package/gluon-wireless-encryption-wpa3/Makefile

+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=gluon-wireless-encryption-wpa3
+
+include ../gluon.mk
+
+define Package/gluon-wireless-encryption-wpa3
+  DEPENDS:=+hostapd-mbedtls
+  TITLE:=Package for supporting WPA3 encrypted wireless networks
+endef
+
+define Package/gluon-wireless-encryption-wpa3/install
+	$(INSTALL_DIR) $(1)/lib/gluon/features
+
+	touch $(1)/lib/gluon/features/wpa2
+	touch $(1)/lib/gluon/features/wpa3
+endef
+
+$(eval $(call BuildPackageGluon,gluon-wireless-encryption-wpa3))

package/gluon.mk

 GLUON_MK := $(abspath $(lastword $(MAKEFILE_LIST)))
 PKG_FILE_DEPENDS += $(GLUON_MK)
 
-# Dependencies for LuaSrcDiet
-PKG_BUILD_DEPENDS += luci-base/host
+PKG_VERSION ?= 1
+
+PKG_BUILD_DEPENDS += luasrcdiet/host
+
+ifneq ($(wildcard ./luasrc/.),)
+  PKG_CONFIG_DEPENDS += CONFIG_GLUON_MINIFY
+endif
 
 ifneq ($(wildcard ./src/respondd.c),)
   PKG_BUILD_DEPENDS += respondd
@@ -18,7 +23,8 @@ shell-verbatim = $(call shell-unescape,$(call shell-escape,$(1)))
 
 
 define GluonCheckSite
-[ -z "$$IPKG_INSTROOT" ] || "${TOPDIR}/staging_dir/hostpkg/bin/lua" "${TOPDIR}/../scripts/check_site.lua" <<'END__GLUON__CHECK__SITE'
+[ -z "$$STAGING_DIR_HOSTPKG" ] || PATH="$$STAGING_DIR_HOSTPKG/bin:$$PATH"
+lua "$$IPKG_INSTROOT/lib/gluon/check-site.lua" <<'END__GLUON__CHECK__SITE'
 $(call shell-verbatim,cat '$(1)')
 END__GLUON__CHECK__SITE
 endef
@@ -31,6 +37,7 @@ GLUON_I18N_CONFIG := $(foreach lang,$(GLUON_SUPPORTED_LANGS),CONFIG_GLUON_WEB_LA
 GLUON_ENABLED_LANGS := en $(foreach lang,$(GLUON_SUPPORTED_LANGS),$(if $(CONFIG_GLUON_WEB_LANG_$(lang)),$(lang)))
 
 ifneq ($(wildcard ./i18n/.),)
+  PKG_BUILD_DEPENDS += gluon-web/host
   PKG_CONFIG_DEPENDS += $(GLUON_I18N_CONFIG)
 endif
 
@@ -40,7 +47,7 @@ define GluonBuildI18N
 	for lang in $$(GLUON_ENABLED_LANGS); do \
 		if [ -e $(1)/$$$$lang.po ]; then \
 			rm -f $$(PKG_BUILD_DIR)/i18n/$$$$lang.lmo; \
-			po2lmo $(1)/$$$$lang.po $$(PKG_BUILD_DIR)/i18n/$$$$lang.lmo; \
+			gluon-po2lmo $(1)/$$$$lang.po $$(PKG_BUILD_DIR)/i18n/$$$$lang.lmo; \
 		fi; \
 	done
 endef
@@ -57,12 +64,15 @@ endef
 define GluonSrcDiet
 	rm -rf $(2)
 	$(CP) $(1) $(2)
-	$(FIND) $(2) -type f | while read src; do \
-		if LuaSrcDiet --noopt-binequiv -o "$$$$src.o" "$$$$src"; then \
-			chmod $$$$(stat -c%a "$$$$src") "$$$$src.o"; \
-			mv "$$$$src.o" "$$$$src"; \
-		fi; \
+  ifdef CONFIG_GLUON_MINIFY
+	# Use cp + rm instead of mv to preserve destination permissions
+	set -e; $(FIND) $(2) -type f | while read src; do \
+		echo "Minifying $$$$src..."; \
+		luasrcdiet --noopt-binequiv -o "$$$$src.tmp" "$$$$src"; \
+		cp "$$$$src.tmp" "$$$$src"; \
+		rm "$$$$src.tmp"; \
 	done
+  endif
 endef
 
 

package/libbatadv/src/batadv-genl.c

@@ -41,58 +41,206 @@
 
 __attribute__ ((visibility ("default")))
 struct nla_policy batadv_genl_policy[NUM_BATADV_ATTR] = {
-	[BATADV_ATTR_VERSION]		= { .type = NLA_STRING },
-	[BATADV_ATTR_ALGO_NAME]		= { .type = NLA_STRING },
-	[BATADV_ATTR_MESH_IFINDEX]	= { .type = NLA_U32 },
-	[BATADV_ATTR_MESH_IFNAME]	= { .type = NLA_STRING,
-					    .maxlen = IFNAMSIZ },
-	[BATADV_ATTR_MESH_ADDRESS]	= { .type = NLA_UNSPEC,
+	[BATADV_ATTR_VERSION] = {
+		.type = NLA_STRING,
+	},
+	[BATADV_ATTR_ALGO_NAME] = {
+		.type = NLA_STRING,
+	},
+	[BATADV_ATTR_MESH_IFINDEX] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_MESH_IFNAME] = {
+		.type = NLA_STRING,
+		.maxlen = IFNAMSIZ,
+	},
+	[BATADV_ATTR_MESH_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_HARD_IFINDEX]	= { .type = NLA_U32 },
-	[BATADV_ATTR_HARD_IFNAME]	= { .type = NLA_STRING,
-					    .maxlen = IFNAMSIZ },
-	[BATADV_ATTR_HARD_ADDRESS]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_HARD_IFINDEX] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_HARD_IFNAME] = {
+		.type = NLA_STRING,
+		.maxlen = IFNAMSIZ,
+	},
+	[BATADV_ATTR_HARD_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_ORIG_ADDRESS]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_ORIG_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_TPMETER_RESULT]	= { .type = NLA_U8 },
-	[BATADV_ATTR_TPMETER_TEST_TIME]	= { .type = NLA_U32 },
-	[BATADV_ATTR_TPMETER_BYTES]	= { .type = NLA_U64 },
-	[BATADV_ATTR_TPMETER_COOKIE]	= { .type = NLA_U32 },
-	[BATADV_ATTR_PAD]		= { .type = NLA_UNSPEC },
-	[BATADV_ATTR_ACTIVE]		= { .type = NLA_FLAG },
-	[BATADV_ATTR_TT_ADDRESS]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_TPMETER_RESULT] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_TPMETER_TEST_TIME] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_TPMETER_BYTES] = {
+		.type = NLA_U64,
+	},
+	[BATADV_ATTR_TPMETER_COOKIE] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_PAD] = {
+		.type = NLA_UNSPEC,
+	},
+	[BATADV_ATTR_ACTIVE] = {
+		.type = NLA_FLAG,
+	},
+	[BATADV_ATTR_TT_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_TT_TTVN]		= { .type = NLA_U8 },
-	[BATADV_ATTR_TT_LAST_TTVN]	= { .type = NLA_U8 },
-	[BATADV_ATTR_TT_CRC32]		= { .type = NLA_U32 },
-	[BATADV_ATTR_TT_VID]		= { .type = NLA_U16 },
-	[BATADV_ATTR_TT_FLAGS]		= { .type = NLA_U32 },
-	[BATADV_ATTR_FLAG_BEST]		= { .type = NLA_FLAG },
-	[BATADV_ATTR_LAST_SEEN_MSECS]	= { .type = NLA_U32 },
-	[BATADV_ATTR_NEIGH_ADDRESS]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_TT_TTVN] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_TT_LAST_TTVN] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_TT_CRC32] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_TT_VID] = {
+		.type = NLA_U16,
+	},
+	[BATADV_ATTR_TT_FLAGS] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_FLAG_BEST] = {
+		.type = NLA_FLAG,
+	},
+	[BATADV_ATTR_LAST_SEEN_MSECS] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_NEIGH_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_TQ]		= { .type = NLA_U8 },
-	[BATADV_ATTR_THROUGHPUT]	= { .type = NLA_U32 },
-	[BATADV_ATTR_BANDWIDTH_UP]	= { .type = NLA_U32 },
-	[BATADV_ATTR_BANDWIDTH_DOWN]	= { .type = NLA_U32 },
-	[BATADV_ATTR_ROUTER]		= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_TQ] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_THROUGHPUT] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_BANDWIDTH_UP] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_BANDWIDTH_DOWN] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_ROUTER] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_BLA_OWN]		= { .type = NLA_FLAG },
-	[BATADV_ATTR_BLA_ADDRESS]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_BLA_OWN] = {
+		.type = NLA_FLAG,
+	},
+	[BATADV_ATTR_BLA_ADDRESS] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_BLA_VID]		= { .type = NLA_U16 },
-	[BATADV_ATTR_BLA_BACKBONE]	= { .type = NLA_UNSPEC,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_BLA_VID] = {
+		.type = NLA_U16,
+	},
+	[BATADV_ATTR_BLA_BACKBONE] = {
+		.type = NLA_UNSPEC,
 		.minlen = ETH_ALEN,
-					    .maxlen = ETH_ALEN },
-	[BATADV_ATTR_BLA_CRC]		= { .type = NLA_U16 },
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_BLA_CRC] = {
+		.type = NLA_U16,
+	},
+	[BATADV_ATTR_DAT_CACHE_IP4ADDRESS] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_DAT_CACHE_HWADDRESS] = {
+		.type = NLA_UNSPEC,
+		.minlen = ETH_ALEN,
+		.maxlen = ETH_ALEN,
+	},
+	[BATADV_ATTR_DAT_CACHE_VID] = {
+		.type = NLA_U16,
+	},
+	[BATADV_ATTR_MCAST_FLAGS] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_MCAST_FLAGS_PRIV] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_VLANID] = {
+		.type = NLA_U16,
+	},
+	[BATADV_ATTR_AGGREGATED_OGMS_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_AP_ISOLATION_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_ISOLATION_MARK] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_ISOLATION_MASK] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_BONDING_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_FRAGMENTATION_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_GW_BANDWIDTH_DOWN] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_GW_BANDWIDTH_UP] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_GW_MODE] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_GW_SEL_CLASS] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_HOP_PENALTY] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_LOG_LEVEL] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_NETWORK_CODING_ENABLED] = {
+		.type = NLA_U8,
+	},
+	[BATADV_ATTR_ORIG_INTERVAL] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_ELP_INTERVAL] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_THROUGHPUT_OVERRIDE] = {
+		.type = NLA_U32,
+	},
+	[BATADV_ATTR_MULTICAST_FANOUT] = {
+		.type = NLA_U32,
+	},
 };
 
 /**

package/libbatadv/src/batadv-genl.h

@@ -79,10 +79,8 @@ struct batadv_nlquery_opts {
  *
  * Return: Return true when a attribute is missing, false otherwise
  */
-static inline bool
-batadv_genl_missing_attrs(struct nlattr *attrs[],
-			  const enum batadv_nl_attrs mandatory[], size_t num)
-{
+static inline bool batadv_genl_missing_attrs(struct nlattr *attrs[],
+		const enum batadv_nl_attrs mandatory[], size_t num) {
 	size_t i;
 
 	for (i = 0; i < num; i++) {

package/libbatadv/src/batman_adv.h

 /* SPDX-License-Identifier: MIT */
-/* Copyright (C) 2016-2017  B.A.T.M.A.N. contributors:
+/* Copyright (C) B.A.T.M.A.N. contributors:
  *
  * Matthias Schiffer
- *
- * Permission is hereby granted, free of charge, to any person obtaining a
- * copy of this software and associated documentation files (the "Software"),
- * to deal in the Software without restriction, including without limitation
- * the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
  */
 
 #ifndef _UAPI_LINUX_BATMAN_ADV_H_
@@ -27,6 +9,7 @@
 
 #define BATADV_NL_NAME "batadv"
 
+#define BATADV_NL_MCAST_GROUP_CONFIG	"config"
 #define BATADV_NL_MCAST_GROUP_TPMETER	"tpmeter"
 
 /**
@@ -86,11 +69,72 @@ enum batadv_tt_client_flags {
 
 	/**
 	 * @BATADV_TT_CLIENT_TEMP: this global client has been detected to be
-	 * part of the network but no nnode has already announced it
+	 * part of the network but no node has already announced it
 	 */
 	BATADV_TT_CLIENT_TEMP	 = (1 << 11),
 };
 
+/**
+ * enum batadv_mcast_flags_priv - Private, own multicast flags
+ *
+ * These are internal, multicast related flags. Currently they describe certain
+ * multicast related attributes of the segment this originator bridges into the
+ * mesh.
+ *
+ * Those attributes are used to determine the public multicast flags this
+ * originator is going to announce via TT.
+ *
+ * For netlink, if BATADV_MCAST_FLAGS_BRIDGED is unset then all querier
+ * related flags are undefined.
+ */
+enum batadv_mcast_flags_priv {
+	/**
+	 * @BATADV_MCAST_FLAGS_BRIDGED: There is a bridge on top of the mesh
+	 * interface.
+	 */
+	BATADV_MCAST_FLAGS_BRIDGED			= (1 << 0),
+
+	/**
+	 * @BATADV_MCAST_FLAGS_QUERIER_IPV4_EXISTS: Whether an IGMP querier
+	 * exists in the mesh
+	 */
+	BATADV_MCAST_FLAGS_QUERIER_IPV4_EXISTS		= (1 << 1),
+
+	/**
+	 * @BATADV_MCAST_FLAGS_QUERIER_IPV6_EXISTS: Whether an MLD querier
+	 * exists in the mesh
+	 */
+	BATADV_MCAST_FLAGS_QUERIER_IPV6_EXISTS		= (1 << 2),
+
+	/**
+	 * @BATADV_MCAST_FLAGS_QUERIER_IPV4_SHADOWING: If an IGMP querier
+	 * exists, whether it is potentially shadowing multicast listeners
+	 * (i.e. querier is behind our own bridge segment)
+	 */
+	BATADV_MCAST_FLAGS_QUERIER_IPV4_SHADOWING	= (1 << 3),
+
+	/**
+	 * @BATADV_MCAST_FLAGS_QUERIER_IPV6_SHADOWING: If an MLD querier
+	 * exists, whether it is potentially shadowing multicast listeners
+	 * (i.e. querier is behind our own bridge segment)
+	 */
+	BATADV_MCAST_FLAGS_QUERIER_IPV6_SHADOWING	= (1 << 4),
+};
+
+/**
+ * enum batadv_gw_modes - gateway mode of node
+ */
+enum batadv_gw_modes {
+	/** @BATADV_GW_MODE_OFF: gw mode disabled */
+	BATADV_GW_MODE_OFF,
+
+	/** @BATADV_GW_MODE_CLIENT: send DHCP requests to gw servers */
+	BATADV_GW_MODE_CLIENT,
+
+	/** @BATADV_GW_MODE_SERVER: announce itself as gateway server */
+	BATADV_GW_MODE_SERVER,
+};
+
 /**
  * enum batadv_nl_attrs - batman-adv netlink attributes
  */
@@ -272,6 +316,171 @@ enum batadv_nl_attrs {
 	 */
 	BATADV_ATTR_BLA_CRC,
 
+	/**
+	 * @BATADV_ATTR_DAT_CACHE_IP4ADDRESS: Client IPv4 address
+	 */
+	BATADV_ATTR_DAT_CACHE_IP4ADDRESS,
+
+	/**
+	 * @BATADV_ATTR_DAT_CACHE_HWADDRESS: Client MAC address
+	 */
+	BATADV_ATTR_DAT_CACHE_HWADDRESS,
+
+	/**
+	 * @BATADV_ATTR_DAT_CACHE_VID: VLAN ID
+	 */
+	BATADV_ATTR_DAT_CACHE_VID,
+
+	/**
+	 * @BATADV_ATTR_MCAST_FLAGS: Per originator multicast flags
+	 */
+	BATADV_ATTR_MCAST_FLAGS,
+
+	/**
+	 * @BATADV_ATTR_MCAST_FLAGS_PRIV: Private, own multicast flags
+	 */
+	BATADV_ATTR_MCAST_FLAGS_PRIV,
+
+	/**
+	 * @BATADV_ATTR_VLANID: VLAN id on top of soft interface
+	 */
+	BATADV_ATTR_VLANID,
+
+	/**
+	 * @BATADV_ATTR_AGGREGATED_OGMS_ENABLED: whether the batman protocol
+	 *  messages of the mesh interface shall be aggregated or not.
+	 */
+	BATADV_ATTR_AGGREGATED_OGMS_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_AP_ISOLATION_ENABLED: whether the data traffic going
+	 *  from a wireless client to another wireless client will be silently
+	 *  dropped.
+	 */
+	BATADV_ATTR_AP_ISOLATION_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_ISOLATION_MARK: the isolation mark which is used to
+	 *  classify clients as "isolated" by the Extended Isolation feature.
+	 */
+	BATADV_ATTR_ISOLATION_MARK,
+
+	/**
+	 * @BATADV_ATTR_ISOLATION_MASK: the isolation (bit)mask which is used to
+	 *  classify clients as "isolated" by the Extended Isolation feature.
+	 */
+	BATADV_ATTR_ISOLATION_MASK,
+
+	/**
+	 * @BATADV_ATTR_BONDING_ENABLED: whether the data traffic going through
+	 *  the mesh will be sent using multiple interfaces at the same time.
+	 */
+	BATADV_ATTR_BONDING_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED: whether the bridge loop
+	 *  avoidance feature is enabled. This feature detects and avoids loops
+	 *  between the mesh and devices bridged with the soft interface
+	 */
+	BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED: whether the distributed
+	 *  arp table feature is enabled. This feature uses a distributed hash
+	 *  table to answer ARP requests without flooding the request through
+	 *  the whole mesh.
+	 */
+	BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_FRAGMENTATION_ENABLED: whether the data traffic going
+	 *  through the mesh will be fragmented or silently discarded if the
+	 *  packet size exceeds the outgoing interface MTU.
+	 */
+	BATADV_ATTR_FRAGMENTATION_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_GW_BANDWIDTH_DOWN: defines the download bandwidth which
+	 *  is propagated by this node if %BATADV_ATTR_GW_BANDWIDTH_MODE was set
+	 *  to 'server'.
+	 */
+	BATADV_ATTR_GW_BANDWIDTH_DOWN,
+
+	/**
+	 * @BATADV_ATTR_GW_BANDWIDTH_UP: defines the upload bandwidth which
+	 *  is propagated by this node if %BATADV_ATTR_GW_BANDWIDTH_MODE was set
+	 *  to 'server'.
+	 */
+	BATADV_ATTR_GW_BANDWIDTH_UP,
+
+	/**
+	 * @BATADV_ATTR_GW_MODE: defines the state of the gateway features.
+	 * Possible values are specified in enum batadv_gw_modes
+	 */
+	BATADV_ATTR_GW_MODE,
+
+	/**
+	 * @BATADV_ATTR_GW_SEL_CLASS: defines the selection criteria this node
+	 *  will use to choose a gateway if gw_mode was set to 'client'.
+	 */
+	BATADV_ATTR_GW_SEL_CLASS,
+
+	/**
+	 * @BATADV_ATTR_HOP_PENALTY: defines the penalty which will be applied
+	 *  to an originator message's tq-field on every hop and/or per
+	 *  hard interface
+	 */
+	BATADV_ATTR_HOP_PENALTY,
+
+	/**
+	 * @BATADV_ATTR_LOG_LEVEL: bitmask with to define which debug messages
+	 *  should be send to the debug log/trace ring buffer
+	 */
+	BATADV_ATTR_LOG_LEVEL,
+
+	/**
+	 * @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED: whether multicast
+	 *  optimizations should be replaced by simple broadcast-like flooding
+	 *  of multicast packets. If set to non-zero then all nodes in the mesh
+	 *  are going to use classic flooding for any multicast packet with no
+	 *  optimizations.
+	 */
+	BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_NETWORK_CODING_ENABLED: whether Network Coding (using
+	 *  some magic to send fewer wifi packets but still the same content) is
+	 *  enabled or not.
+	 */
+	BATADV_ATTR_NETWORK_CODING_ENABLED,
+
+	/**
+	 * @BATADV_ATTR_ORIG_INTERVAL: defines the interval in milliseconds in
+	 *  which batman sends its protocol messages.
+	 */
+	BATADV_ATTR_ORIG_INTERVAL,
+
+	/**
+	 * @BATADV_ATTR_ELP_INTERVAL: defines the interval in milliseconds in
+	 *  which batman emits probing packets for neighbor sensing (ELP).
+	 */
+	BATADV_ATTR_ELP_INTERVAL,
+
+	/**
+	 * @BATADV_ATTR_THROUGHPUT_OVERRIDE: defines the throughput value to be
+	 *  used by B.A.T.M.A.N. V when estimating the link throughput using
+	 *  this interface. If the value is set to 0 then batman-adv will try to
+	 *  estimate the throughput by itself.
+	 */
+	BATADV_ATTR_THROUGHPUT_OVERRIDE,
+
+	/**
+	 * @BATADV_ATTR_MULTICAST_FANOUT: defines the maximum number of packet
+	 * copies that may be generated for a multicast-to-unicast conversion.
+	 * Once this limit is exceeded distribution will fall back to broadcast.
+	 */
+	BATADV_ATTR_MULTICAST_FANOUT,
+
 	/* add attributes above here, update the policy in netlink.c */
 
 	/**
@@ -300,10 +509,14 @@ enum batadv_nl_commands {
 	BATADV_CMD_UNSPEC,
 
 	/**
-	 * @BATADV_CMD_GET_MESH_INFO: Query basic information about batman-adv
-	 * device
+	 * @BATADV_CMD_GET_MESH: Get attributes from softif/mesh
 	 */
-	BATADV_CMD_GET_MESH_INFO,
+	BATADV_CMD_GET_MESH,
+
+	/**
+	 * @BATADV_CMD_GET_MESH_INFO: Alias for @BATADV_CMD_GET_MESH
+	 */
+	BATADV_CMD_GET_MESH_INFO = BATADV_CMD_GET_MESH,
 
 	/**
 	 * @BATADV_CMD_TP_METER: Start a tp meter session
@@ -321,9 +534,15 @@ enum batadv_nl_commands {
 	BATADV_CMD_GET_ROUTING_ALGOS,
 
 	/**
-	 * @BATADV_CMD_GET_HARDIFS: Query list of hard interfaces
+	 * @BATADV_CMD_GET_HARDIF: Get attributes from a hardif of the
+	 *  current softif
 	 */
-	BATADV_CMD_GET_HARDIFS,
+	BATADV_CMD_GET_HARDIF,
+
+	/**
+	 * @BATADV_CMD_GET_HARDIFS: Alias for @BATADV_CMD_GET_HARDIF
+	 */
+	BATADV_CMD_GET_HARDIFS = BATADV_CMD_GET_HARDIF,
 
 	/**
 	 * @BATADV_CMD_GET_TRANSTABLE_LOCAL: Query list of local translations
@@ -361,6 +580,39 @@ enum batadv_nl_commands {
 	 */
 	BATADV_CMD_GET_BLA_BACKBONE,
 
+	/**
+	 * @BATADV_CMD_GET_DAT_CACHE: Query list of DAT cache entries
+	 */
+	BATADV_CMD_GET_DAT_CACHE,
+
+	/**
+	 * @BATADV_CMD_GET_MCAST_FLAGS: Query list of multicast flags
+	 */
+	BATADV_CMD_GET_MCAST_FLAGS,
+
+	/**
+	 * @BATADV_CMD_SET_MESH: Set attributes for softif/mesh
+	 */
+	BATADV_CMD_SET_MESH,
+
+	/**
+	 * @BATADV_CMD_SET_HARDIF: Set attributes for hardif of the
+	 *  current softif
+	 */
+	BATADV_CMD_SET_HARDIF,
+
+	/**
+	 * @BATADV_CMD_GET_VLAN: Get attributes from a VLAN of the
+	 *  current softif
+	 */
+	BATADV_CMD_GET_VLAN,
+
+	/**
+	 * @BATADV_CMD_SET_VLAN: Set attributes for VLAN of the
+	 *  current softif
+	 */
+	BATADV_CMD_SET_VLAN,
+
 	/* add new commands above here */
 
 	/**
@@ -423,4 +675,30 @@ enum batadv_tp_meter_reason {
 	BATADV_TP_REASON_TOO_MANY		= 133,
 };
 
+/**
+ * enum batadv_ifla_attrs - batman-adv ifla nested attributes
+ */
+enum batadv_ifla_attrs {
+	/**
+	 * @IFLA_BATADV_UNSPEC: unspecified attribute which is not parsed by
+	 *  rtnetlink
+	 */
+	IFLA_BATADV_UNSPEC,
+
+	/**
+	 * @IFLA_BATADV_ALGO_NAME: routing algorithm (name) which should be
+	 *  used by the newly registered batadv net_device.
+	 */
+	IFLA_BATADV_ALGO_NAME,
+
+	/* add attributes above here, update the policy in soft-interface.c */
+
+	/**
+	 * @__IFLA_BATADV_MAX: internal use
+	 */
+	__IFLA_BATADV_MAX,
+};
+
+#define IFLA_BATADV_MAX (__IFLA_BATADV_MAX - 1)
+
 #endif /* _UAPI_LINUX_BATMAN_ADV_H_ */

package/libgluonutil/src/libgluonutil.c

-/*
-  Copyright (c) 2016, Matthias Schiffer <mschiffer@universe-factory.net>
-  All rights reserved.
-
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice,
-       this list of conditions and the following disclaimer.
-    2. Redistributions in binary form must reproduce the above copyright notice,
-       this list of conditions and the following disclaimer in the documentation
-       and/or other materials provided with the distribution.
-
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
+/* SPDX-FileCopyrightText: 2016 Matthias Schiffer <mschiffer@universe-factory.net> */
+/* SPDX-License-Identifier: BSD-2-Clause */
 
 
 #include "libgluonutil.h"
 
 #include <json-c/json.h>
 #include <uci.h>
+
 #include <arpa/inet.h>
+
+#include <errno.h>
+#include <glob.h>
+#include <libgen.h>
+#include <limits.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
@@ -127,6 +111,75 @@ char * gluonutil_get_interface_address(const char *ifname) {
 	return gluonutil_read_line(path);
 }
 
+void gluonutil_get_interface_lower(char out[IF_NAMESIZE], const char *ifname) {
+	strncpy(out, ifname, IF_NAMESIZE-1);
+	out[IF_NAMESIZE-1] = 0;
+
+	const char *format = "/sys/class/net/%s/lower_*";
+	char pattern[strlen(format) + IF_NAMESIZE];
+
+	while (true) {
+		snprintf(pattern, sizeof(pattern), format, out);
+		size_t pattern_len = strlen(pattern);
+
+		glob_t lower;
+		if (glob(pattern, GLOB_NOSORT, NULL, &lower) != 0)
+			break;
+
+		strncpy(out, lower.gl_pathv[0] + pattern_len - 1, IF_NAMESIZE-1);
+
+		globfree(&lower);
+	}
+}
+
+enum gluonutil_interface_type lookup_interface_type(const char *devtype) {
+	if (strcmp(devtype, "wlan") == 0)
+		return GLUONUTIL_INTERFACE_TYPE_WIRELESS;
+
+	if (strcmp(devtype, "l2tpeth") == 0 || strcmp(devtype, "wireguard") == 0)
+		return GLUONUTIL_INTERFACE_TYPE_TUNNEL;
+
+	/* Regular wired interfaces do not set DEVTYPE, so if this point is
+	 * reached, we have something different */
+	return GLUONUTIL_INTERFACE_TYPE_UNKNOWN;
+}
+
+enum gluonutil_interface_type gluonutil_get_interface_type(const char *ifname) {
+	const char *pattern = "/sys/class/net/%s/%s";
+
+	/* Default to wired type when no DEVTYPE is set */
+	enum gluonutil_interface_type ret = GLUONUTIL_INTERFACE_TYPE_WIRED;
+	char *line = NULL, path[PATH_MAX];
+	size_t buflen = 0;
+	ssize_t len;
+	FILE *f;
+
+	snprintf(path, sizeof(path), pattern, ifname, "tun_flags");
+	if (access(path, F_OK) == 0)
+		return GLUONUTIL_INTERFACE_TYPE_TUNNEL;
+
+	snprintf(path, sizeof(path), pattern, ifname, "uevent");
+	f = fopen(path, "r");
+	if (!f)
+		return GLUONUTIL_INTERFACE_TYPE_UNKNOWN;
+
+	while ((len = getline(&line, &buflen, f)) >= 0) {
+		if (len == 0)
+			continue;
+
+		if (line[len-1] == '\n')
+			line[len-1] = '\0';
+
+		if (strncmp(line, "DEVTYPE=", 8) == 0) {
+			ret = lookup_interface_type(line+8);
+			break;
+		}
+	}
+	free(line);
+
+	fclose(f);
+	return ret;
+}
 
 
 struct json_object * gluonutil_wrap_string(const char *str) {
@@ -212,6 +265,45 @@ uci_fail:
 	return ret;
 }
 
+char * gluonutil_get_primary_domain(void) {
+	if (!gluonutil_has_domains())
+		return NULL;
+
+	char *domain_code = gluonutil_get_domain();
+	if (!domain_code)
+		return NULL;
+
+	const char *domain_path_fmt = "/lib/gluon/domains/%s.json";
+	char domain_path[strlen(domain_path_fmt) + strlen(domain_code)];
+	snprintf(domain_path, sizeof(domain_path), domain_path_fmt, domain_code);
+
+	char primary_domain_path[PATH_MAX+1];
+	char *primary_domain_code;
+	ssize_t len = readlink(domain_path, primary_domain_path, PATH_MAX);
+	if (len < 0) {
+		// EINVAL = file is not a symlink = the domain itself is the primary domain
+		if (errno != EINVAL) {
+			free(domain_code);
+			return NULL;
+		}
+
+		return domain_code;
+	}
+
+	free(domain_code);
+
+	primary_domain_path[len] = '\0';
+	primary_domain_code = basename(primary_domain_path);
+
+	char *ext_begin = strrchr(primary_domain_code, '.');
+	if (!ext_begin)
+		return NULL;
+
+	// strip .json from filename
+	*ext_begin = '\0';
+	return strdup(primary_domain_code);
+}
+
 
 struct json_object * gluonutil_load_site_config(void) {
 	char *domain_code = NULL;
@@ -243,6 +335,5 @@ struct json_object * gluonutil_load_site_config(void) {
 
 err:
 	json_object_put(site);
-	free(domain_code);
 	return NULL;
 }

package/libgluonutil/src/libgluonutil.h

-/*
-  Copyright (c) 2016, Matthias Schiffer <mschiffer@universe-factory.net>
-  All rights reserved.
-
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice,
-       this list of conditions and the following disclaimer.
-    2. Redistributions in binary form must reproduce the above copyright notice,
-       this list of conditions and the following disclaimer in the documentation
-       and/or other materials provided with the distribution.
-
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
+/* SPDX-FileCopyrightText: 2016 Matthias Schiffer <mschiffer@universe-factory.net> */
+/* SPDX-License-Identifier: BSD-2-Clause */
 
 
 #ifndef _LIBGLUON_LIBGLUON_H_
 #define _LIBGLUON_LIBGLUON_H_
 
+#include <net/if.h>
 #include <netinet/in.h>
 #include <stdbool.h>
 
@@ -34,7 +13,18 @@
 char * gluonutil_read_line(const char *filename);
 char * gluonutil_get_sysconfig(const char *key);
 char * gluonutil_get_node_id(void);
+
+enum gluonutil_interface_type {
+	GLUONUTIL_INTERFACE_TYPE_UNKNOWN,
+	GLUONUTIL_INTERFACE_TYPE_WIRED,
+	GLUONUTIL_INTERFACE_TYPE_WIRELESS,
+	GLUONUTIL_INTERFACE_TYPE_TUNNEL,
+};
+
+void gluonutil_get_interface_lower(char out[IF_NAMESIZE], const char *ifname);
 char * gluonutil_get_interface_address(const char *ifname);
+enum gluonutil_interface_type gluonutil_get_interface_type(const char *ifname);
+
 bool gluonutil_get_node_prefix6(struct in6_addr *prefix);
 
 struct json_object * gluonutil_wrap_string(const char *str);
@@ -42,6 +32,7 @@ struct json_object * gluonutil_wrap_and_free_string(char *str);
 
 bool gluonutil_has_domains(void);
 char * gluonutil_get_domain(void);
+char * gluonutil_get_primary_domain(void);
 struct json_object * gluonutil_load_site_config(void);
 
 #endif /* _LIBGLUON_LIBGLUON_H_ */

patches/openwrt/0001-procd-add-support-for-alternative-rc.d-directories.patch

@@ -4,10 +4,10 @@ Subject: procd: add support for alternative rc.d directories
 
 diff --git a/package/system/procd/patches/0001-Add-support-for-alternative-rc.d-directories.patch b/package/system/procd/patches/0001-Add-support-for-alternative-rc.d-directories.patch
 new file mode 100644
-index 0000000000000000000000000000000000000000..bc2434200364b46f1db4c2eec22c4e8b973844d5
+index 0000000000000000000000000000000000000000..16d3179f05c64b7178f883745294c64a27127775
 --- /dev/null
 +++ b/package/system/procd/patches/0001-Add-support-for-alternative-rc.d-directories.patch
-@@ -0,0 +1,97 @@
+@@ -0,0 +1,80 @@
 +From 03a2bc70e4260ec9f669391c47b9a7a9ecd0b75d Mon Sep 17 00:00:00 2001
 +Message-Id: <03a2bc70e4260ec9f669391c47b9a7a9ecd0b75d.1407329621.git.mschiffer@universe-factory.net>
 +From: Matthias Schiffer <mschiffer@universe-factory.net>
@@ -19,21 +19,10 @@ index 0000000000000000000000000000000000000000..bc2434200364b46f1db4c2eec22c4e8b
 + rcS.c           |  2 +-
 + 2 files changed, 39 insertions(+), 1 deletion(-)
 +
-+diff --git a/initd/preinit.c b/initd/preinit.c
-+index fb94527..8b832a7 100644
 +--- a/initd/preinit.c
 ++++ b/initd/preinit.c
-+@@ -12,6 +12,8 @@
-+  * GNU General Public License for more details.
-+  */
-+ 
-++#define _GNU_SOURCE
-++
-+ #include <sys/stat.h>
-+ #include <sys/types.h>
-+ #include <sys/mount.h>
-+@@ -46,6 +48,35 @@ check_dbglvl(void)
-+ 		debug = lvl;
++@@ -87,12 +87,42 @@ fail:
++ 	free(command);
 + }
 + 
 ++static char*
@@ -68,15 +57,14 @@ index 0000000000000000000000000000000000000000..bc2434200364b46f1db4c2eec22c4e8b
 + static void
 + spawn_procd(struct uloop_process *proc, int ret)
 + {
-+@@ -53,6 +84,7 @@ spawn_procd(struct uloop_process *proc, int ret)
++ 	char *wdt_fd = watchdog_fd();
 + 	char *argv[] = { "/sbin/procd", NULL};
-+ 	struct stat s;
 + 	char dbg[2];
 ++	char *rc_d_path;
 + 
 + 	if (plugd_proc.pid > 0)
 + 		kill(plugd_proc.pid, SIGKILL);
-+@@ -72,6 +104,12 @@ spawn_procd(struct uloop_process *proc, int ret)
++@@ -112,6 +142,12 @@ spawn_procd(struct uloop_process *proc,
 + 		setenv("DBGLVL", dbg, 1);
 + 	}
 + 
@@ -89,11 +77,9 @@ index 0000000000000000000000000000000000000000..bc2434200364b46f1db4c2eec22c4e8b
 + 	execvp(argv[0], argv);
 + }
 + 
-+diff --git a/rcS.c b/rcS.c
-+index 0e1b0ba..1b00831 100644
 +--- a/rcS.c
 ++++ b/rcS.c
-+@@ -150,7 +150,7 @@ int rcS(char *pattern, char *param, void (*q_empty)(struct runqueue *))
++@@ -184,7 +184,7 @@ int rcS(char *pattern, char *param, void
 + 	q.empty_cb = q_empty;
 + 	q.max_running_tasks = 1;
 + 
@@ -102,6 +88,3 @@ index 0000000000000000000000000000000000000000..bc2434200364b46f1db4c2eec22c4e8b
 + }
 + 
 + int rc(const char *file, char *param)
-+-- 
-+2.0.4
-+

patches/openwrt/0005-dropbear-add-a-failsafe-mode-that-will-always-allow-password-less-root-login.patch → patches/openwrt/0003-dropbear-add-a-failsafe-mode-that-will-always-allow-password-less-root-login.patch

@@ -6,24 +6,13 @@ Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
 
 diff --git a/package/network/services/dropbear/patches/700-failsafe-mode.patch b/package/network/services/dropbear/patches/700-failsafe-mode.patch
 new file mode 100644
-index 0000000000000000000000000000000000000000..d379da0d0a7890e0a25d87e227c2e065cd2750ee
+index 0000000000000000000000000000000000000000..9b619ce80b2963c67ac62bcf95b33b28b505ad2a
 --- /dev/null
 +++ b/package/network/services/dropbear/patches/700-failsafe-mode.patch
 @@ -0,0 +1,57 @@
-+--- a/runopts.h
-++++ b/runopts.h
-+@@ -98,6 +98,8 @@ typedef struct svr_runopts {
-+ 	int allowblankpass;
-+ 	unsigned int maxauthtries;
-+ 
-++	int failsafe_mode;
-++
-+ #ifdef ENABLE_SVR_REMOTETCPFWD
-+ 	int noremotetcp;
-+ #endif
-+--- a/svr-auth.c
-++++ b/svr-auth.c
-+@@ -149,10 +149,11 @@ void recv_msg_userauth_request() {
++--- a/src/svr-auth.c
+++++ b/src/svr-auth.c
++@@ -124,10 +124,11 @@ void recv_msg_userauth_request() {
 + 				AUTH_METHOD_NONE_LEN) == 0) {
 + 		TRACE(("recv_msg_userauth_request: 'none' request"))
 + 		if (valid_user
@@ -39,31 +28,42 @@ index 0000000000000000000000000000000000000000..d379da0d0a7890e0a25d87e227c2e065
 + 		{
 + 			dropbear_log(LOG_NOTICE, 
 + 					"Auth succeeded with blank password for '%s' from %s",
-+--- a/svr-runopts.c
-++++ b/svr-runopts.c
-+@@ -72,6 +72,7 @@ static void printhelp(const char * progn
++--- a/src/svr-runopts.c
+++++ b/src/svr-runopts.c
++@@ -82,6 +82,7 @@ static void printhelp(const char * progn
 + 					"-s		Disable password logins\n"
 + 					"-g		Disable password logins for root\n"
 + 					"-B		Allow blank password logins\n"
 ++					"-f             Failsafe mode: always allow password-less root login\n"
++ 					"-t		Enable two-factor authentication (both password and public key required)\n"
 + #endif
-+ 					"-T <1 to %d> 	Maximum authentication tries (default %d)\n"
-+ #ifdef ENABLE_SVR_LOCALTCPFWD
-+@@ -133,6 +134,7 @@ void svr_getopts(int argc, char ** argv)
++ 					"-T		Maximum authentication tries (default %d)\n"
++@@ -166,6 +167,7 @@ void svr_getopts(int argc, char ** argv)
 + 	svr_opts.noauthpass = 0;
 + 	svr_opts.norootpass = 0;
 + 	svr_opts.allowblankpass = 0;
 ++	svr_opts.failsafe_mode = 0;
-+ 	svr_opts.maxauthtries = DEFAULT_AUTH_TRIES;
++ 	svr_opts.multiauthmethod = 0;
++ 	svr_opts.maxauthtries = MAX_AUTH_TRIES;
 + 	svr_opts.inetdmode = 0;
-+ 	svr_opts.portcount = 0;
-+@@ -251,6 +253,9 @@ void svr_getopts(int argc, char ** argv)
-+ 				case 'B':
-+ 					svr_opts.allowblankpass = 1;
++@@ -263,6 +265,9 @@ void svr_getopts(int argc, char ** argv)
++ 				case '2':
++ 					next = &reexec_fd_arg;
 + 					break;
 ++				case 'f':
 ++					svr_opts.failsafe_mode = 1;
 ++					break;
 + #endif
-+ 				case 'h':
-+ 					printhelp(argv[0]);
++ 				case 'p':
++ 					nextisport = 1;
++--- a/src/runopts.h
+++++ b/src/runopts.h
++@@ -110,6 +110,8 @@ typedef struct svr_runopts {
++ 	int multiauthmethod;
++ 	unsigned int maxauthtries;
++ 
+++	int failsafe_mode;
+++
++ #if DROPBEAR_SVR_REMOTETCPFWD
++ 	int noremotetcp;
++ #endif

patches/openwrt/0003-hostapd-prevent-channel-switch-for-5GHz.patch

-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Mon, 27 Jul 2015 20:42:50 +0200
-Subject: hostapd: prevent channel switch for 5GHz
-
-hostapd would switch the primary and secondary channel on 5GHz networks in
-certain circumstances, completely breaking the adhoc interfaces of the WLAN
-adapter (they would lose their configuration).
-
-As a temporary fix, disable this channel switch function.
-
-diff --git a/package/network/services/hostapd/patches/900-no_channel_switch.patch b/package/network/services/hostapd/patches/900-no_channel_switch.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..c6145156928ffa5a5195ca145b0655bb88c92091
---- /dev/null
-+++ b/package/network/services/hostapd/patches/900-no_channel_switch.patch
-@@ -0,0 +1,68 @@
-+--- a/src/common/hw_features_common.c
-++++ b/src/common/hw_features_common.c
-+@@ -171,7 +171,6 @@ int check_40mhz_5g(struct hostapd_hw_mod
-+ 		   struct wpa_scan_results *scan_res, int pri_chan,
-+ 		   int sec_chan)
-+ {
-+-	int pri_freq, sec_freq, pri_bss, sec_bss;
-+ 	int bss_pri_chan, bss_sec_chan;
-+ 	size_t i;
-+ 	int match;
-+@@ -180,57 +179,6 @@ int check_40mhz_5g(struct hostapd_hw_mod
-+ 	    pri_chan == sec_chan)
-+ 		return 0;
-+ 
-+-	pri_freq = hw_get_freq(mode, pri_chan);
-+-	sec_freq = hw_get_freq(mode, sec_chan);
-+-
-+-	/*
-+-	 * Switch PRI/SEC channels if Beacons were detected on selected SEC
-+-	 * channel, but not on selected PRI channel.
-+-	 */
-+-	pri_bss = sec_bss = 0;
-+-	for (i = 0; i < scan_res->num; i++) {
-+-		struct wpa_scan_res *bss = scan_res->res[i];
-+-		if (bss->freq == pri_freq)
-+-			pri_bss++;
-+-		else if (bss->freq == sec_freq)
-+-			sec_bss++;
-+-	}
-+-	if (sec_bss && !pri_bss) {
-+-		wpa_printf(MSG_INFO,
-+-			   "Switch own primary and secondary channel to get secondary channel with no Beacons from other BSSes");
-+-		return 2;
-+-	}
-+-
-+-	/*
-+-	 * Match PRI/SEC channel with any existing HT40 BSS on the same
-+-	 * channels that we are about to use (if already mixed order in
-+-	 * existing BSSes, use own preference).
-+-	 */
-+-	match = 0;
-+-	for (i = 0; i < scan_res->num; i++) {
-+-		struct wpa_scan_res *bss = scan_res->res[i];
-+-		get_pri_sec_chan(bss, &bss_pri_chan, &bss_sec_chan);
-+-		if (pri_chan == bss_pri_chan &&
-+-		    sec_chan == bss_sec_chan) {
-+-			match = 1;
-+-			break;
-+-		}
-+-	}
-+-	if (!match) {
-+-		for (i = 0; i < scan_res->num; i++) {
-+-			struct wpa_scan_res *bss = scan_res->res[i];
-+-			get_pri_sec_chan(bss, &bss_pri_chan, &bss_sec_chan);
-+-			if (pri_chan == bss_sec_chan &&
-+-			    sec_chan == bss_pri_chan) {
-+-				wpa_printf(MSG_INFO, "Switch own primary and "
-+-					   "secondary channel due to BSS "
-+-					   "overlap with " MACSTR,
-+-					   MAC2STR(bss->bssid));
-+-				return 2;
-+-			}
-+-		}
-+-	}
-+-
-+ 	return 1;
-+ }
-+ 

patches/openwrt/0004-HACK-opkg-do-not-preserve-opkg-keys-on-upgrades-by-default.patch

+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Sun, 30 Mar 2025 13:16:02 +0200
+Subject: HACK: opkg: do not preserve opkg keys on upgrades by default
+
+Custom keys can still be preserved by listing them in sysupgrade.conf.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+
+diff --git a/package/system/opkg/Makefile b/package/system/opkg/Makefile
+index e7c45e3523135a6cc35385a81c65cf2831b842bb..fc5ec6a7ed1eb559a478b00b03102fbccd543c57 100644
+--- a/package/system/opkg/Makefile
++++ b/package/system/opkg/Makefile
+@@ -56,7 +56,6 @@ endef
+ 
+ define Package/opkg/conffiles
+ /etc/opkg.conf
+-/etc/opkg/keys/
+ /etc/opkg/customfeeds.conf
+ endef
+ 

patches/openwrt/0004-libjson-c-Add-support-for-custom-format-strings-for-doubles.patch

-From: Jan-Philipp Litza <janphilipp@litza.de>
-Date: Fri, 6 May 2016 16:44:29 +0200
-Subject: libjson-c: Add support for custom format strings for doubles
-
-diff --git a/package/libs/libjson-c/patches/002-custom-format-string.patch b/package/libs/libjson-c/patches/002-custom-format-string.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..2f454c560ff78c1edd4654b9651f0e6299bd5e6f
---- /dev/null
-+++ b/package/libs/libjson-c/patches/002-custom-format-string.patch
-@@ -0,0 +1,98 @@
-+From 21dc5dc92bd56f5f4dc2c90b9ea6bf1e1407714e Mon Sep 17 00:00:00 2001
-+From: Jan-Philipp Litza <janphilipp@litza.de>
-+Date: Fri, 6 May 2016 16:12:44 +0200
-+Subject: [PATCH] Export json_object_double_to_json_string() and use custom
-+ format string
-+BCC: janphilipp@litza.de
-+
-+---
-+ json_object.c | 12 ++++++------
-+ json_object.h | 28 ++++++++++++++++++++++++++++
-+ 2 files changed, 34 insertions(+), 6 deletions(-)
-+
-+diff --git a/json_object.c b/json_object.c
-+index 7d60884..46701e7 100644
-+--- a/json_object.c
-++++ b/json_object.c
-+@@ -55,7 +55,6 @@ static struct json_object* json_object_new(enum json_type o_type);
-+ static json_object_to_json_string_fn json_object_object_to_json_string;
-+ static json_object_to_json_string_fn json_object_boolean_to_json_string;
-+ static json_object_to_json_string_fn json_object_int_to_json_string;
-+-static json_object_to_json_string_fn json_object_double_to_json_string;
-+ static json_object_to_json_string_fn json_object_string_to_json_string;
-+ static json_object_to_json_string_fn json_object_array_to_json_string;
-+ 
-+@@ -644,10 +643,10 @@ int64_t json_object_get_int64(const struct json_object *jso)
-+ 
-+ /* json_object_double */
-+ 
-+-static int json_object_double_to_json_string(struct json_object* jso,
-+-					     struct printbuf *pb,
-+-					     int level,
-+-						 int flags)
-++int json_object_double_to_json_string(struct json_object* jso,
-++				      struct printbuf *pb,
-++				      int level,
-++				      int flags)
-+ {
-+   char buf[128], *p, *q;
-+   int size;
-+@@ -663,7 +662,8 @@ static int json_object_double_to_json_string(struct json_object* jso,
-+     else
-+       size = snprintf(buf, sizeof(buf), "-Infinity");
-+   else
-+-    size = snprintf(buf, sizeof(buf), "%.17g", jso->o.c_double);
-++    size = snprintf(buf, sizeof(buf),
-++        jso->_userdata ? (const char*) jso->_userdata : "%.17g", jso->o.c_double);
-+ 
-+   p = strchr(buf, ',');
-+   if (p) {
-+diff --git a/json_object.h b/json_object.h
-+index 2bce454..a89de44 100644
-+--- a/json_object.h
-++++ b/json_object.h
-+@@ -614,6 +614,9 @@ extern int64_t json_object_get_int64(const struct json_object *obj);
-+ /* double type methods */
-+ 
-+ /** Create a new empty json_object of type json_type_double
-++ *
-++ * @see json_object_double_to_json_string() for how to set a custom format string.
-++ *
-+  * @param d the double
-+  * @returns a json_object of type json_type_double
-+  */
-+@@ -642,6 +645,31 @@ extern struct json_object* json_object_new_double(double d);
-+  */
-+ extern struct json_object* json_object_new_double_s(double d, const char *ds);
-+ 
-++
-++/** Serialize a json_object of type json_type_double to a string.
-++ *
-++ * This function isn't meant to be called directly. Instead, you can set a
-++ * custom format string for the serialization of this double using the
-++ * following call (where "%.17g" actually is the default):
-++ *
-++ * @code
-++ *   jso = json_object_new_double(d);
-++ *   json_object_set_serializer(jso, json_object_double_to_json_string,
-++ *       "%.17g", NULL);
-++ * @endcode
-++ *
-++ * @see printf(3) man page for format strings
-++ *
-++ * @param jso The json_type_double object that is serialized.
-++ * @param pb The destination buffer.
-++ * @param level Ignored.
-++ * @param flags Ignored.
-++ */
-++extern int json_object_double_to_json_string(struct json_object* jso,
-++					     struct printbuf *pb,
-++					     int level,
-++					     int flags);
-++
-+ /** Get the double floating point value of a json_object
-+  *
-+  * The type is coerced to a double if the passed object is not a double.
-+-- 
-+2.7.4
-+

patches/openwrt/0005-kernel-bridge-Implement-MLD-Querier-wake-up-calls-Android-bug-workaround.patch

+From: Linus Lüssing <linus.luessing@c0d3.blue>
+Date: Sat, 1 Jan 2022 10:09:13 +0100
+Subject: kernel: bridge: Implement MLD Querier wake-up calls / Android bug workaround
+
+Implement a configurable MLD Querier wake-up calls "feature" which
+works around a widely spread Android bug in connection with IGMP/MLD
+snooping.
+
+Currently there are mobile devices (e.g. Android) which are not able
+to receive and respond to MLD Queries reliably because the Wifi driver
+filters a lot of ICMPv6 when the device is asleep - including
+MLD. This in turn breaks IPv6 communication when MLD Snooping is
+enabled. However there is one ICMPv6 type which is allowed to pass and
+which can be used to wake up the mobile device: ICMPv6 Echo Requests.
+
+If this bridge is the selected MLD Querier then setting
+"multicast_wakeupcall" to a number n greater than 0 will send n
+ICMPv6 Echo Requests to each host behind this port to wake
+them up with each MLD Query. Upon receiving a matching ICMPv6 Echo
+Reply an MLD Query with a unicast ethernet destination will be sent
+to the specific host(s).
+
+Link: https://issuetracker.google.com/issues/149630944
+Link: https://github.com/freifunk-gluon/gluon/issues/1832
+
+Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
+
+diff --git a/package/network/config/netifd/patches/0001-bridge-Add-multicast_wakeupcall-option.patch b/package/network/config/netifd/patches/0001-bridge-Add-multicast_wakeupcall-option.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..077a563b6066cd1d3aee4b1e82328e8cc5e042ea
+--- /dev/null
++++ b/package/network/config/netifd/patches/0001-bridge-Add-multicast_wakeupcall-option.patch
+@@ -0,0 +1,142 @@
++From d23a49e6542dc068b12fbc7b6a4520f9fb3626f9 Mon Sep 17 00:00:00 2001
++From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
++Date: Sun, 5 Jul 2020 23:33:51 +0200
++Subject: [PATCH] bridge: Add multicast_wakeupcall option
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++This makes the new per bridge port multicast_wakeupcall feature
++for the Linux bridge configurable for wireless interfaces and enables it
++by default for an AP interface.
++
++The MLD Querier wake-up calls "feature" works around a widely spread Android
++bug in connection with IGMP/MLD snooping.
++
++Currently there are mobile devices (e.g. Android) which are not able
++to receive and respond to MLD Queries reliably because the Wifi driver
++filters a lot of ICMPv6 when the device is asleep - including
++MLD. This in turn breaks IPv6 communication when MLD Snooping is
++enabled. However there is one ICMPv6 type which is allowed to pass and
++which can be used to wake up the mobile device: ICMPv6 Echo Requests.
++
++If this bridge is the selected MLD Querier then setting
++"multicast_wakeupcall" to a number n greater than 0 will send n
++ICMPv6 Echo Requests to each host behind this port to wake
++them up with each MLD Query. Upon receiving a matching ICMPv6 Echo
++Reply an MLD Query with a unicast ethernet destination will be sent
++to the specific host(s).
++
++Link: https://issuetracker.google.com/issues/149630944
++Link: https://github.com/freifunk-gluon/gluon/issues/1832
++
++Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
++---
++ device.c       |  9 +++++++++
++ device.h       |  3 +++
++ system-linux.c | 13 +++++++++++++
++ 3 files changed, 25 insertions(+)
++
++--- a/device.c
+++++ b/device.c
++@@ -49,6 +49,7 @@ static const struct blobmsg_policy dev_a
++ 	[DEV_ATTR_NEIGHGCSTALETIME] = { .name = "neighgcstaletime", .type = BLOBMSG_TYPE_INT32 },
++ 	[DEV_ATTR_DADTRANSMITS] = { .name = "dadtransmits", .type = BLOBMSG_TYPE_INT32 },
++ 	[DEV_ATTR_MULTICAST_TO_UNICAST] = { .name = "multicast_to_unicast", .type = BLOBMSG_TYPE_BOOL },
+++	[DEV_ATTR_MULTICAST_WAKEUPCALL] = { .name = "multicast_wakeupcall", .type = BLOBMSG_TYPE_INT32 },
++ 	[DEV_ATTR_MULTICAST_ROUTER] = { .name = "multicast_router", .type = BLOBMSG_TYPE_INT32 },
++ 	[DEV_ATTR_MULTICAST_FAST_LEAVE] = { .name = "multicast_fast_leave", . type = BLOBMSG_TYPE_BOOL },
++ 	[DEV_ATTR_MULTICAST] = { .name ="multicast", .type = BLOBMSG_TYPE_BOOL },
++@@ -275,6 +276,7 @@ device_merge_settings(struct device *dev
++ 	n->multicast = s->flags & DEV_OPT_MULTICAST ?
++ 		s->multicast : os->multicast;
++ 	n->multicast_to_unicast = s->multicast_to_unicast;
+++	n->multicast_wakeupcall = s->multicast_wakeupcall;
++ 	n->multicast_router = s->multicast_router;
++ 	n->multicast_fast_leave = s->multicast_fast_leave;
++ 	n->learning = s->learning;
++@@ -449,6 +451,11 @@ device_init_settings(struct device *dev,
++ 		s->flags |= DEV_OPT_MULTICAST_TO_UNICAST;
++ 	}
++ 
+++	if ((cur = tb[DEV_ATTR_MULTICAST_WAKEUPCALL])) {
+++		s->multicast_wakeupcall = blobmsg_get_u32(cur);
+++		s->flags |= DEV_OPT_MULTICAST_WAKEUPCALL;
+++	}
+++
++ 	if ((cur = tb[DEV_ATTR_MULTICAST_ROUTER])) {
++ 		s->multicast_router = blobmsg_get_u32(cur);
++ 		if (s->multicast_router <= 2)
++@@ -1372,6 +1379,8 @@ device_dump_status(struct blob_buf *b, s
++ 			blobmsg_add_u32(b, "dadtransmits", st.dadtransmits);
++ 		if (st.flags & DEV_OPT_MULTICAST_TO_UNICAST)
++ 			blobmsg_add_u8(b, "multicast_to_unicast", st.multicast_to_unicast);
+++		if (st.flags & DEV_OPT_MULTICAST_WAKEUPCALL)
+++			blobmsg_add_u32(b, "multicast_wakeupcall", st.multicast_wakeupcall);
++ 		if (st.flags & DEV_OPT_MULTICAST_ROUTER)
++ 			blobmsg_add_u32(b, "multicast_router", st.multicast_router);
++ 		if (st.flags & DEV_OPT_MULTICAST_FAST_LEAVE)
++--- a/device.h
+++++ b/device.h
++@@ -44,6 +44,7 @@ enum {
++ 	DEV_ATTR_NEIGHREACHABLETIME,
++ 	DEV_ATTR_DADTRANSMITS,
++ 	DEV_ATTR_MULTICAST_TO_UNICAST,
+++	DEV_ATTR_MULTICAST_WAKEUPCALL,
++ 	DEV_ATTR_MULTICAST_ROUTER,
++ 	DEV_ATTR_MULTICAST_FAST_LEAVE,
++ 	DEV_ATTR_MULTICAST,
++@@ -144,6 +145,7 @@ enum {
++ 	DEV_OPT_GRO			= (1ULL << 37),
++ 	DEV_OPT_MASTER			= (1ULL << 38),
++ 	DEV_OPT_EEE			= (1ULL << 39),
+++	DEV_OPT_MULTICAST_WAKEUPCALL	= (1ULL << 63),
++ };
++ 
++ /* events broadcasted to all users of a device */
++@@ -205,6 +207,7 @@ struct device_settings {
++ 	int neigh4locktime;
++ 	unsigned int dadtransmits;
++ 	bool multicast_to_unicast;
+++	unsigned int multicast_wakeupcall;
++ 	unsigned int multicast_router;
++ 	bool multicast_fast_leave;
++ 	bool multicast;
++--- a/system-linux.c
+++++ b/system-linux.c
++@@ -536,6 +536,11 @@ static void system_bridge_set_multicast_
++ 	system_set_dev_sysfs("brport/multicast_to_unicast", dev->ifname, val);
++ }
++ 
+++static void system_bridge_set_multicast_wakeupcall(struct device *dev, const char *val)
+++{
+++	system_set_dev_sysfs("brport/multicast_wakeupcall", dev->ifname, val);
+++}
+++
++ static void system_bridge_set_multicast_fast_leave(struct device *dev, const char *val)
++ {
++ 	system_set_dev_sysfs("brport/multicast_fast_leave", dev->ifname, val);
++@@ -923,8 +928,10 @@ static char *system_get_bridge(const cha
++ static void
++ system_bridge_set_wireless(struct device *bridge, struct device *dev)
++ {
+++	unsigned int mcast_wakeupcall = dev->wireless_ap ? 2 : 0;
++ 	bool mcast_to_ucast = dev->wireless_ap;
++ 	bool hairpin;
+++	char buf[64];
++ 
++ 	if (dev->settings.flags & DEV_OPT_MULTICAST_TO_UNICAST)
++ 		mcast_to_ucast = dev->settings.multicast_to_unicast;
++@@ -939,6 +946,12 @@ system_bridge_set_wireless(struct device
++ 	system_bridge_set_multicast_to_unicast(dev, mcast_to_ucast ? "1" : "0");
++ 	system_bridge_set_hairpin_mode(dev, hairpin ? "1" : "0");
++ 	system_bridge_set_proxyarp_wifi(dev, dev->wireless_proxyarp ? "1" : "0");
+++
+++	if (bridge->settings.flags & DEV_OPT_MULTICAST_WAKEUPCALL)
+++		mcast_wakeupcall = dev->settings.multicast_wakeupcall;
+++
+++	snprintf(buf, sizeof(buf), "%u", mcast_wakeupcall);
+++	system_bridge_set_multicast_wakeupcall(dev, buf);
++ }
++ 
++ int system_bridge_addif(struct device *bridge, struct device *dev)
+diff --git a/target/linux/generic/config-6.6 b/target/linux/generic/config-6.6
+index 46283ac3bd818d3b39ad8c57262bba101efff753..da3956c0fa55bd0b9c8ae3edacd28286066f357e 100644
+--- a/target/linux/generic/config-6.6
++++ b/target/linux/generic/config-6.6
+@@ -716,6 +716,7 @@ CONFIG_BRIDGE=y
+ # CONFIG_BRIDGE_EBT_T_NAT is not set
+ # CONFIG_BRIDGE_EBT_VLAN is not set
+ CONFIG_BRIDGE_IGMP_SNOOPING=y
++CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS=y
+ # CONFIG_BRIDGE_MRP is not set
+ # CONFIG_BRIDGE_NETFILTER is not set
+ # CONFIG_BRIDGE_NF_EBTABLES is not set
+diff --git a/target/linux/generic/hack-6.6/602-bridge-Implement-MLD-Querier-wake-up-calls-Android-b.patch b/target/linux/generic/hack-6.6/602-bridge-Implement-MLD-Querier-wake-up-calls-Android-b.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..5a54131fab24f9cfaa9c51d51b3163bd2ecaf4c3
+--- /dev/null
++++ b/target/linux/generic/hack-6.6/602-bridge-Implement-MLD-Querier-wake-up-calls-Android-b.patch
+@@ -0,0 +1,690 @@
++From 9734fac17903cc0c67c63361525cc99f793fd6d7 Mon Sep 17 00:00:00 2001
++From: =?UTF-8?q?Linus=20L=C3=BCssing?= <linus.luessing@c0d3.blue>
++Date: Mon, 29 Jun 2020 19:04:05 +0200
++Subject: [PATCH] bridge: Implement MLD Querier wake-up calls / Android bug
++ workaround
++MIME-Version: 1.0
++Content-Type: text/plain; charset=UTF-8
++Content-Transfer-Encoding: 8bit
++
++Implement a configurable MLD Querier wake-up calls "feature" which
++works around a widely spread Android bug in connection with IGMP/MLD
++snooping.
++
++Currently there are mobile devices (e.g. Android) which are not able
++to receive and respond to MLD Queries reliably because the Wifi driver
++filters a lot of ICMPv6 when the device is asleep - including
++MLD. This in turn breaks IPv6 communication when MLD Snooping is
++enabled. However there is one ICMPv6 type which is allowed to pass and
++which can be used to wake up the mobile device: ICMPv6 Echo Requests.
++
++If this bridge is the selected MLD Querier then setting
++"multicast_wakeupcall" to a number n greater than 0 will send n
++ICMPv6 Echo Requests to each host behind this port to wake
++them up with each MLD Query. Upon receiving a matching ICMPv6 Echo
++Reply an MLD Query with a unicast ethernet destination will be sent
++to the specific host(s).
++
++Link: https://issuetracker.google.com/issues/149630944
++Link: https://github.com/freifunk-gluon/gluon/issues/1832
++
++Signed-off-by: Linus Lüssing <linus.luessing@c0d3.blue>
++---
++ include/linux/if_bridge.h    |   1 +
++ include/net/addrconf.h       |   1 +
++ include/uapi/linux/if_link.h |   1 +
++ net/bridge/Kconfig           |  26 ++++
++ net/bridge/br_fdb.c          |  10 ++
++ net/bridge/br_input.c        |   4 +-
++ net/bridge/br_multicast.c    | 291 ++++++++++++++++++++++++++++++++++-
++ net/bridge/br_netlink.c      |  19 +++
++ net/bridge/br_private.h      |  20 +++
++ net/bridge/br_sysfs_if.c     |  18 +++
++ net/core/rtnetlink.c         |   2 +-
++ net/ipv6/mcast_snoop.c       |   3 +-
++ 12 files changed, 386 insertions(+), 10 deletions(-)
++
++diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
++index cff03a1dfd68..70b6f74653d0 100644
++--- a/include/linux/if_bridge.h
+++++ b/include/linux/if_bridge.h
++@@ -62,6 +62,7 @@ struct br_ip_list {
++ #define BR_PORT_MAB		BIT(22)
++ #define BR_NEIGH_VLAN_SUPPRESS	BIT(23)
++ #define BR_BPDU_FILTER		BIT(24)
+++#define BR_MULTICAST_WAKEUPCALL	BIT(25)
++ 
++ #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
++ 
++diff --git a/include/net/addrconf.h b/include/net/addrconf.h
++index facb7a469efa..817a33d1c055 100644
++--- a/include/net/addrconf.h
+++++ b/include/net/addrconf.h
++@@ -243,6 +243,7 @@ void ipv6_mc_unmap(struct inet6_dev *idev);
++ void ipv6_mc_remap(struct inet6_dev *idev);
++ void ipv6_mc_init_dev(struct inet6_dev *idev);
++ void ipv6_mc_destroy_dev(struct inet6_dev *idev);
+++int ipv6_mc_check_icmpv6(struct sk_buff *skb);
++ int ipv6_mc_check_mld(struct sk_buff *skb);
++ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp);
++ 
++diff --git a/include/uapi/linux/if_link.h b/include/uapi/linux/if_link.h
++index b29417908271..88b1c8a19bb4 100644
++--- a/include/uapi/linux/if_link.h
+++++ b/include/uapi/linux/if_link.h
++@@ -572,6 +572,7 @@ enum {
++ 	IFLA_BRPORT_NEIGH_VLAN_SUPPRESS,
++ 	IFLA_BRPORT_BACKUP_NHID,
++ 	IFLA_BRPORT_BPDU_FILTER,
+++	IFLA_BRPORT_MCAST_WAKEUPCALL,
++ 	__IFLA_BRPORT_MAX
++ };
++ #define IFLA_BRPORT_MAX (__IFLA_BRPORT_MAX - 1)
++diff --git a/net/bridge/Kconfig b/net/bridge/Kconfig
++index 3c8ded7d3e84..1a11e22c7d51 100644
++--- a/net/bridge/Kconfig
+++++ b/net/bridge/Kconfig
++@@ -48,6 +48,32 @@ config BRIDGE_IGMP_SNOOPING
++ 
++ 	  If unsure, say Y.
++ 
+++config BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	bool "MLD Querier wake-up calls"
+++	depends on BRIDGE_IGMP_SNOOPING
+++	depends on IPV6
+++	help
+++	  If you say Y here, then the MLD Snooping Querier will be built
+++	  with a per bridge port wake-up call "feature"/workaround.
+++
+++	  Currently there are mobile devices (e.g. Android) which are not able
+++	  to receive and respond to MLD Queries reliably because the Wifi driver
+++	  filters a lot of ICMPv6 when the device is asleep - including MLD.
+++	  This in turn breaks IPv6 communication when MLD Snooping is enabled.
+++	  However there is one ICMPv6 type which is allowed to pass and
+++	  which can be used to wake up the mobile device: ICMPv6 Echo Requests.
+++
+++	  If this bridge is the selected MLD Querier then setting
+++	  "multicast_wakeupcall" to a number n greater than 0 will send n
+++	  ICMPv6 Echo Requests to each host behind this port to wake them up
+++	  with each MLD Query. Upon receiving a matching ICMPv6 Echo Reply
+++	  an MLD Query with a unicast ethernet destination will be sent to the
+++	  specific host(s).
+++
+++	  Say N to exclude this support and reduce the binary size.
+++
+++	  If unsure, say N.
+++
++ config BRIDGE_VLAN_FILTERING
++ 	bool "VLAN filtering"
++ 	depends on BRIDGE
++diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
++index a6d8cd9a5807..b70426806d45 100644
++--- a/net/bridge/br_fdb.c
+++++ b/net/bridge/br_fdb.c
++@@ -80,6 +80,10 @@ static void fdb_rcu_free(struct rcu_head *head)
++ {
++ 	struct net_bridge_fdb_entry *ent
++ 		= container_of(head, struct net_bridge_fdb_entry, rcu);
+++
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	del_timer_sync(&ent->wakeupcall_timer);
+++#endif
++ 	kmem_cache_free(br_fdb_cache, ent);
++ }
++ 
++@@ -400,6 +404,12 @@ static struct net_bridge_fdb_entry *fdb_create(struct net_bridge *br,
++ 	fdb->key.vlan_id = vid;
++ 	fdb->flags = flags;
++ 	fdb->updated = fdb->used = jiffies;
+++
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++		timer_setup(&fdb->wakeupcall_timer,
+++			    br_multicast_send_wakeupcall, 0);
+++#endif
+++
++ 	err = rhashtable_lookup_insert_fast(&br->fdb_hash_tbl, &fdb->rhnode,
++ 					    br_fdb_rht_params);
++ 	if (err) {
++diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
++index 4540c76d6079..d4644aab7dbf 100644
++--- a/net/bridge/br_input.c
+++++ b/net/bridge/br_input.c
++@@ -204,8 +204,10 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
++ 	if (dst) {
++ 		unsigned long now = jiffies;
++ 
++-		if (test_bit(BR_FDB_LOCAL, &dst->flags))
+++		if (test_bit(BR_FDB_LOCAL, &dst->flags)) {
+++			br_multicast_wakeupcall_rcv(brmctx, pmctx, skb, vid);
++ 			return br_pass_frame_up(skb, false);
+++		}
++ 
++ 		if (now != dst->used)
++ 			dst->used = now;
++diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
++index c38244d60ff8..df3a4d4dbb8f 100644
++--- a/net/bridge/br_multicast.c
+++++ b/net/bridge/br_multicast.c
++@@ -1076,15 +1076,16 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge_mcast *brm
++ 						    const struct in6_addr *group,
++ 						    bool with_srcs, bool over_llqt,
++ 						    u8 sflag, u8 *igmp_type,
++-						    bool *need_rexmit)
+++						    bool *need_rexmit,
+++						    bool delay)
++ {
++ 	struct net_bridge_port *p = pg ? pg->key.port : NULL;
++ 	struct net_bridge_group_src *ent;
++ 	size_t pkt_size, mld_hdr_size;
++ 	unsigned long now = jiffies;
+++	unsigned long interval = 0;
++ 	struct mld2_query *mld2q;
++ 	void *csum_start = NULL;
++-	unsigned long interval;
++ 	__sum16 *csum = NULL;
++ 	struct ipv6hdr *ip6h;
++ 	struct mld_msg *mldq;
++@@ -1166,9 +1167,13 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge_mcast *brm
++ 
++ 	/* ICMPv6 */
++ 	skb_set_transport_header(skb, skb->len);
++-	interval = ipv6_addr_any(group) ?
++-			brmctx->multicast_query_response_interval :
++-			brmctx->multicast_last_member_interval;
+++	if (delay) {
+++		interval = ipv6_addr_any(group) ?
+++				brmctx->multicast_query_response_interval :
+++				brmctx->multicast_last_member_interval;
+++		interval = jiffies_to_msecs(interval);
+++	}
+++
++ 	*igmp_type = ICMPV6_MGM_QUERY;
++ 	switch (brmctx->multicast_mld_version) {
++ 	case 1:
++@@ -1176,7 +1181,7 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge_mcast *brm
++ 		mldq->mld_type = ICMPV6_MGM_QUERY;
++ 		mldq->mld_code = 0;
++ 		mldq->mld_cksum = 0;
++-		mldq->mld_maxdelay = htons((u16)jiffies_to_msecs(interval));
+++		mldq->mld_maxdelay = htons((u16)interval);
++ 		mldq->mld_reserved = 0;
++ 		mldq->mld_mca = *group;
++ 		csum = &mldq->mld_cksum;
++@@ -1267,7 +1272,7 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge_mcast *brmctx,
++ 						    &ip6_dst, &group->dst.ip6,
++ 						    with_srcs, over_lmqt,
++ 						    sflag, igmp_type,
++-						    need_rexmit);
+++						    need_rexmit, true);
++ 	}
++ #endif
++ 	}
++@@ -1777,6 +1782,169 @@ static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx,
++ #endif
++ }
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++
+++#define BR_MC_WAKEUP_ID htons(0xEC6B) /* random identifier */
+++#define BR_MC_ETH_ZERO { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }
+++#define BR_MC_IN6_ZERO \
+++{ \
+++	.s6_addr32[0] = 0, .s6_addr32[1] = 0, \
+++	.s6_addr32[2] = 0, .s6_addr32[3] = 0, \
+++}
+++
+++#define BR_MC_IN6_FE80 \
+++{ \
+++	.s6_addr32[0] = htonl(0xfe800000), \
+++	.s6_addr32[1] = 0, \
+++	.s6_addr32[2] = htonl(0x000000ff), \
+++	.s6_addr32[3] = htonl(0xfe000000), \
+++}
+++
+++#define BR_MC_ECHO_LEN sizeof(pkt->echohdr)
+++
+++static struct sk_buff *br_multicast_alloc_wakeupcall(struct net_bridge *br,
+++						     struct net_bridge_port *port,
+++						     u8 *eth_dst)
+++{
+++	struct in6_addr ip6_src, ip6_dst = BR_MC_IN6_FE80;
+++	struct sk_buff *skb;
+++	__wsum csum_part;
+++	__sum16 csum;
+++
+++	struct wakeupcall_pkt {
+++		struct ethhdr ethhdr;
+++		struct ipv6hdr ip6hdr;
+++		struct icmp6hdr echohdr;
+++	} __packed;
+++
+++	struct wakeupcall_pkt *pkt;
+++
+++	static const struct wakeupcall_pkt __pkt_template = {
+++		.ethhdr = {
+++			.h_dest = BR_MC_ETH_ZERO, // update
+++			.h_source = BR_MC_ETH_ZERO, // update
+++			.h_proto = htons(ETH_P_IPV6),
+++		},
+++		.ip6hdr = {
+++			.priority = 0,
+++			.version = 0x6,
+++			.flow_lbl = { 0x00, 0x00, 0x00 },
+++			.payload_len = htons(BR_MC_ECHO_LEN),
+++			.nexthdr = IPPROTO_ICMPV6,
+++			.hop_limit = 1,
+++			.saddr = BR_MC_IN6_ZERO, // update
+++			.daddr = BR_MC_IN6_ZERO, // update
+++		},
+++		.echohdr = {
+++			.icmp6_type = ICMPV6_ECHO_REQUEST,
+++			.icmp6_code = 0,
+++			.icmp6_cksum = 0, // update
+++			.icmp6_dataun.u_echo = {
+++				.identifier = BR_MC_WAKEUP_ID,
+++				.sequence = 0,
+++			},
+++		},
+++	};
+++
+++	memcpy(&ip6_dst.s6_addr32[2], &eth_dst[0], ETH_ALEN / 2);
+++	memcpy(&ip6_dst.s6_addr[13], &eth_dst[3], ETH_ALEN / 2);
+++	ip6_dst.s6_addr[8] ^= 0x02;
+++	if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6_dst, 0,
+++			       &ip6_src))
+++		return NULL;
+++
+++	skb = netdev_alloc_skb_ip_align(br->dev, sizeof(*pkt));
+++	if (!skb)
+++		return NULL;
+++
+++	skb->protocol = htons(ETH_P_IPV6);
+++	skb->dev = port->dev;
+++
+++	pkt = (struct wakeupcall_pkt *)skb->data;
+++	*pkt = __pkt_template;
+++
+++	ether_addr_copy(pkt->ethhdr.h_source, br->dev->dev_addr);
+++	ether_addr_copy(pkt->ethhdr.h_dest, eth_dst);
+++
+++	pkt->ip6hdr.saddr = ip6_src;
+++	pkt->ip6hdr.daddr = ip6_dst;
+++
+++	csum_part = csum_partial(&pkt->echohdr, sizeof(pkt->echohdr), 0);
+++	csum = csum_ipv6_magic(&ip6_src, &ip6_dst, sizeof(pkt->echohdr),
+++			       IPPROTO_ICMPV6, csum_part);
+++	pkt->echohdr.icmp6_cksum = csum;
+++
+++	skb_reset_mac_header(skb);
+++	skb_set_network_header(skb, offsetof(struct wakeupcall_pkt, ip6hdr));
+++	skb_set_transport_header(skb, offsetof(struct wakeupcall_pkt, echohdr));
+++	skb_put(skb, sizeof(*pkt));
+++	__skb_pull(skb, sizeof(pkt->ethhdr));
+++
+++	return skb;
+++}
+++
+++void br_multicast_send_wakeupcall(struct timer_list *t)
+++{
+++	struct net_bridge_fdb_entry *fdb = from_timer(fdb, t, wakeupcall_timer);
+++	struct net_bridge_port *port = fdb->dst;
+++	struct net_bridge *br = port->br;
+++	struct sk_buff *skb, *skb0;
+++	int i;
+++
+++	skb0 = br_multicast_alloc_wakeupcall(br, port, fdb->key.addr.addr);
+++	if (!skb0)
+++		return;
+++
+++	for (i = port->wakeupcall_num_rings; i > 0; i--) {
+++		if (i > 1) {
+++			skb = skb_clone(skb0, GFP_ATOMIC);
+++			if (!skb) {
+++				kfree_skb(skb0);
+++				break;
+++			}
+++		} else {
+++			skb = skb0;
+++		}
+++
+++		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,
+++			dev_net(port->dev), NULL, skb, NULL, skb->dev,
+++			br_dev_queue_push_xmit);
+++	}
+++}
+++
+++static void
+++br_multicast_schedule_wakeupcalls(struct net_bridge_mcast *brmctx,
+++				  struct net_bridge_mcast_port *pmctx,
+++				  const struct in6_addr *group)
+++{
+++	struct net_bridge_fdb_entry *fdb;
+++	unsigned long delay;
+++
+++	rcu_read_lock();
+++	hlist_for_each_entry_rcu(fdb, &brmctx->br->fdb_list, fdb_node) {
+++		if (!fdb->dst || fdb->dst->dev != pmctx->port->dev)
+++			continue;
+++
+++		/* Wake-up calls to VLANs unsupported for now */
+++		if (fdb->key.vlan_id)
+++			continue;
+++
+++		/* Spread the ICMPv6 Echo Requests to avoid congestion.
+++		 * We then won't use a max response delay for the queries later,
+++		 * as that would be redundant. Spread randomly by a little less
+++		 * than max response delay to anticipate the extra round trip.
+++		 */
+++		delay =	ipv6_addr_any(group) ?
+++				brmctx->multicast_query_response_interval :
+++				brmctx->multicast_last_member_interval;
+++		delay = get_random_u32_below(3 * delay / 4);
+++
+++		timer_reduce(&fdb->wakeupcall_timer, jiffies + delay);
+++	}
+++	rcu_read_unlock();
+++}
+++#endif /* CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS */
+++
++ static void __br_multicast_send_query(struct net_bridge_mcast *brmctx,
++ 				      struct net_bridge_mcast_port *pmctx,
++ 				      struct net_bridge_port_group *pg,
++@@ -1809,6 +1977,13 @@ static void __br_multicast_send_query(struct net_bridge_mcast *brmctx,
++ 			dev_net(pmctx->port->dev), NULL, skb, NULL, skb->dev,
++ 			br_dev_queue_push_xmit);
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++		if (pmctx->port->wakeupcall_num_rings &&
+++		    group->proto == htons(ETH_P_IPV6))
+++			br_multicast_schedule_wakeupcalls(brmctx, pmctx,
+++							  &group->dst.ip6);
+++#endif
+++
++ 		if (over_lmqt && with_srcs && sflag) {
++ 			over_lmqt = false;
++ 			goto again_under_lmqt;
++@@ -3976,6 +4151,99 @@ int br_multicast_rcv(struct net_bridge_mcast **brmctx,
++ 	return ret;
++ }
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++
+++static bool br_multicast_wakeupcall_check(struct net_bridge *br,
+++					  struct net_bridge_port *port,
+++					  struct sk_buff *skb, u16 vid)
+++{
+++	struct ethhdr *eth = eth_hdr(skb);
+++	const struct ipv6hdr *ip6h;
+++	unsigned int offset, len;
+++	struct icmp6hdr *icmp6h;
+++
+++	/* Wake-up calls to VLANs unsupported for now */
+++	if (!port->wakeupcall_num_rings || vid ||
+++	    eth->h_proto != htons(ETH_P_IPV6))
+++		return false;
+++
+++	if (!ether_addr_equal(eth->h_dest, br->dev->dev_addr) ||
+++	    is_multicast_ether_addr(eth->h_source) ||
+++	    is_zero_ether_addr(eth->h_source))
+++		return false;
+++
+++	offset = skb_network_offset(skb) + sizeof(*ip6h);
+++	if (!pskb_may_pull(skb, offset))
+++		return false;
+++
+++	ip6h = ipv6_hdr(skb);
+++
+++	if (ip6h->version != 6)
+++		return false;
+++
+++	len = offset + ntohs(ip6h->payload_len);
+++	if (skb->len < len || len <= offset)
+++		return false;
+++
+++	if (ip6h->nexthdr != IPPROTO_ICMPV6)
+++		return false;
+++
+++	skb_set_transport_header(skb, offset);
+++
+++	if (ipv6_mc_check_icmpv6(skb) < 0)
+++		return false;
+++
+++	icmp6h = (struct icmp6hdr *)skb_transport_header(skb);
+++	if (icmp6h->icmp6_type != ICMPV6_ECHO_REPLY ||
+++	    icmp6h->icmp6_dataun.u_echo.identifier != BR_MC_WAKEUP_ID)
+++		return false;
+++
+++	return true;
+++}
+++
+++static void br_multicast_wakeupcall_send_mldq(struct net_bridge_mcast *brmctx,
+++					      struct net_bridge_mcast_port *pmctx,
+++					      const u8 *eth_dst)
+++{
+++	const struct in6_addr group = BR_MC_IN6_ZERO;
+++	struct in6_addr ip6_dst;
+++	struct sk_buff *skb;
+++	u8 igmp_type;
+++
+++	/* we might have been triggered by multicast-address-specific query
+++	 * but reply with a general MLD query for now to keep things simple
+++	 */
+++	ipv6_addr_set(&ip6_dst, htonl(0xff020000), 0, 0, htonl(1));
+++
+++	skb = br_ip6_multicast_alloc_query(brmctx, pmctx, NULL, &ip6_dst,
+++					   &group, false, false, false,
+++					   &igmp_type, NULL, false);
+++	if (!skb)
+++		return;
+++
+++	skb->dev = pmctx->port->dev;
+++	ether_addr_copy(eth_hdr(skb)->h_dest, eth_dst);
+++
+++	br_multicast_count(brmctx->br, pmctx->port, skb, igmp_type,
+++			   BR_MCAST_DIR_TX);
+++	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT,
+++		dev_net(pmctx->port->dev), NULL, skb, NULL, skb->dev,
+++		br_dev_queue_push_xmit);
+++}
+++
+++void br_multicast_wakeupcall_rcv(struct net_bridge_mcast *brmctx,
+++				 struct net_bridge_mcast_port *pmctx,
+++				 struct sk_buff *skb, u16 vid)
+++{
+++	if (!br_multicast_wakeupcall_check(brmctx->br, pmctx->port, skb, vid))
+++		return;
+++
+++	br_multicast_wakeupcall_send_mldq(brmctx, pmctx,
+++					  eth_hdr(skb)->h_source);
+++}
+++
+++#endif /* CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS */
+++
++ static void br_multicast_query_expired(struct net_bridge_mcast *brmctx,
++ 				       struct bridge_mcast_own_query *query,
++ 				       struct bridge_mcast_querier *querier)
++@@ -4504,6 +4772,15 @@ int br_multicast_set_vlan_router(struct net_bridge_vlan *v, u8 mcast_router)
++ 	return err;
++ }
++ 
+++int br_multicast_set_wakeupcall(struct net_bridge_port *p, unsigned long val)
+++{
+++	if (val > U8_MAX)
+++		return -EINVAL;
+++
+++	p->wakeupcall_num_rings = val;
+++	return 0;
+++}
+++
++ static void br_multicast_start_querier(struct net_bridge_mcast *brmctx,
++ 				       struct bridge_mcast_own_query *query)
++ {
++diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
++index a760d5a5ad12..8fdabad8e10a 100644
++--- a/net/bridge/br_netlink.c
+++++ b/net/bridge/br_netlink.c
++@@ -206,6 +206,9 @@ static inline size_t br_port_info_size(void)
++ 		+ nla_total_size(sizeof(u8))	/* IFLA_BRPORT_MULTICAST_ROUTER */
++ 		+ nla_total_size(sizeof(u32))	/* IFLA_BRPORT_MCAST_N_GROUPS */
++ 		+ nla_total_size(sizeof(u32))	/* IFLA_BRPORT_MCAST_MAX_GROUPS */
+++#endif
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++		+ nla_total_size(sizeof(u8))	/* IFLA_BRPORT_MCAST_WAKEUPCALL */
++ #endif
++ 		+ nla_total_size(sizeof(u16))	/* IFLA_BRPORT_GROUP_FWD_MASK */
++ 		+ nla_total_size(sizeof(u8))	/* IFLA_BRPORT_MRP_RING_OPEN */
++@@ -313,6 +316,11 @@ static int br_port_fill_attrs(struct sk_buff *skb,
++ 			br_multicast_ngroups_get_max(&p->multicast_ctx)))
++ 		return -EMSGSIZE;
++ #endif
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	if (nla_put_u8(skb, IFLA_BRPORT_MCAST_WAKEUPCALL,
+++		       p->wakeupcall_num_rings))
+++		return -EMSGSIZE;
+++#endif
++ 
++ 	/* we might be called only with br->lock */
++ 	rcu_read_lock();
++@@ -890,6 +898,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = {
++ 	[IFLA_BRPORT_PROXYARP_WIFI] = { .type = NLA_U8 },
++ 	[IFLA_BRPORT_MULTICAST_ROUTER] = { .type = NLA_U8 },
++ 	[IFLA_BRPORT_MCAST_TO_UCAST] = { .type = NLA_U8 },
+++	[IFLA_BRPORT_MCAST_WAKEUPCALL] = { .type = NLA_U8 },
++ 	[IFLA_BRPORT_MCAST_FLOOD] = { .type = NLA_U8 },
++ 	[IFLA_BRPORT_BCAST_FLOOD] = { .type = NLA_U8 },
++ 	[IFLA_BRPORT_VLAN_TUNNEL] = { .type = NLA_U8 },
++@@ -1051,6 +1060,16 @@ static int br_setport(struct net_bridge_port *p, struct nlattr *tb[],
++ 	}
++ #endif
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	if (tb[IFLA_BRPORT_MCAST_WAKEUPCALL]) {
+++		u8 wakeupcall = nla_get_u8(tb[IFLA_BRPORT_MCAST_WAKEUPCALL]);
+++
+++		err = br_multicast_set_wakeupcall(p, wakeupcall);
+++		if (err)
+++			return err;
+++	}
+++#endif
+++
++ 	if (tb[IFLA_BRPORT_GROUP_FWD_MASK]) {
++ 		u16 fwd_mask = nla_get_u16(tb[IFLA_BRPORT_GROUP_FWD_MASK]);
++ 
++diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
++index 72d80fd943a8..b237c39edd35 100644
++--- a/net/bridge/br_private.h
+++++ b/net/bridge/br_private.h
++@@ -294,6 +294,10 @@ struct net_bridge_fdb_entry {
++ 	unsigned long			used;
++ 
++ 	struct rcu_head			rcu;
+++
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	struct timer_list		wakeupcall_timer;
+++#endif
++ };
++ 
++ struct net_bridge_fdb_flush_desc {
++@@ -417,6 +421,7 @@ struct net_bridge_port {
++ 	u32				multicast_eht_hosts_limit;
++ 	u32				multicast_eht_hosts_cnt;
++ 	struct hlist_head		mglist;
+++	u8				wakeupcall_num_rings;
++ #endif
++ 
++ #ifdef CONFIG_SYSFS
++@@ -1504,6 +1509,21 @@ br_multicast_ctx_options_equal(const struct net_bridge_mcast *brmctx1,
++ }
++ #endif
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++void br_multicast_wakeupcall_rcv(struct net_bridge_mcast *brmctx,
+++				 struct net_bridge_mcast_port *pmctx,
+++				 struct sk_buff *skb, u16 vid);
+++void br_multicast_send_wakeupcall(struct timer_list *t);
+++int br_multicast_set_wakeupcall(struct net_bridge_port *p, unsigned long val);
+++#else
+++static inline void
+++br_multicast_wakeupcall_rcv(struct net_bridge_mcast *brmctx,
+++			    struct net_bridge_mcast_port *pmctx,
+++			    struct sk_buff *skb, u16 vid)
+++{
+++}
+++#endif /* CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS */
+++
++ /* br_vlan.c */
++ #ifdef CONFIG_BRIDGE_VLAN_FILTERING
++ bool br_allowed_ingress(const struct net_bridge *br,
++diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
++index aee7c5902206..15ee27e1aa72 100644
++--- a/net/bridge/br_sysfs_if.c
+++++ b/net/bridge/br_sysfs_if.c
++@@ -260,6 +260,21 @@ BRPORT_ATTR_FLAG(multicast_fast_leave, BR_MULTICAST_FAST_LEAVE);
++ BRPORT_ATTR_FLAG(multicast_to_unicast, BR_MULTICAST_TO_UNICAST);
++ #endif
++ 
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++static ssize_t show_multicast_wakeupcall(struct net_bridge_port *p, char *buf)
+++{
+++	return sprintf(buf, "%d\n", p->wakeupcall_num_rings);
+++}
+++
+++static int store_multicast_wakeupcall(struct net_bridge_port *p,
+++				      unsigned long v)
+++{
+++	return br_multicast_set_wakeupcall(p, v);
+++}
+++static BRPORT_ATTR(multicast_wakeupcall, 0644, show_multicast_wakeupcall,
+++		   store_multicast_wakeupcall);
+++#endif
+++
++ static const struct brport_attribute *brport_attrs[] = {
++ 	&brport_attr_path_cost,
++ 	&brport_attr_priority,
++@@ -285,6 +300,9 @@ static const struct brport_attribute *brport_attrs[] = {
++ 	&brport_attr_multicast_router,
++ 	&brport_attr_multicast_fast_leave,
++ 	&brport_attr_multicast_to_unicast,
+++#endif
+++#ifdef CONFIG_BRIDGE_IGMP_SNOOPING_WAKEUPCALLS
+++	&brport_attr_multicast_wakeupcall,
++ #endif
++ 	&brport_attr_proxyarp,
++ 	&brport_attr_proxyarp_wifi,
++diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
++index 71797d44af4c..abe17f8c4939 100644
++--- a/net/core/rtnetlink.c
+++++ b/net/core/rtnetlink.c
++@@ -61,7 +61,7 @@
++ #include "dev.h"
++ 
++ #define RTNL_MAX_TYPE		50
++-#define RTNL_SLAVE_MAX_TYPE	45
+++#define RTNL_SLAVE_MAX_TYPE	46
++ 
++ struct rtnl_link {
++ 	rtnl_doit_func		doit;
++diff --git a/net/ipv6/mcast_snoop.c b/net/ipv6/mcast_snoop.c
++index 04d5fcdfa6e0..9a5061edbaf3 100644
++--- a/net/ipv6/mcast_snoop.c
+++++ b/net/ipv6/mcast_snoop.c
++@@ -131,7 +131,7 @@ static inline __sum16 ipv6_mc_validate_checksum(struct sk_buff *skb)
++ 	return skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo);
++ }
++ 
++-static int ipv6_mc_check_icmpv6(struct sk_buff *skb)
+++int ipv6_mc_check_icmpv6(struct sk_buff *skb)
++ {
++ 	unsigned int len = skb_transport_offset(skb) + sizeof(struct icmp6hdr);
++ 	unsigned int transport_len = ipv6_transport_len(skb);
++@@ -150,6 +150,7 @@ static int ipv6_mc_check_icmpv6(struct sk_buff *skb)
++ 
++ 	return 0;
++ }
+++EXPORT_SYMBOL(ipv6_mc_check_icmpv6);
++ 
++ /**
++  * ipv6_mc_check_mld - checks whether this is a sane MLD packet
++-- 
++2.45.2
++

patches/openwrt/0006-generic-vxlan-backport-support-for-VXLAN-over-link-local-IPv6-to-4.9.patch

-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Tue, 9 Jan 2018 22:38:19 +0100
-Subject: generic: vxlan: backport support for VXLAN over link-local IPv6 to 4.9
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/target/linux/generic/backport-4.9/095-0001-vxlan-improve-validation-of-address-family-configura.patch b/target/linux/generic/backport-4.9/095-0001-vxlan-improve-validation-of-address-family-configura.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..2114562536675cd59450928f591e70d66f8fc7b9
---- /dev/null
-+++ b/target/linux/generic/backport-4.9/095-0001-vxlan-improve-validation-of-address-family-configura.patch
-@@ -0,0 +1,73 @@
-+From f45ba82cd83d27b5d44d3dc417e0e480ba0d3703 Mon Sep 17 00:00:00 2001
-+Message-Id: <f45ba82cd83d27b5d44d3dc417e0e480ba0d3703.1515533863.git.mschiffer@universe-factory.net>
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Mon, 19 Jun 2017 10:03:57 +0200
-+Subject: [PATCH 1/4] vxlan: improve validation of address family configuration
-+
-+Address families of source and destination addresses must match, and
-+changelink operations can't change the address family.
-+
-+In addition, always use the VXLAN_F_IPV6 to check if a VXLAN device uses
-+IPv4 or IPv6.
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+Signed-off-by: David S. Miller <davem@davemloft.net>
-+[Matthias Schiffer: rebase to v4.9.y]
-+---
-+ drivers/net/vxlan.c | 23 +++++++++++++++--------
-+ 1 file changed, 15 insertions(+), 8 deletions(-)
-+
-+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-+index 983e941bdf29..fbe8da7fa296 100644
-+--- a/drivers/net/vxlan.c
-++++ b/drivers/net/vxlan.c
-+@@ -2867,12 +2867,20 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
-+ 
-+ 	memcpy(&dst->remote_ip, &conf->remote_ip, sizeof(conf->remote_ip));
-+ 
-+-	/* Unless IPv6 is explicitly requested, assume IPv4 */
-+-	if (!dst->remote_ip.sa.sa_family)
-++	if (!dst->remote_ip.sa.sa_family && !conf->saddr.sa.sa_family) {
-++		/* Unless IPv6 is explicitly requested, assume IPv4 */
-+ 		dst->remote_ip.sa.sa_family = AF_INET;
-++		conf->saddr.sa.sa_family = AF_INET;
-++	} else if (!dst->remote_ip.sa.sa_family) {
-++		dst->remote_ip.sa.sa_family = conf->saddr.sa.sa_family;
-++	} else if (!conf->saddr.sa.sa_family) {
-++		conf->saddr.sa.sa_family = dst->remote_ip.sa.sa_family;
-++	}
-++
-++	if (conf->saddr.sa.sa_family != dst->remote_ip.sa.sa_family)
-++		return -EINVAL;
-+ 
-+-	if (dst->remote_ip.sa.sa_family == AF_INET6 ||
-+-	    vxlan->cfg.saddr.sa.sa_family == AF_INET6) {
-++	if (conf->saddr.sa.sa_family == AF_INET6) {
-+ 		if (!IS_ENABLED(CONFIG_IPV6))
-+ 			return -EPFNOSUPPORT;
-+ 		use_ipv6 = true;
-+@@ -2938,11 +2946,9 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
-+ 
-+ 	list_for_each_entry(tmp, &vn->vxlan_list, next) {
-+ 		if (tmp->cfg.vni == conf->vni &&
-+-		    (tmp->default_dst.remote_ip.sa.sa_family == AF_INET6 ||
-+-		     tmp->cfg.saddr.sa.sa_family == AF_INET6) == use_ipv6 &&
-+ 		    tmp->cfg.dst_port == vxlan->cfg.dst_port &&
-+-		    (tmp->flags & VXLAN_F_RCV_FLAGS) ==
-+-		    (vxlan->flags & VXLAN_F_RCV_FLAGS)) {
-++		    (tmp->flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6)) ==
-++		    (vxlan->flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6))) {
-+ 			pr_info("duplicate VNI %u\n", be32_to_cpu(conf->vni));
-+ 			return -EEXIST;
-+ 		}
-+@@ -2987,6 +2993,7 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
-+ 
-+ 	if (data[IFLA_VXLAN_GROUP]) {
-+ 		conf.remote_ip.sin.sin_addr.s_addr = nla_get_in_addr(data[IFLA_VXLAN_GROUP]);
-++		conf.remote_ip.sa.sa_family = AF_INET;
-+ 	} else if (data[IFLA_VXLAN_GROUP6]) {
-+ 		if (!IS_ENABLED(CONFIG_IPV6))
-+ 			return -EPFNOSUPPORT;
-+-- 
-+2.15.1
-+
-diff --git a/target/linux/generic/backport-4.9/095-0002-vxlan-check-valid-combinations-of-address-scopes.patch b/target/linux/generic/backport-4.9/095-0002-vxlan-check-valid-combinations-of-address-scopes.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..b38b9977bca192eafe9a0d9b8c36a120b3a2c590
---- /dev/null
-+++ b/target/linux/generic/backport-4.9/095-0002-vxlan-check-valid-combinations-of-address-scopes.patch
-@@ -0,0 +1,91 @@
-+From 0eb4ccfc77e07fb4bfc7b1778a7ecb136b47aba4 Mon Sep 17 00:00:00 2001
-+Message-Id: <0eb4ccfc77e07fb4bfc7b1778a7ecb136b47aba4.1515533863.git.mschiffer@universe-factory.net>
-+In-Reply-To: <f45ba82cd83d27b5d44d3dc417e0e480ba0d3703.1515533863.git.mschiffer@universe-factory.net>
-+References: <f45ba82cd83d27b5d44d3dc417e0e480ba0d3703.1515533863.git.mschiffer@universe-factory.net>
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Mon, 19 Jun 2017 10:03:58 +0200
-+Subject: [PATCH 2/4] vxlan: check valid combinations of address scopes
-+
-+* Multicast addresses are never valid as local address
-+* Link-local IPv6 unicast addresses may only be used as remote when the
-+  local address is link-local as well
-+* Don't allow link-local IPv6 local/remote addresses without interface
-+
-+We also store in the flags field if link-local addresses are used for the
-+follow-up patches that actually make VXLAN over link-local IPv6 work.
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+Signed-off-by: David S. Miller <davem@davemloft.net>
-+[Matthias Schiffer: rebase to v4.9.y]
-+---
-+ drivers/net/vxlan.c | 29 +++++++++++++++++++++++++++++
-+ include/net/vxlan.h |  1 +
-+ 2 files changed, 30 insertions(+)
-+
-+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-+index fbe8da7fa296..863d9528b900 100644
-+--- a/drivers/net/vxlan.c
-++++ b/drivers/net/vxlan.c
-+@@ -2880,11 +2880,35 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
-+ 	if (conf->saddr.sa.sa_family != dst->remote_ip.sa.sa_family)
-+ 		return -EINVAL;
-+ 
-++	if (vxlan_addr_multicast(&conf->saddr))
-++		return -EINVAL;
-++
-+ 	if (conf->saddr.sa.sa_family == AF_INET6) {
-+ 		if (!IS_ENABLED(CONFIG_IPV6))
-+ 			return -EPFNOSUPPORT;
-+ 		use_ipv6 = true;
-+ 		vxlan->flags |= VXLAN_F_IPV6;
-++
-++		if (!(conf->flags & VXLAN_F_COLLECT_METADATA)) {
-++			int local_type =
-++				ipv6_addr_type(&conf->saddr.sin6.sin6_addr);
-++			int remote_type =
-++				ipv6_addr_type(&dst->remote_ip.sin6.sin6_addr);
-++
-++			if (local_type & IPV6_ADDR_LINKLOCAL) {
-++				if (!(remote_type & IPV6_ADDR_LINKLOCAL) &&
-++				    (remote_type != IPV6_ADDR_ANY))
-++					return -EINVAL;
-++
-++				vxlan->flags |= VXLAN_F_IPV6_LINKLOCAL;
-++			} else {
-++				if (remote_type ==
-++				    (IPV6_ADDR_UNICAST | IPV6_ADDR_LINKLOCAL))
-++					return -EINVAL;
-++
-++				vxlan->flags &= ~VXLAN_F_IPV6_LINKLOCAL;
-++			}
-++		}
-+ 	}
-+ 
-+ 	if (conf->label && !use_ipv6) {
-+@@ -2918,6 +2942,11 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
-+ 	} else if (vxlan_addr_multicast(&dst->remote_ip)) {
-+ 		pr_info("multicast destination requires interface to be specified\n");
-+ 		return -EINVAL;
-++	} else {
-++#if IS_ENABLED(CONFIG_IPV6)
-++		if (vxlan->flags & VXLAN_F_IPV6_LINKLOCAL)
-++			return -EINVAL;
-++#endif
-+ 	}
-+ 
-+ 	if (conf->mtu) {
-+diff --git a/include/net/vxlan.h b/include/net/vxlan.h
-+index 9fce47e3e13e..c1c0d03e3456 100644
-+--- a/include/net/vxlan.h
-++++ b/include/net/vxlan.h
-+@@ -267,6 +267,7 @@ struct vxlan_dev {
-+ #define VXLAN_F_REMCSUM_NOPARTIAL	0x1000
-+ #define VXLAN_F_COLLECT_METADATA	0x2000
-+ #define VXLAN_F_GPE			0x4000
-++#define VXLAN_F_IPV6_LINKLOCAL		0x8000
-+ 
-+ /* Flags that are used in the receive path. These flags must match in
-+  * order for a socket to be shareable
-+-- 
-+2.15.1
-+
-diff --git a/target/linux/generic/backport-4.9/095-0003-vxlan-fix-snooping-for-link-local-IPv6-addresses.patch b/target/linux/generic/backport-4.9/095-0003-vxlan-fix-snooping-for-link-local-IPv6-addresses.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..dcfd1ce7c2f015354d21a65f12f6ebd00331b629
---- /dev/null
-+++ b/target/linux/generic/backport-4.9/095-0003-vxlan-fix-snooping-for-link-local-IPv6-addresses.patch
-@@ -0,0 +1,93 @@
-+From 010b2b541d958e12d78ba1c79734c700f169610b Mon Sep 17 00:00:00 2001
-+Message-Id: <010b2b541d958e12d78ba1c79734c700f169610b.1515533863.git.mschiffer@universe-factory.net>
-+In-Reply-To: <f45ba82cd83d27b5d44d3dc417e0e480ba0d3703.1515533863.git.mschiffer@universe-factory.net>
-+References: <f45ba82cd83d27b5d44d3dc417e0e480ba0d3703.1515533863.git.mschiffer@universe-factory.net>
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Mon, 19 Jun 2017 10:03:59 +0200
-+Subject: [PATCH 3/4] vxlan: fix snooping for link-local IPv6 addresses
-+
-+If VXLAN is run over link-local IPv6 addresses, it is necessary to store
-+the ifindex in the FDB entries. Otherwise, the used interface is undefined
-+and unicast communication will most likely fail.
-+
-+Support for link-local IPv4 addresses should be possible as well, but as
-+the semantics aren't as well defined as for IPv6, and there doesn't seem to
-+be much interest in having the support, it's not implemented for now.
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+Signed-off-by: David S. Miller <davem@davemloft.net>
-+[Matthias Schiffer: rebase to v4.9.y]
-+---
-+ drivers/net/vxlan.c | 20 +++++++++++++++-----
-+ 1 file changed, 15 insertions(+), 5 deletions(-)
-+
-+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-+index 863d9528b900..c28c6f34b3b3 100644
-+--- a/drivers/net/vxlan.c
-++++ b/drivers/net/vxlan.c
-+@@ -917,16 +917,25 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
-+  * Return true if packet is bogus and should be dropped.
-+  */
-+ static bool vxlan_snoop(struct net_device *dev,
-+-			union vxlan_addr *src_ip, const u8 *src_mac)
-++			union vxlan_addr *src_ip, const u8 *src_mac,
-++			u32 src_ifindex)
-+ {
-+ 	struct vxlan_dev *vxlan = netdev_priv(dev);
-+ 	struct vxlan_fdb *f;
-++	u32 ifindex = 0;
-++
-++#if IS_ENABLED(CONFIG_IPV6)
-++	if (src_ip->sa.sa_family == AF_INET6 &&
-++	    (ipv6_addr_type(&src_ip->sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL))
-++		ifindex = src_ifindex;
-++#endif
-+ 
-+ 	f = vxlan_find_mac(vxlan, src_mac);
-+ 	if (likely(f)) {
-+ 		struct vxlan_rdst *rdst = first_remote_rcu(f);
-+ 
-+-		if (likely(vxlan_addr_equal(&rdst->remote_ip, src_ip)))
-++		if (likely(vxlan_addr_equal(&rdst->remote_ip, src_ip) &&
-++			   rdst->remote_ifindex == ifindex))
-+ 			return false;
-+ 
-+ 		/* Don't migrate static entries, drop packets */
-+@@ -952,7 +961,7 @@ static bool vxlan_snoop(struct net_device *dev,
-+ 					 NLM_F_EXCL|NLM_F_CREATE,
-+ 					 vxlan->cfg.dst_port,
-+ 					 vxlan->default_dst.remote_vni,
-+-					 0, NTF_SELF);
-++					 ifindex, NTF_SELF);
-+ 		spin_unlock(&vxlan->hash_lock);
-+ 	}
-+ 
-+@@ -1223,6 +1232,7 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan,
-+ 			  struct sk_buff *skb)
-+ {
-+ 	union vxlan_addr saddr;
-++	u32 ifindex = skb->dev->ifindex;
-+ 
-+ 	skb_reset_mac_header(skb);
-+ 	skb->protocol = eth_type_trans(skb, vxlan->dev);
-+@@ -1244,7 +1254,7 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan,
-+ 	}
-+ 
-+ 	if ((vxlan->flags & VXLAN_F_LEARN) &&
-+-	    vxlan_snoop(skb->dev, &saddr, eth_hdr(skb)->h_source))
-++	    vxlan_snoop(skb->dev, &saddr, eth_hdr(skb)->h_source, ifindex))
-+ 		return false;
-+ 
-+ 	return true;
-+@@ -1932,7 +1942,7 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
-+ 	}
-+ 
-+ 	if (dst_vxlan->flags & VXLAN_F_LEARN)
-+-		vxlan_snoop(skb->dev, &loopback, eth_hdr(skb)->h_source);
-++		vxlan_snoop(skb->dev, &loopback, eth_hdr(skb)->h_source, 0);
-+ 
-+ 	u64_stats_update_begin(&tx_stats->syncp);
-+ 	tx_stats->tx_packets++;
-+-- 
-+2.15.1
-+
-diff --git a/target/linux/generic/backport-4.9/095-0004-vxlan-allow-multiple-VXLANs-with-same-VNI-for-IPv6-l.patch b/target/linux/generic/backport-4.9/095-0004-vxlan-allow-multiple-VXLANs-with-same-VNI-for-IPv6-l.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..18ae230a3b04d2b57184109fa14f9533f0fb7192
---- /dev/null
-+++ b/target/linux/generic/backport-4.9/095-0004-vxlan-allow-multiple-VXLANs-with-same-VNI-for-IPv6-l.patch
-@@ -0,0 +1,182 @@
-+From 95583c75a95449dade713e1dad4ed0a8dcc1b391 Mon Sep 17 00:00:00 2001
-+Message-Id: <95583c75a95449dade713e1dad4ed0a8dcc1b391.1515533863.git.mschiffer@universe-factory.net>
-+In-Reply-To: <f45ba82cd83d27b5d44d3dc417e0e480ba0d3703.1515533863.git.mschiffer@universe-factory.net>
-+References: <f45ba82cd83d27b5d44d3dc417e0e480ba0d3703.1515533863.git.mschiffer@universe-factory.net>
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Mon, 19 Jun 2017 10:04:00 +0200
-+Subject: [PATCH 4/4] vxlan: allow multiple VXLANs with same VNI for IPv6
-+ link-local addresses
-+
-+As link-local addresses are only valid for a single interface, we can allow
-+to use the same VNI for multiple independent VXLANs, as long as the used
-+interfaces are distinct. This way, VXLANs can always be used as a drop-in
-+replacement for VLANs with greater ID space.
-+
-+This also extends VNI lookup to respect the ifindex when link-local IPv6
-+addresses are used, so using the same VNI on multiple interfaces can
-+actually work.
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+Signed-off-by: David S. Miller <davem@davemloft.net>
-+[Matthias Schiffer: rebase to v4.9.y]
-+---
-+ drivers/net/vxlan.c | 60 ++++++++++++++++++++++++++++++++++++-----------------
-+ 1 file changed, 41 insertions(+), 19 deletions(-)
-+
-+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-+index c28c6f34b3b3..9208e3d9ec43 100644
-+--- a/drivers/net/vxlan.c
-++++ b/drivers/net/vxlan.c
-+@@ -225,7 +225,8 @@ static struct vxlan_sock *vxlan_find_sock(struct net *net, sa_family_t family,
-+ 	return NULL;
-+ }
-+ 
-+-static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, __be32 vni)
-++static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, int ifindex,
-++					   __be32 vni)
-+ {
-+ 	struct vxlan_dev_node *node;
-+ 
-+@@ -234,17 +235,27 @@ static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, __be32 vni)
-+ 		vni = 0;
-+ 
-+ 	hlist_for_each_entry_rcu(node, vni_head(vs, vni), hlist) {
-+-		if (node->vxlan->default_dst.remote_vni == vni)
-+-			return node->vxlan;
-++		if (node->vxlan->default_dst.remote_vni != vni)
-++			continue;
-++
-++		if (IS_ENABLED(CONFIG_IPV6)) {
-++			const struct vxlan_config *cfg = &node->vxlan->cfg;
-++
-++			if ((node->vxlan->flags & VXLAN_F_IPV6_LINKLOCAL) &&
-++			    cfg->remote_ifindex != ifindex)
-++				continue;
-++		}
-++
-++		return node->vxlan;
-+ 	}
-+ 
-+ 	return NULL;
-+ }
-+ 
-+ /* Look up VNI in a per net namespace table */
-+-static struct vxlan_dev *vxlan_find_vni(struct net *net, __be32 vni,
-+-					sa_family_t family, __be16 port,
-+-					u32 flags)
-++static struct vxlan_dev *vxlan_find_vni(struct net *net, int ifindex,
-++				        __be32 vni, sa_family_t family,
-++					__be16 port, u32 flags)
-+ {
-+ 	struct vxlan_sock *vs;
-+ 
-+@@ -252,7 +263,7 @@ static struct vxlan_dev *vxlan_find_vni(struct net *net, __be32 vni,
-+ 	if (!vs)
-+ 		return NULL;
-+ 
-+-	return vxlan_vs_find_vni(vs, vni);
-++	return vxlan_vs_find_vni(vs, ifindex, vni);
-+ }
-+ 
-+ /* Fill in neighbour message in skbuff. */
-+@@ -1317,7 +1328,8 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
-+ 	if (!vs)
-+ 		goto drop;
-+ 
-+-	vxlan = vxlan_vs_find_vni(vs, vxlan_vni(vxlan_hdr(skb)->vx_vni));
-++	vxlan = vxlan_vs_find_vni(vs, skb->dev->ifindex,
-++                                  vxlan_vni(vxlan_hdr(skb)->vx_vni));
-+ 	if (!vxlan)
-+ 		goto drop;
-+ 
-+@@ -1976,6 +1988,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
-+ 	__be32 vni, label;
-+ 	__be16 df = 0;
-+ 	__u8 tos, ttl;
-++	int ifindex;
-+ 	int err;
-+ 	u32 flags = vxlan->flags;
-+ 	bool udp_sum = false;
-+@@ -1987,6 +2000,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
-+ 	if (rdst) {
-+ 		dst_port = rdst->remote_port ? rdst->remote_port : vxlan->cfg.dst_port;
-+ 		vni = rdst->remote_vni;
-++		ifindex = rdst->remote_ifindex;
-+ 		dst = &rdst->remote_ip;
-+ 		local_ip = vxlan->cfg.saddr;
-+ 		dst_cache = &rdst->dst_cache;
-+@@ -1998,6 +2012,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
-+ 		}
-+ 		dst_port = info->key.tp_dst ? : vxlan->cfg.dst_port;
-+ 		vni = tunnel_id_to_key32(info->key.tun_id);
-++		ifindex = 0;
-+ 		remote_ip.sa.sa_family = ip_tunnel_info_af(info);
-+ 		if (remote_ip.sa.sa_family == AF_INET) {
-+ 			remote_ip.sin.sin_addr.s_addr = info->key.u.ipv4.dst;
-+@@ -2053,7 +2068,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
-+ 		sk = sock4->sock->sk;
-+ 
-+ 		rt = vxlan_get_route(vxlan, skb,
-+-				     rdst ? rdst->remote_ifindex : 0, tos,
-++				     ifindex, tos,
-+ 				     dst->sin.sin_addr.s_addr,
-+ 				     &local_ip.sin.sin_addr.s_addr,
-+ 				     dst_cache, info);
-+@@ -2077,7 +2092,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
-+ 			struct vxlan_dev *dst_vxlan;
-+ 
-+ 			ip_rt_put(rt);
-+-			dst_vxlan = vxlan_find_vni(vxlan->net, vni,
-++			dst_vxlan = vxlan_find_vni(vxlan->net, ifindex, vni,
-+ 						   dst->sa.sa_family, dst_port,
-+ 						   vxlan->flags);
-+ 			if (!dst_vxlan)
-+@@ -2112,7 +2127,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
-+ 		sk = sock6->sock->sk;
-+ 
-+ 		ndst = vxlan6_get_route(vxlan, skb,
-+-					rdst ? rdst->remote_ifindex : 0, tos,
-++					ifindex, tos,
-+ 					label, &dst->sin6.sin6_addr,
-+ 					&local_ip.sin6.sin6_addr,
-+ 					dst_cache, info);
-+@@ -2138,7 +2153,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
-+ 			struct vxlan_dev *dst_vxlan;
-+ 
-+ 			dst_release(ndst);
-+-			dst_vxlan = vxlan_find_vni(vxlan->net, vni,
-++			dst_vxlan = vxlan_find_vni(vxlan->net, ifindex, vni,
-+ 						   dst->sa.sa_family, dst_port,
-+ 						   vxlan->flags);
-+ 			if (!dst_vxlan)
-+@@ -2984,13 +2999,20 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
-+ 		vxlan->cfg.age_interval = FDB_AGE_DEFAULT;
-+ 
-+ 	list_for_each_entry(tmp, &vn->vxlan_list, next) {
-+-		if (tmp->cfg.vni == conf->vni &&
-+-		    tmp->cfg.dst_port == vxlan->cfg.dst_port &&
-+-		    (tmp->flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6)) ==
-+-		    (vxlan->flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6))) {
-+-			pr_info("duplicate VNI %u\n", be32_to_cpu(conf->vni));
-+-			return -EEXIST;
-+-		}
-++		if (tmp->cfg.vni != conf->vni)
-++			continue;
-++		if (tmp->cfg.dst_port != vxlan->cfg.dst_port)
-++			continue;
-++		if ((tmp->flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6)) !=
-++		    (vxlan->flags & (VXLAN_F_RCV_FLAGS | VXLAN_F_IPV6)))
-++			continue;
-++
-++		if ((vxlan->flags & VXLAN_F_IPV6_LINKLOCAL) &&
-++		    tmp->cfg.remote_ifindex != vxlan->cfg.remote_ifindex)
-++			continue;
-++
-++		pr_info("duplicate VNI %u\n", be32_to_cpu(conf->vni));
-++		return -EEXIST;
-+ 	}
-+ 
-+ 	dev->ethtool_ops = &vxlan_ethtool_ops;
-+-- 
-+2.15.1
-+

patches/openwrt/0006-mac80211-silence-warning-for-missing-rate-information.patch

+From: David Bauer <mail@david-bauer.net>
+Date: Thu, 18 Jan 2024 00:52:09 +0100
+Subject: mac80211: silence warning for missing rate information
+
+Silence warnings for missing rate information.
+
+These warnings do not provide value. Instead, they might rotate more
+crucial information out of the kernel message ringbuffer.
+
+Link: https://github.com/freifunk-gluon/gluon/issues/3160
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+
+diff --git a/package/kernel/mac80211/patches/subsys/999-silence-missing-rate.patch b/package/kernel/mac80211/patches/subsys/999-silence-missing-rate.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..a34455f78960ded59b60d3d9600823b39fc7b7a2
+--- /dev/null
++++ b/package/kernel/mac80211/patches/subsys/999-silence-missing-rate.patch
+@@ -0,0 +1,11 @@
++--- a/net/mac80211/mesh_hwmp.c
+++++ b/net/mac80211/mesh_hwmp.c
++@@ -350,7 +350,7 @@ u32 airtime_link_metric_get(struct ieee8
++ 			return MAX_METRIC;
++ 
++ 		rate = ewma_mesh_tx_rate_avg_read(&sta->mesh->tx_rate_avg);
++-		if (WARN_ON(!rate))
+++		if (!rate)
++ 			return MAX_METRIC;
++ 
++ 		err = (fail_avg << ARITH_SHIFT) / 100;

patches/openwrt/0007-kernel-ebtables-add-support-for-ICMP-IGMP-type-matches.patch

-From: Matthias Schiffer <mschiffer@universe-factory.net>
-Date: Thu, 12 Apr 2018 07:50:02 +0200
-Subject: kernel: ebtables: add support for ICMP/IGMP type matches
-
-Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-
-diff --git a/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch b/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..9e4d90fb3b8e2c91e4adf0e0efdb3f4575b5027d
---- /dev/null
-+++ b/target/linux/generic/backport-4.14/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch
-@@ -0,0 +1,141 @@
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Sat, 3 Mar 2018 11:55:21 +0100
-+Subject: [PATCH 1/2] ebtables: add support for matching ICMP type and code
-+
-+We already have ICMPv6 type/code matches. This adds support for IPv4 ICMP
-+matches in the same way.
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+---
-+ include/uapi/linux/netfilter_bridge/ebt_ip.h | 13 +++++++--
-+ net/bridge/netfilter/ebt_ip.c                | 43 +++++++++++++++++++++-------
-+ 2 files changed, 43 insertions(+), 13 deletions(-)
-+
-+diff --git a/include/uapi/linux/netfilter_bridge/ebt_ip.h b/include/uapi/linux/netfilter_bridge/ebt_ip.h
-+index 8e462fb1983f..4ed7fbb0a482 100644
-+--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h
-++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h
-+@@ -24,8 +24,9 @@
-+ #define EBT_IP_PROTO 0x08
-+ #define EBT_IP_SPORT 0x10
-+ #define EBT_IP_DPORT 0x20
-++#define EBT_IP_ICMP 0x40
-+ #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
-+- EBT_IP_SPORT | EBT_IP_DPORT )
-++		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)
-+ #define EBT_IP_MATCH "ip"
-+ 
-+ /* the same values are used for the invflags */
-+@@ -38,8 +39,14 @@ struct ebt_ip_info {
-+ 	__u8  protocol;
-+ 	__u8  bitmask;
-+ 	__u8  invflags;
-+-	__u16 sport[2];
-+-	__u16 dport[2];
-++	union {
-++		__u16 sport[2];
-++		__u8 icmp_type[2];
-++	};
-++	union {
-++		__u16 dport[2];
-++		__u8 icmp_code[2];
-++	};
-+ };
-+ 
-+ #endif
-+diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
-+index 2b46c50abce0..8cb8f8395768 100644
-+--- a/net/bridge/netfilter/ebt_ip.c
-++++ b/net/bridge/netfilter/ebt_ip.c
-+@@ -19,9 +19,15 @@
-+ #include <linux/netfilter_bridge/ebtables.h>
-+ #include <linux/netfilter_bridge/ebt_ip.h>
-+ 
-+-struct tcpudphdr {
-+-	__be16 src;
-+-	__be16 dst;
-++union pkthdr {
-++	struct {
-++		__be16 src;
-++		__be16 dst;
-++	} tcpudphdr;
-++	struct {
-++		u8 type;
-++		u8 code;
-++	} icmphdr;
-+ };
-+ 
-+ static bool
-+@@ -30,8 +36,8 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+ 	const struct ebt_ip_info *info = par->matchinfo;
-+ 	const struct iphdr *ih;
-+ 	struct iphdr _iph;
-+-	const struct tcpudphdr *pptr;
-+-	struct tcpudphdr _ports;
-++	const union pkthdr *pptr;
-++	union pkthdr _pkthdr;
-+ 
-+ 	ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
-+ 	if (ih == NULL)
-+@@ -50,29 +56,38 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+ 	if (info->bitmask & EBT_IP_PROTO) {
-+ 		if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
-+ 			return false;
-+-		if (!(info->bitmask & EBT_IP_DPORT) &&
-+-		    !(info->bitmask & EBT_IP_SPORT))
-++		if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT |
-++				       EBT_IP_ICMP)))
-+ 			return true;
-+ 		if (ntohs(ih->frag_off) & IP_OFFSET)
-+ 			return false;
-++
-++		/* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */
-+ 		pptr = skb_header_pointer(skb, ih->ihl*4,
-+-					  sizeof(_ports), &_ports);
-++					  sizeof(_pkthdr), &_pkthdr);
-+ 		if (pptr == NULL)
-+ 			return false;
-+ 		if (info->bitmask & EBT_IP_DPORT) {
-+-			u32 dst = ntohs(pptr->dst);
-++			u32 dst = ntohs(pptr->tcpudphdr.dst);
-+ 			if (NF_INVF(info, EBT_IP_DPORT,
-+ 				    dst < info->dport[0] ||
-+ 				    dst > info->dport[1]))
-+ 				return false;
-+ 		}
-+ 		if (info->bitmask & EBT_IP_SPORT) {
-+-			u32 src = ntohs(pptr->src);
-++			u32 src = ntohs(pptr->tcpudphdr.src);
-+ 			if (NF_INVF(info, EBT_IP_SPORT,
-+ 				    src < info->sport[0] ||
-+ 				    src > info->sport[1]))
-+ 				return false;
-+ 		}
-++		if ((info->bitmask & EBT_IP_ICMP) &&
-++		    NF_INVF(info, EBT_IP_ICMP,
-++			    pptr->icmphdr.type < info->icmp_type[0] ||
-++			    pptr->icmphdr.type > info->icmp_type[1] ||
-++			    pptr->icmphdr.code < info->icmp_code[0] ||
-++			    pptr->icmphdr.code > info->icmp_code[1]))
-++			return false;
-+ 	}
-+ 	return true;
-+ }
-+@@ -101,6 +116,14 @@ static int ebt_ip_mt_check(const struct xt_mtchk_param *par)
-+ 		return -EINVAL;
-+ 	if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
-+ 		return -EINVAL;
-++	if (info->bitmask & EBT_IP_ICMP) {
-++		if ((info->invflags & EBT_IP_PROTO) ||
-++		    info->protocol != IPPROTO_ICMP)
-++			return -EINVAL;
-++		if (info->icmp_type[0] > info->icmp_type[1] ||
-++		    info->icmp_code[0] > info->icmp_code[1])
-++			return -EINVAL;
-++	}
-+ 	return 0;
-+ }
-+ 
-+-- 
-+2.16.2
-+
-diff --git a/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch b/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..35b93adc802c2850cd6ee218c3d7d6f6c53bba29
---- /dev/null
-+++ b/target/linux/generic/backport-4.14/096-0002-ebtables-add-support-for-matching-IGMP-type.patch
-@@ -0,0 +1,95 @@
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Sat, 3 Mar 2018 12:02:21 +0100
-+Subject: [PATCH 2/2] ebtables: add support for matching IGMP type
-+
-+We already have ICMPv6 type/code matches (which can be used to distinguish
-+different types of MLD packets). Add support for IPv4 IGMP matches in the
-+same way.
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+---
-+ include/uapi/linux/netfilter_bridge/ebt_ip.h |  4 +++-
-+ net/bridge/netfilter/ebt_ip.c                | 19 +++++++++++++++++--
-+ 2 files changed, 20 insertions(+), 3 deletions(-)
-+
-+diff --git a/include/uapi/linux/netfilter_bridge/ebt_ip.h b/include/uapi/linux/netfilter_bridge/ebt_ip.h
-+index 4ed7fbb0a482..46d6261370b0 100644
-+--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h
-++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h
-+@@ -25,8 +25,9 @@
-+ #define EBT_IP_SPORT 0x10
-+ #define EBT_IP_DPORT 0x20
-+ #define EBT_IP_ICMP 0x40
-++#define EBT_IP_IGMP 0x80
-+ #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
-+-		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)
-++		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP | EBT_IP_IGMP)
-+ #define EBT_IP_MATCH "ip"
-+ 
-+ /* the same values are used for the invflags */
-+@@ -42,6 +43,7 @@ struct ebt_ip_info {
-+ 	union {
-+ 		__u16 sport[2];
-+ 		__u8 icmp_type[2];
-++		__u8 igmp_type[2];
-+ 	};
-+ 	union {
-+ 		__u16 dport[2];
-+diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
-+index 8cb8f8395768..ffaa8ce2e724 100644
-+--- a/net/bridge/netfilter/ebt_ip.c
-++++ b/net/bridge/netfilter/ebt_ip.c
-+@@ -28,6 +28,9 @@ union pkthdr {
-+ 		u8 type;
-+ 		u8 code;
-+ 	} icmphdr;
-++	struct {
-++		u8 type;
-++	} igmphdr;
-+ };
-+ 
-+ static bool
-+@@ -57,12 +60,12 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+ 		if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
-+ 			return false;
-+ 		if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT |
-+-				       EBT_IP_ICMP)))
-++				       EBT_IP_ICMP | EBT_IP_IGMP)))
-+ 			return true;
-+ 		if (ntohs(ih->frag_off) & IP_OFFSET)
-+ 			return false;
-+ 
-+-		/* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */
-++		/* min icmp/igmp headersize is 4, so sizeof(_pkthdr) is ok. */
-+ 		pptr = skb_header_pointer(skb, ih->ihl*4,
-+ 					  sizeof(_pkthdr), &_pkthdr);
-+ 		if (pptr == NULL)
-+@@ -88,6 +91,11 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+ 			    pptr->icmphdr.code < info->icmp_code[0] ||
-+ 			    pptr->icmphdr.code > info->icmp_code[1]))
-+ 			return false;
-++		if ((info->bitmask & EBT_IP_IGMP) &&
-++		    NF_INVF(info, EBT_IP_IGMP,
-++			    pptr->igmphdr.type < info->igmp_type[0] ||
-++			    pptr->igmphdr.type > info->igmp_type[1]))
-++			return false;
-+ 	}
-+ 	return true;
-+ }
-+@@ -124,6 +132,13 @@ static int ebt_ip_mt_check(const struct xt_mtchk_param *par)
-+ 		    info->icmp_code[0] > info->icmp_code[1])
-+ 			return -EINVAL;
-+ 	}
-++	if (info->bitmask & EBT_IP_IGMP) {
-++		if ((info->invflags & EBT_IP_PROTO) ||
-++		    info->protocol != IPPROTO_IGMP)
-++			return -EINVAL;
-++		if (info->igmp_type[0] > info->igmp_type[1])
-++			return -EINVAL;
-++	}
-+ 	return 0;
-+ }
-+ 
-+-- 
-+2.16.2
-+
-diff --git a/target/linux/generic/backport-4.9/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch b/target/linux/generic/backport-4.9/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..db82fd6b69b3c4e279f39db7ca4b415498457e75
---- /dev/null
-+++ b/target/linux/generic/backport-4.9/096-0001-ebtables-add-support-for-matching-ICMP-type-and-code.patch
-@@ -0,0 +1,141 @@
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Sat, 3 Mar 2018 11:55:21 +0100
-+Subject: [PATCH 1/2] ebtables: add support for matching ICMP type and code
-+
-+We already have ICMPv6 type/code matches. This adds support for IPv4 ICMP
-+matches in the same way.
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+---
-+ include/uapi/linux/netfilter_bridge/ebt_ip.h | 13 +++++++--
-+ net/bridge/netfilter/ebt_ip.c                | 43 +++++++++++++++++++++-------
-+ 2 files changed, 43 insertions(+), 13 deletions(-)
-+
-+diff --git a/include/uapi/linux/netfilter_bridge/ebt_ip.h b/include/uapi/linux/netfilter_bridge/ebt_ip.h
-+index c4bbc41b0ea4..63a2860ae1e3 100644
-+--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h
-++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h
-+@@ -23,8 +23,9 @@
-+ #define EBT_IP_PROTO 0x08
-+ #define EBT_IP_SPORT 0x10
-+ #define EBT_IP_DPORT 0x20
-++#define EBT_IP_ICMP 0x40
-+ #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
-+- EBT_IP_SPORT | EBT_IP_DPORT )
-++		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)
-+ #define EBT_IP_MATCH "ip"
-+ 
-+ /* the same values are used for the invflags */
-+@@ -37,8 +38,14 @@ struct ebt_ip_info {
-+ 	__u8  protocol;
-+ 	__u8  bitmask;
-+ 	__u8  invflags;
-+-	__u16 sport[2];
-+-	__u16 dport[2];
-++	union {
-++		__u16 sport[2];
-++		__u8 icmp_type[2];
-++	};
-++	union {
-++		__u16 dport[2];
-++		__u8 icmp_code[2];
-++	};
-+ };
-+ 
-+ #endif
-+diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
-+index d06968bdf5ec..e4fc77072b27 100644
-+--- a/net/bridge/netfilter/ebt_ip.c
-++++ b/net/bridge/netfilter/ebt_ip.c
-+@@ -19,9 +19,15 @@
-+ #include <linux/netfilter_bridge/ebtables.h>
-+ #include <linux/netfilter_bridge/ebt_ip.h>
-+ 
-+-struct tcpudphdr {
-+-	__be16 src;
-+-	__be16 dst;
-++union pkthdr {
-++	struct {
-++		__be16 src;
-++		__be16 dst;
-++	} tcpudphdr;
-++	struct {
-++		u8 type;
-++		u8 code;
-++	} icmphdr;
-+ };
-+ 
-+ static bool
-+@@ -30,8 +36,8 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+ 	const struct ebt_ip_info *info = par->matchinfo;
-+ 	const struct iphdr *ih;
-+ 	struct iphdr _iph;
-+-	const struct tcpudphdr *pptr;
-+-	struct tcpudphdr _ports;
-++	const union pkthdr *pptr;
-++	union pkthdr _pkthdr;
-+ 
-+ 	ih = skb_header_pointer(skb, 0, sizeof(_iph), &_iph);
-+ 	if (ih == NULL)
-+@@ -50,29 +56,38 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+ 	if (info->bitmask & EBT_IP_PROTO) {
-+ 		if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
-+ 			return false;
-+-		if (!(info->bitmask & EBT_IP_DPORT) &&
-+-		    !(info->bitmask & EBT_IP_SPORT))
-++		if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT |
-++				       EBT_IP_ICMP)))
-+ 			return true;
-+ 		if (ntohs(ih->frag_off) & IP_OFFSET)
-+ 			return false;
-++
-++		/* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */
-+ 		pptr = skb_header_pointer(skb, ih->ihl*4,
-+-					  sizeof(_ports), &_ports);
-++					  sizeof(_pkthdr), &_pkthdr);
-+ 		if (pptr == NULL)
-+ 			return false;
-+ 		if (info->bitmask & EBT_IP_DPORT) {
-+-			u32 dst = ntohs(pptr->dst);
-++			u32 dst = ntohs(pptr->tcpudphdr.dst);
-+ 			if (NF_INVF(info, EBT_IP_DPORT,
-+ 				    dst < info->dport[0] ||
-+ 				    dst > info->dport[1]))
-+ 			return false;
-+ 		}
-+ 		if (info->bitmask & EBT_IP_SPORT) {
-+-			u32 src = ntohs(pptr->src);
-++			u32 src = ntohs(pptr->tcpudphdr.src);
-+ 			if (NF_INVF(info, EBT_IP_SPORT,
-+ 				    src < info->sport[0] ||
-+ 				    src > info->sport[1]))
-+ 			return false;
-+ 		}
-++		if ((info->bitmask & EBT_IP_ICMP) &&
-++		    NF_INVF(info, EBT_IP_ICMP,
-++			    pptr->icmphdr.type < info->icmp_type[0] ||
-++			    pptr->icmphdr.type > info->icmp_type[1] ||
-++			    pptr->icmphdr.code < info->icmp_code[0] ||
-++			    pptr->icmphdr.code > info->icmp_code[1]))
-++			return false;
-+ 	}
-+ 	return true;
-+ }
-+@@ -101,6 +116,14 @@ static int ebt_ip_mt_check(const struct xt_mtchk_param *par)
-+ 		return -EINVAL;
-+ 	if (info->bitmask & EBT_IP_SPORT && info->sport[0] > info->sport[1])
-+ 		return -EINVAL;
-++	if (info->bitmask & EBT_IP_ICMP) {
-++		if ((info->invflags & EBT_IP_PROTO) ||
-++		    info->protocol != IPPROTO_ICMP)
-++			return -EINVAL;
-++		if (info->icmp_type[0] > info->icmp_type[1] ||
-++		    info->icmp_code[0] > info->icmp_code[1])
-++			return -EINVAL;
-++	}
-+ 	return 0;
-+ }
-+ 
-+-- 
-+2.16.2
-+
-diff --git a/target/linux/generic/backport-4.9/096-0002-ebtables-add-support-for-matching-IGMP-type.patch b/target/linux/generic/backport-4.9/096-0002-ebtables-add-support-for-matching-IGMP-type.patch
-new file mode 100644
-index 0000000000000000000000000000000000000000..5750b612fc0f322e0a257f3229b5b698328b428b
---- /dev/null
-+++ b/target/linux/generic/backport-4.9/096-0002-ebtables-add-support-for-matching-IGMP-type.patch
-@@ -0,0 +1,95 @@
-+From: Matthias Schiffer <mschiffer@universe-factory.net>
-+Date: Sat, 3 Mar 2018 12:02:21 +0100
-+Subject: [PATCH 2/2] ebtables: add support for matching IGMP type
-+
-+We already have ICMPv6 type/code matches (which can be used to distinguish
-+different types of MLD packets). Add support for IPv4 IGMP matches in the
-+same way.
-+
-+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
-+---
-+ include/uapi/linux/netfilter_bridge/ebt_ip.h |  4 +++-
-+ net/bridge/netfilter/ebt_ip.c                | 19 +++++++++++++++++--
-+ 2 files changed, 20 insertions(+), 3 deletions(-)
-+
-+diff --git a/include/uapi/linux/netfilter_bridge/ebt_ip.h b/include/uapi/linux/netfilter_bridge/ebt_ip.h
-+index 63a2860ae1e3..ae5d4d108418 100644
-+--- a/include/uapi/linux/netfilter_bridge/ebt_ip.h
-++++ b/include/uapi/linux/netfilter_bridge/ebt_ip.h
-+@@ -24,8 +24,9 @@
-+ #define EBT_IP_SPORT 0x10
-+ #define EBT_IP_DPORT 0x20
-+ #define EBT_IP_ICMP 0x40
-++#define EBT_IP_IGMP 0x80
-+ #define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
-+-		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP)
-++		     EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP | EBT_IP_IGMP)
-+ #define EBT_IP_MATCH "ip"
-+ 
-+ /* the same values are used for the invflags */
-+@@ -41,6 +42,7 @@ struct ebt_ip_info {
-+ 	union {
-+ 		__u16 sport[2];
-+ 		__u8 icmp_type[2];
-++		__u8 igmp_type[2];
-+ 	};
-+ 	union {
-+ 		__u16 dport[2];
-+diff --git a/net/bridge/netfilter/ebt_ip.c b/net/bridge/netfilter/ebt_ip.c
-+index e4fc77072b27..57fbb13cb8e0 100644
-+--- a/net/bridge/netfilter/ebt_ip.c
-++++ b/net/bridge/netfilter/ebt_ip.c
-+@@ -28,6 +28,9 @@ union pkthdr {
-+ 		u8 type;
-+ 		u8 code;
-+ 	} icmphdr;
-++	struct {
-++		u8 type;
-++	} igmphdr;
-+ };
-+ 
-+ static bool
-+@@ -57,12 +60,12 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+ 		if (NF_INVF(info, EBT_IP_PROTO, info->protocol != ih->protocol))
-+ 			return false;
-+ 		if (!(info->bitmask & (EBT_IP_DPORT | EBT_IP_SPORT |
-+-				       EBT_IP_ICMP)))
-++				       EBT_IP_ICMP | EBT_IP_IGMP)))
-+ 			return true;
-+ 		if (ntohs(ih->frag_off) & IP_OFFSET)
-+ 			return false;
-+ 
-+-		/* min icmp headersize is 4, so sizeof(_pkthdr) is ok. */
-++		/* min icmp/igmp headersize is 4, so sizeof(_pkthdr) is ok. */
-+ 		pptr = skb_header_pointer(skb, ih->ihl*4,
-+ 					  sizeof(_pkthdr), &_pkthdr);
-+ 		if (pptr == NULL)
-+@@ -88,6 +91,11 @@ ebt_ip_mt(const struct sk_buff *skb, struct xt_action_param *par)
-+ 			    pptr->icmphdr.code < info->icmp_code[0] ||
-+ 			    pptr->icmphdr.code > info->icmp_code[1]))
-+ 			return false;
-++		if ((info->bitmask & EBT_IP_IGMP) &&
-++		    NF_INVF(info, EBT_IP_IGMP,
-++			    pptr->igmphdr.type < info->igmp_type[0] ||
-++			    pptr->igmphdr.type > info->igmp_type[1]))
-++			return false;
-+ 	}
-+ 	return true;
-+ }
-+@@ -124,6 +132,13 @@ static int ebt_ip_mt_check(const struct xt_mtchk_param *par)
-+ 		    info->icmp_code[0] > info->icmp_code[1])
-+ 			return -EINVAL;
-+ 	}
-++	if (info->bitmask & EBT_IP_IGMP) {
-++		if ((info->invflags & EBT_IP_PROTO) ||
-++		    info->protocol != IPPROTO_IGMP)
-++			return -EINVAL;
-++		if (info->igmp_type[0] > info->igmp_type[1])
-++			return -EINVAL;
-++	}
-+ 	return 0;
-+ }
-+ 
-+-- 
-+2.16.2
-+

patches/openwrt/0007-net-mac80211-override-incompatible-basic-rates-for-mesh.patch

+From: David Bauer <mail@david-bauer.net>
+Date: Mon, 6 Jan 2025 08:30:35 +0100
+Subject: net: mac80211: override incompatible basic-rates for mesh
+
+This is a dirty hack for Gluon.
+
+We assume basic rate setup only affects the rate-controller on the TX
+side. As all devices we support have at least a 802.11n radio and thus
+cover 802.11b as well as 802.11g on 2.4 GHz, they are compatible with
+each other.
+
+As the basic rate was incorrectly set for mesh interfaces in the past,
+connections between mesh neighbors would fail when altering the basic
+rate.
+
+This patch ignores mismatches in the basic-rate field. By doing so, we
+avoid implementing some sort of scheduled switch between wireless
+configurations.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+
+diff --git a/package/kernel/mac80211/patches/subsys/995-net-mac80211-override-incompatible-basic-rates-for-m.patch b/package/kernel/mac80211/patches/subsys/995-net-mac80211-override-incompatible-basic-rates-for-m.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..efcf0b4f041bb21184e9cd997bc6caca4729a1fe
+--- /dev/null
++++ b/package/kernel/mac80211/patches/subsys/995-net-mac80211-override-incompatible-basic-rates-for-m.patch
+@@ -0,0 +1,37 @@
++From 091e1eea9e34db7cbf84379021fcbff82887e09a Mon Sep 17 00:00:00 2001
++From: David Bauer <mail@david-bauer.net>
++Date: Mon, 6 Jan 2025 08:23:54 +0100
++Subject: [PATCH] net: mac80211: override incompatible basic-rates for mesh
++
++This is a dirty hack for Gluon.
++
++We assume basic rate setup only affects the rate-controller on the TX
++side. As all devices we support have at least a 802.11n radio and thus
++cover 802.11b as well as 802.11g on 2.4 GHz, they are compatible with
++each other.
++
++As the basic rate was incorrectly set for mesh interfaces in the past,
++connections between mesh neighbors would fail when altering the basic
++rate.
++
++This patch ignores mismatches in the basic-rate field. By doing so, we
++avoid implementing some sort of scheduled switch between wireless
++configurations.
++
++Signed-off-by: David Bauer <mail@david-bauer.net>
++---
++ net/mac80211/mesh.c | 7 +++++--
++ 1 file changed, 5 insertions(+), 2 deletions(-)
++
++--- a/net/mac80211/mesh.c
+++++ b/net/mac80211/mesh.c
++@@ -94,9 +94,6 @@ bool mesh_matches_local(struct ieee80211
++ 	ieee80211_sta_get_rates(sdata, ie, sband->band,
++ 				&basic_rates);
++ 
++-	if (sdata->vif.bss_conf.basic_rates != basic_rates)
++-		return false;
++-
++ 	cfg80211_chandef_create(&sta_chan_def, sdata->vif.bss_conf.chanreq.oper.chan,
++ 				NL80211_CHAN_NO_HT);
++ 	ieee80211_chandef_ht_oper(ie->ht_operation, &sta_chan_def);

patches/openwrt/0008-net-mac80211-force-backwards-compatible-basic-rates.patch

+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 7 Jan 2025 00:49:41 +0100
+Subject: net: mac80211: force backwards compatible basic rates
+
+Force backwards-compatible basic-rates on the mesh interface.
+This is required to maintain backwards-compatible with older
+Gluon releases.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+
+diff --git a/package/kernel/mac80211/patches/subsys/996-net-mac80211-always-pretend-1-Mbit-s-as-mesh-basic-r.patch b/package/kernel/mac80211/patches/subsys/996-net-mac80211-always-pretend-1-Mbit-s-as-mesh-basic-r.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..6af899c754dcc58df8e262c2db9be0bd9c347e5e
+--- /dev/null
++++ b/package/kernel/mac80211/patches/subsys/996-net-mac80211-always-pretend-1-Mbit-s-as-mesh-basic-r.patch
+@@ -0,0 +1,66 @@
++From 70c1812fa170ee35cdc576c886bed4bfaae1d23c Mon Sep 17 00:00:00 2001
++From: David Bauer <mail@david-bauer.net>
++Date: Tue, 7 Jan 2025 00:47:33 +0100
++Subject: [PATCH] net: mac80211: force backwards compatible basic rates
++
++Force backwards-compatible basic-rates on the mesh interface.
++This is required to maintain backwards-compatible with older
++Gluon releases.
++
++Signed-off-by: David Bauer <mail@david-bauer.net>
++---
++ net/mac80211/util.c | 4 ++--
++ 1 file changed, 2 insertions(+), 2 deletions(-)
++
++--- a/net/mac80211/mesh.c
+++++ b/net/mac80211/mesh.c
++@@ -954,6 +954,7 @@ ieee80211_mesh_build_beacon(struct ieee8
++ 	struct ieee80211_sub_if_data *sdata;
++ 	int hdr_len = offsetofend(struct ieee80211_mgmt, u.beacon);
++ 	u32 rate_flags;
+++	u32 br_bitfield;
++ 
++ 	sdata = container_of(ifmsh, struct ieee80211_sub_if_data, u.mesh);
++ 
++@@ -1086,8 +1087,16 @@ ieee80211_mesh_build_beacon(struct ieee8
++ 	}
++ 	rcu_read_unlock();
++ 
+++	if (sband->band == NL80211_BAND_2GHZ) {
+++		br_bitfield = BIT(0);
+++	} else if (sband->band == NL80211_BAND_5GHZ) {
+++		br_bitfield = BIT(0) | BIT(2) | BIT(4);
+++	} else {
+++		br_bitfield = sdata->vif.bss_conf.basic_rates;
+++	}
+++
++ 	if (ieee80211_put_srates_elem(skb, sband,
++-				      sdata->vif.bss_conf.basic_rates,
+++				      br_bitfield,
++ 				      rate_flags, 0, WLAN_EID_SUPP_RATES) ||
++ 	    mesh_add_ds_params_ie(sdata, skb))
++ 		goto out_free;
++@@ -1100,7 +1109,7 @@ ieee80211_mesh_build_beacon(struct ieee8
++ 	bcn->tail = bcn->head + bcn->head_len;
++ 
++ 	if (ieee80211_put_srates_elem(skb, sband,
++-				      sdata->vif.bss_conf.basic_rates,
+++				      br_bitfield,
++ 				      rate_flags, 0, WLAN_EID_EXT_SUPP_RATES) ||
++ 	    mesh_add_rsn_ie(sdata, skb) ||
++ 	    mesh_add_ht_cap_ie(sdata, skb) ||
++--- a/net/mac80211/mesh_plink.c
+++++ b/net/mac80211/mesh_plink.c
++@@ -284,6 +284,12 @@ static int mesh_plink_frame_tx(struct ie
++ 			ieee80211_chandef_rate_flags(&sdata->vif.bss_conf.chanreq.oper);
++ 		basic_rates = sdata->vif.bss_conf.basic_rates;
++ 
+++		if (sband->band == NL80211_BAND_2GHZ) {
+++			basic_rates = BIT(0); /* mandatory rate */
+++		} else if (sband->band == NL80211_BAND_5GHZ) {
+++			basic_rates = BIT(0) | BIT(2) | BIT(4); /* mandatory rate */
+++		}
+++
++ 		if (ieee80211_put_srates_elem(skb, sband, basic_rates,
++ 					      rate_flags, 0,
++ 					      WLAN_EID_SUPP_RATES) ||

patches/openwrt/0009-mt76-import-MT7915-recovery-fixes.patch

+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 7 Feb 2025 00:17:02 +0100
+Subject: mt76: import MT7915 recovery fixes
+
+diff --git a/package/kernel/mt76/patches/0003-mt7915-mcu-lower-default-timeout.patch b/package/kernel/mt76/patches/0003-mt7915-mcu-lower-default-timeout.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..2f55d42fbffba1d84bff3a89da3281b73f3668de
+--- /dev/null
++++ b/package/kernel/mt76/patches/0003-mt7915-mcu-lower-default-timeout.patch
+@@ -0,0 +1,32 @@
++From 74530440427abcbd20d071f00e25ab0e4c483ea2 Mon Sep 17 00:00:00 2001
++From: David Bauer <mail@david-bauer.net>
++Date: Mon, 13 Jan 2025 08:48:41 +0100
++Subject: [PATCH 3/5] mt7915: mcu: lower default timeout
++
++The default timeout set in mt76_connac2_mcu_fill_message of 20 seconds
++leads to excessive stalling in case messages are lost.
++
++Testing showed that a smaller timeout of  seconds is sufficient in
++normal operation.
++
++Signed-off-by: David Bauer <mail@david-bauer.net>
++---
++ mt7915/mcu.c | 2 ++
++ 1 file changed, 2 insertions(+)
++
++diff --git a/mt7915/mcu.c b/mt7915/mcu.c
++index 9d790f23..51b6e480 100644
++--- a/mt7915/mcu.c
+++++ b/mt7915/mcu.c
++@@ -197,6 +197,8 @@ mt7915_mcu_parse_response(struct mt76_dev *mdev, int cmd,
++ static void
++ mt7915_mcu_set_timeout(struct mt76_dev *mdev, int cmd)
++ {
+++	mdev->mcu.timeout = 5 * HZ;
+++
++ 	if ((cmd & __MCU_CMD_FIELD_ID) != MCU_CMD_EXT_CID)
++ 		return;
++ 
++-- 
++2.47.2
++
+diff --git a/package/kernel/mt76/patches/0004-mt7915-mcu-increase-command-timeout.patch b/package/kernel/mt76/patches/0004-mt7915-mcu-increase-command-timeout.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..5368dcff6623681c40c938efeed171885805e3a9
+--- /dev/null
++++ b/package/kernel/mt76/patches/0004-mt7915-mcu-increase-command-timeout.patch
+@@ -0,0 +1,32 @@
++From 094105e471472e3ea44c4094857ad8a7c6973460 Mon Sep 17 00:00:00 2001
++From: David Bauer <mail@david-bauer.net>
++Date: Mon, 13 Jan 2025 08:51:30 +0100
++Subject: [PATCH 4/5] mt7915: mcu: increase command timeout
++
++Increase the timeout for MCU_EXT_CMD_EFUSE_BUFFER_MODE command.
++
++Regular retries upon hardware-recovery have been observed. Increasing
++the timeout slightly remedies this problem.
++
++Signed-off-by: David Bauer <mail@david-bauer.net>
++---
++ mt7915/mcu.c | 3 +++
++ 1 file changed, 3 insertions(+)
++
++diff --git a/mt7915/mcu.c b/mt7915/mcu.c
++index 51b6e480..cd9cb428 100644
++--- a/mt7915/mcu.c
+++++ b/mt7915/mcu.c
++@@ -210,6 +210,9 @@ mt7915_mcu_set_timeout(struct mt76_dev *mdev, int cmd)
++ 	case MCU_EXT_CMD_BSS_INFO_UPDATE:
++ 		mdev->mcu.timeout = 2 * HZ;
++ 		return;
+++	case MCU_EXT_CMD_EFUSE_BUFFER_MODE:
+++		mdev->mcu.timeout = 10 * HZ;
+++		return;
++ 	default:
++ 		break;
++ 	}
++-- 
++2.47.2
++
+diff --git a/package/kernel/mt76/patches/0005-mt7915-mcu-re-init-MCU-before-loading-FW-patch.patch b/package/kernel/mt76/patches/0005-mt7915-mcu-re-init-MCU-before-loading-FW-patch.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..21b47b1c484edf8b29f3237fd4e02e075b368a31
+--- /dev/null
++++ b/package/kernel/mt76/patches/0005-mt7915-mcu-re-init-MCU-before-loading-FW-patch.patch
+@@ -0,0 +1,55 @@
++From 4e9e3cceea7ace91df52d795e4e45a7acb368a4c Mon Sep 17 00:00:00 2001
++From: David Bauer <mail@david-bauer.net>
++Date: Sun, 12 Jan 2025 15:30:54 +0100
++Subject: [PATCH 5/5] mt7915: mcu: re-init MCU before loading FW patch
++
++Restart the MCU and release the patch semaphore before loading the MCU
++patch firmware from the host.
++
++This fixes failures upon error recovery in case the semaphore was
++previously taken and never released by the host.
++
++Signed-off-by: David Bauer <mail@david-bauer.net>
++---
++ mt7915/mcu.c | 25 +++++++++++++++----------
++ 1 file changed, 15 insertions(+), 10 deletions(-)
++
++diff --git a/mt7915/mcu.c b/mt7915/mcu.c
++index cd9cb428..4121b980 100644
++--- a/mt7915/mcu.c
+++++ b/mt7915/mcu.c
++@@ -2097,16 +2097,21 @@ static int mt7915_load_firmware(struct mt7915_dev *dev)
++ {
++ 	int ret;
++ 
++-	/* make sure fw is download state */
++-	if (mt7915_firmware_state(dev, false)) {
++-		/* restart firmware once */
++-		mt76_connac_mcu_restart(&dev->mt76);
++-		ret = mt7915_firmware_state(dev, false);
++-		if (ret) {
++-			dev_err(dev->mt76.dev,
++-				"Firmware is not ready for download\n");
++-			return ret;
++-		}
+++	/* Release Semaphore if taken by previous failed attempt */
+++	ret = mt76_connac_mcu_patch_sem_ctrl(&dev->mt76, false);
+++	if (ret != PATCH_REL_SEM_SUCCESS) {
+++		dev_err(dev->mt76.dev, "Could not release semaphore\n");
+++		/* Continue anyways */
+++	}
+++
+++	/* Always restart MCU firmware */
+++	mt76_connac_mcu_restart(&dev->mt76);
+++
+++	/* Check if MCU is ready */
+++	ret = mt7915_firmware_state(dev, false);
+++	if (ret) {
+++		dev_err(dev->mt76.dev, "Firmware did not enter download state\n");
+++		return ret;
++ 	}
++ 
++ 	ret = mt76_connac2_load_patch(&dev->mt76, fw_name_var(dev, ROM_PATCH));
++-- 
++2.47.2
++

patches/packages/packages/0001-fastd-remove-random-delay-on-inital-handshake.patch

+From: Nico <github@nicoboehr.de>
+Date: Mon, 26 Apr 2021 14:12:43 +0000
+Subject: fastd: remove random delay on inital handshake
+
+When a peer limit is defined, fastd will by default randomly delay
+the inital handshake. As our gateways delay their handshake to
+better distribute their load, this is undesireable.
+
+diff --git a/net/fastd/patches/0100-remove-random-delay-on-inital-handshake.patch b/net/fastd/patches/0100-remove-random-delay-on-inital-handshake.patch
+new file mode 100644
+index 0000000000000000000000000000000000000000..40ca26812bda65d8b08a1034e23d1b2335c77259
+--- /dev/null
++++ b/net/fastd/patches/0100-remove-random-delay-on-inital-handshake.patch
+@@ -0,0 +1,23 @@
++--- a/src/peer.c
+++++ b/src/peer.c
++@@ -322,19 +322,11 @@ static void reset_peer(fastd_peer_t *pee
++ 
++ /**
++    Starts the first handshake with a newly setup peer
++-
++-   If a peer group has a peer limit the handshakes will be delayed between 0 and 3 seconds
++-   make the choice of peers random (it will be biased by the latency, which might or might not be
++-   what a user wants)
++ */
++ static void init_handshake(fastd_peer_t *peer) {
++-	unsigned delay = 0;
++-	if (has_group_config_constraints(peer->group))
++-		delay = fastd_rand(0, 3000);
++-
++ 	peer->state = STATE_HANDSHAKE;
++ 
++-	fastd_peer_schedule_handshake(peer, delay);
+++	fastd_peer_schedule_handshake(peer, 0);
++ }
++ 
++ /** Handles an asynchronous DNS resolve response */