diff --git a/contrib/docker/Dockerfile b/contrib/docker/Dockerfile
index 1c382c12023c158cfe89c3867809f9a33e1a50c8..ca0903ad926b9687649c298c6c3dc01163823724 100644
--- a/contrib/docker/Dockerfile
+++ b/contrib/docker/Dockerfile
@@ -5,30 +5,32 @@ ARG TARGETARCH
ARG DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y --no-install-recommends \
+ build-essential \
ca-certificates \
+ clang \
+ ecdsautils \
file \
+ gawk \
git \
+ libelf-dev \
+ libncurses5-dev \
+ libnss-unknown \
+ libssl-dev \
+ llvm \
+ lua-check \
+ openssh-client \
python3 \
python3-dev \
python3-pyelftools \
python3-setuptools \
- build-essential \
- gawk \
- unzip \
- libncurses5-dev \
- zlib1g-dev \
- libssl-dev \
- libelf-dev \
- wget \
- rsync \
- time \
qemu-utils \
- ecdsautils \
- lua-check \
+ rsync \
shellcheck \
- libnss-unknown \
- openssh-client \
swig \
+ time \
+ unzip \
+ wget \
+ zlib1g-dev \
&& apt-get clean \
&& rm -rf /var/lib/apt/lists/*
diff --git a/docs/user/getting_started.rst b/docs/user/getting_started.rst
index 010d605f3d6ec1a10a01b4bd877c5cd44978cda8..cdddc3f96149981da96cefaedd88bb76ede240af 100644
--- a/docs/user/getting_started.rst
+++ b/docs/user/getting_started.rst
@@ -27,6 +27,7 @@ Dependencies
To build Gluon, several packages need to be installed on the system. On a
freshly installed Debian Bullseye system the following packages are required:
+* `clang`
* `git` (to get Gluon and other dependencies)
* `python3`
* `build-essential`
@@ -37,6 +38,7 @@ freshly installed Debian Bullseye system the following packages are required:
* `libz-dev` (actually `zlib1g-dev`)
* `libssl-dev`
* `libelf-dev` (to build x86-64)
+* `llvm`
* `wget`
* `rsync`
* `time` (built-in `time` doesn't work)
diff --git a/modules b/modules
index f0ff06faf7e23578ee0d51693ffbaf6135891a80..69362a2eb7a57c823f51c9ecde452ab2dd58e915 100644
--- a/modules
+++ b/modules
@@ -2,15 +2,15 @@ GLUON_FEEDS='gluon packages routing'
OPENWRT_REPO=https://github.com/openwrt/openwrt.git
OPENWRT_BRANCH=openwrt-24.10
-OPENWRT_COMMIT=298654b9ab57b953b5c5d72cc69f1c46e0a5dd23
+OPENWRT_COMMIT=f3a210b7425497155b22e197a4bcdaa034f142fa
PACKAGES_GLUON_REPO=https://github.com/freifunk-gluon/packages.git
PACKAGES_GLUON_COMMIT=3d08b0fee8dc5d96d8bcdb985fad1d5564de4022
PACKAGES_PACKAGES_REPO=https://github.com/openwrt/packages.git
PACKAGES_PACKAGES_BRANCH=openwrt-24.10
-PACKAGES_PACKAGES_COMMIT=512e38761716ac6caa2423596d2c4cede8a3f7cd
+PACKAGES_PACKAGES_COMMIT=4c3052dda19f26fc9a4f64585bca0509241f6c37
PACKAGES_ROUTING_REPO=https://github.com/openwrt/routing.git
PACKAGES_ROUTING_BRANCH=openwrt-24.10
-PACKAGES_ROUTING_COMMIT=e87b55c6a642947ad7e24cd5054a637df63d5dbe
+PACKAGES_ROUTING_COMMIT=c9b636698881059a3c981032770968f5a98ff201
diff --git a/patches/openwrt/0005-kernel-bridge-Implement-MLD-Querier-wake-up-calls-Android-bug-workaround.patch b/patches/openwrt/0004-kernel-bridge-Implement-MLD-Querier-wake-up-calls-Android-bug-workaround.patch
similarity index 100%
rename from patches/openwrt/0005-kernel-bridge-Implement-MLD-Querier-wake-up-calls-Android-bug-workaround.patch
rename to patches/openwrt/0004-kernel-bridge-Implement-MLD-Querier-wake-up-calls-Android-bug-workaround.patch
diff --git a/patches/openwrt/0004-mt76-include-fixes-for-MT7603-MT7612.patch b/patches/openwrt/0004-mt76-include-fixes-for-MT7603-MT7612.patch
deleted file mode 100644
index e8b9896181107d15098308e2cc2ed096f5b0998e..0000000000000000000000000000000000000000
--- a/patches/openwrt/0004-mt76-include-fixes-for-MT7603-MT7612.patch
+++ /dev/null
@@ -1,175 +0,0 @@
-From: David Bauer <mail@david-bauer.net>
-Date: Thu, 14 Mar 2024 09:39:22 +0100
-Subject: mt76: include fixes for MT7603 / MT7612
-
-diff --git a/package/kernel/mt76/patches/0001-tx-add-limit-for-TXS-ack-override.patch b/package/kernel/mt76/patches/0001-tx-add-limit-for-TXS-ack-override.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..568c590f24c251dda70522865af32b3753cd5beb
---- /dev/null
-+++ b/package/kernel/mt76/patches/0001-tx-add-limit-for-TXS-ack-override.patch
-@@ -0,0 +1,79 @@
-+From a95c23b2c2e923ed293eb794b74735c7d6c5b272 Mon Sep 17 00:00:00 2001
-+From: David Bauer <mail@david-bauer.net>
-+Date: Fri, 1 Mar 2024 17:41:33 +0100
-+Subject: [PATCH 1/2] tx: add limit for TXS ack override
-+
-+Add an upper limit for overriding missing TX status for each client.
-+
-+This avoids clients, which to mac80211 still appear as if they are
-+connected when in fact they are not reachable for the AP anymore.
-+
-+This can happen, as the radio (observed on MT7603 in particular) might
-+skip TX status-reporting which the host will then mark as acked. This
-+prevents the client from timing out and become "sticky" on the AP.
-+
-+Signed-off-by: David Bauer <mail@david-bauer.net>
-+---
-+ mt76.h | 2 ++
-+ tx.c | 20 +++++++++++++++++++-
-+ 2 files changed, 21 insertions(+), 1 deletion(-)
-+
-+diff --git a/mt76.h b/mt76.h
-+index fd527649..6d9b7028 100644
-+--- a/mt76.h
-++++ b/mt76.h
-+@@ -330,6 +330,8 @@ struct mt76_wcid {
-+ u8 rx_key_pn[IEEE80211_NUM_TIDS + 1][6];
-+ u16 cipher;
-+
-++ u8 txs_failed_cnt;
-++
-+ u32 tx_info;
-+ bool sw_iv;
-+
-+diff --git a/tx.c b/tx.c
-+index 1809b032..65d6104f 100644
-+--- a/tx.c
-++++ b/tx.c
-+@@ -91,6 +91,7 @@ __mt76_tx_status_skb_done(struct mt76_dev *dev, struct sk_buff *skb, u8 flags,
-+ {
-+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-+ struct mt76_tx_cb *cb = mt76_tx_skb_cb(skb);
-++ struct mt76_wcid *wcid;
-+ u8 done = MT_TX_CB_DMA_DONE | MT_TX_CB_TXS_DONE;
-+
-+ flags |= cb->flags;
-+@@ -98,12 +99,29 @@ __mt76_tx_status_skb_done(struct mt76_dev *dev, struct sk_buff *skb, u8 flags,
-+
-+ if ((flags & done) != done)
-+ return;
-++
-++ wcid = rcu_dereference(dev->wcid[cb->wcid]);
-+
-+ /* Tx status can be unreliable. if it fails, mark the frame as ACKed */
-+ if (flags & MT_TX_CB_TXS_FAILED) {
-++ /* Increment station counter */
-++ if (wcid && wcid->sta)
-++ wcid->txs_failed_cnt++;
-++
-+ info->status.rates[0].count = 0;
-+ info->status.rates[0].idx = -1;
-+- info->flags |= IEEE80211_TX_STAT_ACK;
-++
-++ /**
-++ * Check if station counter exceeds the limit for
-++ * implicit acks. If not, mark the frame as ACKed.
-++ */
-++ if (!wcid || wcid->txs_failed_cnt < 25) {
-++ info->flags |= IEEE80211_TX_STAT_ACK;
-++ }
-++ } else if (info->flags & IEEE80211_TX_STAT_ACK) {
-++ /* Reset station counter */
-++ if (wcid && wcid->sta)
-++ wcid->txs_failed_cnt = 0;
-+ }
-+
-+ __skb_queue_tail(list, skb);
-+--
-+2.43.0
-+
-diff --git a/package/kernel/mt76/patches/0002-mt76x02-avoid-action-ghost-ack.patch b/package/kernel/mt76/patches/0002-mt76x02-avoid-action-ghost-ack.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..0910ed99ef473db9cf4129f88017912b5d63267d
---- /dev/null
-+++ b/package/kernel/mt76/patches/0002-mt76x02-avoid-action-ghost-ack.patch
-@@ -0,0 +1,80 @@
-+From 3c9ecc0c77e85d9ff91faddde59764fbc9316b7c Mon Sep 17 00:00:00 2001
-+From: David Bauer <mail@david-bauer.net>
-+Date: Sat, 2 Mar 2024 13:14:49 +0100
-+Subject: [PATCH 2/2] mt76x02: avoid action ghost-ack
-+
-+On PMF enabled networks, chip reports ACTION frames always as acked.
-+
-+In case a roaming-assistant sens link-measurements periodically,
-+this results in the station never becoming inactive and not being removed
-+from the AP's station list.
-+
-+Avoid this from happening by marking action frames sent on a PMF enabled
-+network as no-ack.
-+
-+Signed-off-by: David Bauer <mail@david-bauer.net>
-+---
-+ mt76x02_mac.c | 27 +++++++++++++++++++++++++++
-+ mt76x02_mac.h | 1 +
-+ 2 files changed, 28 insertions(+)
-+
-+diff --git a/mt76x02_mac.c b/mt76x02_mac.c
-+index d5db6ffd..672e01ec 100644
-+--- a/mt76x02_mac.c
-++++ b/mt76x02_mac.c
-+@@ -544,6 +544,7 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
-+ struct ieee80211_tx_status status = {
-+ .info = &info
-+ };
-++ struct ieee80211_hdr *hdr;
-+ static const u8 ac_to_tid[4] = {
-+ [IEEE80211_AC_BE] = 0,
-+ [IEEE80211_AC_BK] = 1,
-+@@ -619,6 +620,32 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev,
-+ *update = 1;
-+ }
-+
-++ if (msta && status.skb &&
-++ (status.info->flags & IEEE80211_TX_STAT_ACK)) {
-++ hdr = (struct ieee80211_hdr *)status.skb->data;
-++
-++ if (ieee80211_has_protected(hdr->frame_control) &&
-++ ieee80211_is_robust_mgmt_frame(status.skb)) {
-++ /**
-++ * On PMF enabled networks, chip reports ACTION frames
-++ * always as acked.
-++ *
-++ * In case a roaming-assistant sends link-measurements
-++ * periodically, this results in the station never
-++ * becoming inactive and not being removed from the
-++ * AP's station list.
-++ */
-++
-++ if (msta->n_enc_mgmt >= 25) {
-++ status.info->flags &= ~IEEE80211_TX_STAT_ACK;
-++ } else {
-++ msta->n_enc_mgmt++;
-++ }
-++ } else {
-++ msta->n_enc_mgmt = 0;
-++ }
-++ }
-++
-+ if (status.skb) {
-+ info = *status.info;
-+ len = status.skb->len;
-+diff --git a/mt76x02_mac.h b/mt76x02_mac.h
-+index 5dc6c834..1bd2288f 100644
-+--- a/mt76x02_mac.h
-++++ b/mt76x02_mac.h
-+@@ -39,6 +39,7 @@ struct mt76x02_sta {
-+ struct mt76x02_vif *vif;
-+ struct mt76x02_tx_status status;
-+ int n_frames;
-++ u8 n_enc_mgmt;
-+
-+ struct ewma_pktlen pktlen;
-+ };
-+--
-+2.43.0
-+
diff --git a/patches/openwrt/0006-mac80211-silence-warning-for-missing-rate-information.patch b/patches/openwrt/0005-mac80211-silence-warning-for-missing-rate-information.patch
similarity index 100%
rename from patches/openwrt/0006-mac80211-silence-warning-for-missing-rate-information.patch
rename to patches/openwrt/0005-mac80211-silence-warning-for-missing-rate-information.patch
diff --git a/patches/openwrt/0007-net-mac80211-override-incompatible-basic-rates-for-mesh.patch b/patches/openwrt/0006-net-mac80211-override-incompatible-basic-rates-for-mesh.patch
similarity index 100%
rename from patches/openwrt/0007-net-mac80211-override-incompatible-basic-rates-for-mesh.patch
rename to patches/openwrt/0006-net-mac80211-override-incompatible-basic-rates-for-mesh.patch
diff --git a/patches/openwrt/0008-net-mac80211-force-backwards-compatible-basic-rates.patch b/patches/openwrt/0007-net-mac80211-force-backwards-compatible-basic-rates.patch
similarity index 100%
rename from patches/openwrt/0008-net-mac80211-force-backwards-compatible-basic-rates.patch
rename to patches/openwrt/0007-net-mac80211-force-backwards-compatible-basic-rates.patch
diff --git a/targets/generic b/targets/generic
index 7de3660a330327fc40a051287eddedf942e436e0..4e59d341976551343efa21e1d21b802a4d790eea 100644
--- a/targets/generic
+++ b/targets/generic
@@ -37,6 +37,7 @@ config('TARGET_ROOTFS_INITRAMFS', false)
config('DEVEL', true)
config('ALL_NONSHARED', true)
+config('BPF_TOOLCHAIN_HOST', true)
try_config('PACKAGE_usbip', false) -- fails to build
try_config('PACKAGE_coova-chilli', false) -- fails to build