kernel: bump 6.1 to 6.1.91 (#12165)

delete target/linux/bcm27xx/patches-6.1/950-0270-net-bcmgenet-Reset-RBUF-on-first-open.patch
 delete target/linux/generic/backport-6.1/600-v6.9-03-net-gro-add-flush-check-in-udp_gro_receive_segment.patch
 delete target/linux/generic/pending-6.1/681-net-bridge-fix-multicast-to-unicast-with-fraglist-GS.patch
 delete target/linux/generic/pending-6.1/682-net-core-reject-skb_copy-_expand-for-fraglist-GSO-sk.patch
 delete target/linux/generic/pending-6.1/684-net-bridge-fix-corrupted-ethernet-header-on-multicas.patch

include/kernel-6.1

@@ -1,2 +1,2 @@
-LINUX_VERSION-6.1 = .90
+LINUX_VERSION-6.1 = .91
-LINUX_KERNEL_HASH-6.1.90 = 83a3d72e764fceda2c1fc68a4ea6b91253a28da56a688a2b61776b0d19788e1d
+LINUX_KERNEL_HASH-6.1.91 = 880ace63ca2291b8b639e9bd862cc828649d3e1e00ccfee5861473debd2e4dec

target/linux/bcm27xx/patches-6.1/950-0080-Revert-net-bcmgenet-Request-APD-DLL-disable-and-IDDQ.patch

@@ -16,7 +16,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
 +++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
-@@ -290,9 +290,7 @@ int bcmgenet_mii_probe(struct net_device
+@@ -303,9 +303,7 @@ int bcmgenet_mii_probe(struct net_device
  	struct device_node *dn = kdev->of_node;
  	phy_interface_t phy_iface = priv->phy_interface;
  	struct phy_device *phydev;

target/linux/bcm27xx/patches-6.1/950-0106-Add-dwc_otg-driver.patch

@@ -1185,7 +1185,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  }
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -5697,7 +5697,7 @@ static void port_event(struct usb_hub *h
+@@ -5698,7 +5698,7 @@ static void port_event(struct usb_hub *h
  		port_dev->over_current_count++;
  		port_over_current_notify(port_dev);
  

target/linux/bcm27xx/patches-6.1/950-0179-bcmgenet-Better-coalescing-parameter-defaults.patch

@@ -18,7 +18,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
 +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-@@ -2659,7 +2659,7 @@ static void bcmgenet_init_tx_ring(struct
+@@ -2665,7 +2665,7 @@ static void bcmgenet_init_tx_ring(struct
  
  	bcmgenet_tdma_ring_writel(priv, index, 0, TDMA_PROD_INDEX);
  	bcmgenet_tdma_ring_writel(priv, index, 0, TDMA_CONS_INDEX);
@@ -27,7 +27,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	/* Disable rate control for now */
  	bcmgenet_tdma_ring_writel(priv, index, flow_period_val,
  				  TDMA_FLOW_PERIOD);
-@@ -4140,9 +4140,12 @@ static int bcmgenet_probe(struct platfor
+@@ -4160,9 +4160,12 @@ static int bcmgenet_probe(struct platfor
  	netif_set_real_num_rx_queues(priv->dev, priv->hw_params->rx_queues + 1);
  
  	/* Set default coalescing parameters */

target/linux/bcm27xx/patches-6.1/950-0180-net-genet-enable-link-energy-detect-powerdown-for-ex.patch

@@ -20,7 +20,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
 +++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
-@@ -296,6 +296,8 @@ int bcmgenet_mii_probe(struct net_device
+@@ -309,6 +309,8 @@ int bcmgenet_mii_probe(struct net_device
  	/* Communicate the integrated PHY revision */
  	if (priv->internal_phy)
  		phy_flags = priv->gphy_rev;

target/linux/bcm27xx/patches-6.1/950-0189-net-bcmgenet-Workaround-2-for-Pi4-Ethernet-fail.patch

@@ -37,7 +37,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  static inline void bcmgenet_writel(u32 value, void __iomem *offset)
  {
-@@ -2490,6 +2493,11 @@ static void reset_umac(struct bcmgenet_p
+@@ -2494,6 +2497,11 @@ static void reset_umac(struct bcmgenet_p
  	bcmgenet_rbuf_ctrl_set(priv, 0);
  	udelay(10);
  
@@ -47,5 +47,5 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 +	}
 +
  	/* issue soft reset and disable MAC while updating its registers */
+ 	spin_lock_bh(&priv->reg_lock);
  	bcmgenet_umac_writel(priv, CMD_SW_RESET, UMAC_CMD);
- 	udelay(2);

target/linux/bcm27xx/patches-6.1/950-0227-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch

@@ -32,7 +32,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/spi/spi.c
 +++ b/drivers/spi/spi.c
-@@ -3679,6 +3679,7 @@ static int spi_set_cs_timing(struct spi_
+@@ -3690,6 +3690,7 @@ static int spi_set_cs_timing(struct spi_
   */
  int spi_setup(struct spi_device *spi)
  {
@@ -40,7 +40,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	unsigned	bad_bits, ugly_bits;
  	int		status = 0;
  
-@@ -3699,6 +3700,14 @@ int spi_setup(struct spi_device *spi)
+@@ -3710,6 +3711,14 @@ int spi_setup(struct spi_device *spi)
  		(SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL |
  		 SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL)))
  		return -EINVAL;

target/linux/bcm27xx/patches-6.1/950-0270-net-bcmgenet-Reset-RBUF-on-first-open.patch

@@ -1,70 +0,0 @@
-From e857a27d5bca6269cea7a0ca0058aa8fffe90a83 Mon Sep 17 00:00:00 2001
-From: Phil Elwell <phil@raspberrypi.com>
-Date: Fri, 25 Sep 2020 15:07:23 +0100
-Subject: [PATCH] net: bcmgenet: Reset RBUF on first open
-
-If the RBUF logic is not reset when the kernel starts then there
-may be some data left over from any network boot loader. If the
-64-byte packet headers are enabled then this can be fatal.
-
-Extend bcmgenet_dma_disable to do perform the reset, but not when
-called from bcmgenet_resume in order to preserve a wake packet.
-
-N.B. This different handling of resume is just based on a hunch -
-why else wouldn't one reset the RBUF as well as the TBUF? If this
-isn't the case then it's easy to change the patch to make the RBUF
-reset unconditional.
-
-See: https://github.com/raspberrypi/linux/issues/3850
-
-Signed-off-by: Phil Elwell <phil@raspberrypi.com>
----
- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 16 ++++++++++++----
- 1 file changed, 12 insertions(+), 4 deletions(-)
-
---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
-@@ -3306,7 +3306,7 @@ static void bcmgenet_get_hw_addr(struct
- }
- 
- /* Returns a reusable dma control register value */
--static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv)
-+static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv, bool flush_rx)
- {
- 	unsigned int i;
- 	u32 reg;
-@@ -3331,6 +3331,14 @@ static u32 bcmgenet_dma_disable(struct b
- 	udelay(10);
- 	bcmgenet_umac_writel(priv, 0, UMAC_TX_FLUSH);
- 
-+	if (flush_rx) {
-+	    reg = bcmgenet_rbuf_ctrl_get(priv);
-+	    bcmgenet_rbuf_ctrl_set(priv, reg | BIT(0));
-+	    udelay(10);
-+	    bcmgenet_rbuf_ctrl_set(priv, reg);
-+	    udelay(10);
-+	}
-+
- 	return dma_ctrl;
- }
- 
-@@ -3394,8 +3402,8 @@ static int bcmgenet_open(struct net_devi
- 
- 	bcmgenet_set_hw_addr(priv, dev->dev_addr);
- 
--	/* Disable RX/TX DMA and flush TX queues */
--	dma_ctrl = bcmgenet_dma_disable(priv);
-+	/* Disable RX/TX DMA and flush TX and RX queues */
-+	dma_ctrl = bcmgenet_dma_disable(priv, true);
- 
- 	/* Reinitialize TDMA and RDMA and SW housekeeping */
- 	ret = bcmgenet_init_dma(priv);
-@@ -4269,7 +4277,7 @@ static int bcmgenet_resume(struct device
- 			bcmgenet_hfb_create_rxnfc_filter(priv, rule);
- 
- 	/* Disable RX/TX DMA and flush TX queues */
--	dma_ctrl = bcmgenet_dma_disable(priv);
-+	dma_ctrl = bcmgenet_dma_disable(priv, false);
- 
- 	/* Reinitialize TDMA and RDMA and SW housekeeping */
- 	ret = bcmgenet_init_dma(priv);

target/linux/bcm27xx/patches-6.1/950-0513-net-bcmgenet-Add-eee-module-parameter.patch

@@ -26,7 +26,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  static inline void bcmgenet_writel(u32 value, void __iomem *offset)
  {
-@@ -3440,6 +3443,17 @@ static int bcmgenet_open(struct net_devi
+@@ -3448,6 +3451,17 @@ static int bcmgenet_open(struct net_devi
  
  	bcmgenet_phy_pause_set(dev, priv->rx_pause, priv->tx_pause);
  

target/linux/bcm27xx/patches-6.1/950-0865-usb-dwc3-Set-DMA-and-coherent-masks-early.patch

@@ -212,7 +212,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	},
 --- a/drivers/usb/dwc3/core.c
 +++ b/drivers/usb/dwc3/core.c
-@@ -1179,6 +1179,24 @@ static void dwc3_config_threshold(struct
+@@ -1180,6 +1180,24 @@ static void dwc3_config_threshold(struct
  	}
  }
  
@@ -237,7 +237,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  /**
   * dwc3_core_init - Low-level initialization of DWC3 Core
   * @dwc: Pointer to our controller context structure
-@@ -1271,6 +1289,8 @@ static int dwc3_core_init(struct dwc3 *d
+@@ -1257,6 +1275,8 @@ static int dwc3_core_init(struct dwc3 *d
  
  	dwc3_set_incr_burst_type(dwc);
  
@@ -246,7 +246,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	usb_phy_set_suspend(dwc->usb2_phy, 0);
  	usb_phy_set_suspend(dwc->usb3_phy, 0);
  	ret = phy_power_on(dwc->usb2_generic_phy);
-@@ -1504,6 +1524,7 @@ static void dwc3_get_properties(struct d
+@@ -1490,6 +1510,7 @@ static void dwc3_get_properties(struct d
  	u8			tx_thr_num_pkt_prd = 0;
  	u8			tx_max_burst_prd = 0;
  	u8			tx_fifo_resize_max_num;
@@ -254,7 +254,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	const char		*usb_psy_name;
  	int			ret;
  
-@@ -1526,6 +1547,9 @@ static void dwc3_get_properties(struct d
+@@ -1512,6 +1533,9 @@ static void dwc3_get_properties(struct d
  	 */
  	tx_fifo_resize_max_num = 6;
  
@@ -264,7 +264,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	dwc->maximum_speed = usb_get_maximum_speed(dev);
  	dwc->max_ssp_rate = usb_get_maximum_ssp_rate(dev);
  	dwc->dr_mode = usb_get_dr_mode(dev);
-@@ -1641,6 +1665,9 @@ static void dwc3_get_properties(struct d
+@@ -1627,6 +1651,9 @@ static void dwc3_get_properties(struct d
  	dwc->dis_split_quirk = device_property_read_bool(dev,
  				"snps,dis-split-quirk");
  
@@ -274,7 +274,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	dwc->lpm_nyet_threshold = lpm_nyet_threshold;
  	dwc->tx_de_emphasis = tx_de_emphasis;
  
-@@ -1658,6 +1685,8 @@ static void dwc3_get_properties(struct d
+@@ -1644,6 +1671,8 @@ static void dwc3_get_properties(struct d
  	dwc->tx_thr_num_pkt_prd = tx_thr_num_pkt_prd;
  	dwc->tx_max_burst_prd = tx_max_burst_prd;
  
@@ -283,7 +283,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	dwc->imod_interval = 0;
  
  	dwc->tx_fifo_resize_max_num = tx_fifo_resize_max_num;
-@@ -1866,6 +1895,12 @@ static int dwc3_probe(struct platform_de
+@@ -1852,6 +1881,12 @@ static int dwc3_probe(struct platform_de
  
  	dwc3_get_properties(dwc);
  
@@ -326,7 +326,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
 --- a/drivers/usb/dwc3/host.c
 +++ b/drivers/usb/dwc3/host.c
-@@ -30,10 +30,10 @@ static void dwc3_host_fill_xhci_irq_res(
+@@ -51,10 +51,10 @@ static void dwc3_host_fill_xhci_irq_res(
  
  static int dwc3_host_get_irq(struct dwc3 *dwc)
  {
@@ -339,7 +339,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (irq > 0) {
  		dwc3_host_fill_xhci_irq_res(dwc, irq, "host");
  		goto out;
-@@ -42,7 +42,7 @@ static int dwc3_host_get_irq(struct dwc3
+@@ -63,7 +63,7 @@ static int dwc3_host_get_irq(struct dwc3
  	if (irq == -EPROBE_DEFER)
  		goto out;
  
@@ -348,7 +348,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (irq > 0) {
  		dwc3_host_fill_xhci_irq_res(dwc, irq, "dwc_usb3");
  		goto out;
-@@ -51,7 +51,7 @@ static int dwc3_host_get_irq(struct dwc3
+@@ -72,7 +72,7 @@ static int dwc3_host_get_irq(struct dwc3
  	if (irq == -EPROBE_DEFER)
  		goto out;
  
@@ -357,7 +357,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (irq > 0) {
  		dwc3_host_fill_xhci_irq_res(dwc, irq, NULL);
  		goto out;
-@@ -66,16 +66,23 @@ out:
+@@ -87,16 +87,23 @@ out:
  
  int dwc3_host_init(struct dwc3 *dwc)
  {

target/linux/generic/backport-6.1/600-v6.9-03-net-gro-add-flush-check-in-udp_gro_receive_segment.patch

@@ -1,48 +0,0 @@
-From: Richard Gobert <richardbgobert@gmail.com>
-Date: Tue, 30 Apr 2024 16:35:55 +0200
-Subject: [PATCH] net: gro: add flush check in udp_gro_receive_segment
-
-GRO-GSO path is supposed to be transparent and as such L3 flush checks are
-relevant to all UDP flows merging in GRO. This patch uses the same logic
-and code from tcp_gro_receive, terminating merge if flush is non zero.
-
-Fixes: e20cf8d3f1f7 ("udp: implement GRO for plain UDP sockets.")
-Signed-off-by: Richard Gobert <richardbgobert@gmail.com>
-Reviewed-by: Willem de Bruijn <willemb@google.com>
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
----
-
---- a/net/ipv4/udp_offload.c
-+++ b/net/ipv4/udp_offload.c
-@@ -463,6 +463,7 @@ static struct sk_buff *udp_gro_receive_s
- 	struct sk_buff *p;
- 	unsigned int ulen;
- 	int ret = 0;
-+	int flush;
- 
- 	/* requires non zero csum, for symmetry with GSO */
- 	if (!uh->check) {
-@@ -496,13 +497,22 @@ static struct sk_buff *udp_gro_receive_s
- 			return p;
- 		}
- 
-+		flush = NAPI_GRO_CB(p)->flush;
-+
-+		if (NAPI_GRO_CB(p)->flush_id != 1 ||
-+		    NAPI_GRO_CB(p)->count != 1 ||
-+		    !NAPI_GRO_CB(p)->is_atomic)
-+			flush |= NAPI_GRO_CB(p)->flush_id;
-+		else
-+			NAPI_GRO_CB(p)->is_atomic = false;
-+
- 		/* Terminate the flow on len mismatch or if it grow "too much".
- 		 * Under small packet flood GRO count could elsewhere grow a lot
- 		 * leading to excessive truesize values.
- 		 * On len mismatch merge the first packet shorter than gso_size,
- 		 * otherwise complete the GRO packet.
- 		 */
--		if (ulen > ntohs(uh2->len)) {
-+		if (ulen > ntohs(uh2->len) || flush) {
- 			pp = p;
- 		} else {
- 			if (NAPI_GRO_CB(skb)->is_flist) {

target/linux/generic/hack-6.1/221-module_exports.patch

@@ -115,7 +115,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	.previous
 --- a/scripts/Makefile.build
 +++ b/scripts/Makefile.build
-@@ -388,7 +388,7 @@ targets += $(real-dtb-y) $(lib-y) $(alwa
+@@ -391,7 +391,7 @@ targets += $(real-dtb-y) $(lib-y) $(alwa
  # Linker scripts preprocessor (.lds.S -> .lds)
  # ---------------------------------------------------------------------------
  quiet_cmd_cpp_lds_S = LDS     $@

target/linux/generic/hack-6.1/601-of_net-add-mac-address-ascii-support.patch

@@ -11,7 +11,7 @@ Submitted-by: Yousong Zhou <yszhou4tech@gmail.com>
 
 --- a/net/ethernet/eth.c
 +++ b/net/ethernet/eth.c
-@@ -521,6 +521,63 @@ int eth_platform_get_mac_address(struct
+@@ -505,6 +505,63 @@ int eth_platform_get_mac_address(struct
  }
  EXPORT_SYMBOL(eth_platform_get_mac_address);
  
@@ -75,7 +75,7 @@ Submitted-by: Yousong Zhou <yszhou4tech@gmail.com>
  /**
   * platform_get_ethdev_address - Set netdev's MAC address from a given device
   * @dev:	Pointer to the device
-@@ -554,19 +611,23 @@ int nvmem_get_mac_address(struct device
+@@ -538,19 +595,23 @@ int nvmem_get_mac_address(struct device
  {
  	struct nvmem_cell *cell;
  	const void *mac;

target/linux/generic/hack-6.1/721-net-add-packet-mangeling.patch

@@ -47,7 +47,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	const struct header_ops *header_ops;
  
  	unsigned char		operstate;
-@@ -2184,6 +2191,10 @@ struct net_device {
+@@ -2182,6 +2189,10 @@ struct net_device {
  	struct mctp_dev __rcu	*mctp_ptr;
  #endif
  
@@ -60,7 +60,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   */
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -3046,6 +3046,10 @@ static inline int pskb_trim(struct sk_bu
+@@ -3060,6 +3060,10 @@ static inline int pskb_trim(struct sk_bu
  	return (len < skb->len) ? __pskb_trim(skb, len) : 0;
  }
  
@@ -71,7 +71,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /**
   *	pskb_trim_unique - remove end from a paged unique (not cloned) buffer
   *	@skb: buffer to alter
-@@ -3195,16 +3199,6 @@ static inline struct sk_buff *dev_alloc_
+@@ -3209,16 +3213,6 @@ static inline struct sk_buff *dev_alloc_
  }
  
  
@@ -152,7 +152,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
 --- a/net/ethernet/eth.c
 +++ b/net/ethernet/eth.c
-@@ -171,6 +171,12 @@ __be16 eth_type_trans(struct sk_buff *sk
+@@ -159,6 +159,12 @@ __be16 eth_type_trans(struct sk_buff *sk
  	const struct ethhdr *eth;
  
  	skb->dev = dev;

target/linux/generic/hack-6.1/953-net-patch-linux-kernel-to-support-shortcut-fe.patch

@@ -12,7 +12,7 @@
  			       struct list_head *br_ip_list);
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -990,6 +990,10 @@ struct sk_buff {
+@@ -989,6 +989,10 @@ struct sk_buff {
  	__u8			csum_not_inet:1;
  	__u8			scm_io_uring:1;
  

target/linux/generic/pending-6.1/540-ksmbd-only-v2-leases-handle-the-directory.patch

@@ -17,7 +17,7 @@ Signed-off-by: Steve French <stfrench@microsoft.com>
 
 --- a/fs/smb/server/oplock.c
 +++ b/fs/smb/server/oplock.c
-@@ -1203,6 +1203,12 @@ int smb_grant_oplock(struct ksmbd_work *
+@@ -1214,6 +1214,12 @@ int smb_grant_oplock(struct ksmbd_work *
  			return 0;
  	}
  

target/linux/generic/pending-6.1/655-increase_skb_pad.patch

@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -3012,7 +3012,7 @@ static inline int pskb_network_may_pull(
+@@ -3027,7 +3027,7 @@ static inline int pskb_network_may_pull(
   * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
   */
  #ifndef NET_SKB_PAD

target/linux/generic/pending-6.1/681-net-bridge-fix-multicast-to-unicast-with-fraglist-GS.patch

@@ -1,23 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 27 Apr 2024 18:54:25 +0200
-Subject: [PATCH] net: bridge: fix multicast-to-unicast with fraglist GSO
-
-Calling skb_copy on a SKB_GSO_FRAGLIST skb is not valid, since it returns
-an invalid linearized skb. This code only needs to change the ethernet
-header, so pskb_copy is the right function to call here.
-
-Fixes: 6db6f0eae605 ("bridge: multicast to unicast")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/bridge/br_forward.c
-+++ b/net/bridge/br_forward.c
-@@ -261,7 +261,7 @@ static void maybe_deliver_addr(struct ne
- 	if (skb->dev == p->dev && ether_addr_equal(src, addr))
- 		return;
- 
--	skb = skb_copy(skb, GFP_ATOMIC);
-+	skb = pskb_copy(skb, GFP_ATOMIC);
- 	if (!skb) {
- 		DEV_STATS_INC(dev, tx_dropped);
- 		return;

target/linux/generic/pending-6.1/682-net-core-reject-skb_copy-_expand-for-fraglist-GSO-sk.patch

@@ -1,59 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sat, 27 Apr 2024 19:29:45 +0200
-Subject: [PATCH] net: core: reject skb_copy(_expand) for fraglist GSO skbs
-
-SKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become
-invalid. Return NULL if such an skb is passed to skb_copy or
-skb_copy_expand, in order to prevent a crash on a potential later
-call to skb_gso_segment.
-
-Fixes: 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -1720,11 +1720,17 @@ static inline int skb_alloc_rx_flag(cons
- 
- struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
- {
--	int headerlen = skb_headroom(skb);
--	unsigned int size = skb_end_offset(skb) + skb->data_len;
--	struct sk_buff *n = __alloc_skb(size, gfp_mask,
--					skb_alloc_rx_flag(skb), NUMA_NO_NODE);
-+	struct sk_buff *n;
-+	unsigned int size;
-+	int headerlen;
- 
-+	if (WARN_ON_ONCE(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST))
-+		return NULL;
-+
-+	headerlen = skb_headroom(skb);
-+	size = skb_end_offset(skb) + skb->data_len;
-+	n = __alloc_skb(size, gfp_mask,
-+			skb_alloc_rx_flag(skb), NUMA_NO_NODE);
- 	if (!n)
- 		return NULL;
- 
-@@ -2037,12 +2043,17 @@ struct sk_buff *skb_copy_expand(const st
- 	/*
- 	 *	Allocate the copy buffer
- 	 */
--	struct sk_buff *n = __alloc_skb(newheadroom + skb->len + newtailroom,
--					gfp_mask, skb_alloc_rx_flag(skb),
--					NUMA_NO_NODE);
--	int oldheadroom = skb_headroom(skb);
- 	int head_copy_len, head_copy_off;
-+	struct sk_buff *n;
-+	int oldheadroom;
-+
-+	if (WARN_ON_ONCE(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST))
-+		return NULL;
- 
-+	oldheadroom = skb_headroom(skb);
-+	n = __alloc_skb(newheadroom + skb->len + newtailroom,
-+			gfp_mask, skb_alloc_rx_flag(skb),
-+			NUMA_NO_NODE);
- 	if (!n)
- 		return NULL;
- 

target/linux/generic/pending-6.1/684-net-bridge-fix-corrupted-ethernet-header-on-multicas.patch

@@ -1,42 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 5 May 2024 20:36:56 +0200
-Subject: [PATCH] net: bridge: fix corrupted ethernet header on
- multicast-to-unicast
-
-The change from skb_copy to pskb_copy unfortunately changed the data
-copying to omit the ethernet header, since it was pulled before reaching
-this point. Fix this by calling __skb_push/pull around pskb_copy.
-
-Fixes: 59c878cbcdd8 ("net: bridge: fix multicast-to-unicast with fraglist GSO")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/bridge/br_forward.c
-+++ b/net/bridge/br_forward.c
-@@ -253,6 +253,7 @@ static void maybe_deliver_addr(struct ne
- {
- 	struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
- 	const unsigned char *src = eth_hdr(skb)->h_source;
-+	struct sk_buff *nskb;
- 
- 	if (!should_deliver(p, skb))
- 		return;
-@@ -261,12 +262,16 @@ static void maybe_deliver_addr(struct ne
- 	if (skb->dev == p->dev && ether_addr_equal(src, addr))
- 		return;
- 
--	skb = pskb_copy(skb, GFP_ATOMIC);
--	if (!skb) {
-+	__skb_push(skb, ETH_HLEN);
-+	nskb = pskb_copy(skb, GFP_ATOMIC);
-+	__skb_pull(skb, ETH_HLEN);
-+	if (!nskb) {
- 		DEV_STATS_INC(dev, tx_dropped);
- 		return;
- 	}
- 
-+	skb = nskb;
-+	__skb_pull(skb, ETH_HLEN);
- 	if (!is_broadcast_ether_addr(addr))
- 		memcpy(eth_hdr(skb)->h_dest, addr, ETH_ALEN);
- 

target/linux/generic/pending-6.1/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch

@@ -134,7 +134,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		return -EMSGSIZE;
  
  	timerval = br_timer_value(&p->message_age_timer);
-@@ -878,6 +880,7 @@ static const struct nla_policy br_port_p
+@@ -879,6 +881,7 @@ static const struct nla_policy br_port_p
  	[IFLA_BRPORT_LOCKED] = { .type = NLA_U8 },
  	[IFLA_BRPORT_BACKUP_PORT] = { .type = NLA_U32 },
  	[IFLA_BRPORT_MCAST_EHT_HOSTS_LIMIT] = { .type = NLA_U32 },
@@ -142,7 +142,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  };
  
  /* Change the state of the port and notify spanning tree */
-@@ -943,6 +946,7 @@ static int br_setport(struct net_bridge_
+@@ -944,6 +947,7 @@ static int br_setport(struct net_bridge_
  	br_set_port_flag(p, tb, IFLA_BRPORT_NEIGH_SUPPRESS, BR_NEIGH_SUPPRESS);
  	br_set_port_flag(p, tb, IFLA_BRPORT_ISOLATED, BR_ISOLATED);
  	br_set_port_flag(p, tb, IFLA_BRPORT_LOCKED, BR_PORT_LOCKED);

target/linux/generic/pending-6.1/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch

@@ -17,7 +17,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -2170,7 +2170,7 @@ struct net_device {
+@@ -2168,7 +2168,7 @@ struct net_device {
  #if IS_ENABLED(CONFIG_AX25)
  	void			*ax25_ptr;
  #endif

target/linux/generic/pending-6.1/760-net-core-add-optional-threading-for-backlog-processi.patch

@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  /**
   *	napi_disable - prevent NAPI from scheduling
-@@ -3130,6 +3131,7 @@ struct softnet_data {
+@@ -3128,6 +3129,7 @@ struct softnet_data {
  	unsigned int		processed;
  	unsigned int		time_squeeze;
  	unsigned int		received_rps;
@@ -157,7 +157,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  void netif_napi_add_weight(struct net_device *dev, struct napi_struct *napi,
  			   int (*poll)(struct napi_struct *, int), int weight)
  {
-@@ -11186,6 +11257,9 @@ static int dev_cpu_dead(unsigned int old
+@@ -11141,6 +11212,9 @@ static int dev_cpu_dead(unsigned int old
  	raise_softirq_irqoff(NET_TX_SOFTIRQ);
  	local_irq_enable();
  
@@ -167,7 +167,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #ifdef CONFIG_RPS
  	remsd = oldsd->rps_ipi_list;
  	oldsd->rps_ipi_list = NULL;
-@@ -11498,6 +11572,7 @@ static int __init net_dev_init(void)
+@@ -11453,6 +11527,7 @@ static int __init net_dev_init(void)
  		INIT_CSD(&sd->defer_csd, trigger_rx_softirq, sd);
  		spin_lock_init(&sd->defer_lock);
  

target/linux/generic/pending-6.1/901-usb-add-more-modem-support.patch

@@ -1,9 +1,9 @@
 --- a/drivers/net/usb/qmi_wwan.c
 +++ b/drivers/net/usb/qmi_wwan.c
-@@ -1429,6 +1429,9 @@ static const struct usb_device_id produc
+@@ -1430,6 +1430,9 @@ static const struct usb_device_id produc
- 	{QMI_FIXED_INTF(0x0489, 0xe0b5, 0)},	/* Foxconn T77W968 LTE with eSIM support*/
  	{QMI_FIXED_INTF(0x2692, 0x9025, 4)},    /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */
  	{QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)},	/* u-blox LARA-L6 */
+ 	{QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET */
 +	{QMI_FIXED_INTF(0x2077, 0x2002, 4)},	/* T&W TW04C */
 +	{QMI_FIXED_INTF(0x2077, 0x2003, 4)},	/* T&W TW12G */
 +	{QMI_FIXED_INTF(0x2077, 0x2004, 4)},	/* T&W TW510M */

target/linux/mediatek/patches-6.1/432-drivers-spi-Add-support-for-dynamic-calibration.patch

@@ -212,7 +212,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
  static inline struct spi_driver *to_spi_driver(struct device_driver *drv)
  {
  	return drv ? container_of(drv, struct spi_driver, driver) : NULL;
-@@ -703,6 +737,11 @@ struct spi_controller {
+@@ -712,6 +746,11 @@ struct spi_controller {
  	void			*dummy_rx;
  	void			*dummy_tx;
  
@@ -224,7 +224,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
  	int (*fw_translate_cs)(struct spi_controller *ctlr, unsigned cs);
  
  	/*
-@@ -1510,6 +1549,9 @@ spi_register_board_info(struct spi_board
+@@ -1555,6 +1594,9 @@ spi_register_board_info(struct spi_board
  	{ return 0; }
  #endif
  

target/linux/x86/patches-6.1/998-add-a-sysctl-to-enable-disable-tcp_collapse-logic.patch

@@ -140,7 +140,7 @@ and performance for all other cases.
  	 * and hopefully then we'll have sufficient space.
 --- a/net/ipv4/tcp_ipv4.c
 +++ b/net/ipv4/tcp_ipv4.c
-@@ -3225,6 +3225,8 @@ static int __net_init tcp_sk_init(struct
+@@ -3231,6 +3231,8 @@ static int __net_init tcp_sk_init(struct
  
  	net->ipv4.sysctl_tcp_shrink_window = 0;