mcs_count[HAL_RX_MAX_MCS_HT + 1];
 	u64 vht_mcs_count[HAL_RX_MAX_MCS_VHT + 1];
-@@ -654,6 +662,13 @@ struct ath12k {
+@@ -655,6 +663,13 @@ struct ath12k {
 	u32 freq_low;
 	u32 freq_high;
 
@@ -474,7 +474,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 	bool nlo_enabled;
 };
 
-@@ -886,6 +901,8 @@ struct ath12k_base {
+@@ -887,6 +902,8 @@ struct ath12k_base {
 	/* continuous recovery fail count */
 	atomic_t fail_cont_count;
 	unsigned long reset_fail_timeout;
@@ -532,7 +532,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 	return ret;
 }
 
-@@ -5994,7 +6009,7 @@ static int ath12k_mac_start(struct ath12
+@@ -5998,7 +6013,7 @@ static int ath12k_mac_start(struct ath12
 
 	/* TODO: Do we need to enable ANI? */
 
@@ -541,7 +541,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 
 	ar->num_started_vdevs = 0;
 	ar->num_created_vdevs = 0;
-@@ -6174,6 +6189,9 @@ static void ath12k_mac_stop(struct ath12
+@@ -6178,6 +6193,9 @@ static void ath12k_mac_stop(struct ath12
 	cancel_delayed_work_sync(&ar->scan.timeout);
 	cancel_work_sync(&ar->regd_update_work);
 	cancel_work_sync(&ar->ab->rfkill_work);
@@ -551,7 +551,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 
 	spin_lock_bh(&ar->data_lock);
 	list_for_each_entry_safe(ppdu_stats, tmp, &ar->ppdu_stats_info, list) {
-@@ -6420,6 +6438,117 @@ static void ath12k_mac_op_update_vif_off
+@@ -6424,6 +6442,117 @@ static void ath12k_mac_op_update_vif_off
 	ath12k_mac_update_vif_offload(arvif);
 }
 
@@ -669,7 +669,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 static int ath12k_mac_vdev_create(struct ath12k *ar, struct ieee80211_vif *vif)
 {
 	struct ath12k_hw *ah = ar->ah;
-@@ -6534,6 +6663,7 @@ static int ath12k_mac_vdev_create(struct
+@@ -6538,6 +6667,7 @@ static int ath12k_mac_vdev_create(struct
 				    arvif->vdev_id, ret);
 			goto err_peer_del;
 		}
@@ -677,7 +677,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 		break;
 	case WMI_VDEV_TYPE_STA:
 		param_id = WMI_STA_PS_PARAM_RX_WAKE_POLICY;
-@@ -6572,6 +6702,13 @@ static int ath12k_mac_vdev_create(struct
+@@ -6576,6 +6706,13 @@ static int ath12k_mac_vdev_create(struct
 				    arvif->vdev_id, ret);
 			goto err_peer_del;
 		}
@@ -691,7 +691,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 		break;
 	default:
 		break;
-@@ -6912,6 +7049,11 @@ static void ath12k_mac_op_remove_interfa
+@@ -6916,6 +7053,11 @@ static void ath12k_mac_op_remove_interfa
 	ath12k_dbg(ab, ATH12K_DBG_MAC, "mac remove interface (vdev %d)\n",
 		   arvif->vdev_id);
 
@@ -703,7 +703,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
 		ret = ath12k_peer_delete(ar, arvif->vdev_id, vif->addr);
 		if (ret)
-@@ -7752,6 +7894,14 @@ ath12k_mac_op_unassign_vif_chanctx(struc
+@@ -7756,6 +7898,14 @@ ath12k_mac_op_unassign_vif_chanctx(struc
 	    ar->num_started_vdevs == 1 && ar->monitor_vdev_created)
 		ath12k_mac_monitor_stop(ar);
 
@@ -718,7 +718,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 	mutex_unlock(&ar->conf_mutex);
 }
 
-@@ -8290,6 +8440,14 @@ ath12k_mac_op_reconfig_complete(struct i
+@@ -8294,6 +8444,14 @@ ath12k_mac_op_reconfig_complete(struct i
 		ath12k_warn(ar->ab, "pdev %d successfully recovered\n",
 			    ar->pdev->pdev_id);
 
@@ -733,7 +733,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 		if (ab->is_reset) {
 			recovery_count = atomic_inc_return(&ab->recovery_count);
 
-@@ -9339,6 +9497,9 @@ static void ath12k_mac_setup(struct ath1
+@@ -9344,6 +9502,9 @@ static void ath12k_mac_setup(struct ath1
 
 	INIT_WORK(&ar->wmi_mgmt_tx_work, ath12k_mgmt_over_wmi_tx_work);
 	skb_queue_head_init(&ar->wmi_mgmt_tx_queue);
@@ -888,7 +888,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 #endif
 --- a/drivers/net/wireless/ath/ath12k/hw.c
 +++ b/drivers/net/wireless/ath/ath12k/hw.c
-@@ -928,6 +928,7 @@ static const struct ath12k_hw_params ath
+@@ -961,6 +961,7 @@ static const struct ath12k_hw_params ath
 		.iova_mask = 0,
 
 		.supports_aspm = false,
@@ -896,7 +896,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 	},
 	{
 		.name = "wcn7850 hw2.0",
-@@ -1008,6 +1009,7 @@ static const struct ath12k_hw_params ath
+@@ -1041,6 +1042,7 @@ static const struct ath12k_hw_params ath
 		.iova_mask = ATH12K_PCIE_MAX_PAYLOAD_SIZE - 1,
 
 		.supports_aspm = true,
@@ -904,7 +904,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
 	},
 	{
 		.name = "qcn9274 hw2.0",
-@@ -1084,6 +1086,7 @@ static const struct ath12k_hw_params ath
+@@ -1117,6 +1119,7 @@ static const struct ath12k_hw_params ath
 		.iova_mask = 0,
 
 		.supports_aspm = false,
--- a/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -882,6 +882,7 @@ static const struct ieee80211_iface_limi
+@@ -884,6 +884,7 @@ static const struct ieee80211_iface_limi
 				 BIT(NL80211_IFTYPE_AP) },
 	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
 				 BIT(NL80211_IFTYPE_P2P_GO) },
--- a/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
+++ b/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
@@ -14,7 +14,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>

 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -963,6 +963,7 @@ static void ath9k_set_hw_capab(struct at
+@@ -965,6 +965,7 @@ static void ath9k_set_hw_capab(struct at
 	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
 	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
 	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
@@ -22,7 +22,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 	if (ath9k_ps_enable)
 		ieee80211_hw_set(hw, SUPPORTS_PS);
-@@ -975,9 +976,6 @@ static void ath9k_set_hw_capab(struct at
+@@ -977,9 +978,6 @@ static void ath9k_set_hw_capab(struct at
 				IEEE80211_RADIOTAP_MCS_HAVE_STBC;
 	}
 
--- a/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
+++ b/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1178,25 +1178,25 @@ static int __init ath9k_init(void)
+@@ -1180,25 +1180,25 @@ static int __init ath9k_init(void)
 {
 	int error;
 
--- a/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
@@ -181,7 +181,7 @@
 	hw->max_listen_interval = 1;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -733,6 +733,7 @@ static int ath9k_init_softc(u16 devid, s
+@@ -735,6 +735,7 @@ static int ath9k_init_softc(u16 devid, s
 	if (!ath9k_is_chanctx_enabled())
 		sc->cur_chan->hw_queue_base = 0;
 
--- a/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
@@ -181,7 +181,7 @@
 
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1089,7 +1089,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -1091,7 +1091,7 @@ int ath9k_init_device(u16 devid, struct
 
 #ifdef CPTCFG_MAC80211_LEDS
 	/* must be initialized before ieee80211_register_hw */
--- a/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
@@ -55,7 +55,7 @@
 	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -871,7 +871,8 @@ static void ath9k_init_txpower_limits(st
+@@ -873,7 +873,8 @@ static void ath9k_init_txpower_limits(st
 	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
 		ath9k_init_band_txpower(sc, NL80211_BAND_5GHZ);
 
@@ -65,7 +65,7 @@
 }
 
 static const struct ieee80211_iface_limit if_limits[] = {
-@@ -1049,6 +1050,18 @@ static void ath9k_set_hw_capab(struct at
+@@ -1051,6 +1052,18 @@ static void ath9k_set_hw_capab(struct at
 	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
 }
 
@@ -84,7 +84,7 @@
 int ath9k_init_device(u16 devid, struct ath_softc *sc,
 		    const struct ath_bus_ops *bus_ops)
 {
-@@ -1096,6 +1109,8 @@ int ath9k_init_device(u16 devid, struct
+@@ -1098,6 +1111,8 @@ int ath9k_init_device(u16 devid, struct
 
 	wiphy_read_of_freq_limits(hw->wiphy);
 
--- a/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
+++ b/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -696,6 +696,12 @@ static int ath9k_of_init(struct ath_soft
+@@ -698,6 +698,12 @@ static int ath9k_of_init(struct ath_soft
 	return 0;
 }
 
@@ -13,7 +13,7 @@
 static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
 			    const struct ath_bus_ops *bus_ops)
 {
-@@ -804,6 +810,9 @@ static int ath9k_init_softc(u16 devid, s
+@@ -806,6 +812,9 @@ static int ath9k_init_softc(u16 devid, s
 	if (ret)
 		goto err_hw;
 
--- a/package/kernel/mac80211/patches/brcm/870-04-rpi-6.12-brcmfmac-non-upstream-support-DS1-exit-firmware-re-download.patch
+++ b/package/kernel/mac80211/patches/brcm/870-04-rpi-6.12-brcmfmac-non-upstream-support-DS1-exit-firmware-re-download.patch
@@ -112,7 +112,7 @@ JIRA: SWWLAN-136577
 				    BRCMF_DEFAULT_SCAN_CHANNEL_TIME);
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
-@@ -1317,7 +1317,7 @@ int brcmf_alloc(struct device *dev, stru
+@@ -1322,7 +1322,7 @@ int brcmf_alloc(struct device *dev, stru
 	return 0;
 }
 
@@ -121,7 +121,7 @@ JIRA: SWWLAN-136577
 {
 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
 	struct brcmf_pub *drvr = bus_if->drvr;
-@@ -1358,10 +1358,13 @@ int brcmf_attach(struct device *dev)
+@@ -1363,10 +1363,13 @@ int brcmf_attach(struct device *dev)
 	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
 			    brcmf_psm_watchdog_notify);
 
@@ -692,7 +692,7 @@ JIRA: SWWLAN-136577
 #endif /* BRCMFMAC_SDIO_H */
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1200,7 +1200,7 @@ static void brcmf_usb_probe_phase2(struc
+@@ -1202,7 +1202,7 @@ static void brcmf_usb_probe_phase2(struc
 		goto error;
 
 	/* Attach to the common driver interface */
@@ -701,7 +701,7 @@ JIRA: SWWLAN-136577
 	if (ret)
 		goto error;
 
-@@ -1277,7 +1277,7 @@ static int brcmf_usb_probe_cb(struct brc
+@@ -1279,7 +1279,7 @@ static int brcmf_usb_probe_cb(struct brc
 		ret = brcmf_alloc(devinfo->dev, devinfo->settings);
 		if (ret)
 			goto fail;
--- a/package/kernel/mac80211/patches/build/150-ath_iommu_paging_domain_revert.patch
+++ b/package/kernel/mac80211/patches/build/150-ath_iommu_paging_domain_revert.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/snoc.c
 +++ b/drivers/net/wireless/ath/ath10k/snoc.c
-@@ -1635,10 +1635,10 @@ static int ath10k_fw_init(struct ath10k
+@@ -1637,10 +1637,10 @@ static int ath10k_fw_init(struct ath10k
 
 	ar_snoc->fw.dev = &pdev->dev;
 
--- a/package/kernel/mac80211/patches/build/210-wireless_netns_local_backport.patch
+++ b/package/kernel/mac80211/patches/build/210-wireless_netns_local_backport.patch
@@ -32,7 +32,7 @@
 		}
 
 		return err;
-@@ -1518,7 +1526,9 @@ static int cfg80211_netdev_notifier_call
+@@ -1525,7 +1533,9 @@ static int cfg80211_netdev_notifier_call
 		SET_NETDEV_DEVTYPE(dev, &wiphy_type);
 		wdev->netdev = dev;
 		/* can only change netns with wiphy */
--- a/package/kernel/mac80211/patches/build/220-brcmfmac_usb_driver_backport.patch
+++ b/package/kernel/mac80211/patches/build/220-brcmfmac_usb_driver_backport.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1574,7 +1574,11 @@ static int brcmf_usb_reset_device(struct
+@@ -1576,7 +1576,11 @@ static int brcmf_usb_reset_device(struct
 
 void brcmf_usb_exit(void)
 {
--- a/package/kernel/mac80211/patches/build/230-fix-init_vqs-build-error-on-kernel-6.6.patch
+++ b/package/kernel/mac80211/patches/build/230-fix-init_vqs-build-error-on-kernel-6.6.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/virtual/mac80211_hwsim.c
 +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
-@@ -6629,6 +6629,7 @@ static void hwsim_virtio_rx_done(struct
+@@ -6636,6 +6636,7 @@ static void hwsim_virtio_rx_done(struct
 
 static int init_vqs(struct virtio_device *vdev)
 {
@@ -8,7 +8,7 @@
 	struct virtqueue_info vqs_info[HWSIM_NUM_VQS] = {
 		[HWSIM_VQ_TX] = { "tx", hwsim_virtio_tx_done },
 		[HWSIM_VQ_RX] = { "rx", hwsim_virtio_rx_done },
-@@ -6636,6 +6637,19 @@ static int init_vqs(struct virtio_device
+@@ -6643,6 +6644,19 @@ static int init_vqs(struct virtio_device
 
 	return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
 			       hwsim_vqs, vqs_info, NULL);
--- a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -5712,6 +5712,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+@@ -5716,6 +5716,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
 MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
 
 static const struct pci_device_id mwl8k_pci_id_table[] = {
--- a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -6298,6 +6298,8 @@ static int mwl8k_probe(struct pci_dev *p
+@@ -6302,6 +6302,8 @@ static int mwl8k_probe(struct pci_dev *p
 
 	priv->running_bsses = 0;
 
@@ -9,7 +9,7 @@
 	return rc;
 
 err_stop_firmware:
-@@ -6331,8 +6333,6 @@ static void mwl8k_remove(struct pci_dev
+@@ -6335,8 +6337,6 @@ static void mwl8k_remove(struct pci_dev
 		return;
 	priv = hw->priv;
 
--- a/package/kernel/mac80211/patches/rt2x00/997-rt2x00-use-remove_new.patch
+++ b/package/kernel/mac80211/patches/rt2x00/997-rt2x00-use-remove_new.patch
@@ -0,0 +1,26 @@
+Switch rt2800soc from .remove to .remove_new callback
+
+The rt2x00soc_remove() function was converted to the new .remove API.
+Kernel 6.6 still uses the old .remove API, switch to .remove_new.
+
+rt2800soc was switched in upstream commit:
+https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-6.12.y&id=06c566371f8afd582b9080f2d076509a4c78ae60
+
+This fixes the following build problem:
+```
+/drivers/net/wireless/ralink/rt2x00/rt2800soc.c:276:27: error: initialization of 'int (*)(struct platform_device *)' from incompatible pointer type 'void (*)(struct platform_device *)' [-Werror=incompatible-pointer-types]
+  276 |         .remove         = rt2x00soc_remove,
+      |                           ^~~~~~~~~~~~~~~~
+```
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+@@ -273,7 +273,7 @@ static struct platform_driver rt2800soc_
+ 		.of_match_table	= rt2880_wmac_match,
+ 	},
+ 	.probe		= rt2800soc_probe,
+-	.remove		= rt2x00soc_remove,
+	.remove_new	= rt2x00soc_remove,
+ 	.suspend	= rt2x00soc_suspend,
+ 	.resume		= rt2x00soc_resume,
+ };
--- a/package/kernel/mac80211/patches/rtl/017-v6.13-wifi-rtw88-Constify-some-arrays-and-structs.patch
+++ b/package/kernel/mac80211/patches/rtl/017-v6.13-wifi-rtw88-Constify-some-arrays-and-structs.patch
@@ -284,7 +284,7 @@ Link: https://patch.msgid.link/dae7994f-3491-40de-b537-ebf68df084bb@gmail.com
 	.query_rx_desc		= rtw8821c_query_rx_desc,
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
-@@ -1978,13 +1978,13 @@ static const struct rtw_pwr_seq_cmd tran
+@@ -1980,13 +1980,13 @@ static const struct rtw_pwr_seq_cmd tran
 	 RTW_PWR_CMD_END, 0, 0},
 };
 
@@ -300,7 +300,7 @@ Link: https://patch.msgid.link/dae7994f-3491-40de-b537-ebf68df084bb@gmail.com
 	trans_act_to_cardemu_8822b,
 	trans_cardemu_to_carddis_8822b,
 	NULL
-@@ -2156,7 +2156,7 @@ static const struct rtw_rqpn rqpn_table_
+@@ -2158,7 +2158,7 @@ static const struct rtw_rqpn rqpn_table_
 	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
 };
 
@@ -309,7 +309,7 @@ Link: https://patch.msgid.link/dae7994f-3491-40de-b537-ebf68df084bb@gmail.com
 	.prio[RTW_DMA_MAPPING_EXTRA] = {
 		.rsvd = REG_FIFOPAGE_INFO_4, .avail = REG_FIFOPAGE_INFO_4 + 2,
 	},
-@@ -2172,7 +2172,7 @@ static struct rtw_prioq_addrs prioq_addr
+@@ -2174,7 +2174,7 @@ static struct rtw_prioq_addrs prioq_addr
 	.wsize = true,
 };
 
@@ -318,7 +318,7 @@ Link: https://patch.msgid.link/dae7994f-3491-40de-b537-ebf68df084bb@gmail.com
 	.phy_set_param		= rtw8822b_phy_set_param,
 	.read_efuse		= rtw8822b_read_efuse,
 	.query_rx_desc		= rtw8822b_query_rx_desc,
-@@ -2521,7 +2521,7 @@ static const struct rtw_reg_domain coex_
+@@ -2523,7 +2523,7 @@ static const struct rtw_reg_domain coex_
 	{0xc50,  MASKBYTE0, RTW_REG_DOMAIN_MAC8},
 };
 
@@ -329,7 +329,7 @@ Link: https://patch.msgid.link/dae7994f-3491-40de-b537-ebf68df084bb@gmail.com
 };
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
-@@ -4874,13 +4874,13 @@ static const struct rtw_pwr_seq_cmd tran
+@@ -4875,13 +4875,13 @@ static const struct rtw_pwr_seq_cmd tran
 	 RTW_PWR_CMD_END, 0, 0},
 };
 
@@ -345,7 +345,7 @@ Link: https://patch.msgid.link/dae7994f-3491-40de-b537-ebf68df084bb@gmail.com
 	trans_act_to_cardemu_8822c,
 	trans_cardemu_to_carddis_8822c,
 	NULL
-@@ -4972,7 +4972,7 @@ static const struct rtw_rqpn rqpn_table_
+@@ -4973,7 +4973,7 @@ static const struct rtw_rqpn rqpn_table_
 	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
 };
 
@@ -354,7 +354,7 @@ Link: https://patch.msgid.link/dae7994f-3491-40de-b537-ebf68df084bb@gmail.com
 	.prio[RTW_DMA_MAPPING_EXTRA] = {
 		.rsvd = REG_FIFOPAGE_INFO_4, .avail = REG_FIFOPAGE_INFO_4 + 2,
 	},
-@@ -4988,7 +4988,7 @@ static struct rtw_prioq_addrs prioq_addr
+@@ -4989,7 +4989,7 @@ static struct rtw_prioq_addrs prioq_addr
 	.wsize = true,
 };
 
@@ -363,7 +363,7 @@ Link: https://patch.msgid.link/dae7994f-3491-40de-b537-ebf68df084bb@gmail.com
 	.phy_set_param		= rtw8822c_phy_set_param,
 	.read_efuse		= rtw8822c_read_efuse,
 	.query_rx_desc		= rtw8822c_query_rx_desc,
-@@ -5301,7 +5301,7 @@ static const struct rtw_pwr_track_tbl rt
+@@ -5302,7 +5302,7 @@ static const struct rtw_pwr_track_tbl rt
 	.pwrtrk_2g_ccka_p = rtw8822c_pwrtrk_2g_cck_a_p,
 };
 
--- a/package/kernel/mac80211/patches/rtl/019-v6.13-wifi-rtw88-Parse-the-RX-descriptor-with-a-single-fun.patch
+++ b/package/kernel/mac80211/patches/rtl/019-v6.13-wifi-rtw88-Parse-the-RX-descriptor-with-a-single-fun.patch
@@ -48,7 +48,7 @@ Link: https://patch.msgid.link/913f1747-38fc-4409-85a4-57bb9cee506b@gmail.com
 	bool (*write_rf)(struct rtw_dev *rtwdev, enum rtw_rf_path rf_path,
 --- a/drivers/net/wireless/realtek/rtw88/pci.c
 +++ b/drivers/net/wireless/realtek/rtw88/pci.c
-@@ -1065,7 +1065,7 @@ static u32 rtw_pci_rx_napi(struct rtw_de
+@@ -1066,7 +1066,7 @@ static u32 rtw_pci_rx_napi(struct rtw_de
 		dma_sync_single_for_cpu(rtwdev->dev, dma, RTK_PCI_RX_BUF_SIZE,
 					DMA_FROM_DEVICE);
 		rx_desc = skb->data;
@@ -302,9 +302,9 @@ Link: https://patch.msgid.link/913f1747-38fc-4409-85a4-57bb9cee506b@gmail.com
 -}
 -
 static void
- rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs)
- {
-@@ -2175,7 +2134,7 @@ static const struct rtw_prioq_addrs prio
+ rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path,
+ 				    u8 rs, u32 *phy_pwr_idx)
+@@ -2177,7 +2136,7 @@ static const struct rtw_prioq_addrs prio
 static const struct rtw_chip_ops rtw8822b_ops = {
 	.phy_set_param		= rtw8822b_phy_set_param,
 	.read_efuse		= rtw8822b_read_efuse,
@@ -364,7 +364,7 @@ Link: https://patch.msgid.link/913f1747-38fc-4409-85a4-57bb9cee506b@gmail.com
 static void
 rtw8822c_set_write_tx_power_ref(struct rtw_dev *rtwdev, u8 *tx_pwr_ref_cck,
 				u8 *tx_pwr_ref_ofdm)
-@@ -4991,7 +4949,7 @@ static const struct rtw_prioq_addrs prio
+@@ -4992,7 +4950,7 @@ static const struct rtw_prioq_addrs prio
 static const struct rtw_chip_ops rtw8822c_ops = {
 	.phy_set_param		= rtw8822c_phy_set_param,
 	.read_efuse		= rtw8822c_read_efuse,
@@ -535,7 +535,7 @@ Link: https://patch.msgid.link/913f1747-38fc-4409-85a4-57bb9cee506b@gmail.com
 				struct rtw_rx_pkt_stat *pkt_stat);
 --- a/drivers/net/wireless/realtek/rtw88/sdio.c
 +++ b/drivers/net/wireless/realtek/rtw88/sdio.c
-@@ -981,8 +981,7 @@ static void rtw_sdio_rxfifo_recv(struct
+@@ -979,8 +979,7 @@ static void rtw_sdio_rxfifo_recv(struct
 
 	while (true) {
 		rx_desc = skb->data;
@@ -547,7 +547,7 @@ Link: https://patch.msgid.link/913f1747-38fc-4409-85a4-57bb9cee506b@gmail.com
 
 --- a/drivers/net/wireless/realtek/rtw88/usb.c
 +++ b/drivers/net/wireless/realtek/rtw88/usb.c
-@@ -571,8 +571,8 @@ static void rtw_usb_rx_handler(struct wo
+@@ -625,8 +625,8 @@ static void rtw_usb_rx_handler(struct wo
 
 		do {
 			rx_desc = skb->data;
--- a/package/kernel/mac80211/patches/rtl/024-v6.13-wifi-rtw88-Add-some-definitions-for-RTL8821AU-RTL881.patch
+++ b/package/kernel/mac80211/patches/rtl/024-v6.13-wifi-rtw88-Add-some-definitions-for-RTL8821AU-RTL881.patch
@@ -82,7 +82,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_AFE_CTRL_4		0x0078
 #define BIT_CK320M_AFE_EN	BIT(4)
 #define BIT_EN_SYN		BIT(15)
-@@ -134,6 +143,11 @@
+@@ -135,6 +144,11 @@
 #define REG_PMC_DBG_CTRL1	0xa8
 #define BITS_PMC_BT_IQK_STS	GENMASK(22, 21)
 
@@ -94,7 +94,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_PAD_CTRL2		0x00C4
 #define BIT_RSM_EN_V1		BIT(16)
 #define BIT_NO_PDN_CHIPOFF_V1	BIT(17)
-@@ -185,6 +199,15 @@
+@@ -186,6 +200,15 @@
 #define MAC_TRX_ENABLE	(BIT_HCI_TXDMA_EN | BIT_HCI_RXDMA_EN | BIT_TXDMA_EN | \
 			BIT_RXDMA_EN | BIT_PROTOCOL_EN | BIT_SCHEDULE_EN | \
 			BIT_MACTXEN | BIT_MACRXEN)
@@ -110,7 +110,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define BIT_SHIFT_TXDMA_VOQ_MAP	4
 #define BIT_MASK_TXDMA_VOQ_MAP	0x3
 #define BIT_TXDMA_VOQ_MAP(x)                                                   \
-@@ -256,6 +279,8 @@
+@@ -257,6 +280,8 @@
 #define REG_HMEBOX1		0x01D4
 #define REG_HMEBOX2		0x01D8
 #define REG_HMEBOX3		0x01DC
@@ -119,7 +119,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_HMEBOX0_EX		0x01F0
 #define REG_HMEBOX1_EX		0x01F4
 #define REG_HMEBOX2_EX		0x01F8
-@@ -298,6 +323,7 @@
+@@ -299,6 +324,7 @@
 
 #define REG_AUTO_LLT		0x0224
 #define BIT_AUTO_INIT_LLT	BIT(16)
@@ -127,7 +127,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_RQPN_CTRL_1		0x0228
 #define REG_RQPN_CTRL_2		0x022C
 #define BIT_LD_RQPN		BIT(31)
-@@ -329,6 +355,7 @@
+@@ -330,6 +356,7 @@
 #define BIT_DMA_BURST_SIZE_1024	0
 
 #define REG_RXPKTNUM		0x02B0
@@ -135,7 +135,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 
 #define REG_INT_MIG		0x0304
 #define REG_HCI_MIX_CFG		0x03FC
-@@ -336,6 +363,7 @@
+@@ -337,6 +364,7 @@
 
 #define REG_BCNQ_INFO		0x0418
 #define BIT_MGQ_CPU_EMPTY	BIT(24)
@@ -143,7 +143,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_FWHW_TXQ_CTRL	0x0420
 #define BIT_EN_BCNQ_DL		BIT(22)
 #define BIT_EN_WR_FREE_TAIL	BIT(20)
-@@ -362,10 +390,12 @@
+@@ -363,10 +391,12 @@
 #define REG_AMPDU_MAX_TIME_V1	0x0455
 #define REG_BCNQ1_BDNY_V1	0x0456
 #define REG_AMPDU_MAX_TIME	0x0456
@@ -156,7 +156,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_DATA_SC		0x0483
 #define REG_ARFR2_V1		0x048C
 #define REG_ARFRH2_V1		0x0490
-@@ -390,6 +420,8 @@
+@@ -391,6 +421,8 @@
 #define REG_PRECNT_CTRL		0x04E5
 #define BIT_BTCCA_CTRL		(BIT(0) | BIT(1))
 #define BIT_EN_PRECNT		BIT(11)
@@ -165,7 +165,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_DUMMY_PAGE4_V1	0x04FC
 
 #define REG_EDCA_VO_PARAM	0x0500
-@@ -400,6 +432,7 @@
+@@ -401,6 +433,7 @@
 #define BIT_MASK_CWMAX		GENMASK(15, 12)
 #define BIT_MASK_CWMIN		GENMASK(11, 8)
 #define BIT_MASK_AIFS		GENMASK(7, 0)
@@ -173,7 +173,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_PIFS		0x0512
 #define REG_SIFS		0x0514
 #define BIT_SHIFT_SIFS_OFDM_CTX	8
-@@ -526,6 +559,8 @@
+@@ -527,6 +560,8 @@
 #define REG_BT_COEX_V2		0x0762
 #define BIT_GNT_BT_POLARITY	BIT(12)
 #define BIT_LTE_COEX_EN		BIT(7)
@@ -182,7 +182,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_BT_COEX_ENH_INTR_CTRL	0x76E
 #define BIT_R_GRANTALL_WLMASK	BIT(3)
 #define BIT_STATIS_BT_EN	BIT(2)
-@@ -543,14 +578,43 @@
+@@ -544,14 +579,43 @@
 #define REG_FPGA0_RFMOD		0x0800
 #define BIT_CCKEN		BIT(24)
 #define BIT_OFDMEN		BIT(25)
@@ -226,7 +226,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 
 #define REG_DIS_DPD		0x0a70
 #define DIS_DPD_MASK		GENMASK(9, 0)
-@@ -566,13 +630,109 @@
+@@ -567,13 +631,109 @@
 #define DIS_DPD_RATEVHT2SS_MCS1	BIT(9)
 #define DIS_DPD_RATEALL		GENMASK(9, 0)
 
@@ -336,7 +336,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_ANAPARSW_MAC_0	0x1010
 #define BIT_CF_L_V2		GENMASK(29, 28)
 
-@@ -709,6 +869,10 @@
+@@ -710,6 +870,10 @@
 
 #define REG_IGN_GNTBT4	0x4160
 
@@ -347,7 +347,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define RF_MODE		0x00
 #define RF_MODOPT	0x01
 #define RF_WLINT	0x01
-@@ -716,7 +880,13 @@
+@@ -717,7 +881,13 @@
 #define RF_DTXLOK	0x08
 #define RF_CFGCH	0x18
 #define BIT_BAND	GENMASK(18, 16)
@@ -361,7 +361,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define RF_LUTWA	0x33
 #define RF_LUTWD1	0x3e
 #define RF_LUTWD0	0x3f
-@@ -725,10 +895,14 @@
+@@ -726,10 +896,14 @@
 #define RF_T_METER	0x42
 #define RF_BSPAD	0x54
 #define RF_GAINTX	0x56
@@ -378,7 +378,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define RF_MALSEL	0xbe
 --- a/drivers/net/wireless/realtek/rtw88/rtw8821c.h
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.h
-@@ -214,19 +214,10 @@ extern const struct rtw_chip_info rtw882
+@@ -215,19 +215,10 @@ extern const struct rtw_chip_info rtw882
 #define BIT_FEN_EN	BIT(26)
 #define REG_INIRTS_RATE_SEL 0x0480
 #define REG_HTSTFWT	0x800
@@ -398,7 +398,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_ADC40	0x8c8
 #define REG_CHFIR	0x8f0
 #define REG_CDDTXP	0x93c
-@@ -234,14 +225,11 @@ extern const struct rtw_chip_info rtw882
+@@ -235,14 +226,11 @@ extern const struct rtw_chip_info rtw882
 #define REG_ACBB0	0x948
 #define REG_ACBBRXFIR	0x94c
 #define REG_ACGG2TBL	0x958
@@ -413,7 +413,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_RXDESC	0xa2c
 #define REG_ENTXCCK	0xa80
 #define BTG_LNA		0xfc84
-@@ -252,12 +240,8 @@ extern const struct rtw_chip_info rtw882
+@@ -253,12 +241,8 @@ extern const struct rtw_chip_info rtw882
 #define REG_PWRTH2	0xaa8
 #define REG_CSRATIO	0xaaa
 #define REG_TXFILTER	0xaac
@@ -426,7 +426,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_TRSW	0xca0
 #define REG_RFESEL0	0xcb0
 #define REG_RFESEL8	0xcb4
-@@ -269,14 +253,6 @@ extern const struct rtw_chip_info rtw882
+@@ -270,14 +254,6 @@ extern const struct rtw_chip_info rtw882
 #define B_WLA_SWITCH	BIT(23)
 #define REG_RFEINV	0xcbc
 #define REG_AGCTR_B	0xe08
@@ -443,7 +443,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_ANTWT	0x1904
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822b.h
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.h
-@@ -151,21 +151,12 @@ _rtw_write32s_mask(struct rtw_dev *rtwde
+@@ -152,21 +152,12 @@ _rtw_write32s_mask(struct rtw_dev *rtwde
 #define RTW8822B_EDCCA_MAX	0x7f
 #define RTW8822B_EDCCA_SRC_DEF	1
 #define REG_HTSTFWT	0x800
@@ -465,7 +465,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_ADC40	0x8c8
 #define REG_EDCCA_DECISION	0x8dc
 #define BIT_EDCCA_OPTION	BIT(5)
-@@ -176,7 +167,6 @@ _rtw_write32s_mask(struct rtw_dev *rtwde
+@@ -177,7 +168,6 @@ _rtw_write32s_mask(struct rtw_dev *rtwde
 #define REG_ACBB0	0x948
 #define REG_ACBBRXFIR	0x94c
 #define REG_ACGG2TBL	0x958
@@ -473,7 +473,7 @@ Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
 #define REG_ADCINI	0xa04
 #define REG_TXSF2	0xa24
 #define REG_TXSF6	0xa28
-@@ -184,14 +174,12 @@ _rtw_write32s_mask(struct rtw_dev *rtwde
+@@ -185,14 +175,12 @@ _rtw_write32s_mask(struct rtw_dev *rtwde
 #define REG_ENTXCCK	0xa80
 #define REG_AGCTR_A	0xc08
 #define REG_TXDFIR	0xc20
--- a/package/kernel/mac80211/patches/rtl/025-v6.13-wifi-rtw88-Dump-the-HW-features-only-for-some-chips.patch
+++ b/package/kernel/mac80211/patches/rtl/025-v6.13-wifi-rtw88-Dump-the-HW-features-only-for-some-chips.patch
@@ -21,7 +21,7 @@ Link: https://patch.msgid.link/8becd851-8760-4480-8e8c-c4869ce72507@gmail.com

 --- a/drivers/net/wireless/realtek/rtw88/main.c
 +++ b/drivers/net/wireless/realtek/rtw88/main.c
-@@ -1917,6 +1917,9 @@ static int rtw_dump_hw_feature(struct rt
+@@ -1907,6 +1907,9 @@ static int rtw_dump_hw_feature(struct rt
 	u8 bw;
 	int i;
 
@@ -73,7 +73,7 @@ Link: https://patch.msgid.link/8becd851-8760-4480-8e8c-c4869ce72507@gmail.com
 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
-@@ -2509,6 +2509,7 @@ const struct rtw_chip_info rtw8822b_hw_s
+@@ -2511,6 +2511,7 @@ const struct rtw_chip_info rtw8822b_hw_s
 	.page_size = TX_PAGE_SIZE,
 	.dig_min = 0x1c,
 	.usb_tx_agg_desc_num = 3,
@@ -83,7 +83,7 @@ Link: https://patch.msgid.link/8becd851-8760-4480-8e8c-c4869ce72507@gmail.com
 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
-@@ -5329,6 +5329,7 @@ const struct rtw_chip_info rtw8822c_hw_s
+@@ -5330,6 +5330,7 @@ const struct rtw_chip_info rtw8822c_hw_s
 	.page_size = TX_PAGE_SIZE,
 	.dig_min = 0x20,
 	.usb_tx_agg_desc_num = 3,
--- a/package/kernel/mac80211/patches/rtl/026-v6.13-wifi-rtw88-Allow-different-C2H-RA-report-sizes.patch
+++ b/package/kernel/mac80211/patches/rtl/026-v6.13-wifi-rtw88-Allow-different-C2H-RA-report-sizes.patch
@@ -155,7 +155,7 @@ Link: https://patch.msgid.link/c3e73c3a-fb2f-4013-9f06-d5274211e282@gmail.com
 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
-@@ -2510,6 +2510,7 @@ const struct rtw_chip_info rtw8822b_hw_s
+@@ -2512,6 +2512,7 @@ const struct rtw_chip_info rtw8822b_hw_s
 	.dig_min = 0x1c,
 	.usb_tx_agg_desc_num = 3,
 	.hw_feature_report = true,
@@ -165,7 +165,7 @@ Link: https://patch.msgid.link/c3e73c3a-fb2f-4013-9f06-d5274211e282@gmail.com
 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
-@@ -5330,6 +5330,7 @@ const struct rtw_chip_info rtw8822c_hw_s
+@@ -5331,6 +5331,7 @@ const struct rtw_chip_info rtw8822c_hw_s
 	.dig_min = 0x20,
 	.usb_tx_agg_desc_num = 3,
 	.hw_feature_report = true,
--- a/package/kernel/mac80211/patches/rtl/029-v6.13-wifi-rtw88-Let-each-driver-control-the-power-on-off-.patch
+++ b/package/kernel/mac80211/patches/rtl/029-v6.13-wifi-rtw88-Let-each-driver-control-the-power-on-off-.patch
@@ -67,7 +67,7 @@ Link: https://patch.msgid.link/98ab839f-9100-44ae-9551-9af743a4aa3a@gmail.com
 
 static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on)
 {
-@@ -994,6 +995,7 @@ int rtw_download_firmware(struct rtw_dev
+@@ -999,6 +1000,7 @@ int rtw_download_firmware(struct rtw_dev
 
 	return 0;
 }
@@ -75,7 +75,7 @@ Link: https://patch.msgid.link/98ab839f-9100-44ae-9551-9af743a4aa3a@gmail.com
 
 static u32 get_priority_queues(struct rtw_dev *rtwdev, u32 queues)
 {
-@@ -1127,7 +1129,7 @@ static int txdma_queue_mapping(struct rt
+@@ -1132,7 +1134,7 @@ static int txdma_queue_mapping(struct rt
 	return 0;
 }
 
@@ -84,7 +84,7 @@ Link: https://patch.msgid.link/98ab839f-9100-44ae-9551-9af743a4aa3a@gmail.com
 {
 	const struct rtw_chip_info *chip = rtwdev->chip;
 	struct rtw_fifo_conf *fifo = &rtwdev->fifo;
-@@ -1179,6 +1181,7 @@ static int set_trx_fifo_info(struct rtw_
+@@ -1184,6 +1186,7 @@ static int set_trx_fifo_info(struct rtw_
 
 	return 0;
 }
@@ -92,7 +92,7 @@ Link: https://patch.msgid.link/98ab839f-9100-44ae-9551-9af743a4aa3a@gmail.com
 
 static int __priority_queue_cfg(struct rtw_dev *rtwdev,
 				const struct rtw_page_table *pg_tbl,
-@@ -1256,7 +1259,7 @@ static int priority_queue_cfg(struct rtw
+@@ -1261,7 +1264,7 @@ static int priority_queue_cfg(struct rtw
 	u16 pubq_num;
 	int ret;
 
@@ -103,7 +103,7 @@ Link: https://patch.msgid.link/98ab839f-9100-44ae-9551-9af743a4aa3a@gmail.com
 
 --- a/drivers/net/wireless/realtek/rtw88/mac.h
 +++ b/drivers/net/wireless/realtek/rtw88/mac.h
-@@ -30,11 +30,14 @@
+@@ -30,6 +30,8 @@
 
 void rtw_set_channel_mac(struct rtw_dev *rtwdev, u8 channel, u8 bw,
 			 u8 primary_ch_idx);
@@ -111,6 +111,8 @@ Link: https://patch.msgid.link/98ab839f-9100-44ae-9551-9af743a4aa3a@gmail.com
 +		       const struct rtw_pwr_seq_cmd * const *cmd_seq);
 int rtw_mac_power_on(struct rtw_dev *rtwdev);
 void rtw_mac_power_off(struct rtw_dev *rtwdev);
+ void rtw_write_firmware_page(struct rtw_dev *rtwdev, u32 page,
+@@ -37,6 +39,7 @@ void rtw_write_firmware_page(struct rtw_
 int rtw_download_firmware(struct rtw_dev *rtwdev, struct rtw_fw_state *fw);
 int rtw_mac_init(struct rtw_dev *rtwdev);
 void rtw_mac_flush_queues(struct rtw_dev *rtwdev, u32 queues, bool drop);
@@ -250,7 +252,7 @@ Link: https://patch.msgid.link/98ab839f-9100-44ae-9551-9af743a4aa3a@gmail.com
 	.query_phy_status	= query_phy_status,
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
-@@ -2132,6 +2132,8 @@ static const struct rtw_prioq_addrs prio
+@@ -2134,6 +2134,8 @@ static const struct rtw_prioq_addrs prio
 };
 
 static const struct rtw_chip_ops rtw8822b_ops = {
@@ -261,7 +263,7 @@ Link: https://patch.msgid.link/98ab839f-9100-44ae-9551-9af743a4aa3a@gmail.com
 	.query_phy_status	= query_phy_status,
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
-@@ -4947,6 +4947,8 @@ static const struct rtw_prioq_addrs prio
+@@ -4948,6 +4948,8 @@ static const struct rtw_prioq_addrs prio
 };
 
 static const struct rtw_chip_ops rtw8822c_ops = {
--- a/package/kernel/mac80211/patches/rtl/030-v6.13-wifi-rtw88-Enable-data-rate-fallback-for-older-chips.patch
+++ b/package/kernel/mac80211/patches/rtl/030-v6.13-wifi-rtw88-Enable-data-rate-fallback-for-older-chips.patch
@@ -60,7 +60,7 @@ Link: https://patch.msgid.link/2b3e3e6f-541b-4a3b-8ca3-65b267e6a95a@gmail.com
 
 --- a/drivers/net/wireless/realtek/rtw88/pci.c
 +++ b/drivers/net/wireless/realtek/rtw88/pci.c
-@@ -824,7 +824,7 @@ static int rtw_pci_tx_write_data(struct
+@@ -825,7 +825,7 @@ static int rtw_pci_tx_write_data(struct
 	pkt_desc = skb_push(skb, chip->tx_pkt_desc_sz);
 	memset(pkt_desc, 0, tx_pkt_desc_sz);
 	pkt_info->qsel = rtw_pci_get_tx_qsel(skb, queue);
@@ -101,7 +101,7 @@ Link: https://patch.msgid.link/2b3e3e6f-541b-4a3b-8ca3-65b267e6a95a@gmail.com
 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
-@@ -2513,6 +2513,7 @@ const struct rtw_chip_info rtw8822b_hw_s
+@@ -2515,6 +2515,7 @@ const struct rtw_chip_info rtw8822b_hw_s
 	.usb_tx_agg_desc_num = 3,
 	.hw_feature_report = true,
 	.c2h_ra_report_size = 7,
@@ -111,7 +111,7 @@ Link: https://patch.msgid.link/2b3e3e6f-541b-4a3b-8ca3-65b267e6a95a@gmail.com
 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
-@@ -5333,6 +5333,7 @@ const struct rtw_chip_info rtw8822c_hw_s
+@@ -5334,6 +5334,7 @@ const struct rtw_chip_info rtw8822c_hw_s
 	.usb_tx_agg_desc_num = 3,
 	.hw_feature_report = true,
 	.c2h_ra_report_size = 7,
@@ -121,7 +121,7 @@ Link: https://patch.msgid.link/2b3e3e6f-541b-4a3b-8ca3-65b267e6a95a@gmail.com
 	.ht_supported = true,
 --- a/drivers/net/wireless/realtek/rtw88/sdio.c
 +++ b/drivers/net/wireless/realtek/rtw88/sdio.c
-@@ -864,7 +864,7 @@ static void rtw_sdio_tx_skb_prepare(stru
+@@ -862,7 +862,7 @@ static void rtw_sdio_tx_skb_prepare(stru
 
 	pkt_info->qsel = rtw_sdio_get_tx_qsel(rtwdev, skb, queue);
 
@@ -174,7 +174,7 @@ Link: https://patch.msgid.link/2b3e3e6f-541b-4a3b-8ca3-65b267e6a95a@gmail.com
 void rtw_tx_rsvd_page_pkt_info_update(struct rtw_dev *rtwdev,
 --- a/drivers/net/wireless/realtek/rtw88/usb.c
 +++ b/drivers/net/wireless/realtek/rtw88/usb.c
-@@ -458,7 +458,7 @@ static int rtw_usb_write_data(struct rtw
+@@ -512,7 +512,7 @@ static int rtw_usb_write_data(struct rtw
 	skb_put_data(skb, buf, size);
 	skb_push(skb, chip->tx_pkt_desc_sz);
 	memset(skb->data, 0, chip->tx_pkt_desc_sz);
@@ -183,7 +183,7 @@ Link: https://patch.msgid.link/2b3e3e6f-541b-4a3b-8ca3-65b267e6a95a@gmail.com
 	rtw_tx_fill_txdesc_checksum(rtwdev, pkt_info, skb->data);
 
 	ret = rtw_usb_write_port(rtwdev, qsel, skb,
-@@ -525,7 +525,7 @@ static int rtw_usb_tx_write(struct rtw_d
+@@ -579,7 +579,7 @@ static int rtw_usb_tx_write(struct rtw_d
 	pkt_desc = skb_push(skb, chip->tx_pkt_desc_sz);
 	memset(pkt_desc, 0, chip->tx_pkt_desc_sz);
 	ep = qsel_to_ep(rtwusb, pkt_info->qsel);
--- a/package/kernel/mac80211/patches/rtl/032-v6.13-wifi-rtw88-Support-TX-page-sizes-bigger-than-128.patch
+++ b/package/kernel/mac80211/patches/rtl/032-v6.13-wifi-rtw88-Support-TX-page-sizes-bigger-than-128.patch
@@ -93,7 +93,7 @@ Link: https://patch.msgid.link/acdefbb1-3daf-4349-9e03-9472754d5f1e@gmail.com
 	if (rtw_fw_feature_ext_check(&rtwdev->fw, FW_FEATURE_EXT_OLD_PAGE_NUM))
 --- a/drivers/net/wireless/realtek/rtw88/mac.c
 +++ b/drivers/net/wireless/realtek/rtw88/mac.c
-@@ -1138,7 +1138,7 @@ int rtw_set_trx_fifo_info(struct rtw_dev
+@@ -1143,7 +1143,7 @@ int rtw_set_trx_fifo_info(struct rtw_dev
 
 	/* config rsvd page num */
 	fifo->rsvd_drv_pg_num = chip->rsvd_drv_pg_num;
--- a/package/kernel/mac80211/patches/rtl/033-v6.13-wifi-rtw88-Move-pwr_track_tbl-to-struct-rtw_rfe_def.patch
+++ b/package/kernel/mac80211/patches/rtl/033-v6.13-wifi-rtw88-Move-pwr_track_tbl-to-struct-rtw_rfe_def.patch
@@ -199,7 +199,7 @@ Link: https://patch.msgid.link/904d0ab1-c046-40cd-a3a3-d4fdcf663c9d@gmail.com
 	.bfer_mu_max_num = 1,
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
-@@ -2072,12 +2072,6 @@ static const struct rtw_intf_phy_para_ta
+@@ -2074,12 +2074,6 @@ static const struct rtw_intf_phy_para_ta
 	.n_gen2_para	= ARRAY_SIZE(pcie_gen2_param_8822b),
 };
 
@@ -212,7 +212,7 @@ Link: https://patch.msgid.link/904d0ab1-c046-40cd-a3a3-d4fdcf663c9d@gmail.com
 static const struct rtw_hw_reg rtw8822b_dig[] = {
 	[0] = { .addr = 0xc50, .mask = 0x7f },
 	[1] = { .addr = 0xe50, .mask = 0x7f },
-@@ -2432,7 +2426,7 @@ static const u8 rtw8822b_pwrtrk_2g_cck_a
+@@ -2434,7 +2428,7 @@ static const u8 rtw8822b_pwrtrk_2g_cck_a
 	10, 11, 11, 12, 12, 13, 13, 14, 14, 15
 };
 
@@ -221,7 +221,7 @@ Link: https://patch.msgid.link/904d0ab1-c046-40cd-a3a3-d4fdcf663c9d@gmail.com
 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_1] = rtw8822b_pwrtrk_5gb_n[RTW_PWR_TRK_5G_1],
 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_2] = rtw8822b_pwrtrk_5gb_n[RTW_PWR_TRK_5G_2],
 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_3] = rtw8822b_pwrtrk_5gb_n[RTW_PWR_TRK_5G_3],
-@@ -2455,6 +2449,12 @@ static const struct rtw_pwr_track_tbl rt
+@@ -2457,6 +2451,12 @@ static const struct rtw_pwr_track_tbl rt
 	.pwrtrk_2g_ccka_p = rtw8822b_pwrtrk_2g_cck_a_p,
 };
 
@@ -234,7 +234,7 @@ Link: https://patch.msgid.link/904d0ab1-c046-40cd-a3a3-d4fdcf663c9d@gmail.com
 static const struct rtw_reg_domain coex_info_hw_regs_8822b[] = {
 	{0xcb0, MASKDWORD, RTW_REG_DOMAIN_MAC32},
 	{0xcb4, MASKDWORD, RTW_REG_DOMAIN_MAC32},
-@@ -2535,7 +2535,6 @@ const struct rtw_chip_info rtw8822b_hw_s
+@@ -2537,7 +2537,6 @@ const struct rtw_chip_info rtw8822b_hw_s
 	.rf_tbl = {&rtw8822b_rf_a_tbl, &rtw8822b_rf_b_tbl},
 	.rfe_defs = rtw8822b_rfe_defs,
 	.rfe_defs_size = ARRAY_SIZE(rtw8822b_rfe_defs),
@@ -244,7 +244,7 @@ Link: https://patch.msgid.link/904d0ab1-c046-40cd-a3a3-d4fdcf663c9d@gmail.com
 	.bfer_mu_max_num = 1,
 --- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
 +++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
-@@ -4883,16 +4883,6 @@ static const struct rtw_intf_phy_para_ta
+@@ -4884,16 +4884,6 @@ static const struct rtw_intf_phy_para_ta
 	.n_gen2_para	= ARRAY_SIZE(pcie_gen2_param_8822c),
 };
 
@@ -261,7 +261,7 @@ Link: https://patch.msgid.link/904d0ab1-c046-40cd-a3a3-d4fdcf663c9d@gmail.com
 static const struct rtw_hw_reg rtw8822c_dig[] = {
 	[0] = { .addr = 0x1d70, .mask = 0x7f },
 	[1] = { .addr = 0x1d70, .mask = 0x7f00 },
-@@ -5238,7 +5228,7 @@ static const u8 rtw8822c_pwrtrk_2g_cck_a
+@@ -5239,7 +5229,7 @@ static const u8 rtw8822c_pwrtrk_2g_cck_a
 	18, 18, 19, 20, 21, 22, 23, 24, 24, 25
 };
 
@@ -270,7 +270,7 @@ Link: https://patch.msgid.link/904d0ab1-c046-40cd-a3a3-d4fdcf663c9d@gmail.com
 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_1] = rtw8822c_pwrtrk_5gb_n[RTW_PWR_TRK_5G_1],
 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_2] = rtw8822c_pwrtrk_5gb_n[RTW_PWR_TRK_5G_2],
 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_3] = rtw8822c_pwrtrk_5gb_n[RTW_PWR_TRK_5G_3],
-@@ -5261,6 +5251,16 @@ static const struct rtw_pwr_track_tbl rt
+@@ -5262,6 +5252,16 @@ static const struct rtw_pwr_track_tbl rt
 	.pwrtrk_2g_ccka_p = rtw8822c_pwrtrk_2g_cck_a_p,
 };
 
@@ -287,7 +287,7 @@ Link: https://patch.msgid.link/904d0ab1-c046-40cd-a3a3-d4fdcf663c9d@gmail.com
 static const struct rtw_hw_reg_offset rtw8822c_edcca_th[] = {
 	[EDCCA_TH_L2H_IDX] = {
 		{.addr = 0x84c, .mask = MASKBYTE2}, .offset = 0x80
-@@ -5360,7 +5360,6 @@ const struct rtw_chip_info rtw8822c_hw_s
+@@ -5361,7 +5361,6 @@ const struct rtw_chip_info rtw8822c_hw_s
 	.rfe_defs_size = ARRAY_SIZE(rtw8822c_rfe_defs),
 	.en_dis_dpd = true,
 	.dpd_ratemask = DIS_DPD_RATEALL,
--- a/package/kernel/mac80211/patches/rtl/034-v6.13-wifi-rtw88-usb-Set-pkt_info.ls-for-the-reserved-page.patch
+++ b/package/kernel/mac80211/patches/rtl/034-v6.13-wifi-rtw88-usb-Set-pkt_info.ls-for-the-reserved-page.patch
@@ -17,7 +17,7 @@ Link: https://patch.msgid.link/e443f5d9-4b53-4f64-985c-64313ec80bef@gmail.com

 --- a/drivers/net/wireless/realtek/rtw88/usb.c
 +++ b/drivers/net/wireless/realtek/rtw88/usb.c
-@@ -478,6 +478,7 @@ static int rtw_usb_write_data_rsvd_page(
+@@ -532,6 +532,7 @@ static int rtw_usb_write_data_rsvd_page(
 	pkt_info.tx_pkt_size = size;
 	pkt_info.qsel = TX_DESC_QSEL_BEACON;
 	pkt_info.offset = chip->tx_pkt_desc_sz;
--- a/package/kernel/mac80211/patches/rtl/048-wifi-rtw88-usb-Support-USB-3-with-RTL8812AU.patch
+++ b/package/kernel/mac80211/patches/rtl/048-wifi-rtw88-usb-Support-USB-3-with-RTL8812AU.patch
@@ -12,7 +12,7 @@ Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>

 --- a/drivers/net/wireless/realtek/rtw88/usb.c
 +++ b/drivers/net/wireless/realtek/rtw88/usb.c
-@@ -930,6 +930,32 @@ static void rtw_usb_intf_deinit(struct r
+@@ -985,6 +985,32 @@ static void rtw_usb_intf_deinit(struct r
 	usb_set_intfdata(intf, NULL);
 }
 
@@ -45,7 +45,7 @@ Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
 static int rtw_usb_switch_mode_new(struct rtw_dev *rtwdev)
 {
 	enum usb_device_speed cur_speed;
-@@ -983,7 +1009,8 @@ static int rtw_usb_switch_mode(struct rt
+@@ -1038,7 +1064,8 @@ static int rtw_usb_switch_mode(struct rt
 {
 	u8 id = rtwdev->chip->id;
 
@@ -55,7 +55,7 @@ Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
 		return 0;
 
 	if (!rtwdev->efuse.usb_mode_switch) {
-@@ -998,7 +1025,10 @@ static int rtw_usb_switch_mode(struct rt
+@@ -1053,7 +1080,10 @@ static int rtw_usb_switch_mode(struct rt
 		return 0;
 	}
 
--- a/package/kernel/mac80211/patches/rtl/049-wifi-rtw88-usb-Enable-RX-aggregation-for-8821au-8812.patch
+++ b/package/kernel/mac80211/patches/rtl/049-wifi-rtw88-usb-Enable-RX-aggregation-for-8821au-8812.patch
@@ -19,7 +19,7 @@ Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>

 --- a/drivers/net/wireless/realtek/rtw88/usb.c
 +++ b/drivers/net/wireless/realtek/rtw88/usb.c
-@@ -789,6 +789,32 @@ static void rtw_usb_dynamic_rx_agg_v1(st
+@@ -843,6 +843,32 @@ static void rtw_usb_dynamic_rx_agg_v1(st
 	rtw_write16(rtwdev, REG_RXDMA_AGG_PG_TH, val16);
 }
 
@@ -52,7 +52,7 @@ Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
 static void rtw_usb_dynamic_rx_agg(struct rtw_dev *rtwdev, bool enable)
 {
 	switch (rtwdev->chip->id) {
-@@ -797,6 +823,10 @@ static void rtw_usb_dynamic_rx_agg(struc
+@@ -851,6 +877,10 @@ static void rtw_usb_dynamic_rx_agg(struc
 	case RTW_CHIP_TYPE_8821C:
 		rtw_usb_dynamic_rx_agg_v1(rtwdev, enable);
 		break;
--- a/package/kernel/mac80211/patches/rtl/050-wifi-rtlwifi-rtl8821ae-phy-restore-removed-code-to-f.patch
+++ b/package/kernel/mac80211/patches/rtl/050-wifi-rtlwifi-rtl8821ae-phy-restore-removed-code-to-f.patch
@@ -1,32 +0,0 @@
-From 927dcd0ab53f39ee00a2d1f204b5aac77e28fcf9 Mon Sep 17 00:00:00 2001
-From: Colin Ian King <colin.i.king@gmail.com>
-Date: Wed, 6 Nov 2024 15:46:42 +0000
-Subject: [PATCH 5/6] wifi: rtlwifi: rtl8821ae: phy: restore removed code to
- fix infinite loop
-
-A previous clean-up fix removed the assignment of v2 inside a while loop
-that turned it into an infinite loop. Fix this by restoring the assignment
-of v2 from array[] so that v2 is updated inside the loop.
-
-Fixes: cda37445718d ("wifi: rtlwifi: rtl8821ae: phy: remove some useless code")
-Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
-Tested-by: Ping-Ke Shih <pkshih@realtek.com>
-Reviewed-by: Su Hui <suhui@nfschina.com>
---
- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
-+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
-@@ -2033,8 +2033,10 @@ static bool _rtl8821ae_phy_config_bb_wit
- 			if (!_rtl8821ae_check_condition(hw, v1)) {
- 				i += 2; /* skip the pair of expression*/
- 				v2 = array[i+1];
-				while (v2 != 0xDEAD)
-+				while (v2 != 0xDEAD) {
- 					i += 3;
-+					v2 = array[i + 1];
-+				}
- 			}
- 		}
- 	}
--- a/package/kernel/mac80211/patches/subsys/130-disable_auto_vif.patch
+++ b/package/kernel/mac80211/patches/subsys/130-disable_auto_vif.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -1583,24 +1583,6 @@ int ieee80211_register_hw(struct ieee802
+@@ -1585,24 +1585,6 @@ int ieee80211_register_hw(struct ieee802
 
 	ieee80211_check_wbrf_support(local);
 
--- a/package/kernel/mac80211/patches/subsys/230-avoid-crashing-missing-band.patch
+++ b/package/kernel/mac80211/patches/subsys/230-avoid-crashing-missing-band.patch
@@ -18,7 +18,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>

 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2439,6 +2439,13 @@ static void sta_stats_decode_rate(struct
+@@ -2446,6 +2446,13 @@ static void sta_stats_decode_rate(struct
 
 		sband = local->hw.wiphy->bands[band];
 
--- a/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
+++ b/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
@@ -28,7 +28,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>

 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -565,6 +565,7 @@ __sta_info_alloc(struct ieee80211_sub_if
+@@ -564,6 +564,7 @@ __sta_info_alloc(struct ieee80211_sub_if
 	spin_lock_init(&sta->ps_lock);
 	INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
 	wiphy_work_init(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
--- a/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
+++ b/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4081,7 +4081,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4082,7 +4082,7 @@ struct ieee80211_txq *ieee80211_next_txq
 
 		if (deficit < 0)
 			sta->airtime[txqi->txq.ac].deficit +=
@@ -32,7 +32,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 		if (deficit < 0 || !aql_check) {
 			list_move_tail(&txqi->schedule_order,
-@@ -4224,7 +4224,8 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4227,7 +4227,8 @@ bool ieee80211_txq_may_transmit(struct i
 		}
 		sta = container_of(iter->txq.sta, struct sta_info, sta);
 		if (ieee80211_sta_deficit(sta, ac) < 0)
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
 	}
 
-@@ -4232,7 +4233,7 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4235,7 +4236,7 @@ bool ieee80211_txq_may_transmit(struct i
 	if (sta->airtime[ac].deficit >= 0)
 		goto out;
 
--- a/package/kernel/mac80211/patches/subsys/310-cfg80211-allow-grace-period-for-DFS-available-after-.patch
+++ b/package/kernel/mac80211/patches/subsys/310-cfg80211-allow-grace-period-for-DFS-available-after-.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -187,6 +187,8 @@ enum ieee80211_channel_flags {
+@@ -190,6 +190,8 @@ enum ieee80211_channel_flags {
  * @dfs_state: current state of this channel. Only relevant if radar is required
  *	on this channel.
  * @dfs_state_entered: timestamp (jiffies) when the dfs state was entered.
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  * @dfs_cac_ms: DFS CAC time in milliseconds, this is valid for DFS channels.
  * @psd: power spectral density (in dBm)
  */
-@@ -204,6 +206,7 @@ struct ieee80211_channel {
+@@ -207,6 +209,7 @@ struct ieee80211_channel {
 	int orig_mag, orig_mpwr;
 	enum nl80211_dfs_state dfs_state;
 	unsigned long dfs_state_entered;
@@ -124,7 +124,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/wireless/mlme.c
 +++ b/net/wireless/mlme.c
-@@ -1031,6 +1031,8 @@ void cfg80211_dfs_channels_update_work(s
+@@ -1032,6 +1032,8 @@ void cfg80211_dfs_channels_update_work(s
 			if (c->dfs_state == NL80211_DFS_UNAVAILABLE) {
 				time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS;
 				radar_event = NL80211_RADAR_NOP_FINISHED;
@@ -133,7 +133,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 			} else {
 				if (regulatory_pre_cac_allowed(wiphy) ||
 				    cfg80211_any_wiphy_oper_chan(wiphy, c))
-@@ -1038,11 +1040,10 @@ void cfg80211_dfs_channels_update_work(s
+@@ -1039,11 +1041,10 @@ void cfg80211_dfs_channels_update_work(s
 
 				time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS;
 				radar_event = NL80211_RADAR_PRE_CAC_EXPIRED;
--- a/package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch
+++ b/package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch
@@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -3423,6 +3423,7 @@ enum wiphy_params_flags {
+@@ -3426,6 +3426,7 @@ enum wiphy_params_flags {
 /* The per TXQ device queue limit in airtime */
 #define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L	5000
 #define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H	12000
@@ -70,7 +70,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1351,10 +1351,12 @@ struct ieee80211_local {
+@@ -1360,10 +1360,12 @@ struct ieee80211_local {
 	spinlock_t handle_wake_tx_queue_lock;
 
 	u16 airtime_flags;
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		spin_lock_init(&local->active_txq_lock[i]);
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2353,13 +2353,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggre
+@@ -2360,13 +2360,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggre
 
 void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
 					  struct sta_info *sta, u8 ac,
@@ -136,7 +136,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		spin_unlock_irqrestore(&local->ack_status_lock, flags);
 
 		if (id >= 0) {
-@@ -3982,20 +3982,20 @@ begin:
+@@ -3983,20 +3983,20 @@ begin:
 encap_out:
 	info->control.vif = vif;
 
@@ -167,7 +167,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	}
 
 	return skb;
-@@ -4047,6 +4047,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4048,6 +4048,7 @@ struct ieee80211_txq *ieee80211_next_txq
 	struct ieee80211_txq *ret = NULL;
 	struct txq_info *txqi = NULL, *head = NULL;
 	bool found_eligible_txq = false;
@@ -175,7 +175,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 	spin_lock_bh(&local->active_txq_lock[ac]);
 
-@@ -4070,26 +4071,26 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4071,26 +4072,26 @@ struct ieee80211_txq *ieee80211_next_txq
 	if (!head)
 		head = txqi;
 
@@ -214,7 +214,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	if (txqi->schedule_round == local->schedule_round[ac])
 		goto out;
 
-@@ -4154,7 +4155,8 @@ bool ieee80211_txq_airtime_check(struct
+@@ -4157,7 +4158,8 @@ bool ieee80211_txq_airtime_check(struct
 		return true;
 
 	if (!txq->sta)
@@ -224,7 +224,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
 		return true;
-@@ -4203,15 +4205,15 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4206,15 +4208,15 @@ bool ieee80211_txq_may_transmit(struct i
 
 	spin_lock_bh(&local->active_txq_lock[ac]);
 
--- a/package/kernel/mac80211/patches/subsys/330-wifi-cfg80211-add-option-for-vif-allowed-radios.patch
+++ b/package/kernel/mac80211/patches/subsys/330-wifi-cfg80211-add-option-for-vif-allowed-radios.patch
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -6271,6 +6271,7 @@ enum ieee80211_ap_reg_power {
+@@ -6274,6 +6274,7 @@ enum ieee80211_ap_reg_power {
  *	entered.
  * @links.cac_time_ms: CAC time in ms
  * @valid_links: bitmap describing what elements of @links are valid
@@ -31,7 +31,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  */
 struct wireless_dev {
 	struct wiphy *wiphy;
-@@ -6383,6 +6384,8 @@ struct wireless_dev {
+@@ -6386,6 +6387,8 @@ struct wireless_dev {
 		unsigned int cac_time_ms;
 	} links[IEEE80211_MLD_MAX_NUM_LINKS];
 	u16 valid_links;
@@ -40,7 +40,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 };
 
 static inline const u8 *wdev_address(struct wireless_dev *wdev)
-@@ -6569,6 +6572,17 @@ bool cfg80211_radio_chandef_valid(const
+@@ -6572,6 +6575,17 @@ bool cfg80211_radio_chandef_valid(const
 				  const struct cfg80211_chan_def *chandef);
 
 /**
@@ -81,7 +81,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	__NL80211_ATTR_AFTER_LAST,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -829,6 +829,7 @@ static const struct nla_policy nl80211_p
+@@ -832,6 +832,7 @@ static const struct nla_policy nl80211_p
 	[NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
 	[NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
 	[NL80211_ATTR_ASSOC_SPP_AMSDU] = { .type = NLA_FLAG },
@@ -89,7 +89,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 };
 
 /* policy for the key attributes */
-@@ -3996,7 +3997,8 @@ static int nl80211_send_iface(struct sk_
+@@ -4003,7 +4004,8 @@ static int nl80211_send_iface(struct sk_
 	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
 			rdev->devlist_generation ^
 			(cfg80211_rdev_list_generation << 2)) ||
@@ -99,7 +99,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		goto nla_put_failure;
 
 	if (rdev->ops->get_channel && !wdev->valid_links) {
-@@ -4312,6 +4314,29 @@ static int nl80211_valid_4addr(struct cf
+@@ -4324,6 +4326,29 @@ static int nl80211_valid_4addr(struct cf
 	return -EOPNOTSUPP;
 }
 
@@ -129,7 +129,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 {
 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
-@@ -4319,6 +4344,8 @@ static int nl80211_set_interface(struct
+@@ -4331,6 +4356,8 @@ static int nl80211_set_interface(struct
 	int err;
 	enum nl80211_iftype otype, ntype;
 	struct net_device *dev = info->user_ptr[1];
@@ -138,7 +138,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	bool change = false;
 
 	memset(&params, 0, sizeof(params));
-@@ -4332,8 +4359,6 @@ static int nl80211_set_interface(struct
+@@ -4344,8 +4371,6 @@ static int nl80211_set_interface(struct
 	}
 
 	if (info->attrs[NL80211_ATTR_MESH_ID]) {
@@ -147,7 +147,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		if (ntype != NL80211_IFTYPE_MESH_POINT)
 			return -EINVAL;
 		if (otype != NL80211_IFTYPE_MESH_POINT)
-@@ -4364,6 +4389,12 @@ static int nl80211_set_interface(struct
+@@ -4376,6 +4401,12 @@ static int nl80211_set_interface(struct
 	if (err > 0)
 		change = true;
 
@@ -160,7 +160,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	if (change)
 		err = cfg80211_change_iface(rdev, dev, ntype, &params);
 	else
-@@ -4372,11 +4403,11 @@ static int nl80211_set_interface(struct
+@@ -4384,11 +4415,11 @@ static int nl80211_set_interface(struct
 	if (!err && params.use_4addr != -1)
 		dev->ieee80211_ptr->use_4addr = params.use_4addr;
 
@@ -175,7 +175,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 	return err;
 }
-@@ -4387,6 +4418,7 @@ static int _nl80211_new_interface(struct
+@@ -4399,6 +4430,7 @@ static int _nl80211_new_interface(struct
 	struct vif_params params;
 	struct wireless_dev *wdev;
 	struct sk_buff *msg;
@@ -183,7 +183,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	int err;
 	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 
-@@ -4424,6 +4456,10 @@ static int _nl80211_new_interface(struct
+@@ -4436,6 +4468,10 @@ static int _nl80211_new_interface(struct
 	if (err < 0)
 		return err;
 
@@ -194,7 +194,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 	if (!msg)
 		return -ENOMEM;
-@@ -4465,6 +4501,9 @@ static int _nl80211_new_interface(struct
+@@ -4477,6 +4513,9 @@ static int _nl80211_new_interface(struct
 		break;
 	}
 
@@ -204,7 +204,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
 			       rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
 		nlmsg_free(msg);
-@@ -9180,6 +9219,9 @@ static bool cfg80211_off_channel_oper_al
+@@ -9192,6 +9231,9 @@ static bool cfg80211_off_channel_oper_al
 
 	lockdep_assert_wiphy(wdev->wiphy);
 
@@ -214,7 +214,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	if (!cfg80211_beaconing_iface_active(wdev))
 		return true;
 
-@@ -9392,7 +9434,8 @@ static int nl80211_trigger_scan(struct s
+@@ -9404,7 +9446,8 @@ static int nl80211_trigger_scan(struct s
 			}
 
 			/* ignore disabled channels */
@@ -224,7 +224,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 				continue;
 
 			request->channels[i] = chan;
-@@ -9412,7 +9455,8 @@ static int nl80211_trigger_scan(struct s
+@@ -9424,7 +9467,8 @@ static int nl80211_trigger_scan(struct s
 
 				chan = &wiphy->bands[band]->channels[j];
 
@@ -236,7 +236,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 				request->channels[i] = chan;
 --- a/net/wireless/scan.c
 +++ b/net/wireless/scan.c
-@@ -956,7 +956,8 @@ static int cfg80211_scan_6ghz(struct cfg
+@@ -953,7 +953,8 @@ static int cfg80211_scan_6ghz(struct cfg
 		struct ieee80211_channel *chan =
 			ieee80211_get_channel(&rdev->wiphy, ap->center_freq);
 
@@ -246,7 +246,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 			continue;
 
 		for (i = 0; i < rdev_req->n_channels; i++) {
-@@ -3519,9 +3520,12 @@ int cfg80211_wext_siwscan(struct net_dev
+@@ -3512,9 +3513,12 @@ int cfg80211_wext_siwscan(struct net_dev
 			continue;
 
 		for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
@@ -263,7 +263,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 			/* If we have a wireless request structure and the
 --- a/net/wireless/util.c
 +++ b/net/wireless/util.c
-@@ -2923,3 +2923,32 @@ bool cfg80211_radio_chandef_valid(const
+@@ -2970,3 +2970,32 @@ bool cfg80211_radio_chandef_valid(const
 	return true;
 }
 EXPORT_SYMBOL(cfg80211_radio_chandef_valid);
@@ -298,7 +298,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +EXPORT_SYMBOL(cfg80211_wdev_channel_allowed);
 --- a/net/wireless/core.c
 +++ b/net/wireless/core.c
-@@ -1424,6 +1424,8 @@ void cfg80211_init_wdev(struct wireless_
+@@ -1431,6 +1431,8 @@ void cfg80211_init_wdev(struct wireless_
 	/* allow mac80211 to determine the timeout */
 	wdev->ps_timeout = -1;
 
--- a/package/kernel/mac80211/patches/subsys/331-wifi-mac80211-use-vif-radio-mask-to-limit-ibss-scan-.patch
+++ b/package/kernel/mac80211/patches/subsys/331-wifi-mac80211-use-vif-radio-mask-to-limit-ibss-scan-.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/net/mac80211/scan.c
 +++ b/net/mac80211/scan.c
-@@ -1176,14 +1176,14 @@ int ieee80211_request_ibss_scan(struct i
+@@ -1175,14 +1175,14 @@ int ieee80211_request_ibss_scan(struct i
 				unsigned int n_channels)
 {
 	struct ieee80211_local *local = sdata->local;
@@ -27,7 +27,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 	/* fill internal scan request */
 	if (!channels) {
-@@ -1200,7 +1200,9 @@ int ieee80211_request_ibss_scan(struct i
+@@ -1199,7 +1199,9 @@ int ieee80211_request_ibss_scan(struct i
 				    &local->hw.wiphy->bands[band]->channels[i];
 
 				if (tmp_ch->flags & (IEEE80211_CHAN_NO_IR |
@@ -38,7 +38,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 					continue;
 
 				local->int_scan_req->channels[n_ch] = tmp_ch;
-@@ -1209,21 +1211,23 @@ int ieee80211_request_ibss_scan(struct i
+@@ -1208,21 +1210,23 @@ int ieee80211_request_ibss_scan(struct i
 		}
 
 		if (WARN_ON_ONCE(n_ch == 0))
@@ -66,7 +66,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 		local->int_scan_req->n_channels = n_ch;
 	}
-@@ -1233,9 +1237,7 @@ int ieee80211_request_ibss_scan(struct i
+@@ -1232,9 +1236,7 @@ int ieee80211_request_ibss_scan(struct i
 	memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
 	local->int_scan_req->ssids[0].ssid_len = ssid_len;
 
--- a/package/kernel/mac80211/patches/subsys/332-wifi-mac80211-use-vif-radio-mask-to-limit-chanctx-an.patch
+++ b/package/kernel/mac80211/patches/subsys/332-wifi-mac80211-use-vif-radio-mask-to-limit-chanctx-an.patch
@@ -39,7 +39,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 			new_ctx = ieee80211_new_chanctx(local, chanreq, mode,
 							false, radio_idx);
 		else
-@@ -1883,7 +1888,9 @@ int _ieee80211_link_use_channel(struct i
+@@ -1884,7 +1889,9 @@ int _ieee80211_link_use_channel(struct i
 	/* Note: context is now reserved */
 	if (ctx)
 		reserved = true;
--- a/package/kernel/mac80211/patches/subsys/334-wifi-cfg80211-pass-net_device-to-.set_monitor_channel.patch
+++ b/package/kernel/mac80211/patches/subsys/334-wifi-cfg80211-pass-net_device-to-.set_monitor_channel.patch
@@ -49,7 +49,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -4700,6 +4700,7 @@ struct cfg80211_ops {
+@@ -4703,6 +4703,7 @@ struct cfg80211_ops {
 					     struct ieee80211_channel *chan);
 
 	int	(*set_monitor_channel)(struct wiphy *wiphy,
@@ -69,7 +69,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	struct ieee80211_local *local = wiphy_priv(wiphy);
 --- a/net/wireless/chan.c
 +++ b/net/wireless/chan.c
-@@ -1673,6 +1673,7 @@ bool cfg80211_reg_check_beaconing(struct
+@@ -1679,6 +1679,7 @@ bool cfg80211_reg_check_beaconing(struct
 EXPORT_SYMBOL(cfg80211_reg_check_beaconing);
 
 int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
@@ -77,7 +77,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 				 struct cfg80211_chan_def *chandef)
 {
 	if (!rdev->ops->set_monitor_channel)
-@@ -1680,7 +1681,7 @@ int cfg80211_set_monitor_channel(struct
+@@ -1686,7 +1687,7 @@ int cfg80211_set_monitor_channel(struct
 	if (!cfg80211_has_monitors_only(rdev))
 		return -EBUSY;
 
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -3562,7 +3562,7 @@ static int __nl80211_set_channel(struct
+@@ -3569,7 +3569,7 @@ static int __nl80211_set_channel(struct
 	case NL80211_IFTYPE_MESH_POINT:
 		return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
 	case NL80211_IFTYPE_MONITOR:
--- a/package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-flag-to-opt-out-of-virtual-monitor.patch
+++ b/package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-flag-to-opt-out-of-virtual-monitor.patch
@@ -25,7 +25,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  * @IEEE80211_HW_NO_AUTO_VIF: The driver would like for no wlanX to
  *	be created.  It is expected user-space will create vifs as
  *	desired (and thus have them named as desired).
-@@ -2838,6 +2843,7 @@ enum ieee80211_hw_flags {
+@@ -2843,6 +2848,7 @@ enum ieee80211_hw_flags {
 	IEEE80211_HW_SUPPORTS_DYNAMIC_PS,
 	IEEE80211_HW_MFP_CAPABLE,
 	IEEE80211_HW_WANT_MONITOR_VIF,
@@ -217,7 +217,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	}
 
 	/* Regardless of eth_mac_addr() return we still want to add the
-@@ -699,9 +704,11 @@ static void ieee80211_do_stop(struct iee
+@@ -705,9 +710,11 @@ static void ieee80211_do_stop(struct iee
 		ieee80211_recalc_idle(local);
 		ieee80211_recalc_offload(local);
 
@@ -230,7 +230,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		fallthrough;
 	default:
 		if (!going_down)
-@@ -1131,7 +1138,8 @@ int ieee80211_add_virtual_monitor(struct
+@@ -1140,7 +1147,8 @@ int ieee80211_add_virtual_monitor(struct
 	ASSERT_RTNL();
 	lockdep_assert_wiphy(local->hw.wiphy);
 
@@ -240,7 +240,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		return 0;
 
 	sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
-@@ -1193,6 +1201,9 @@ void ieee80211_del_virtual_monitor(struc
+@@ -1202,6 +1210,9 @@ void ieee80211_del_virtual_monitor(struc
 {
 	struct ieee80211_sub_if_data *sdata;
 
@@ -250,7 +250,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	ASSERT_RTNL();
 	lockdep_assert_wiphy(local->hw.wiphy);
 
-@@ -1328,7 +1339,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1345,7 +1356,8 @@ int ieee80211_do_open(struct wireless_de
 			break;
 		}
 
@@ -284,7 +284,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 			vif = &sdata->vif;
 			break;
 		}
-@@ -3952,7 +3953,8 @@ begin:
+@@ -3953,7 +3954,8 @@ begin:
 
 	switch (tx.sdata->vif.type) {
 	case NL80211_IFTYPE_MONITOR:
@@ -296,7 +296,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		}
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -739,7 +739,8 @@ static void __iterate_interfaces(struct
+@@ -740,7 +740,8 @@ static void __iterate_interfaces(struct
 				lockdep_is_held(&local->hw.wiphy->mtx)) {
 		switch (sdata->vif.type) {
 		case NL80211_IFTYPE_MONITOR:
@@ -306,7 +306,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 				continue;
 			break;
 		case NL80211_IFTYPE_AP_VLAN:
-@@ -1856,8 +1857,10 @@ int ieee80211_reconfig(struct ieee80211_
+@@ -1860,8 +1861,10 @@ int ieee80211_reconfig(struct ieee80211_
 	}
 
 	list_for_each_entry(sdata, &local->interfaces, list) {
@@ -318,7 +318,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 		    ieee80211_sdata_running(sdata)) {
 			res = drv_add_interface(local, sdata);
 			if (WARN_ON(res))
-@@ -1870,11 +1873,14 @@ int ieee80211_reconfig(struct ieee80211_
+@@ -1874,11 +1877,14 @@ int ieee80211_reconfig(struct ieee80211_
 	 */
 	if (res) {
 		list_for_each_entry_continue_reverse(sdata, &local->interfaces,
--- a/package/kernel/mac80211/patches/subsys/336-wifi-cfg80211-add-monitor-SKIP_TX-flag.patch
+++ b/package/kernel/mac80211/patches/subsys/336-wifi-cfg80211-add-monitor-SKIP_TX-flag.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -2272,6 +2272,7 @@ static inline int cfg80211_get_station(s
+@@ -2275,6 +2275,7 @@ static inline int cfg80211_get_station(s
  * @MONITOR_FLAG_OTHER_BSS: disable BSSID filtering
  * @MONITOR_FLAG_COOK_FRAMES: report frames after processing
  * @MONITOR_FLAG_ACTIVE: active monitor, ACKs frames on its MAC address
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  */
 enum monitor_flags {
 	MONITOR_FLAG_CHANGED		= BIT(__NL80211_MNTR_FLAG_INVALID),
-@@ -2281,6 +2282,7 @@ enum monitor_flags {
+@@ -2284,6 +2285,7 @@ enum monitor_flags {
 	MONITOR_FLAG_OTHER_BSS		= BIT(NL80211_MNTR_FLAG_OTHER_BSS),
 	MONITOR_FLAG_COOK_FRAMES	= BIT(NL80211_MNTR_FLAG_COOK_FRAMES),
 	MONITOR_FLAG_ACTIVE		= BIT(NL80211_MNTR_FLAG_ACTIVE),
@@ -28,7 +28,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 /**
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -4703,6 +4703,7 @@ enum nl80211_survey_info {
+@@ -4709,6 +4709,7 @@ enum nl80211_survey_info {
  *	overrides all other flags.
  * @NL80211_MNTR_FLAG_ACTIVE: use the configured MAC address
  *	and ACK incoming unicast packets.
@@ -36,7 +36,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  *
  * @__NL80211_MNTR_FLAG_AFTER_LAST: internal use
  * @NL80211_MNTR_FLAG_MAX: highest possible monitor flag
-@@ -4715,6 +4716,7 @@ enum nl80211_mntr_flags {
+@@ -4721,6 +4722,7 @@ enum nl80211_mntr_flags {
 	NL80211_MNTR_FLAG_OTHER_BSS,
 	NL80211_MNTR_FLAG_COOK_FRAMES,
 	NL80211_MNTR_FLAG_ACTIVE,
@@ -46,7 +46,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	__NL80211_MNTR_FLAG_AFTER_LAST,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -4201,6 +4201,7 @@ static const struct nla_policy mntr_flag
+@@ -4208,6 +4208,7 @@ static const struct nla_policy mntr_flag
 	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
--- a/package/kernel/mac80211/patches/subsys/337-wifi-mac80211-add-support-for-the-monitor-SKIP_TX-fl.patch
+++ b/package/kernel/mac80211/patches/subsys/337-wifi-mac80211-add-support-for-the-monitor-SKIP_TX-fl.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1373,7 +1373,7 @@ struct ieee80211_local {
+@@ -1382,7 +1382,7 @@ struct ieee80211_local {
 	spinlock_t queue_stop_reason_lock;
 
 	int open_count;
@@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	    fif_probe_req;
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -1094,6 +1094,8 @@ void ieee80211_adjust_monitor_flags(stru
+@@ -1103,6 +1103,8 @@ void ieee80211_adjust_monitor_flags(stru
 	ADJUST(CONTROL, control);
 	ADJUST(CONTROL, pspoll);
 	ADJUST(OTHER_BSS, other_bss);
--- a/package/kernel/mac80211/patches/subsys/340-wifi-cfg80211-report-per-wiphy-radio-antenna-mask.patch
+++ b/package/kernel/mac80211/patches/subsys/340-wifi-cfg80211-report-per-wiphy-radio-antenna-mask.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -5443,6 +5443,8 @@ struct wiphy_radio_freq_range {
+@@ -5446,6 +5446,8 @@ struct wiphy_radio_freq_range {
  * @iface_combinations: Valid interface combinations array, should not
  *	list single interface types.
  * @n_iface_combinations: number of entries in @iface_combinations array.
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  */
 struct wiphy_radio {
 	const struct wiphy_radio_freq_range *freq_range;
-@@ -5450,6 +5452,8 @@ struct wiphy_radio {
+@@ -5453,6 +5455,8 @@ struct wiphy_radio {
 
 	const struct ieee80211_iface_combination *iface_combinations;
 	int n_iface_combinations;
@@ -31,7 +31,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 #define CFG80211_HW_TIMESTAMP_ALL_PEERS	0xffff
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -8038,6 +8038,8 @@ enum nl80211_ap_settings_flags {
+@@ -8044,6 +8044,8 @@ enum nl80211_ap_settings_flags {
  * @NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION: Supported interface
  *	combination for this radio. Attribute may be present multiple times
  *	and contains attributes defined in &enum nl80211_if_combination_attrs.
@@ -40,7 +40,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  *
  * @__NL80211_WIPHY_RADIO_ATTR_LAST: Internal
  * @NL80211_WIPHY_RADIO_ATTR_MAX: Highest attribute
-@@ -8048,6 +8050,7 @@ enum nl80211_wiphy_radio_attrs {
+@@ -8054,6 +8056,7 @@ enum nl80211_wiphy_radio_attrs {
 	NL80211_WIPHY_RADIO_ATTR_INDEX,
 	NL80211_WIPHY_RADIO_ATTR_FREQ_RANGE,
 	NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION,
@@ -50,7 +50,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	__NL80211_WIPHY_RADIO_ATTR_LAST,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -2431,6 +2431,11 @@ static int nl80211_put_radio(struct wiph
+@@ -2438,6 +2438,11 @@ static int nl80211_put_radio(struct wiph
 	if (nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_INDEX, idx))
 		goto nla_put_failure;
 
--- a/package/kernel/mac80211/patches/subsys/341-wifi-mac80211-fix-vif-addr-when-switching-from-monit.patch
+++ b/package/kernel/mac80211/patches/subsys/341-wifi-mac80211-fix-vif-addr-when-switching-from-monit.patch
@@ -52,7 +52,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	}
 
 	/* Regardless of eth_mac_addr() return we still want to add the
-@@ -1324,6 +1319,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1336,6 +1331,8 @@ int ieee80211_do_open(struct wireless_de
 		}
 	}
 
--- a/package/kernel/mac80211/patches/subsys/342-wifi-mac80211-Support-EHT-1024-aggregation-size-in-T.patch
+++ b/package/kernel/mac80211/patches/subsys/342-wifi-mac80211-Support-EHT-1024-aggregation-size-in-T.patch
@@ -0,0 +1,321 @@
+From 406c5548c661df0bff6bb6ee79bf9d49faf23e31 Mon Sep 17 00:00:00 2001
+From: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Date: Tue, 12 Nov 2024 16:38:46 +0800
+Subject: [PATCH] wifi: mac80211: Support EHT 1024 aggregation size in TX
+
+Support EHT 1024 aggregation size in TX
+
+The 1024 agg size for RX is supported but not for TX.
+This patch adds this support and refactors common parsing logics for
+addbaext in both process_addba_resp and process_addba_req into a
+function.
+
+Reviewed-by: Shayne Chen <shayne.chen@mediatek.com>
+Reviewed-by: Money Wang <money.wang@mediatek.com>
+Co-developed-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: Peter Chiu <chui-hao.chiu@mediatek.com>
+Signed-off-by: MeiChia Chiu <MeiChia.Chiu@mediatek.com>
+Link: https://patch.msgid.link/20241112083846.32063-1-MeiChia.Chiu@mediatek.com
+[pass elems/len instead of mgmt/len/is_req]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ include/linux/ieee80211.h  |  2 +
+ net/mac80211/agg-rx.c      | 94 +++++++++++++++++++++++---------------
+ net/mac80211/agg-tx.c      | 31 +++++++++----
+ net/mac80211/ht.c          |  2 +-
+ net/mac80211/ieee80211_i.h |  9 +++-
+ 5 files changed, 90 insertions(+), 48 deletions(-)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index 456bca45ff05..05dedc45505c 100644
+--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
+@@ -1445,6 +1445,8 @@ struct ieee80211_mgmt {
+ 					__le16 status;
+ 					__le16 capab;
+ 					__le16 timeout;
+					/* followed by BA Extension */
+					u8 variable[];
+ 				} __packed addba_resp;
+ 				struct{
+ 					u8 action_code;
+diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
+index fe7eab4b681b..f3fbe5a4395e 100644
+--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
+@@ -170,28 +170,63 @@ static void sta_rx_agg_reorder_timer_expired(struct timer_list *t)
+ 	rcu_read_unlock();
+ }
+ 
+-static void ieee80211_add_addbaext(struct ieee80211_sub_if_data *sdata,
+-				   struct sk_buff *skb,
+-				   const struct ieee80211_addba_ext_ie *req,
+-				   u16 buf_size)
+void ieee80211_add_addbaext(struct sk_buff *skb,
+			    const u8 req_addba_ext_data,
+			    u16 buf_size)
+ {
+-	struct ieee80211_addba_ext_ie *resp;
+	struct ieee80211_addba_ext_ie *addba_ext;
+ 	u8 *pos;
+ 
+ 	pos = skb_put_zero(skb, 2 + sizeof(struct ieee80211_addba_ext_ie));
+ 	*pos++ = WLAN_EID_ADDBA_EXT;
+ 	*pos++ = sizeof(struct ieee80211_addba_ext_ie);
+-	resp = (struct ieee80211_addba_ext_ie *)pos;
+-	resp->data = req->data & IEEE80211_ADDBA_EXT_NO_FRAG;
+	addba_ext = (struct ieee80211_addba_ext_ie *)pos;
+ 
+-	resp->data |= u8_encode_bits(buf_size >> IEEE80211_ADDBA_EXT_BUF_SIZE_SHIFT,
+-				     IEEE80211_ADDBA_EXT_BUF_SIZE_MASK);
+	addba_ext->data = IEEE80211_ADDBA_EXT_NO_FRAG;
+	if (req_addba_ext_data)
+		addba_ext->data &= req_addba_ext_data;
+
+	addba_ext->data |=
+		u8_encode_bits(buf_size >> IEEE80211_ADDBA_EXT_BUF_SIZE_SHIFT,
+			       IEEE80211_ADDBA_EXT_BUF_SIZE_MASK);
+}
+
+u8 ieee80211_retrieve_addba_ext_data(struct sta_info *sta,
+				     const void *elem_data, ssize_t elem_len,
+				     u16 *buf_size)
+{
+	struct ieee802_11_elems *elems;
+	u8 buf_size_1k, data = 0;
+
+	if (!sta->sta.deflink.he_cap.has_he)
+		return 0;
+
+	if (elem_len <= 0)
+		return 0;
+
+	elems = ieee802_11_parse_elems(elem_data, elem_len, true, NULL);
+
+	if (elems && !elems->parse_error && elems->addba_ext_ie) {
+		data = elems->addba_ext_ie->data;
+
+		if (!sta->sta.deflink.eht_cap.has_eht || !buf_size)
+			goto free;
+
+		buf_size_1k = u8_get_bits(elems->addba_ext_ie->data,
+					  IEEE80211_ADDBA_EXT_BUF_SIZE_MASK);
+		*buf_size |= (u16)buf_size_1k <<
+			     IEEE80211_ADDBA_EXT_BUF_SIZE_SHIFT;
+	}
+free:
+	kfree(elems);
+
+	return data;
+ }
+ 
+ static void ieee80211_send_addba_resp(struct sta_info *sta, u8 *da, u16 tid,
+ 				      u8 dialog_token, u16 status, u16 policy,
+ 				      u16 buf_size, u16 timeout,
+-				      const struct ieee80211_addba_ext_ie *addbaext)
+				      const u8 req_addba_ext_data)
+ {
+ 	struct ieee80211_sub_if_data *sdata = sta->sdata;
+ 	struct ieee80211_local *local = sdata->local;
+@@ -223,8 +258,8 @@ static void ieee80211_send_addba_resp(struct sta_info *sta, u8 *da, u16 tid,
+ 	mgmt->u.action.u.addba_resp.timeout = cpu_to_le16(timeout);
+ 	mgmt->u.action.u.addba_resp.status = cpu_to_le16(status);
+ 
+-	if (sta->sta.deflink.he_cap.has_he && addbaext)
+-		ieee80211_add_addbaext(sdata, skb, addbaext, buf_size);
+	if (sta->sta.deflink.he_cap.has_he)
+		ieee80211_add_addbaext(skb, req_addba_ext_data, buf_size);
+ 
+ 	ieee80211_tx_skb(sdata, skb);
+ }
+@@ -233,7 +268,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
+ 				     u8 dialog_token, u16 timeout,
+ 				     u16 start_seq_num, u16 ba_policy, u16 tid,
+ 				     u16 buf_size, bool tx, bool auto_seq,
+-				     const struct ieee80211_addba_ext_ie *addbaext)
+				     const u8 addba_ext_data)
+ {
+ 	struct ieee80211_local *local = sta->sdata->local;
+ 	struct tid_ampdu_rx *tid_agg_rx;
+@@ -419,7 +454,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
+ 	if (tx)
+ 		ieee80211_send_addba_resp(sta, sta->sta.addr, tid,
+ 					  dialog_token, status, 1, buf_size,
+-					  timeout, addbaext);
+					  timeout, addba_ext_data);
+ }
+ 
+ void ieee80211_process_addba_request(struct ieee80211_local *local,
+@@ -428,9 +463,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
+ 				     size_t len)
+ {
+ 	u16 capab, tid, timeout, ba_policy, buf_size, start_seq_num;
+-	struct ieee802_11_elems *elems = NULL;
+-	u8 dialog_token;
+-	int ies_len;
+	u8 dialog_token, addba_ext_data;
+ 
+ 	/* extract session parameters from addba request frame */
+ 	dialog_token = mgmt->u.action.u.addba_req.dialog_token;
+@@ -443,28 +476,17 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
+ 	tid = (capab & IEEE80211_ADDBA_PARAM_TID_MASK) >> 2;
+ 	buf_size = (capab & IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK) >> 6;
+ 
+-	ies_len = len - offsetof(struct ieee80211_mgmt,
+-				 u.action.u.addba_req.variable);
+-	if (ies_len) {
+-		elems = ieee802_11_parse_elems(mgmt->u.action.u.addba_req.variable,
+-					       ies_len, true, NULL);
+-		if (!elems || elems->parse_error)
+-			goto free;
+-	}
+-
+-	if (sta->sta.deflink.eht_cap.has_eht && elems && elems->addba_ext_ie) {
+-		u8 buf_size_1k = u8_get_bits(elems->addba_ext_ie->data,
+-					     IEEE80211_ADDBA_EXT_BUF_SIZE_MASK);
+-
+-		buf_size |= buf_size_1k << IEEE80211_ADDBA_EXT_BUF_SIZE_SHIFT;
+-	}
+	addba_ext_data =
+		ieee80211_retrieve_addba_ext_data(sta,
+						  mgmt->u.action.u.addba_req.variable,
+						  len -
+						  offsetof(typeof(*mgmt),
+							   u.action.u.addba_req.variable),
+						  &buf_size);
+ 
+ 	__ieee80211_start_rx_ba_session(sta, dialog_token, timeout,
+ 					start_seq_num, ba_policy, tid,
+-					buf_size, true, false,
+-					elems ? elems->addba_ext_ie : NULL);
+-free:
+-	kfree(elems);
+					buf_size, true, false, addba_ext_data);
+ }
+ 
+ void ieee80211_manage_rx_ba_offl(struct ieee80211_vif *vif,
+diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
+index 04cb45cfb310..61f2cac37728 100644
+--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
+@@ -58,23 +58,24 @@
+  * complete.
+  */
+ 
+-static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
+-					 const u8 *da, u16 tid,
+static void ieee80211_send_addba_request(struct sta_info *sta, u16 tid,
+ 					 u8 dialog_token, u16 start_seq_num,
+ 					 u16 agg_size, u16 timeout)
+ {
+	struct ieee80211_sub_if_data *sdata = sta->sdata;
+ 	struct ieee80211_local *local = sdata->local;
+ 	struct sk_buff *skb;
+ 	struct ieee80211_mgmt *mgmt;
+ 	u16 capab;
+ 
+-	skb = dev_alloc_skb(sizeof(*mgmt) + local->hw.extra_tx_headroom);
+-
+	skb = dev_alloc_skb(sizeof(*mgmt) +
+			    2 + sizeof(struct ieee80211_addba_ext_ie) +
+			    local->hw.extra_tx_headroom);
+ 	if (!skb)
+ 		return;
+ 
+ 	skb_reserve(skb, local->hw.extra_tx_headroom);
+-	mgmt = ieee80211_mgmt_ba(skb, da, sdata);
+	mgmt = ieee80211_mgmt_ba(skb, sta->sta.addr, sdata);
+ 
+ 	skb_put(skb, 1 + sizeof(mgmt->u.action.u.addba_req));
+ 
+@@ -93,6 +94,9 @@ static void ieee80211_send_addba_request(struct ieee80211_sub_if_data *sdata,
+ 	mgmt->u.action.u.addba_req.start_seq_num =
+ 					cpu_to_le16(start_seq_num << 4);
+ 
+	if (sta->sta.deflink.he_cap.has_he)
+		ieee80211_add_addbaext(skb, 0, agg_size);
+
+ 	ieee80211_tx_skb_tid(sdata, skb, tid, -1);
+ }
+ 
+@@ -460,8 +464,11 @@ static void ieee80211_send_addba_with_timeout(struct sta_info *sta,
+ 	sta->ampdu_mlme.addba_req_num[tid]++;
+ 	spin_unlock_bh(&sta->lock);
+ 
+-	if (sta->sta.deflink.he_cap.has_he) {
+	if (sta->sta.deflink.eht_cap.has_eht) {
+ 		buf_size = local->hw.max_tx_aggregation_subframes;
+	} else if (sta->sta.deflink.he_cap.has_he) {
+		buf_size = min_t(u16, local->hw.max_tx_aggregation_subframes,
+				 IEEE80211_MAX_AMPDU_BUF_HE);
+ 	} else {
+ 		/*
+ 		 * We really should use what the driver told us it will
+@@ -473,9 +480,8 @@ static void ieee80211_send_addba_with_timeout(struct sta_info *sta,
+ 	}
+ 
+ 	/* send AddBA request */
+-	ieee80211_send_addba_request(sdata, sta->sta.addr, tid,
+-				     tid_tx->dialog_token, tid_tx->ssn,
+-				     buf_size, tid_tx->timeout);
+	ieee80211_send_addba_request(sta, tid, tid_tx->dialog_token,
+				     tid_tx->ssn, buf_size, tid_tx->timeout);
+ 
+ 	WARN_ON(test_and_set_bit(HT_AGG_STATE_SENT_ADDBA, &tid_tx->state));
+ }
+@@ -970,6 +976,13 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local,
+ 	amsdu = capab & IEEE80211_ADDBA_PARAM_AMSDU_MASK;
+ 	tid = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_TID_MASK);
+ 	buf_size = u16_get_bits(capab, IEEE80211_ADDBA_PARAM_BUF_SIZE_MASK);
+
+	ieee80211_retrieve_addba_ext_data(sta,
+					  mgmt->u.action.u.addba_resp.variable,
+					  len - offsetof(typeof(*mgmt),
+							 u.action.u.addba_resp.variable),
+					  &buf_size);
+
+ 	buf_size = min(buf_size, local->hw.max_tx_aggregation_subframes);
+ 
+ 	txq = sta->sta.txq[tid];
+diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
+index 1c2b7dd8976a..32390d8a9d75 100644
+--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
+@@ -379,7 +379,7 @@ void ieee80211_ba_session_work(struct wiphy *wiphy, struct wiphy_work *work)
+ 				       sta->ampdu_mlme.tid_rx_manage_offl))
+ 			__ieee80211_start_rx_ba_session(sta, 0, 0, 0, 1, tid,
+ 							IEEE80211_MAX_AMPDU_BUF_HT,
+-							false, true, NULL);
+							false, true, 0);
+ 
+ 		if (test_and_clear_bit(tid + IEEE80211_NUM_TIDS,
+ 				       sta->ampdu_mlme.tid_rx_manage_offl))
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 7dcb46120abc..752297bcde76 100644
+--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
+@@ -2111,14 +2111,19 @@ int ieee80211_send_smps_action(struct ieee80211_sub_if_data *sdata,
+ 			       const u8 *bssid, int link_id);
+ bool ieee80211_smps_is_restrictive(enum ieee80211_smps_mode smps_mode_old,
+ 				   enum ieee80211_smps_mode smps_mode_new);
+-
+void ieee80211_add_addbaext(struct sk_buff *skb,
+			    const u8 req_addba_ext_data,
+			    u16 buf_size);
+u8 ieee80211_retrieve_addba_ext_data(struct sta_info *sta,
+				     const void *elem_data, ssize_t elem_len,
+				     u16 *buf_size);
+ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+ 				    u16 initiator, u16 reason, bool stop);
+ void __ieee80211_start_rx_ba_session(struct sta_info *sta,
+ 				     u8 dialog_token, u16 timeout,
+ 				     u16 start_seq_num, u16 ba_policy, u16 tid,
+ 				     u16 buf_size, bool tx, bool auto_seq,
+-				     const struct ieee80211_addba_ext_ie *addbaext);
+				     const u8 addba_ext_data);
+ void ieee80211_sta_tear_down_BA_sessions(struct sta_info *sta,
+ 					 enum ieee80211_agg_stop_reason reason);
+ void ieee80211_process_delba(struct ieee80211_sub_if_data *sdata,
+-- 
+2.39.5
+
--- a/package/kernel/mac80211/patches/subsys/350-wifi-mac80211-Add-link-iteration-macro-for-link-data.patch
+++ b/package/kernel/mac80211/patches/subsys/350-wifi-mac80211-Add-link-iteration-macro-for-link-data.patch
@@ -0,0 +1,47 @@
+From 4e1916dec9850cd49dd5792200ab649061cbedc1 Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Date: Fri, 18 Jul 2025 11:38:35 +0530
+Subject: [PATCH] wifi: mac80211: Add link iteration macro for link data with
+ rcu_dereference
+
+Currently, the existing macro for_each_link_data() uses sdata_dereference()
+which requires the wiphy lock. This lock cannot be used in atomic or RCU
+read-side contexts, such as in the RX path.
+
+Introduce a new macro, for_each_link_data_rcu(), that iterates over link of
+sdata using rcu_dereference(), making it safe to use in RCU contexts. This
+allows callers to access link data without requiring the wiphy lock.
+
+The macro takes into account the vif.valid_links bitmap and ensures only
+valid links are accessed safely. Callers are responsible for ensuring that
+rcu_read_lock() is held when using this macro.
+
+Signed-off-by: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250718060837.59371-3-maharaja.kennadyrajan@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/mac80211/ieee80211_i.h | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
+@@ -1220,6 +1220,19 @@ struct ieee80211_sub_if_data *vif_to_sda
+ 		    ((__link) = sdata_dereference((__sdata)->link[__link_id],	\
+ 						  (__sdata))))
+ 
+/*
+ * for_each_link_data_rcu should be used under RCU read lock.
+ */
+#define for_each_link_data_rcu(sdata, __link)					\
+	/* outer loop just to define the variable ... */			\
+	for (struct ieee80211_sub_if_data *__sdata = (sdata); __sdata;		\
+		__sdata = NULL /* always stop */)				\
+	for (int __link_id = 0;							\
+	     __link_id < ARRAY_SIZE((__sdata)->link); __link_id++)		\
+		if ((!(__sdata)->vif.valid_links ||				\
+		     (__sdata)->vif.valid_links & BIT(__link_id)) &&		\
+		    ((__link) = rcu_dereference((__sdata)->link[__link_id])))	\
+
+ static inline int
+ ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems,
+ 				struct cfg80211_rnr_elems *rnr_elems,
--- a/package/kernel/mac80211/patches/subsys/351-wifi-mac80211-extend-beacon-monitoring-for-MLO.patch
+++ b/package/kernel/mac80211/patches/subsys/351-wifi-mac80211-extend-beacon-monitoring-for-MLO.patch
@@ -0,0 +1,77 @@
+From: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Date: Fri, 18 Jul 2025 11:38:36 +0530
+Subject: [PATCH] wifi: mac80211: extend beacon monitoring for MLO
+
+Currently, reset beacon monitor (ieee80211_sta_reset_beacon_monitor())
+timer is handled only for non-AP non-MLD STA and do not support non-AP MLD
+STA. When the beacon loss occurs in non-AP MLD STA with the current
+implementation, it is treated as a single link and the timer will reset
+based on the timeout of the deflink, without checking all the links.
+
+Check the CSA flags for all the links in the MLO and decide whether to
+schedule the work queue for beacon loss. If any of the links has CSA
+active, then beacon loss work is not scheduled.
+
+Also, call the functions ieee80211_sta_reset_beacon_monitor() and
+ieee80211_sta_reset_conn_monitor() from ieee80211_csa_switch_work() only
+when all the links are CSA active.
+
+Signed-off-by: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250718060837.59371-4-maharaja.kennadyrajan@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
+@@ -2167,6 +2167,21 @@ static void ieee80211_csa_switch_work(st
+ 		}
+ 	}
+ 
+	/*
+	 * It is not necessary to reset these timers if any link does not
+	 * have an active CSA and that link still receives the beacons
+	 * when other links have active CSA.
+	 */
+	for_each_link_data(sdata, link) {
+		if (!link->conf->csa_active)
+			return;
+	}
+
+	/*
+	 * Reset the beacon monitor and connection monitor timers when CSA
+	 * is active for all links in MLO when channel switch occurs in all
+	 * the links.
+	 */
+ 	ieee80211_sta_reset_beacon_monitor(sdata);
+ 	ieee80211_sta_reset_conn_monitor(sdata);
+ }
+@@ -7892,6 +7907,29 @@ void ieee80211_sta_work(struct ieee80211
+ 	}
+ }
+ 
+static bool
+ieee80211_is_csa_in_progress(struct ieee80211_sub_if_data *sdata)
+{
+	/*
+	 * In MLO, check the CSA flags 'active' and 'waiting_bcn' for all
+	 * the links.
+	 */
+	struct ieee80211_link_data *link;
+	bool ret = true;
+
+	rcu_read_lock();
+	for_each_link_data_rcu(sdata, link) {
+		if (!(link->conf->csa_active &&
+		      !link->u.mgd.csa.waiting_bcn)) {
+			ret = false;
+			break;
+		}
+	}
+	rcu_read_unlock();
+
+	return ret;
+}
+
+ static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
+ {
+ 	struct ieee80211_sub_if_data *sdata =
--- a/package/kernel/mac80211/patches/subsys/352-wifi-mac80211-extend-connection-monitoring-for-MLO.patch
+++ b/package/kernel/mac80211/patches/subsys/352-wifi-mac80211-extend-connection-monitoring-for-MLO.patch
@@ -0,0 +1,141 @@
+From: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Date: Fri, 18 Jul 2025 11:38:37 +0530
+Subject: [PATCH] wifi: mac80211: extend connection monitoring for MLO
+
+Currently, reset connection monitor (ieee80211_sta_reset_conn_monitor())
+timer is handled only for non-AP non-MLD STA and do not support non-AP MLD
+STA. The current implementation checks for the CSA active and update the
+monitor timer with the timeout value of deflink and reset the timer based
+on the deflink's timeout value else schedule the connection loss work when
+the deflink is timed out and it won't work for the non-AP MLD STA.
+
+Handle the reset connection monitor timer for non-AP MLD STA by updating
+the monitor timer with the timeout value which is determined based on the
+link that will expire last among all the links in MLO. If at least one link
+has not timed out, the timer is updated accordingly with the latest timeout
+value else schedule the connection loss work when all links have timed out.
+
+Remove the MLO-related WARN_ON() checks in the beacon and connection
+monitoring logic code paths as they support MLO now.
+
+Signed-off-by: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250718060837.59371-5-maharaja.kennadyrajan@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
+@@ -3841,9 +3841,6 @@ static void ieee80211_mgd_probe_ap_send(
+ 
+ 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
+ 
+-	if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
+-		return;
+-
+ 	/*
+ 	 * Try sending broadcast probe requests for the last three
+ 	 * probe requests after the first ones failed since some
+@@ -3889,9 +3886,6 @@ static void ieee80211_mgd_probe_ap(struc
+ 
+ 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
+ 
+-	if (WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif)))
+-		return;
+-
+ 	if (!ieee80211_sdata_running(sdata))
+ 		return;
+ 
+@@ -7950,36 +7944,73 @@ static void ieee80211_sta_bcn_mon_timer(
+ 			 &sdata->u.mgd.beacon_connection_loss_work);
+ }
+ 
+static unsigned long
+ieee80211_latest_active_link_conn_timeout(struct ieee80211_sub_if_data *sdata)
+{
+	unsigned long latest_timeout = 0;
+	unsigned int link_id;
+	struct sta_info *sta;
+
+	rcu_read_lock();
+
+	sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
+	if (!sta)
+		goto out;
+
+	for (link_id = 0; link_id < ARRAY_SIZE(sta->link);
+	     link_id++) {
+		struct link_sta_info *link_sta;
+		unsigned long timeout;
+
+		link_sta = rcu_dereference(sta->link[link_id]);
+		if (!link_sta)
+			continue;
+
+		timeout = link_sta->status_stats.last_ack;
+		if (time_before(timeout, link_sta->rx_stats.last_rx))
+			timeout = link_sta->rx_stats.last_rx;
+
+		timeout += IEEE80211_CONNECTION_IDLE_TIME;
+
+		/*
+		 * latest_timeout holds the timeout of the link
+		 * that will expire last among all links in an
+		 * non-AP MLD STA. This ensures that the connection
+		 * monitor timer is only reset if at least one link
+		 * is still active, and it is scheduled to fire at
+		 * the latest possible timeout.
+		 */
+		if (time_is_after_jiffies(timeout) &&
+		    time_after(timeout, latest_timeout))
+			latest_timeout = timeout;
+	}
+
+out:
+	rcu_read_unlock();
+
+	return latest_timeout;
+}
+
+ static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
+ {
+ 	struct ieee80211_sub_if_data *sdata =
+ 		from_timer(sdata, t, u.mgd.conn_mon_timer);
+ 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+ 	struct ieee80211_local *local = sdata->local;
+-	struct sta_info *sta;
+-	unsigned long timeout;
+	unsigned long latest_timeout;
+ 
+-	if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
+	if (ieee80211_is_csa_in_progress(sdata))
+ 		return;
+ 
+-	if (sdata->vif.bss_conf.csa_active &&
+-	    !sdata->deflink.u.mgd.csa.waiting_bcn)
+-		return;
+-
+-	sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
+-	if (!sta)
+-		return;
+-
+-	timeout = sta->deflink.status_stats.last_ack;
+-	if (time_before(sta->deflink.status_stats.last_ack, sta->deflink.rx_stats.last_rx))
+-		timeout = sta->deflink.rx_stats.last_rx;
+-	timeout += IEEE80211_CONNECTION_IDLE_TIME;
+	latest_timeout = ieee80211_latest_active_link_conn_timeout(sdata);
+ 
+-	/* If timeout is after now, then update timer to fire at
+-	 * the later date, but do not actually probe at this time.
+-	 */
+-	if (time_is_after_jiffies(timeout)) {
+-		mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout));
+	/*
+	 * If latest timeout is after now, then update timer to fire at
+ 	 * the later date, but do not actually probe at this time.
+ 	 */
+	if (latest_timeout) {
+		mod_timer(&ifmgd->conn_mon_timer,
+			  round_jiffies_up(latest_timeout));
+ 		return;
+ 	}
+ 
--- a/package/kernel/mac80211/patches/subsys/353-wifi-mac80211-Make-CONNECTION_MONITOR-optional-for-M.patch
+++ b/package/kernel/mac80211/patches/subsys/353-wifi-mac80211-Make-CONNECTION_MONITOR-optional-for-M.patch
@@ -0,0 +1,25 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 26 Aug 2025 13:54:31 +0200
+Subject: [PATCH] wifi: mac80211: Make CONNECTION_MONITOR optional for MLO sta
+
+Since commit '1bc892d76a6f ("wifi: mac80211: extend connection
+monitoring for MLO")' mac80211 supports connection monitor for MLO
+client interfaces. Remove the CONNECTION_MONITOR requirement in
+ieee80211_register_hw routine.
+
+Fixes: 1bc892d76a6f ("wifi: mac80211: extend connection monitoring for MLO")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+
+--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
+@@ -1174,9 +1174,6 @@ int ieee80211_register_hw(struct ieee802
+ 		if (WARN_ON(!ieee80211_hw_check(hw, MFP_CAPABLE)))
+ 			return -EINVAL;
+ 
+-		if (WARN_ON(!ieee80211_hw_check(hw, CONNECTION_MONITOR)))
+-			return -EINVAL;
+-
+ 		if (WARN_ON(ieee80211_hw_check(hw, NEED_DTIM_BEFORE_ASSOC)))
+ 			return -EINVAL;
+ 
--- a/package/kernel/mac80211/patches/subsys/400-v6.16-wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch
+++ b/package/kernel/mac80211/patches/subsys/400-v6.16-wifi-mac80211-do-not-offer-a-mesh-path-if-forwarding.patch
@@ -1,56 +0,0 @@
-From 0d47666f48a084363ee54f389bec2865de4934b8 Mon Sep 17 00:00:00 2001
-From: Benjamin Berg <benjamin@sipsolutions.net>
-Date: Wed, 30 Apr 2025 20:25:38 +0200
-Subject: [PATCH] wifi: mac80211: do not offer a mesh path if forwarding is
- disabled
-
-When processing a PREQ the code would always check whether we have a
-mesh path locally and reply accordingly. However, when forwarding is
-disabled then we should not reply with this information as we will not
-forward data packets down that path.
-
-Move the check for dot11MeshForwarding up in the function and skip the
-mesh path lookup in that case. In the else block, set forward to false
-so that the rest of the function becomes a no-op and the
-dot11MeshForwarding check does not need to be duplicated.
-
-This explains an effect observed in the Freifunk community where mesh
-forwarding is disabled. In that case a mesh with three STAs and only bad
-links in between them, individual STAs would occionally have indirect
-mpath entries. This should not have happened.
-
-Signed-off-by: Benjamin Berg <benjamin@sipsolutions.net>
-Reviewed-by: Rouven Czerwinski <rouven@czerwinskis.de>
---
- net/mac80211/mesh_hwmp.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
--- a/net/mac80211/mesh_hwmp.c
-+++ b/net/mac80211/mesh_hwmp.c
-@@ -630,7 +630,7 @@ static void hwmp_preq_frame_process(stru
- 				mesh_path_add_gate(mpath);
- 		}
- 		rcu_read_unlock();
-	} else {
-+	} else if (ifmsh->mshcfg.dot11MeshForwarding) {
- 		rcu_read_lock();
- 		mpath = mesh_path_lookup(sdata, target_addr);
- 		if (mpath) {
-@@ -648,6 +648,8 @@ static void hwmp_preq_frame_process(stru
- 			}
- 		}
- 		rcu_read_unlock();
-+	} else {
-+		forward = false;
- 	}
- 
- 	if (reply) {
-@@ -665,7 +667,7 @@ static void hwmp_preq_frame_process(stru
- 		}
- 	}
- 
-	if (forward && ifmsh->mshcfg.dot11MeshForwarding) {
-+	if (forward) {
- 		u32 preq_id;
- 		u8 hopcount;
- 
--- a/package/kernel/mt76/Makefile
+++ b/package/kernel/mt76/Makefile
@@ -8,9 +8,9 @@ PKG_LICENSE_FILES:=

 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2025-02-14
-PKG_SOURCE_VERSION:=e5fef138524e63314cb96ff8314048d175294e95
-PKG_MIRROR_HASH:=4d6ea8669b3034c97f5b341a5473facf4fe21262a2fde71257b57c4d1c86be5e
+PKG_SOURCE_DATE:=2025-09-15
+PKG_SOURCE_VERSION:=6467af3bcf1154c2ceb032c903d533f0c718bbc2
+PKG_MIRROR_HASH:=98781ea57cdc97bc63ecb2c1d4004964f2a10663987887445f1c71b76610cd96

 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_USE_NINJA:=0
--- a/package/kernel/mt76/patches/100-api_compat.patch
+++ b/package/kernel/mt76/patches/100-api_compat.patch
@@ -0,0 +1,108 @@
+--- a/mt7915/main.c
+++ b/mt7915/main.c
+@@ -1224,10 +1224,9 @@ static void mt7915_sta_rc_work(void *dat
+ 
+ static void mt7915_sta_rc_update(struct ieee80211_hw *hw,
+ 				 struct ieee80211_vif *vif,
+-				 struct ieee80211_link_sta *link_sta,
+				 struct ieee80211_sta *sta,
+ 				 u32 changed)
+ {
+-	struct ieee80211_sta *sta = link_sta->sta;
+ 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+@@ -1771,7 +1770,7 @@ const struct ieee80211_ops mt7915_ops =
+ 	.stop_ap = mt7915_stop_ap,
+ 	.sta_state = mt76_sta_state,
+ 	.sta_pre_rcu_remove = mt76_sta_pre_rcu_remove,
+-	.link_sta_rc_update = mt7915_sta_rc_update,
+	.sta_rc_update = mt7915_sta_rc_update,
+ 	.set_key = mt7915_set_key,
+ 	.ampdu_action = mt7915_ampdu_action,
+ 	.set_rts_threshold = mt7915_set_rts_threshold,
+--- a/mt7996/main.c
+++ b/mt7996/main.c
+@@ -732,8 +732,7 @@ static void mt7996_configure_filter(stru
+ }
+ 
+ static int
+-mt7996_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-		   unsigned int link_id, int *dbm)
+mt7996_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif, int *dbm)
+ {
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_phy *phy = mt7996_vif_link_phy(&mvif->deflink);
+@@ -1716,26 +1715,31 @@ static void mt7996_link_rate_ctrl_update
+ 	spin_unlock_bh(&dev->mt76.sta_poll_lock);
+ }
+ 
+-static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
+-				      struct ieee80211_vif *vif,
+-				      struct ieee80211_link_sta *link_sta,
+-				      u32 changed)
+static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
+				 struct ieee80211_vif *vif,
+				 struct ieee80211_sta *sta,
+				 u32 changed)
+ {
+-	struct ieee80211_sta *sta = link_sta->sta;
+ 	struct mt7996_sta *msta = (struct mt7996_sta *)sta->drv_priv;
+-	struct mt7996_sta_link *msta_link;
+	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+	struct ieee80211_link_sta *link_sta;
+	unsigned int link_id;
+ 
+ 	rcu_read_lock();
+ 
+-	msta_link = rcu_dereference(msta->link[link_sta->link_id]);
+-	if (msta_link) {
+-		struct mt7996_dev *dev = mt7996_hw_dev(hw);
+	for_each_sta_active_link(vif, sta, link_sta, link_id) {
+		struct mt7996_sta_link *msta_link;
+
+		msta_link = rcu_dereference(msta->link[link_sta->link_id]);
+		if (!msta_link)
+			continue;
+ 
+ 		mt7996_link_rate_ctrl_update(&changed, msta_link);
+-		ieee80211_queue_work(hw, &dev->rc_work);
+ 	}
+ 
+ 	rcu_read_unlock();
+
+	ieee80211_queue_work(hw, &dev->rc_work);
+ }
+ 
+ static void mt7996_sta_rate_ctrl_update(void *data, struct ieee80211_sta *sta)
+@@ -2248,7 +2252,7 @@ const struct ieee80211_ops mt7996_ops =
+ 	.link_info_changed = mt7996_link_info_changed,
+ 	.sta_state = mt7996_sta_state,
+ 	.sta_pre_rcu_remove = mt76_sta_pre_rcu_remove,
+-	.link_sta_rc_update = mt7996_link_sta_rc_update,
+	.sta_rc_update = mt7996_sta_rc_update,
+ 	.set_key = mt7996_set_key,
+ 	.ampdu_action = mt7996_ampdu_action,
+ 	.set_rts_threshold = mt7996_set_rts_threshold,
+--- a/mac80211.c
+++ b/mac80211.c
+@@ -1752,7 +1752,7 @@ s8 mt76_get_power_bound(struct mt76_phy
+ EXPORT_SYMBOL_GPL(mt76_get_power_bound);
+ 
+ int mt76_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-		     unsigned int link_id, int *dbm)
+		     int *dbm)
+ {
+ 	struct mt76_phy *phy = mt76_vif_phy(hw, vif);
+ 	int n_chains, delta;
+--- a/mt76.h
+++ b/mt76.h
+@@ -1547,7 +1547,7 @@ int mt76_get_min_avg_rssi(struct mt76_de
+ s8 mt76_get_power_bound(struct mt76_phy *phy, s8 txpower);
+ 
+ int mt76_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-		     unsigned int link_id, int *dbm);
+		     int *dbm);
+ int mt76_init_sar_power(struct ieee80211_hw *hw,
+ 			const struct cfg80211_sar_specs *sar);
+ int mt76_get_sar_power(struct mt76_phy *phy,
--- a/package/kernel/r8125/Makefile
+++ b/package/kernel/r8125/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=r8125
-PKG_VERSION:=9.016.00
+PKG_VERSION:=9.016.01
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://github.com/openwrt/rtl8125/releases/download/$(PKG_VERSION)
-PKG_HASH:=cd1955dd07d2f5a6faaa210ffc4e8af992421295a32ab6ddcfa759bed9eba922
+PKG_HASH:=5434b26500538a62541c55cd09eea099177f59bd9cc48d16969089a9bcdbbd41

 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPLv2
--- a/package/kernel/r8125/patches/200-r8125-print-link-speed-and-duplex-mode.patch
+++ b/package/kernel/r8125/patches/200-r8125-print-link-speed-and-duplex-mode.patch
@@ -38,7 +38,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
-@@ -5045,6 +5046,38 @@ rtl8125_link_down_patch(struct net_devic
+@@ -5051,6 +5052,38 @@ rtl8125_link_down_patch(struct net_devic
 #endif
 }
 
@@ -77,7 +77,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 static void
 _rtl8125_check_link_status(struct net_device *dev, unsigned int link_state)
 {
-@@ -5057,11 +5090,18 @@ _rtl8125_check_link_status(struct net_de
+@@ -5063,11 +5096,18 @@ _rtl8125_check_link_status(struct net_de
         if (link_state == R8125_LINK_STATE_ON) {
                 rtl8125_link_on_patch(dev);
 
--- a/package/kernel/r8126/Makefile
+++ b/package/kernel/r8126/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=r8126
-PKG_VERSION:=10.015.00
-PKG_RELEASE:=3
+PKG_VERSION:=10.016.00
+PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://github.com/openwrt/rtl8126/releases/download/$(PKG_VERSION)
-PKG_HASH:=fac513aa925264a95b053e7532fcda56022d29db288f6625fafee2759a8a6124
+PKG_HASH:=50c8d3d49592d2e8f372bd7ece8e7df9b50a71b055c077d42eacc42302914440

 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPLv2
--- a/package/kernel/r8126/patches/200-r8126-print-link-speed-and-duplex-mode.patch
+++ b/package/kernel/r8126/patches/200-r8126-print-link-speed-and-duplex-mode.patch
@@ -18,7 +18,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>

 --- a/src/r8126.h
 +++ b/src/r8126.h
-@@ -1756,6 +1756,10 @@ enum RTL8126_register_content {
+@@ -1752,6 +1752,10 @@ enum RTL8126_register_content {
         LinkStatus = 0x02,
         FullDup = 0x01,
 
@@ -39,8 +39,8 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
-@@ -4661,6 +4662,40 @@ rtl8126_link_down_patch(struct net_devic
- #endif
+@@ -4410,6 +4411,40 @@ rtl8126_link_down_patch(struct net_devic
+         //rtl8126_set_speed(dev, tp->autoneg, tp->speed, tp->duplex, tp->advertising);
 }
 
 +static unsigned int rtl8126_phy_duplex(u32 status)
@@ -80,7 +80,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 static void
 _rtl8126_check_link_status(struct net_device *dev, unsigned int link_state)
 {
-@@ -4673,11 +4708,18 @@ _rtl8126_check_link_status(struct net_de
+@@ -4422,11 +4457,18 @@ _rtl8126_check_link_status(struct net_de
         if (link_state == R8126_LINK_STATE_ON) {
                 rtl8126_link_on_patch(dev);
 
--- a/package/kernel/r8127/Makefile
+++ b/package/kernel/r8127/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=r8127
-PKG_VERSION:=11.014.00
-PKG_RELEASE:=3
+PKG_VERSION:=11.015.00
+PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://github.com/openwrt/rtl8127/releases/download/$(PKG_VERSION)
-PKG_HASH:=f496bc16c32d2e8f9482c57d006604c70d9e8d55b4f1f999b88c602de9104094
+PKG_HASH:=ab21bf69368fb9de7f591b2e81cf1a815988bbf086ecbf41af7de9787b10594b

 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPLv2
--- a/package/kernel/r8127/patches/200-r8127-print-link-speed-and-duplex-mode.patch
+++ b/package/kernel/r8127/patches/200-r8127-print-link-speed-and-duplex-mode.patch
@@ -18,7 +18,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>

 --- a/src/r8127.h
 +++ b/src/r8127.h
-@@ -1753,6 +1753,11 @@ enum RTL8127_register_content {
+@@ -1770,6 +1770,11 @@ enum RTL8127_register_content {
         LinkStatus = 0x02,
         FullDup = 0x01,
 
@@ -40,7 +40,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/delay.h>
-@@ -4746,6 +4747,42 @@ rtl8127_link_down_patch(struct net_devic
+@@ -4734,6 +4735,42 @@ rtl8127_link_down_patch(struct net_devic
 #endif
 }
 
@@ -83,7 +83,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 static void
 _rtl8127_check_link_status(struct net_device *dev, unsigned int link_state)
 {
-@@ -4758,11 +4795,18 @@ _rtl8127_check_link_status(struct net_de
+@@ -4746,11 +4783,18 @@ _rtl8127_check_link_status(struct net_de
         if (link_state == R8127_LINK_STATE_ON) {
                 rtl8127_link_on_patch(dev);
 
--- a/package/kernel/r8168/Makefile
+++ b/package/kernel/r8168/Makefile
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk

 PKG_NAME:=r8168
 PKG_VERSION:=8.055.00
-PKG_RELEASE:=3
+PKG_RELEASE:=4

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://github.com/openwrt/rtl8168/releases/download/$(PKG_VERSION)
@@ -40,6 +40,7 @@ endif

 define Build/Compile
 	+$(KERNEL_MAKE) $(PKG_JOBS) \
+		$(PKG_MAKE_FLAGS) \
 		M="$(PKG_BUILD_DIR)/src" \
 		modules
 endef
--- a/package/libs/elfutils/Makefile
+++ b/package/libs/elfutils/Makefile
@@ -16,7 +16,7 @@ PKG_SOURCE_URL:=https://sourceware.org/$(PKG_NAME)/ftp/$(PKG_VERSION) \
 PKG_HASH:=616099beae24aba11f9b63d86ca6cc8d566d968b802391334c91df54eab416b4

 PKG_MAINTAINER:=Luiz Angelo Daros de Luca <luizluca@gmail.com>
-PKG_LICENSE:=GPL-3.0-or-later
+PKG_LICENSE:=GPL-2.0-or-later OR LGPL-3.0-or-later
 PKG_LICENSE_FILES:=COPYING COPYING-GPLV2 COPYING-LGPLV3
 PKG_CPE_ID:=cpe:/a:elfutils_project:elfutils

--- a/package/libs/gettext-full/Makefile
+++ b/package/libs/gettext-full/Makefile
@@ -18,7 +18,8 @@ PKG_BUILD_DIR:=$(BUILD_DIR)/gettext-$(PKG_VERSION)
 HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/gettext-$(PKG_VERSION)

 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
-PKG_LICENSE:=GPL-3.0-or-later
+PKG_LICENSE:=LGPL-2.1-or-later
+PKG_LICENSE_FILES:=gettext-runtime/intl/COPYING.LIB
 PKG_CPE_ID:=cpe:/a:gnu:gettext

 PKG_INSTALL:=1
--- a/package/libs/libubox/Makefile
+++ b/package/libs/libubox/Makefile
@@ -5,10 +5,10 @@ PKG_RELEASE=1

 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/libubox.git
-PKG_MIRROR_HASH:=e10144cfae155cf2ae5fdf167bd575dbf34c7751ddb112554b6962003f989b36
-PKG_SOURCE_DATE:=2024-12-19
+PKG_MIRROR_HASH:=51b48648a3a64eed74bcb1ab352aaad6ef7679a574df4445d2914b990aba5bbf
+PKG_SOURCE_DATE:=2025-07-23
 PKG_SOURCE_DATE_ABI:=2024-03-29
-PKG_SOURCE_VERSION:=3868f47c8f6c6570e62a3cdf8a7f26ffb1a67e6a
+PKG_SOURCE_VERSION:=49056d178f42da98048a5d4c23f83a6f6bc6dd80
 PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE_ABI))
 CMAKE_INSTALL:=1

--- a/package/libs/libxml2/Makefile
+++ b/package/libs/libxml2/Makefile
@@ -1,15 +1,15 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=libxml2
-PKG_VERSION:=2.13.6
-PKG_RELEASE:=1
+PKG_VERSION:=2.14.5
+PKG_RELEASE:=2

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNOME/libxml2/$(basename $(PKG_VERSION))
-PKG_HASH:=f453480307524968f7a04ec65e64f2a83a825973bcd260a2e7691be82ae70c96
+PKG_HASH:=03d006f3537616833c16c53addcdc32a0eb20e55443cba4038307e3fa7d8d44b

 PKG_LICENSE:=MIT
-PKG_LICENSE_FILES:=COPYING
+PKG_LICENSE_FILES:=Copyright
 PKG_CPE_ID:=cpe:/a:xmlsoft:libxml2
 HOST_BUILD_DEPENDS := libiconv-full/host

@@ -24,6 +24,7 @@ define Package/libxml2
  TITLE:=Gnome XML library
  URL:=http://xmlsoft.org/
  DEPENDS:=+libpthread +zlib $(ICONV_DEPENDS)
+  ABI_VERSION:=16
 endef

 define Package/libxml2/description
@@ -61,7 +62,7 @@ endef
 CMAKE_HOST_OPTIONS += \
 	-DBUILD_SHARED_LIBS=OFF \
 	-DLIBXML2_WITH_C14N=ON \
-	-DLIBXML2_WITH_CATALOG=OFF \
+	-DLIBXML2_WITH_CATALOG=ON \
 	-DLIBXML2_WITH_DEBUG=ON \
 	-DLIBXML2_WITH_FTP=OFF \
 	-DLIBXML2_WITH_HTML=ON \
@@ -99,7 +100,7 @@ CMAKE_HOST_OPTIONS += \
 CMAKE_OPTIONS += \
 	-DBUILD_SHARED_LIBS=ON \
 	-DLIBXML2_WITH_C14N=ON \
-	-DLIBXML2_WITH_CATALOG=OFF \
+	-DLIBXML2_WITH_CATALOG=ON \
 	-DLIBXML2_WITH_DEBUG=ON \
 	-DLIBXML2_WITH_FTP=OFF \
 	-DLIBXML2_WITH_HTML=ON \
@@ -160,9 +161,6 @@ define Build/InstallDev

 	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libxml-2.0.pc $(1)/usr/lib/pkgconfig/
-
-	$(INSTALL_DIR) $(2)/share/aclocal/
-	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/share/aclocal/* $(2)/share/aclocal
 endef

 define Host/Install
@@ -190,9 +188,6 @@ define Package/libxml2-dev/install
 	$(INSTALL_DIR) $(1)/usr/lib/{cmake,pkgconfig}
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/{cmake,pkgconfig} $(1)/usr/lib/
 	$(SED) "s,$(STAGING_DIR),,g" $(1)/usr/lib/pkgconfig/*.pc
-
-	$(INSTALL_DIR) $(1)/usr/share/aclocal
-	$(CP) $(PKG_INSTALL_DIR)/usr/share/aclocal/* $(1)/usr/share/aclocal
 endef

 define Package/libxml2-utils/install
--- a/package/libs/mbedtls/Config.in
+++ b/package/libs/mbedtls/Config.in
@@ -84,6 +84,10 @@ config MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
 	bool "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED"
 	default n

+config MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED"
+	default n
+
 comment "Curves - unselect old or less-used curves to reduce binary size"

 config MBEDTLS_ECP_DP_SECP192R1_ENABLED
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=mbedtls
-PKG_VERSION:=3.6.3
+PKG_VERSION:=3.6.4
 PKG_RELEASE:=1
 PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL=https://github.com/Mbed-TLS/$(PKG_NAME)/releases/download/$(PKG_NAME)-$(PKG_VERSION)
-PKG_HASH:=64cd73842cdc05e101172f7b437c65e7312e476206e1dbfd644433d11bc56327
+PKG_HASH:=ec35b18a6c593cf98c3e30db8b98ff93e8940a8c4e690e66b41dfc011d678110

 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=LICENSE
@@ -53,6 +53,7 @@ MBEDTLS_BUILD_OPTS_CIPHERS= \
  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \
  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED \
  CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED \
  CONFIG_MBEDTLS_NIST_KW_C \
  CONFIG_MBEDTLS_RIPEMD160_C \
  CONFIG_MBEDTLS_RSA_NO_CRT \
--- a/package/libs/openssl/Makefile
+++ b/package/libs/openssl/Makefile
@@ -8,8 +8,8 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=openssl
-PKG_VERSION:=3.0.16
-PKG_RELEASE:=1
+PKG_VERSION:=3.0.17
+PKG_RELEASE:=3
 PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto

 PKG_BUILD_PARALLEL:=1
@@ -21,10 +21,10 @@ PKG_SOURCE_URL:= \
 	https://www.openssl.org/source/old/$(PKG_BASE)/ \
 	https://github.com/openssl/openssl/releases/download/$(PKG_NAME)-$(PKG_VERSION)/

-PKG_HASH:=57e03c50feab5d31b152af2b764f10379aecd8ee92f16c985983ce4a99f7ef86
+PKG_HASH:=dfdd77e4ea1b57ff3a6dbde6b0bdc3f31db5ac99e7fdd4eaf9e1fbb6ec2db8ce

 PKG_LICENSE:=Apache-2.0
-PKG_LICENSE_FILES:=LICENSE
+PKG_LICENSE_FILES:=LICENSE.txt
 PKG_MAINTAINER:=Eneas U de Queiroz <cotequeiroz@gmail.com>
 PKG_CPE_ID:=cpe:/a:openssl:openssl
 PKG_CONFIG_DEPENDS:= \
--- a/package/libs/openssl/patches/0001-Don-t-keep-the-store-open-in-by_store_ctrl_ex.patch
+++ b/package/libs/openssl/patches/0001-Don-t-keep-the-store-open-in-by_store_ctrl_ex.patch
@@ -0,0 +1,127 @@
+From c0d968f0ac56ad507ab0101e537e7d530e9f0448 Mon Sep 17 00:00:00 2001
+From: Matt Caswell <matt@openssl.org>
+Date: Thu, 7 Aug 2025 17:50:17 +0100
+Subject: [PATCH] Don't keep the store open in by_store_ctrl_ex
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Previously #27529 made a change to `by_store_ctrl_ex` in order to open
+the OSSL_STORE early. The reason given in that PR is:
+
+"This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and
+get to see possible errors when the URI is loaded"
+
+That PR then kept the store open until cache_objects is called and then
+reused it. Unfortunately by the time cache_objects() is called we could be
+in a multi-threaded scenario where the X509_STORE is being shared by
+multiple threads. We then get a race condition where multiple threads are
+all using (and ultimately closing) the same `OSSL_STORE_CTX`.
+
+The purpose of keeping the `OSSL_STORE` object between by_store_ctrl_ex()
+and `cache_objects` is presumably an optimisation to avoid having to open
+the store twice. But this does not work because of the above issue.
+
+We just take the hit and open it again.
+
+Fixes #28171
+
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+Reviewed-by: Saša Nedvědický <sashan@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/28385)
+---
+ crypto/x509/by_store.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+--- a/crypto/x509/by_store.c
+++ b/crypto/x509/by_store.c
+@@ -17,7 +17,6 @@ typedef struct cached_store_st {
+     char *uri;
+     OSSL_LIB_CTX *libctx;
+     char *propq;
+-    OSSL_STORE_CTX *ctx;
+ } CACHED_STORE;
+ 
+ DEFINE_STACK_OF(CACHED_STORE)
+@@ -27,14 +26,12 @@ static int cache_objects(X509_LOOKUP *lc
+                          const OSSL_STORE_SEARCH *criterion, int depth)
+ {
+     int ok = 0;
+-    OSSL_STORE_CTX *ctx = store->ctx;
+    OSSL_STORE_CTX *ctx;
+     X509_STORE *xstore = X509_LOOKUP_get_store(lctx);
+ 
+-    if (ctx == NULL
+-        && (ctx = OSSL_STORE_open_ex(store->uri, store->libctx, store->propq,
+-                                     NULL, NULL, NULL, NULL, NULL)) == NULL)
+    if ((ctx = OSSL_STORE_open_ex(store->uri, store->libctx, store->propq,
+                                  NULL, NULL, NULL, NULL, NULL)) == NULL)
+         return 0;
+-    store->ctx = ctx;
+ 
+     /*
+      * We try to set the criterion, but don't care if it was valid or not.
+@@ -79,7 +76,6 @@ static int cache_objects(X509_LOOKUP *lc
+                 substore.uri = (char *)OSSL_STORE_INFO_get0_NAME(info);
+                 substore.libctx = store->libctx;
+                 substore.propq = store->propq;
+-                substore.ctx = NULL;
+                 ok = cache_objects(lctx, &substore, criterion, depth - 1);
+             }
+         } else {
+@@ -105,7 +101,6 @@ static int cache_objects(X509_LOOKUP *lc
+             break;
+     }
+     OSSL_STORE_close(ctx);
+-    store->ctx = NULL;
+ 
+     return ok;
+ }
+@@ -114,7 +109,6 @@ static int cache_objects(X509_LOOKUP *lc
+ static void free_store(CACHED_STORE *store)
+ {
+     if (store != NULL) {
+-        OSSL_STORE_close(store->ctx);
+         OPENSSL_free(store->uri);
+         OPENSSL_free(store->propq);
+         OPENSSL_free(store);
+@@ -148,6 +142,7 @@ static int by_store_ctrl_ex(X509_LOOKUP
+         {
+             STACK_OF(CACHED_STORE) *stores = X509_LOOKUP_get_method_data(ctx);
+             CACHED_STORE *store = OPENSSL_zalloc(sizeof(*store));
+            OSSL_STORE_CTX *sctx;
+ 
+             if (store == NULL) {
+                 return 0;
+@@ -157,14 +152,20 @@ static int by_store_ctrl_ex(X509_LOOKUP
+             store->libctx = libctx;
+             if (propq != NULL)
+                 store->propq = OPENSSL_strdup(propq);
+-            store->ctx = OSSL_STORE_open_ex(argp, libctx, propq, NULL, NULL,
+-                                           NULL, NULL, NULL);
+-            if (store->ctx == NULL
+            /*
+             * We open this to check for errors now - so we can report those
+             * errors early.
+             */
+            sctx = OSSL_STORE_open_ex(argp, libctx, propq, NULL, NULL,
+                                      NULL, NULL, NULL);
+            if (sctx == NULL
+                 || (propq != NULL && store->propq == NULL)
+                 || store->uri == NULL) {
+                OSSL_STORE_close(sctx);
+                 free_store(store);
+                 return use_default;
+             }
+            OSSL_STORE_close(sctx);
+ 
+             if (stores == NULL) {
+                 stores = sk_CACHED_STORE_new_null();
+@@ -184,7 +185,6 @@ static int by_store_ctrl_ex(X509_LOOKUP
+         store.uri = (char *)argp;
+         store.libctx = libctx;
+         store.propq = (char *)propq;
+-        store.ctx = NULL;
+         return cache_objects(ctx, &store, NULL, 0);
+     }
+     default:
--- a/package/libs/openssl/patches/100-Configure-afalg-support.patch
+++ b/package/libs/openssl/patches/100-Configure-afalg-support.patch
@@ -10,7 +10,7 @@ Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>

 --- a/Configure
 +++ b/Configure
-@@ -1677,7 +1677,9 @@ $config{CFLAGS} = [ map { $_ eq '--ossl-
+@@ -1678,7 +1678,9 @@ $config{CFLAGS} = [ map { $_ eq '--ossl-
 
 unless ($disabled{afalgeng}) {
     $config{afalgeng}="";
--- a/package/libs/udebug/Makefile
+++ b/package/libs/udebug/Makefile
@@ -11,9 +11,9 @@ PKG_NAME:=udebug
 CMAKE_INSTALL:=1
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/udebug.git
-PKG_MIRROR_HASH:=4dfe98b5d5813066dccd46d112502565b6961a4a7382083c529dfb423a626c2b
-PKG_SOURCE_DATE:=2023-12-06
-PKG_SOURCE_VERSION:=6d3f51f9fda706f0cf4732c762e4dbe8c21e12cf
+PKG_MIRROR_HASH:=5e7b713aa1bff3b6480d4bd94d607b9cafed787b3d1cb27513883c83e56b0273
+PKG_SOURCE_DATE:=2025-08-24
+PKG_SOURCE_VERSION:=edeb4d6dc690acb476a47e6b11633b5632b08437
 PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))

 PKG_LICENSE:=GPL-2.0
--- a/package/network/config/ltq-adsl-app/Makefile
+++ b/package/network/config/ltq-adsl-app/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=dsl_cpe_control_danube
 PKG_VERSION:=3.24.4.4
-PKG_RELEASE:=13
+PKG_RELEASE:=14
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_BUILD_DIR:=$(BUILD_DIR)/dsl_cpe_control-$(PKG_VERSION)
 PKG_SOURCE_URL:=@OPENWRT
--- a/package/network/config/ltq-vdsl-vr11-app/Makefile
+++ b/package/network/config/ltq-vdsl-vr11-app/Makefile
@@ -9,7 +9,7 @@ include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=ltq-vdsl-vr11-app
 PKG_VERSION:=4.23.1
-PKG_RELEASE:=5
+PKG_RELEASE:=6
 PKG_BASE_NAME:=dsl_cpe_control

 UGW_VERSION=8.5.2.10
--- a/package/network/config/ltq-vdsl-vr9-app/Makefile
+++ b/package/network/config/ltq-vdsl-vr9-app/Makefile
@@ -9,7 +9,7 @@ include $(INCLUDE_DIR)/kernel.mk

 PKG_NAME:=ltq-vdsl-vr9-app
 PKG_VERSION:=4.17.18.6
-PKG_RELEASE:=7
+PKG_RELEASE:=8
 PKG_BASE_NAME:=dsl_cpe_control
 PKG_SOURCE:=$(PKG_BASE_NAME)_vrx-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@OPENWRT
--- a/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c
+++ b/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c
@@ -447,7 +447,7 @@ static void pilot_tones_status(int fd) {
 }

 static void band_border_status(int fd, DSL_AccessDir_t direction) {
-	IOCTL(DSL_BandBorderStatus_t, DSL_FIO_BAND_BORDER_STATUS_GET);
+	IOCTL_DIR(DSL_BandBorderStatus_t, DSL_FIO_BAND_BORDER_STATUS_GET, direction);

 	void *c, *c2;

--- a/package/network/config/wifi-scripts/files/lib/netifd/hostapd.sh
+++ b/package/network/config/wifi-scripts/files/lib/netifd/hostapd.sh
@@ -1361,11 +1361,13 @@ wpa_supplicant_add_network() {

 	json_get_vars \
 		ssid bssid key \
-		basic_rate mcast_rate \
+		mcast_rate \
 		ieee80211w ieee80211r fils ocv \
 		multi_ap \
 		default_disabled

+	json_get_values basic_rate_list basic_rate
+
 	case "$auth_type" in
 		sae|owe|eap2|eap192)
 			set_default ieee80211w 2
@@ -1626,12 +1628,21 @@ wpa_supplicant_add_network() {
 	[ -n "$bssid_blacklist" ] && append network_data "bssid_blacklist=$bssid_blacklist" "$N$T"
 	[ -n "$bssid_whitelist" ] && append network_data "bssid_whitelist=$bssid_whitelist" "$N$T"

-	[ -n "$basic_rate" ] && {
-		local br rate_list=
-		for br in $basic_rate; do
-			wpa_supplicant_add_rate rate_list "$br"
-		done
-		[ -n "$rate_list" ] && append network_data "rates=$rate_list" "$N$T"
+	[ -n "$basic_rate_list" ] && {
+		local br rate rate_list=
+
+		if [ "$mode" = mesh ]; then
+			for br in $basic_rate_list; do
+				rate="$(($br / 100))"
+				append rate_list "$rate" " "
+			done
+			[ -n "$rate_list" ] && append network_data "mesh_basic_rates=$rate_list" "$N$T"
+		else
+			for br in $basic_rate_list; do
+				wpa_supplicant_add_rate rate_list "$br"
+			done
+			[ -n "$rate_list" ] && append network_data "rates=$rate_list" "$N$T"
+		fi
 	}

 	[ -n "$mcast_rate" ] && {
--- a/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
+++ b/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
@@ -563,6 +563,7 @@ mac80211_hostapd_setup_bss() {
 $hostapd_cfg
 bssid=$macaddr
 ${default_macaddr:+#default_macaddr}
+${random_macaddr:+#random_macaddr}
 ${dtim_period:+dtim_period=$dtim_period}
 ${max_listen_int:+max_listen_interval=$max_listen_int}
 EOF
@@ -691,12 +692,14 @@ mac80211_prepare_vif() {
 	json_add_string _ifname "$ifname"

 	default_macaddr=
+	random_macaddr=
 	if [ -z "$macaddr" ]; then
 		macaddr="$(mac80211_generate_mac $phy)"
 		macidx="$(($macidx + 1))"
 		default_macaddr=1
 	elif [ "$macaddr" = 'random' ]; then
 		macaddr="$(macaddr_random)"
+		random_macaddr=1
 	fi
 	json_add_string _macaddr "$macaddr"
 	json_add_string _default_macaddr "$default_macaddr"
--- a/package/network/services/hostapd/files/hostapd.uc
+++ b/package/network/services/hostapd/files/hostapd.uc
@@ -485,7 +485,9 @@ function iface_reload_config(name, phydev, config, old_config)

 		// try to preserve MAC address of this BSS by reassigning another
 		// BSS if necessary
-		if (cur_config.default_macaddr &&
+		if ((cur_config.default_macaddr || cur_config.random_macaddr) &&
+		    cur_config.random_macaddr == prev_config.random_macaddr &&
+		    cur_config.default_macaddr == prev_config.default_macaddr &&
 		    !macaddr_list[prev_config.bssid]) {
 			macaddr_list[prev_config.bssid] = i;
 			cur_config.bssid = prev_config.bssid;
@@ -761,6 +763,8 @@ function iface_load_config(phy, radio, filename)
 	while ((line = rtrim(f.read("line"), "\n")) != null) {
 		if (line == "#default_macaddr")
 			bss.default_macaddr = true;
+		if (line == "#random_macaddr")
+			bss.random_macaddr = true;

 		let val = split(line, "=", 2);
 		if (!val[0])
--- a/Show More
+++ b/Show More