Merge Official Source

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

package/boot/uboot-tools/uboot-envtools/files/mediatek_filogic

@@ -113,6 +113,8 @@ konka,komi-a31)
 	;;
 buffalo,wsr-3000ax4p|\
 buffalo,wsr-6000ax8|\
+elecom,wrc-x6000gsd|\
+elecom,wrc-x6000qs|\
 mercusys,mr80x-v3|\
 mercusys,mr85x|\
 mercusys,mr90x-v1|\

package/boot/uboot-tools/uboot-envtools/files/mpc85xx

@@ -9,8 +9,8 @@ board=$(board_name)
 
 case "$board" in
 enterasys,ws-ap3715i)
-	ubootenv_add_uci_config "$(find_mtd_part 'cfg1')" "0x0" "0x10000" "0x10000"
+	ubootenv_add_uci_config "/dev/mtd$(find_mtd_index 'cfg1')" "0x0" "0x1000" "0x10000"
-	ubootenv_add_uci_config "$(find_mtd_part 'cfg2')" "0x0" "0x10000" "0x10000"
+	ubootenv_add_uci_config "/dev/mtd$(find_mtd_index 'cfg2')" "0x0" "0x1000" "0x10000"
 	;;
 extreme-networks,ws-ap3825i)
 	ubootenv_add_uci_config "$(find_mtd_part 'cfg1')" "0x0" "0x10000" "0x20000"

package/kernel/linux/modules/netsupport.mk

@@ -1129,27 +1129,6 @@ endef
 $(eval $(call KernelPackage,tcp-scalable))
 
 
-define KernelPackage/ax25
-  SUBMENU:=$(NETWORK_SUPPORT_MENU)
-  TITLE:=AX25 support
-  DEPENDS:=+kmod-lib-crc16
-  KCONFIG:= \
-	CONFIG_HAMRADIO=y \
-	CONFIG_AX25 \
-	CONFIG_MKISS
-  FILES:= \
-	$(LINUX_DIR)/net/ax25/ax25.ko \
-	$(LINUX_DIR)/drivers/net/hamradio/mkiss.ko
-  AUTOLOAD:=$(call AutoLoad,80,ax25 mkiss)
-endef
-
-define KernelPackage/ax25/description
- Kernel modules for AX25 support
-endef
-
-$(eval $(call KernelPackage,ax25))
-
-
 define KernelPackage/pktgen
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   DEPENDS:=@!TARGET_uml

package/kernel/mac80211/Makefile

@@ -10,13 +10,13 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=6.18.7
+PKG_VERSION:=6.18.26
 PKG_RELEASE:=1
 PKG_LICENSE:=GPL-2.0-only
 PKG_LICENSE_FILES:=COPYING
 
 PKG_SOURCE_URL:=https://github.com/openwrt/backports/releases/download/backports-v$(PKG_VERSION)
-PKG_HASH:=623e5cf46ca8e81fd413f4f465e2580a0143e24929f9c22ce1ba7c34f2872989
+PKG_HASH:=2ad578c6cae22f192fefd44e1449725228d4109ee781998b41dcbae872554968
 
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.zst
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(if $(BUILD_VARIANT),$(PKG_NAME)-$(BUILD_VARIANT)/)backports-$(PKG_VERSION)

package/kernel/mac80211/patches/ath11k/100-wifi-ath11k-use-unique-QRTR-instance-ID.patch

@@ -49,7 +49,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 
 --- a/drivers/net/wireless/ath/ath11k/mhi.c
 +++ b/drivers/net/wireless/ath/ath11k/mhi.c
-@@ -239,6 +239,34 @@ static void ath11k_mhi_op_runtime_put(st
+@@ -235,6 +235,34 @@ static void ath11k_mhi_op_runtime_put(st
  {
  }
  
@@ -84,7 +84,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
  static char *ath11k_mhi_op_callback_to_str(enum mhi_callback reason)
  {
  	switch (reason) {
-@@ -260,6 +288,8 @@ static char *ath11k_mhi_op_callback_to_s
+@@ -256,6 +284,8 @@ static char *ath11k_mhi_op_callback_to_s
  		return "MHI_CB_FATAL_ERROR";
  	case MHI_CB_BW_REQ:
  		return "MHI_CB_BW_REQ";
@@ -93,7 +93,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
  	default:
  		return "UNKNOWN";
  	}
-@@ -290,6 +320,9 @@ static void ath11k_mhi_op_status_cb(stru
+@@ -286,6 +316,9 @@ static void ath11k_mhi_op_status_cb(stru
  			queue_work(ab->workqueue_aux, &ab->reset_work);
  
  		break;
@@ -103,7 +103,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
  	default:
  		break;
  	}
-@@ -297,22 +330,6 @@ static void ath11k_mhi_op_status_cb(stru
+@@ -293,22 +326,6 @@ static void ath11k_mhi_op_status_cb(stru
  	ab_pci->mhi_pre_cb = cb;
  }
  

package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch

@@ -31,7 +31,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
  	{
  		.hw_rev = ATH11K_HW_IPQ8074,
  		.name = "ipq8074 hw2.0",
-@@ -2521,7 +2521,8 @@ static void ath11k_core_reset(struct wor
+@@ -2576,7 +2576,8 @@ static void ath11k_core_reset(struct wor
  static int ath11k_init_hw_params(struct ath11k_base *ab)
  {
  	const struct ath11k_hw_params *hw_params = NULL;
@@ -41,7 +41,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
  
  	for (i = 0; i < ARRAY_SIZE(ath11k_hw_params); i++) {
  		hw_params = &ath11k_hw_params[i];
-@@ -2537,7 +2538,31 @@ static int ath11k_init_hw_params(struct
+@@ -2592,7 +2593,31 @@ static int ath11k_init_hw_params(struct
  
  	ab->hw_params = *hw_params;
  

package/kernel/mac80211/patches/ath11k/905-ath11k-remove-intersection-support-for-regulatory-ru.patch

@@ -291,9 +291,9 @@ Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
  	int pdev_idx;
  	struct ath11k *ar;
  	enum wmi_vdev_type vdev_type;
-@@ -929,24 +772,14 @@ int ath11k_reg_handle_chan_list(struct a
+@@ -932,24 +775,14 @@ int ath11k_reg_handle_chan_list(struct a
- 		    (char *)reg_info->alpha2, 2))
+ 		return 0;
- 		goto retfail;
+ 	}
  
 -	/* Intersect new rules with default regd if a new country setting was
 -	 * requested, i.e a default regd was already set during initialization

package/kernel/mac80211/patches/ath11k/949-wifi-ath11k-fix-monitor-rx-pktlen.patch

@@ -24,7 +24,7 @@ to the monitor RX delivery path.
 
 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c
 +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
-@@ -4931,8 +4931,13 @@ ath11k_dp_rx_mon_merg_msdus(struct ath11
+@@ -4930,8 +4930,13 @@ ath11k_dp_rx_mon_merg_msdus(struct ath11
  		}
  
  		prev_buf->next = NULL;
@@ -39,7 +39,7 @@ to the monitor RX delivery path.
  	} else if (decap_format == DP_RX_DECAP_TYPE_NATIVE_WIFI) {
  		u8 qos_pkt = 0;
  
-@@ -4958,10 +4963,13 @@ ath11k_dp_rx_mon_merg_msdus(struct ath11
+@@ -4957,10 +4962,13 @@ ath11k_dp_rx_mon_merg_msdus(struct ath11
  			prev_buf = msdu;
  			msdu = msdu->next;
  		}
@@ -57,7 +57,7 @@ to the monitor RX delivery path.
  		ath11k_dbg(ab, ATH11K_DBG_DATA,
  			   "mpdu_buf %p mpdu_buf->len %u",
  			   prev_buf, prev_buf->len);
-@@ -5086,12 +5094,27 @@ static int ath11k_dp_rx_mon_deliver(stru
+@@ -5085,12 +5093,27 @@ static int ath11k_dp_rx_mon_deliver(stru
  
  	header = mon_skb;
  

package/kernel/mac80211/patches/ath12k/001-v7.1-wifi-ath12k-add-basic-hwmon-temperature-reporting.patch

@@ -101,7 +101,7 @@ Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
  struct ath12k_hw {
 --- a/drivers/net/wireless/ath/ath12k/mac.c
 +++ b/drivers/net/wireless/ath/ath12k/mac.c
-@@ -14057,6 +14057,10 @@ static void ath12k_mac_setup(struct ath1
+@@ -14063,6 +14063,10 @@ static void ath12k_mac_setup(struct ath1
  	init_completion(&ar->mlo_setup_done);
  	init_completion(&ar->completed_11d_scan);
  	init_completion(&ar->regd_update_completed);
@@ -294,7 +294,7 @@ Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
 +#endif /* _ATH12K_THERMAL_ */
 --- a/drivers/net/wireless/ath/ath12k/wmi.c
 +++ b/drivers/net/wireless/ath/ath12k/wmi.c
-@@ -6674,31 +6674,6 @@ static int ath12k_pull_peer_assoc_conf_e
+@@ -6673,31 +6673,6 @@ static int ath12k_pull_peer_assoc_conf_e
  	return 0;
  }
  
@@ -326,7 +326,7 @@ Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
  static void ath12k_wmi_op_ep_tx_credits(struct ath12k_base *ab)
  {
  	/* try to send pending beacons first. they take priority */
-@@ -8713,25 +8688,45 @@ static void
+@@ -8712,25 +8687,45 @@ static void
  ath12k_wmi_pdev_temperature_event(struct ath12k_base *ab,
  				  struct sk_buff *skb)
  {

package/kernel/mac80211/patches/ath12k/102-wifi-ath12k-limit-WMI_SCAN_CHAN_LIST_CMDID-arg.patch

@@ -130,7 +130,7 @@ Best regards,
 
 --- a/drivers/net/wireless/ath/ath12k/wmi.c
 +++ b/drivers/net/wireless/ath/ath12k/wmi.c
-@@ -2894,6 +2894,9 @@ int ath12k_wmi_send_scan_chan_list_cmd(s
+@@ -2900,6 +2900,9 @@ int ath12k_wmi_send_scan_chan_list_cmd(s
  		max_chan_limit = (wmi->wmi_ab->max_msg_len[ar->pdev_idx] - len) /
  			sizeof(*chan_info);
  

package/kernel/mac80211/patches/ath12k/103-wifi-ath12k-fix-5GHz-operation-on-wideband-QCN.patch

@@ -124,7 +124,7 @@ Best regards,
 
 --- a/drivers/net/wireless/ath/ath12k/mac.c
 +++ b/drivers/net/wireless/ath/ath12k/mac.c
-@@ -7724,9 +7724,7 @@ static void ath12k_mac_setup_ht_vht_cap(
+@@ -7727,9 +7727,7 @@ static void ath12k_mac_setup_ht_vht_cap(
  						    rate_cap_rx_chainmask);
  	}
  

package/kernel/mac80211/patches/ath9k/550-ath9k-of.patch

@@ -166,7 +166,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2429,6 +2429,7 @@ static bool ath9k_hw_dfs_tested(struct ath_hw *ah)
+@@ -2481,6 +2481,7 @@ static bool ath9k_hw_dfs_tested(struct a
  static void ath9k_gpio_cap_init(struct ath_hw *ah)
  {
  	struct ath9k_hw_capabilities *pCap = &ah->caps;
@@ -174,7 +174,7 @@
  
  	if (AR_SREV_9271(ah)) {
  		pCap->num_gpio_pins = AR9271_NUM_GPIO;
-@@ -2479,6 +2480,12 @@ static void ath9k_gpio_cap_init(struct ath_hw *ah)
+@@ -2531,6 +2532,12 @@ static void ath9k_gpio_cap_init(struct a
  		pCap->num_gpio_pins = AR_NUM_GPIO;
  		pCap->gpio_mask = AR_GPIO_MASK;
  	}

package/kernel/mac80211/patches/brcm/870-04-rpi-6.12-brcmfmac-non-upstream-support-DS1-exit-firmware-re-download.patch

@@ -518,7 +518,7 @@ JIRA: SWWLAN-136577
  	/* ready */
  	return;
  
-@@ -4649,3 +4860,40 @@ int brcmf_sdio_sleep(struct brcmf_sdio *
+@@ -4650,3 +4861,40 @@ int brcmf_sdio_sleep(struct brcmf_sdio *
  
  	return ret;
  }

package/kernel/mac80211/patches/build/210-wireless_netns_local_backport.patch

@@ -40,7 +40,7 @@
  		}
  
  		return err;
-@@ -1550,7 +1566,11 @@ static int cfg80211_netdev_notifier_call
+@@ -1549,7 +1565,11 @@ static int cfg80211_netdev_notifier_call
  		SET_NETDEV_DEVTYPE(dev, &wiphy_type);
  		wdev->netdev = dev;
  		/* can only change netns with wiphy */

package/kernel/mac80211/patches/build/230-fix-init_vqs-build-error-on-kernel-6.6.patch

@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/virtual/mac80211_hwsim.c
 +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
-@@ -6927,6 +6927,7 @@ static void hwsim_virtio_rx_done(struct
+@@ -6926,6 +6926,7 @@ static void hwsim_virtio_rx_done(struct
  
  static int init_vqs(struct virtio_device *vdev)
  {
@@ -8,7 +8,7 @@
  	struct virtqueue_info vqs_info[HWSIM_NUM_VQS] = {
  		[HWSIM_VQ_TX] = { "tx", hwsim_virtio_tx_done },
  		[HWSIM_VQ_RX] = { "rx", hwsim_virtio_rx_done },
-@@ -6934,6 +6935,19 @@ static int init_vqs(struct virtio_device
+@@ -6933,6 +6934,19 @@ static int init_vqs(struct virtio_device
  
  	return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
  			       hwsim_vqs, vqs_info, NULL);

package/kernel/mac80211/patches/build/300-backports-handle-genlmsg_multicast_allns-upstream-ba.patch

@@ -44,7 +44,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 +compat-$(CPTCFG_KERNEL_6_1) += backport-genetlink.o
  compat-$(CPTCFG_KERNEL_6_4) += backport-6.4.o
  compat-$(CPTCFG_KERNEL_6_11) += backport-6.11.o
- 
+ compat-$(CPTCFG_KERNEL_6_14) += backport-faux.o
 --- a/compat/backport-genetlink.c
 +++ b/compat/backport-genetlink.c
 @@ -17,6 +17,7 @@

package/kernel/mac80211/patches/build/410-mac80211-convert-short-fops-to-debugfs-files.patch

@@ -58,7 +58,7 @@
  	.llseek = default_llseek,
  };
  
-@@ -348,9 +353,10 @@ static ssize_t aql_enable_write(struct f
+@@ -344,9 +349,10 @@ static ssize_t aql_enable_write(struct f
  	return count;
  }
  
@@ -70,7 +70,7 @@
  	.llseek = default_llseek,
  };
  
-@@ -398,9 +404,10 @@ static ssize_t force_tx_status_write(str
+@@ -394,9 +400,10 @@ static ssize_t force_tx_status_write(str
  	return count;
  }
  
@@ -82,7 +82,7 @@
  	.llseek = default_llseek,
  };
  
-@@ -425,8 +432,9 @@ static ssize_t reset_write(struct file *
+@@ -421,8 +428,9 @@ static ssize_t reset_write(struct file *
  	return count;
  }
  
@@ -93,7 +93,7 @@
  	.llseek = noop_llseek,
  };
  #endif
-@@ -653,8 +661,9 @@ static ssize_t stats_ ##name## _read(str
+@@ -649,8 +657,9 @@ static ssize_t stats_ ##name## _read(str
  				      print_devstats_##name);		\
  }									\
  									\

package/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patch

@@ -9,9 +9,9 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnect
 
 --- a/net/mac80211/cfg.c
 +++ b/net/mac80211/cfg.c
-@@ -1872,12 +1872,6 @@ static int ieee80211_stop_ap(struct wiph
+@@ -1883,12 +1883,6 @@ static int ieee80211_stop_ap(struct wiph
- 
+ 	ieee80211_link_info_change_notify(sdata, link,
- 	__sta_info_flush(sdata, true, link_id, NULL);
+ 					  BSS_CHANGED_BEACON_ENABLED);
  
 -	ieee80211_remove_link_keys(link, &keys);
 -	if (!list_empty(&keys)) {
@@ -19,6 +19,6 @@ Used for AP+STA support in OpenWrt - preserve AP mode keys across STA reconnect
 -		ieee80211_free_key_list(local, &keys);
 -	}
 -
- 	ieee80211_stop_mbssid(sdata);
+ 	if (sdata->wdev.links[link_id].cac_started) {
- 	RCU_INIT_POINTER(link_conf->tx_bss_conf, NULL);
+ 		chandef = link_conf->chanreq.oper;
- 
+ 		wiphy_delayed_work_cancel(wiphy, &link->dfs_cac_timer_work);

package/kernel/mac80211/patches/subsys/220-allow-ibss-mixed.patch

@@ -16,7 +16,7 @@ and we should ignore this.
 
 --- a/net/wireless/core.c
 +++ b/net/wireless/core.c
-@@ -679,21 +679,6 @@ int wiphy_verify_iface_combinations(stru
+@@ -675,21 +675,6 @@ int wiphy_verify_iface_combinations(stru
  				    c->limits[j].max > 1))
  				return -EINVAL;
  

package/kernel/mac80211/patches/subsys/230-avoid-crashing-missing-band.patch

@@ -18,7 +18,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2526,6 +2526,13 @@ static void sta_stats_decode_rate(struct
+@@ -2527,6 +2527,13 @@ static void sta_stats_decode_rate(struct
  
  		sband = local->hw.wiphy->bands[band];
  

package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch

@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4086,7 +4086,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4088,7 +4088,7 @@ struct ieee80211_txq *ieee80211_next_txq
  
  		if (deficit < 0)
  			sta->airtime[txqi->txq.ac].deficit +=
@@ -32,7 +32,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  		if (deficit < 0 || !aql_check) {
  			list_move_tail(&txqi->schedule_order,
-@@ -4231,7 +4231,8 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4233,7 +4233,8 @@ bool ieee80211_txq_may_transmit(struct i
  		}
  		sta = container_of(iter->txq.sta, struct sta_info, sta);
  		if (ieee80211_sta_deficit(sta, ac) < 0)
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
  	}
  
-@@ -4239,7 +4240,7 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4241,7 +4242,7 @@ bool ieee80211_txq_may_transmit(struct i
  	if (sta->airtime[ac].deficit >= 0)
  		goto out;
  

package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch

@@ -70,7 +70,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1428,10 +1428,12 @@ struct ieee80211_local {
+@@ -1426,10 +1426,12 @@ struct ieee80211_local {
  	spinlock_t handle_wake_tx_queue_lock;
  
  	u16 airtime_flags;
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		spin_lock_init(&local->active_txq_lock[i]);
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2431,13 +2431,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggre
+@@ -2432,13 +2432,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggre
  
  void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
  					  struct sta_info *sta, u8 ac,
@@ -127,7 +127,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			atomic_add(tx_airtime,
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -2556,7 +2556,7 @@ static u16 ieee80211_store_ack_skb(struc
+@@ -2558,7 +2558,7 @@ static u16 ieee80211_store_ack_skb(struc
  
  		spin_lock_irqsave(&local->ack_status_lock, flags);
  		id = idr_alloc(&local->ack_status_frames, ack_skb,
@@ -136,7 +136,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		spin_unlock_irqrestore(&local->ack_status_lock, flags);
  
  		if (id >= 0) {
-@@ -3987,20 +3987,20 @@ begin:
+@@ -3989,20 +3989,20 @@ begin:
  encap_out:
  	info->control.vif = vif;
  
@@ -167,7 +167,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  
  	return skb;
-@@ -4052,6 +4052,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4054,6 +4054,7 @@ struct ieee80211_txq *ieee80211_next_txq
  	struct ieee80211_txq *ret = NULL;
  	struct txq_info *txqi = NULL, *head = NULL;
  	bool found_eligible_txq = false;
@@ -175,7 +175,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	spin_lock_bh(&local->active_txq_lock[ac]);
  
-@@ -4075,26 +4076,26 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4077,26 +4078,26 @@ struct ieee80211_txq *ieee80211_next_txq
  	if (!head)
  		head = txqi;
  
@@ -214,7 +214,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (txqi->schedule_round == local->schedule_round[ac])
  		goto out;
  
-@@ -4161,7 +4162,8 @@ bool ieee80211_txq_airtime_check(struct
+@@ -4163,7 +4164,8 @@ bool ieee80211_txq_airtime_check(struct
  		return true;
  
  	if (!txq->sta)
@@ -224,7 +224,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
  		return true;
-@@ -4210,15 +4212,15 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4212,15 +4214,15 @@ bool ieee80211_txq_may_transmit(struct i
  
  	spin_lock_bh(&local->active_txq_lock[ac]);
  

package/kernel/mac80211/patches/subsys/330-mac80211-fix-crash-in-ieee80211_chan_bw_change-for-A.patch

@@ -1,39 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Thu, 5 Mar 2026 17:04:11 +0000
-Subject: [PATCH] mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN
- stations
-
-ieee80211_chan_bw_change() iterates all stations and accesses
-link->reserved.oper via sta->sdata->link[link_id]. For stations on
-AP_VLAN interfaces (e.g. 4addr WDS clients), sta->sdata points to
-the VLAN sdata, whose link never participates in chanctx reservations.
-This leaves link->reserved.oper zero-initialized with chan == NULL,
-causing a NULL pointer dereference in __ieee80211_sta_cap_rx_bw()
-when accessing chandef->chan->band during CSA.
-
-Resolve the VLAN sdata to its parent AP sdata using get_bss_sdata()
-before accessing link data.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/chan.c
-+++ b/net/mac80211/chan.c
-@@ -441,13 +441,15 @@ static void ieee80211_chan_bw_change(str
- 	rcu_read_lock();
- 	list_for_each_entry_rcu(sta, &local->sta_list,
- 				list) {
--		struct ieee80211_sub_if_data *sdata = sta->sdata;
-+		struct ieee80211_sub_if_data *sdata;
- 		enum ieee80211_sta_rx_bandwidth new_sta_bw;
- 		unsigned int link_id;
- 
- 		if (!ieee80211_sdata_running(sta->sdata))
- 			continue;
- 
-+		sdata = get_bss_sdata(sta->sdata);
-+
- 		for (link_id = 0; link_id < ARRAY_SIZE(sta->sdata->link); link_id++) {
- 			struct ieee80211_link_data *link =
- 				rcu_dereference(sdata->link[link_id]);

package/kernel/mac80211/patches/subsys/350-mac80211-allow-scanning-while-on-radar-channel.patch

@@ -97,7 +97,7 @@
  	return false;
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2022,6 +2022,13 @@ int ieee80211_mesh_finish_csa(struct iee
+@@ -2020,6 +2020,13 @@ int ieee80211_mesh_finish_csa(struct iee
  			      u64 *changed);
  
  /* scan/BSS handling */
@@ -111,7 +111,7 @@
  void ieee80211_scan_work(struct wiphy *wiphy, struct wiphy_work *work);
  int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
  				const u8 *ssid, u8 ssid_len,
-@@ -2060,6 +2067,7 @@ void ieee80211_sched_scan_stopped_work(s
+@@ -2058,6 +2065,7 @@ void ieee80211_sched_scan_stopped_work(s
  /* off-channel/mgmt-tx */
  void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local);
  void ieee80211_offchannel_return(struct ieee80211_local *local);
@@ -119,7 +119,7 @@
  void ieee80211_roc_setup(struct ieee80211_local *local);
  void ieee80211_start_next_roc(struct ieee80211_local *local);
  void ieee80211_reconfig_roc(struct ieee80211_local *local);
-@@ -2719,6 +2727,8 @@ bool ieee80211_chandef_s1g_oper(struct i
+@@ -2717,6 +2725,8 @@ bool ieee80211_chandef_s1g_oper(struct i
  				struct cfg80211_chan_def *chandef);
  void ieee80211_chandef_downgrade(struct cfg80211_chan_def *chandef,
  				 struct ieee80211_conn_settings *conn);
@@ -128,7 +128,7 @@
  static inline void
  ieee80211_chanreq_downgrade(struct ieee80211_chan_req *chanreq,
  			    struct ieee80211_conn_settings *conn)
-@@ -2775,7 +2785,7 @@ void ieee80211_recalc_chanctx_min_def(st
+@@ -2773,7 +2783,7 @@ void ieee80211_recalc_chanctx_min_def(st
  				      struct ieee80211_chanctx *ctx,
  				      struct ieee80211_link_data *rsvd_for,
  				      bool check_reserved);
@@ -211,7 +211,7 @@
  			list_add_tail(&roc->list, &local->roc_list);
 --- a/net/mac80211/scan.c
 +++ b/net/mac80211/scan.c
-@@ -586,25 +586,72 @@ static int ieee80211_start_sw_scan(struc
+@@ -591,25 +591,72 @@ static int ieee80211_start_sw_scan(struc
  	return 0;
  }
  
@@ -289,7 +289,7 @@
  	}
  
  	return true;
-@@ -612,12 +659,12 @@ static bool __ieee80211_can_leave_ch(str
+@@ -617,12 +664,12 @@ static bool __ieee80211_can_leave_ch(str
  
  static bool ieee80211_can_scan(struct ieee80211_local *local,
  			       struct ieee80211_sub_if_data *sdata,
@@ -307,7 +307,7 @@
  		return false;
  
  	if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-@@ -629,19 +676,22 @@ static bool ieee80211_can_scan(struct ie
+@@ -634,19 +681,22 @@ static bool ieee80211_can_scan(struct ie
  
  void ieee80211_run_deferred_scan(struct ieee80211_local *local)
  {
@@ -337,7 +337,7 @@
  		return;
  
  	wiphy_delayed_work_queue(local->hw.wiphy, &local->scan_work,
-@@ -724,6 +774,7 @@ static int __ieee80211_start_scan(struct
+@@ -729,6 +779,7 @@ static int __ieee80211_start_scan(struct
  {
  	struct ieee80211_local *local = sdata->local;
  	bool hw_scan = local->ops->hw_scan;
@@ -345,7 +345,7 @@
  	int rc;
  
  	lockdep_assert_wiphy(local->hw.wiphy);
-@@ -738,10 +789,11 @@ static int __ieee80211_start_scan(struct
+@@ -743,10 +794,11 @@ static int __ieee80211_start_scan(struct
  	    !(sdata->vif.active_links & BIT(req->tsf_report_link_id)))
  		return -EINVAL;
  
@@ -387,7 +387,7 @@
   * the suspend->resume cycle. Since we can't check each caller
 --- a/net/wireless/util.c
 +++ b/net/wireless/util.c
-@@ -2943,6 +2943,9 @@ bool cfg80211_radio_chandef_valid(const
+@@ -2945,6 +2945,9 @@ bool cfg80211_radio_chandef_valid(const
  {
  	u32 freq, width;
  

package/kernel/mac80211/patches/subsys/360-mac80211-factor-out-part-of-ieee80211_calc_expected_.patch

@@ -126,7 +126,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2839,6 +2839,11 @@ u8 *ieee80211_get_bssid(struct ieee80211
+@@ -2837,6 +2837,11 @@ u8 *ieee80211_get_bssid(struct ieee80211
  
  extern const struct ethtool_ops ieee80211_ethtool_ops;
  

package/kernel/mac80211/patches/subsys/361-mac80211-estimate-expected-throughput-if-not-provide.patch

@@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2977,6 +2977,29 @@ static void sta_set_link_sinfo(struct st
+@@ -2980,6 +2980,29 @@ static void sta_set_link_sinfo(struct st
  	}
  }
  
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo,
  		   bool tidstats)
  {
-@@ -3201,6 +3224,8 @@ void sta_set_sinfo(struct sta_info *sta,
+@@ -3205,6 +3228,8 @@ void sta_set_sinfo(struct sta_info *sta,
  		sinfo->sta_flags.set |= BIT(NL80211_STA_FLAG_TDLS_PEER);
  
  	thr = sta_get_expected_throughput(sta);

package/kernel/mac80211/patches/subsys/371-wifi-mac80211-Add-eMLSR-eMLMR-action-frame-parsing-s.patch

@@ -320,7 +320,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 +}
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -2859,6 +2859,8 @@ void ieee80211_destroy_frag_cache(struct
+@@ -2857,6 +2857,8 @@ void ieee80211_destroy_frag_cache(struct
  
  u8 ieee80211_ie_len_eht_cap(struct ieee80211_sub_if_data *sdata);
  
@@ -331,7 +331,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  				    struct ieee80211_supported_band *sband,
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -1630,7 +1630,15 @@ static void ieee80211_iface_process_skb(
+@@ -1634,7 +1634,15 @@ static void ieee80211_iface_process_skb(
  		}
  	} else if (ieee80211_is_action(mgmt->frame_control) &&
  		   mgmt->u.action.category == WLAN_CATEGORY_PROTECTED_EHT) {

package/kernel/mac80211/patches/subsys/380-mac80211-report-assoc_link_id-in-station-info-for-no.patch

@@ -19,7 +19,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -3252,7 +3252,10 @@ void sta_set_sinfo(struct sta_info *sta,
+@@ -3256,7 +3256,10 @@ void sta_set_sinfo(struct sta_info *sta,
  		struct link_sta_info *link_sta;
  		int link_id;
  

package/libs/mbedtls/Makefile

@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mbedtls
 PKG_VERSION:=3.6.6
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2

package/libs/mbedtls/patches/001-ssl-accept-TLS-1.2-rsa_pss_rsae-signature-schemes.patch

@@ -0,0 +1,84 @@
+From c4738fab064f018aa251577fae9399040a86bc33 Mon Sep 17 00:00:00 2001
+From: Viktor Sokolovskiy <maokaman@gmail.com>
+Date: Sat, 4 Apr 2026 03:57:04 +0300
+Subject: [PATCH] ssl: accept TLS 1.2 rsa_pss_rsae signature schemes
+
+Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
+(cherry picked from commit c064ba0edb86e44f3c1c8dcaf05b1139407eebd4)
+---
+ ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt |  3 +++
+ library/ssl_misc.h                        | 19 +++++++++++++++++++
+ tests/suites/test_suite_ssl.data          | 12 ++++++++++++
+ tests/suites/test_suite_ssl.function      |  8 ++++++++
+ 4 files changed, 42 insertions(+)
+ create mode 100644 ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt
+
+--- /dev/null
++++ b/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt
+@@ -0,0 +1,3 @@
++Bugfix
++   * Fix a TLS 1.2 regression that caused clients to reject valid
++     ServerKeyExchange signatures using RSA-PSS signature scheme values.
+--- a/library/ssl_misc.h
++++ b/library/ssl_misc.h
+@@ -2591,6 +2591,25 @@ static inline int mbedtls_ssl_get_pk_typ
+ static inline int mbedtls_ssl_tls12_sig_alg_is_supported(
+     const uint16_t sig_alg)
+ {
++#if defined(PSA_WANT_ALG_RSA_PSS)
++    switch (sig_alg) {
++#if defined(PSA_WANT_ALG_SHA_256)
++        case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
++            return 1;
++#endif
++#if defined(PSA_WANT_ALG_SHA_384)
++        case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
++            return 1;
++#endif
++#if defined(PSA_WANT_ALG_SHA_512)
++        case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
++            return 1;
++#endif
++        default:
++            break;
++    }
++#endif /* PSA_WANT_ALG_RSA_PSS */
++
+     /* High byte is hash */
+     unsigned char hash = MBEDTLS_BYTE_1(sig_alg);
+     unsigned char sig = MBEDTLS_BYTE_0(sig_alg);
+--- a/tests/suites/test_suite_ssl.data
++++ b/tests/suites/test_suite_ssl.data
+@@ -3546,3 +3546,15 @@ send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECD
+ 
+ Default verify_result before doing a handshake
+ verify_result_without_handshake
++
++TLS 1.2 accepts rsa_pss_rsae_sha256 in signature_algorithm
++depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_256
++ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:1
++
++TLS 1.2 accepts rsa_pss_rsae_sha384 in signature_algorithm
++depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_384
++ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:1
++
++TLS 1.2 accepts rsa_pss_rsae_sha512 in signature_algorithm
++depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_512
++ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:1
+--- a/tests/suites/test_suite_ssl.function
++++ b/tests/suites/test_suite_ssl.function
+@@ -5861,6 +5861,14 @@ exit:
+ }
+ /* END_CASE */
+ 
++/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
++void ssl_tls12_sig_alg_supported(int sig_alg, int expected)
++{
++    TEST_EQUAL(mbedtls_ssl_tls12_sig_alg_is_supported((uint16_t) sig_alg),
++               expected);
++}
++/* END_CASE */
++
+ /* BEGIN_CASE depends_on:MBEDTLS_SSL_KEYING_MATERIAL_EXPORT:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */
+ void ssl_tls_exporter_consistent_result(int proto, int exported_key_length, int use_context)
+ {

package/libs/mbedtls/patches/002-ssl-narrow-TLS-1.2-RSA-PSS-handling-and-add-interop-.patch

@@ -0,0 +1,236 @@
+From 3833db7c7cb167e8eda2ec5e07da70cd834e88d4 Mon Sep 17 00:00:00 2001
+From: Viktor Sokolovskiy <maokaman@gmail.com>
+Date: Fri, 17 Apr 2026 18:52:34 +0300
+Subject: [PATCH] ssl: narrow TLS 1.2 RSA-PSS handling and add interop coverage
+
+Narrow TLS 1.2 RSA-PSS handling to the client ServerKeyExchange parse path and add OpenSSL and GnuTLS interoperability tests.
+
+Signed-off-by: Viktor Sokolovskiy <maokaman@gmail.com>
+---
+ ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt |  3 +-
+ library/ssl_misc.h                        | 19 -------
+ library/ssl_tls12_client.c                | 63 +++++++++++++++++++----
+ tests/ssl-opt.sh                          | 38 +++++++++++++-
+ tests/suites/test_suite_ssl.data          | 12 -----
+ tests/suites/test_suite_ssl.function      |  8 ---
+ 6 files changed, 91 insertions(+), 52 deletions(-)
+
+--- a/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt
++++ b/ChangeLog.d/fix-tls12-rsa-pss-sigalgs.txt
+@@ -1,3 +1,4 @@
+ Bugfix
+    * Fix a TLS 1.2 regression that caused clients to reject valid
+-     ServerKeyExchange signatures using RSA-PSS signature scheme values.
++     ServerKeyExchange signatures using RSA-PSS signature algorithms.
++     Fixes #10668.
+--- a/library/ssl_misc.h
++++ b/library/ssl_misc.h
+@@ -2591,25 +2591,6 @@ static inline int mbedtls_ssl_get_pk_typ
+ static inline int mbedtls_ssl_tls12_sig_alg_is_supported(
+     const uint16_t sig_alg)
+ {
+-#if defined(PSA_WANT_ALG_RSA_PSS)
+-    switch (sig_alg) {
+-#if defined(PSA_WANT_ALG_SHA_256)
+-        case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
+-            return 1;
+-#endif
+-#if defined(PSA_WANT_ALG_SHA_384)
+-        case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
+-            return 1;
+-#endif
+-#if defined(PSA_WANT_ALG_SHA_512)
+-        case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
+-            return 1;
+-#endif
+-        default:
+-            break;
+-    }
+-#endif /* PSA_WANT_ALG_RSA_PSS */
+-
+     /* High byte is hash */
+     unsigned char hash = MBEDTLS_BYTE_1(sig_alg);
+     unsigned char sig = MBEDTLS_BYTE_0(sig_alg);
+--- a/library/ssl_tls12_client.c
++++ b/library/ssl_tls12_client.c
+@@ -13,6 +13,7 @@
+ 
+ #include "mbedtls/ssl.h"
+ #include "ssl_client.h"
++#include "ssl_debug_helpers.h"
+ #include "ssl_misc.h"
+ #include "debug_internal.h"
+ #include "mbedtls/error.h"
+@@ -2087,32 +2088,72 @@ static int ssl_parse_signature_algorithm
+ {
+     if (mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg(sig_alg, pk_alg, md_alg) != 0) {
+         MBEDTLS_SSL_DEBUG_MSG(1,
+-                              ("Server used unsupported value in SigAlg extension 0x%04x",
+-                               sig_alg));
++                              ("Server used unsupported %s signature algorithm",
++                               mbedtls_ssl_sig_alg_to_str(sig_alg)));
+         return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
+     }
+ 
+     /*
+-     * mbedtls_ssl_get_pk_sigalg_and_md_alg_from_sig_alg() understands sig_alg code points across
+-     * TLS versions. Make sure that the received sig_alg extension is valid in TLS 1.2.
++     * mbedtls_ssl_get_pk_type_and_md_alg_from_sig_alg() understands
++     * signature algorithm code points from both TLS 1.2 and TLS 1.3. Make sure
++     * that the selected signature algorithm is acceptable when TLS 1.2 is
++     * negotiated.
++     *
++     * In TLS 1.2, RSA-PSS signature algorithms (rsa_pss_rsae_*) are not
++     * defined by RFC 5246. However, RFC 8446 Section 4.2.3 requires that
++     * implementations which advertise support for RSASSA-PSS must be
++     * prepared to accept such signatures even when TLS 1.2 is negotiated,
++     * provided they were offered in the signature_algorithms extension.
++     *
++     * Therefore, we allow rsa_pss_rsae_* here if:
++     *  - the implementation supports them, and
++     *  - they were offered in the signature_algorithms extension (checked by
++     *    `mbedtls_ssl_sig_alg_is_offered()` below).
++     *
++     * If we were to add full support for rsa_pss_rsae_* signature algorithms
++     * in TLS 1.2, we should then integrate RSA-PSS into the TLS 1.2 signature
++     * algorithm support logic (`mbedtls_ssl_tls12_sig_alg_is_supported()`)
++     * instead of handling it as a special case here.
+      */
+     if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) {
+-        MBEDTLS_SSL_DEBUG_MSG(1,
+-                              ("Server used unsupported value in SigAlg extension 0x%04x",
+-                               sig_alg));
+-        return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
++        switch (sig_alg) {
++#if defined(PSA_WANT_ALG_RSA_PSS)
++#if defined(PSA_WANT_ALG_SHA_256)
++            case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:
++#endif
++#if defined(PSA_WANT_ALG_SHA_384)
++            case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:
++#endif
++#if defined(PSA_WANT_ALG_SHA_512)
++            case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:
++#endif
++#if defined(PSA_WANT_ALG_SHA_256) || defined(PSA_WANT_ALG_SHA_384) || defined(PSA_WANT_ALG_SHA_512)
++                MBEDTLS_SSL_DEBUG_MSG(3,
++                                      ("Accepting TLS 1.2 RSA-PSS signature algorithm %s via compatibility exception",
++                                       mbedtls_ssl_sig_alg_to_str(sig_alg)));
++                break;
++#endif
++#endif /* PSA_WANT_ALG_RSA_PSS */
++            default:
++                MBEDTLS_SSL_DEBUG_MSG(1,
++                                      ("Server used unsupported %s signature algorithm",
++                                       mbedtls_ssl_sig_alg_to_str(sig_alg)));
++                return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
++        }
+     }
+ 
+     /*
+      * Check if the signature algorithm is acceptable
+      */
+     if (!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) {
+-        MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value 0x%04x that was not offered", sig_alg));
++        MBEDTLS_SSL_DEBUG_MSG(1,
++                              ("Server used the signature algorithm %s that was not offered",
++                               mbedtls_ssl_sig_alg_to_str(sig_alg)));
+         return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER;
+     }
+ 
+-    MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", sig_alg & 0x00FF));
+-    MBEDTLS_SSL_DEBUG_MSG(2, ("Server used HashAlgorithm %d", sig_alg >> 8));
++    MBEDTLS_SSL_DEBUG_MSG(2, ("Server used the signature algorithm %s",
++                              mbedtls_ssl_sig_alg_to_str(sig_alg)));
+ 
+     return 0;
+ }
+--- a/tests/ssl-opt.sh
++++ b/tests/ssl-opt.sh
+@@ -14948,7 +14948,6 @@ run_test    "TLS 1.2: Check rsa_pss_rsae
+             -c "Protocol is TLSv1.2" \
+             -c "HTTP/1.0 200 [Oo][Kk]"
+ 
+-
+ requires_gnutls_tls1_3
+ requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
+ requires_config_enabled MBEDTLS_DEBUG_C
+@@ -14964,6 +14963,43 @@ run_test    "TLS 1.2: Check rsa_pss_rsae
+             -c "Protocol is TLSv1.2" \
+             -c "HTTP/1.0 200 [Oo][Kk]"
+ 
++requires_openssl_tls1_3_with_compatible_ephemeral
++requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
++requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
++requires_config_enabled MBEDTLS_DEBUG_C
++requires_config_enabled MBEDTLS_SSL_CLI_C
++requires_config_enabled PSA_WANT_ALG_RSA_PSS
++requires_config_enabled PSA_WANT_ALG_SHA_256
++run_test    "TLS 1.2: Server forces TLS 1.2 and rsa_pss_rsae_sha256, m->O" \
++            "$O_NEXT_SRV_NO_CERT -cert $DATA_FILES_PATH/server2-sha256.crt -key $DATA_FILES_PATH/server2.key
++                                 -tls1_2 -sigalgs rsa_pss_rsae_sha256 " \
++            "$P_CLI debug_level=3" \
++            0 \
++            -c "sent signature scheme \\[804\\] rsa_pss_rsae_sha256" \
++            -c "Perform .* computation of digest of ServerKeyExchange" \
++            -c "Server used the signature algorithm rsa_pss_rsae_sha256" \
++            -c "Protocol is TLSv1.2" \
++            -c "HTTP/1.0 200 [Oo][Kk]"
++
++requires_gnutls_tls1_3
++requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_2
++requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3
++requires_config_enabled MBEDTLS_DEBUG_C
++requires_config_enabled MBEDTLS_SSL_CLI_C
++requires_config_enabled PSA_WANT_ALG_RSA_PSS
++requires_config_enabled PSA_WANT_ALG_SHA_256
++run_test    "TLS 1.2: Server forces TLS 1.2 and rsa_pss_rsae_sha256, m->G" \
++            "$G_NEXT_SRV_NO_CERT --x509certfile $DATA_FILES_PATH/server2-sha256.crt --x509keyfile $DATA_FILES_PATH/server2.key
++                    --disable-client-cert
++                    --priority=NORMAL:-VERS-ALL:+VERS-TLS1.2:-SIGN-ALL:+SIGN-RSA-PSS-RSAE-SHA256" \
++            "$P_CLI debug_level=3" \
++            0 \
++            -c "sent signature scheme \\[804\\] rsa_pss_rsae_sha256" \
++            -c "Perform .* computation of digest of ServerKeyExchange" \
++            -c "Server used the signature algorithm rsa_pss_rsae_sha256" \
++            -c "Protocol is TLSv1.2" \
++            -c "HTTP/1.0 200 [Oo][Kk]"
++
+ requires_config_enabled MBEDTLS_SSL_SRV_C
+ requires_config_enabled MBEDTLS_DEBUG_C
+ requires_config_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED
+--- a/tests/suites/test_suite_ssl.data
++++ b/tests/suites/test_suite_ssl.data
+@@ -3546,15 +3546,3 @@ send_invalid_sig_alg:MBEDTLS_SSL_SIG_ECD
+ 
+ Default verify_result before doing a handshake
+ verify_result_without_handshake
+-
+-TLS 1.2 accepts rsa_pss_rsae_sha256 in signature_algorithm
+-depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_256
+-ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256:1
+-
+-TLS 1.2 accepts rsa_pss_rsae_sha384 in signature_algorithm
+-depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_384
+-ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384:1
+-
+-TLS 1.2 accepts rsa_pss_rsae_sha512 in signature_algorithm
+-depends_on:PSA_WANT_ALG_RSA_PSS:PSA_WANT_ALG_SHA_512
+-ssl_tls12_sig_alg_supported:MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512:1
+--- a/tests/suites/test_suite_ssl.function
++++ b/tests/suites/test_suite_ssl.function
+@@ -5861,14 +5861,6 @@ exit:
+ }
+ /* END_CASE */
+ 
+-/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_2:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
+-void ssl_tls12_sig_alg_supported(int sig_alg, int expected)
+-{
+-    TEST_EQUAL(mbedtls_ssl_tls12_sig_alg_is_supported((uint16_t) sig_alg),
+-               expected);
+-}
+-/* END_CASE */
+-
+ /* BEGIN_CASE depends_on:MBEDTLS_SSL_KEYING_MATERIAL_EXPORT:MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED:PSA_WANT_ECC_SECP_R1_384:PSA_WANT_ALG_SHA_256 */
+ void ssl_tls_exporter_consistent_result(int proto, int exported_key_length, int use_context)
+ {

package/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json

@@ -962,10 +962,10 @@
 		"rsn_preauth": {
 			"type": "boolean"
 		},
-		"rsn_override": {
+		"sae_ext_key": {
-			"type": "number",
+			"description": "Advertise the SAE-EXT-KEY AKM alongside plain SAE. Mandatory for EHT, enabled by default.",
-			"description": "Use RSNE override IE WPA3 compatibility (0: disabled, 1: enabled, 2:force WPA2 for older devices)",
+			"type": "boolean",
-			"default": 1
+			"default": true
 		},
 		"sae_password_file": {
 			"description": "External file containing VLAN SAE MAC address triplets",
@@ -1040,6 +1040,14 @@
 			"description": "Local time zone as specified in 8.3 of IEEE Std 1003.1-2004",
 			"type": "string"
 		},
+		"transition_disable": {
+			"description": "Transition modes the AP signals as disabled per WPA3 v3.5 §13. Entries 'sae', 'sae-pk', 'wpa3', 'owe' are OR'd into the bitmap; 'on' (or '1') derives it from auth_type; 'off' (or '0') suppresses the element. Unset by default.",
+			"type": "array",
+			"items": {
+				"type": "string",
+				"enum": [ "on", "off", "0", "1", "sae", "sae-pk", "wpa3", "owe" ]
+			}
+		},
 		"uapsd": {
 			"type": "alias",
 			"default": "uapsd_advertisement_enabled"

package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc

@@ -57,7 +57,7 @@ function iface_setup(config) {
 		'disassoc_low_ack', 'skip_inactivity_poll', 'ignore_broadcast_ssid', 'uapsd_advertisement_enabled',
 		'utf8_ssid', 'multi_ap', 'multi_ap_vlanid', 'multi_ap_profile', 'tdls_prohibit', 'bridge',
 		'wds_sta', 'wds_bridge', 'snoop_iface', 'vendor_elements', 'nas_identifier', 'radius_acct_interim_interval',
-		'ocv', 'beacon_prot', 'spp_amsdu', 'multicast_to_unicast', 'preamble', 'proxy_arp', 'per_sta_vif', 'mbo',
+		'ocv', 'spp_amsdu', 'multicast_to_unicast', 'preamble', 'proxy_arp', 'per_sta_vif', 'mbo',
 		'bss_transition', 'wnm_sleep_mode', 'wnm_sleep_mode_no_keys', 'qos_map_set', 'max_listen_int',
 		'dtim_period', 'wmm_enabled', 'start_disabled', 'na_mcast_to_ucast', 'no_probe_resp_if_max_sta',
 	]);
@@ -81,21 +81,39 @@ function iface_accounting_server(config) {
 	append_vars(config, [ 'radius_acct_req_attr' ]);
 }
 
-function iface_auth_type(config) {
+function iface_auth_type(config, band) {
-	if (config.auth_type in [ 'sae', 'owe', 'eap2', 'eap192', 'dpp' ]) {
+	if (config.auth_type in [ 'sae', 'owe', 'eap2', 'eap192', 'dpp' ])
 		config.ieee80211w = 2;
-		config.sae_require_mfp = 1;
+
-		if (!config.ppsk)
+	if (config.auth_type in [ 'psk-sae', 'eap-eap2' ])
-			set_default(config, 'sae_pwe', 2);
+		set_default(config, 'ieee80211w', 1);
+
+	if (config.auth_type == 'psk-sae-compat') {
+		if (band == '6g') {
+			set_default(config, 'ieee80211w', 2);
+		} else {
+			set_default(config, 'ieee80211w', 0);
+			config.rsn_override_mfp = 2;
+			config.rsn_override_omit_rsnxe = 1;
+		}
+		if (config.rsn_override_pairwise_2)
+			config.rsn_override_mfp_2 = 2;
 	}
 
-	if (config.auth_type in [ 'psk-sae', 'eap-eap2' ]) {
+	if (config.auth_type == 'owe') {
-		set_default(config, 'ieee80211w', 1);
+		set_default(config, 'owe_groups', '19 20 21');
-		if (config.rsn_override)
+		set_default(config, 'owe_ptk_workaround', 1);
-			config.rsn_override_mfp = 2;
+	}
+
+	if (config.auth_type in [ 'sae', 'psk-sae', 'psk-sae-compat' ]) {
 		config.sae_require_mfp = 1;
-		if (!config.ppsk)
+		set_default(config, 'sae_groups', '19 20 21');
-			set_default(config, 'sae_pwe', 2);
+		if (!config.ppsk) {
+			if (band == '6g')
+				set_default(config, 'sae_pwe', 1);
+			else
+				set_default(config, 'sae_pwe', 2);
+		}
 	}
 
 	if (config.own_ip_addr)
@@ -126,6 +144,7 @@ function iface_auth_type(config) {
 	case 'psk2':
 	case 'sae':
 	case 'psk-sae':
+	case 'psk-sae-compat':
 		config.vlan_possible = 1;
 		config.wps_possible = 1;
 
@@ -141,12 +160,12 @@ function iface_auth_type(config) {
 			 netifd.setup_failed('INVALID_WPA_PSK');
 		}
 
-		if (config.auth_type in [ 'psk', 'psk-sae' ]) {
+		if (config.auth_type in [ 'psk', 'psk-sae', 'psk-sae-compat' ] && band != '6g') {
 			set_default(config, 'wpa_psk_file', `/var/run/hostapd-${config.ifname}.psk`);
 			touch_file(config.wpa_psk_file);
 		}
 
-		if (config.auth_type in [ 'sae', 'psk-sae' ]) {
+		if (config.auth_type in [ 'sae', 'psk-sae', 'psk-sae-compat' ]) {
 			set_default(config, 'sae_password_file', `/var/run/hostapd-${config.ifname}.sae`);
 			touch_file(config.sae_password_file);
 		}
@@ -186,11 +205,11 @@ function iface_auth_type(config) {
 	}
 
 	append_vars(config, [
-		'sae_require_mfp', 'sae_password_file', 'sae_pwe', 'sae_track_password', 'time_advertisement', 'time_zone',
+		'sae_require_mfp', 'sae_password_file', 'sae_pwe', 'sae_groups', 'sae_track_password', 'time_advertisement', 'time_zone',
 		'wpa_group_rekey', 'wpa_ptk_rekey', 'wpa_gmk_rekey', 'wpa_strict_rekey',
 		'macaddr_acl', 'wpa_psk_radius', 'wpa_psk', 'wpa_passphrase', 'wpa_psk_file',
 		'eapol_version', 'dynamic_vlan', 'radius_request_cui', 'eap_reauth_period',
-		'radius_das_client', 'radius_das_port', 'own_ip_addr', 'dynamic_own_ip_addr',
+		'radius_das_client', 'radius_das_port', 'owe_groups', 'owe_ptk_workaround', 'own_ip_addr', 'dynamic_own_ip_addr',
 		'wpa_disable_eapol_key_retries', 'auth_algs', 'wpa', 'wpa_pairwise',
 		'erp_domain', 'fils_realm', 'erp_send_reauth_start', 'fils_cache_id'
 	]);
@@ -202,7 +221,7 @@ function iface_auth_type(config) {
 }
 
 function iface_ppsk(config) {
-	if (!(config.auth_type in [ 'none', 'owe', 'psk', 'sae', 'psk-sae', 'wep' ]) || !config.auth_server_addr)
+	if (!(config.auth_type in [ 'none', 'owe', 'psk', 'sae', 'psk-sae', 'psk-sae-compat', 'wep' ]) || !config.auth_server_addr)
 		return;
 
 	iface_authentication_server(config);
@@ -405,22 +424,74 @@ function iface_roaming(config) {
 	]);
 }
 
+function default_group_mgmt_cipher(config) {
+	let p = ' ' + (config.wpa_pairwise ?? '') + ' ';
+
+	if (wildcard(p, '* CCMP *') || wildcard(p, '* TKIP *'))
+		return 'AES-128-CMAC';
+	if (wildcard(p, '* CCMP-256 *'))
+		return 'BIP-CMAC-256';
+	if (wildcard(p, '* GCMP *'))
+		return 'BIP-GMAC-128';
+	if (wildcard(p, '* GCMP-256 *'))
+		return 'BIP-GMAC-256';
+	return 'AES-128-CMAC';
+}
+
 function iface_mfp(config) {
-	if (!config.ieee80211w || config.wpa < 2) {
+	let override_mfp = config.rsn_override_mfp || config.rsn_override_mfp_2;
+
+	if ((!config.ieee80211w && !override_mfp) || config.wpa < 2) {
 		append('ieee80211w', 0);
 		return;
 	}
 
-	if (config.auth_type == 'eap192')
+	config.group_mgmt_cipher = config.ieee80211w_mgmt_cipher ?? default_group_mgmt_cipher(config);
-		config.group_mgmt_cipher = 'BIP-GMAC-256';
+
-	else
+	set_default(config, 'beacon_prot', 1);
-		config.group_mgmt_cipher = config.ieee80211w_mgmt_cipher ?? 'AES-128-CMAC';
 
 	append_vars(config, [
-		'ieee80211w', 'group_mgmt_cipher', 'assoc_sa_query_max_timeout', 'assoc_sa_query_retry_timeout'
+		'ieee80211w', 'group_mgmt_cipher', 'beacon_prot',
+		'assoc_sa_query_max_timeout', 'assoc_sa_query_retry_timeout'
 	]);
 }
 
+function iface_transition_disable(config) {
+	if (config.wpa < 2)
+		return;
+
+	let list = config.transition_disable;
+	if (!list || !length(list))
+		return;
+
+	for (let s in list)
+		if (s == 'off' || s == '0')
+			return;
+
+	let bits = 0;
+	for (let s in list) {
+		if (s == 'on' || s == '1') {
+			bits = 0;
+			switch (config.auth_type) {
+			case 'sae':    bits = 0x01; break;
+			case 'eap2':
+			case 'eap192': bits = 0x04; break;
+			case 'owe':    if (!config.owe_transition) bits = 0x08; break;
+			}
+			break;
+		}
+		switch (s) {
+		case 'sae':    bits |= 0x01; break;
+		case 'sae-pk': bits |= 0x02; break;
+		case 'wpa3':   bits |= 0x04; break;
+		case 'owe':    bits |= 0x08; break;
+		}
+	}
+
+	if (bits)
+		append('transition_disable', sprintf('0x%02x', bits));
+}
+
 function iface_key_caching(config) {
 	if (config.wpa < 2)
 		return;
@@ -433,7 +504,7 @@ function iface_key_caching(config) {
 			'rsn_preauth', 'rsn_preauth_interfaces'
 		]);
 	} else {
-		set_default(config, 'okc', (config.auth_type in  [ 'sae', 'psk-sae', 'owe' ]));
+		set_default(config, 'okc', (config.auth_type in  [ 'sae', 'psk-sae', 'psk-sae-compat', 'owe' ]));
 	}
 
 	if (!config.okc && !config.fils)
@@ -488,12 +559,12 @@ export function generate(interface, data, config, vlans, stas, phy_features) {
 			config.auth_type = 'eap2';
 	}
 
-	if (config.auth_type in [ 'psk', 'psk-sae' ])
+	if (config.auth_type in [ 'psk', 'psk-sae', 'psk-sae-compat' ] && data.config.band != '6g')
 		iface_wpa_stations(config, stas);
-	if (config.auth_type in [ 'sae', 'psk-sae' ])
+	if (config.auth_type in [ 'sae', 'psk-sae', 'psk-sae-compat' ])
 		iface_sae_stations(config, stas);
 
-	iface_auth_type(config);
+	iface_auth_type(config, data.config.band);
 
 	iface_accounting_server(config);
 
@@ -515,38 +586,37 @@ export function generate(interface, data, config, vlans, stas, phy_features) {
 
 	iface_mfp(config);
 
+	iface_transition_disable(config);
+
 	iface_key_caching(config);
 
 	iface_hs20(config);
 
 	iface_interworking(config);
 
-	iface.wpa_key_mgmt(config);
+	iface.wpa_key_mgmt(config, data.config.band);
 	append_vars(config, [
 		'wpa_key_mgmt',
 	]);
 
-	if (config.rsn_override_key_mgmt || config.rsn_override_pairwise) {
+	if (config.rsn_override_key_mgmt && config.rsn_override_pairwise && config.rsn_override_mfp) {
-		config.rsn_override_mfp ??= config.ieee80211w;
-		config.rsn_override_key_mgmt ??= config.wpa_key_mgmt;
-		config.rsn_override_pairwise ??= config.wpa_pairwise;
 		append_vars(config, [
 			'rsn_override_key_mgmt',
 			'rsn_override_pairwise',
 			'rsn_override_mfp'
 		]);
+	}
 
-		if (config.mlo) {
+	if (config.rsn_override_key_mgmt_2 && config.rsn_override_pairwise_2 && config.rsn_override_mfp_2) {
-			config.rsn_override_mfp_2 ??= config.rsn_override_mfp;
+		append_vars(config, [
-			config.rsn_override_key_mgmt_2 ??= config.rsn_override_key_mgmt;
+			'rsn_override_key_mgmt_2',
-			config.rsn_override_pairwise_2 ??= config.rsn_override_pairwise;
+			'rsn_override_pairwise_2',
+			'rsn_override_mfp_2'
+		]);
+	}
 
-			append_vars(config, [
+	if (config.rsn_override_omit_rsnxe) {
-				'rsn_override_key_mgmt_2',
+		append_vars(config, ['rsn_override_omit_rsnxe']);
-				'rsn_override_pairwise_2',
-				'rsn_override_mfp_2'
-			]);
-		}
 	}
 
 	/* raw options */

package/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uc

@@ -17,16 +17,8 @@ export function parse_encryption(config, dev_config) {
 			break;
 		}
 
-	config.wpa_pairwise = null;
-	if (config.wpa)
-		config.wpa_pairwise = (config.hw_mode == 'ad') ? 'GCMP' : 'CCMP';
-
 	config.auth_type = encryption[0] ?? 'none';
 
-	let wpa3_pairwise = config.wpa_pairwise;
-	if (wildcard(dev_config?.htmode, 'EHT*') || wildcard(dev_config?.htmode, 'HE*'))
-		wpa3_pairwise = 'GCMP-256 ' + wpa3_pairwise;
-
 	switch(config.auth_type) {
 	case 'owe':
 		config.auth_type = 'owe';
@@ -38,6 +30,7 @@ export function parse_encryption(config, dev_config) {
 
 	case 'wpa3-192':
 		config.auth_type = 'eap192';
+		config.wpa_pairwise = 'GCMP-256';
 		break;
 
 	case 'wpa3-mixed':
@@ -52,7 +45,6 @@ export function parse_encryption(config, dev_config) {
 	case 'psk2':
 	case 'psk-mixed':
 		config.auth_type = 'psk';
-		wpa3_pairwise = null;
 		break;
 
 	case 'sae':
@@ -65,16 +57,19 @@ export function parse_encryption(config, dev_config) {
 		config.auth_type = 'psk-sae';
 		break;
 
+	case 'sae-compat':
+		config.auth_type = 'psk-sae-compat';
+		config.wpa_pairwise = 'CCMP';
+		if (dev_config.band != '6g')
+			config.rsn_override_pairwise = 'CCMP';
+		if (wildcard(dev_config.htmode ?? '', 'EHT*'))
+			config.rsn_override_pairwise_2 = 'GCMP-256';
+		break;
+
 	case 'wpa':
 	case 'wpa2':
 	case 'wpa-mixed':
 		config.auth_type = 'eap';
-		wpa3_pairwise = null;
-		break;
-
-	default:
-		config.wpa_pairwise = null;
-		wpa3_pairwise = null;
 		break;
 	}
 
@@ -106,26 +101,19 @@ export function parse_encryption(config, dev_config) {
 	case 'gcmp':
 		config.wpa_pairwise = 'GCMP';
 		break;
-
-	default:
-		if (config.encryption == 'wpa3-192') {
-			config.wpa_pairwise = 'GCMP-256';
-			break;
-		}
-
-		if (!wpa3_pairwise)
-			break;
-
-		if (config.rsn_override && wpa3_pairwise != config.wpa_pairwise)
-			config.rsn_override_pairwise = wpa3_pairwise;
-		else
-			config.wpa_pairwise = wpa3_pairwise;
-		break;
 	}
 
+	if (!config.wpa)
+		config.wpa_pairwise ??= null;
+	else if (config.hw_mode == 'ad')
+		config.wpa_pairwise ??= 'GCMP';
+	else if (wildcard(dev_config?.htmode, 'EHT*') || wildcard(dev_config?.htmode, 'HE*'))
+		config.wpa_pairwise ??= 'GCMP-256 CCMP';
+	else
+		config.wpa_pairwise ??= 'CCMP';
 };
 
-export function wpa_key_mgmt(config) {
+export function wpa_key_mgmt(config, band) {
 	if (!config.wpa)
 		return;
 
@@ -158,9 +146,6 @@ export function wpa_key_mgmt(config) {
 		if (config.ieee80211r)
 			append_value(config, 'wpa_key_mgmt', 'FT-EAP');
 
-		if (config.rsn_override)
-			config.rsn_override_key_mgmt = config.wpa_key_mgmt;
-
 		append_value(config, 'wpa_key_mgmt', 'WPA-EAP');
 		break;
 
@@ -172,26 +157,25 @@ export function wpa_key_mgmt(config) {
 
 	case 'sae':
 		append_value(config, 'wpa_key_mgmt', 'SAE');
-		if (config.ieee80211r)
+		if (config.sae_ext_key)
+			append_value(config, 'wpa_key_mgmt', 'SAE-EXT-KEY');
+		if (config.ieee80211r) {
 			append_value(config, 'wpa_key_mgmt', 'FT-SAE');
+			if (config.sae_ext_key)
+				append_value(config, 'wpa_key_mgmt', 'FT-SAE-EXT-KEY');
+		}
 		break;
 
 	case 'psk-sae':
 		append_value(config, 'wpa_key_mgmt', 'SAE');
-		if (config.ieee80211r)
+		if (config.sae_ext_key)
+			append_value(config, 'wpa_key_mgmt', 'SAE-EXT-KEY');
+		if (config.ieee80211r) {
 			append_value(config, 'wpa_key_mgmt', 'FT-SAE');
-
+			if (config.sae_ext_key)
-		if (config.rsn_override) {
+				append_value(config, 'wpa_key_mgmt', 'FT-SAE-EXT-KEY');
-			config.rsn_override_key_mgmt = config.wpa_key_mgmt;
-
-			append_value(config, 'rsn_override_key_mgmt_2', 'SAE-EXT-KEY');
-			if (config.ieee80211r)
-				append_value(config, 'rsn_override_key_mgmt_2', 'FT-SAE-EXT-KEY');
 		}
 
-		if (config.rsn_override > 1)
-			delete config.wpa_key_mgmt;
-
 		append_value(config, 'wpa_key_mgmt', 'WPA-PSK');
 		if (config.ieee80211w)
 			append_value(config, 'wpa_key_mgmt', 'WPA-PSK-SHA256');
@@ -199,6 +183,36 @@ export function wpa_key_mgmt(config) {
 			append_value(config, 'wpa_key_mgmt', 'FT-PSK');
 		break;
 
+	case 'psk-sae-compat':
+		if (band == '6g') {
+			append_value(config, 'wpa_key_mgmt', 'SAE');
+			if (config.ieee80211r)
+				append_value(config, 'wpa_key_mgmt', 'FT-SAE');
+
+			if (config.sae_ext_key && config.rsn_override_pairwise_2) {
+				append_value(config, 'rsn_override_key_mgmt_2', 'SAE-EXT-KEY');
+				if (config.ieee80211r)
+					append_value(config, 'rsn_override_key_mgmt_2', 'FT-SAE-EXT-KEY');
+			}
+		} else {
+			append_value(config, 'wpa_key_mgmt', 'WPA-PSK');
+			if (config.ieee80211w)
+				append_value(config, 'wpa_key_mgmt', 'WPA-PSK-SHA256');
+			if (config.ieee80211r)
+				append_value(config, 'wpa_key_mgmt', 'FT-PSK');
+
+			append_value(config, 'rsn_override_key_mgmt', 'SAE');
+			if (config.ieee80211r)
+				append_value(config, 'rsn_override_key_mgmt', 'FT-SAE');
+
+			if (config.sae_ext_key && config.rsn_override_pairwise_2) {
+				append_value(config, 'rsn_override_key_mgmt_2', 'SAE-EXT-KEY');
+				if (config.ieee80211r)
+					append_value(config, 'rsn_override_key_mgmt_2', 'FT-SAE-EXT-KEY');
+			}
+		}
+		break;
+
 	case 'owe':
 		append_value(config, 'wpa_key_mgmt', 'OWE');
 		break;
@@ -225,13 +239,6 @@ export function wpa_key_mgmt(config) {
 			append_value(config, 'wpa_key_mgmt', 'FILS-SHA256');
 			if (config.ieee80211r)
 				append_value(config, 'wpa_key_mgmt', 'FT-FILS-SHA256');
-
-			if (!config.rsn_override_key_mgmt)
-				break;
-
-			append_value(config, 'rsn_override_key_mgmt', 'FILS-SHA256');
-			if (config.ieee80211r)
-				append_value(config, 'rsn_override_key_mgmt', 'FT-FILS-SHA256');
 			break;
 		}
 	}

package/network/services/hostapd/files/hostapd.uc

@@ -1070,7 +1070,7 @@ function mld_set_config(config)
 	let prev_mld = { ...hostapd.data.mld };
 	let new_mld = {};
 	let phy_list = {};
-	let new_config = !length(prev_mld);
+	let new_config = !length(prev_mld) && length(new_mld);
 
 	hostapd.printf(`Set MLD config: ${keys(config)}`);
 

package/network/services/hostapd/patches/600-ubus_support.patch

@@ -195,7 +195,15 @@ probe/assoc/auth requests via object subscribe.
  struct hostapd_iface * hostapd_alloc_iface(void);
 --- a/src/ap/ieee802_11.c
 +++ b/src/ap/ieee802_11.c
-@@ -4077,7 +4077,7 @@ static void handle_auth(struct hostapd_d
+@@ -2026,6 +2026,7 @@ static void handle_auth_sae(struct hosta
+ 
+ 			if (sae_check_confirm(sta->sae, var, var_len,
+ 					      NULL) < 0) {
++				hostapd_ubus_notify(hapd, "key-mismatch", sta->addr);
+ 				if (sae_password_track_fail(hapd, sta)) {
+ 					wpa_printf(MSG_DEBUG,
+ 						   "SAE: Reject mismatching Confirm so that another password can be attempted by "
+@@ -4077,7 +4078,7 @@ static void handle_auth(struct hostapd_d
  	u16 auth_alg, auth_transaction, status_code;
  	u16 resp = WLAN_STATUS_SUCCESS;
  	struct sta_info *sta = NULL;
@@ -204,7 +212,7 @@ probe/assoc/auth requests via object subscribe.
  	u16 fc;
  	const u8 *challenge = NULL;
  	u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
-@@ -4116,6 +4116,11 @@ static void handle_auth(struct hostapd_d
+@@ -4116,6 +4117,11 @@ static void handle_auth(struct hostapd_d
  	else
  		sa = mgmt->sa;
  #endif /* CONFIG_IEEE80211BE */
@@ -216,7 +224,7 @@ probe/assoc/auth requests via object subscribe.
  
  	auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
  	auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
-@@ -4306,6 +4311,13 @@ static void handle_auth(struct hostapd_d
+@@ -4306,6 +4312,13 @@ static void handle_auth(struct hostapd_d
  		resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
  		goto fail;
  	}
@@ -230,7 +238,7 @@ probe/assoc/auth requests via object subscribe.
  	if (res == HOSTAPD_ACL_PENDING)
  		return;
  
-@@ -6999,7 +7011,7 @@ static void handle_assoc(struct hostapd_
+@@ -6999,7 +7012,7 @@ static void handle_assoc(struct hostapd_
  	int resp = WLAN_STATUS_SUCCESS;
  	u16 reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
  	const u8 *pos;
@@ -239,7 +247,7 @@ probe/assoc/auth requests via object subscribe.
  	struct sta_info *sta;
  	u8 *tmp = NULL;
  #ifdef CONFIG_FILS
-@@ -7255,6 +7267,11 @@ static void handle_assoc(struct hostapd_
+@@ -7255,6 +7268,11 @@ static void handle_assoc(struct hostapd_
  		left = res;
  	}
  #endif /* CONFIG_FILS */
@@ -251,7 +259,7 @@ probe/assoc/auth requests via object subscribe.
  
  	/* followed by SSID and Supported rates; and HT capabilities if 802.11n
  	 * is used */
-@@ -7347,6 +7364,7 @@ static void handle_assoc(struct hostapd_
+@@ -7347,6 +7365,7 @@ static void handle_assoc(struct hostapd_
  
  #ifdef CONFIG_TAXONOMY
  	taxonomy_sta_info_assoc_req(hapd, sta, pos, left);
@@ -259,7 +267,7 @@ probe/assoc/auth requests via object subscribe.
  #endif /* CONFIG_TAXONOMY */
  
  	sta->pending_wds_enable = 0;
-@@ -7360,6 +7378,13 @@ static void handle_assoc(struct hostapd_
+@@ -7360,6 +7379,13 @@ static void handle_assoc(struct hostapd_
  	}
  #endif /* CONFIG_FILS */
  
@@ -273,7 +281,7 @@ probe/assoc/auth requests via object subscribe.
   fail:
  
  	/*
-@@ -7598,6 +7623,7 @@ static void handle_disassoc(struct hosta
+@@ -7598,6 +7624,7 @@ static void handle_disassoc(struct hosta
  			   (unsigned long) len);
  		return;
  	}
@@ -281,7 +289,7 @@ probe/assoc/auth requests via object subscribe.
  
  	sta = ap_get_sta(hapd, mgmt->sa);
  	if (!sta) {
-@@ -7629,6 +7655,8 @@ static void handle_deauth(struct hostapd
+@@ -7629,6 +7656,8 @@ static void handle_deauth(struct hostapd
  	/* Clear the PTKSA cache entries for PASN */
  	ptksa_cache_flush(hapd->ptksa, mgmt->sa, WPA_CIPHER_NONE);
  

package/network/services/hostapd/patches/601-ucode_support.patch

@@ -494,7 +494,7 @@ as adding/removing interfaces.
  		}
  	}
  
-@@ -4466,6 +4489,12 @@ static void handle_auth(struct hostapd_d
+@@ -4467,6 +4490,12 @@ static void handle_auth(struct hostapd_d
  		goto fail;
  	}
  

package/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patch

@@ -373,7 +373,7 @@ Hotfix-by: Sebastian Gottschall https://github.com/mirror/dd-wrt/commit/0c3001a6
  
  #ifdef CONFIG_FILS
  static struct wpabuf *
-@@ -4868,8 +4871,8 @@ static u16 check_multi_ap(struct hostapd
+@@ -4869,8 +4872,8 @@ static u16 check_multi_ap(struct hostapd
  }
  
  
@@ -384,7 +384,7 @@ Hotfix-by: Sebastian Gottschall https://github.com/mirror/dd-wrt/commit/0c3001a6
  {
  	/* Supported rates not used in IEEE 802.11ad/DMG */
  	if (hapd->iface->current_mode &&
-@@ -5337,7 +5340,7 @@ static int __check_assoc_ies(struct host
+@@ -5338,7 +5341,7 @@ static int __check_assoc_ies(struct host
  			       elems->ext_capab_len);
  	if (resp != WLAN_STATUS_SUCCESS)
  		goto out;
@@ -393,7 +393,7 @@ Hotfix-by: Sebastian Gottschall https://github.com/mirror/dd-wrt/commit/0c3001a6
  	if (resp != WLAN_STATUS_SUCCESS)
  		goto out;
  
-@@ -7719,6 +7722,11 @@ static void handle_beacon(struct hostapd
+@@ -7720,6 +7723,11 @@ static void handle_beacon(struct hostapd
  				      0);
  
  	ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);

package/network/services/hostapd/src/src/ap/ucode.c

@@ -457,9 +457,11 @@ uc_hostapd_iface_add_bss(uc_vm_t *vm, size_t nargs)
 	    interfaces->ctrl_iface_init(hapd) < 0)
 		goto free_hapd;
 
-	if (iface->state == HAPD_IFACE_ENABLED &&
+	if (iface->state == HAPD_IFACE_ENABLED) {
-	    hostapd_setup_bss(hapd, -1, true))
+		hapd->conf->start_disabled = 0;
-		goto deinit_ctrl;
+		if (hostapd_setup_bss(hapd, -1, true))
+			goto deinit_ctrl;
+	}
 
 	iface->bss = os_realloc_array(iface->bss, iface->num_bss + 1,
 				      sizeof(*iface->bss));

package/network/utils/iw/patches/001-iw-scan-print-RSN-Element-Override-IEs.patch

@@ -0,0 +1,58 @@
+From d90618809e06e123241f57efdb7039a7a8a43d58 Mon Sep 17 00:00:00 2001
+From: Alex Gavin <a_gavin@icloud.com>
+Date: Sun, 15 Mar 2026 22:16:46 -0700
+Subject: iw: scan: print RSN Element Override IEs
+
+Parse body of RSN Element Override IEs as RSN IEs
+using existing code.
+
+RSN IEs are a minimum size of 4 octets, as detailed
+in IEEE802.11-2024, 9.4.2.23.1
+
+Example output:
+RSN Element Override:
+	 * Version: 1
+	 * Group cipher: CCMP
+	 * Pairwise ciphers: CCMP
+	 * Authentication suites: SAE
+	 * Capabilities: 16-PTKSA-RC 1-GTKSA-RC MFP-required MFP-capable (0x00cc)
+RSN Element Override 2:
+	 * Version: 1
+	 * Group cipher: CCMP
+	 * Pairwise ciphers: GCMP-256
+	 * Authentication suites: SAE-EXT-KEY
+	 * Capabilities: 16-PTKSA-RC 1-GTKSA-RC MFP-required MFP-capable (0x00cc)
+
+Signed-off-by: Alex Gavin <a_gavin@icloud.com>
+Link: https://patch.msgid.link/20260316051646.18303-2-a_gavin@icloud.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ scan.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/scan.c
++++ b/scan.c
+@@ -1893,6 +1893,14 @@ static void print_wifi_osen(const uint8_
+ 	print_osen_ie("OSEN", "OSEN", len, data);
+ }
+ 
++static void print_wifi_rsn_override(const uint8_t type, uint8_t len,
++			    const uint8_t *data,
++			    const struct ie_context *ctx)
++{
++	printf("\n\t");
++	print_rsn_ie("CCMP", "IEEE802.1X", len, data);
++}
++
+ static bool print_wifi_wmm_param(const uint8_t *data, uint8_t len)
+ {
+ 	int i;
+@@ -2344,6 +2352,8 @@ static const struct ie_print wfa_printer
+ 	[16] = { "HotSpot 2.0 Indication", print_hs20_ind, 1, 255, BIT(PRINT_SCAN), },
+ 	[18] = { "HotSpot 2.0 OSEN", print_wifi_osen, 1, 255, BIT(PRINT_SCAN), },
+ 	[28] = { "OWE Transition Mode", print_wifi_owe_tarns, 7, 255, BIT(PRINT_SCAN), },
++	[41] = { "RSN Element Override", print_wifi_rsn_override, 4, 255, BIT(PRINT_SCAN), },
++	[42] = { "RSN Element Override 2", print_wifi_rsn_override, 4, 255, BIT(PRINT_SCAN), },
+ };
+ 
+ static void print_vendor(unsigned char len, unsigned char *data,

package/network/utils/iw/patches/200-reduce_size.patch

@@ -24,15 +24,18 @@
  	case NL80211_CMD_JOIN_IBSS:
  		mac_addr_n2a(macbuf, nla_data(tb[NL80211_ATTR_MAC]));
  		printf("IBSS %s joined\n", macbuf);
-@@ -1297,9 +1300,9 @@ static int print_event(struct nl_msg *ms
+@@ -1297,9 +1300,14 @@ static int print_event(struct nl_msg *ms
  	case NL80211_CMD_ASSOC_COMEBACK: /* 147 */
  		parse_assoc_comeback(tb, gnlh->cmd);
  		break;
 +#endif
  	default:
--		printf("unknown event %d (%s)\n",
++#ifndef IW_FULL
--		       gnlh->cmd, command_name(gnlh->cmd));
 +		printf("unknown event %d\n", gnlh->cmd);
++#else
+ 		printf("unknown event %d (%s)\n",
+ 		       gnlh->cmd, command_name(gnlh->cmd));
++#endif
  		break;
  	}
  
@@ -197,7 +200,7 @@
  };
  
  static void print_wifi_wpa(const uint8_t type, uint8_t len, const uint8_t *data,
-@@ -2213,8 +2218,10 @@ static void print_wifi_wps(const uint8_t
+@@ -2221,8 +2226,10 @@ static void print_wifi_wps(const uint8_t
  
  static const struct ie_print wifiprinters[] = {
  	[1] = { "WPA", print_wifi_wpa, 2, 255, BIT(PRINT_SCAN), },
@@ -208,18 +211,18 @@
  };
  
  static inline void print_p2p(const uint8_t type, uint8_t len,
-@@ -2377,6 +2384,10 @@ static void print_vendor(unsigned char l
+@@ -2387,6 +2394,10 @@ static void print_vendor(unsigned char l
  		return;
  	}
  
-+#ifdef IW_FULL
++#ifndef IW_FULL
 +	return;
 +#endif
 +
  	if (len >= 4 && memcmp(data, wfa_oui, 3) == 0) {
  		if (data[3] < ARRAY_SIZE(wfa_printers) &&
  		    wfa_printers[data[3]].name &&
-@@ -2576,6 +2587,7 @@ static void print_capa_non_dmg(__u16 cap
+@@ -2586,6 +2597,7 @@ static void print_capa_non_dmg(__u16 cap
  		printf(" ESS");
  	if (capa & WLAN_CAPABILITY_IBSS)
  		printf(" IBSS");
@@ -227,7 +230,7 @@
  	if (capa & WLAN_CAPABILITY_CF_POLLABLE)
  		printf(" CfPollable");
  	if (capa & WLAN_CAPABILITY_CF_POLL_REQUEST)
-@@ -2604,6 +2616,7 @@ static void print_capa_non_dmg(__u16 cap
+@@ -2614,6 +2626,7 @@ static void print_capa_non_dmg(__u16 cap
  		printf(" DelayedBACK");
  	if (capa & WLAN_CAPABILITY_IMM_BACK)
  		printf(" ImmediateBACK");
@@ -235,7 +238,7 @@
  }
  
  static int print_bss_handler(struct nl_msg *msg, void *arg)
-@@ -2694,8 +2707,10 @@ static int print_bss_handler(struct nl_m
+@@ -2704,8 +2717,10 @@ static int print_bss_handler(struct nl_m
  		else
  			printf("\tfreq: %d\n", freq);
  
@@ -246,7 +249,7 @@
  	}
  	if (bss[NL80211_BSS_BEACON_INTERVAL])
  		printf("\tbeacon interval: %d TUs\n",
-@@ -2889,6 +2904,7 @@ static int handle_stop_sched_scan(struct
+@@ -2899,6 +2914,7 @@ static int handle_stop_sched_scan(struct
  	return 0;
  }
  
@@ -254,7 +257,7 @@
  COMMAND(scan, sched_start,
  	SCHED_SCAN_OPTIONS,
  	NL80211_CMD_START_SCHED_SCAN, 0, CIB_NETDEV, handle_start_sched_scan,
-@@ -2899,3 +2915,4 @@ COMMAND(scan, sched_start,
+@@ -2909,3 +2925,4 @@ COMMAND(scan, sched_start,
  COMMAND(scan, sched_stop, "",
  	NL80211_CMD_STOP_SCHED_SCAN, 0, CIB_NETDEV, handle_stop_sched_scan,
  	"Stop an ongoing scheduled scan.");

package/utils/ucode/Makefile

@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/jow-/ucode.git
-PKG_SOURCE_DATE:=2026-02-27
+PKG_SOURCE_DATE:=2026-04-24
-PKG_SOURCE_VERSION:=934bb593dba520e84920865703bd4fe94490d11e
+PKG_SOURCE_VERSION:=0beaa9dc244f16c52c0a7dc3f180cca0539124cd
-PKG_MIRROR_HASH:=baa59093c5a32303f64c2507664f7b36e2b7b7c14ed65524e5d1130633e5b639
+PKG_MIRROR_HASH:=9a58c061541cd98d248335c351a10049823a0dd317475fa0be73593c6d90a70a
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=ISC
 

package/utils/ucode/patches/100-add-include-for-older-kernels.patch

@@ -1,20 +0,0 @@
-From 165d395ffa2a22e293160b24d4791302a156eab8 Mon Sep 17 00:00:00 2001
-From: Rosen Penev <rosenp@gmail.com>
-Date: Mon, 8 Dec 2025 12:48:01 -0800
-Subject: add include for older kernels
-
-in6.h is needed for some macros. Seems newer kernels include this implicitly.
----
- lib/socket.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/lib/socket.c
-+++ b/lib/socket.c
-@@ -77,6 +77,7 @@
- #include "ucode/platform.h"
- 
- #if defined(__linux__)
-+# include <linux/in6.h>
- # include <linux/if_packet.h>
- # include <linux/filter.h>
- 

package/utils/ucode/patches/120-ubus-fix-refcounting-bug.patch

@@ -1,25 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 6 Feb 2026 19:04:54 +0000
-Subject: [PATCH] ubus: fix refcounting bug
-
-In uc_ubus_channel_req_cb an extra ref is taken for args and method,
-which are not used elsewhere.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/lib/ubus.c
-+++ b/lib/ubus.c
-@@ -2395,10 +2395,10 @@ uc_ubus_channel_req_cb(struct ubus_conte
- 
- 	args = blob_array_to_ucv(c->vm, blob_data(msg), blob_len(msg), true);
- 	reqproto = ucv_object_new(c->vm);
--	ucv_object_add(reqproto, "args", ucv_get(args));
-+	ucv_object_add(reqproto, "args", args);
- 
- 	if (method)
--		ucv_object_add(reqproto, "type", ucv_get(ucv_string_new(method)));
-+		ucv_object_add(reqproto, "type", ucv_string_new(method));
- 
- 	return uc_ubus_handle_reply_common(ctx, req, c->vm, c->res, func, reqproto);
- }

package/utils/ucode/patches/121-ubus-avoid-double-close-of-externally-owned-channel-.patch

@@ -1,130 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 6 Feb 2026 20:19:59 +0000
-Subject: [PATCH] ubus: avoid double close of externally owned channel fds
-
-When a channel is opened via an fd obtained through fileno(), the fd is
-owned by an external resource. Track this in fd_handle and detach from
-uloop without closing the fd on disconnect/shutdown.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/lib/ubus.c
-+++ b/lib/ubus.c
-@@ -132,6 +132,7 @@ typedef struct {
- 	struct ubus_context ctx;
- 	struct blob_buf buf;
- 	int timeout;
-+	bool fd_handle;
- 
- 	uc_vm_t *vm;
- 	uc_value_t *res;
-@@ -739,7 +740,7 @@ uc_ubus_call_timeout_cb(struct uloop_tim
- }
- 
- static int
--get_fd(uc_vm_t *vm, uc_value_t *val)
-+get_fd(uc_vm_t *vm, uc_value_t *val, bool *handle)
- {
- 	uc_value_t *fn;
- 	int64_t n;
-@@ -747,6 +748,9 @@ get_fd(uc_vm_t *vm, uc_value_t *val)
- 	fn = ucv_property_get(val, "fileno");
- 
- 	if (ucv_is_callable(fn)) {
-+		if (handle)
-+			*handle = true;
-+
- 		uc_vm_stack_push(vm, ucv_get(val));
- 		uc_vm_stack_push(vm, ucv_get(fn));
- 
-@@ -816,7 +820,7 @@ uc_ubus_call_common(uc_vm_t *vm, uc_ubus
- 		ucv_object_to_blob(funargs, &c->buf);
- 
- 	if (fd) {
--		fd_val = get_fd(vm, fd);
-+		fd_val = get_fd(vm, fd, NULL);
- 
- 		if (fd_val < 0)
- 			errval_return(UBUS_STATUS_INVALID_ARGUMENT,
-@@ -938,7 +942,7 @@ uc_ubus_defer_common(uc_vm_t *vm, uc_ubu
- 		ucv_object_to_blob(funargs, &c->buf);
- 
- 	if (fd) {
--		fd_val = get_fd(vm, fd);
-+		fd_val = get_fd(vm, fd, NULL);
- 
- 		if (fd_val < 0)
- 			errval_return(UBUS_STATUS_INVALID_ARGUMENT,
-@@ -1174,7 +1178,7 @@ uc_ubus_request_set_fd(uc_vm_t *vm, size
- 	if (!callctx)
- 		err_return(UBUS_STATUS_INVALID_ARGUMENT, "Invalid call context");
- 
--	fd = get_fd(vm, uc_fn_arg(0));
-+	fd = get_fd(vm, uc_fn_arg(0), NULL);
- 
- 	if (fd < 0)
- 		err_return(UBUS_STATUS_INVALID_ARGUMENT, "Invalid file descriptor");
-@@ -2313,6 +2317,10 @@ uc_ubus_disconnect(uc_vm_t *vm, size_t n
- #ifdef HAVE_UBUS_FLUSH_REQUESTS
- 	ubus_flush_requests(&c->ctx);
- #endif
-+	if (c->fd_handle) {
-+		uloop_fd_delete(&c->ctx.sock);
-+		c->ctx.sock.fd = -1;
-+	}
- 	ubus_shutdown(&c->ctx);
- 	c->ctx.sock.fd = -1;
- 	uc_ubus_put_res(&c->res);
-@@ -2422,6 +2430,10 @@ uc_ubus_channel_disconnect_cb(struct ubu
- 	blob_buf_free(&c->buf);
- 
- 	if (c->ctx.sock.fd >= 0) {
-+		if (c->fd_handle) {
-+			uloop_fd_delete(&c->ctx.sock);
-+			c->ctx.sock.fd = -1;
-+		}
- 		ubus_shutdown(&c->ctx);
- 		c->ctx.sock.fd = -1;
- 	}
-@@ -2486,6 +2498,7 @@ uc_ubus_channel_connect(uc_vm_t *vm, siz
- {
- #ifdef HAVE_UBUS_CHANNEL_SUPPORT
- 	uc_value_t *fd, *cb, *disconnect_cb, *timeout;
-+	bool handle = false;
- 	uc_ubus_connection_t *c;
- 	int fd_val;
- 
-@@ -2495,7 +2508,7 @@ uc_ubus_channel_connect(uc_vm_t *vm, siz
- 	         "disconnect_cb", UC_CLOSURE, true, &disconnect_cb,
- 	         "timeout", UC_INTEGER, true, &timeout);
- 
--	fd_val = get_fd(vm, fd);
-+	fd_val = get_fd(vm, fd, &handle);
- 
- 	if (fd_val < 0)
- 		err_return(UBUS_STATUS_INVALID_ARGUMENT, "Invalid file descriptor argument");
-@@ -2505,6 +2518,8 @@ uc_ubus_channel_connect(uc_vm_t *vm, siz
- 	if (!c)
- 		return NULL;
- 
-+	c->fd_handle = handle;
-+
- 	if (ubus_channel_connect(&c->ctx, fd_val, cb ? uc_ubus_channel_req_cb : NULL)) {
- 		ucv_put(c->res);
- 		err_return(UBUS_STATUS_UNKNOWN_ERROR, "Unable to create ubus channel");
-@@ -2602,8 +2617,13 @@ static void free_connection(void *ud) {
- 
- 	blob_buf_free(&conn->buf);
- 
--	if (conn->ctx.sock.fd >= 0)
-+	if (conn->ctx.sock.fd >= 0) {
-+		if (conn->fd_handle) {
-+			uloop_fd_delete(&conn->ctx.sock);
-+			conn->ctx.sock.fd = -1;
-+		}
- 		ubus_shutdown(&conn->ctx);
-+	}
- }
- 
- static void free_deferred(void *ud) {

package/utils/ucode/patches/130-nl80211-add-missing-survey-info-attributes.patch

@@ -1,36 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 28 Feb 2026 11:12:22 +0000
-Subject: [PATCH] nl80211: add missing survey info attributes
-
-Add in_use, time_bss_rx and frequency_offset to the survey info
-nested attribute spec.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/lib/nl80211.c
-+++ b/lib/nl80211.c
-@@ -867,16 +867,19 @@ static const uc_nl_nested_spec_t nl80211
- 
- static const uc_nl_nested_spec_t nl80211_survey_info_nla = {
- 	.headsize = 0,
--	.nattrs = 8,
-+	.nattrs = 11,
- 	.attrs = {
- 		{ NL80211_SURVEY_INFO_FREQUENCY, "frequency", DT_U32, 0, NULL },
-+		{ NL80211_SURVEY_INFO_NOISE, "noise", DT_S8, 0, NULL },
-+		{ NL80211_SURVEY_INFO_IN_USE, "in_use", DT_FLAG, 0, NULL },
- 		{ NL80211_SURVEY_INFO_TIME, "time", DT_U64, 0, NULL },
--		{ NL80211_SURVEY_INFO_TIME_TX, "time_tx", DT_U64, 0, NULL },
--		{ NL80211_SURVEY_INFO_TIME_RX, "time_rx", DT_U64, 0, NULL },
- 		{ NL80211_SURVEY_INFO_TIME_BUSY, "busy", DT_U64, 0, NULL },
- 		{ NL80211_SURVEY_INFO_TIME_EXT_BUSY, "ext_busy", DT_U64, 0, NULL },
-+		{ NL80211_SURVEY_INFO_TIME_RX, "time_rx", DT_U64, 0, NULL },
-+		{ NL80211_SURVEY_INFO_TIME_TX, "time_tx", DT_U64, 0, NULL },
- 		{ NL80211_SURVEY_INFO_TIME_SCAN, "scan", DT_U64, 0, NULL },
--		{ NL80211_SURVEY_INFO_NOISE, "noise", DT_S8, 0, NULL },
-+		{ NL80211_SURVEY_INFO_TIME_BSS_RX, "time_bss_rx", DT_U64, 0, NULL },
-+		{ NL80211_SURVEY_INFO_FREQUENCY_OFFSET, "frequency_offset", DT_U32, 0, NULL },
- 	}
- };
- 

package/utils/ucode/patches/131-nl80211-fix-dfs_cac_time-attribute-type.patch

@@ -1,18 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 1 Mar 2026 15:32:06 +0000
-Subject: [PATCH] nl80211: fix dfs_cac_time attribute type
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/lib/nl80211.c
-+++ b/lib/nl80211.c
-@@ -610,7 +610,7 @@ static const uc_nl_nested_spec_t nl80211
- 		{ NL80211_FREQUENCY_ATTR_NO_HT40_PLUS, "no_ht40_plus", DT_FLAG, 0, NULL },
- 		{ NL80211_FREQUENCY_ATTR_NO_80MHZ, "no_80mhz", DT_FLAG, 0, NULL },
- 		{ NL80211_FREQUENCY_ATTR_NO_160MHZ, "no_160mhz", DT_FLAG, 0, NULL },
--		{ NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, "dfs_cac_time", DT_FLAG, 0, NULL },
-+		{ NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, "dfs_cac_time", DT_U32, 0, NULL },
- 		{ NL80211_FREQUENCY_ATTR_INDOOR_ONLY, "indoor_only", DT_FLAG, 0, NULL },
- 		{ NL80211_FREQUENCY_ATTR_IR_CONCURRENT, "ir_concurrent", DT_FLAG, 0, NULL },
- 		{ NL80211_FREQUENCY_ATTR_NO_20MHZ, "no_20mhz", DT_FLAG, 0, NULL },

package/utils/ucode/patches/132-nl80211-fix-HE-MCS-set-parsing.patch

@@ -1,43 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Fri, 20 Mar 2026 11:53:30 +0000
-Subject: [PATCH] nl80211: fix HE MCS set parsing
-
-The Channel Width Set bits occupy B1-B4 of byte 0 of he_cap_phy.
-Since this attribute is a byte array, not an integer, reading it via
-nla_get_u16() produces an endian-dependent result. The << 8 shift was
-correct on big-endian but wrong on little-endian.
-
-Fix this by reading byte 0 directly as a uint8_t, making the check
-endian-neutral.
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/lib/nl80211.c
-+++ b/lib/nl80211.c
-@@ -1575,21 +1575,22 @@ uc_nl_convert_rta_he_mcs(const uc_nl_att
- 	uint8_t bw_support_mask[] = { (1 << 1) | (1 << 2), (1 << 3), (1 << 4) };
- 	uc_value_t *mcs_set, *mcs_bw, *mcs_dir, *mcs_entry, *mcs_idx;
- 	uint16_t bw[] = { 80, 160, 8080 }, mcs[6];
--	uint16_t u16, phy_cap_0 = 0;
-+	uint8_t phy_cap_0 = 0;
-+	uint16_t u16;
- 	size_t i, j, k, l, max_idx;
- 
- 	if (!nla_check_len(attr, sizeof(mcs)))
- 		return NULL;
- 
- 	if (nla_check_len(phy_attr, sizeof(phy_cap_0)))
--		phy_cap_0 = nla_get_u16(phy_attr);
-+		phy_cap_0 = *(uint8_t *)nla_data(phy_attr);
- 
- 	memcpy(mcs, nla_data(attr), sizeof(mcs));
- 
- 	mcs_set = ucv_array_new_length(vm, 3);
- 
- 	for (i = 0; i < ARRAY_SIZE(bw); i++) {
--		if (!(phy_cap_0 & (bw_support_mask[i] << 8)))
-+		if (!(phy_cap_0 & bw_support_mask[i]))
- 			continue;
- 
- 		mcs_bw = ucv_object_new(vm);

target/linux/mediatek/dts/mt7986b-elecom-wrc-x6000.dtsi

@@ -0,0 +1,477 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/pinctrl/mt65xx.h>
+
+#include "mt7986b.dtsi"
+
+/ {
+	aliases {
+		serial0 = &uart0;
+
+		label-mac-device = &gmac0;
+		led-boot = &led_power_g;
+		led-failsafe = &led_power_r;
+		led-running = &led_power_g;
+		led-upgrade = &led_power_g;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&pio 2 GPIO_ACTIVE_LOW>;
+		};
+
+		led-2 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			default-state = "off";
+		};
+
+		led-4 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		led-5 {
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-6 {
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&pio 14 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led-7 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&pio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_g: led-8 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&pio 18 GPIO_ACTIVE_LOW>;
+		};
+
+		led-9 {
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&pio 20 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_r: led-10 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&pio 22 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		button-wps {
+			label = "wps";
+			gpios = <&pio 16 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		/*
+		 * mode0 mode1: (Switch Position)
+		 *   1     0  : Router
+		 *   1     1  : AP
+		 *   0     0  : Repeater (Normal)
+		 *   0     1  : Repeater (Hanareya (en: Outbuilding))
+		 */
+		switch-mode0 {
+			label = "mode0";
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+		};
+
+		switch-mode1 {
+			label = "mode1";
+			gpios = <&pio 19 GPIO_ACTIVE_LOW>;
+			linux,code = <BTN_1>;
+			linux,input-type = <EV_SW>;
+		};
+	};
+
+	memory@40000000 {
+		device_type = "memory";
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&pio {
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-disable;
+		};
+
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-disable;
+		};
+	};
+
+	wf_2g_5g_pins: wf-2g-5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+				"WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+				"WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+				"WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+				"WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+				"WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+				"WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <MTK_DRIVE_4mA>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cells = <&macaddr_factory_2a>;
+		nvmem-cell-names = "mac-address";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		status = "okay";
+		phy-mode = "2500base-x";
+		phy-handle = <&ethphy5>;
+
+		label = "wan";
+		nvmem-cells = <&macaddr_factory_24>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		reset-delay-us = <600>;
+		reset-post-delay-us = <20000>;
+
+		ethphy5: ethernet-phy@5 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reg = <5>;
+			max-speed = <2500>;
+
+			leds {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				led@0 {
+					reg = <0>;
+					color = <LED_COLOR_ID_WHITE>;
+					function = LED_FUNCTION_WAN;
+				};
+			};
+		};
+
+		switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			interrupt-parent = <&pio>;
+			interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					label = "lan1";
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan2";
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan3";
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan4";
+				};
+
+				port@6 {
+					reg = <6>;
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	num-cs = <2>;
+	cs-gpios = <0>, <0>;
+
+	flash@1 {
+		compatible = "spi-nand";
+		reg = <1>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+		mediatek,bmt-remap-range =
+		<0x0000000 0x5a0000>,  /*     BL2 - Fwheader  (5.625 MiB) */
+		<0x37a0000 0x3b40000>, /*  Config - Fwheader2 (3.625 MiB) */
+		<0x6d40000 0x7580000>; /* Config2 - Backup    (8.25 MiB) */
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x00 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					macaddr_factory_4: mac-address@4 {
+						reg = <0x4 0x6>;
+					};
+
+					macaddr_factory_a: mac-address@a {
+						reg = <0xa 0x6>;
+					};
+
+					macaddr_factory_24: mac-address@24 {
+						reg = <0x24 0x6>;
+					};
+
+					macaddr_factory_2a: mac-address@2a {
+						reg = <0x2a 0x6>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "Fwheader";
+				reg = <0x580000 0x20000>;
+				read-only;
+			};
+
+			partition@5a0000 {
+				compatible = "mstc,boot";
+				label = "firmware1";
+				reg = <0x5a0000 0x3200000>;
+				mstc,bootnum = <1>;
+				mstc,persist = <&mtd_persist>;
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label-base = "ubi";
+					reg = <0x0 0x3200000>;
+				};
+			};
+
+			partition@37a0000 {
+				label = "Config";
+				reg = <0x37a0000 0x380000>;
+				read-only;
+			};
+
+			partition@3b20000 {
+				label = "Fwheader_2";
+				reg = <0x3b20000 0x20000>;
+				read-only;
+			};
+
+			partition@3b40000 {
+				compatible = "mstc,boot";
+				label = "firmware2";
+				reg = <0x3b40000 0x3200000>;
+				mstc,bootnum = <2>;
+				mstc,persist = <&mtd_persist>;
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label-base = "ubi";
+					reg = <0x0 0x3200000>;
+				};
+			};
+
+			partition@6d40000 {
+				label = "Config_2";
+				reg = <0x6d40000 0x380000>;
+				read-only;
+			};
+
+			mtd_persist: partition@70c0000 {
+				label = "persist";
+				reg = <0x70c0000 0x100000>;
+			};
+
+			partition@71c0000 {
+				label = "Mrd";
+				reg = <0x71c0000 0x40000>;
+				read-only;
+			};
+
+			partition@7200000 {
+				label = "Backup";
+				reg = <0x7200000 0x380000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+
+	band@0 {
+		reg = <0>;
+		nvmem-cells = <&macaddr_factory_4>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	band@1 {
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_a>;
+		nvmem-cell-names = "mac-address";
+	};
+};

target/linux/mediatek/dts/mt7986b-elecom-wrc-x6000gsd.dts

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7986b-elecom-wrc-x6000.dtsi"
+
+/ {
+	model = "ELECOM WRC-X6000GSD";
+	compatible = "elecom,wrc-x6000gsd", "mediatek,mt7986b";
+};

target/linux/mediatek/dts/mt7986b-elecom-wrc-x6000qs.dts

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7986b-elecom-wrc-x6000.dtsi"
+
+/ {
+	model = "ELECOM WRC-X6000QS";
+	compatible = "elecom,wrc-x6000qs", "mediatek,mt7986b";
+};

target/linux/mediatek/filogic/base-files/etc/board.d/01_leds

@@ -100,6 +100,10 @@ cudy,wbr3000uax-v1-ubootmod)
 elecom,wrc-x3000gs3)
 	ucidef_set_led_netdev "wan" "wan" "green:wan" "wan"
 	;;
+elecom,wrc-x6000gsd|\
+elecom,wrc-x6000qs)
+	ucidef_set_led_netdev "wan" "wan" "mdio-bus:05:white:wan" "wan" "link tx rx"
+	;;
 glinet,gl-x3000|\
 glinet,gl-xe3000)
 	ucidef_set_led_default "power" "POWER" "green:power" "1"

target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh

@@ -233,7 +233,9 @@ platform_do_upgrade() {
 		fw_setenv sw_tryactive 0
 		nand_do_upgrade "$1"
 		;;
-	elecom,wrc-x3000gs3)
+	elecom,wrc-x3000gs3|\
+	elecom,wrc-x6000gsd|\
+	elecom,wrc-x6000qs)
 		local bootnum="$(mstc_rw_bootnum)"
 		case "$bootnum" in
 		1|2)
@@ -459,6 +461,13 @@ platform_pre_upgrade() {
 	buffalo,wsr-6000ax8)
 		buffalo_initial_setup
 		;;
+	elecom,wrc-x6000gsd|\
+	elecom,wrc-x6000qs)
+		local delay=$(fw_printenv -n bootmenu_delay)
+
+		[ -z "$delay" ] || [ "$delay" -eq "0" ] && \
+			fw_setenv bootmenu_delay 3
+		;;
 	xiaomi,mi-router-ax3000t|\
 	xiaomi,mi-router-wr30u-stock|\
 	xiaomi,redmi-router-ax6000-stock)

target/linux/mediatek/image/filogic.mk

@@ -1640,6 +1640,34 @@ define Device/elecom_wrc-x3000gs3
 endef
 TARGET_DEVICES += elecom_wrc-x3000gs3
 
+define Device/elecom_wrc-x6000gsd
+  DEVICE_VENDOR := ELECOM
+  DEVICE_MODEL := WRC-X6000GSD
+  DEVICE_DTS := mt7986b-elecom-wrc-x6000gsd
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  IMAGES += factory.bin
+  IMAGE/factory.bin := sysupgrade-tar | mstc-header 5.04(XZR.0)b90 YTC@ | \
+	elecom-product-header WRC-X6000GS
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+endef
+TARGET_DEVICES += elecom_wrc-x6000gsd
+
+define Device/elecom_wrc-x6000qs
+  DEVICE_VENDOR := ELECOM
+  DEVICE_MODEL := WRC-X6000QS
+  DEVICE_DTS := mt7986b-elecom-wrc-x6000qs
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  IMAGES += factory.bin
+  IMAGE/factory.bin := sysupgrade-tar | mstc-header 5.04(XZL.0)b90 COMD | \
+	elecom-product-header WRC-X6000QS
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+endef
+TARGET_DEVICES += elecom_wrc-x6000qs
+
 define Device/gatonetworks_gdsp
   DEVICE_VENDOR := GatoNetworks
   DEVICE_MODEL := gdsp

target/linux/microchipsw/patches-6.18/0099-v7.2-net-phy-micrel-fix-LAN8814-QSGMII-soft-reset.patch

@@ -1,7 +1,7 @@
-From f9184cc6c809bc1de331fa1bece2797f54167985 Mon Sep 17 00:00:00 2001
+From e027c218c482c6a0ae1948129ccda3b0a2033368 Mon Sep 17 00:00:00 2001
 From: Robert Marko <robert.marko@sartura.hr>
-Date: Tue, 28 Apr 2026 15:09:36 +0200
+Date: Tue, 28 Apr 2026 15:41:01 +0200
-Subject: [PATCH net] net: phy: micrel: fix LAN8814 QSGMII soft reset
+Subject: [PATCH] net: phy: micrel: fix LAN8814 QSGMII soft reset
 
 LAN8814 QSGMII soft reset was moved into the probe function to avoid
 triggering it for each of 4 PHY-s in the package.
@@ -19,6 +19,8 @@ setup.
 
 Fixes: 96a9178a29a6 ("net: phy: micrel: lan8814 fix reset of the QSGMII interface")
 Signed-off-by: Robert Marko <robert.marko@sartura.hr>
+Link: https://patch.msgid.link/20260428134138.1741253-1-robert.marko@sartura.hr
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 ---
  drivers/net/phy/micrel.c | 15 ++++++++-------
  1 file changed, 8 insertions(+), 7 deletions(-)

target/linux/mpc85xx/files/arch/powerpc/boot/dts/ws-ap3715i.dts

@@ -234,13 +234,11 @@
 				partition@120000 {
 					reg = <0x120000 0x10000>;
 					label = "cfg1";
-					read-only;
 				};
 
 				partition@130000 {
 					reg = <0x130000 0x10000>;
 					label = "cfg2";
-					read-only;
 				};
 
 				partition@140000 {

target/linux/mpc85xx/image/p1010.mk

@@ -41,7 +41,7 @@ define Device/enterasys_ws-ap3715i
   KERNEL_NAME := simpleImage.ws-ap3715i
   KERNEL_ENTRY := 0x1500000
   KERNEL_LOADADDR := 0x1500000
-  KERNEL = kernel-bin | lzma | uImage lzma
+  KERNEL = kernel-bin | libdeflate-gzip | uImage gzip
   IMAGES := sysupgrade.bin
   IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | append-metadata
 endef

target/linux/mpc85xx/patches-6.12/099-mpc85xx-p1010-change-wrapper-address-of-simple-image-devices.patch

@@ -0,0 +1,10 @@
+--- a/arch/powerpc/boot/wrapper
++++ b/arch/powerpc/boot/wrapper
+@@ -351,6 +351,7 @@ adder875-redboot)
+ simpleboot-*)
+     platformo="$object/fixed-head.o $object/simpleboot.o"
+     binary=y
++    link_address='0x1500000'
+     ;;
+ asp834x-redboot)
+     platformo="$object/fixed-head.o $object/redboot-83xx.o"

target/linux/mpc85xx/patches-6.12/100-powerpc-85xx-tl-wdr4900-v1-support.patch

@@ -12,10 +12,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
 ---
  arch/powerpc/boot/Makefile           |  3 ++-
- arch/powerpc/boot/wrapper            |  5 +++++
  arch/powerpc/platforms/85xx/Kconfig  | 12 ++++++++++++
  arch/powerpc/platforms/85xx/Makefile |  1 +
- 4 files changed, 20 insertions(+), 1 deletion(-)
+ 4 files changed, 15 insertions(+), 1 deletion(-)
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
@@ -36,20 +35,6 @@ Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
  # Board ports in arch/powerpc/platform/86xx/Kconfig
  image-$(CONFIG_MVME7100)                += dtbImage.mvme7100
  
---- a/arch/powerpc/boot/wrapper
-+++ b/arch/powerpc/boot/wrapper
-@@ -348,6 +348,11 @@ adder875-redboot)
-     platformo="$object/fixed-head.o $object/redboot-8xx.o"
-     binary=y
-     ;;
-+simpleboot-tl-wdr4900-v1)
-+    platformo="$object/fixed-head.o $object/simpleboot.o"
-+    link_address='0x1500000'
-+    binary=y
-+    ;;
- simpleboot-*)
-     platformo="$object/fixed-head.o $object/simpleboot.o"
-     binary=y
 --- a/arch/powerpc/platforms/85xx/Kconfig
 +++ b/arch/powerpc/platforms/85xx/Kconfig
 @@ -176,6 +176,18 @@ config STX_GP3

target/linux/mpc85xx/patches-6.12/101-powerpc-85xx-hiveap-330-support.patch

@@ -46,13 +46,3 @@
  image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
  # Board ports in arch/powerpc/platform/86xx/Kconfig
  image-$(CONFIG_MVME7100)                += dtbImage.mvme7100
---- a/arch/powerpc/boot/wrapper
-+++ b/arch/powerpc/boot/wrapper
-@@ -348,6 +348,7 @@ adder875-redboot)
-     platformo="$object/fixed-head.o $object/redboot-8xx.o"
-     binary=y
-     ;;
-+simpleboot-hiveap-330|\
- simpleboot-tl-wdr4900-v1)
-     platformo="$object/fixed-head.o $object/simpleboot.o"
-     link_address='0x1500000'

target/linux/mpc85xx/patches-6.12/106-powerpc-85xx-ws-ap3710i-support.patch

@@ -46,15 +46,3 @@
  # Board ports in arch/powerpc/platform/86xx/Kconfig
  image-$(CONFIG_MVME7100)                += dtbImage.mvme7100
  
---- a/arch/powerpc/boot/wrapper
-+++ b/arch/powerpc/boot/wrapper
-@@ -349,7 +349,8 @@ adder875-redboot)
-     binary=y
-     ;;
- simpleboot-hiveap-330|\
--simpleboot-tl-wdr4900-v1)
-+simpleboot-tl-wdr4900-v1|\
-+simpleboot-ws-ap3710i)
-     platformo="$object/fixed-head.o $object/simpleboot.o"
-     link_address='0x1500000'
-     binary=y

target/linux/mpc85xx/patches-6.12/107-powerpc-85xx-add-ws-ap3825i-support.patch

@@ -55,8 +55,8 @@ WS-AP3825i AP.
  
 --- a/arch/powerpc/boot/wrapper
 +++ b/arch/powerpc/boot/wrapper
-@@ -355,6 +355,11 @@ simpleboot-ws-ap3710i)
+@@ -348,6 +348,11 @@ adder875-redboot)
-     link_address='0x1500000'
+     platformo="$object/fixed-head.o $object/redboot-8xx.o"
      binary=y
      ;;
 +simpleboot-ws-ap3825i)

target/linux/mpc85xx/patches-6.12/110-powerpc-85xx-br200-wp-support.patch

@@ -45,13 +45,3 @@
  image-$(CONFIG_HIVEAP_330)		+= simpleImage.hiveap-330
  image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
  image-$(CONFIG_WS_AP3710I)		+= simpleImage.ws-ap3710i
---- a/arch/powerpc/boot/wrapper
-+++ b/arch/powerpc/boot/wrapper
-@@ -348,6 +348,7 @@ adder875-redboot)
-     platformo="$object/fixed-head.o $object/redboot-8xx.o"
-     binary=y
-     ;;
-+simpleboot-br200-wp|\
- simpleboot-hiveap-330|\
- simpleboot-tl-wdr4900-v1|\
- simpleboot-ws-ap3710i)

target/linux/mpc85xx/patches-6.18/099-mpc85xx-p1010-change-wrapper-address-of-simple-image-devices.patch

@@ -0,0 +1,10 @@
+--- a/arch/powerpc/boot/wrapper
++++ b/arch/powerpc/boot/wrapper
+@@ -342,6 +342,7 @@ adder875-redboot)
+ simpleboot-*)
+     platformo="$object/fixed-head.o $object/simpleboot.o"
+     binary=y
++    link_address='0x1500000'
+     ;;
+ asp834x-redboot)
+     platformo="$object/fixed-head.o $object/redboot-83xx.o"

target/linux/mpc85xx/patches-6.18/100-powerpc-85xx-tl-wdr4900-v1-support.patch

@@ -12,10 +12,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
 ---
  arch/powerpc/boot/Makefile           |  3 ++-
- arch/powerpc/boot/wrapper            |  5 +++++
  arch/powerpc/platforms/85xx/Kconfig  | 12 ++++++++++++
  arch/powerpc/platforms/85xx/Makefile |  1 +
- 4 files changed, 20 insertions(+), 1 deletion(-)
+ 4 files changed, 15 insertions(+), 1 deletion(-)
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
@@ -36,20 +35,6 @@ Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
  # Board ports in arch/powerpc/platform/86xx/Kconfig
  image-$(CONFIG_MVME7100)                += dtbImage.mvme7100
  
---- a/arch/powerpc/boot/wrapper
-+++ b/arch/powerpc/boot/wrapper
-@@ -339,6 +339,11 @@ adder875-redboot)
-     platformo="$object/fixed-head.o $object/redboot-8xx.o"
-     binary=y
-     ;;
-+simpleboot-tl-wdr4900-v1)
-+    platformo="$object/fixed-head.o $object/simpleboot.o"
-+    link_address='0x1500000'
-+    binary=y
-+    ;;
- simpleboot-*)
-     platformo="$object/fixed-head.o $object/simpleboot.o"
-     binary=y
 --- a/arch/powerpc/platforms/85xx/Kconfig
 +++ b/arch/powerpc/platforms/85xx/Kconfig
 @@ -155,6 +155,18 @@ config STX_GP3

target/linux/mpc85xx/patches-6.18/101-powerpc-85xx-hiveap-330-support.patch

@@ -46,13 +46,3 @@
  image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
  # Board ports in arch/powerpc/platform/86xx/Kconfig
  image-$(CONFIG_MVME7100)                += dtbImage.mvme7100
---- a/arch/powerpc/boot/wrapper
-+++ b/arch/powerpc/boot/wrapper
-@@ -339,6 +339,7 @@ adder875-redboot)
-     platformo="$object/fixed-head.o $object/redboot-8xx.o"
-     binary=y
-     ;;
-+simpleboot-hiveap-330|\
- simpleboot-tl-wdr4900-v1)
-     platformo="$object/fixed-head.o $object/simpleboot.o"
-     link_address='0x1500000'

target/linux/mpc85xx/patches-6.18/106-powerpc-85xx-ws-ap3710i-support.patch

@@ -46,15 +46,3 @@
  # Board ports in arch/powerpc/platform/86xx/Kconfig
  image-$(CONFIG_MVME7100)                += dtbImage.mvme7100
  
---- a/arch/powerpc/boot/wrapper
-+++ b/arch/powerpc/boot/wrapper
-@@ -340,7 +340,8 @@ adder875-redboot)
-     binary=y
-     ;;
- simpleboot-hiveap-330|\
--simpleboot-tl-wdr4900-v1)
-+simpleboot-tl-wdr4900-v1|\
-+simpleboot-ws-ap3710i)
-     platformo="$object/fixed-head.o $object/simpleboot.o"
-     link_address='0x1500000'
-     binary=y

target/linux/mpc85xx/patches-6.18/107-powerpc-85xx-add-ws-ap3825i-support.patch

@@ -55,8 +55,8 @@ WS-AP3825i AP.
  
 --- a/arch/powerpc/boot/wrapper
 +++ b/arch/powerpc/boot/wrapper
-@@ -346,6 +346,11 @@ simpleboot-ws-ap3710i)
+@@ -339,6 +339,11 @@ adder875-redboot)
-     link_address='0x1500000'
+     platformo="$object/fixed-head.o $object/redboot-8xx.o"
      binary=y
      ;;
 +simpleboot-ws-ap3825i)

target/linux/mpc85xx/patches-6.18/110-powerpc-85xx-br200-wp-support.patch

@@ -45,13 +45,3 @@
  image-$(CONFIG_HIVEAP_330)		+= simpleImage.hiveap-330
  image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
  image-$(CONFIG_WS_AP3710I)		+= simpleImage.ws-ap3710i
---- a/arch/powerpc/boot/wrapper
-+++ b/arch/powerpc/boot/wrapper
-@@ -339,6 +339,7 @@ adder875-redboot)
-     platformo="$object/fixed-head.o $object/redboot-8xx.o"
-     binary=y
-     ;;
-+simpleboot-br200-wp|\
- simpleboot-hiveap-330|\
- simpleboot-tl-wdr4900-v1|\
- simpleboot-ws-ap3710i)

target/linux/ramips/dts/mt7621_zyxel_lte3301-plus.dts

@@ -193,7 +193,6 @@
 	wifi@0,0 {
 		compatible = "mediatek,mt76";
 		reg = <0x0000 0 0 0 0>;
-		mediatek,firmware-eeprom = "mt7615e_eeprom.bin";
 		nvmem-cells = <&eeprom_factory_0>, <&macaddr_factory_fe6e 1>;
 		nvmem-cell-names = "eeprom", "mac-address";
 	};

target/linux/realtek/dts/macros.dtsi

@@ -70,7 +70,7 @@
 		managed = "in-band-status"; \
 	};
 
-// LED Set mode definitions
+/* LED Set mode definitions */
 #define RTL93XX_LED_SET_NONE        (0)
 #define RTL93XX_LED_SET_10G         (1 << 0)
 #define RTL93XX_LED_SET_5G          (1 << 1)
@@ -85,3 +85,8 @@
 #define RTL93XX_LED_SET_TX          (1 << 13)
 #define RTL93XX_LED_SET_COLLISION   (1 << 14)
 #define RTL93XX_LED_SET_DUPLEX      (1 << 15)
+
+/* LED Interface modes */
+#define RTL93XX_LED_MODE_SERIAL             1
+#define RTL93XX_LED_MODE_SINGLE_COLOR_SCAN  2
+#define RTL93XX_LED_MODE_BI_COLOR_SCAN      3

target/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/rtl930x.c

@@ -2610,6 +2610,7 @@ static void rtl930x_led_init(struct rtl838x_switch_priv *priv)
 	struct device_node *node;
 	struct device *dev = priv->dev;
 	u8 leds_in_set[4] = {};
+	u32 led_mode = 1;
 	u32 pm = 0;
 
 	node = of_find_compatible_node(NULL, NULL, "realtek,rtl9300-leds");
@@ -2683,8 +2684,9 @@ static void rtl930x_led_init(struct rtl838x_switch_priv *priv)
 		sw_w32_mask(0, set << pos, RTL930X_LED_PORT_FIB_SET_SEL_CTRL(i));
 	}
 
-	/* Set LED mode to serial (0x1) */
+	/* Set LED mode */
-	sw_w32_mask(0x3, 0x1, RTL930X_LED_GLB_CTRL);
+	of_property_read_u32(node, "realtek,led-mode", &led_mode);
+	sw_w32_mask(0x3, led_mode & 0x3, RTL930X_LED_GLB_CTRL);
 
 	/* Set LED active state */
 	if (of_property_read_bool(node, "active-low"))

target/linux/realtek/files-6.18/drivers/net/mdio/mdio-realtek-otto.c

@@ -13,7 +13,16 @@
 #define RTMDIO_MAX_PORTS			57
 #define RTMDIO_MAX_SMI_BUSSES			4
 
+#define RTMDIO_838X_NUM_BUSSES			1
+#define RTMDIO_838X_NUM_PAGES			4096
+#define RTMDIO_839X_NUM_BUSSES			2
+#define RTMDIO_839X_NUM_PAGES			8192
+#define RTMDIO_930X_NUM_BUSSES			4
+#define RTMDIO_930X_NUM_PAGES			4096
+#define RTMDIO_931X_NUM_BUSSES			4
+#define RTMDIO_931X_NUM_PAGES			8192
 #define RTMDIO_PAGE_SELECT			0x1f
+#define RTMDIO_RAW_PAGE(p)			((p) - 1)
 
 #define RTMDIO_PHY_AQR113C_A			0x31c31c12
 #define RTMDIO_PHY_AQR113C_B			0x31c31c13
@@ -28,20 +37,25 @@
 
 #define RTMDIO_PHY_MAC_1G			3
 #define RTMDIO_PHY_MAC_2G_PLUS			1
+#define RTMDIO_PHY_MAC_SDS			0
 
-#define RTMDIO_PHY_POLL_MMD(dev, reg, bit)	((bit << 21) | (dev << 16) | (reg))
+#define RTMDIO_PHY_POLL_MMD(dev, reg, bit)	((((bit) & GENMASK(3, 0)) << 21) | \
+						 (((dev) & GENMASK(4, 0)) << 16) | \
+						 ((reg) & GENMASK(15, 0)))
 
 /* MDIO bus registers/fields */
-#define RTMDIO_C45_DATA(devnum, regnum)		(((devnum) << 16) | ((regnum) & GENMASK(15, 0)))
+#define RTMDIO_C45_DATA(devnum, regnum)		((((devnum) & GENMASK(4, 0)) << 16) | \
+						  ((regnum) & GENMASK(15, 0)))
 #define RTMDIO_DATA_MASK			GENMASK(15, 0)
 #define RTMDIO_RUN				BIT(0)
 
-#define RTMDIO_838X_C22_DATA(page, reg)		((reg) << 20 | 0x1f << 15 | (page) << 3)
+#define RTMDIO_838X_C22_DATA(page, reg)		((reg) << 20 | RTMDIO_PAGE_SELECT << 15 | (page) << 3)
 #define RTMDIO_838X_PHY_PATCH_DONE		BIT(15)
 #define RTMDIO_838X_SMI_GLB_CTRL		(0xa100)
+#define   RTMDIO_838X_SMI_GLB_PHY_MAN_24_27	BIT(7)
 #define RTMDIO_838X_SMI_ACCESS_PHY_CTRL_0	(0xa1b8)
 #define RTMDIO_838X_SMI_ACCESS_PHY_CTRL_1	(0xa1bc)
-#define   RTMDIO_838X_CMD_FAIL			0
+#define   RTMDIO_838X_CMD_FAIL			0 /* No hardware support */
 #define   RTMDIO_838X_CMD_READ_C22		0
 #define   RTMDIO_838X_CMD_READ_C45		BIT(1)
 #define   RTMDIO_838X_CMD_WRITE_C22		BIT(2)
@@ -52,7 +66,8 @@
 #define RTMDIO_838X_SMI_PORT0_5_ADDR_CTRL	(0xa1c8)
 
 #define RTMDIO_839X_C22_DATA(page, reg)		((reg) << 5 | (page) << 10 | \
-						 (((page) == 8191) ? 0x1f : 0) << 23)
+						 (((page) == RTMDIO_RAW_PAGE(RTMDIO_839X_NUM_PAGES)) ? \
+						  RTMDIO_PAGE_SELECT : 0) << 23)
 #define RTMDIO_839X_PHYREG_ACCESS_CTRL		(0x03DC)
 #define   RTMDIO_839X_CMD_FAIL			BIT(1)
 #define   RTMDIO_839X_CMD_READ_C22		0
@@ -60,11 +75,13 @@
 #define   RTMDIO_839X_CMD_WRITE_C22		BIT(3)
 #define   RTMDIO_839X_CMD_WRITE_C45		(BIT(2) | BIT(3))
 #define   RTMDIO_839X_CMD_MASK			GENMASK(3, 0)
+#define RTMDIO_839X_PHYREG_CTRL			(0x03e0)
+#define   RTMDIO_839X_PHYREG_SKIP_EXT_PAGE	GENMASK(8, 0)
 #define RTMDIO_839X_PHYREG_DATA_CTRL		(0x03F0)
 #define RTMDIO_839X_SMI_PORT_POLLING_CTRL	(0x03fc)
 #define RTMDIO_839X_SMI_GLB_CTRL		(0x03f8)
 
-#define RTMDIO_930X_C22_DATA(page, reg)		((reg) << 20 | 0x1f << 15 | (page) << 3)
+#define RTMDIO_930X_C22_DATA(page, reg)		((reg) << 20 | RTMDIO_PAGE_SELECT << 15 | (page) << 3)
 #define RTMDIO_930X_SMI_GLB_CTRL		(0xCA00)
 #define RTMDIO_930X_SMI_ACCESS_PHY_CTRL_0	(0xCB70)
 #define RTMDIO_930X_SMI_ACCESS_PHY_CTRL_1	(0xCB74)
@@ -109,10 +126,7 @@
 #define RTMDIO_931X_SMI_10GPHY_POLLING_SEL4	(0x0D00)
 
 #define for_each_port(ctrl, pn) \
-	for_each_set_bit(pn, ctrl->valid_ports, RTMDIO_MAX_PORTS)
+	for_each_set_bit(pn, (ctrl)->valid_ports, RTMDIO_MAX_PORTS)
-
-#define rtmdio_ctrl_from_bus(bus) \
-	(((struct rtmdio_chan *)(bus)->priv)->ctrl)
 
 /*
  * On all Realtek switch platforms the hardware periodically reads the link status of all
@@ -203,23 +217,24 @@ struct rtmdio_chan {
 };
 
 struct rtmdio_config {
-	int num_phys;
-	int raw_page;
 	u32 cmd_fail;
 	u32 cmd_mask;
 	u32 cmd_reg;
 	int bus_map_base;
+	u16 num_busses;
+	u16 num_pages;
+	u16 num_phys;
 	int port_map_base;
-	int (*read_mmd_phy)(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 *val);
+	int (*read_c22)(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 *val);
-	int (*read_phy)(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 *val);
+	int (*read_c45)(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 *val);
 	u32 ret_mask;
 	u32 ret_reg;
 	int (*setup_ctrl)(struct rtmdio_ctrl *ctrl);
 	void (*setup_polling)(struct rtmdio_ctrl *ctrl);
 	u32 smi_base;
 	u32 smi_size;
-	int (*write_mmd_phy)(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 val);
+	int (*write_c22)(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 val);
-	int (*write_phy)(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 val);
+	int (*write_c45)(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 val);
 };
 
 struct rtmdio_phy_info {
@@ -266,6 +281,11 @@ struct rtmdio_931x_smi_access {
 	u32 m_ctrl;
 };
 
+static inline struct rtmdio_ctrl *rtmdio_ctrl_from_bus(struct mii_bus *bus)
+{
+	return ((struct rtmdio_chan *)bus->priv)->ctrl;
+}
+
 static int rtmdio_phy_to_port(struct mii_bus *bus, int phy)
 {
 	struct rtmdio_chan *chan = bus->priv;
@@ -289,6 +309,7 @@ static int rtmdio_run_cmd(struct mii_bus *bus, int cmd, void *smi_access, u32 *v
 	if (ret)
 		return ret;
 
+	/* Use masks as C22 data and command bits share the same register. */
 	ret = regmap_update_bits(ctrl->map, ctrl->cfg->cmd_reg,
 				 ctrl->cfg->cmd_mask, cmd | RTMDIO_RUN);
 	if (ret)
@@ -316,7 +337,7 @@ static int rtmdio_run_cmd(struct mii_bus *bus, int cmd, void *smi_access, u32 *v
 	return ret;
 }
 
-static int rtmdio_838x_read_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 *val)
+static int rtmdio_838x_read_c22(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 *val)
 {
 	struct rtmdio_838x_smi_access smi_access = {
 		.ctrl_0 = BIT(pn),
@@ -327,7 +348,7 @@ static int rtmdio_838x_read_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg,
 	return rtmdio_run_cmd(bus, RTMDIO_838X_CMD_READ_C22, &smi_access, val);
 }
 
-static int rtmdio_838x_write_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 val)
+static int rtmdio_838x_write_c22(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 val)
 {
 	struct rtmdio_838x_smi_access smi_access = {
 		.ctrl_0 = BIT(pn),
@@ -338,7 +359,7 @@ static int rtmdio_838x_write_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg,
 	return rtmdio_run_cmd(bus, RTMDIO_838X_CMD_WRITE_C22, &smi_access, NULL);
 }
 
-static int rtmdio_838x_read_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 *val)
+static int rtmdio_838x_read_c45(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 *val)
 {
 	struct rtmdio_838x_smi_access smi_access = {
 		.ctrl_0 = BIT(pn),
@@ -349,7 +370,7 @@ static int rtmdio_838x_read_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32
 	return rtmdio_run_cmd(bus, RTMDIO_838X_CMD_READ_C45, &smi_access, val);
 }
 
-static int rtmdio_838x_write_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 val)
+static int rtmdio_838x_write_c45(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 val)
 {
 	struct rtmdio_838x_smi_access smi_access = {
 		.ctrl_0 = BIT(pn),
@@ -360,10 +381,10 @@ static int rtmdio_838x_write_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u3
 	return rtmdio_run_cmd(bus, RTMDIO_838X_CMD_WRITE_C45, &smi_access, NULL);
 }
 
-static int rtmdio_839x_read_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 *val)
+static int rtmdio_839x_read_c22(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 *val)
 {
 	struct rtmdio_839x_smi_access smi_access = {
-		.main_ctrl = 0x1ff,
+		.main_ctrl = RTMDIO_839X_PHYREG_SKIP_EXT_PAGE,
 		.data_ctrl = pn << 16,
 		.accs_ctrl = RTMDIO_839X_C22_DATA(page, reg),
 	};
@@ -371,10 +392,10 @@ static int rtmdio_839x_read_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg,
 	return rtmdio_run_cmd(bus, RTMDIO_839X_CMD_READ_C22, &smi_access, val);
 }
 
-static int rtmdio_839x_write_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 val)
+static int rtmdio_839x_write_c22(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 val)
 {
 	struct rtmdio_839x_smi_access smi_access = {
-		.main_ctrl = 0x1ff,
+		.main_ctrl = RTMDIO_839X_PHYREG_SKIP_EXT_PAGE,
 		.data_ctrl = val << 16,
 		.prt0_ctrl = (u32)(BIT_ULL(pn)),
 		.prt1_ctrl = (u32)(BIT_ULL(pn) >> 32),
@@ -384,7 +405,7 @@ static int rtmdio_839x_write_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg,
 	return rtmdio_run_cmd(bus, RTMDIO_839X_CMD_WRITE_C22, &smi_access, NULL);
 }
 
-static int rtmdio_839x_read_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 *val)
+static int rtmdio_839x_read_c45(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 *val)
 {
 	struct rtmdio_839x_smi_access smi_access = {
 		.data_ctrl = pn << 16,
@@ -394,7 +415,7 @@ static int rtmdio_839x_read_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32
 	return rtmdio_run_cmd(bus, RTMDIO_839X_CMD_READ_C45, &smi_access, val);
 }
 
-static int rtmdio_839x_write_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 val)
+static int rtmdio_839x_write_c45(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 val)
 {
 	struct rtmdio_839x_smi_access smi_access = {
 		.data_ctrl = val << 16,
@@ -406,7 +427,7 @@ static int rtmdio_839x_write_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u3
 	return rtmdio_run_cmd(bus, RTMDIO_839X_CMD_WRITE_C45, &smi_access, NULL);
 }
 
-static int rtmdio_930x_read_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 *val)
+static int rtmdio_930x_read_c22(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 *val)
 {
 	struct rtmdio_930x_smi_access smi_access = {
 		.ctrl_1 = RTMDIO_930X_C22_DATA(page, reg),
@@ -416,7 +437,7 @@ static int rtmdio_930x_read_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg,
 	return rtmdio_run_cmd(bus, RTMDIO_930X_CMD_READ_C22, &smi_access, val);
 }
 
-static int rtmdio_930x_write_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 val)
+static int rtmdio_930x_write_c22(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 val)
 {
 	struct rtmdio_930x_smi_access smi_access = {
 		.ctrl_0 = BIT(pn),
@@ -427,7 +448,7 @@ static int rtmdio_930x_write_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg,
 	return rtmdio_run_cmd(bus, RTMDIO_930X_CMD_WRITE_C22, &smi_access, NULL);
 }
 
-static int rtmdio_930x_read_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 *val)
+static int rtmdio_930x_read_c45(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 *val)
 {
 	struct rtmdio_930x_smi_access smi_access = {
 		.ctrl_2 = pn << 16,
@@ -437,7 +458,7 @@ static int rtmdio_930x_read_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32
 	return rtmdio_run_cmd(bus, RTMDIO_930X_CMD_READ_C45, &smi_access, val);
 }
 
-static int rtmdio_930x_write_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 val)
+static int rtmdio_930x_write_c45(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 val)
 {
 	struct rtmdio_930x_smi_access smi_access = {
 		.ctrl_0 = BIT(pn),
@@ -448,7 +469,7 @@ static int rtmdio_930x_write_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u3
 	return rtmdio_run_cmd(bus, RTMDIO_930X_CMD_WRITE_C45, &smi_access, NULL);
 }
 
-static int rtmdio_931x_read_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 *val)
+static int rtmdio_931x_read_c22(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 *val)
 {
 	struct rtmdio_931x_smi_access smi_access = {
 		.ctrl_0 = RTMDIO_931X_C22_DATA(page, reg),
@@ -458,12 +479,10 @@ static int rtmdio_931x_read_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg,
 	return rtmdio_run_cmd(bus, RTMDIO_931X_CMD_READ_C22, &smi_access, val);
 }
 
-
+static int rtmdio_931x_write_c22(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 val)
-static int rtmdio_931x_write_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg, u32 val)
 {
 	struct rtmdio_931x_smi_access smi_access = {
 		.ctrl_0 = RTMDIO_931X_C22_DATA(page, reg),
-		.ctrl_1 = 0x1ff,
 		.ctrl_2 = (u32)(BIT_ULL(pn)),
 		.ctrl_x = (u32)(BIT_ULL(pn) >> 32),
 		.ctrl_3 = val,
@@ -472,7 +491,7 @@ static int rtmdio_931x_write_phy(struct mii_bus *bus, u32 pn, u32 page, u32 reg,
 	return rtmdio_run_cmd(bus, RTMDIO_931X_CMD_WRITE_C22, &smi_access, NULL);
 }
 
-static int rtmdio_931x_read_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 *val)
+static int rtmdio_931x_read_c45(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 *val)
 {
 	struct rtmdio_931x_smi_access smi_access = {
 		.b_ctrl = pn << 5,
@@ -482,7 +501,7 @@ static int rtmdio_931x_read_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32
 	return rtmdio_run_cmd(bus, RTMDIO_931X_CMD_READ_C45, &smi_access, val);
 }
 
-static int rtmdio_931x_write_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 val)
+static int rtmdio_931x_write_c45(struct mii_bus *bus, u32 pn, u32 devnum, u32 regnum, u32 val)
 {
 	struct rtmdio_931x_smi_access smi_access = {
 		.ctrl_2 = (u32)(BIT_ULL(pn)),
@@ -497,63 +516,64 @@ static int rtmdio_931x_write_mmd_phy(struct mii_bus *bus, u32 pn, u32 devnum, u3
 static int rtmdio_read_c45(struct mii_bus *bus, int phy, int devnum, int regnum)
 {
 	struct rtmdio_ctrl *ctrl = rtmdio_ctrl_from_bus(bus);
-	int err, val, pn;
+	int ret, pn, val = 0;
 
 	pn = rtmdio_phy_to_port(bus, phy);
 	if (pn < 0)
 		return pn;
 
 	guard(mutex)(&ctrl->lock);
-	err = (*ctrl->cfg->read_mmd_phy)(bus, pn, devnum, regnum, &val);
+	ret = (*ctrl->cfg->read_c45)(bus, pn, devnum, regnum, &val);
-	dev_dbg(&bus->dev, "rd_MMD(phy=0x%02x, dev=0x%04x, reg=0x%04x) = 0x%04x, err = %d\n",
+	dev_dbg(&bus->dev, "rd_MMD(phy=0x%02x, dev=0x%04x, reg=0x%04x) = 0x%04x, ret = %d\n",
-		phy, devnum, regnum, val, err);
+		phy, devnum, regnum, val, ret);
 
-	return err ? err : val;
+	return ret ? ret : val;
 }
 
-static int rtmdio_read(struct mii_bus *bus, int phy, int regnum)
+static int rtmdio_read_c22(struct mii_bus *bus, int phy, int regnum)
 {
 	struct rtmdio_ctrl *ctrl = rtmdio_ctrl_from_bus(bus);
-	int err, val, pn;
+	int ret, pn, val = 0;
 
 	pn = rtmdio_phy_to_port(bus, phy);
 	if (pn < 0)
 		return pn;
 
 	guard(mutex)(&ctrl->lock);
-	if (regnum == RTMDIO_PAGE_SELECT && ctrl->port[pn].page != ctrl->cfg->raw_page)
+	if (regnum == RTMDIO_PAGE_SELECT &&
+	    ctrl->port[pn].page != RTMDIO_RAW_PAGE(ctrl->cfg->num_pages))
 		return ctrl->port[pn].page;
 
-	ctrl->port[pn].raw = (ctrl->port[pn].page == ctrl->cfg->raw_page);
+	ctrl->port[pn].raw = (ctrl->port[pn].page == RTMDIO_RAW_PAGE(ctrl->cfg->num_pages));
 
-	err = (*ctrl->cfg->read_phy)(bus, pn, ctrl->port[pn].page, regnum, &val);
+	ret = (*ctrl->cfg->read_c22)(bus, pn, ctrl->port[pn].page, regnum, &val);
-	dev_dbg(&bus->dev, "rd_PHY(phy=0x%02x, pag=0x%04x, reg=0x%04x) = 0x%04x, err = %d\n",
+	dev_dbg(&bus->dev, "rd_PHY(phy=0x%02x, pag=0x%04x, reg=0x%04x) = 0x%04x, ret = %d\n",
-		phy, ctrl->port[pn].page, regnum, val, err);
+		phy, ctrl->port[pn].page, regnum, val, ret);
 
-	return err ? err : val;
+	return ret ? ret : val;
 }
 
 static int rtmdio_write_c45(struct mii_bus *bus, int phy, int devnum, int regnum, u16 val)
 {
 	struct rtmdio_ctrl *ctrl = rtmdio_ctrl_from_bus(bus);
-	int err, pn;
+	int ret, pn;
 
 	pn = rtmdio_phy_to_port(bus, phy);
 	if (pn < 0)
 		return pn;
 
 	guard(mutex)(&ctrl->lock);
-	err = (*ctrl->cfg->write_mmd_phy)(bus, pn, devnum, regnum, val);
+	ret = (*ctrl->cfg->write_c45)(bus, pn, devnum, regnum, val);
-	dev_dbg(&bus->dev, "wr_MMD(phy=0x%02x, dev=0x%04x, reg=0x%04x, val=0x%04x), err = %d\n",
+	dev_dbg(&bus->dev, "wr_MMD(phy=0x%02x, dev=0x%04x, reg=0x%04x, val=0x%04x), ret = %d\n",
-		phy, devnum, regnum, val, err);
+		phy, devnum, regnum, val, ret);
 
-	return err;
+	return ret;
 }
 
-static int rtmdio_write(struct mii_bus *bus, int phy, int regnum, u16 val)
+static int rtmdio_write_c22(struct mii_bus *bus, int phy, int regnum, u16 val)
 {
 	struct rtmdio_ctrl *ctrl = rtmdio_ctrl_from_bus(bus);
-	int err, page, pn;
+	int ret, page, pn;
 
 	pn = rtmdio_phy_to_port(bus, phy);
 	if (pn < 0)
@@ -566,14 +586,14 @@ static int rtmdio_write(struct mii_bus *bus, int phy, int regnum, u16 val)
 		ctrl->port[pn].page = val;
 
 	if (!ctrl->port[pn].raw &&
-	    (regnum != RTMDIO_PAGE_SELECT || page == ctrl->cfg->raw_page)) {
+	    (regnum != RTMDIO_PAGE_SELECT || page == RTMDIO_RAW_PAGE(ctrl->cfg->num_pages))) {
-		ctrl->port[pn].raw = (page == ctrl->cfg->raw_page);
+		ctrl->port[pn].raw = (page == RTMDIO_RAW_PAGE(ctrl->cfg->num_pages));
 
-		err = (*ctrl->cfg->write_phy)(bus, pn, page, regnum, val);
+		ret = (*ctrl->cfg->write_c22)(bus, pn, page, regnum, val);
 		dev_dbg(&bus->dev,
-			"wr_PHY(phy=0x%02x, pag=0x%04x, reg=0x%04x, val=0x%04x), err = %d\n",
+			"wr_PHY(phy=0x%02x, pag=0x%04x, reg=0x%04x, val=0x%04x), ret = %d\n",
-			phy, page, regnum, val, err);
+			phy, page, regnum, val, ret);
-		return err;
+		return ret;
 	}
 
 	ctrl->port[pn].raw = false;
@@ -581,25 +601,32 @@ static int rtmdio_write(struct mii_bus *bus, int phy, int regnum, u16 val)
 	return 0;
 }
 
-static void rtmdio_setup_smi_topology(struct rtmdio_ctrl *ctrl)
+static int rtmdio_setup_smi_topology(struct rtmdio_ctrl *ctrl)
 {
 	u32 reg, mask, val, pn;
+	int ret;
 
 	for_each_port(ctrl, pn) {
 		if (ctrl->cfg->bus_map_base) {
-			reg = (pn / 16) * 4;
+			reg = ctrl->cfg->bus_map_base + (pn / 16) * 4;
-			mask = 0x3 << ((pn % 16) * 2);
+			mask = GENMASK(1, 0) << ((pn % 16) * 2);
-			val = ctrl->port[pn].smi_bus << ((pn % 16) * 2);
+			val = (u32)ctrl->port[pn].smi_bus << __ffs(mask);
-			regmap_update_bits(ctrl->map, ctrl->cfg->bus_map_base + reg, mask, val);
+			ret = regmap_update_bits(ctrl->map, reg, mask, val);
+			if (ret)
+				return ret;
 		}
 
 		if (ctrl->cfg->port_map_base) {
-			reg = (pn / 6) * 4;
+			reg = ctrl->cfg->port_map_base + (pn / 6) * 4;
-			mask = 0x1f << ((pn % 6) * 5);
+			mask = GENMASK(4, 0) << ((pn % 6) * 5);
-			val = ctrl->port[pn].smi_addr << ((pn % 6) * 5);
+			val = (u32)ctrl->port[pn].smi_addr << __ffs(mask);
-			regmap_update_bits(ctrl->map, ctrl->cfg->port_map_base + reg, mask, val);
+			ret = regmap_update_bits(ctrl->map, reg, mask, val);
+			if (ret)
+				return ret;
 		}
 	}
+
+	return 0;
 }
 
 static u32 rtmdio_get_phy_id(struct phy_device *phydev)
@@ -634,7 +661,7 @@ static int rtmdio_get_phy_info(struct rtmdio_ctrl *ctrl, int pn, struct rtmdio_p
 	memset(phyinfo, 0, sizeof(*phyinfo));
 	phyid = rtmdio_get_phy_id(mdiobus_get_phy(bus, addr));
 
-	switch(phyid) {
+	switch (phyid) {
 	case RTMDIO_PHY_AQR113C_A:
 	case RTMDIO_PHY_AQR113C_B:
 	case RTMDIO_PHY_AQR813:
@@ -664,7 +691,7 @@ static int rtmdio_get_phy_info(struct rtmdio_ctrl *ctrl, int pn, struct rtmdio_p
 		phyinfo->has_res_reg = true;
 		break;
 	default:
-		pr_warn("skip polling setup for unknown PHY %08x on port %d\n", phyid, pn);
+		dev_warn(&bus->dev, "skip polling setup for phy 0x%08x on port %d\n", phyid, pn);
 		ret = -EINVAL;
 		break;
 	}
@@ -678,9 +705,7 @@ static int rtmdio_838x_setup_ctrl(struct rtmdio_ctrl *ctrl)
 	 * PHY_PATCH_DONE enables phy control via SoC. This is required for phy access,
 	 * including patching. Must always be set before the phys are probed.
 	 */
-	regmap_set_bits(ctrl->map, RTMDIO_838X_SMI_GLB_CTRL, RTMDIO_838X_PHY_PATCH_DONE);
+	return regmap_set_bits(ctrl->map, RTMDIO_838X_SMI_GLB_CTRL, RTMDIO_838X_PHY_PATCH_DONE);
-
-	return 0;
 }
 
 static void rtmdio_838x_setup_polling(struct rtmdio_ctrl *ctrl)
@@ -694,7 +719,8 @@ static void rtmdio_838x_setup_polling(struct rtmdio_ctrl *ctrl)
 	 * give the real media status (0=copper, 1=fibre). For now assume that if address 24 is
 	 * PHY driven, it must be a combo PHY and media detection is needed.
 	 */
-	regmap_assign_bits(ctrl->map, RTMDIO_838X_SMI_GLB_CTRL, BIT(7),
+	regmap_assign_bits(ctrl->map, RTMDIO_838X_SMI_GLB_CTRL,
+			   RTMDIO_838X_SMI_GLB_PHY_MAN_24_27,
 			   test_bit(24, ctrl->valid_ports));
 }
 
@@ -716,31 +742,51 @@ static int rtmdio_839x_setup_ctrl(struct rtmdio_ctrl *ctrl)
 
 static int rtmdio_930x_setup_ctrl(struct rtmdio_ctrl *ctrl)
 {
+	int ret;
+
 	/* Define C22/C45 bus feature set */
-	for (int smi_bus = 0; smi_bus < RTMDIO_MAX_SMI_BUSSES; smi_bus++)
+	for (int smi_bus = 0; smi_bus < ctrl->cfg->num_busses; smi_bus++) {
-		regmap_assign_bits(ctrl->map, RTMDIO_930X_SMI_GLB_CTRL,
+		ret = regmap_assign_bits(ctrl->map, RTMDIO_930X_SMI_GLB_CTRL,
-				   BIT(16 + smi_bus), ctrl->bus[smi_bus].is_c45);
+					 BIT(16 + smi_bus), ctrl->bus[smi_bus].is_c45);
+		if (ret)
+			return ret;
+	}
 
 	return 0;
 }
 
+static int rtmdio_930x_set_port_ability(struct rtmdio_ctrl *ctrl, u32 pn, u32 ability)
+{
+	u32 mask, val;
+
+	if (pn >= ctrl->cfg->num_phys)
+		return -EINVAL;
+	/*
+	 * Hardware accepts only register values 0-3 but uses 2 types of fields. Ports 0-23 are
+	 * grouped by 4 with 2 field bits. Ports 24-27 are handled individually with 3 field bits.
+	 */
+	mask = pn < 24 ? GENMASK(1, 0) << ((pn / 4) * 2) : GENMASK(2, 0) << ((pn - 24) * 3 + 12);
+	val = ability << __ffs(mask);
+
+	return regmap_update_bits(ctrl->map, RTMDIO_930X_SMI_MAC_TYPE_CTRL, mask, val);
+}
+
 static void rtmdio_930x_setup_polling(struct rtmdio_ctrl *ctrl)
 {
 	struct rtmdio_phy_info phyinfo;
-	unsigned int mask, val, pn;
+	unsigned int pn;
 
-	/* set everthing to "SerDes driven" */
+	/* set all ports to "SerDes driven" */
-	regmap_write(ctrl->map, RTMDIO_930X_SMI_MAC_TYPE_CTRL, 0);
+	for (pn = 0; pn < ctrl->cfg->num_phys; pn++)
+		rtmdio_930x_set_port_ability(ctrl, pn, RTMDIO_PHY_MAC_SDS);
 
 	/* Define PHY specific polling parameters */
 	for_each_port(ctrl, pn) {
 		if (rtmdio_get_phy_info(ctrl, pn, &phyinfo))
 			continue;
 
-		/* set to "PHY driven" */
+		/* set port to "PHY driven" */
-		mask = pn > 23 ? 0x7 << ((pn - 24) * 3 + 12): 0x3 << ((pn / 4) * 2);
+		rtmdio_930x_set_port_ability(ctrl, pn, phyinfo.mac_type);
-		val = phyinfo.mac_type << (ffs(mask) - 1);
-		regmap_update_bits(ctrl->map, RTMDIO_930X_SMI_MAC_TYPE_CTRL, mask, val);
 
 		/* polling via standard or resolution register */
 		regmap_assign_bits(ctrl->map, RTMDIO_930X_SMI_GLB_CTRL,
@@ -750,7 +796,7 @@ static void rtmdio_930x_setup_polling(struct rtmdio_ctrl *ctrl)
 		regmap_assign_bits(ctrl->map, RTMDIO_930X_SMI_PRVTE_POLLING_CTRL,
 				   BIT(pn), phyinfo.has_giga_lite);
 
-		/* special duplex/advertisement polling registers */
+		/* Unique 10G polling setup enforced by hardware design. Always same 10G PHYs. */
 		if (phyinfo.poll_duplex || phyinfo.poll_adv_1000 || phyinfo.poll_lpa_1000) {
 			regmap_write(ctrl->map, RTMDIO_930X_SMI_10G_POLLING_REG0_CFG, phyinfo.poll_duplex);
 			regmap_write(ctrl->map, RTMDIO_930X_SMI_10G_POLLING_REG9_CFG, phyinfo.poll_adv_1000);
@@ -761,46 +807,56 @@ static void rtmdio_930x_setup_polling(struct rtmdio_ctrl *ctrl)
 
 static int rtmdio_931x_setup_ctrl(struct rtmdio_ctrl *ctrl)
 {
-	u32 c45_mask = 0;
+	int ret;
 
 	/* Disable polling for configuration purposes */
 	regmap_write(ctrl->map, RTMDIO_931X_SMI_PORT_POLLING_CTRL, 0);
 	regmap_write(ctrl->map, RTMDIO_931X_SMI_PORT_POLLING_CTRL + 4, 0);
 	msleep(100);
 
-	/* Define C22/C45 bus feature set */
+	/* Define C22/C45 bus feature set (bit 1 of SMI_SETx_FMT_SEL) */
-	for (int smi_bus = 0; smi_bus < RTMDIO_MAX_SMI_BUSSES; smi_bus++) {
+	for (int smi_bus = 0; smi_bus < ctrl->cfg->num_busses; smi_bus++) {
-		if (ctrl->bus[smi_bus].is_c45)
+		ret = regmap_assign_bits(ctrl->map, RTMDIO_931X_SMI_GLB_CTRL1,
-			c45_mask |= 0x2 << (smi_bus * 2);  /* Std. C45, non-standard is 0x3 */
+					 BIT(smi_bus * 2 + 1), ctrl->bus[smi_bus].is_c45);
+		if (ret)
+			return ret;
 	}
-	regmap_update_bits(ctrl->map, RTMDIO_931X_SMI_GLB_CTRL1, GENMASK(7, 0), c45_mask);
 
 	return 0;
 }
 
+static int rtmdio_931x_set_port_ability(struct rtmdio_ctrl *ctrl, u32 pn, u32 ability)
+{
+	u32 mask, val, reg;
+
+	if (pn >= ctrl->cfg->num_phys)
+		return -EINVAL;
+
+	reg = RTMDIO_931X_SMI_PHY_ABLTY_GET_SEL + (pn / 16) * 4;
+	mask = GENMASK(1, 0) << ((pn % 16) * 2);
+	val = ability << __ffs(mask);
+
+	return regmap_update_bits(ctrl->map, reg, mask, val);
+}
+
 static void rtmdio_931x_setup_polling(struct rtmdio_ctrl *ctrl)
 {
 	struct rtmdio_phy_info phyinfo;
 	u32 pn;
 
-	/* set everything to "SerDes driven" */
+	/* set all ports to "SerDes driven" */
-	for (int reg = 0; reg < 4; reg++)
+	for (pn = 0; pn < ctrl->cfg->num_phys; pn++)
-		regmap_write(ctrl->map, RTMDIO_931X_SMI_PHY_ABLTY_GET_SEL + reg * 4,
+		rtmdio_931x_set_port_ability(ctrl, pn, RTMDIO_931X_SMI_PHY_ABLTY_SDS);
-			     RTMDIO_931X_SMI_PHY_ABLTY_SDS * 0x55555555U);
 
 	/* Define PHY specific polling parameters */
 	for_each_port(ctrl, pn) {
 		u8 smi_bus = ctrl->port[pn].smi_bus;
-		unsigned int mask, val;
 
 		if (rtmdio_get_phy_info(ctrl, pn, &phyinfo))
 			continue;
 
-		/* set to "PHY driven" */
+		/* set port to "PHY driven" */
-		mask = GENMASK(1, 0) << ((pn % 16) * 2);
+		rtmdio_931x_set_port_ability(ctrl, pn, RTMDIO_931X_SMI_PHY_ABLTY_MDIO);
-		val = RTMDIO_931X_SMI_PHY_ABLTY_MDIO << (ffs(mask) - 1);
-		regmap_update_bits(ctrl->map, RTMDIO_931X_SMI_PHY_ABLTY_GET_SEL + (pn / 16) * 4,
-				   mask, val);
 
 		/* PRVTE0 polling */
 		regmap_assign_bits(ctrl->map, RTMDIO_931X_SMI_GLB_CTRL0,
@@ -809,11 +865,11 @@ static void rtmdio_931x_setup_polling(struct rtmdio_ctrl *ctrl)
 		regmap_assign_bits(ctrl->map, RTMDIO_931X_SMI_GLB_CTRL0,
 				   BIT(24 + smi_bus), phyinfo.force_res);
 
-		/* polling std. or proprietary format (bit 0 of SMI_SETX_FMT_SEL) */
+		/* polling std. or proprietary format (bit 0 of SMI_SETx_FMT_SEL) */
 		regmap_assign_bits(ctrl->map, RTMDIO_931X_SMI_GLB_CTRL1,
 				   BIT(smi_bus * 2), phyinfo.force_res);
 
-		/* special polling registers */
+		/* Unique 10G polling setup enforced by hardware design. Always same 10G PHYs. */
 		if (phyinfo.poll_duplex || phyinfo.poll_adv_1000 || phyinfo.poll_lpa_1000) {
 			regmap_write(ctrl->map, RTMDIO_931X_SMI_10GPHY_POLLING_SEL2, phyinfo.poll_duplex);
 			regmap_write(ctrl->map, RTMDIO_931X_SMI_10GPHY_POLLING_SEL3, phyinfo.poll_adv_1000);
@@ -869,7 +925,7 @@ static int rtmdio_map_ports(struct device *dev)
 			return dev_err_probe(dev, -EINVAL, "%pfwP no bus address\n",
 					     of_fwnode_handle(phy->parent));
 
-		if (smi_bus >= RTMDIO_MAX_SMI_BUSSES)
+		if (smi_bus >= ctrl->cfg->num_busses)
 			return dev_err_probe(dev, -EINVAL, "%pfwP illegal bus number\n",
 					     of_fwnode_handle(phy->parent));
 
@@ -893,7 +949,9 @@ static int rtmdio_probe_one(struct device *dev, struct rtmdio_ctrl *ctrl,
 
 	ret = fwnode_property_read_u32(node, "reg", &smi_bus);
 	if (ret)
-		return ret;
+		return dev_err_probe(dev, ret, "%pfwP missing reg property for MDIO bus\n", node);
+	if (smi_bus >= ctrl->cfg->num_busses)
+		return dev_err_probe(dev, -EINVAL, "%pfwP wrong bus index %d\n", node, smi_bus);
 
 	bus = devm_mdiobus_alloc_size(dev, sizeof(*chan));
 	if (!bus)
@@ -906,8 +964,8 @@ static int rtmdio_probe_one(struct device *dev, struct rtmdio_ctrl *ctrl,
 	chan->smi_bus = smi_bus;
 
 	bus->name = "Realtek MDIO bus";
-	bus->read = rtmdio_read;
+	bus->read = rtmdio_read_c22;
-	bus->write = rtmdio_write;
+	bus->write = rtmdio_write_c22;
 	bus->read_c45 = rtmdio_read_c45;
 	bus->write_c45 = rtmdio_write_c45;
 	bus->parent = dev;
@@ -944,8 +1002,13 @@ static int rtmdio_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
-	rtmdio_setup_smi_topology(ctrl);
+	ret = rtmdio_setup_smi_topology(ctrl);
-	ctrl->cfg->setup_ctrl(ctrl);
+	if (ret)
+		return ret;
+
+	ret = ctrl->cfg->setup_ctrl(ctrl);
+	if (ret)
+		return ret;
 
 	device_for_each_child_node_scoped(dev, child) {
 		ret = rtmdio_probe_one(dev, ctrl, child);
@@ -960,79 +1023,83 @@ static int rtmdio_probe(struct platform_device *pdev)
 }
 
 static const struct rtmdio_config rtmdio_838x_cfg = {
-	.num_phys	= 28,
-	.raw_page	= 4095,
 	.cmd_fail	= RTMDIO_838X_CMD_FAIL,
 	.cmd_mask	= RTMDIO_838X_CMD_MASK,
 	.cmd_reg	= RTMDIO_838X_SMI_ACCESS_PHY_CTRL_1,
+	.num_busses	= RTMDIO_838X_NUM_BUSSES,
+	.num_pages	= RTMDIO_838X_NUM_PAGES,
+	.num_phys	= 28,
 	.port_map_base	= RTMDIO_838X_SMI_PORT0_5_ADDR_CTRL,
-	.read_mmd_phy	= rtmdio_838x_read_mmd_phy,
+	.read_c22	= rtmdio_838x_read_c22,
-	.read_phy	= rtmdio_838x_read_phy,
+	.read_c45	= rtmdio_838x_read_c45,
 	.ret_mask	= GENMASK(15, 0),
 	.ret_reg	= RTMDIO_838X_SMI_ACCESS_PHY_CTRL_2,
 	.setup_ctrl	= rtmdio_838x_setup_ctrl,
 	.setup_polling	= rtmdio_838x_setup_polling,
 	.smi_base	= RTMDIO_838X_SMI_ACCESS_PHY_CTRL_0,
 	.smi_size	= sizeof(struct rtmdio_838x_smi_access),
-	.write_mmd_phy	= rtmdio_838x_write_mmd_phy,
+	.write_c22	= rtmdio_838x_write_c22,
-	.write_phy	= rtmdio_838x_write_phy,
+	.write_c45	= rtmdio_838x_write_c45,
 };
 
 static const struct rtmdio_config rtmdio_839x_cfg = {
-	.num_phys	= 52,
-	.raw_page	= 8191,
 	.cmd_fail	= RTMDIO_839X_CMD_FAIL,
 	.cmd_mask	= RTMDIO_839X_CMD_MASK,
 	.cmd_reg	= RTMDIO_839X_PHYREG_ACCESS_CTRL,
-	.read_mmd_phy	= rtmdio_839x_read_mmd_phy,
+	.num_busses	= RTMDIO_839X_NUM_BUSSES,
-	.read_phy	= rtmdio_839x_read_phy,
+	.num_pages	= RTMDIO_839X_NUM_PAGES,
+	.num_phys	= 52,
+	.read_c22	= rtmdio_839x_read_c22,
+	.read_c45	= rtmdio_839x_read_c45,
 	.ret_mask	= GENMASK(15, 0),
 	.ret_reg	= RTMDIO_839X_PHYREG_DATA_CTRL,
 	.setup_ctrl	= rtmdio_839x_setup_ctrl,
 	.smi_base	= RTMDIO_839X_PHYREG_ACCESS_CTRL,
 	.smi_size	= sizeof(struct rtmdio_839x_smi_access),
-	.write_mmd_phy	= rtmdio_839x_write_mmd_phy,
+	.write_c22	= rtmdio_839x_write_c22,
-	.write_phy	= rtmdio_839x_write_phy,
+	.write_c45	= rtmdio_839x_write_c45,
 };
 
 static const struct rtmdio_config rtmdio_930x_cfg = {
-	.num_phys	= 28,
-	.raw_page	= 4095,
 	.cmd_fail	= RTMDIO_930X_CMD_FAIL,
 	.cmd_mask	= RTMDIO_930X_CMD_MASK,
 	.cmd_reg	= RTMDIO_930X_SMI_ACCESS_PHY_CTRL_1,
 	.bus_map_base	= RTMDIO_930X_SMI_PORT0_15_POLLING_SEL,
+	.num_busses	= RTMDIO_930X_NUM_BUSSES,
+	.num_pages	= RTMDIO_930X_NUM_PAGES,
+	.num_phys	= 28,
 	.port_map_base	= RTMDIO_930X_SMI_PORT0_5_ADDR_CTRL,
-	.read_mmd_phy	= rtmdio_930x_read_mmd_phy,
+	.read_c22	= rtmdio_930x_read_c22,
-	.read_phy	= rtmdio_930x_read_phy,
+	.read_c45	= rtmdio_930x_read_c45,
 	.ret_mask	= GENMASK(15, 0),
 	.ret_reg	= RTMDIO_930X_SMI_ACCESS_PHY_CTRL_2,
 	.setup_ctrl	= rtmdio_930x_setup_ctrl,
 	.setup_polling	= rtmdio_930x_setup_polling,
 	.smi_base	= RTMDIO_930X_SMI_ACCESS_PHY_CTRL_0,
 	.smi_size	= sizeof(struct rtmdio_930x_smi_access),
-	.write_mmd_phy	= rtmdio_930x_write_mmd_phy,
+	.write_c22	= rtmdio_930x_write_c22,
-	.write_phy	= rtmdio_930x_write_phy,
+	.write_c45	= rtmdio_930x_write_c45,
 };
 
 static const struct rtmdio_config rtmdio_931x_cfg = {
-	.num_phys	= 56,
-	.raw_page	= 8191,
 	.cmd_fail	= RTMDIO_931X_CMD_FAIL,
 	.cmd_mask	= RTMDIO_931X_CMD_MASK,
 	.cmd_reg	= RTMDIO_931X_SMI_INDRT_ACCESS_CTRL_0,
 	.bus_map_base	= RTMDIO_931X_SMI_PORT_POLLING_SEL,
+	.num_busses	= RTMDIO_931X_NUM_BUSSES,
+	.num_pages	= RTMDIO_931X_NUM_PAGES,
+	.num_phys	= 56,
 	.port_map_base	= RTMDIO_931X_SMI_PORT_ADDR_CTRL,
-	.read_mmd_phy	= rtmdio_931x_read_mmd_phy,
+	.read_c22	= rtmdio_931x_read_c22,
-	.read_phy	= rtmdio_931x_read_phy,
+	.read_c45	= rtmdio_931x_read_c45,
 	.ret_mask	= GENMASK(31, 16),
 	.ret_reg	= RTMDIO_931X_SMI_INDRT_ACCESS_CTRL_3,
 	.setup_ctrl	= rtmdio_931x_setup_ctrl,
 	.setup_polling	= rtmdio_931x_setup_polling,
 	.smi_base	= RTMDIO_931X_SMI_INDRT_ACCESS_CTRL_0,
 	.smi_size	= sizeof(struct rtmdio_931x_smi_access),
-	.write_mmd_phy	= rtmdio_931x_write_mmd_phy,
+	.write_c22	= rtmdio_931x_write_c22,
-	.write_phy	= rtmdio_931x_write_phy,
+	.write_c45	= rtmdio_931x_write_c45,
 };
 
 static const struct of_device_id rtmdio_ids[] = {
@@ -1066,5 +1133,6 @@ static struct platform_driver rtmdio_driver = {
 
 module_platform_driver(rtmdio_driver);
 
-MODULE_DESCRIPTION("RTL83xx/RTL93xx MDIO driver");
+MODULE_AUTHOR("Markus Stockhausen <markus.stockhausen@gmx.de>");
-MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Realtek Otto MDIO driver");
+MODULE_LICENSE("GPL v2");

target/linux/realtek/files-6.18/drivers/net/phy/realtek/realtek_multiport.c

@@ -300,6 +300,7 @@ static int rtl8214fc_get_features(struct phy_device *phydev)
 	 * announce the superset of all possible features.
 	 */
 	linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT, phydev->supported);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_100baseFX_Full_BIT, phydev->supported);
 	linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported);
 
 	return 0;
@@ -325,10 +326,15 @@ static int rtl8214fc_config_aneg(struct phy_device *phydev)
 {
 	int ret;
 
-	if (rtl8214fc_media_is_fibre(phydev))
+	if (rtl8214fc_media_is_fibre(phydev)) {
+		if (linkmode_test_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, phydev->advertising)) {
+			linkmode_clear_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, phydev->advertising);
+			linkmode_set_bit(ETHTOOL_LINK_MODE_100baseFX_Full_BIT, phydev->advertising);
+		}
 		ret = genphy_c37_config_aneg(phydev);
-	else
+	} else {
 		ret = genphy_config_aneg(phydev);
+	}
 
 	return ret;
 }

toolchain/gcc/Config.in

@@ -6,9 +6,6 @@ choice
 	help
 	  Select the version of gcc you wish to use.
 
-	config GCC_USE_VERSION_12
-		bool "gcc 12.x"
-
 	config GCC_USE_VERSION_13
 		bool "gcc 13.x"
 

toolchain/gcc/Config.version

@@ -1,7 +1,3 @@
-config GCC_VERSION_12
-	default y if GCC_USE_VERSION_12
-	bool
-
 config GCC_VERSION_13
 	default y if GCC_USE_VERSION_13
 	bool
@@ -13,7 +9,6 @@ config GCC_VERSION_15
 config GCC_VERSION
 	string
 	default EXTERNAL_GCC_VERSION	if EXTERNAL_TOOLCHAIN && !NATIVE_TOOLCHAIN
-	default "12.3.0"	if GCC_VERSION_12
 	default "13.4.0"	if GCC_VERSION_13
 	default "15.2.0"	if GCC_VERSION_15
 	default "14.3.0"

toolchain/gcc/common.mk

@@ -30,14 +30,6 @@ PKG_SOURCE_URL:=@GNU/gcc/gcc-$(PKG_VERSION)
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_CPE_ID:=cpe:/a:gnu:gcc
 
-ifeq ($(PKG_VERSION),11.3.0)
-  PKG_HASH:=b47cf2818691f5b1e21df2bb38c795fac2cfbd640ede2d0a5e1c89e338a3ac39
-endif
-
-ifeq ($(PKG_VERSION),12.3.0)
-  PKG_HASH:=949a5d4f99e786421a93b532b22ffab5578de7321369975b91aec97adfda8c3b
-endif
-
 ifeq ($(PKG_VERSION),13.4.0)
   PKG_HASH:=9c4ce6dbb040568fdc545588ac03c5cbc95a8dbf0c7aa490170843afb59ca8f5
 endif
@@ -200,12 +192,6 @@ define Host/SetToolchainInfo
 endef
 
 
-ifeq ($(GCC_MAJOR_VERSION),11)
-	GCC_VERSION_FILE:=gcc/version.c
-else
-	GCC_VERSION_FILE:=gcc/genversion.cc
-endif
-
 ifneq ($(GCC_PREPARE),)
   define Host/Prepare
 	$(call Host/SetToolchainInfo)
@@ -214,7 +200,7 @@ ifneq ($(GCC_PREPARE),)
 	$(CP) $(SCRIPT_DIR)/config.{guess,sub} $(HOST_SOURCE_DIR)/
 	$(SED) 's,^MULTILIB_OSDIRNAMES,# MULTILIB_OSDIRNAMES,' $(HOST_SOURCE_DIR)/gcc/config/*/t-*
 	$(SED) 'd' $(HOST_SOURCE_DIR)/gcc/DEV-PHASE
-	$(SED) 's, DATESTAMP,,' $(HOST_SOURCE_DIR)/$(GCC_VERSION_FILE)
+	$(SED) 's, DATESTAMP,,' $(HOST_SOURCE_DIR)/gcc/genversion.cc
 	$(SED) 's,gcc_no_link=yes,gcc_no_link=no,' $(HOST_SOURCE_DIR)/libstdc++-v3/configure
 	mkdir -p $(GCC_BUILD_DIR)
   endef

toolchain/gcc/patches-12.x/002-case_insensitive.patch

@@ -1,24 +0,0 @@
-commit 81cc26c706b2bc8c8c1eb1a322e5c5157900836e
-Author: Felix Fietkau <nbd@openwrt.org>
-Date:   Sun Oct 19 21:45:51 2014 +0000
-
-    gcc: do not assume that the Mac OS X filesystem is case insensitive
-    
-    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-    
-    SVN-Revision: 42973
-
---- a/include/filenames.h
-+++ b/include/filenames.h
-@@ -44,11 +44,6 @@ extern "C" {
- #  define IS_DIR_SEPARATOR(c) IS_DOS_DIR_SEPARATOR (c)
- #  define IS_ABSOLUTE_PATH(f) IS_DOS_ABSOLUTE_PATH (f)
- #else /* not DOSish */
--#  if defined(__APPLE__)
--#    ifndef HAVE_CASE_INSENSITIVE_FILE_SYSTEM
--#      define HAVE_CASE_INSENSITIVE_FILE_SYSTEM 1
--#    endif
--#  endif /* __APPLE__ */
- #  define HAS_DRIVE_SPEC(f) (0)
- #  define IS_DIR_SEPARATOR(c) IS_UNIX_DIR_SEPARATOR (c)
- #  define IS_ABSOLUTE_PATH(f) IS_UNIX_ABSOLUTE_PATH (f)

toolchain/gcc/patches-12.x/010-documentation.patch

@@ -1,35 +0,0 @@
-commit 098bd91f5eae625c7d2ee621e10930fc4434e5e2
-Author: Luka Perkov <luka@openwrt.org>
-Date:   Tue Feb 26 16:16:33 2013 +0000
-
-    gcc: don't build documentation
-    
-    This closes #13039.
-    
-    Signed-off-by: Luka Perkov <luka@openwrt.org>
-    
-    SVN-Revision: 35807
-
---- a/gcc/Makefile.in
-+++ b/gcc/Makefile.in
-@@ -3366,18 +3366,10 @@ doc/gcc.info: $(TEXI_GCC_FILES)
- doc/gccint.info: $(TEXI_GCCINT_FILES)
- doc/cppinternals.info: $(TEXI_CPPINT_FILES)
- 
--doc/%.info: %.texi
--	if [ x$(BUILD_INFO) = xinfo ]; then \
--		$(MAKEINFO) $(MAKEINFOFLAGS) -I . -I $(gcc_docdir) \
--			-I $(gcc_docdir)/include -o $@ $<; \
--	fi
-+doc/%.info:
- 
- # Duplicate entry to handle renaming of gccinstall.info
--doc/gccinstall.info: $(TEXI_GCCINSTALL_FILES)
--	if [ x$(BUILD_INFO) = xinfo ]; then \
--		$(MAKEINFO) $(MAKEINFOFLAGS) -I $(gcc_docdir) \
--			-I $(gcc_docdir)/include -o $@ $<; \
--	fi
-+doc/gccinstall.info:
- 
- doc/cpp.dvi: $(TEXI_CPP_FILES)
- doc/gcc.dvi: $(TEXI_GCC_FILES)

toolchain/gcc/patches-12.x/020-Include-safe-ctype.h-after-C-standard-headers-to-avo.patch

@@ -1,134 +0,0 @@
-From 9970b576b7e4ae337af1268395ff221348c4b34a Mon Sep 17 00:00:00 2001
-From: Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
-Date: Thu, 7 Mar 2024 14:36:03 +0100
-Subject: [PATCH] Include safe-ctype.h after C++ standard headers, to avoid
- over-poisoning
-
-When building gcc's C++ sources against recent libc++, the poisoning of
-the ctype macros due to including safe-ctype.h before including C++
-standard headers such as <list>, <map>, etc, causes many compilation
-errors, similar to:
-
-  In file included from /home/dim/src/gcc/master/gcc/gensupport.cc:23:
-  In file included from /home/dim/src/gcc/master/gcc/system.h:233:
-  In file included from /usr/include/c++/v1/vector:321:
-  In file included from
-  /usr/include/c++/v1/__format/formatter_bool.h:20:
-  In file included from
-  /usr/include/c++/v1/__format/formatter_integral.h:32:
-  In file included from /usr/include/c++/v1/locale:202:
-  /usr/include/c++/v1/__locale:546:5: error: '__abi_tag__' attribute
-  only applies to structs, variables, functions, and namespaces
-    546 |     _LIBCPP_INLINE_VISIBILITY
-        |     ^
-  /usr/include/c++/v1/__config:813:37: note: expanded from macro
-  '_LIBCPP_INLINE_VISIBILITY'
-    813 | #  define _LIBCPP_INLINE_VISIBILITY _LIBCPP_HIDE_FROM_ABI
-        |                                     ^
-  /usr/include/c++/v1/__config:792:26: note: expanded from macro
-  '_LIBCPP_HIDE_FROM_ABI'
-    792 |
-    __attribute__((__abi_tag__(_LIBCPP_TOSTRING(
-  _LIBCPP_VERSIONED_IDENTIFIER))))
-        |                          ^
-  In file included from /home/dim/src/gcc/master/gcc/gensupport.cc:23:
-  In file included from /home/dim/src/gcc/master/gcc/system.h:233:
-  In file included from /usr/include/c++/v1/vector:321:
-  In file included from
-  /usr/include/c++/v1/__format/formatter_bool.h:20:
-  In file included from
-  /usr/include/c++/v1/__format/formatter_integral.h:32:
-  In file included from /usr/include/c++/v1/locale:202:
-  /usr/include/c++/v1/__locale:547:37: error: expected ';' at end of
-  declaration list
-    547 |     char_type toupper(char_type __c) const
-        |                                     ^
-  /usr/include/c++/v1/__locale:553:48: error: too many arguments
-  provided to function-like macro invocation
-    553 |     const char_type* toupper(char_type* __low, const
-    char_type* __high) const
-        |                                                ^
-  /home/dim/src/gcc/master/gcc/../include/safe-ctype.h:146:9: note:
-  macro 'toupper' defined here
-    146 | #define toupper(c) do_not_use_toupper_with_safe_ctype
-        |         ^
-
-This is because libc++ uses different transitive includes than
-libstdc++, and some of those transitive includes pull in various ctype
-declarations (typically via <locale>).
-
-There was already a special case for including <string> before
-safe-ctype.h, so move the rest of the C++ standard header includes to
-the same location, to fix the problem.
-
-gcc/ChangeLog:
-
-	* system.h: Include safe-ctype.h after C++ standard headers.
-
-Signed-off-by: Dimitry Andric <dimitry@andric.com>
----
- gcc/system.h | 39 ++++++++++++++++++---------------------
- 1 file changed, 18 insertions(+), 21 deletions(-)
-
---- a/gcc/system.h
-+++ b/gcc/system.h
-@@ -194,27 +194,8 @@ extern int fprintf_unlocked (FILE *, con
- #undef fread_unlocked
- #undef fwrite_unlocked
- 
--/* Include <string> before "safe-ctype.h" to avoid GCC poisoning
--   the ctype macros through safe-ctype.h */
--
--#ifdef __cplusplus
--#ifdef INCLUDE_STRING
--# include <string>
--#endif
--#endif
--
--/* There are an extraordinary number of issues with <ctype.h>.
--   The last straw is that it varies with the locale.  Use libiberty's
--   replacement instead.  */
--#include "safe-ctype.h"
--
--#include <sys/types.h>
--
--#include <errno.h>
--
--#if !defined (errno) && defined (HAVE_DECL_ERRNO) && !HAVE_DECL_ERRNO
--extern int errno;
--#endif
-+/* Include C++ standard headers before "safe-ctype.h" to avoid GCC
-+   poisoning the ctype macros through safe-ctype.h */
- 
- #ifdef __cplusplus
- #if defined (INCLUDE_ALGORITHM) || !defined (HAVE_SWAP_IN_UTILITY)
-@@ -229,6 +210,9 @@ extern int errno;
- #ifdef INCLUDE_SET
- # include <set>
- #endif
-+#ifdef INCLUDE_STRING
-+# include <string>
-+#endif
- #ifdef INCLUDE_VECTOR
- # include <vector>
- #endif
-@@ -245,6 +229,19 @@ extern int errno;
- # include <type_traits>
- #endif
- 
-+/* There are an extraordinary number of issues with <ctype.h>.
-+   The last straw is that it varies with the locale.  Use libiberty's
-+   replacement instead.  */
-+#include "safe-ctype.h"
-+
-+#include <sys/types.h>
-+
-+#include <errno.h>
-+
-+#if !defined (errno) && defined (HAVE_DECL_ERRNO) && !HAVE_DECL_ERRNO
-+extern int errno;
-+#endif
-+
- /* Some of glibc's string inlines cause warnings.  Plus we'd rather
-    rely on (and therefore test) GCC's string builtins.  */
- #define __NO_STRING_INLINES

toolchain/gcc/patches-12.x/021-libcc1-fix-vector-include.patch

@@ -1,58 +0,0 @@
-From 5213047b1d50af63dfabb5e5649821a6cb157e33 Mon Sep 17 00:00:00 2001
-From: Francois-Xavier Coudert <fxcoudert@gcc.gnu.org>
-Date: Sat, 16 Mar 2024 09:50:00 +0100
-Subject: [PATCH] libcc1: fix <vector> include
-
-Use INCLUDE_VECTOR before including system.h, instead of directly
-including <vector>, to avoid running into poisoned identifiers.
-
-Signed-off-by: Dimitry Andric <dimitry@andric.com>
-
-libcc1/ChangeLog:
-
-	PR middle-end/111632
-	* libcc1plugin.cc: Fix include.
-	* libcp1plugin.cc: Fix include.
----
- libcc1/libcc1plugin.cc | 3 +--
- libcc1/libcp1plugin.cc | 3 +--
- 2 files changed, 2 insertions(+), 4 deletions(-)
-
---- a/libcc1/libcc1plugin.cc
-+++ b/libcc1/libcc1plugin.cc
-@@ -32,6 +32,7 @@
- #undef PACKAGE_VERSION
- 
- #define INCLUDE_MEMORY
-+#define INCLUDE_VECTOR
- #include "gcc-plugin.h"
- #include "system.h"
- #include "coretypes.h"
-@@ -69,8 +70,6 @@
- #include "gcc-c-interface.h"
- #include "context.hh"
- 
--#include <vector>
--
- using namespace cc1_plugin;
- 
- 
---- a/libcc1/libcp1plugin.cc
-+++ b/libcc1/libcp1plugin.cc
-@@ -33,6 +33,7 @@
- #undef PACKAGE_VERSION
- 
- #define INCLUDE_MEMORY
-+#define INCLUDE_VECTOR
- #include "gcc-plugin.h"
- #include "system.h"
- #include "coretypes.h"
-@@ -71,8 +72,6 @@
- #include "rpc.hh"
- #include "context.hh"
- 
--#include <vector>
--
- using namespace cc1_plugin;
- 
- 

toolchain/gcc/patches-12.x/110-Fix-MIPS-PR-84790.patch

@@ -1,20 +0,0 @@
-Fix https://gcc.gnu.org/bugzilla/show_bug.cgi?id=84790.
-MIPS16 functions have a static assembler prologue which clobbers
-registers v0 and v1. Add these register clobbers to function call
-instructions.
-
---- a/gcc/config/mips/mips.cc
-+++ b/gcc/config/mips/mips.cc
-@@ -3134,6 +3134,12 @@ mips_emit_call_insn (rtx pattern, rtx or
-       emit_insn (gen_update_got_version ());
-     }
- 
-+  if (TARGET_MIPS16 && TARGET_USE_GOT)
-+    {
-+      clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS16_PIC_TEMP);
-+      clobber_reg (&CALL_INSN_FUNCTION_USAGE (insn), MIPS_PROLOGUE_TEMP (word_mode));
-+    }
-+
-   if (TARGET_MIPS16
-       && TARGET_EXPLICIT_RELOCS
-       && TARGET_CALL_CLOBBERED_GP)

toolchain/gcc/patches-12.x/230-musl_libssp.patch

@@ -1,13 +0,0 @@
---- a/gcc/gcc.cc
-+++ b/gcc/gcc.cc
-@@ -987,7 +987,9 @@ proper position among the other output f
- #endif
- 
- #ifndef LINK_SSP_SPEC
--#ifdef TARGET_LIBC_PROVIDES_SSP
-+#if DEFAULT_LIBC == LIBC_MUSL
-+#define LINK_SSP_SPEC "-lssp_nonshared"
-+#elif defined(TARGET_LIBC_PROVIDES_SSP)
- #define LINK_SSP_SPEC "%{fstack-protector|fstack-protector-all" \
- 		       "|fstack-protector-strong|fstack-protector-explicit:}"
- #else

toolchain/gcc/patches-12.x/300-mips_Os_cpu_rtx_cost_model.patch

@@ -1,21 +0,0 @@
-commit ecf7671b769fe96f7b5134be442089f8bdba55d2
-Author: Felix Fietkau <nbd@nbd.name>
-Date:   Thu Aug 4 20:29:45 2016 +0200
-
-gcc: add a patch to generate better code with Os on mips
-
-Also happens to reduce compressed code size a bit
-
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
-
---- a/gcc/config/mips/mips.cc
-+++ b/gcc/config/mips/mips.cc
-@@ -20216,7 +20216,7 @@ mips_option_override (void)
-     flag_pcc_struct_return = 0;
- 
-   /* Decide which rtx_costs structure to use.  */
--  if (optimize_size)
-+  if (0 && optimize_size)
-     mips_cost = &mips_rtx_cost_optimize_size;
-   else
-     mips_cost = &mips_rtx_cost_data[mips_tune];

toolchain/gcc/patches-12.x/701-riscv-linux-Don-t-add-latomic-with-pthread.patch

@@ -1,36 +0,0 @@
-From 203f3060dd363361b172f7295f42bb6bf5ac0b3b Mon Sep 17 00:00:00 2001
-From: Andreas Schwab <schwab@suse.de>
-Date: Sat, 23 Apr 2022 15:48:42 +0200
-Subject: [PATCH] riscv/linux: Don't add -latomic with -pthread
-
-Now that we have support for inline subword atomic operations, it is no
-longer necessary to link against libatomic.  This also fixes testsuite
-failures because the framework does not properly set up the linker flags
-for finding libatomic.
-The use of atomic operations is also independent of the use of libpthread.
-
-gcc/
-	* config/riscv/linux.h (LIB_SPEC): Don't redefine.
----
- gcc/config/riscv/linux.h | 10 ----------
- 1 file changed, 10 deletions(-)
-
---- a/gcc/config/riscv/linux.h
-+++ b/gcc/config/riscv/linux.h
-@@ -35,16 +35,6 @@ along with GCC; see the file COPYING3.
- #undef MUSL_DYNAMIC_LINKER
- #define MUSL_DYNAMIC_LINKER "/lib/ld-musl-riscv" XLEN_SPEC MUSL_ABI_SUFFIX ".so.1"
- 
--/* Because RISC-V only has word-sized atomics, it requries libatomic where
--   others do not.  So link libatomic by default, as needed.  */
--#undef LIB_SPEC
--#ifdef LD_AS_NEEDED_OPTION
--#define LIB_SPEC GNU_USER_TARGET_LIB_SPEC \
--  " %{pthread:" LD_AS_NEEDED_OPTION " -latomic " LD_NO_AS_NEEDED_OPTION "}"
--#else
--#define LIB_SPEC GNU_USER_TARGET_LIB_SPEC " -latomic "
--#endif
--
- #define ICACHE_FLUSH_FUNC "__riscv_flush_icache"
- 
- #define CPP_SPEC "%{pthread:-D_REENTRANT}"

toolchain/gcc/patches-12.x/800-arm_v5te_no_ldrd_strd.patch

@@ -1,11 +0,0 @@
---- a/gcc/config/arm/arm.h
-+++ b/gcc/config/arm/arm.h
-@@ -165,7 +165,7 @@ emission of floating point pcs attribute
- /* Thumb-1 only.  */
- #define TARGET_THUMB1_ONLY		(TARGET_THUMB1 && !arm_arch_notm)
- 
--#define TARGET_LDRD			(arm_arch5te && ARM_DOUBLEWORD_ALIGN \
-+#define TARGET_LDRD			(arm_arch6 && ARM_DOUBLEWORD_ALIGN \
-                                          && !TARGET_THUMB1)
- 
- #define TARGET_CRC32			(arm_arch_crc)

toolchain/gcc/patches-12.x/810-arm-softfloat-libgcc.patch

@@ -1,33 +0,0 @@
-commit 8570c4be394cff7282f332f97da2ff569a927ddb
-Author: Imre Kaloz <kaloz@openwrt.org>
-Date:   Wed Feb 2 20:06:12 2011 +0000
-
-    fixup arm soft-float symbols
-    
-    SVN-Revision: 25325
-
---- a/libgcc/config/arm/t-linux
-+++ b/libgcc/config/arm/t-linux
-@@ -1,6 +1,10 @@
- LIB1ASMSRC = arm/lib1funcs.S
- LIB1ASMFUNCS = _udivsi3 _divsi3 _umodsi3 _modsi3 _dvmd_lnx _clzsi2 _clzdi2 \
--	_ctzsi2 _arm_addsubdf3 _arm_addsubsf3
-+	_ctzsi2 _arm_addsubdf3 _arm_addsubsf3 \
-+	_arm_negdf2 _arm_muldivdf3 _arm_cmpdf2 _arm_unorddf2 \
-+	_arm_fixdfsi _arm_fixunsdfsi _arm_truncdfsf2 \
-+	_arm_negsf2 _arm_muldivsf3 _arm_cmpsf2 _arm_unordsf2 \
-+	_arm_fixsfsi _arm_fixunssfsi
- 
- # Just for these, we omit the frame pointer since it makes such a big
- # difference.
---- a/gcc/config/arm/linux-elf.h
-+++ b/gcc/config/arm/linux-elf.h
-@@ -58,8 +58,6 @@
-    %{shared:-lc} \
-    %{!shared:%{profile:-lc_p}%{!profile:-lc}}"
- 
--#define LIBGCC_SPEC "%{mfloat-abi=soft*:-lfloat} -lgcc"
--
- #define GLIBC_DYNAMIC_LINKER "/lib/ld-linux.so.2"
- 
- #define LINUX_TARGET_LINK_SPEC  "%{h*} \

toolchain/gcc/patches-12.x/820-libgcc_pic.patch

@@ -1,44 +0,0 @@
-commit c96312958c0621e72c9b32da5bc224ffe2161384
-Author: Felix Fietkau <nbd@openwrt.org>
-Date:   Mon Oct 19 23:26:09 2009 +0000
-
-    gcc: create a proper libgcc_pic.a static library for relinking (4.3.3+ for now, backport will follow)
-    
-    SVN-Revision: 18086
-
---- a/libgcc/Makefile.in
-+++ b/libgcc/Makefile.in
-@@ -930,11 +930,12 @@ $(libgcov-driver-objects): %$(objext): $
- 
- # Static libraries.
- libgcc.a: $(libgcc-objects)
-+libgcc_pic.a: $(libgcc-s-objects)
- libgcov.a: $(libgcov-objects)
- libunwind.a: $(libunwind-objects)
- libgcc_eh.a: $(libgcc-eh-objects)
- 
--libgcc.a libgcov.a libunwind.a libgcc_eh.a:
-+libgcc.a libgcov.a libunwind.a libgcc_eh.a libgcc_pic.a:
- 	-rm -f $@
- 
- 	objects="$(objects)";					\
-@@ -958,7 +959,7 @@ all: libunwind.a
- endif
- 
- ifeq ($(enable_shared),yes)
--all: libgcc_eh.a libgcc_s$(SHLIB_EXT)
-+all: libgcc_eh.a libgcc_pic.a libgcc_s$(SHLIB_EXT)
- ifneq ($(LIBUNWIND),)
- all: libunwind$(SHLIB_EXT)
- libgcc_s$(SHLIB_EXT): libunwind$(SHLIB_EXT)
-@@ -1164,6 +1165,10 @@ install-shared:
- 	chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_eh.a
- 	$(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_eh.a
- 
-+	$(INSTALL_DATA) libgcc_pic.a $(mapfile) $(DESTDIR)$(inst_libdir)/
-+	chmod 644 $(DESTDIR)$(inst_libdir)/libgcc_pic.a
-+	$(RANLIB) $(DESTDIR)$(inst_libdir)/libgcc_pic.a
-+
- 	$(subst @multilib_dir@,$(MULTIDIR),$(subst \
- 		@shlib_base_name@,libgcc_s,$(subst \
- 		@shlib_slibdir_qual@,$(MULTIOSSUBDIR),$(SHLIB_INSTALL))))

toolchain/gcc/patches-12.x/840-armv4_pass_fix-v4bx_to_ld.patch

@@ -1,28 +0,0 @@
-commit 7edc8ca5456d9743dd0075eb3cc5b04f4f24c8cc
-Author: Imre Kaloz <kaloz@openwrt.org>
-Date:   Wed Feb 2 19:34:36 2011 +0000
-
-    add armv4 fixup patches
-    
-    SVN-Revision: 25322
-
-
---- a/gcc/config/arm/linux-eabi.h
-+++ b/gcc/config/arm/linux-eabi.h
-@@ -91,10 +91,15 @@
- #define MUSL_DYNAMIC_LINKER \
-   "/lib/ld-musl-arm" MUSL_DYNAMIC_LINKER_E "%{mfloat-abi=hard:hf}%{mfdpic:-fdpic}.so.1"
- 
-+/* For armv4 we pass --fix-v4bx to linker to support EABI */
-+#undef TARGET_FIX_V4BX_SPEC
-+#define TARGET_FIX_V4BX_SPEC " %{mcpu=arm8|mcpu=arm810|mcpu=strongarm*"\
-+  "|march=armv4|mcpu=fa526|mcpu=fa626:--fix-v4bx}"
-+
- /* At this point, bpabi.h will have clobbered LINK_SPEC.  We want to
-    use the GNU/Linux version, not the generic BPABI version.  */
- #undef  LINK_SPEC
--#define LINK_SPEC EABI_LINK_SPEC					\
-+#define LINK_SPEC EABI_LINK_SPEC TARGET_FIX_V4BX_SPEC			\
-   LINUX_OR_ANDROID_LD (LINUX_TARGET_LINK_SPEC,				\
- 		       LINUX_TARGET_LINK_SPEC " " ANDROID_LINK_SPEC)
- 

toolchain/gcc/patches-12.x/850-use_shared_libgcc.patch

@@ -1,54 +0,0 @@
-commit dcfc40358b5a3cae7320c17f8d1cebd5ad5540cd
-Author: Felix Fietkau <nbd@openwrt.org>
-Date:   Sun Feb 12 20:25:47 2012 +0000
-
-    gcc 4.6: port over the missing patch 850-use_shared_libgcc.patch to prevent libgcc crap from leaking into every single binary
-    
-    SVN-Revision: 30486
---- a/gcc/config/arm/linux-eabi.h
-+++ b/gcc/config/arm/linux-eabi.h
-@@ -132,10 +132,6 @@
-   "%{Ofast|ffast-math|funsafe-math-optimizations:crtfastmath.o%s} "	\
-   LINUX_OR_ANDROID_LD (GNU_USER_TARGET_ENDFILE_SPEC, ANDROID_ENDFILE_SPEC)
- 
--/* Use the default LIBGCC_SPEC, not the version in linux-elf.h, as we
--   do not use -lfloat.  */
--#undef LIBGCC_SPEC
--
- /* Clear the instruction cache from `beg' to `end'.  This is
-    implemented in lib1funcs.S, so ensure an error if this definition
-    is used.  */
---- a/gcc/config/linux.h
-+++ b/gcc/config/linux.h
-@@ -71,6 +71,10 @@ see the files COPYING3 and COPYING.RUNTI
- 	  builtin_version ("CRuntime_Musl");			\
-     } while (0)
- 
-+#ifndef LIBGCC_SPEC
-+#define LIBGCC_SPEC "%{static|static-libgcc:-lgcc}%{!static:%{!static-libgcc:-lgcc_s}}"
-+#endif
-+
- /* Determine which dynamic linker to use depending on whether GLIBC or
-    uClibc or Bionic or musl is the default C library and whether
-    -muclibc or -mglibc or -mbionic or -mmusl has been passed to change
---- a/libgcc/mkmap-symver.awk
-+++ b/libgcc/mkmap-symver.awk
-@@ -136,5 +136,5 @@ function output(lib) {
-   else if (inherit[lib])
-     printf("} %s;\n", inherit[lib]);
-   else
--    printf ("\n  local:\n\t*;\n};\n");
-+    printf ("\n\t*;\n};\n");
- }
---- a/gcc/config/rs6000/linux.h
-+++ b/gcc/config/rs6000/linux.h
-@@ -67,6 +67,9 @@
- #undef	CPP_OS_DEFAULT_SPEC
- #define CPP_OS_DEFAULT_SPEC "%(cpp_os_linux)"
- 
-+#undef LIBGCC_SPEC
-+#define LIBGCC_SPEC "%{!static:%{!static-libgcc:-lgcc_s}} -lgcc"
-+
- #undef  LINK_SHLIB_SPEC
- #define LINK_SHLIB_SPEC "%{shared:-shared} %{!shared: %{static:-static}} \
-   %{static-pie:-static -pie --no-dynamic-linker -z text}"

toolchain/gcc/patches-12.x/851-libgcc_no_compat.patch

@@ -1,22 +0,0 @@
-commit 64661de100da1ec1061ef3e5e400285dce115e6b
-Author: Felix Fietkau <nbd@openwrt.org>
-Date:   Sun May 10 13:16:35 2015 +0000
-
-    gcc: add some size optimization patches
-    
-    Signed-off-by: Felix Fietkau <nbd@openwrt.org>
-    
-    SVN-Revision: 45664
-
---- a/libgcc/config/t-libunwind
-+++ b/libgcc/config/t-libunwind
-@@ -2,8 +2,7 @@
- 
- HOST_LIBGCC2_CFLAGS += -DUSE_GAS_SYMVER
- 
--LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c \
--  $(srcdir)/unwind-compat.c $(srcdir)/unwind-dw2-fde-compat.c
-+LIB2ADDEH = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
- LIB2ADDEHSTATIC = $(srcdir)/unwind-sjlj.c $(srcdir)/unwind-c.c
- 
- # Override the default value from t-slibgcc-elf-ver and mention -lunwind

toolchain/gcc/patches-12.x/870-ppc_no_crtsavres.patch

@@ -1,11 +0,0 @@
---- a/gcc/config/rs6000/rs6000-logue.cc
-+++ b/gcc/config/rs6000/rs6000-logue.cc
-@@ -348,7 +348,7 @@ rs6000_savres_strategy (rs6000_stack_t *
-   /* Define cutoff for using out-of-line functions to save registers.  */
-   if (DEFAULT_ABI == ABI_V4 || TARGET_ELF)
-     {
--      if (!optimize_size)
-+      if (1)
- 	{
- 	  strategy |= SAVE_INLINE_FPRS | REST_INLINE_FPRS;
- 	  strategy |= SAVE_INLINE_GPRS | REST_INLINE_GPRS;

toolchain/gcc/patches-12.x/881-no_tm_section.patch

@@ -1,11 +0,0 @@
---- a/libgcc/crtstuff.c
-+++ b/libgcc/crtstuff.c
-@@ -152,7 +152,7 @@ call_ ## FUNC (void)					\
- #endif
- 
- #if !defined(USE_TM_CLONE_REGISTRY) && defined(OBJECT_FORMAT_ELF)
--# define USE_TM_CLONE_REGISTRY 1
-+# define USE_TM_CLONE_REGISTRY 0
- #elif !defined(USE_TM_CLONE_REGISTRY)
- # define USE_TM_CLONE_REGISTRY 0
- #endif

toolchain/gcc/patches-12.x/900-bad-mips16-crt.patch

@@ -1,9 +0,0 @@
---- a/libgcc/config/mips/t-mips16
-+++ b/libgcc/config/mips/t-mips16
-@@ -43,3 +43,6 @@ SYNC_CFLAGS = -mno-mips16
- 
- # Version these symbols if building libgcc.so.
- SHLIB_MAPFILES += $(srcdir)/config/mips/libgcc-mips16.ver
-+
-+CRTSTUFF_T_CFLAGS += -mno-mips16
-+CRTSTUFF_T_CFLAGS_S += -mno-mips16

toolchain/gcc/patches-12.x/910-mbsd_multi.patch

@@ -1,146 +0,0 @@
-commit 99368862e44740ff4fd33760893f04e14f9dbdf1
-Author: Felix Fietkau <nbd@openwrt.org>
-Date:   Tue Jul 31 00:52:27 2007 +0000
-
-    Port the mbsd_multi patch from freewrt, which adds -fhonour-copts. This will emit warnings in packages that don't use our target cflags properly
-    
-    SVN-Revision: 8256
-
-	This patch brings over a feature from MirBSD:
-	* -fhonour-copts
-	  If this option is not given, it's warned (depending
-	  on environment variables). This is to catch errors
-	  of misbuilt packages which override CFLAGS themselves.
-
-	This patch was authored by Thorsten Glaser <tg at mirbsd.de>
-	with copyright assignment to the FSF in effect.
-
---- a/gcc/c-family/c-opts.cc
-+++ b/gcc/c-family/c-opts.cc
-@@ -107,6 +107,9 @@ static dump_flags_t original_dump_flags;
- /* Whether any standard preincluded header has been preincluded.  */
- static bool done_preinclude;
- 
-+/* Check if a port honours COPTS.  */
-+static int honour_copts = 0;
-+
- static void handle_OPT_d (const char *);
- static void set_std_cxx98 (int);
- static void set_std_cxx11 (int);
-@@ -478,6 +481,12 @@ c_common_handle_option (size_t scode, co
-       flag_no_builtin = !value;
-       break;
- 
-+    case OPT_fhonour_copts:
-+      if (c_language == clk_c) {
-+        honour_copts++;
-+      }
-+      break;
-+
-     case OPT_fconstant_string_class_:
-       constant_string_class_name = arg;
-       break;
-@@ -1218,6 +1227,47 @@ c_common_init (void)
-       return false;
-     }
- 
-+  if (c_language == clk_c) {
-+    char *ev = getenv ("GCC_HONOUR_COPTS");
-+    int evv;
-+    if (ev == NULL)
-+      evv = -1;
-+    else if ((*ev == '0') || (*ev == '\0'))
-+      evv = 0;
-+    else if (*ev == '1')
-+      evv = 1;
-+    else if (*ev == '2')
-+      evv = 2;
-+    else if (*ev == 's')
-+      evv = -1;
-+    else {
-+      warning (0, "unknown GCC_HONOUR_COPTS value, assuming 1");
-+      evv = 1; /* maybe depend this on something like MIRBSD_NATIVE?  */
-+    }
-+    if (evv == 1) {
-+      if (honour_copts == 0) {
-+        error ("someone does not honour COPTS at all in lenient mode");
-+        return false;
-+      } else if (honour_copts != 1) {
-+        warning (0, "someone does not honour COPTS correctly, passed %d times",
-+         honour_copts);
-+      }
-+    } else if (evv == 2) {
-+      if (honour_copts == 0) {
-+        error ("someone does not honour COPTS at all in strict mode");
-+        return false;
-+      } else if (honour_copts != 1) {
-+        error ("someone does not honour COPTS correctly, passed %d times",
-+         honour_copts);
-+        return false;
-+      }
-+    } else if (evv == 0) {
-+      if (honour_copts != 1)
-+        inform (UNKNOWN_LOCATION, "someone does not honour COPTS correctly, passed %d times",
-+         honour_copts);
-+    }
-+  }
-+
-   return true;
- }
- 
---- a/gcc/c-family/c.opt
-+++ b/gcc/c-family/c.opt
-@@ -1755,6 +1755,9 @@ C++ ObjC++ Optimization Alias(fexception
- fhonor-std
- C++ ObjC++ WarnRemoved
- 
-+fhonour-copts
-+C ObjC C++ ObjC++ RejectNegative
-+
- fhosted
- C ObjC
- Assume normal C execution environment.
---- a/gcc/common.opt
-+++ b/gcc/common.opt
-@@ -1770,6 +1770,9 @@ fharden-conditional-branches
- Common Var(flag_harden_conditional_branches) Optimization
- Harden conditional branches by checking reversed conditions.
- 
-+fhonour-copts
-+Common RejectNegative
-+
- ; Nonzero means ignore `#ident' directives.  0 means handle them.
- ; Generate position-independent code for executables if possible
- ; On SVR4 targets, it also controls whether or not to emit a
---- a/gcc/doc/invoke.texi
-+++ b/gcc/doc/invoke.texi
-@@ -9597,6 +9597,17 @@ This option is only supported for C and
- @option{-Wall} and by @option{-Wpedantic}, which can be disabled with
- @option{-Wno-pointer-sign}.
- 
-+@item -fhonour-copts
-+@opindex fhonour-copts
-+If @env{GCC_HONOUR_COPTS} is set to 1, abort if this option is not
-+given at least once, and warn if it is given more than once.
-+If @env{GCC_HONOUR_COPTS} is set to 2, abort if this option is not
-+given exactly once.
-+If @env{GCC_HONOUR_COPTS} is set to 0 or unset, warn if this option
-+is not given exactly once.
-+The warning is quelled if @env{GCC_HONOUR_COPTS} is set to @samp{s}.
-+This flag and environment variable only affect the C language.
-+
- @item -Wstack-protector
- @opindex Wstack-protector
- @opindex Wno-stack-protector
---- a/gcc/opts.cc
-+++ b/gcc/opts.cc
-@@ -2699,6 +2699,9 @@ common_handle_option (struct gcc_options
-       add_comma_separated_to_vector (&opts->x_flag_ignored_attributes, arg);
-       break;
- 
-+    case OPT_fhonour_copts:
-+      break;
-+
-     case OPT_Werror:
-       dc->warning_as_error_requested = value;
-       break;

toolchain/gcc/patches-12.x/920-specs_nonfatal_getenv.patch

@@ -1,22 +0,0 @@
-Author: Jo-Philipp Wich <jow@openwrt.org>
-Date:   Sat Apr 21 03:02:39 2012 +0000
-
-    gcc: add patch to make the getenv() spec function nonfatal if requested environment variable is unset
-    
-    SVN-Revision: 31390
-
---- a/gcc/gcc.cc
-+++ b/gcc/gcc.cc
-@@ -10186,8 +10186,10 @@ getenv_spec_function (int argc, const ch
-     }
- 
-   if (!value)
--    fatal_error (input_location,
--		 "environment variable %qs not defined", varname);
-+    {
-+      warning (input_location, "environment variable %qs not defined", varname);
-+      value = "";
-+    }
- 
-   /* We have to escape every character of the environment variable so
-      they are not interpreted as active spec characters.  A

toolchain/gcc/patches-12.x/960-gotools-fix-compilation-when-making-cross-compiler.patch

@@ -1,67 +0,0 @@
-From dda6b050cd74a352670787a294596a9c56c21327 Mon Sep 17 00:00:00 2001
-From: Yousong Zhou <yszhou4tech@gmail.com>
-Date: Fri, 4 May 2018 18:20:53 +0800
-Subject: [PATCH] gotools: fix compilation when making cross compiler
-
-libgo is "the runtime support library for the Go programming language.
-This library is intended for use with the Go frontend."
-
-gccgo will link target files with libgo.so which depends on libgcc_s.so.1, but
-the linker will complain that it cannot find it.  That's because shared libgcc
-is not present in the install directory yet.  libgo.so was made without problem
-because gcc will emit -lgcc_s when compiled with -shared option.  When gotools
-were being made, it was supplied with -static-libgcc thus no link option was
-provided.  Check LIBGO in gcc/go/gcc-spec.c for how gccgo make a builtin spec
-for linking with libgo.so
-
-- GccgoCrossCompilation, https://github.com/golang/go/wiki/GccgoCrossCompilation
-- Cross-building instructions, http://www.eglibc.org/archives/patches/msg00078.html
-
-When 3-pass GCC compilation is used, shared libgcc runtime libraries will be
-available after gcc pass2 completed and will meet the gotools link requirement
-at gcc pass3
----
- gotools/Makefile.am | 4 +++-
- gotools/Makefile.in | 4 +++-
- 2 files changed, 6 insertions(+), 2 deletions(-)
-
---- a/gotools/Makefile.am
-+++ b/gotools/Makefile.am
-@@ -26,6 +26,7 @@ PWD_COMMAND = $${PWDCMD-pwd}
- STAMP = echo timestamp >
- 
- libgodir = ../$(target_noncanonical)/libgo
-+libgccdir = ../$(target_noncanonical)/libgcc
- LIBGODEP = $(libgodir)/libgo.la
- 
- LIBGOTOOL = $(libgodir)/libgotool.a
-@@ -41,7 +42,8 @@ GOCFLAGS = $(CFLAGS_FOR_TARGET)
- GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
- 
- AM_GOCFLAGS = -I $(libgodir)
--AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
-+AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
-+	-L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
- GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
- 
- libgosrcdir = $(srcdir)/../libgo/go
---- a/gotools/Makefile.in
-+++ b/gotools/Makefile.in
-@@ -337,6 +337,7 @@ mkinstalldirs = $(SHELL) $(toplevel_srcd
- PWD_COMMAND = $${PWDCMD-pwd}
- STAMP = echo timestamp >
- libgodir = ../$(target_noncanonical)/libgo
-+libgccdir = ../$(target_noncanonical)/libgcc
- LIBGODEP = $(libgodir)/libgo.la
- LIBGOTOOL = $(libgodir)/libgotool.a
- @NATIVE_FALSE@GOCOMPILER = $(GOC)
-@@ -346,7 +347,8 @@ LIBGOTOOL = $(libgodir)/libgotool.a
- GOCFLAGS = $(CFLAGS_FOR_TARGET)
- GOCOMPILE = $(GOCOMPILER) $(GOCFLAGS)
- AM_GOCFLAGS = -I $(libgodir)
--AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs
-+AM_LDFLAGS = -L $(libgodir) -L $(libgodir)/.libs \
-+	-L $(libgccdir) -L $(libgccdir)/.libs -lgcc_s
- GOLINK = $(GOCOMPILER) $(GOCFLAGS) $(AM_GOCFLAGS) $(LDFLAGS) $(AM_LDFLAGS) -o $@
- libgosrcdir = $(srcdir)/../libgo/go
- cmdsrcdir = $(libgosrcdir)/cmd

toolchain/gcc/patches-12.x/970-macos_arm64-building-fix.patch

@@ -1,45 +0,0 @@
-commit 9c6e71079b46ad5433165feaa2001450f2017b56
-Author: Przemysław Buczkowski <prem@prem.moe>
-Date:   Mon Aug 16 13:16:21 2021 +0100
-
-    GCC: Patch for Apple Silicon compatibility
-    
-    This patch fixes a linker error occuring when compiling
-    the cross-compiler on macOS and ARM64 architecture.
-    
-    Adapted from:
-    https://github.com/richfelker/musl-cross-make/issues/116#issuecomment-823612404
-    
-    Change-Id: Ia3ee98a163bbb62689f42e2da83a5ef36beb0913
-    Reviewed-on: https://review.haiku-os.org/c/buildtools/+/4329
-    Reviewed-by: John Scipione <jscipione@gmail.com>
-    Reviewed-by: Adrien Destugues <pulkomandy@gmail.com>
-
---- a/gcc/config/aarch64/aarch64.h
-+++ b/gcc/config/aarch64/aarch64.h
-@@ -1293,7 +1293,7 @@ extern const char *aarch64_rewrite_mcpu
- #define MCPU_TO_MARCH_SPEC_FUNCTIONS \
-   { "rewrite_mcpu", aarch64_rewrite_mcpu },
- 
--#if defined(__aarch64__)
-+#if defined(__aarch64__) && ! defined(__APPLE__)
- extern const char *host_detect_local_cpu (int argc, const char **argv);
- #define HAVE_LOCAL_CPU_DETECT
- # define EXTRA_SPEC_FUNCTIONS						\
---- a/gcc/config/host-darwin.cc
-+++ b/gcc/config/host-darwin.cc
-@@ -23,6 +23,8 @@
- #include "options.h"
- #include "diagnostic-core.h"
- #include "config/host-darwin.h"
-+#include "hosthooks.h"
-+#include "hosthooks-def.h"
- #include <errno.h>
- 
- /* For Darwin (macOS only) platforms, without ASLR (PIE) enabled on the
-@@ -181,3 +183,5 @@ darwin_gt_pch_use_address (void *&addr,
- 
-   return 1;
- }
-+
-+const struct host_hooks host_hooks = HOST_HOOKS_INITIALIZER;

toolchain/gcc/patches-12.x/980-fix-build-error-with-Xcode-16.3.patch

@@ -1,47 +0,0 @@
-From 93954654b87552c4fe0273cab99d0f42f213f7f8 Mon Sep 17 00:00:00 2001
-From: Georgi Valkov <gvalkov@gmail.com>
-Date: Mon, 14 Apr 2025 15:45:59 +0300
-Subject: [PATCH] zlib: fix build error with Xcode 16.3
-
-Xcode 16.3 defines TARGET_OS_MAC, it was not defined in prior versions.
-zutil.h conditionally defines fdopen as NULL when this macro is defined,
-resulting in the following build error:
-
-/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/_stdio.h:318:7: error: expected identifier or '('
-  318 | FILE    *fdopen(int, const char *) __DARWIN_ALIAS_STARTING(__MAC_10_6, __IPHONE_2_0, __DARWIN_ALIAS(fdopen));
-      |          ^
-./zutil.h:147:33: note: expanded from macro 'fdopen'
-  147 | #        define fdopen(fd,mode) NULL /* No fdopen() */
-
-In Xcode 16.2 and earlier, TARGET_OS_MAC was not defined so this entire
-block was ignored, gcc and gdb used to compile and work fine.
-
-This may have been used for compatibility with older versions of macOS,
-but is no longer needed. By pure luck, the build worked fine for a long
-time, because it did not properly detect macOS.
-Fixed by removing the check for TARGET_OS_MAC.
-
-Note that since Xcode 16.3, an entire set of TARGET_OS macros
-are now defined, most of which are set to 0:
-TARGET_OS_LINUX 0
-TARGET_OS_MAC 1
-TARGET_OS_OSX 1
-
-[1] https://github.com/openwrt/openwrt/pull/18467
-
-Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
----
- zlib/zutil.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/zlib/zutil.h
-+++ b/zlib/zutil.h
-@@ -130,7 +130,7 @@ extern z_const char * const z_errmsg[10]
- #  endif
- #endif
- 
--#if defined(MACOS) || defined(TARGET_OS_MAC)
-+#if defined(MACOS)
- #  define OS_CODE  7
- #  ifndef Z_SOLO
- #    if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os