kernel: bump 6.6 to 6.6.35

Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.35

Removed upstreamed:
	bcm27xx/patches-6.6/950-1135-ax25-Fix-refcount-imbalance-on-inbound-connections.patch[1]

Removed no longer needed:
	generic/pending-6.6/779-net-vxlan-don-t-learn-non-unicast-L2-destinations.patch[2]

All other patches automatically rebased.

Build system: x86/64
Build-tested: x86/64/AMD Cezanne, flogic/glinet_gl-mt6000, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3
Run-tested: x86/64/AMD Cezanne, flogic/glinet_gl-mt6000, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3

1. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.35&id=52100fd74ad07b53a4666feafff1cd11436362d3
2. As suggested by @DragonBluep, "This patch can be removed. It will never return false. And the upstream commit should fix the same issue: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit?h=v6.6.35&id=924f7bbfc5cfd029e417c56357ca01eae681fba6"

Signed-off-by: John Audia <therealgraysky@proton.me>

14 files changed, 33 insertions, 148 deletions

diff --git a/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch b/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
index 7876818c39..cbaf6ac1e2 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
@@ -14,7 +14,7 @@ We don't agree with upstream revert so undo it.
 
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -479,8 +479,10 @@ static void xhci_pci_quirks(struct devic
+@@ -486,8 +486,10 @@ static void xhci_pci_quirks(struct devic
  			pdev->device == 0x3432)
  		xhci->quirks |= XHCI_BROKEN_STREAMS;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch b/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch
index a454300558..f9fa454aeb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch
@@ -52,7 +52,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	erst_base = xhci_read_64(xhci, &ir->ir_set->erst_base);
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1679,8 +1679,9 @@ struct urb_priv {
+@@ -1680,8 +1680,9 @@ struct urb_priv {
   * Each segment table entry is 4*32bits long.  1K seems like an ok size:
   * (1K bytes * 8bytes/bit) / (4*32 bits) = 64 segment entries in the table,
   * meaning 64 ring segments.
diff --git a/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch b/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
index 344e206df6..65d04a01ee 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
@@ -24,7 +24,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -482,6 +482,7 @@ static void xhci_pci_quirks(struct devic
+@@ -489,6 +489,7 @@ static void xhci_pci_quirks(struct devic
  	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
  		xhci->quirks |= XHCI_LPM_SUPPORT;
  		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
@@ -52,7 +52,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	addr = xhci_trb_virt_to_dma(new_seg, new_deq);
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1914,6 +1914,9 @@ struct xhci_hcd {
+@@ -1915,6 +1915,9 @@ struct xhci_hcd {
  #define XHCI_ZHAOXIN_TRB_FETCH	BIT_ULL(45)
  #define XHCI_ZHAOXIN_HOST	BIT_ULL(46)
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch b/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch
index 488629c334..fa7a10e316 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch
@@ -22,7 +22,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -483,6 +483,7 @@ static void xhci_pci_quirks(struct devic
+@@ -490,6 +490,7 @@ static void xhci_pci_quirks(struct devic
  		xhci->quirks |= XHCI_LPM_SUPPORT;
  		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
  		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch b/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
index 766b4f5bf1..ef0ef47969 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
@@ -90,7 +90,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	/* Allow 3 retries for everything but isoc, set CErr = 3 */
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -484,6 +484,7 @@ static void xhci_pci_quirks(struct devic
+@@ -491,6 +491,7 @@ static void xhci_pci_quirks(struct devic
  		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
  		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
  		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
@@ -100,7 +100,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1916,6 +1916,7 @@ struct xhci_hcd {
+@@ -1917,6 +1917,7 @@ struct xhci_hcd {
  
  /* Downstream VLI fixes */
  #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(56)
diff --git a/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch b/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
index 97c88f8231..e1846dc8f5 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
@@ -47,7 +47,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  /* Device for a quirk */
  #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
  #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK	0x1000
-@@ -290,6 +292,16 @@ static int xhci_pci_reinit(struct xhci_h
+@@ -291,6 +293,16 @@ static int xhci_pci_reinit(struct xhci_h
  	return 0;
  }
  
@@ -64,7 +64,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
  {
  	struct pci_dev                  *pdev = to_pci_dev(dev);
-@@ -485,6 +497,8 @@ static void xhci_pci_quirks(struct devic
+@@ -492,6 +504,8 @@ static void xhci_pci_quirks(struct devic
  		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
  		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
  		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
@@ -75,7 +75,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 --- a/drivers/usb/host/xhci-ring.c
 +++ b/drivers/usb/host/xhci-ring.c
-@@ -3626,6 +3626,48 @@ static int xhci_align_td(struct xhci_hcd
+@@ -3657,6 +3657,48 @@ static int xhci_align_td(struct xhci_hcd
  	return 1;
  }
  
@@ -124,7 +124,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  /* This is very similar to what ehci-q.c qtd_fill() does */
  int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
  		struct urb *urb, int slot_id, unsigned int ep_index)
-@@ -3782,6 +3824,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+@@ -3813,6 +3855,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
  	}
  
  	check_trb_math(urb, enqd_len);
@@ -133,7 +133,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
  			start_cycle, start_trb);
  	return 0;
-@@ -3917,6 +3961,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
+@@ -3948,6 +3992,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
  			/* Event on completion */
  			field | TRB_IOC | TRB_TYPE(TRB_STATUS) | ep_ring->cycle_state);
  
@@ -144,7 +144,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	return 0;
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1917,6 +1917,7 @@ struct xhci_hcd {
+@@ -1918,6 +1918,7 @@ struct xhci_hcd {
  /* Downstream VLI fixes */
  #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(56)
  #define XHCI_VLI_SS_BULK_OUT_BUG	BIT_ULL(57)
diff --git a/target/linux/bcm27xx/patches-6.6/950-1135-ax25-Fix-refcount-imbalance-on-inbound-connections.patch b/target/linux/bcm27xx/patches-6.6/950-1135-ax25-Fix-refcount-imbalance-on-inbound-connections.patch
deleted file mode 100644
index da945d2d05..0000000000
--- a/target/linux/bcm27xx/patches-6.6/950-1135-ax25-Fix-refcount-imbalance-on-inbound-connections.patch
+++ /dev/null
@@ -1,85 +0,0 @@
-From 333b34fa4845022d563e83f01a60af0abd080679 Mon Sep 17 00:00:00 2001
-From: Lars Kellogg-Stedman <lars@oddbit.com>
-Date: Wed, 29 May 2024 17:02:43 -0400
-Subject: [PATCH 1135/1135] ax25: Fix refcount imbalance on inbound connections
-
-commit 3c34fb0bd4a4237592c5ecb5b2e2531900c55774 upstream.
-
-When releasing a socket in ax25_release(), we call netdev_put() to
-decrease the refcount on the associated ax.25 device. However, the
-execution path for accepting an incoming connection never calls
-netdev_hold(). This imbalance leads to refcount errors, and ultimately
-to kernel crashes.
-
-A typical call trace for the above situation will start with one of the
-following errors:
-
-    refcount_t: decrement hit 0; leaking memory.
-    refcount_t: underflow; use-after-free.
-
-And will then have a trace like:
-
-    Call Trace:
-    <TASK>
-    ? show_regs+0x64/0x70
-    ? __warn+0x83/0x120
-    ? refcount_warn_saturate+0xb2/0x100
-    ? report_bug+0x158/0x190
-    ? prb_read_valid+0x20/0x30
-    ? handle_bug+0x3e/0x70
-    ? exc_invalid_op+0x1c/0x70
-    ? asm_exc_invalid_op+0x1f/0x30
-    ? refcount_warn_saturate+0xb2/0x100
-    ? refcount_warn_saturate+0xb2/0x100
-    ax25_release+0x2ad/0x360
-    __sock_release+0x35/0xa0
-    sock_close+0x19/0x20
-    [...]
-
-On reboot (or any attempt to remove the interface), the kernel gets
-stuck in an infinite loop:
-
-    unregister_netdevice: waiting for ax0 to become free. Usage count = 0
-
-This patch corrects these issues by ensuring that we call netdev_hold()
-and ax25_dev_hold() for new connections in ax25_accept(). This makes the
-logic leading to ax25_accept() match the logic for ax25_bind(): in both
-cases we increment the refcount, which is ultimately decremented in
-ax25_release().
-
-Fixes: 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()")
-Signed-off-by: Lars Kellogg-Stedman <lars@oddbit.com>
-Tested-by: Duoming Zhou <duoming@zju.edu.cn>
-Tested-by: Dan Cross <crossd@gmail.com>
-Tested-by: Chris Maness <christopher.maness@gmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
-Link: https://lore.kernel.org/r/20240529210242.3346844-2-lars@oddbit.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
----
- net/ax25/af_ax25.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/net/ax25/af_ax25.c
-+++ b/net/ax25/af_ax25.c
-@@ -1378,8 +1378,10 @@ static int ax25_accept(struct socket *so
- {
- 	struct sk_buff *skb;
- 	struct sock *newsk;
-+	ax25_dev *ax25_dev;
- 	DEFINE_WAIT(wait);
- 	struct sock *sk;
-+	ax25_cb *ax25;
- 	int err = 0;
- 
- 	if (sock->state != SS_UNCONNECTED)
-@@ -1434,6 +1436,10 @@ static int ax25_accept(struct socket *so
- 	kfree_skb(skb);
- 	sk_acceptq_removed(sk);
- 	newsock->state = SS_CONNECTED;
-+	ax25 = sk_to_ax25(newsk);
-+	ax25_dev = ax25->ax25_dev;
-+	netdev_hold(ax25_dev->dev, &ax25->dev_tracker, GFP_ATOMIC);
-+	ax25_dev_hold(ax25_dev);
- 
- out:
- 	release_sock(sk);
diff --git a/target/linux/bcm53xx/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch b/target/linux/bcm53xx/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
index 8b2f86de01..eb6317a2d1 100644
--- a/target/linux/bcm53xx/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
+++ b/target/linux/bcm53xx/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
@@ -103,7 +103,7 @@ it on BCM4708 family.
  	if (xhci->quirks & XHCI_NEC_HOST)
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1912,6 +1912,7 @@ struct xhci_hcd {
+@@ -1913,6 +1913,7 @@ struct xhci_hcd {
  #define XHCI_RESET_TO_DEFAULT	BIT_ULL(44)
  #define XHCI_ZHAOXIN_TRB_FETCH	BIT_ULL(45)
  #define XHCI_ZHAOXIN_HOST	BIT_ULL(46)
diff --git a/target/linux/generic/hack-6.6/204-module_strip.patch b/target/linux/generic/hack-6.6/204-module_strip.patch
index 8619c29073..403ee11513 100644
--- a/target/linux/generic/hack-6.6/204-module_strip.patch
+++ b/target/linux/generic/hack-6.6/204-module_strip.patch
@@ -141,7 +141,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (err)
 --- a/scripts/mod/modpost.c
 +++ b/scripts/mod/modpost.c
-@@ -1692,7 +1692,9 @@ static void read_symbols(const char *mod
+@@ -1693,7 +1693,9 @@ static void read_symbols(const char *mod
  		symname = remove_dot(info.strtab + sym->st_name);
  
  		handle_symbol(mod, &info, sym, symname);
@@ -151,7 +151,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  
  	check_sec_ref(mod, &info);
-@@ -1865,8 +1867,10 @@ static void add_header(struct buffer *b,
+@@ -1866,8 +1868,10 @@ static void add_header(struct buffer *b,
  	buf_printf(b, "BUILD_SALT;\n");
  	buf_printf(b, "BUILD_LTO_INFO;\n");
  	buf_printf(b, "\n");
@@ -162,7 +162,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	buf_printf(b, "\n");
  	buf_printf(b, "__visible struct module __this_module\n");
  	buf_printf(b, "__section(\".gnu.linkonce.this_module\") = {\n");
-@@ -1880,8 +1884,10 @@ static void add_header(struct buffer *b,
+@@ -1881,8 +1885,10 @@ static void add_header(struct buffer *b,
  	buf_printf(b, "\t.arch = MODULE_ARCH_INIT,\n");
  	buf_printf(b, "};\n");
  
@@ -173,7 +173,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	buf_printf(b,
  		   "\n"
-@@ -1889,8 +1895,10 @@ static void add_header(struct buffer *b,
+@@ -1890,8 +1896,10 @@ static void add_header(struct buffer *b,
  		   "MODULE_INFO(retpoline, \"Y\");\n"
  		   "#endif\n");
  
@@ -184,7 +184,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (strstarts(mod->name, "tools/testing"))
  		buf_printf(b, "\nMODULE_INFO(test, \"Y\");\n");
-@@ -2000,11 +2008,13 @@ static void add_depends(struct buffer *b
+@@ -2001,11 +2009,13 @@ static void add_depends(struct buffer *b
  
  static void add_srcversion(struct buffer *b, struct module *mod)
  {
@@ -198,7 +198,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  static void write_buf(struct buffer *b, const char *fname)
-@@ -2087,7 +2097,9 @@ static void write_mod_c_file(struct modu
+@@ -2088,7 +2098,9 @@ static void write_mod_c_file(struct modu
  	add_exported_symbols(&buf, mod);
  	add_versions(&buf, mod);
  	add_depends(&buf, mod);
diff --git a/target/linux/generic/hack-6.6/790-SFP-GE-T-ignore-TX_FAULT.patch b/target/linux/generic/hack-6.6/790-SFP-GE-T-ignore-TX_FAULT.patch
index d48f382ce5..a4d84f8b7d 100644
--- a/target/linux/generic/hack-6.6/790-SFP-GE-T-ignore-TX_FAULT.patch
+++ b/target/linux/generic/hack-6.6/790-SFP-GE-T-ignore-TX_FAULT.patch
@@ -36,7 +36,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	// Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report
  	// 2500MBd NRZ in their EEPROM
  	SFP_QUIRK_M("Lantech", "8330-262D-E", sfp_quirk_2500basex),
-@@ -2587,7 +2590,8 @@ static void sfp_sm_main(struct sfp *sfp,
+@@ -2586,7 +2589,8 @@ static void sfp_sm_main(struct sfp *sfp,
  			 * or t_start_up, so assume there is a fault.
  			 */
  			sfp_sm_fault(sfp, SFP_S_INIT_TX_FAULT,
@@ -46,7 +46,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		} else if (event == SFP_E_TIMEOUT || event == SFP_E_TX_CLEAR) {
  	init_done:
  			/* Create mdiobus and start trying for PHY */
-@@ -2841,10 +2845,12 @@ static void sfp_check_state(struct sfp *
+@@ -2840,10 +2844,12 @@ static void sfp_check_state(struct sfp *
  	mutex_lock(&sfp->st_mutex);
  	state = sfp_get_state(sfp);
  	changed = state ^ sfp->state;
diff --git a/target/linux/generic/pending-6.6/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/target/linux/generic/pending-6.6/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
index 334460f9e6..77a16bad9a 100644
--- a/target/linux/generic/pending-6.6/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
+++ b/target/linux/generic/pending-6.6/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -157,7 +157,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	case RTN_THROW:
  	case RTN_UNREACHABLE:
  	default:
-@@ -4543,6 +4562,17 @@ static int ip6_pkt_prohibit_out(struct n
+@@ -4544,6 +4563,17 @@ static int ip6_pkt_prohibit_out(struct n
  	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
  }
  
@@ -175,7 +175,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  /*
   *	Allocate a dst for local (unicast / anycast) address.
   */
-@@ -5034,7 +5064,8 @@ static int rtm_to_fib6_config(struct sk_
+@@ -5035,7 +5065,8 @@ static int rtm_to_fib6_config(struct sk_
  	if (rtm->rtm_type == RTN_UNREACHABLE ||
  	    rtm->rtm_type == RTN_BLACKHOLE ||
  	    rtm->rtm_type == RTN_PROHIBIT ||
@@ -185,7 +185,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		cfg->fc_flags |= RTF_REJECT;
  
  	if (rtm->rtm_type == RTN_LOCAL)
-@@ -6281,6 +6312,8 @@ static int ip6_route_dev_notify(struct n
+@@ -6282,6 +6313,8 @@ static int ip6_route_dev_notify(struct n
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
  		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
@@ -194,7 +194,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
  		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
  #endif
-@@ -6292,6 +6325,7 @@ static int ip6_route_dev_notify(struct n
+@@ -6293,6 +6326,7 @@ static int ip6_route_dev_notify(struct n
  		in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
@@ -202,7 +202,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
  #endif
  	}
-@@ -6492,6 +6526,8 @@ static int __net_init ip6_route_net_init
+@@ -6493,6 +6527,8 @@ static int __net_init ip6_route_net_init
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	net->ipv6.fib6_has_custom_rules = false;
@@ -211,7 +211,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
  					       sizeof(*net->ipv6.ip6_prohibit_entry),
  					       GFP_KERNEL);
-@@ -6502,11 +6538,21 @@ static int __net_init ip6_route_net_init
+@@ -6503,11 +6539,21 @@ static int __net_init ip6_route_net_init
  			 ip6_template_metrics, true);
  	INIT_LIST_HEAD(&net->ipv6.ip6_prohibit_entry->dst.rt_uncached);
  
@@ -234,7 +234,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
  	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
  			 ip6_template_metrics, true);
-@@ -6533,6 +6579,8 @@ out:
+@@ -6534,6 +6580,8 @@ out:
  	return ret;
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -243,7 +243,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  out_ip6_prohibit_entry:
  	kfree(net->ipv6.ip6_prohibit_entry);
  out_ip6_null_entry:
-@@ -6552,6 +6600,7 @@ static void __net_exit ip6_route_net_exi
+@@ -6553,6 +6601,7 @@ static void __net_exit ip6_route_net_exi
  	kfree(net->ipv6.ip6_null_entry);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	kfree(net->ipv6.ip6_prohibit_entry);
@@ -251,7 +251,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	kfree(net->ipv6.ip6_blk_hole_entry);
  #endif
  	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
-@@ -6635,6 +6684,9 @@ void __init ip6_route_init_special_entri
+@@ -6636,6 +6685,9 @@ void __init ip6_route_init_special_entri
  	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
  	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
diff --git a/target/linux/generic/pending-6.6/779-net-vxlan-don-t-learn-non-unicast-L2-destinations.patch b/target/linux/generic/pending-6.6/779-net-vxlan-don-t-learn-non-unicast-L2-destinations.patch
deleted file mode 100644
index 551855a229..0000000000
--- a/target/linux/generic/pending-6.6/779-net-vxlan-don-t-learn-non-unicast-L2-destinations.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 3f1a227cb071f65f6ecc4db9f399649869735a7c Mon Sep 17 00:00:00 2001
-From: David Bauer <mail@david-bauer.net>
-Date: Sat, 17 Feb 2024 22:34:59 +0100
-Subject: [PATCH] net vxlan: don't learn non-unicast L2 destinations
-
-This patch avoids learning non-unicast targets in the vxlan FDB.
-They are non-unicast and thus should be sent to the broadcast-IPv6
-instead of a unicast address.
-
-Link: https://lore.kernel.org/netdev/15ee0cc7-9252-466b-8ce7-5225d605dde8@david-bauer.net/
-Link: https://github.com/freifunk-gluon/gluon/issues/3191
-
-Signed-off-by: David Bauer <mail@david-bauer.net>
----
- drivers/net/vxlan.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/drivers/net/vxlan/vxlan_core.c
-+++ b/drivers/net/vxlan/vxlan_core.c
-@@ -1446,6 +1446,10 @@ static bool vxlan_snoop(struct net_devic
- 	struct vxlan_fdb *f;
- 	u32 ifindex = 0;
- 
-+	/* Don't learn broadcast packets */
-+	if (is_multicast_ether_addr(src_mac) || is_zero_ether_addr(src_mac))
-+		return false;
-+
- #if IS_ENABLED(CONFIG_IPV6)
- 	if (src_ip->sa.sa_family == AF_INET6 &&
- 	    (ipv6_addr_type(&src_ip->sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL))
diff --git a/target/linux/ipq40xx/patches-6.6/004-v6.7-firmware-qcom_scm-disable-SDI-if-required.patch b/target/linux/ipq40xx/patches-6.6/004-v6.7-firmware-qcom_scm-disable-SDI-if-required.patch
index a296d8c9a2..9df758ae1b 100644
--- a/target/linux/ipq40xx/patches-6.6/004-v6.7-firmware-qcom_scm-disable-SDI-if-required.patch
+++ b/target/linux/ipq40xx/patches-6.6/004-v6.7-firmware-qcom_scm-disable-SDI-if-required.patch
@@ -57,7 +57,7 @@ Signed-off-by: Bjorn Andersson <andersson@kernel.org>
  static int __qcom_scm_set_dload_mode(struct device *dev, bool enable)
  {
  	struct qcom_scm_desc desc = {
-@@ -1467,6 +1490,13 @@ static int qcom_scm_probe(struct platfor
+@@ -1473,6 +1496,13 @@ static int qcom_scm_probe(struct platfor
  
  	__get_convention();
  
diff --git a/target/linux/ipq40xx/patches-6.6/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch b/target/linux/ipq40xx/patches-6.6/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch
index 8cb424c050..26cd0e0309 100644
--- a/target/linux/ipq40xx/patches-6.6/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch
+++ b/target/linux/ipq40xx/patches-6.6/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch
@@ -15,7 +15,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 
 --- a/drivers/firmware/qcom_scm.c
 +++ b/drivers/firmware/qcom_scm.c
-@@ -1522,7 +1522,8 @@ static int qcom_scm_probe(struct platfor
+@@ -1528,7 +1528,8 @@ static int qcom_scm_probe(struct platfor
  static void qcom_scm_shutdown(struct platform_device *pdev)
  {
  	/* Clean shutdown, disable download mode to allow normal restart */