realtek: 5.15: backport VLAN fix

With commit a22d359fa56fe0 VLAN handling was fixed for kernel 6.6.
This restored network connectivity of the devices. For easy testing
backport the fix for 5.15 too.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/16391
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 35e13244aab36958831195a1d2e152aa3ad0ab6c)
Signed-off-by: Goetz Goerisch <ggoerisch@gmail.com>

ath79: fix I2C pins on GL-AR750

Change I2C pin flags to GPIO_ACTIVE_HIGH and change SDA to GPIO1.

On my late production GL-AR750 (purchased 2024):
SCL = GPIO16
SDA = GPIO1

Bug report:
I2C bus doesn't work in GL-AR750
https://github.com/openwrt/openwrt/issues/16319

Signed-off-by: Ryan Salsbury <ryanrs@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16406
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 2e626ae2d2488f2d3708d3aed57eea7a1402f00e)
Signed-off-by: Ryan Salsbury <ryanrs@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16446
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

ramips: tp-link er605-v2: Remove sysupgrade-tar image

The sysupgrade-tar image build is not defined for this target, do not
add a build instruction for it. The build system will use the definition
from the dna_valokuitu-plus-ex400 board and the build will fail.

This fixes the build of the ramips target.

Fixes: 665c2154ef12 ("ramips: add basic support for tp-link er605-v2")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 746e894877e5130a7d5227cd90f90dfe18cc274b)

ucode: another fix for host installation

The previous host installation fix accidentally moved the rpath settings
out of CMAKE_HOST_OPTIONS and into CMAKE_OPTIONS.

Fixes: ae42ecaad4e7 ("ucode: fix host installation")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 2ee1392e094f9b6fdb2a759e2e29fa203b61e066)

ipq40xx: add PoE passthrough GPIO

Add the GPIO pin of the PoE passthrough switch on the Aruba AP-303H.
Power is activated when the pin is low. It enables a PSE chip, so power
is only supplied to downstream devices when they are 802.3af/at
compliant devices.

Ensure you use a sufficient power supply when chaining a consuming
device after the AP.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit b40cc46cc882ff97f2752e7837173ffc9f884eb9)

ramips: mt7621: use lzma-loader for Sercomm NA502s

This fixes a well-known "LZMA ERROR 1" error on Sercomm NA502s, reported
on the OpneWrt forum [0].

[0] https://forum.openwrt.org/t/206640

Signed-off-by: Andreas Böhler <dev@aboehler.at>
(cherry picked from commit 6d89aa29878a93c744e8c752a68bc05d41252cfc)
Link: https://github.com/openwrt/openwrt/pull/16412
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

lldpd: fix reload bug: advertisements shall default to on

Because these capability advertisements default to on in lldpd, they
became absent at reload, and not restart, due to how the reload logic
works ( keep daemon running, send unconfigured and then the new config
via socket ), and it was not evident unless you happened to be looking
for it (e.g. via pcap or tcpdump). It was also not evident from the
manpage ( have now sent patches upstream ).

At reload time, the unconfigure logic disabled them unless they were
explicitly enabled (compare with other settings where 'unconfigure' just
resets them). Now they default to on/enabled at init time, and are
explicitly 'unconfigure'd at startup if the user disables them via:

lldp_mgmt_addr_advertisements=0
lldp_capability_advertisements=0

In other words: explicit is necessary to disable the advertisements.

The same applies to 'configure system capabilities enabled'. Technically
'unconfigure'd is the default but now it is explicit at reload.

Tested on: 23.05.3

Signed-off-by: Paul Donald <newtwen+github@gmail.com>
(cherry picked from commit 708101c1412c42c7fb1d838024513a34424c50ff)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: extended interface(s) parsing to handle patterns

For interface type parameters, the man page documents patterns:
```
*,!eth*,!!eth1

uses all interfaces, except interfaces starting with "eth",
but including "eth1".
```

* Renamed `_ifname` to `_l2dev`.
* get the l2dev via network_get_physdev (and not l3dev)
* Glob pattern `*` is also valid - use noglob for this

The net result is that now interface 'names' including globs '*' and '!'
inversions are included in the generated lldpd configs.

Temporarily `set -o noglob` and then `set +o noglob` to disable & enable
globbing respectively, because when we pass `*` as an interface choice,
other file and pathnames get sucked in from where the init script runs,
and the `*` never makes it to lldpd.

Tested extensively on: 22.03.6, 23.05.3

Signed-off-by: Paul Donald <newtwen+github@gmail.com>
[ squash with commit bumping release version ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 4a81d868db85a7954a73bc6dc4a957bbd6abc813)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: make management address advertisement controllable

Defaults to off.

Available from >= 0.7.15

These are sent in TLV

Signed-off-by: Paul Donald <newtwen+github@gmail.com>
(cherry picked from commit 50021d3222667a9a239451de0422f0508aef4419)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: make capabilities advertisement controllable

Defaults to off.

Only available from >= 1.0.15

These capabilities are sent in TLV.

Signed-off-by: Paul Donald <newtwen+github@gmail.com>
(cherry picked from commit 4d8f56bd59f457fd815e2bb4f87df8c7dad2d4fd)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: note about capabilities

only available from >= 1.0.15

Comments are useful. Apparently this config parameter was committed when
openwrt used an older version of lldpd which did not yet support it.

Signed-off-by: Paul Donald <newtwen+github@gmail.com>
(cherry picked from commit b4769175029ad23833b21960d1b605f629537ad7)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: fix restart

Redirection broke in 5364fe0f01ca ("lldpd: shellcheck fixes")

redirects to /dev/null shall be handled correctly (i.e. last).

This fixes these errors on `/etc/init.d/lldpd reload`:

2024-03-16T20:39:00 [WARN/lldpctl] unknown command from argument 1: `/dev/null`
2024-03-16T20:39:00 [WARN/lldpctl] unknown command from argument 1: `/dev/null`
2024-03-16T20:39:00 [WARN/lldpctl] unknown command from argument 1: `/dev/null`
2024-03-16T20:39:00 [WARN/lldpctl] unknown command from argument 1: `/dev/null`

Tested-on: 22.03.6
Fixes: 5364fe0f01ca ("lldpd: shellcheck fixes")
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
[ improve commit description, add fixes tag ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 8cf1dce428b11740d8335d167b9c1f297d1752d0)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: update URL

update Makefile URL

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit f753d3152f81bd037e9b7abb1b8c5bf9fe54596b)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: shellcheck fixes

No functionality/behaviour changes; code is synonymous

Tested on: 22.03.6

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 5364fe0f01ca11b47c55d78f756d3176748dd0c2)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: implement lldp_policy parameter

For certain lldp_class scenarios (2 & 3) a policy must be set also.
Class 4 is default, although it's good to handle the policy eventuality.

Here, set a default lldp_policy for all lldp_class scenarios. Any
lldp_policy can now be set.

Depends on PR #14584 (which introduced an `if` block)

Tested on 22.03.5, 22.03.6

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 497fafb8aea48e764ce0e456f20ab346691e585f)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: Implement location parameter

Previously only partially implemented. After commit
5007f488bb5e1b556052ef246bd3822fed8d09d2 lldp_location was never removed

Now, add the value of lldp_location to the generated config.

The location param has a few syntaxes, so the config acquires the first
usage from the man page: 'address country EU'

Supplementary fix for PR #14193 (this param was included in the original
PR #13018 but the lldp_location fixes were absent from PR #14193).

Tested on 22.03.5, 22.03.6

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 53252eeb3b6177b77e23235436b04818a88eafe0)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: fix error "sh: XXXms: bad number"

from commit 3ce909914a12647bec52bcee0a162dd6d158a4f6

The lldpd man page says that "configure lldp tx-interval" can
specify an interval value in milliseconds by appending a "ms" suffix to
the figure. Thus mandating string handling, and not integer comparison.

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 79ee4cb0397eb9eae34369e33d66b5a1d837a652)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: refactor out ifaces derivation; reuse function

from commit 909f0630663d7ae1471c76154516e3299992a150

Now pass two params to get_config_cid_ifaces() for:

cid_interface
interface

Each of which is a CSV of interfaces.

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 228d4e7f1b759c11897043dc73ef3c576bc13f7f)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: remove unneeded quotes

from commit a5f715da713304972467612d6934130ce3aa2837

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 4dcece46a7b4ede7d05d8fb9d31d62406bca74d0)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: remove unneeded quotes and variable quoting

from commit ac771313ebedd2c4bfda8adef47650d45d77c32d

portidsubtype takes 1 of 2 possible keywords which do not need quoting:

         configure lldp portidsubtype ifname | macaddress

The third keyword 'local' is used in the syntax when individual ports
are being defined:

         configure [ports ethX [,…]] lldp portidsubtype local value

When this syntax is used, quoting is useful (see test cases for lldpd).
In the init file, the 'local' syntax is unused.

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit bd1b17d589bc622408cebdd9fa0f43386cc3ef5a)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: remove unneeded quotes and variable quoting

from commit c98ee4dbb3db0f064d990941cdd82e872da76946

agent-type takes 1 of 3 possible keywords which do not require quoting:

         configure lldp agent-type nearest-bridge | nearest-non-tpmr-bridge
         | nearest-customer-bridge

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 24a4da527f7e70d9916439a78298de2f4e4af653)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: remove unneeded quotes and variable quoting

from commit 3ce909914a12647bec52bcee0a162dd6d158a4f6

'capabilities enabled x' where x is a string of CSV

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit b039641071b1e9ee9654513ef3229bb97cc379af)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: remove unneeded quotes

from commit 3ce909914a12647bec52bcee0a162dd6d158a4f6

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 82ec853284e44fb85ad702879d18857bd566c7db)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: remove unneeded quotes and variable quoting

from commit 24176a6bdd8f26040a97960868fd0d9ee968d695

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 20a4dddeb0366a56c14f9128392ffe8d0b62e32d)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: fix a paste error
from commit 1be2088a5247b2cfabe8be991c1e52ddaf780a16

The original PR #13018 did not exhibit this.

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 4fb8fea6de363aeeeca029ed9801b85cdbf45f0c)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: spell fixes

Supplementary fix for PR #14193

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 1909b6f8835c1381f859c85394defe993e016edd)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: fix -k 'lldp_no_version' row

Supplementary fix for PR #14193 and commit
b67182008fd124706be0ec3ce67347447554ffd5

Tested on 22.03.5

Signed-off-by: Paul Donald <newtwen@gmail.com>
(cherry picked from commit 97eb3bf76c17328f80554e6a3603de00d835e4c5)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: add option to force EDP

allow EDP support if compiled and add force EDP option

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit d274867c217cade795537af93ff9b209e472e19c)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: only use snmp options when compiled in

prevent SNMP options being passed unless lldpd supports them

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 8b2d02e48cd2559a52e1cbf04143028e50da6a88)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: Update Makefile package release

increment Makefile package release to reflect changes to init script

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 1b36d44323cdd467980f83318be0837b8a1fd487)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: add option for tx delay and tx hold

add option to set LLDP transmit delay, hold timers to set update frequency

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit a5f715da713304972467612d6934130ce3aa2837)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: add option to set system platform

add option to override system platform instead of using kernel name

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 4159acceebeec646fb2ebecdd85561ba140f1ce4)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: add option to force SONMP enabled

add option to force SONMP to be enabled even when no peer detected

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 4ac134aa78d2b4441b0afd485d1d26dbd53d7276)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: add option to force FDP on

add option to force FDP when no peers detected

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 1be2088a5247b2cfabe8be991c1e52ddaf780a16)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: set CDP version and allow forcing CDP on

add option to specify CDPv1 or CDPv2 and separately enable or force each

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit b67182008fd124706be0ec3ce67347447554ffd5)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: allow disabling LLDP protcol

add option to allow LLDP disabling while using other supported protocols

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 61dbe756d8edc1adcd152920f71d6dce26232662)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: add portidsubtype option

add option portidsubtype to correct port identifiers and descriptions

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit ac771313ebedd2c4bfda8adef47650d45d77c32d)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: add agent-type option

add option to set agent-type to control propogation

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit c98ee4dbb3db0f064d990941cdd82e872da76946)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: add LLDP MED options

add option to enable LLDP MED fast-start and set fast-start timer

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 24176a6bdd8f26040a97960868fd0d9ee968d695)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: option to disable LLDP-MED inventory TLV

add option to disable LLDP-MED inventory TLV transmission

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 1753498b01d86b8d63349b01cb04026c07c343d9)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: Init adds no-version option

add option to disable advertising kernel version

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 058f284b1a802fafafb2cfde522693bd43aeaf4d)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: Allow neighbour filtering

add filter option to init script.

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit ac3ed75309e7db93bf2316eccba8106e3fe8f9fc)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: LLDPD binds to only specified interfaces

Bind to the configured system interfaces only. Switchport interfaces
are no longer ignored and uci interface values for LLDPD are honored.

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit 064b4999ad1f37f4c6ccf95a0404007b990ed0ef)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: Init config read on reload

Init script reload with trigger to detect config file update.
Reload command added to attempt non-impactful lldpd reload where
lldpcli can be used to update config without process restart.
Config hash function used to track whether process restart is needed.

Signed-off-by: Stephen Howell <howels@allthatwemight.be>
(cherry picked from commit e483c247dc75723a32d03b5b1149f7fd61ac8ac6)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

lldpd: add lldp_syscapabilities config option

allow to overwrite the detected system capabilities e.g. if devices
does not operate as bridge.

Signed-off-by: Sebastian Pflieger <sebastian@pflieger.email>
(cherry picked from commit 3ce909914a12647bec52bcee0a162dd6d158a4f6)
Link: https://github.com/openwrt/openwrt/pull/15299
Signed-off-by: Robert Marko <robimarko@gmail.com>

ucode: fix missing backslash

Fixes: ae42ecaad4e7 ("ucode: fix host installation")
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 9d663c7435752bf17ecec4bfc66c73cde55ed04c)

ncurses: Fix path in ncursesw.pc

The file contains the the /usr/lib path from the toolchain directory and
not from the target directory. The /usr/lib directory for the toolchain
is empty and the shared library is not in the specified paths. On RISCV
the linker of util-linux was finding the libncursesw.so in my host
system, tried to link against it and failed. Fix the .pc file.

Fixes: #15942
Co-authored-by: Thomas Weißschuh <thomas@t-8ch.de>
Link: https://github.com/openwrt/openwrt/pull/16018
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 91573ac145aa70a12b0984ec75507ac648569240)
Link: https://github.com/openwrt/openwrt/pull/16390
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

build: autoconf: set ac_cv_func_setresuid=true

MUSL and eglibc provide these symbols.

Bind needs setresuid() to build properly in recent versions.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Link: https://github.com/openwrt/openwrt/pull/15952
(cherry picked from commit 0bd129a5d3b298340e1f6351942a8ccc2ba6eaea)
Link: https://github.com/openwrt/openwrt/pull/16390
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

filogic: add missing 2.5G PHY LEDs configuration for Zyxel EX5700

configure 2.5G PHY LEDs to:

2500/1000: green with blink on TX/RX
100/10: green+yellow with blink on TX/RX

which is similar to other 1G PHY LEDs, which are:

1000: green with blink on TX/RX
100/10: green+yellow with blink on TX/RX

Fixes: 6cc14bf66aa ("filogic: support Telenor branded ZyXEL EX5700")
Signed-off-by: Yan Cangang <nalanzeyu@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16082
(cherry picked from commit 3de653a0af35c2d6fbc0fd14909f362c6b977e4a)
Link: https://github.com/openwrt/openwrt/pull/16390
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

mac80211: Update to version 6.1.110-1

This updates mac80211 to version 6.1.110-1. This code is based on Linux
6.1.110 and contains all fixes included in the upstream wireless
subsystem from that kernel version. This includes many bugfixes and also
some security fixes.

The removed patches are already integrated in upstream Linux 6.1.110.

The following patches were integrated in upstream Linux:
   subsys/311-v6.2-wifi-mac80211-fix-and-simplify-unencrypted-drop-chec.patch
   subsys/312-v6.3-wifi-cfg80211-move-A-MSDU-check-in-ieee80211_data_to.patch
   subsys/313-v6.3-wifi-cfg80211-factor-out-bridge-tunnel-RFC1042-heade.patch
   subsys/314-v6.3-wifi-mac80211-remove-mesh-forwarding-congestion-chec.patch
   subsys/315-v6.3-wifi-mac80211-fix-receiving-A-MSDU-frames-on-mesh-in.patch
   subsys/316-v6.3-wifi-mac80211-add-a-workaround-for-receiving-non-sta.patch
   subsys/321-mac80211-fix-mesh-forwarding.patch
   subsys/322-wifi-mac80211-fix-mesh-path-discovery-based-on-unica.patch
   subsys/329-wifi-mac80211-fix-receiving-mesh-packets-in-forwardi.patch
   subsys/339-wifi-cfg80211-fix-receving-mesh-packets-without-RFC1.patch
   subsys/350-v6.3-wifi-mac80211-Allow-NSS-change-only-up-to-capability.patch
   subsys/351-v6.9-wifi-mac80211-track-capability-opmode-NSS-separately.patch

Link: https://github.com/openwrt/openwrt/pull/16368
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

openssl: update to 3.0.15

OpenSSL 3.0.15 is a security patch release. The most severe CVE fixed in this release is Moderate.

This release incorporates the following bug fixes and mitigations:

  * Fixed possible denial of service in X.509 name checks (CVE-2024-6119)

  * Fixed possible buffer overread in SSL_select_next_proto() (CVE-2024-5535)

Added github releases url as source mirror

Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16332
(cherry picked from commit 62d3773bf19a3e2f39935c08a8b5b2186777f314)
Link: https://github.com/openwrt/openwrt/pull/16346
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

mbedtls: Update to 2.28.9

This contains a fix for:
CVE-2024-45157:
Unlike previously documented, enabling MBEDTLS_PSA_HMAC_DRBG_MD_TYPE does
not cause the PSA subsystem to use HMAC_DRBG: it uses HMAC_DRBG only when
MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG and MBEDTLS_CTR_DRBG_C are disabled.

Link: https://github.com/openwrt/openwrt/pull/16367
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

kernel: bump 5.15 to 5.15.167

Manually adapted:
   generic/backport-5.15/020-v6.1-05-mm-multi-gen-LRU-groundwork.patch
   ramips/patches-5.15/311-MIPS-use-set_mode-to-enable-disable-the-cevt-r4k-irq.patch

Link: https://github.com/openwrt/openwrt/pull/16366
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

kernel: bump 5.15 to 5.15.166

Manually adapted:
   bcm27xx/patches-5.15/950-0030-Revert-Bluetooth-Always-request-for-user-confirmatio.patch

Link: https://github.com/openwrt/openwrt/pull/16366
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

kernel: bump 5.15 to 5.15.165

Removed because they are upstream:
   generic/pending-5.15/110-v6.3-0001-spidev-Add-Silicon-Labs-EM3581-device-compatible.patch
   https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.15.y&id=bff165a3993683daddf3f00563960e7675966f91

   ipq807x/patches-5.15/0004-v5.16-arm64-dts-qcom-msm8996-Move-clock-cells-to-QMP-PHY-c.patch
   https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.15.y&id=32f0e52f16d45d743b473659329f93d4a27c68bf

Manually adapted:
   bcm27xx/patches-5.15/950-0040-spi-spidev-Completely-disable-the-spidev-warning.patch
   bcm27xx/patches-5.15/950-0578-spi-spidev-Restore-loading-from-Device-Tree.patch
   generic/pending-5.15/110-v6.3-0002-spidev-Add-Silicon-Labs-SI3210-device-compatible.patch

Adapt kernel configuration for newly added option
CONFIG_ARM64_ERRATUM_3194386.

The leddev_list_lock attribute changed from rwlock_t to spinlock_t in:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.15.y&id=590304b798a3b89e716b6b564f8ad14bc9373d93

Link: https://github.com/openwrt/openwrt/pull/16366
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

ucode: fix host installation

The path for linking libucode.so was not specified for the ucode binary.
This breaks execution of ucode in the host context.

Signed-off-by: David Bauer <david.bauer@uniberg.com>
(cherry picked from commit ae42ecaad4e7b4878083f08a2cba6ce511ac6c43)

treewide: fixup models names for UniFi U6 series

Ubiquiti has a set of UniFi 802.11ax (Wi-Fi 6) AP devices. All models
include "U6" in their names and also have code names with no special
characters (including spaces).

Examples:
1. U6 Lite (codename U6-Lite)
2. U6 Long-Range (codename U6-LR)
3. U6+ (codename U6-PLUS)
4. U6 Pro (codename U6-Pro)
5. U6 Mesh (codename U6-Mesh)
6. U6 Mesh Pro (codename U6-Mesh-Pro)
7. U6 Enterprise (codename U6-Enterprise)

Use proper full names for those devices. Names in OpenWrt/DTS code may
need updating too but it can be handled later.

Cc: Elbert Mai <code@elbertmai.com>
Cc: Daniel Golle <daniel@makrotopia.org>
Cc: Henrik Riomar <henrik.riomar@gmail.com>
Cc: David Bauer <mail@david-bauer.net>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 74879140a1aa0b8a8c237e0b67e94c3508e2e249)

ipq40xx: define config-names for Aruba boards

Aruba boards now ship with multiple DTS and image-configurations per
image. Newer apboot revs expect a configuration for their hardware to be
present.

Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit c7ba5574f52f25334add66c15190b578ac873739)

base-files: fix merge of passwd/shadow/group lines with trailing colons

Empty trailing fields get lost when the lines are split and merged again
at colons, resulting in unparsable entries. Only use the split fields for
matching against the other file, but emit the original line unchanged
to fix the issue.

Fixes: de7ca7dafadf ("base-files: merge /etc/passwd et al at sysupgrade config restore")
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit 9bbaa6f2c0419739fb85d48d0f527cb1622946ee)

tools: libtool: do not symlink files in bootstrap

Another instance of files in build_dir symlinking to staging_dir. While
the symlinks do not currently cause any bugs in the libtool package,
such symlinks were found to make the build more fragile, as writing to
the symlink may accidentally modify the shared file in staging_dir. Pass
--copy to bootstrap to disable the symlinking.

Link: https://github.com/openwrt/openwrt/pull/15825
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit d6e54593198851235906c6ab77c20c6209ab19f5)

include: autotools: do not symlink files in autoreconf

In Gluon's Github Actions CI, we were occasionally seeing bizarre build
errors that looked like a config.sub file had been corrupted, or changed
while it was being executed.

The cause turned out to be an interaction of the symlinks created by
autoreconf (pointing from individual tools' build dirs into
`staging_dir/host/share/automake-1.16`) and OpenWrt's host-build.mk,
which replaced config.guess and config.sub *after* autoreconf. The
result was that the replacement of these files ended up following the
symlinks and writing the files in `staging_dir/host/share/automake-1.16`
instead of a package's build dir. This could cause other packages' builds
to fail if they were currently executing the scripts while they were
being written.

To fix this, disable autoreconf's symlinking feature, so that modifying
these files in a package's build directory can't accidentally affect the
staged versions.

Link: https://github.com/openwrt/openwrt/pull/15825
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
(cherry picked from commit c364cb8e469f9a7de1ed8960163c90e26b2df1ad)

hostapd: fix anqp_3gpp_cell_net list delimiter

This patch fixes the list delimiter between 3GPP networks
passed to hostapd.

> list iw_anqp_3gpp_cell_net '262,001'
> list iw_anqp_3gpp_cell_net '262,002'

When passing a list of "iw_anqp_3gpp_cell_net" parameters via UCI,
hostapd would crash at startup:
> daemon.err hostapd: Line 73: Invalid anqp_3gpp_cell_net: 262,001:262,002

Using a semicolon as a delimiter, hostapd will start as expected.

Signed-off-by: Sarah Maedel <git@tbspace.de>
(cherry picked from commit 8de185a176079e738984ab0fc89841bc2e613fb1)

octeon: ubnt-edgerouter: Disable PCIe

Some devices lock up on PCIe initialization:

[   64.309697] PCIe: Port 0 in endpoint mode, skipping.
[   64.320496] PCIe: Initializing port 1
[   64.325257] PCIe: BIST FAILED for port 1 (0xffffffffffffffff)
(system hangs here)

Given the ER contains no PCIe peripherals, has no way to attach any
and the stock kernel doesn't have PCIe support either, just disable it.

(cherry picked from commit 308630aea6da1b5618d169d6ebf208aaa249ef72)
Signed-off-by: Jakob Haufe <sur5r@sur5r.net>
Link: https://github.com/openwrt/openwrt/pull/16223
Signed-off-by: Robert Marko <robimarko@gmail.com>

kernel: r8126: print link status when link up

Like other Ethernet drivers, print link speed and duplex mode
when the interface is up. Formatting output at the same time.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from 5d2a008670122f3f69eb3ab4f776d9fe9b6d76dd)

kernel: r8125: print link status when link up

Like other Ethernet drivers, print link speed and duplex mode
when the interface is up. Formatting output at the same time.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from a57a3e5cc5942b309941d19143b7097a690eb014)

kernel: r8168: print link status when link up

Like other Ethernet drivers, print link speed and duplex mode
when the interface is up. Formatting output at the same time.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from 2f846a33157e32d52c26cf06825f8eb1db13181d)

kernel: r8101: print link status when link up

Like other Ethernet drivers, print link speed and duplex mode
when the interface is up. Formatting output at the same time.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from fe0240f27e9df2d0b8c0981741360f2f87b09536)

kernel: r8126: ignore the rss rxnfc log

This log is noisy and useless, just ignore it.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from 8d9893ff34242f887f40ca271a39e4c67c87b88d)

kernel: r8125: ignore the rss rxnfc log

This log is noisy and useless, just ignore it.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
(cherry picked from 2fd0102cc3dfd81f4585e8599bf671157a4450b8)

kernel: r8126: add RSS variant

Instead of enabling RSS support, let's introduce a variant and let users
choose between both variants since it can cause network issues.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from bfeef9b3d786b76510837014648db8d6c8106989)

package: add kmod-r8126 ethernet driver

r8126 is an out of tree driver provided by Realtek for RTL8126 devices.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from 54623c6a1daeb029858aab96a58e0ee8607f738b)

kernel: r8125: add RSS variant

Instead of enabling RSS support, let's introduce a variant and let users
choose between both variants since it can cause network issues.

Signed-off-by: Milinda Brantini <C_A_T_T_E_R_Y@outlook.com>
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from f063f4620c32b1cb6f43dd249c9cdfb4ee2bd12c)

package: add kmod-r8125 ethernet driver

r8125 is an out of tree driver provided by Realtek for RTL8125 devices.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from ddb4070c96728394c22b4beb1070a26efd1c2d28)

package: add kmod-r8168 ethernet driver

r8168 is an out of tree driver provided by Realtek for RTL8168 devices.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
((cherry picked from commit 1565eeda4e670cd02e9ba90179d53ac50aa8c6d0)

package: add kmod-r8101 ethernet driver

r8101 is an out of tree driver provided by Realtek for RTL8101 devices.

Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
(cherry picked from commit b72c4b53860ef7a65f486212c7393e2c2b57344b)

mediatek: fix lan/wan macaddr for cmcc rax3000m

The MAC address assigned to lan/wan was reversed on eMMC boards.

Fixes: d3c193525e62 ("mediatek: add CMCC RAX3000M support")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/15077
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

mediatek: enable rootwait for cmcc rax3000m emmc version

Sometimes the mmc deivce may come up later than kernel attempts to
mount rootfs, resulting kernel panic. Enable rootwait to fix it.

Reported-by: Yangyu Chen <cyy@cyyself.name>
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/15077
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

mediatek: increase phy assert time for jdcloud re-cp-03

According to RTL8221B's datasheet, the PHY requires at least 10ms
for assert and 68ms (recommended) for de-assert. So increase the
assert/de-assert time to 15ms and 68ms respectively.

Fixes: c0c3234e1720 ("mediatek: add support for JDCloud RE-CP-03")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Link: https://github.com/openwrt/openwrt/pull/16106
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit d1954aa5353eca59bb76d860b09a68a01e7ec05a)

kernel: ubootenv-nvram: driver for RAM backed environments

The vendor U-Boot implementaion on Telenor branded ZyXEL EX5700
devices does not store its environment on flash. It is instead
kept in a memory region.  This is persistent over reboots, but
not over power cycling.

The dual partition failsafe system used by the vendor U-Boot
requires the OS to modify a variable in this memory environment.
This driver allows the ordinary uboot-envtools to access a
memory region like it was a partition on NOR flash.

The specific vendor U-Boot adds a "no-map" /reserved-memory
section and a top level /ubootenv node pointing to the memory
environment.  The driver uses this device specific fact to
locate the region.  The matching and probing code will likely
have to be adjusted for any other devices to be supported.

Example partial device tree:

 / {
    ..
    ubootenv {
        memory-region = <&uenv>;
        compatible = "ubootenv";
    };
    ..
    reserved-memory {
        ..
        uenv: ubootenv@7ffe8000 {
            no-map;
            reg = <0 0x7ffe8000 0 0x4000>;
        };

Signed-off-by: Bjørn Mork <bjorn@mork.no>
(cherry picked from commit b2e810f49588d1bbc90f657826e94b32474b482c)

hostapd: fix SAE H2E security vulnerability

This patch backports fixes for a security vulnerability impacting the
hostapd implementation of SAE H2E.

As upgrading hostapd would require more testing, the second mitigation
step which involves backporting several patches was adopted as outlined
in the official advisory[1].

An explanation of the impact of the vulnerability is provided from the
advisory[1]:

This vulnerability allows the attacker to downgrade the negotiated group
to another enabled group if both the AP and STA have enabled SAE H2E and
multiple groups. It should be noted that the H2E option is not enabled
by default and the attack is not applicable to the default option, i.e.,
hunting-and-pecking, since it does not have any downgrade protection for
group negotiation. In addition, the default configuration for enabled
SAE groups in hostapd is to enable only a single group, so the
vulnerability is not applicable unless hostapd has been explicitly
configured to enable more groups for SAE.

[1]: https://w1.fi/security/2024-2/sae-h2h-and-incomplete-downgrade-protection-for-group-negotiation.txt

Signed-off-by: Rany Hany <rany_hany@riseup.net>
Link: https://github.com/openwrt/openwrt/pull/16043
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit db7f70fe6140e99ae709c7bf2a25eb983cb725ed)

kernel: bump 5.15 to 5.15.164

No manual changes needed.

Link: https://github.com/openwrt/openwrt/pull/16027
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

mac80211: Update to version 6.1.102-1

Upstream removed SSB and BCMA, the drivers are now compiled against the
in kernel versions. No need to patch this for OpenWrt.

Link: https://github.com/openwrt/openwrt/pull/15983
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

ath25: eth: Fix PHY access over ar2313 driver

.ndo_do_ioctl is not called any more. For PHY MII ioctl handling, the
kernel calls .ndo_eth_ioctl now.

See upstream Linux kernel commit:
https://git.kernel.org/linus/a76053707dbf0dc020a73b4d90cd952409ef3691

Link: https://github.com/openwrt/openwrt/pull/16023
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

ipq40xx: eth: Fix PHY access over ipqess driver

.ndo_do_ioctl is not called any more. For PHY MII ioctl handling, the
kernel calls .ndo_eth_ioctl now.

See upstream Linux kernel commit:
https://git.kernel.org/linus/a76053707dbf0dc020a73b4d90cd952409ef3691

Link: https://github.com/openwrt/openwrt/pull/16005
(cherry picked from commit f0bb25aba2ded7bad98188cebe46efff4baa090f)
Link: https://github.com/openwrt/openwrt/pull/16023
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

ramips: eth: Fix PHY access over mtk_eth_soc driver

.ndo_do_ioctl is not called any more. For PHY MII ioctl handling, the
kernel calls .ndo_eth_ioctl now.

See upstream Linux kernel commit:
https://git.kernel.org/linus/a76053707dbf0dc020a73b4d90cd952409ef3691

Link: https://github.com/openwrt/openwrt/pull/16005
(cherry picked from commit dbccc9cf9161103448737785617e6ad537c7da9f)
Link: https://github.com/openwrt/openwrt/pull/16023
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

ath79: Fix PHY access over ag71xx driver

.ndo_do_ioctl is not called any more. For PHY MII ioctl handling, the
kernel calls .ndo_eth_ioctl now.

The SIOCSIFHWADDR and SIOCGIFHWADDR operation are handled in the generic
code in the same way just with more input validation.

See upstream Linux kernel commit:
https://git.kernel.org/linus/a76053707dbf0dc020a73b4d90cd952409ef3691

Reported-by: Cthulhu88 in https://forum.openwrt.org/t/ethernet-leds-control-for-tp-link-tl-wr1043nd-v2-v3/202378
Link: https://github.com/openwrt/openwrt/pull/16005
(cherry picked from commit f86273e742b9f01565018494733d38438e7f0098)
Link: https://github.com/openwrt/openwrt/pull/16023
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

ltq-ptm: Fix netdev ioctls with kernel > 5.15

.ndo_do_ioctl is not called for SIOCDEVPRIVATE any more, the kernel
calls .ndo_siocdevprivate now.

The function gets the data pointer from the callback directly, make use
of it.

See upstream Linux kernel commit:
https://git.kernel.org/linus/b9067f5dc4a07c8e24e01a1b277c6722d91be39e

Link: https://github.com/openwrt/openwrt/pull/16005
(cherry picked from commit e33ebdd00e5aedacb996fd48987067c77e43f5f4)
Link: https://github.com/openwrt/openwrt/pull/16023
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

kernel: bump 5.15 to 5.15.163

Manually adapted:
   lantiq/patches-5.15/0028-NET-lantiq-various-etop-fixes.patch

Link: https://github.com/openwrt/openwrt/pull/15982
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

mac80211: Fix wifi throughput

Backport 2 patches from upstream Linux to fix a Wifi throughput
problem.

Fixes: 323e249ce8ed ("mac80211: Update to version 6.1.97-1")
Link: https://github.com/openwrt/openwrt/pull/16007
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

OpenWrt v23.05.4: revert to branch defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

OpenWrt v23.05.4: adjust config defaults

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

build: include tests/Makefile if available

Testing OpenWrt is important, and there is a test suite in the making.
For maximum convenience and minimal CI over-usage, make it simple to run
tests locally. The main Makefile now attempts to include
`tests/Makefile` and silently fails if it doesn't.

While the test suite[1] is still young, it provides good examples of how
to test things around OpenWrt: starting with shell scripts using
`bats`[2], followed by QEMU tests, and finally real device tests using
LabGrid[3]. This could lead to the creation of the best OpenWrt version
yet.

Please consult the `openwrt-tests.git` README.md for details on the
setup. Once installed you may run commands like the following:

* make tests/shell  # run shell tests
* make tests/x86-64 # run  and test x86/64 in QEMU

[1]: http://github.com/aparcar/openwrt-tests/
[2]: https://bats-core.readthedocs.io
[3]: https://labgrid.readthedocs.io

Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/15647
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit a8ff0c1b7e5aefb8bcd31e0eeb82d2c11399223f)

wolfssl: Update to version 5.7.2

This fixes multiple security problems:
 * [Medium] CVE-2024-1544
   Potential ECDSA nonce side channel attack in versions of wolfSSL before 5.6.6 with wc_ecc_sign_hash calls.

 * [Medium] CVE-2024-5288
   A private key blinding operation, enabled by defining the macro WOLFSSL_BLIND_PRIVATE_KEY, was added to mitigate a potential row hammer attack on ECC operations.

 * [Low] When parsing a provided maliciously crafted certificate directly using wolfSSL API, outside of a TLS connection, a certificate with an excessively large number of extensions could lead to a potential DoS.

 * [Low] CVE-2024-5991
   In the function MatchDomainName(), input param str is treated as a NULL terminated string despite being user provided and unchecked.

 * [Medium] CVE-2024-5814
   A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection.

 * [Medium] OCSP stapling version 2 response verification bypass issue when a crafted response of length 0 is received.

 * [Medium] OCSP stapling version 2 revocation bypass with a retry of a TLS connection attempt.

Unset DISABLE_NLS to prevent setting the unsupported configuration
option --disable-nls which breaks the build now.

Link: https://github.com/openwrt/openwrt/pull/15948
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3a0232ffd33f2dc894c671d90de6b2766399f4dc)

mediatek: filogic: prevent faulty mac address assignment

The vendor U-Boot on the Cudy M3000 and the Yuncore AX835 assign random
mac addresses on boot and set the 'local-mac-address' property which
prevents Openwrt from assigning the correct address from evmem.

This patch removes the alias for ethernet0 so that U-Boot doesn't add the
property, removes the workaround from 02_network, and adds back the nvmem
definition for the M3000.

Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit a55ab9e1343e85021253e9c55f67adf33ad68f09)

mediatek: filogic: add support for Cudy M3000 v1

Hardware:
  SoC:     MT7981b
  RAM:     256 MB
  Flash:   128 MB SPI NAND
  Ethernet:
    1x 2.5Gbps (rtl8221b)
    1x 1Gbps (integrated phy)
  WiFi:    2x2 MT7981
  Buttons: Reset, WPS
  LED:     1x multicolor

Solder on UART:
  - remove rubber ring on the bottom
  - remove screws
  - pull up the cylinder, maybe help by push on an ethernet socket with a screwdriver
  - remove the (3) screws holding the board in the frame
  - remove the board from the frame to get to the screws for the silver, flat heat shield
  - remove the (3) screws holding the heat shield
  - solder UART pins to the back of the board
    - make sure to have the pins point out on side with the black, finned heat spread
    - the markings for the pins are going to be below the silver heat shield
    - Vcc is not needed

If you don't intend on using the UART outside of the installation process, you might not
want to solder:

  - carefully scrape off the thin layer of epoxy on the holes (not the copper)
  - place your pin header with the UART attached in the holes
  - the pins, starting with the one closest to the socket:
    - Vcc (not required)
    - GND
    - RX
    - TX
  - either wedge the header or hold it with your fingers so that the pins stay in contact with the board

Installation (UART):
  - attach an Ethernet cable to the 1Gbps port (black) on the router
  - hold the reset button while powering the router
  - press CTRL-C or wait for the timeout to get to the U-Boot prompt
  - prepare a TFTP server on the network to supply ..-initramfs-kernel.bin
  - use 'tftpboot' in the U-Boot shell to pull the image
  - boot the image using 'bootm'
  - push the ..-sysupgrade to the router using your preferred method
  - perform the upgrade with 'sysupgrade -n'

There is a recovery mechanism that involves fetching a file called 'recovery.bin' but that is not understood yet.

Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
(cherry picked from commit 20e4a18feb3f766b0f6ebec1afc154b345398a7a)

uboot-mediatek: enable rootwait for jdcloud re-cp-03

Sometimes the mmc deivce may come up later than kernel attempts to
mount rootfs, resulting kernel panic. Enable rootwait to fix it.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

uboot-mediatek: fix patch order

Make sure patch sequence number is unique by moving patch
440-add-jdcloud_re-cp-03.patch -> 441-add-jdcloud_re-cp-03.patch

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 2302a7c5ad9c894d0530b7700409b2f4ea4bcc91)

mediatek: fix lan/wan macaddr for jdcloud re-cp-03

The MAC address assigned to lan/wan was reversed.

Fixes: 6e51ff88b053 ("mediatek: add support for JDCloud RE-CP-03")
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

ath79: replace "mac-address-ascii" with "mac-base"

With upstream accepted "mac-base" binding there is no need for a
downstream "mac-address-ascii" workaround anymore.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit daaa0c1b250498acbf91697dfc75c9d3fbac3596)
Link: https://github.com/openwrt/openwrt/pull/15917

ucode: update to Git 1a8a0bcf725520820802ad433db22d8f64fbed6c (2024-07-11)

96f74b5be829 ubus: make ubus_context first in uc_ubus_connection_t
7e5830edfb38 nl80211: fix datatype of NL80211_BAND_IFTYPE_ATTR_HE_CAP_{MAC,PHY} attrs
5c8fd34bac42 nl80211: fix parsing of NL80211_BAND_ATTR_VHT_MCS_SET attribute
e8d4e4fe967d nl80211: fix decoding of NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET attribute
30a3f7ad0433 rtnl: store callback in listener registry only on success
9cbe8294909f rtnl: optimize reception of rtnl events
534417132e18 rtnl: increase event socket rx buffer size limit to 1 MiB
3f9811d2f7b7 compiler: close upvalues on loop control statements
ee4af9b55cb4 vm: rework object iteration
a275399dd8e2 uci: refactor uci.changes() to match documentation
1220992631d5 ubus: automatically clear error information
d6fd94014eea uci: automatically clear error information
99837f280b61 uloop: automatically clear error information
ba3855ae3775 lib: fix documentation typo for `pop()` function
be767ae197ba vm: rework `in` operator semantics
4ade84e8fb81 ubus: add explicit support for deferring incoming requests
cfe137be068a uci: remove incorrectly documentated reorder() parameter
e8d78a26da0c lib: introduce socket library
a0ad1d127ae6 build: fix symbol and library detection
674f65ee551d jsdoc: disable default module titles
a33d16a86493 socket: rework error handling
e2b81d869222 uloop: add documentation
953f36c96e8a socket: make socket.send() accept non-string data
f211d5ac666f ubus: fix uc_ubus_have_uloop for eloop+uloop combination
0662de64bd1f socket: add AF_PACKET socket type support
b594ff8a2841 socket: remove leftover debug code
0d823e702bfe socket: fix addrinfo() with omitted service argument
8cf816d615fd socket: fix potential memory leak in connect()
8f5f231d66cd socket: optimize poll() argument handling
36f106056069 socket: remove wrong documentation fragment
525fca224012 socket: uv_to_sockaddr(): fix length calculation for AF_UNIX addresses
3938645ad9e3 socket: support IPv6 addresses in struct conversion routines
3a586dc7ddbe socket: improve uc_socket_connect() behavior
7b269f1cd3d2 socket: improve uc_socket_listen() behavior
fc6f2b89febf socket: handle further socket option value types
d6f25797dad1 socket: add IPv6 socket options
7611487b9a05 socket: implement recvmsg(), sendmsg() and cmsg support
d2e44bfa8b54 core-lib: improved documentation
e0bab40c8578 fs: add truncate() file method
5d305cfb2ab7 fs: add lock() file method
8b0318f7fabe lib: introduce zlib library
73644a036f5a nl80211: move access to tb array out of uc_nl_convert_attr and below
6e3cf83a77a7 nl80211: add support for multi-attribute arrays
6ff24d5488a9 nl80211: update nl80211.h to latest wireless-next
abc2aef28641 nl80211: add wiphy multi-radio support

Fixes: https://github.com/jow-/ucode/issues/186
Fixes: https://github.com/jow-/ucode/issues/187
Fixes: https://github.com/jow-/ucode/issues/188
Fixes: https://github.com/jow-/ucode/issues/193
Signed-off-by: Jo-Philipp Wich <jo@mein.io>