Minor changes in changelog

Changelog: Prepare for release 25.03.01
Fix migration when SSH server settings exist
2026-07-29 20:23:01 +02:00 · 2025-04-11 16:27:01 +02:00 · 2025-04-11 14:09:57 +02:00 · 2025-04-11 14:05:53 +02:00 · 2025-04-11 14:04:38 +02:00 · 2025-04-11 14:04:24 +02:00
180 changed files with 3600 additions and 893 deletions
@@ -95,11 +95,6 @@ jobs:
          name: artifact-${{ matrix.target }}
          path: output/*.tar.gz

-      - uses: actions/upload-artifact@v4
-        with:
-          name: artifact-disk-image-${{ matrix.target }}
-          path: output/images/*.qcow2
-
  release:
    name: Release Infix ${{ github.ref_name }}
    needs: build
@@ -146,11 +141,6 @@ jobs:
          for file in *.tar.gz; do
              sha256sum $file > $file.sha256
          done
-          if ls *.qcow2 &>/dev/null; then
-            for file in *.qcow2; do
-              sha256sum "$file" > "$file.sha256"
-            done
-          fi

      - name: Extract ChangeLog entry ...
        run: |
@@ -165,7 +155,7 @@ jobs:
          makeLatest: ${{ steps.rel.outputs.latest }}
          discussionCategory: ${{ steps.rel.outputs.cat }}
          bodyFile:  release.md
-          artifacts: "*.tar.gz*,*.qcow2*"
+          artifacts: "*.tar.gz*"

      - name: Summary
        run: |
@@ -230,6 +230,7 @@ CONFIG_MAC80211_LEDS=y
 CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
+# CONFIG_ETHTOOL_NETLINK is not set
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
@@ -480,6 +481,7 @@ CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_GPIO=m
 CONFIG_I2C_RK3X=y
 CONFIG_I2C_SLAVE=y
@@ -127,7 +127,7 @@ bootdata=
 diskimg=disk.img
 bootimg=
 bootpart=
-tmpimage=$(mktemp)
+
 while getopts "a:b:B:n:s:" opt; do
    case ${opt} in
 	a)
@@ -166,7 +166,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vdiskimg=$tmpimage \
+	  -vdiskimg=$diskimg \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -211,7 +211,5 @@ genimage \
    --rootpath "$root" \
    --tmppath  "$tmp" \
    --inputpath "$BINARIES_DIR" \
+    --outputpath "$BINARIES_DIR" \
    --config "$root/genimage.cfg"
-
-qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
-rm "$tmpimage"
@@ -23,7 +23,7 @@ if [ -n "$IMAGE_ID" ]; then
 else
    NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
 fi
-diskimg=disk.qcow2
+diskimg=disk.img

 ver()
 {
@@ -48,7 +48,7 @@ fi
 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
    ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk$(ver).qcow2"
+    diskimg="${NAME}-disk$(ver).img"
    bootcfg=
    if [ "$DISK_IMAGE_BOOT_DATA" ]; then
 	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
@@ -120,7 +120,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=qemu.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
+	echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
    fi
 }

@@ -316,13 +316,13 @@ gdb_args()
 run_qemu()
 {
    if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	if ! qemu-img check "qemu.qcow2"; then
-	    rm -f "qemu.qcow2"
+	if ! qemu-img check "${CONFIG_QEMU_ROOTFS}.qcow2"; then
+	    rm -f "${CONFIG_QEMU_ROOTFS}.qcow2"
 	fi
-	if [ ! -f "qemu.qcow2" ]; then
+	if [ ! -f "${CONFIG_QEMU_ROOTFS}.qcow2" ]; then
 	    echo "Creating qcow2 disk image for Qemu ..."
 	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
-		     -F qcow2 "qemu.qcow2" > /dev/null
+		     -F raw "${CONFIG_QEMU_ROOTFS}.qcow2" > /dev/null
 	fi
    fi

@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.21"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -139,7 +139,6 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -165,7 +164,6 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 DISK_IMAGE_BOOT_BIN=y
@@ -27,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.21"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -119,7 +119,6 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -138,7 +137,6 @@ BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -8,6 +8,7 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -29,7 +30,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.10.3"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
@@ -73,6 +74,7 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
+BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
@@ -176,7 +178,6 @@ INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -200,9 +201,8 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set
@@ -169,7 +169,6 @@ BR2_PACKAGE_CONFD=y
 # BR2_PACKAGE_CONFD_TEST_MODE is not set
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -195,7 +194,6 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.21"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -141,7 +141,6 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -167,7 +166,6 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 GNS3_APPLIANCE_RAM=512
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.23"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.21"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -123,7 +123,6 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
-BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -141,7 +140,6 @@ BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 GNS3_APPLIANCE_RAM=512
@@ -3,21 +3,12 @@ Change Log

 All notable changes to the project are documented in this file.

-
-[v25.04.0][UNRELEASED]
+[v25.03.1][] - 2025-04-11
 -------------------------

-### Changes
- - Upgrade Linux kernel to 6.12.23 (LTS)
- - Format for disk image (for QEMU) has changed to `qcow2`
-
 ### Fixes
- - Fix #1002: Broken symlink in release package
- - Fix #1006: NanoPi R2S corrupt startup, regression in Infix v25.02.0
-   - Bump R2S kernel, now same as tier one boards
- - Fix #1015: Not possible to save custom SSH settings in startup-config
- - Fix group owner and permissions of `/cfg/backup` directory
- - Fix extraction of old version for `/cfg/backup/` files
+ - Fix configuration migration issues when upgrading
+

 [v25.03.0][] - 2025-03-31
 -------------------------
@@ -1545,7 +1536,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:

 [buildroot]:  https://buildroot.org/
 [UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.03.0...HEAD
-[v25.04.0]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
+[v25.03.1]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.03.1
 [v25.03.0]:   https://github.com/kernelkit/infix/compare/v25.02.0...v25.03.0
 [v25.02.0]:   https://github.com/kernelkit/infix/compare/v25.01.0...v25.02.0
 [v25.01.0]:   https://github.com/kernelkit/infix/compare/v24.11.0...v25.01.0
@@ -131,8 +131,6 @@ This rebuilds (and installs) `foo` and `bar`, the `all` target calls
 on Buildroot to finalize the target filesystem and generate the images.
 The final `run` argument is explained below.

-
-
 ### `confd`

 The Infix `src/confd/` is the engine of the system.  Currently it is a
@@ -219,24 +217,21 @@ structure of an existing one. However, before making any changes, **always discu
 them with the Infix core team**. This helps avoid issues later in development and 
 makes pull request reviews smoother.

-
 Testing
 -------

 Manual testing can be done using Qemu by calling <kbd>make run</kbd>,
-see also [Infix in Virtual Environments](virtual.md), or on a physical
-device by upgrading to the latest build or "[netbooting](netboot.md)"
-and running the image from RAM.  The latter is how most board porting
-work is done -- **much quicker** change-load-test cycles.
+see also [Infix in Virtual Environments](virtual.md).

 The Infix automated test suite is built around Qemu and [Qeneth][2], see:

 * [Testing](testing.md)
 * [Docker Image](../test/docker/README.md)

-With any new feature added to Infix, it is essential to include relevant
-test case(s).  See the [Test Development](testing.md#test-development)
-section for guidance on adding test cases.
+With any new feature added to Infix, it is essential to include a 
+relevant test case. See the 
+[Test Development](testing.md#test-development) section for guidance
+on adding test cases.


 Reviewing
@@ -1,130 +0,0 @@
-Netboot HowTo
-=============
-
-This document describes how to set up network booting U-Boot devices on
-a LAN, e.g., when working with an evaluation board or other embedded
-system.  The most secure way to do this is with a local LAN between a PC
-and the device.
-
-Instead of setting up everything in U-Boot to download the Linux Image,
-device tree, and initramfs, we will let U-Boot download a script with
-instructions to run.  When you have multiple systems (boards) this
-quickly becomes a lot easier to manage.
-
-> [!NOTE]
-> Instructions in this HowTo assume a Debian based development system,
-> e.g., Ubuntu or Linux Mint.
-
-
-## Network Interface Setup
-
-For two dedicated network interfaces, here `eth2` and `eth3` (ymmv), we
-create an old-style interfaces config[^1] with the following content:
-
-```
-# /etc/network/interfaces.d/gimli
-auto eth2
-iface eth2 inet static
-        address 192.168.0.1
-        netmask 255.255.255.0
-
-auto eth3
-iface eth3 inet manual
-```
-
-> [!TIP]
-> Use configuration file names in `.d/` directories that make sense and
-> can easily be remembered.  Here we use the hostname of the PC.
-
-
-## DHCP/TFTP Server Setup
-
-The examples given here use `dnsmasq`, which provides both DHCP and TFTP
-server support.  The same can be achieved with other implementations.
-
-Similar to `interfaces.d`, dnsmasq has an `/etc/dnsmasq.d` directory so
-we can use "snippets" instead of modifying `/etc/dnsmasq.conf` directly.
-Add a file called `/etc/dnsmasq.d/gimli`.
-
-Initial content:
-
-```
-# Remember IP address handed out to BOOTP clients
-bootp-dynamic
-# Disable check-if-ip-address-is-already-used
-no-ping
-
-# Enable TFTP server, use /srv/ftp, same as any FTP server, useful
-# when using the same images for system upgrade as for netbooting.
-enable-tftp
-tftp-root=/srv/ftp
-```
-
-> [!CAUTION]
-> First of all, make sure you DO NOT accidentally set up dnsmasq so that
-> it starts acting as a DHCP server also on your office LAN!  Follow the
-> instructions below for more details.
-
-If you have many interfaces used for lab equipment and only one office
-LAN interface, then use something like this:
-
-```
-# Disable DHCP server on loopback and office LAN (eth0)
-except-interface=lo
-except-interface=eth0
-```
-
-To further lock this down, we only run the DHCP server on each of the
-interfaces used for lab equipment, with a dedicated IP range as well:
-
-```
-# Currently I have an imx8mp-evk on eth2, so on my system I have a
-# symlink bootfile-eth2 -> netboot.scr
-interface=eth2
-dhcp-range=192.168.0.100,192.168.0.199,1h
-dhcp-boot=tag:eth2,bootfile-eth2
-```
-
-## Bootfile netboot.scr
-
-The bootfile U-Boot retrieves from the TFTP server is a script that
-looks like this, `netboot.sh`:
-
-```sh
-setenv ramdisk_addr_r 0x58000000
-setenv fdt_addr_r     0x50400000
-
-setenv autoboot off
-tftp ${fdt_addr_r}     imx8mp-evk/imx8mp-evk.dtb
-tftp ${kernel_addr_r}  imx8mp-evk/Image
-tftp ${ramdisk_addr_r} imx8mp-evk/rootfs.squashfs
-
-setenv bootargs console=ttymxc1,115200 root=/dev/ram0 brd.rd_size=500000 rauc.slot=net
-booti ${kernel_addr_r} ${ramdisk_addr_r}:${filesize} ${fdt_addr_r}
-```
-
-U-Boot cannot read script files directly, so we need to wrap it with a
-FIT format header, this is done by first converting it on the PC:
-
-```
-$ mkimage -T script -d netboot.sh netboot.scr
-```
-
-The output is `netboot.scr` which we symlink to above in the dnsmasq
-setup step.
-
-
-## U-Boot Commands
-
-U-Boot is a maze of environment variables, some with values, some wrap
-commands, and most are undocumented.  We will use a prefix for our
-variables to ensure we do not overwrite anything you may want to use
-later.
-
-```sh
-==> setenv ixboot 'dhcp && source \${fileaddr}'
-==> saveenv
-```
-
-
-[^1]: To prevent NetworkManager from automatically managing the interfaces.
@@ -34,7 +34,6 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/python-libyang/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/python-statd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/python-yangdoc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/skeleton-init-finit/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/show/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/tetris/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/libyang-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-cpp/Config.in"
@@ -35,30 +35,13 @@ define CONFD_INSTALL_EXTRA
 	cp $(CONFD_PKGDIR)/avahi.service $(TARGET_DIR)/etc/avahi/services/netconf.service
 endef

-NETOPEER2_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/netopeer2/
-SYSREPO_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/sysrepo/
-LIBNETCONF2_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/libnetconf2/
-CONFD_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/confd/
-TEST_MODE_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/test-mode/
-ROUSETTE_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/rousette/
 COMMON_SYSREPO_ENV = \
 	SYSREPO_SHM_PREFIX=$(CONFD_SYSREPO_SHM_PREFIX) \
 	SYSREPOCTL_EXECUTABLE="$(HOST_DIR)/bin/sysrepoctl" \
 	SYSREPOCFG_EXECUTABLE="$(HOST_DIR)/bin/sysrepocfg" \
-	SEARCH_PATH="$(NETOPEER2_SEARCHPATH) $(SYSREPO_SEARCHPATH) $(LIBNETCONF2_SEARCHPATH) $(TEST_MODE_SEARCHPATH) $(CONFD_SEARCHPATH) $(ROUSETTE_SEARCHPATH)"
-
+	SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/confd/"

 define CONFD_INSTALL_YANG_MODULES
-	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/sysrepo.inc
-	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/libnetconf2.inc
-	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/netopeer2.inc
-	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/rousette.inc
-	$(COMMON_SYSREPO_ENV) \
-	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/test-mode.inc
 	$(COMMON_SYSREPO_ENV) \
 	$(BR2_EXTERNAL_INFIX_PATH)/utils/srload $(@D)/yang/confd.inc
 endef
@@ -74,13 +57,11 @@ define CONFD_PERMISSIONS
 	/etc/sysrepo/data/ r 660 root wheel - - - - -
 	/etc/sysrepo/data  d 770 root wheel - - - - -
 endef
-define CONFD_EMPTY_SYSREPO
-	rm -rf $(TARGET_DIR)/etc/sysrepo/data/
-endef
+
 define CONFD_CLEANUP
 	rm -f /dev/shm/$(CONFD_SYSREPO_SHM_PREFIX)*
 endef
-CONFD_PRE_INSTALL_TARGET_HOOKS += CONFD_EMPTY_SYSREPO
+
 CONFD_PRE_INSTALL_TARGET_HOOKS += CONFD_CLEANUP
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_EXTRA
 CONFD_POST_INSTALL_TARGET_HOOKS += CONFD_INSTALL_YANG_MODULES
@@ -1,6 +0,0 @@
-config BR2_PACKAGE_SHOW
-	bool "show"
-	help
-	  Tool to retrieve and present operational data from sysrepo.
-
-	  https://github.com/kernelkit/infix
@@ -1,19 +0,0 @@
-################################################################################
-#
-# show
-#
-################################################################################
-
-SHOW_VERSION = 1.0
-SHOW_LICENSE = MIT
-SHOW_LICENSE_FILES = LICENSE
-SHOW_SITE_METHOD = local
-SHOW_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/show
-SHOW_REDISTRIBUTE = NO
-
-define SHOW_INSTALL_TARGET_CMDS
-	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D) \
-		DESTDIR="$(TARGET_DIR)" install
-endef
-
-$(eval $(generic-package))
@@ -0,0 +1,236 @@
+From c2251e09714b9715ee5ece18aa1096bc08cb8f6d Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Mon, 4 Mar 2024 16:47:28 +0100
+Subject: [PATCH 1/5] net: bridge: avoid classifying unknown multicast as
+ mrouters_only
+Organization: Addiva Elektronik
+
+Unknown multicast, MAC/IPv4/IPv6, should always be flooded according to
+the per-port mcast_flood setting, as well as to detected and configured
+mcast_router ports.
+
+This patch drops the mrouters_only classifier of unknown IP multicast
+and moves the flow handling from br_multicast_flood() to br_flood().
+This in turn means br_flood() must know about multicast router ports.
+Because a multicast router should always receive both known and unknown
+multicast.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ include/uapi/linux/if_bridge.h |  1 +
+ net/bridge/br.c                |  5 +++++
+ net/bridge/br_device.c         | 10 ++++++----
+ net/bridge/br_forward.c        | 14 ++++++++++++--
+ net/bridge/br_input.c          |  2 +-
+ net/bridge/br_multicast.c      | 11 +++++++++--
+ net/bridge/br_private.h        | 18 ++++++++++++++++--
+ 7 files changed, 50 insertions(+), 11 deletions(-)
+
+diff --git a/include/uapi/linux/if_bridge.h b/include/uapi/linux/if_bridge.h
+index a5b743a2f775..3bffc39d7800 100644
+--- a/include/uapi/linux/if_bridge.h
+++ b/include/uapi/linux/if_bridge.h
+@@ -830,6 +830,7 @@ enum br_boolopt_id {
+ 	BR_BOOLOPT_NO_LL_LEARN,
+ 	BR_BOOLOPT_MCAST_VLAN_SNOOPING,
+ 	BR_BOOLOPT_MST_ENABLE,
+	BR_BOOLOPT_MCAST_FLOOD_ALWAYS,
+ 	BR_BOOLOPT_MAX
+ };
+ 
+diff --git a/net/bridge/br.c b/net/bridge/br.c
+index 2cab878e0a39..006fb2e5eafb 100644
+--- a/net/bridge/br.c
+++ b/net/bridge/br.c
+@@ -277,6 +277,9 @@ int br_boolopt_toggle(struct net_bridge *br, enum br_boolopt_id opt, bool on,
+ 	case BR_BOOLOPT_MST_ENABLE:
+ 		err = br_mst_set_enabled(br, on, extack);
+ 		break;
+	case BR_BOOLOPT_MCAST_FLOOD_ALWAYS:
+		br_opt_toggle(br, BROPT_MCAST_FLOOD_ALWAYS, on);
+		break;
+ 	default:
+ 		/* shouldn't be called with unsupported options */
+ 		WARN_ON(1);
+@@ -295,6 +298,8 @@ int br_boolopt_get(const struct net_bridge *br, enum br_boolopt_id opt)
+ 		return br_opt_get(br, BROPT_MCAST_VLAN_SNOOPING_ENABLED);
+ 	case BR_BOOLOPT_MST_ENABLE:
+ 		return br_opt_get(br, BROPT_MST_ENABLED);
+	case BR_BOOLOPT_MCAST_FLOOD_ALWAYS:
+		return br_opt_get(br, BROPT_MCAST_FLOOD_ALWAYS);
+ 	default:
+ 		/* shouldn't be called with unsupported options */
+ 		WARN_ON(1);
+diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
+index fb1115857e49..6aac21d86d37 100644
+--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
+@@ -87,10 +87,10 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
+ 
+ 	dest = eth_hdr(skb)->h_dest;
+ 	if (is_broadcast_ether_addr(dest)) {
+-		br_flood(br, skb, BR_PKT_BROADCAST, false, true, vid);
+		br_flood(br, skb, NULL, BR_PKT_BROADCAST, false, true, vid);
+ 	} else if (is_multicast_ether_addr(dest)) {
+ 		if (unlikely(netpoll_tx_running(dev))) {
+-			br_flood(br, skb, BR_PKT_MULTICAST, false, true, vid);
+			br_flood(br, skb, brmctx, BR_PKT_MULTICAST, false, true, vid);
+ 			goto out;
+ 		}
+ 		if (br_multicast_rcv(&brmctx, &pmctx_null, vlan, skb, vid)) {
+@@ -103,11 +103,11 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		    br_multicast_querier_exists(brmctx, eth_hdr(skb), mdst))
+ 			br_multicast_flood(mdst, skb, brmctx, false, true);
+ 		else
+-			br_flood(br, skb, BR_PKT_MULTICAST, false, true, vid);
+			br_flood(br, skb, brmctx, BR_PKT_MULTICAST, false, true, vid);
+ 	} else if ((dst = br_fdb_find_rcu(br, dest, vid)) != NULL) {
+ 		br_forward(dst->dst, skb, false, true);
+ 	} else {
+-		br_flood(br, skb, BR_PKT_UNICAST, false, true, vid);
+		br_flood(br, skb, NULL, BR_PKT_UNICAST, false, true, vid);
+ 	}
+ out:
+ 	rcu_read_unlock();
+@@ -524,6 +524,8 @@ void br_dev_setup(struct net_device *dev)
+ 	br->bridge_ageing_time = br->ageing_time = BR_DEFAULT_AGEING_TIME;
+ 	dev->max_mtu = ETH_MAX_MTU;
+ 
+	br_opt_toggle(br, BROPT_MCAST_FLOOD_ALWAYS, false);
+
+ 	br_netfilter_rtable_init(br);
+ 	br_stp_timer_init(br);
+ 	br_multicast_init(br);
+diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
+index e19b583ff2c6..1094364d96e0 100644
+--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
+@@ -198,14 +198,19 @@ static struct net_bridge_port *maybe_deliver(
+ 
+ /* called under rcu_read_lock */
+ void br_flood(struct net_bridge *br, struct sk_buff *skb,
+-	      enum br_pkt_type pkt_type, bool local_rcv, bool local_orig,
+-	      u16 vid)
+	      struct net_bridge_mcast *brmctx, enum br_pkt_type pkt_type,
+	      bool local_rcv, bool local_orig, u16 vid)
+ {
+	struct net_bridge_port *rport = NULL;
+ 	struct net_bridge_port *prev = NULL;
+	struct hlist_node *rp = NULL;
+ 	struct net_bridge_port *p;
+ 
+ 	br_tc_skb_miss_set(skb, pkt_type != BR_PKT_BROADCAST);
+ 
+	if (pkt_type == BR_PKT_MULTICAST)
+		rp = br_multicast_get_first_rport_node(brmctx, skb);
+
+ 	list_for_each_entry_rcu(p, &br->port_list, list) {
+ 		/* Do not flood unicast traffic to ports that turn it off, nor
+ 		 * other traffic if flood off, except for traffic we originate
+@@ -216,6 +221,11 @@ void br_flood(struct net_bridge *br, struct sk_buff *skb,
+ 				continue;
+ 			break;
+ 		case BR_PKT_MULTICAST:
+			rport = br_multicast_rport_from_node_skb(rp, skb);
+			if (rport == p) {
+				rp = rcu_dereference(hlist_next_rcu(rp));
+				break;
+			}
+ 			if (!(p->flags & BR_MCAST_FLOOD) && skb->dev != br->dev)
+ 				continue;
+ 			break;
+diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
+index ceaa5a89b947..e54d648db7de 100644
+--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
+@@ -212,7 +212,7 @@ int br_handle_frame_finish(struct net *net, struct sock *sk, struct sk_buff *skb
+ 		br_forward(dst->dst, skb, local_rcv, false);
+ 	} else {
+ 		if (!mcast_hit)
+-			br_flood(br, skb, pkt_type, local_rcv, false, vid);
+			br_flood(br, skb, brmctx, pkt_type, local_rcv, false, vid);
+ 		else
+ 			br_multicast_flood(mdst, skb, brmctx, local_rcv, false);
+ 	}
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 9a1cb5079a7a..dc49df4f92a8 100644
+--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
+@@ -3776,6 +3776,11 @@ static void br_multicast_err_count(const struct net_bridge *br,
+ 	u64_stats_update_end(&pstats->syncp);
+ }
+ 
+static bool br_flood_mrouters(const struct net_bridge *br)
+{
+	return br_opt_get(br, BROPT_MCAST_FLOOD_ALWAYS) ? false : true;
+}
+
+ static void br_multicast_pim(struct net_bridge_mcast *brmctx,
+ 			     struct net_bridge_mcast_port *pmctx,
+ 			     const struct sk_buff *skb)
+@@ -3822,7 +3827,8 @@ static int br_multicast_ipv4_rcv(struct net_bridge_mcast *brmctx,
+ 
+ 	if (err == -ENOMSG) {
+ 		if (!ipv4_is_local_multicast(ip_hdr(skb)->daddr)) {
+-			BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
+			BR_INPUT_SKB_CB(skb)->mrouters_only =
+				br_flood_mrouters(brmctx->br);
+ 		} else if (pim_ipv4_all_pim_routers(ip_hdr(skb)->daddr)) {
+ 			if (ip_hdr(skb)->protocol == IPPROTO_PIM)
+ 				br_multicast_pim(brmctx, pmctx, skb);
+@@ -3891,7 +3897,8 @@ static int br_multicast_ipv6_rcv(struct net_bridge_mcast *brmctx,
+ 
+ 	if (err == -ENOMSG || err == -ENODATA) {
+ 		if (!ipv6_addr_is_ll_all_nodes(&ipv6_hdr(skb)->daddr))
+-			BR_INPUT_SKB_CB(skb)->mrouters_only = 1;
+			BR_INPUT_SKB_CB(skb)->mrouters_only =
+				br_flood_mrouters(brmctx->br);
+ 		if (err == -ENODATA &&
+ 		    ipv6_addr_is_all_snoopers(&ipv6_hdr(skb)->daddr))
+ 			br_ip6_multicast_mrd_rcv(brmctx, pmctx, skb);
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index d4bedc87b1d8..dfd6e2cdd13e 100644
+--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
+@@ -483,6 +483,7 @@ enum net_bridge_opts {
+ 	BROPT_VLAN_BRIDGE_BINDING,
+ 	BROPT_MCAST_VLAN_SNOOPING_ENABLED,
+ 	BROPT_MST_ENABLED,
+	BROPT_MCAST_FLOOD_ALWAYS,
+ };
+ 
+ struct net_bridge {
+@@ -886,8 +887,8 @@ void br_forward(const struct net_bridge_port *to, struct sk_buff *skb,
+ 		bool local_rcv, bool local_orig);
+ int br_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb);
+ void br_flood(struct net_bridge *br, struct sk_buff *skb,
+-	      enum br_pkt_type pkt_type, bool local_rcv, bool local_orig,
+-	      u16 vid);
+	      struct net_bridge_mcast *brmctx, enum br_pkt_type pkt_type,
+	      bool local_rcv, bool local_orig, u16 vid);
+ 
+ /* return true if both source port and dest port are isolated */
+ static inline bool br_skb_isolated(const struct net_bridge_port *to,
+@@ -1408,6 +1409,19 @@ static inline void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
+ {
+ }
+ 
+static inline struct hlist_node *
+br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
+				  struct sk_buff *skb)
+{
+	return NULL;
+}
+
+static inline struct net_bridge_port *
+br_multicast_rport_from_node_skb(struct hlist_node *rp, struct sk_buff *skb)
+{
+	return NULL;
+}
+
+ static inline bool br_multicast_is_router(struct net_bridge_mcast *brmctx,
+ 					  struct sk_buff *skb)
+ {
+-- 
+2.43.0
+
@@ -0,0 +1,37 @@
+From 75edfa9b690b65423aa3e63ed5870d565950d9bb Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Tue, 5 Mar 2024 06:44:41 +0100
+Subject: [PATCH 2/5] net: bridge: Ignore router ports when forwarding L2
+ multicast
+Organization: Addiva Elektronik
+
+Multicast router ports are either statically configured or learned from
+control protocol traffic (IGMP/MLD/PIM).  These protocols regulate IP
+multicast -- MAC multicast should always be forwarded through flooding
+of unknown multicast or using permanent MDB entries.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ net/bridge/br_private.h | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index dfd6e2cdd13e..7aabf8bd7da2 100644
+--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
+@@ -1086,7 +1086,10 @@ br_multicast_get_first_rport_node(struct net_bridge_mcast *brmctx,
+ 	if (skb->protocol == htons(ETH_P_IPV6))
+ 		return rcu_dereference(hlist_first_rcu(&brmctx->ip6_mc_router_list));
+ #endif
+-	return rcu_dereference(hlist_first_rcu(&brmctx->ip4_mc_router_list));
+	if (skb->protocol == htons(ETH_P_IP))
+		return rcu_dereference(hlist_first_rcu(&brmctx->ip4_mc_router_list));
+
+	return NULL;
+ }
+ 
+ static inline struct net_bridge_port *
+-- 
+2.43.0
+
@@ -0,0 +1,190 @@
+From 2d2ac57a7d9354c2c1fa796659e33496fc8e918d Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Thu, 4 Apr 2024 16:36:30 +0200
+Subject: [PATCH 3/5] net: bridge: drop delay for applying strict multicast
+ filtering
+Organization: Addiva Elektronik
+
+This *local* patch drops the initial delay before applying strict multicast
+filtering, introduced in [1] and recently updated in [2].
+
+The main reason for this patch is RFC conformance and customer expectations.
+At power on we assume the querier role by default and are expected to stop
+unknown flooding as soon as we have a membership report in place, not after
+10 seconds.
+
+A proper fix for upstreaming could be to add a knob to disable the delay.
+
+[1]: https://lore.kernel.org/netdev/1375311980-25575-1-git-send-email-linus.luessing@web.de/
+[2]: https://lore.kernel.org/netdev/20240127175033.9640-1-linus.luessing@c0d3.blue/
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ net/bridge/br_multicast.c | 42 +++++++--------------------------------
+ net/bridge/br_private.h   |  4 +---
+ 2 files changed, 8 insertions(+), 38 deletions(-)
+
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index dc49df4f92a8..47c0625c5553 100644
+--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
+@@ -1762,10 +1762,6 @@ static void br_ip6_multicast_querier_expired(struct timer_list *t)
+ }
+ #endif
+ 
+-static void br_multicast_query_delay_expired(struct timer_list *t)
+-{
+-}
+-
+ static void br_multicast_select_own_querier(struct net_bridge_mcast *brmctx,
+ 					    struct br_ip *ip,
+ 					    struct sk_buff *skb)
+@@ -3198,12 +3194,8 @@ int br_multicast_dump_querier_state(struct sk_buff *skb,
+ 
+ static void
+ br_multicast_update_query_timer(struct net_bridge_mcast *brmctx,
+-				struct bridge_mcast_other_query *query,
+-				unsigned long max_delay)
+				struct bridge_mcast_other_query *query)
+ {
+-	if (!timer_pending(&query->timer))
+-		mod_timer(&query->delay_timer, jiffies + max_delay);
+-
+ 	mod_timer(&query->timer, jiffies + brmctx->multicast_querier_interval);
+ }
+ 
+@@ -3394,13 +3386,12 @@ static void
+ br_ip4_multicast_query_received(struct net_bridge_mcast *brmctx,
+ 				struct net_bridge_mcast_port *pmctx,
+ 				struct bridge_mcast_other_query *query,
+-				struct br_ip *saddr,
+-				unsigned long max_delay)
+				struct br_ip *saddr)
+ {
+ 	if (!br_multicast_select_querier(brmctx, pmctx, saddr))
+ 		return;
+ 
+-	br_multicast_update_query_timer(brmctx, query, max_delay);
+	br_multicast_update_query_timer(brmctx, query);
+ 	br_ip4_multicast_mark_router(brmctx, pmctx);
+ }
+ 
+@@ -3409,13 +3400,12 @@ static void
+ br_ip6_multicast_query_received(struct net_bridge_mcast *brmctx,
+ 				struct net_bridge_mcast_port *pmctx,
+ 				struct bridge_mcast_other_query *query,
+-				struct br_ip *saddr,
+-				unsigned long max_delay)
+				struct br_ip *saddr)
+ {
+ 	if (!br_multicast_select_querier(brmctx, pmctx, saddr))
+ 		return;
+ 
+-	br_multicast_update_query_timer(brmctx, query, max_delay);
+	br_multicast_update_query_timer(brmctx, query);
+ 	br_ip6_multicast_mark_router(brmctx, pmctx);
+ }
+ #endif
+@@ -3469,7 +3459,7 @@ static void br_ip4_multicast_query(struct net_bridge_mcast *brmctx,
+ 
+ 		br_ip4_multicast_query_received(brmctx, pmctx,
+ 						&brmctx->ip4_other_query,
+-						&saddr, max_delay);
+						&saddr);
+ 		goto out;
+ 	}
+ 
+@@ -3557,7 +3547,7 @@ static int br_ip6_multicast_query(struct net_bridge_mcast *brmctx,
+ 
+ 		br_ip6_multicast_query_received(brmctx, pmctx,
+ 						&brmctx->ip6_other_query,
+-						&saddr, max_delay);
+						&saddr);
+ 		goto out;
+ 	} else if (!group) {
+ 		goto out;
+@@ -4065,8 +4055,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
+ 		    br_ip4_multicast_local_router_expired, 0);
+ 	timer_setup(&brmctx->ip4_other_query.timer,
+ 		    br_ip4_multicast_querier_expired, 0);
+-	timer_setup(&brmctx->ip4_other_query.delay_timer,
+-		    br_multicast_query_delay_expired, 0);
+ 	timer_setup(&brmctx->ip4_own_query.timer,
+ 		    br_ip4_multicast_query_expired, 0);
+ #if IS_ENABLED(CONFIG_IPV6)
+@@ -4074,8 +4062,6 @@ void br_multicast_ctx_init(struct net_bridge *br,
+ 		    br_ip6_multicast_local_router_expired, 0);
+ 	timer_setup(&brmctx->ip6_other_query.timer,
+ 		    br_ip6_multicast_querier_expired, 0);
+-	timer_setup(&brmctx->ip6_other_query.delay_timer,
+-		    br_multicast_query_delay_expired, 0);
+ 	timer_setup(&brmctx->ip6_own_query.timer,
+ 		    br_ip6_multicast_query_expired, 0);
+ #endif
+@@ -4210,12 +4196,10 @@ static void __br_multicast_stop(struct net_bridge_mcast *brmctx)
+ {
+ 	del_timer_sync(&brmctx->ip4_mc_router_timer);
+ 	del_timer_sync(&brmctx->ip4_other_query.timer);
+-	del_timer_sync(&brmctx->ip4_other_query.delay_timer);
+ 	del_timer_sync(&brmctx->ip4_own_query.timer);
+ #if IS_ENABLED(CONFIG_IPV6)
+ 	del_timer_sync(&brmctx->ip6_mc_router_timer);
+ 	del_timer_sync(&brmctx->ip6_other_query.timer);
+-	del_timer_sync(&brmctx->ip6_other_query.delay_timer);
+ 	del_timer_sync(&brmctx->ip6_own_query.timer);
+ #endif
+ }
+@@ -4643,8 +4627,6 @@ EXPORT_SYMBOL_GPL(br_multicast_router);
+ 
+ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
+ {
+-	unsigned long max_delay;
+-
+ 	val = !!val;
+ 
+ 	spin_lock_bh(&brmctx->br->multicast_lock);
+@@ -4655,19 +4637,9 @@ int br_multicast_set_querier(struct net_bridge_mcast *brmctx, unsigned long val)
+ 	if (!val)
+ 		goto unlock;
+ 
+-	max_delay = brmctx->multicast_query_response_interval;
+-
+-	if (!timer_pending(&brmctx->ip4_other_query.timer))
+-		mod_timer(&brmctx->ip4_other_query.delay_timer,
+-			  jiffies + max_delay);
+-
+ 	br_multicast_start_querier(brmctx, &brmctx->ip4_own_query);
+ 
+ #if IS_ENABLED(CONFIG_IPV6)
+-	if (!timer_pending(&brmctx->ip6_other_query.timer))
+-		mod_timer(&brmctx->ip6_other_query.delay_timer,
+-			  jiffies + max_delay);
+-
+ 	br_multicast_start_querier(brmctx, &brmctx->ip6_own_query);
+ #endif
+ 
+diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
+index 7aabf8bd7da2..43fff09dfb71 100644
+--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
+@@ -78,7 +78,6 @@ struct bridge_mcast_own_query {
+ /* other querier */
+ struct bridge_mcast_other_query {
+ 	struct timer_list		timer;
+-	struct timer_list		delay_timer;
+ };
+ 
+ /* selected querier */
+@@ -1164,8 +1163,7 @@ __br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
+ 		own_querier_enabled = false;
+ 	}
+ 
+-	return !timer_pending(&querier->delay_timer) &&
+-	       (own_querier_enabled || timer_pending(&querier->timer));
+	return own_querier_enabled || timer_pending(&querier->timer);
+ }
+ 
+ static inline bool br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
+-- 
+2.43.0
+
@@ -0,0 +1,49 @@
+From c7818c4273ef1705d6e153f5e4eda683d68f59be Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Mon, 29 Apr 2024 15:14:51 +0200
+Subject: [PATCH 4/5] usb: core: adjust log level for unauthorized devices
+Organization: Addiva Elektronik
+
+The fact that a USB device currently is not authorized is not an error,
+so let's adjust the log level so these messages slip below radar for the
+commonly used 'quiet' log level.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ drivers/usb/core/driver.c  | 4 ++--
+ drivers/usb/core/generic.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index e02ba15f6e34..3fe4d15cd6db 100644
+--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
+@@ -335,10 +335,10 @@ static int usb_probe_interface(struct device *dev)
+ 		return error;
+ 
+ 	if (udev->authorized == 0) {
+-		dev_err(&intf->dev, "Device is not authorized for usage\n");
+		dev_warn(&intf->dev, "Device is not authorized for usage\n");
+ 		return error;
+ 	} else if (intf->authorized == 0) {
+-		dev_err(&intf->dev, "Interface %d is not authorized for usage\n",
+		dev_warn(&intf->dev, "Interface %d is not authorized for usage\n",
+ 				intf->altsetting->desc.bInterfaceNumber);
+ 		return error;
+ 	}
+diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
+index b134bff5c3fe..60575a01a810 100644
+--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
+@@ -247,7 +247,7 @@ int usb_generic_driver_probe(struct usb_device *udev)
+ 	 * with the driver core and lets interface drivers bind to them.
+ 	 */
+ 	if (udev->authorized == 0)
+-		dev_err(&udev->dev, "Device is not authorized for usage\n");
+		dev_warn(&udev->dev, "Device is not authorized for usage\n");
+ 	else {
+ 		c = usb_choose_configuration(udev);
+ 		if (c >= 0) {
+-- 
+2.43.0
+
@@ -1,9 +1,9 @@
-From 2eb2c9c7eaca24788cf448b151424a347c8ddf98 Mon Sep 17 00:00:00 2001
+From daba70e7782b704224396f0d86dcd91b4713e064 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
-Subject: [PATCH 27/27] net: usb: r8152: add r8153b support for link/activity
+Subject: [PATCH 5/5] net: usb: r8152: add r8153b support for link/activity
 LEDs
-Organization: Wires
+Organization: Addiva Elektronik

 This patch adds support for the link/activity LEDs on the NanoPi R2S
 and OrangePi R1 Plus.
@@ -19,7 +19,7 @@ Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 1 file changed, 8 insertions(+)

 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
-index 468c73974046..7e4089f10fde 100644
+index 19df1cd9f072..810477991810 100644
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
@@ -41,6 +41,11 @@
@@ -34,7 +34,7 @@ index 468c73974046..7e4089f10fde 100644
 #define R8152_PHY_ID		32
 
 #define PLA_IDR			0xc000
-@@ -7306,6 +7311,9 @@ static void r8153b_init(struct r8152 *tp)
+@@ -7296,6 +7301,9 @@ static void r8153b_init(struct r8152 *tp)
 	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
 	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
 
@@ -44,3 +44,6 @@ index 468c73974046..7e4089f10fde 100644
 	rtl_tally_reset(tp);
 
 	tp->coalesce = 15000;	/* 15 us */
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From aa7cb68028d74ca604e29af1e0291041593aed6b Mon Sep 17 00:00:00 2001
+From 774cf1d3f5b9cfac247c3efcf4eed39d06c675dc Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 01/27] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
@@ -8,12 +8,14 @@ Organization: Wires
 In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,
 register 0, bit 15). Therefore, increase the timeout threshold to 1s.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 5935100e7d65..378b6714dcf9 100644
+index 5aeecfab9630..2565277582c5 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -86,7 +86,7 @@ int mv88e6xxx_write(struct mv88e6xxx_chip *chip, int addr, int reg, u16 val)
@@ -25,3 +27,6 @@ index 5935100e7d65..378b6714dcf9 100644
 	u16 data;
 	int err;
 	int i;
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From de553470d110f8a685f084e095cabe70f6e034e7 Mon Sep 17 00:00:00 2001
+From 6bd6c3c49c438e35d61669879b64b6c4a00d1a19 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 02/27] net: dsa: mv88e6xxx: Improve indirect register access
@@ -13,6 +13,8 @@ previous families).
 Therefore, add a new set of SMI operations which remaps accesses to
 such registers to the corresponding directly addressable register. All
 other accesses use the regular indirect interface.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c    |  7 +++
 drivers/net/dsa/mv88e6xxx/global1.h |  3 ++
@@ -22,7 +24,7 @@ other accesses use the regular indirect interface.
 5 files changed, 119 insertions(+)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 378b6714dcf9..e3da229cc309 100644
+index 2565277582c5..7ba492ee5c86 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -6502,6 +6502,13 @@ static int mv88e6xxx_detect(struct mv88e6xxx_chip *chip)
@@ -209,3 +211,6 @@ index c6c71d5757f5..788cf68b7b33 100644
 int mv88e6xxx_smi_init(struct mv88e6xxx_chip *chip,
 		       struct mii_bus *bus, int sw_addr);
 
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 3071af4b67233b72e4861c9cddf86861c39e969a Mon Sep 17 00:00:00 2001
+From 02bb753cee9b24a3a1bcbcd15c3729144200eafc Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 03/27] net: dsa: mv88e6xxx: Honor ports being managed via
@@ -13,12 +13,14 @@ USXGMII autoneg)
 This state is the default set up by mv88e6xxx_port_setup_mac(), so all
 we have to do is to make the phylink MAC callbacks no-ops in cases
 when in-band-status is being used.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 6 ++++++
 1 file changed, 6 insertions(+)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index e3da229cc309..1273d936177c 100644
+index 7ba492ee5c86..cdf48fae0623 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -964,6 +964,9 @@ static void mv88e6xxx_mac_link_down(struct phylink_config *config,
@@ -41,3 +43,6 @@ index e3da229cc309..1273d936177c 100644
 	ops = chip->info->ops;
 
 	mv88e6xxx_reg_lock(chip);
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From f832e39dec010abcab657040a2fc7eb39593a49c Mon Sep 17 00:00:00 2001
+From 6cbb6a0a54d81ff5b117b023ac7e251ab1e9c556 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 04/27] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
@@ -29,6 +29,8 @@ Before this change, due to rsvd2cpu being enabled on the CPU port, the
 switch would try to trap it back to the CPU. Given that the CPU is
 trusted, instead assume that it indeed meant for the packet to be
 forwarded like any other.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/port.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)
@@ -96,3 +98,6 @@ index 04053fdc6489..f25fb3214acb 100644
 	if (err)
 		return err;
 
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 28f28edf9eb603fb25dea6f73f5292b195b8f9b5 Mon Sep 17 00:00:00 2001
+From 86b1608084c6e9676db0641f31203d8067893470 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 19:44:32 +0100
 Subject: [PATCH 05/27] net: dsa: mv88e6xxx: Add LED infrastructure
@@ -6,6 +6,8 @@ Organization: Wires

 Parse DT for LEDs and register them for devices that support it,
 though no actual implementations exist yet.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/Makefile |   1 +
 drivers/net/dsa/mv88e6xxx/chip.c   |   5 +-
@@ -29,7 +31,7 @@ index a9a9651187db..6720d9303914 100644
 mv88e6xxx-objs += pcs-6352.o
 mv88e6xxx-objs += pcs-639x.o
 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 1273d936177c..e1224c3d217a 100644
+index cdf48fae0623..0a7858280903 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -37,6 +37,7 @@
@@ -309,3 +311,6 @@ index 000000000000..8afa2a0c0527
 +int mv88e6xxx_port_setup_leds(struct dsa_switch *ds, int port);
 +
 +#endif /* _MV88E6XXX_LEDS_H */
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 511ad81be48ff78279864de5ca9154ae12a2361b Mon Sep 17 00:00:00 2001
+From 5496a27ee644f72b721eba0e8c057efb65ee445f Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 21:59:35 +0100
 Subject: [PATCH 06/27] net: dsa: mv88e6xxx: Add LED support for 6393X
@@ -8,6 +8,8 @@ Trigger support:
 - "none"
 - "timer"
 - "netdev"
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c |   1 +
 drivers/net/dsa/mv88e6xxx/leds.c | 229 +++++++++++++++++++++++++++++++
@@ -17,7 +19,7 @@ Trigger support:
 5 files changed, 272 insertions(+)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index e1224c3d217a..8c7b8673b694 100644
+index 0a7858280903..cd746bea31be 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -5657,6 +5657,7 @@ static const struct mv88e6xxx_ops mv88e6393x_ops = {
@@ -357,3 +359,6 @@ index ddadeb9bfdae..7157864dc20f 100644
 int mv88e6393x_set_egress_port(struct mv88e6xxx_chip *chip,
 			       enum mv88e6xxx_egress_direction direction,
 			       int port);
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 7ae7d5ff2239d9d99e0fc769a07bcdcb3edfde94 Mon Sep 17 00:00:00 2001
+From a0e2ebe61422d5e0e330022a2a38a31c049a4407 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 07/27] net: dsa: tag_dsa: Use tag priority as initial
@@ -19,6 +19,8 @@ Ideally we could then map this priority to an internal one, like we
 can do with an "ingress-qos-map" on VLAN interfaces. Until that is
 implemented, support the setup that is likely to be the most common; a
 1:1 mapping from FPri to skb->priority.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 net/dsa/tag_dsa.c | 7 +++++++
 1 file changed, 7 insertions(+)
@@ -41,3 +43,6 @@ index 2a2c4fb61a65..a00ae6bf2971 100644
 	return skb;
 }
 
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 4a8b7416746d92a0307b113aebcb9b8c429f031a Mon Sep 17 00:00:00 2001
+From a88679c946d5163eb0e30718109c18ddbbd8cfc6 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 08/27] net: dsa: Support MDB memberships whose L2 addresses
@@ -29,6 +29,8 @@ as long as the count is positive. Fortunately, all the infrastructure
 needed to do this is already in place, since it is also needed on CPU
 and DSA ports. Thus, "implement" this by simply removing the guards
 which previously skipped reference countung on user ports.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 net/dsa/switch.c | 16 ----------------
 1 file changed, 16 deletions(-)
@@ -67,3 +69,6 @@ index 3d2feeea897b..628e8a884dde 100644
 	mutex_lock(&dp->addr_lists_lock);
 
 	a = dsa_mac_addr_find(&dp->mdbs, mdb->addr, mdb->vid, db);
+-- 
+2.43.0
+
@@ -1,9 +1,10 @@
-From 180ecf6cdc045f0bc661551e3f7b0b46c4a6e490 Mon Sep 17 00:00:00 2001
+From c6528f18fbafef721c18e546aa0b60c1b1d772c6 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 09/27] net: dsa: Support EtherType based priority overrides
 Organization: Wires

+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 include/net/dsa.h |  4 ++++
 net/dsa/user.c    | 56 +++++++++++++++++++++++++++++++++++++++++++++--
@@ -112,3 +113,6 @@ index 64f660d2334b..e13fb22e2c2b 100644
 		}
 		break;
 	case IEEE_8021QAZ_APP_SEL_DSCP:
+-- 
+2.43.0
+
@@ -1,10 +1,11 @@
-From 6c90dd976e8ecb860533a0d1c07620bbb3401d28 Mon Sep 17 00:00:00 2001
+From bc41b93b365694ac36a19565270b8deda3b8cb79 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 10/27] net: dsa: mv88e6xxx: Support EtherType based priority
 overrides
 Organization: Wires

+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c    | 64 +++++++++++++++++++++++++++++
 drivers/net/dsa/mv88e6xxx/chip.h    | 21 ++++++++++
@@ -15,7 +16,7 @@ Organization: Wires
 6 files changed, 207 insertions(+), 4 deletions(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 8c7b8673b694..97b4e3770994 100644
+index cd746bea31be..e05caeabdc85 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -1715,6 +1715,11 @@ static int mv88e6xxx_rmu_setup(struct mv88e6xxx_chip *chip)
@@ -370,3 +371,6 @@ index 7157864dc20f..7edb04c41ac8 100644
 int mv88e6xxx_port_set_message_port(struct mv88e6xxx_chip *chip, int port,
 				    bool message_port);
 int mv88e6xxx_port_set_trunk(struct mv88e6xxx_chip *chip, int port,
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From d253013e702aca0e4f91bea6f88a9442e25a8384 Mon Sep 17 00:00:00 2001
+From 70c1d59448db0ec88c07fa4ff5748b0df740a8d2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 11/27] net: dsa: mv88e6xxx: Add mqprio qdisc support
@@ -24,13 +24,15 @@ are effectively only specifying the QPri.
 Since FPri is always a 3-bit field, even on older chips with only 4
 physical queues, always report 8 queues and let the chip's policy
 handle the mapping down to the "real" number.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 70 ++++++++++++++++++++++++++++++++
 net/dsa/tag_dsa.c                |  4 +-
 2 files changed, 73 insertions(+), 1 deletion(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 97b4e3770994..d2404e9431b1 100644
+index e05caeabdc85..ad997818047e 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -31,6 +31,7 @@
@@ -155,3 +157,6 @@ index a00ae6bf2971..55c296e0b5b0 100644
 		dsa_header[3] = vid & 0xff;
 	}
 
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From b4fe1543b6186642024d3600b47f093504ed10cc Mon Sep 17 00:00:00 2001
+From c3721cb1cccf3c8fe18bea05c9ad20e7082291bd Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 12/27] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
@@ -22,12 +22,14 @@ main reasons for choosing the new default:
   packet's priority. As the packet then moves through the network
   core over trusted VLAN trunks, the packet should keep its original
   priority, independent of what inner protocol fields may indicate.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index d2404e9431b1..2477d201b2cf 100644
+index ad997818047e..40e8d2018fee 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3432,9 +3432,13 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
@@ -55,3 +57,6 @@ index d2404e9431b1..2477d201b2cf 100644
 		MV88E6XXX_PORT_CTL0_STATE_FORWARDING;
 	/* Forward any IPv4 IGMP or IPv6 MLD frames received
 	 * by a USER port to the CPU port to allow snooping.
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From a9b8b2431a73995041df5f89e5c79af49e006729 Mon Sep 17 00:00:00 2001
+From 373d60426de6d19fd668e1e0b599ca430f351a18 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 13/27] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
@@ -24,6 +24,8 @@ a VLAN upper interface, rather than to offload bridge VLANs, are
 marked as policy entries. As the VTU policy of user ports is already
 set to TRAP (to ensure proper standalone port operation), this will
 cause all packets assigned to these VLANs to properly terminated.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 33 ++++++++++++++++++--------------
 include/net/switchdev.h          |  4 ++++
@@ -31,7 +33,7 @@ cause all packets assigned to these VLANs to properly terminated.
 3 files changed, 27 insertions(+), 14 deletions(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 2477d201b2cf..41f3223313d0 100644
+index 40e8d2018fee..30f8a5388733 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -2654,7 +2654,7 @@ static int mv88e6xxx_port_broadcast_sync(struct mv88e6xxx_chip *chip, int port,
@@ -154,3 +156,6 @@ index e13fb22e2c2b..f45e313f1dd0 100644
 	};
 	struct dsa_switch *ds = dp->ds;
 	struct netdev_hw_addr *ha;
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 82d6ed51bb597cd1f79e74b1263c3492738b3c71 Mon Sep 17 00:00:00 2001
+From a6368c60ac6ae2e0d97ac571b6506aa09becbb71 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 14/27] net: phy: marvell10g: Support firmware loading on
@@ -11,6 +11,8 @@ its RAM, ask userspace for the binary and load it over XMDIO.
 We have no choice but to bail out of the probe if firmware is not
 available, as the device does not have any built-in image on which to
 fall back.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 161 +++++++++++++++++++++++++++++++++++
 1 file changed, 161 insertions(+)
@@ -234,3 +236,6 @@ index 6642eb642d4b..79d9483419c0 100644
 MODULE_DESCRIPTION("Marvell Alaska X/M multi-gigabit Ethernet PHY driver");
 +MODULE_FIRMWARE("mrvl/x3310fw.hdr");
 MODULE_LICENSE("GPL");
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 384a0171443f0136f626ca2aff94f393837bcb2c Mon Sep 17 00:00:00 2001
+From 550dd1b443cf9d054f2a523088fbe22b215e07cb Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 15/27] net: phy: marvell10g: Fix power-up when strapped to
@@ -8,6 +8,8 @@ Organization: Wires
 On devices which are hardware strapped to start powered down (PDSTATE
 == 1), make sure that we clear the power-down bit on all units
 affected by this setting.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)
@@ -43,3 +45,6 @@ index 79d9483419c0..268484092776 100644
 
 	/* Sometimes, the power down bit doesn't clear immediately, and
 	 * a read of this register causes the bit not to clear. Delay
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From ee93f4ed2fbd7595622ecf0ed3fa9e2803662ae9 Mon Sep 17 00:00:00 2001
+From 9ca4c28ccf7857a36db8dd3c37dcd005222bdb78 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 16/27] net: phy: marvell10g: Add LED support for 88X3310
@@ -17,6 +17,8 @@ Trigger support:
 	   software blinking
 - "netdev": Offload link or duplex information to the solid behavior;
  	    tx and/or rx activity to blink behavior.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 422 +++++++++++++++++++++++++++++++++++
 1 file changed, 422 insertions(+)
@@ -510,3 +512,6 @@ index 268484092776..9f8475b67ef7 100644
 	},
 	{
 		.phy_id		= MARVELL_PHY_ID_88X3310,
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From a37059a58453694376e6e5df700d6d4c51703b13 Mon Sep 17 00:00:00 2001
+From 69f9bda6cab34556e67a096c282eee7337f97f26 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 17/27] net: phy: marvell10g: Support LEDs tied to a single
@@ -14,6 +14,8 @@ tied to a particular media side, and use that information to refine
 the offloading of the "netdev" trigger, such that LEDs attached to the
 RJ45 jack only lights up when a copper link is established, and vice
 versa for the SFP cage.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)
@@ -73,3 +75,6 @@ index 9f8475b67ef7..82b2e9b55b67 100644
 	/* mv3310_led_polarity_set() will not be called unless the
 	 * device tree specifies a mode that of_phy_led() considers to
 	 * be a non-default configuration. I.e., something other than
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 0fabf9cc0ddb17ed1d88212edcb41600444c51e3 Mon Sep 17 00:00:00 2001
+From f70be42f0ee50cda8c1cde14442ea8285c01834b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 18/27] net: phy: Do not resume PHY when attaching
@@ -15,6 +15,8 @@ Otherwise, drivers that attached to their PHYs during
 probing (e.g. DSA) would end up with a physical link being
 established, even though the corresponding interface was still
 administratively down.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/phy_device.c | 1 -
 1 file changed, 1 deletion(-)
@@ -31,3 +33,6 @@ index 119dfa2d6643..7c7cc6edf314 100644
 	if (!phydev->is_on_sfp_module)
 		phy_led_triggers_register(phydev);
 
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 60514772701b8335077c9bbd7107786d2a7a3ed4 Mon Sep 17 00:00:00 2001
+From 17d6f3f6a7429ae635d0359b39da2e173c403fdf Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 19/27] net: bridge: avoid classifying unknown multicast as
@@ -16,6 +16,7 @@ Because a multicast router should always receive both known and unknown
 multicast.

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 include/uapi/linux/if_bridge.h |  1 +
 net/bridge/br.c                |  5 +++++
@@ -231,3 +232,6 @@ index 041f6e571a20..40651b07df94 100644
 static inline bool br_multicast_is_router(struct net_bridge_mcast *brmctx,
 					  struct sk_buff *skb)
 {
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 91d101863365ef759c6101674881c7d21130b24b Mon Sep 17 00:00:00 2001
+From 27ca82c96a6bcd560e908eed17fc24126e8051a6 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 20/27] net: bridge: Ignore router ports when forwarding L2
@@ -32,3 +32,6 @@ index 40651b07df94..e90b4f5cab76 100644
 }
 
 static inline struct net_bridge_port *
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From e22d99445476933f9a2da0e825d8a0da62af0c20 Mon Sep 17 00:00:00 2001
+From bbbb4f7460efeaf057d37d837cae79a565a6d406 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 21/27] net: bridge: drop delay for applying strict multicast
@@ -19,6 +19,7 @@ A proper fix for upstreaming could be to add a knob to disable the delay.
 [2]: https://lore.kernel.org/netdev/20240127175033.9640-1-linus.luessing@c0d3.blue/

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 net/bridge/br_multicast.c | 42 +++++++--------------------------------
 net/bridge/br_private.h   |  4 +---
@@ -185,3 +186,6 @@ index e90b4f5cab76..73b78c594564 100644
 }
 
 static inline bool br_multicast_querier_exists(struct net_bridge_mcast *brmctx,
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 69a5b99e93002daa2a65574677c9ab595f3c8b8d Mon Sep 17 00:00:00 2001
+From 7c751c24428060c3e87f164eb2a054db410f4b0d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 22/27] net: bridge: Differentiate MDB additions from
@@ -21,6 +21,8 @@ generated.

 Therefore, discriminate new groups from changes to existing groups by
 introducing a RTM_SETMDB events to be used in the latter scenario.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 include/uapi/linux/rtnetlink.h | 2 ++
 net/bridge/br_mdb.c            | 4 ++--
@@ -102,3 +104,6 @@ index 34be07a1fd00..9c8bf38e0079 100644
 unlock_continue:
 		spin_unlock(&brmctx->br->multicast_lock);
 	}
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 55ff4511898852f9408c5ccab8082f1b03f697a4 Mon Sep 17 00:00:00 2001
+From db0d727f6cc90ccea2378d876329c151db1670dc Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 23/27] nvmem: layouts: onie-tlv: Let device probe even when
@@ -13,6 +13,8 @@ be successfully probed.

 Therefore, settle for reporting data corruption issues in the log, and
 simply refrain from registering any cells in those cases.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/nvmem/layouts/onie-tlv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
@@ -48,3 +50,6 @@ index 0967a32319a2..48547d5bb502 100644
 
 	data = table + hdr_len;
 	ret = onie_tlv_add_cells(dev, nvmem, data_len, data);
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 950e326ed789709260dbe9f139ebcec264889048 Mon Sep 17 00:00:00 2001
+From ed58f4b6e7344bdefceb7ac31d1c769a6d127827 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 29 Apr 2024 15:14:51 +0200
 Subject: [PATCH 24/27] usb: core: adjust log level for unauthorized devices
@@ -9,6 +9,7 @@ so let's adjust the log level so these messages slip below radar for the
 commonly used 'quiet' log level.

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/usb/core/driver.c  | 4 ++--
 drivers/usb/core/generic.c | 2 +-
@@ -44,3 +45,6 @@ index b134bff5c3fe..60575a01a810 100644
 	else {
 		c = usb_choose_configuration(udev);
 		if (c >= 0) {
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From 6229922ab3d1a414dfbbc8b3d13eaf10136b9e68 Mon Sep 17 00:00:00 2001
+From e7f7ae788680b4ec73af736453ec4afeb34d9842 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 16 Jan 2025 12:35:12 +0100
 Subject: [PATCH 25/27] net: dsa: mv88e6xxx: collapse disabled state into
@@ -18,6 +18,7 @@ each member port, preventing LACPDUs from passing through to qualify the
 link and become active.

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/port.c | 2 --
 1 file changed, 2 deletions(-)
@@ -35,3 +36,6 @@ index 84900814c456..91e58297594c 100644
 	case BR_STATE_BLOCKING:
 	case BR_STATE_LISTENING:
 		state = MV88E6XXX_PORT_CTL0_STATE_BLOCKING;
+-- 
+2.43.0
+
@@ -1,4 +1,4 @@
-From fff392ae3166cc2afa80f3eca6066fa21eb6e28e Mon Sep 17 00:00:00 2001
+From 823687aa03d866f3b76b5e40e35fa56c7f6f4492 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 12 Feb 2025 22:03:14 +0100
 Subject: [PATCH 26/27] net: dsa: mv88e6xxx: Only activate LAG offloading when
@@ -46,12 +46,14 @@ existing port isolation to work as intended.
 Before joining a bridge, the offload does not offer any performance
 benefit anyway. All ingressing packet will always have to go to the
 CPU; egress traffic always relies on software hashing.
+
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 42 +++++++++++++++-----------------
 1 file changed, 20 insertions(+), 22 deletions(-)

 diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
-index 41f3223313d0..7bee935fd40f 100644
+index 30f8a5388733..c1f8adaa008a 100644
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3095,6 +3095,7 @@ static int mv88e6xxx_port_bridge_join(struct dsa_switch *ds, int port,
@@ -140,3 +142,6 @@ index 41f3223313d0..7bee935fd40f 100644
 }
 
 static int mv88e6xxx_crosschip_lag_change(struct dsa_switch *ds, int sw_index,
+-- 
+2.43.0
+
@@ -0,0 +1,651 @@
+From f33dc6fb8cd78eb3b1b2ea3de68b8a54efabdac2 Mon Sep 17 00:00:00 2001
+From: Tobias Waldekranz <tobias@waldekranz.com>
+Date: Tue, 18 Mar 2025 10:55:09 +0100
+Subject: [PATCH 27/27] net: mvpp2: Prevent parser TCAM memory corruption
+Organization: Wires
+
+Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM
+information, from concurrent modifications.
+
+Both the TCAM and SRAM tables are indirectly accessed by configuring
+an index register that selects the row to read or write to. This means
+that operations must be atomic in order to, e.g., avoid spreading
+writes across multiple rows. Since the shadow SRAM array is used to
+find free rows in the hardware table, it must also be protected in
+order to avoid TOCTOU errors where multiple cores allocate the same
+row.
+
+This issue was detected in a situation where `mvpp2_set_rx_mode()` ran
+concurrently on two CPUs. In this particular case the
+MVPP2_PE_MAC_UC_PROMISCUOUS entry was corrupted, causing the
+classifier unit to drop all incoming unicast - indicated by the
+`rx_classifier_drops` counter.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
+---
+ drivers/net/ethernet/marvell/mvpp2/mvpp2.h    |   3 +
+ .../net/ethernet/marvell/mvpp2/mvpp2_main.c   |   3 +-
+ .../net/ethernet/marvell/mvpp2/mvpp2_prs.c    | 201 ++++++++++++------
+ 3 files changed, 140 insertions(+), 67 deletions(-)
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+index 9e02e4367bec..9bd3d76b5fe2 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h
+@@ -1108,6 +1108,9 @@ struct mvpp2 {
+ 
+ 	/* Spinlocks for CM3 shared memory configuration */
+ 	spinlock_t mss_spinlock;
+
+	/* Spinlock for shared PRS parser memory and shadow table */
+	spinlock_t prs_spinlock;
+ };
+ 
+ struct mvpp2_pcpu_stats {
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 3880dcc0418b..66b5a80c9c28 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -7640,8 +7640,9 @@ static int mvpp2_probe(struct platform_device *pdev)
+ 	if (mvpp2_read(priv, MVPP2_VER_ID_REG) == MVPP2_VER_PP23)
+ 		priv->hw_version = MVPP23;
+ 
+-	/* Init mss lock */
+	/* Init locks for shared packet processor resources */
+ 	spin_lock_init(&priv->mss_spinlock);
+	spin_lock_init(&priv->prs_spinlock);
+ 
+ 	/* Initialize network controller */
+ 	err = mvpp2_init(pdev, priv);
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+index 9af22f497a40..a96edc7dc0de 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_prs.c
+@@ -23,6 +23,8 @@ static int mvpp2_prs_hw_write(struct mvpp2 *priv, struct mvpp2_prs_entry *pe)
+ {
+ 	int i;
+ 
+	lockdep_assert_held(&priv->prs_spinlock);
+
+ 	if (pe->index > MVPP2_PRS_TCAM_SRAM_SIZE - 1)
+ 		return -EINVAL;
+ 
+@@ -43,11 +45,13 @@ static int mvpp2_prs_hw_write(struct mvpp2 *priv, struct mvpp2_prs_entry *pe)
+ }
+ 
+ /* Initialize tcam entry from hw */
+-int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe,
+-			   int tid)
+static int mvpp2_prs_init_from_hw_unlocked(struct mvpp2 *priv,
+					   struct mvpp2_prs_entry *pe, int tid)
+ {
+ 	int i;
+ 
+	lockdep_assert_held(&priv->prs_spinlock);
+
+ 	if (tid > MVPP2_PRS_TCAM_SRAM_SIZE - 1)
+ 		return -EINVAL;
+ 
+@@ -73,6 +77,18 @@ int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe,
+ 	return 0;
+ }
+ 
+int mvpp2_prs_init_from_hw(struct mvpp2 *priv, struct mvpp2_prs_entry *pe,
+			   int tid)
+{
+	int err;
+
+	spin_lock_bh(&priv->prs_spinlock);
+	err = mvpp2_prs_init_from_hw_unlocked(priv, pe, tid);
+	spin_unlock_bh(&priv->prs_spinlock);
+
+	return err;
+}
+
+ /* Invalidate tcam hw entry */
+ static void mvpp2_prs_hw_inv(struct mvpp2 *priv, int index)
+ {
+@@ -374,7 +390,7 @@ static int mvpp2_prs_flow_find(struct mvpp2 *priv, int flow)
+ 		    priv->prs_shadow[tid].lu != MVPP2_PRS_LU_FLOWS)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 		bits = mvpp2_prs_sram_ai_get(&pe);
+ 
+ 		/* Sram store classification lookup ID in AI bits [5:0] */
+@@ -441,7 +457,7 @@ static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add)
+ 
+ 	if (priv->prs_shadow[MVPP2_PE_DROP_ALL].valid) {
+ 		/* Entry exist - update port only */
+-		mvpp2_prs_init_from_hw(priv, &pe, MVPP2_PE_DROP_ALL);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, MVPP2_PE_DROP_ALL);
+ 	} else {
+ 		/* Entry doesn't exist - create new */
+ 		memset(&pe, 0, sizeof(pe));
+@@ -469,14 +485,17 @@ static void mvpp2_prs_mac_drop_all_set(struct mvpp2 *priv, int port, bool add)
+ }
+ 
+ /* Set port to unicast or multicast promiscuous mode */
+-void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
+-			       enum mvpp2_prs_l2_cast l2_cast, bool add)
+static void mvpp2_prs_mac_promisc_set_unlocked(struct mvpp2 *priv, int port,
+					       enum mvpp2_prs_l2_cast l2_cast,
+					       bool add)
+ {
+ 	struct mvpp2_prs_entry pe;
+ 	unsigned char cast_match;
+ 	unsigned int ri;
+ 	int tid;
+ 
+	lockdep_assert_held(&priv->prs_spinlock);
+
+ 	if (l2_cast == MVPP2_PRS_L2_UNI_CAST) {
+ 		cast_match = MVPP2_PRS_UCAST_VAL;
+ 		tid = MVPP2_PE_MAC_UC_PROMISCUOUS;
+@@ -489,7 +508,7 @@ void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
+ 
+ 	/* promiscuous mode - Accept unknown unicast or multicast packets */
+ 	if (priv->prs_shadow[tid].valid) {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	} else {
+ 		memset(&pe, 0, sizeof(pe));
+ 		mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC);
+@@ -522,6 +541,14 @@ void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
+ 	mvpp2_prs_hw_write(priv, &pe);
+ }
+ 
+void mvpp2_prs_mac_promisc_set(struct mvpp2 *priv, int port,
+			       enum mvpp2_prs_l2_cast l2_cast, bool add)
+{
+		spin_lock_bh(&priv->prs_spinlock);
+		mvpp2_prs_mac_promisc_set_unlocked(priv, port, l2_cast, add);
+		spin_unlock_bh(&priv->prs_spinlock);
+}
+
+ /* Set entry for dsa packets */
+ static void mvpp2_prs_dsa_tag_set(struct mvpp2 *priv, int port, bool add,
+ 				  bool tagged, bool extend)
+@@ -539,7 +566,7 @@ static void mvpp2_prs_dsa_tag_set(struct mvpp2 *priv, int port, bool add,
+ 
+ 	if (priv->prs_shadow[tid].valid) {
+ 		/* Entry exist - update port only */
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	} else {
+ 		/* Entry doesn't exist - create new */
+ 		memset(&pe, 0, sizeof(pe));
+@@ -610,7 +637,7 @@ static void mvpp2_prs_dsa_tag_ethertype_set(struct mvpp2 *priv, int port,
+ 
+ 	if (priv->prs_shadow[tid].valid) {
+ 		/* Entry exist - update port only */
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	} else {
+ 		/* Entry doesn't exist - create new */
+ 		memset(&pe, 0, sizeof(pe));
+@@ -673,7 +700,7 @@ static int mvpp2_prs_vlan_find(struct mvpp2 *priv, unsigned short tpid, int ai)
+ 		    priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VLAN)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 		match = mvpp2_prs_tcam_data_cmp(&pe, 0, tpid);
+ 		if (!match)
+ 			continue;
+@@ -726,7 +753,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
+ 			    priv->prs_shadow[tid_aux].lu != MVPP2_PRS_LU_VLAN)
+ 				continue;
+ 
+-			mvpp2_prs_init_from_hw(priv, &pe, tid_aux);
+			mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid_aux);
+ 			ri_bits = mvpp2_prs_sram_ri_get(&pe);
+ 			if ((ri_bits & MVPP2_PRS_RI_VLAN_MASK) ==
+ 			    MVPP2_PRS_RI_VLAN_DOUBLE)
+@@ -760,7 +787,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
+ 
+ 		mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VLAN);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	}
+ 	/* Update ports' mask */
+ 	mvpp2_prs_tcam_port_map_set(&pe, port_map);
+@@ -800,7 +827,7 @@ static int mvpp2_prs_double_vlan_find(struct mvpp2 *priv, unsigned short tpid1,
+ 		    priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VLAN)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 
+ 		match = mvpp2_prs_tcam_data_cmp(&pe, 0, tpid1) &&
+ 			mvpp2_prs_tcam_data_cmp(&pe, 4, tpid2);
+@@ -849,7 +876,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
+ 			    priv->prs_shadow[tid_aux].lu != MVPP2_PRS_LU_VLAN)
+ 				continue;
+ 
+-			mvpp2_prs_init_from_hw(priv, &pe, tid_aux);
+			mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid_aux);
+ 			ri_bits = mvpp2_prs_sram_ri_get(&pe);
+ 			ri_bits &= MVPP2_PRS_RI_VLAN_MASK;
+ 			if (ri_bits == MVPP2_PRS_RI_VLAN_SINGLE ||
+@@ -880,7 +907,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
+ 
+ 		mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VLAN);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	}
+ 
+ 	/* Update ports' mask */
+@@ -1213,8 +1240,8 @@ static void mvpp2_prs_mac_init(struct mvpp2 *priv)
+ 	/* Create dummy entries for drop all and promiscuous modes */
+ 	mvpp2_prs_drop_fc(priv);
+ 	mvpp2_prs_mac_drop_all_set(priv, 0, false);
+-	mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_UNI_CAST, false);
+-	mvpp2_prs_mac_promisc_set(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false);
+	mvpp2_prs_mac_promisc_set_unlocked(priv, 0, MVPP2_PRS_L2_UNI_CAST, false);
+	mvpp2_prs_mac_promisc_set_unlocked(priv, 0, MVPP2_PRS_L2_MULTI_CAST, false);
+ }
+ 
+ /* Set default entries for various types of dsa packets */
+@@ -1533,12 +1560,6 @@ static int mvpp2_prs_vlan_init(struct platform_device *pdev, struct mvpp2 *priv)
+ 	struct mvpp2_prs_entry pe;
+ 	int err;
+ 
+-	priv->prs_double_vlans = devm_kcalloc(&pdev->dev, sizeof(bool),
+-					      MVPP2_PRS_DBL_VLANS_MAX,
+-					      GFP_KERNEL);
+-	if (!priv->prs_double_vlans)
+-		return -ENOMEM;
+-
+ 	/* Double VLAN: 0x88A8, 0x8100 */
+ 	err = mvpp2_prs_double_vlan_add(priv, ETH_P_8021AD, ETH_P_8021Q,
+ 					MVPP2_PRS_PORT_MASK);
+@@ -1941,7 +1962,7 @@ static int mvpp2_prs_vid_range_find(struct mvpp2_port *port, u16 vid, u16 mask)
+ 		    port->priv->prs_shadow[tid].lu != MVPP2_PRS_LU_VID)
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(port->priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(port->priv, &pe, tid);
+ 
+ 		mvpp2_prs_tcam_data_byte_get(&pe, 2, &byte[0], &enable[0]);
+ 		mvpp2_prs_tcam_data_byte_get(&pe, 3, &byte[1], &enable[1]);
+@@ -1970,6 +1991,8 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
+	spin_lock_bh(&priv->prs_spinlock);
+
+ 	/* Scan TCAM and see if entry with this <vid,port> already exist */
+ 	tid = mvpp2_prs_vid_range_find(port, vid, mask);
+ 
+@@ -1988,8 +2011,10 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 						MVPP2_PRS_VLAN_FILT_MAX_ENTRY);
+ 
+ 		/* There isn't room for a new VID filter */
+-		if (tid < 0)
+		if (tid < 0) {
+			spin_unlock_bh(&priv->prs_spinlock);
+ 			return tid;
+		}
+ 
+ 		mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_VID);
+ 		pe.index = tid;
+@@ -1997,7 +2022,7 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 		/* Mask all ports */
+ 		mvpp2_prs_tcam_port_map_set(&pe, 0);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	}
+ 
+ 	/* Enable the current port */
+@@ -2019,6 +2044,7 @@ int mvpp2_prs_vid_entry_add(struct mvpp2_port *port, u16 vid)
+ 	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VID);
+ 	mvpp2_prs_hw_write(priv, &pe);
+ 
+	spin_unlock_bh(&priv->prs_spinlock);
+ 	return 0;
+ }
+ 
+@@ -2028,15 +2054,16 @@ void mvpp2_prs_vid_entry_remove(struct mvpp2_port *port, u16 vid)
+ 	struct mvpp2 *priv = port->priv;
+ 	int tid;
+ 
+-	/* Scan TCAM and see if entry with this <vid,port> already exist */
+-	tid = mvpp2_prs_vid_range_find(port, vid, 0xfff);
+	spin_lock_bh(&priv->prs_spinlock);
+ 
+-	/* No such entry */
+-	if (tid < 0)
+-		return;
+	/* Invalidate TCAM entry with this <vid,port>, if it exists */
+	tid = mvpp2_prs_vid_range_find(port, vid, 0xfff);
+	if (tid >= 0) {
+		mvpp2_prs_hw_inv(priv, tid);
+		priv->prs_shadow[tid].valid = false;
+	}
+ 
+-	mvpp2_prs_hw_inv(priv, tid);
+-	priv->prs_shadow[tid].valid = false;
+	spin_unlock_bh(&priv->prs_spinlock);
+ }
+ 
+ /* Remove all existing VID filters on this port */
+@@ -2045,6 +2072,8 @@ void mvpp2_prs_vid_remove_all(struct mvpp2_port *port)
+ 	struct mvpp2 *priv = port->priv;
+ 	int tid;
+ 
+	spin_lock_bh(&priv->prs_spinlock);
+
+ 	for (tid = MVPP2_PRS_VID_PORT_FIRST(port->id);
+ 	     tid <= MVPP2_PRS_VID_PORT_LAST(port->id); tid++) {
+ 		if (priv->prs_shadow[tid].valid) {
+@@ -2052,6 +2081,8 @@ void mvpp2_prs_vid_remove_all(struct mvpp2_port *port)
+ 			priv->prs_shadow[tid].valid = false;
+ 		}
+ 	}
+
+	spin_unlock_bh(&priv->prs_spinlock);
+ }
+ 
+ /* Remove VID filering entry for this port */
+@@ -2060,10 +2091,14 @@ void mvpp2_prs_vid_disable_filtering(struct mvpp2_port *port)
+ 	unsigned int tid = MVPP2_PRS_VID_PORT_DFLT(port->id);
+ 	struct mvpp2 *priv = port->priv;
+ 
+	spin_lock_bh(&priv->prs_spinlock);
+
+ 	/* Invalidate the guard entry */
+ 	mvpp2_prs_hw_inv(priv, tid);
+ 
+ 	priv->prs_shadow[tid].valid = false;
+
+	spin_unlock_bh(&priv->prs_spinlock);
+ }
+ 
+ /* Add guard entry that drops packets when no VID is matched on this port */
+@@ -2079,6 +2114,8 @@ void mvpp2_prs_vid_enable_filtering(struct mvpp2_port *port)
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
+	spin_lock_bh(&priv->prs_spinlock);
+
+ 	pe.index = tid;
+ 
+ 	reg_val = mvpp2_read(priv, MVPP2_MH_REG(port->id));
+@@ -2111,6 +2148,8 @@ void mvpp2_prs_vid_enable_filtering(struct mvpp2_port *port)
+ 	/* Update shadow table */
+ 	mvpp2_prs_shadow_set(priv, pe.index, MVPP2_PRS_LU_VID);
+ 	mvpp2_prs_hw_write(priv, &pe);
+
+	spin_unlock_bh(&priv->prs_spinlock);
+ }
+ 
+ /* Parser default initialization */
+@@ -2118,6 +2157,20 @@ int mvpp2_prs_default_init(struct platform_device *pdev, struct mvpp2 *priv)
+ {
+ 	int err, index, i;
+ 
+	priv->prs_shadow = devm_kcalloc(&pdev->dev, MVPP2_PRS_TCAM_SRAM_SIZE,
+					sizeof(*priv->prs_shadow),
+					GFP_KERNEL);
+	if (!priv->prs_shadow)
+		return -ENOMEM;
+
+	priv->prs_double_vlans = devm_kcalloc(&pdev->dev, sizeof(bool),
+					      MVPP2_PRS_DBL_VLANS_MAX,
+					      GFP_KERNEL);
+	if (!priv->prs_double_vlans)
+		return -ENOMEM;
+
+	spin_lock_bh(&priv->prs_spinlock);
+
+ 	/* Enable tcam table */
+ 	mvpp2_write(priv, MVPP2_PRS_TCAM_CTRL_REG, MVPP2_PRS_TCAM_EN_MASK);
+ 
+@@ -2136,12 +2189,6 @@ int mvpp2_prs_default_init(struct platform_device *pdev, struct mvpp2 *priv)
+ 	for (index = 0; index < MVPP2_PRS_TCAM_SRAM_SIZE; index++)
+ 		mvpp2_prs_hw_inv(priv, index);
+ 
+-	priv->prs_shadow = devm_kcalloc(&pdev->dev, MVPP2_PRS_TCAM_SRAM_SIZE,
+-					sizeof(*priv->prs_shadow),
+-					GFP_KERNEL);
+-	if (!priv->prs_shadow)
+-		return -ENOMEM;
+-
+ 	/* Always start from lookup = 0 */
+ 	for (index = 0; index < MVPP2_MAX_PORTS; index++)
+ 		mvpp2_prs_hw_port_init(priv, index, MVPP2_PRS_LU_MH,
+@@ -2158,26 +2205,13 @@ int mvpp2_prs_default_init(struct platform_device *pdev, struct mvpp2 *priv)
+ 	mvpp2_prs_vid_init(priv);
+ 
+ 	err = mvpp2_prs_etype_init(priv);
+-	if (err)
+-		return err;
+-
+-	err = mvpp2_prs_vlan_init(pdev, priv);
+-	if (err)
+-		return err;
+-
+-	err = mvpp2_prs_pppoe_init(priv);
+-	if (err)
+-		return err;
+-
+-	err = mvpp2_prs_ip6_init(priv);
+-	if (err)
+-		return err;
+-
+-	err = mvpp2_prs_ip4_init(priv);
+-	if (err)
+-		return err;
+	err = err ? : mvpp2_prs_vlan_init(pdev, priv);
+	err = err ? : mvpp2_prs_pppoe_init(priv);
+	err = err ? : mvpp2_prs_ip6_init(priv);
+	err = err ? : mvpp2_prs_ip4_init(priv);
+ 
+-	return 0;
+	spin_unlock_bh(&priv->prs_spinlock);
+	return err;
+ }
+ 
+ /* Compare MAC DA with tcam entry data */
+@@ -2217,7 +2251,7 @@ mvpp2_prs_mac_da_range_find(struct mvpp2 *priv, int pmap, const u8 *da,
+ 		    (priv->prs_shadow[tid].udf != udf_type))
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 		entry_pmap = mvpp2_prs_tcam_port_map_get(&pe);
+ 
+ 		if (mvpp2_prs_mac_range_equals(&pe, da, mask) &&
+@@ -2229,7 +2263,8 @@ mvpp2_prs_mac_da_range_find(struct mvpp2 *priv, int pmap, const u8 *da,
+ }
+ 
+ /* Update parser's mac da entry */
+-int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
+static int mvpp2_prs_mac_da_accept_unlocked(struct mvpp2_port *port,
+					    const u8 *da, bool add)
+ {
+ 	unsigned char mask[ETH_ALEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+ 	struct mvpp2 *priv = port->priv;
+@@ -2261,7 +2296,7 @@ int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
+ 		/* Mask all ports */
+ 		mvpp2_prs_tcam_port_map_set(&pe, 0);
+ 	} else {
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 	}
+ 
+ 	mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_MAC);
+@@ -2317,6 +2352,17 @@ int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
+ 	return 0;
+ }
+ 
+int mvpp2_prs_mac_da_accept(struct mvpp2_port *port, const u8 *da, bool add)
+{
+	int err;
+
+	spin_lock_bh(&port->priv->prs_spinlock);
+	err = mvpp2_prs_mac_da_accept_unlocked(port, da, add);
+	spin_unlock_bh(&port->priv->prs_spinlock);
+
+	return err;
+}
+
+ int mvpp2_prs_update_mac_da(struct net_device *dev, const u8 *da)
+ {
+ 	struct mvpp2_port *port = netdev_priv(dev);
+@@ -2345,6 +2391,8 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port)
+ 	unsigned long pmap;
+ 	int index, tid;
+ 
+	spin_lock_bh(&priv->prs_spinlock);
+
+ 	for (tid = MVPP2_PE_MAC_RANGE_START;
+ 	     tid <= MVPP2_PE_MAC_RANGE_END; tid++) {
+ 		unsigned char da[ETH_ALEN], da_mask[ETH_ALEN];
+@@ -2354,7 +2402,7 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port)
+ 		    (priv->prs_shadow[tid].udf != MVPP2_PRS_UDF_MAC_DEF))
+ 			continue;
+ 
+-		mvpp2_prs_init_from_hw(priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(priv, &pe, tid);
+ 
+ 		pmap = mvpp2_prs_tcam_port_map_get(&pe);
+ 
+@@ -2375,14 +2423,17 @@ void mvpp2_prs_mac_del_all(struct mvpp2_port *port)
+ 			continue;
+ 
+ 		/* Remove entry from TCAM */
+-		mvpp2_prs_mac_da_accept(port, da, false);
+		mvpp2_prs_mac_da_accept_unlocked(port, da, false);
+ 	}
+
+	spin_unlock_bh(&priv->prs_spinlock);
+ }
+ 
+ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ {
+ 	switch (type) {
+ 	case MVPP2_TAG_TYPE_EDSA:
+		spin_lock_bh(&priv->prs_spinlock);
+ 		/* Add port to EDSA entries */
+ 		mvpp2_prs_dsa_tag_set(priv, port, true,
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA);
+@@ -2393,9 +2444,11 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_DSA);
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_UNTAGGED, MVPP2_PRS_DSA);
+		spin_unlock_bh(&priv->prs_spinlock);
+ 		break;
+ 
+ 	case MVPP2_TAG_TYPE_DSA:
+		spin_lock_bh(&priv->prs_spinlock);
+ 		/* Add port to DSA entries */
+ 		mvpp2_prs_dsa_tag_set(priv, port, true,
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_DSA);
+@@ -2406,10 +2459,12 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA);
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_UNTAGGED, MVPP2_PRS_EDSA);
+		spin_unlock_bh(&priv->prs_spinlock);
+ 		break;
+ 
+ 	case MVPP2_TAG_TYPE_MH:
+ 	case MVPP2_TAG_TYPE_NONE:
+		spin_lock_bh(&priv->prs_spinlock);
+ 		/* Remove port form EDSA and DSA entries */
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_DSA);
+@@ -2419,6 +2474,7 @@ int mvpp2_prs_tag_mode_set(struct mvpp2 *priv, int port, int type)
+ 				      MVPP2_PRS_TAGGED, MVPP2_PRS_EDSA);
+ 		mvpp2_prs_dsa_tag_set(priv, port, false,
+ 				      MVPP2_PRS_UNTAGGED, MVPP2_PRS_EDSA);
+		spin_unlock_bh(&priv->prs_spinlock);
+ 		break;
+ 
+ 	default:
+@@ -2437,11 +2493,15 @@ int mvpp2_prs_add_flow(struct mvpp2 *priv, int flow, u32 ri, u32 ri_mask)
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
+	spin_lock_bh(&priv->prs_spinlock);
+
+ 	tid = mvpp2_prs_tcam_first_free(priv,
+ 					MVPP2_PE_LAST_FREE_TID,
+ 					MVPP2_PE_FIRST_FREE_TID);
+-	if (tid < 0)
+	if (tid < 0) {
+		spin_unlock_bh(&priv->prs_spinlock);
+ 		return tid;
+	}
+ 
+ 	pe.index = tid;
+ 
+@@ -2461,6 +2521,7 @@ int mvpp2_prs_add_flow(struct mvpp2 *priv, int flow, u32 ri, u32 ri_mask)
+ 	mvpp2_prs_tcam_port_map_set(&pe, MVPP2_PRS_PORT_MASK);
+ 	mvpp2_prs_hw_write(priv, &pe);
+ 
+	spin_unlock_bh(&priv->prs_spinlock);
+ 	return 0;
+ }
+ 
+@@ -2472,6 +2533,8 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port)
+ 
+ 	memset(&pe, 0, sizeof(pe));
+ 
+	spin_lock_bh(&port->priv->prs_spinlock);
+
+ 	tid = mvpp2_prs_flow_find(port->priv, port->id);
+ 
+ 	/* Such entry not exist */
+@@ -2480,8 +2543,10 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port)
+ 		tid = mvpp2_prs_tcam_first_free(port->priv,
+ 						MVPP2_PE_LAST_FREE_TID,
+ 					       MVPP2_PE_FIRST_FREE_TID);
+-		if (tid < 0)
+		if (tid < 0) {
+			spin_unlock_bh(&port->priv->prs_spinlock);
+ 			return tid;
+		}
+ 
+ 		pe.index = tid;
+ 
+@@ -2492,13 +2557,14 @@ int mvpp2_prs_def_flow(struct mvpp2_port *port)
+ 		/* Update shadow table */
+ 		mvpp2_prs_shadow_set(port->priv, pe.index, MVPP2_PRS_LU_FLOWS);
+ 	} else {
+-		mvpp2_prs_init_from_hw(port->priv, &pe, tid);
+		mvpp2_prs_init_from_hw_unlocked(port->priv, &pe, tid);
+ 	}
+ 
+ 	mvpp2_prs_tcam_lu_set(&pe, MVPP2_PRS_LU_FLOWS);
+ 	mvpp2_prs_tcam_port_map_set(&pe, (1 << port->id));
+ 	mvpp2_prs_hw_write(port->priv, &pe);
+ 
+	spin_unlock_bh(&port->priv->prs_spinlock);
+ 	return 0;
+ }
+ 
+@@ -2509,11 +2575,14 @@ int mvpp2_prs_hits(struct mvpp2 *priv, int index)
+ 	if (index > MVPP2_PRS_TCAM_SRAM_SIZE)
+ 		return -EINVAL;
+ 
+	spin_lock_bh(&priv->prs_spinlock);
+
+ 	mvpp2_write(priv, MVPP2_PRS_TCAM_HIT_IDX_REG, index);
+ 
+ 	val = mvpp2_read(priv, MVPP2_PRS_TCAM_HIT_CNT_REG);
+ 
+ 	val &= MVPP2_PRS_TCAM_HIT_CNT_MASK;
+ 
+	spin_unlock_bh(&priv->prs_spinlock);
+ 	return val;
+ }
+-- 
+2.43.0
+
@@ -1,2 +1,3 @@
-# Calculated with ../utils/kernel-refresh.sh
-sha256   d8d95404f8deeb7ff6992c0df855025062e9e8182bca6daa27ef2e9275d27749  linux-6.12.23.tar.xz
+# Locally calculated
+sha256  9ac322d85bcf98a04667d929f5c2666b15bd58c6c2d68dd512c72acbced07d04  linux-6.8.2.tar.xz
+sha256  fa5f22fd67dd05812d39dca579320c493048e26c4a556048a12385e7ae6fc698  linux-6.10.3.tar.xz
@@ -9,12 +9,10 @@ usage()
    echo
    echo "options:"
    echo "  -b FILE  Create backup FILE, appends detected version before .ext"
-    echo "  -e       Print all messages on stderr instead of syslog"
    echo "  -c       Check only, returns false when migration is not needed"
    echo "  -h       This help text"
    echo "  -i       Edit file in-place instead of sending to stdout, like sed"
    echo "  -q       Quiet, skip normal log messages, only errors are logged"
-    echo "  -s PATH  Specify custom script path"
    echo
    echo "By default, this script reads a .cfg file on stdin, or as the first"
    echo "non-option argument, then migrates it to a new syntax on stdout."
@@ -31,21 +29,12 @@ note()
    if [ -n "$quiet" ]; then
        return
    fi
-
-    if [ -n "$nolog" ]; then
-        echo "$1" >&2
-    else
-        logger -I $$ -k -p user.notice -t "$ident" "$1"
-    fi
+    logger -I $$ -k -p user.notice -t "$ident" "$1"
 }

 err()
 {
-    if [ -n "$nolog" ]; then
-        echo "Error: $1" >&2
-    else
-        logger -I $$ -k -p user.err -t "$ident" "$1"
-    fi
+    logger -I $$ -k -p user.err -t "$ident" "$1"
 }

 # Convert human-readable version to integer level
@@ -132,7 +121,7 @@ chmod 600 "$tmp"

 trap cleanup INT HUP TERM EXIT

-OPTS=$(getopt -o b:echiqs: -- "$@")
+OPTS=$(getopt -o b:chiq -- "$@")
 eval set -- "$OPTS"

 while [ -n "$1" ]; do
@@ -141,9 +130,6 @@ while [ -n "$1" ]; do
            bak=$2
            shift
            ;;
-        -e)
-            nolog=1
-            ;;
        -c)
            check=1
            ;;
@@ -157,10 +143,6 @@ while [ -n "$1" ]; do
        -q)
            quiet=1
            ;;
-        -s)
-            scripts=$2
-            shift
-            ;;
        --)
            shift
            break
@@ -19,11 +19,8 @@ AC_CONFIG_FILES([
 	share/migrate/1.3/Makefile
 	share/migrate/1.4/Makefile
 	share/migrate/1.5/Makefile
-	yang/Makefile
-	yang/confd/Makefile
-	yang/test-mode/Makefile
-	yang/rousette/Makefile
 	src/Makefile
+	yang/Makefile
 ])

 AC_PROG_CC
@@ -86,7 +83,7 @@ DATAROOTDIR=`eval echo $datarootdir`
 DATAROOTDIR=`eval echo $DATAROOTDIR`
 AC_SUBST(DATAROOTDIR)

-YANGDIR=`eval echo $datarootdir/yang/modules`
+YANGDIR=`eval echo $datarootdir/yang/modules/confd`
 AC_SUBST(YANGDIR)

 LIBDIR=`eval echo $libdir`
@@ -1 +1,2 @@
-SUBDIRS             = confd test-mode rousette
+yangdir   = $(YANGDIR)
+yang_DATA = $(wildcard *@*.yang) ieee802-types.yang ieee802-dot1ab-types.yang
@@ -1,20 +1,25 @@
 # -*- sh -*-
 # REMEMBER TO UPDATE infix-interfaces ALSO IN containers.inc
-
+#FORCE_UPDATE="infix-interfaces"
 MODULES=(
 	"ietf-system@2014-08-06.yang -e authentication -e local-users -e ntp -e ntp-udp-port -e timezone-name"
 	"iana-timezones@2013-11-19.yang"
+	"notifications@2008-07-14.yang"
+	"ietf-tcp-common@2023-12-28.yang -e keepalives-supported"
 	"ietf-interfaces@2018-02-20.yang -e if-mib"
 	"ietf-ip@2018-02-22.yang -e ipv6-privacy-autoconf"
 	"ietf-network-instance@2019-01-21.yang"
 	"ietf-netconf-monitoring@2010-10-04.yang"
+	"ietf-netconf-nmda@2019-01-07.yang -e origin -e with-defaults"
+	"ietf-subscribed-notifications@2019-09-09.yang -e encode-xml -e replay -e subtree -e xpath"
+	"ietf-yang-push@2019-09-09.yang -e on-change"
 	"ietf-routing@2018-03-13.yang"
 	"ietf-ipv6-unicast-routing@2018-03-13.yang"
 	"ietf-ipv4-unicast-routing@2018-03-13.yang"
 	"ietf-ospf@2022-10-19.yang -e bfd -e explicit-router-id"
 	"iana-if-type@2023-01-26.yang"
-        # NOTE: ietf-tls-client must be version matched with ietf-tls-server, used by netopeer2!
-	"ietf-tls-client@2023-12-28.yang"
+	# NOTE: ietf-tls-client must be version matched with ietf-tls-server, used by netopeer2!
+	"ietf-tls-client@2023-12-28.yang" # used by ietf-syslog (remote)
 	"ietf-syslog@2024-03-21.yang -e file-action -e file-limit-size -e remote-action"
 	"infix-syslog@2024-07-19.yang"
 	"iana-hardware@2018-03-13.yang"
@@ -38,4 +43,22 @@ MODULES=(
 	"infix-interfaces@2025-01-09.yang -e vlan-filtering"
 	"infix-crypto-types@2025-02-04.yang"
 	"infix-keystore@2025-02-04.yang"
+
+	# from rousette
+	"ietf-restconf@2017-01-26.yang"
+	"ietf-yang-patch@2017-02-22.yang"
+	"ietf-restconf-monitoring@2017-01-26.yang"
+
+	# from sysrepo
+	"sysrepo-plugind@2022-08-26.yang"
+	# from netopeer
+	"nc-notifications@2008-07-14.yang"
+	"ietf-crypto-types@2023-12-28.yang -e encrypted-private-keys"
+	"ietf-netconf-server@2023-12-28.yang -e ssh-listen -e tls-listen -e ssh-call-home -e tls-call-home"
+	"ietf-netconf-acm@2018-02-14.yang"
+	"ietf-netconf@2013-09-29.yang -e writable-running -e candidate -e rollback-on-error -e validate -e startup -e url -e xpath -e confirmed-commit"
+	"ietf-truststore@2023-12-28.yang -e central-truststore-supported -e certificates"
+	"ietf-keystore@2023-12-28.yang -e central-keystore-supported -e asymmetric-keys -e symmetric-keys"
+	"ietf-tls-server@2023-12-28.yang -e server-ident-raw-public-key -e server-ident-x509-cert"
+
 )
@@ -1,2 +0,0 @@
-yangdir   = $(YANGDIR)/confd
-yang_DATA = $(wildcard *@*.yang) ieee802-types.yang ieee802-dot1ab-types.yang
@@ -0,0 +1,374 @@
+module ietf-keystore {
+  yang-version 1.1;
+  namespace "urn:ietf:params:xml:ns:yang:ietf-keystore";
+  prefix ks;
+
+  import ietf-netconf-acm {
+    prefix nacm;
+    reference
+      "RFC 8341: Network Configuration Access Control Model";
+  }
+  import ietf-crypto-types {
+    prefix ct;
+    reference
+      "RFC AAAA: YANG Data Types and Groupings for Cryptography";
+  }
+
+  organization
+    "IETF NETCONF (Network Configuration) Working Group";
+  contact
+    "WG Web:   https://datatracker.ietf.org/wg/netconf
+     WG List:  NETCONF WG list <mailto:netconf@ietf.org>
+     Author:   Kent Watsen <mailto:kent+ietf@watsen.net>";
+  description
+    "This module defines a 'keystore' to centralize management
+     of security credentials.
+
+     Copyright (c) 2023 IETF Trust and the persons identified
+     as authors of the code. All rights reserved.
+
+     Redistribution and use in source and binary forms, with
+     or without modification, is permitted pursuant to, and
+     subject to the license terms contained in, the Revised
+     BSD License set forth in Section 4.c of the IETF Trust's
+     Legal Provisions Relating to IETF Documents
+     (https://trustee.ietf.org/license-info).
+
+     This version of this YANG module is part of RFC CCCC
+     (https://www.rfc-editor.org/info/rfcCCCC); see the RFC
+     itself for full legal notices.
+
+     The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
+     'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
+     'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
+     are to be interpreted as described in BCP 14 (RFC 2119)
+     (RFC 8174) when, and only when, they appear in all
+     capitals, as shown here.";
+
+  revision 2023-12-28 {
+    description
+      "Initial version";
+    reference
+      "RFC CCCC: A YANG Data Model for a Keystore";
+  }
+
+  feature central-keystore-supported {
+    description
+      "The 'central-keystore-supported' feature indicates that
+       the server supports the central keystore (i.e., fully
+       implements the 'ietf-keystore' module).";
+  }
+
+  feature inline-definitions-supported {
+    description
+      "The 'inline-definitions-supported' feature indicates that
+       the server supports locally-defined keys.";
+  }
+
+  feature asymmetric-keys {
+    description
+      "The 'asymmetric-keys' feature indicates that the server
+       implements the /keystore/asymmetric-keys subtree.";
+  }
+
+  feature symmetric-keys {
+    description
+      "The 'symmetric-keys' feature indicates that the server
+       implements the /keystore/symmetric-keys subtree.";
+  }
+
+  typedef symmetric-key-ref {
+    type leafref {
+      path "/ks:keystore/ks:symmetric-keys/ks:symmetric-key/ks:name";
+    }
+    description
+      "This typedef enables modules to easily define a reference
+       to a symmetric key stored in the central keystore.";
+  }
+
+  typedef asymmetric-key-ref {
+    type leafref {
+      path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key/ks:name";
+    }
+    description
+      "This typedef enables modules to easily define a reference
+       to an asymmetric key stored in the central keystore.";
+  }
+
+  grouping encrypted-by-grouping {
+    description
+      "A grouping that defines a 'choice' statement that can be
+       augmented into the 'encrypted-by' node, present in the
+       'symmetric-key-grouping' and 'asymmetric-key-pair-grouping'
+       groupings defined in RFC AAAA, enabling references to keys
+       in the central keystore.";
+    choice encrypted-by {
+      nacm:default-deny-write;
+      mandatory true;
+      description
+        "A choice amongst other symmetric or asymmetric keys.";
+      case symmetric-key-ref {
+        if-feature "central-keystore-supported";
+        if-feature "symmetric-keys";
+        leaf symmetric-key-ref {
+          type ks:symmetric-key-ref;
+          description
+            "Identifies the symmetric key used to encrypt the
+             associated key.";
+        }
+      }
+      case asymmetric-key-ref {
+        if-feature "central-keystore-supported";
+        if-feature "asymmetric-keys";
+        leaf asymmetric-key-ref {
+          type ks:asymmetric-key-ref;
+          description
+            "Identifies the asymmetric key whose public key
+             encrypted the associated key.";
+        }
+      }
+    }
+  }
+
+  grouping asymmetric-key-certificate-ref-grouping {
+    description
+      "Grouping for the reference to a certificate associated
+       with an asymmetric key stored in the central keystore.";
+    leaf asymmetric-key {
+      nacm:default-deny-write;
+      if-feature "central-keystore-supported";
+      if-feature "asymmetric-keys";
+      type ks:asymmetric-key-ref;
+      must '../certificate';
+      description
+        "A reference to an asymmetric key in the keystore.";
+    }
+    leaf certificate {
+      nacm:default-deny-write;
+      type leafref {
+        path "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key[ks:name = current()/../asymmetric-key]/ks:certificates/ks:certificate/ks:name";
+      }
+      must '../asymmetric-key';
+      description
+        "A reference to a specific certificate of the
+         asymmetric key in the keystore.";
+    }
+  }
+
+  grouping inline-or-keystore-symmetric-key-grouping {
+    description
+      "A grouping for the configuration of a symmetric key.  The
+       symmetric key may be defined inline or as a reference to
+       a symmetric key stored in the central keystore.
+
+       Servers that do not define the 'central-keystore-supported'
+       feature SHOULD augment in custom 'case' statements enabling
+       references to alternate keystore locations.";
+    choice inline-or-keystore {
+      nacm:default-deny-write;
+      mandatory true;
+      description
+        "A choice between an inlined definition and a definition
+         that exists in the keystore.";
+      case inline {
+        if-feature "inline-definitions-supported";
+        container inline-definition {
+          description
+            "Container to hold the local key definition.";
+          uses ct:symmetric-key-grouping;
+        }
+      }
+      case central-keystore {
+        if-feature "central-keystore-supported";
+        if-feature "symmetric-keys";
+        leaf central-keystore-reference {
+          type ks:symmetric-key-ref;
+          description
+            "A reference to an symmetric key that exists in
+             the central keystore.";
+        }
+      }
+    }
+  }
+
+  grouping inline-or-keystore-asymmetric-key-grouping {
+    description
+      "A grouping for the configuration of an asymmetric key. The
+       asymmetric key may be defined inline or as a reference to
+       an asymmetric key stored in the central keystore.
+
+       Servers that do not define the 'central-keystore-supported'
+       feature SHOULD augment in custom 'case' statements enabling
+       references to alternate keystore locations.";
+    choice inline-or-keystore {
+      nacm:default-deny-write;
+      mandatory true;
+      description
+        "A choice between an inlined definition and a definition
+         that exists in the keystore.";
+      case inline {
+        if-feature "inline-definitions-supported";
+        container inline-definition {
+          description
+            "Container to hold the local key definition.";
+          uses ct:asymmetric-key-pair-grouping;
+        }
+      }
+      case central-keystore {
+        if-feature "central-keystore-supported";
+        if-feature "asymmetric-keys";
+        leaf central-keystore-reference {
+          type ks:asymmetric-key-ref;
+          description
+            "A reference to an asymmetric key that exists in
+             the central keystore.  The intent is to reference
+             just the asymmetric key without any regard for
+             any certificates that may be associated with it.";
+        }
+      }
+    }
+  }
+
+  grouping inline-or-keystore-asymmetric-key-with-certs-grouping {
+    description
+      "A grouping for the configuration of an asymmetric key and
+       its associated certificates.  The asymmetric key and its
+       associated certificates may be defined inline or as a
+       reference to an asymmetric key (and its associated
+       certificates) in the central keystore.
+
+       Servers that do not define the 'central-keystore-supported'
+       feature SHOULD augment in custom 'case' statements enabling
+       references to alternate keystore locations.";
+    choice inline-or-keystore {
+      nacm:default-deny-write;
+      mandatory true;
+      description
+        "A choice between an inlined definition and a definition
+         that exists in the keystore.";
+      case inline {
+        if-feature "inline-definitions-supported";
+        container inline-definition {
+          description
+            "Container to hold the local key definition.";
+          uses ct:asymmetric-key-pair-with-certs-grouping;
+        }
+      }
+      case central-keystore {
+        if-feature "central-keystore-supported";
+        if-feature "asymmetric-keys";
+        leaf central-keystore-reference {
+          type ks:asymmetric-key-ref;
+          description
+            "A reference to an asymmetric-key (and all of its
+             associated certificates) in the keystore, when
+             this module is implemented.";
+        }
+      }
+    }
+  }
+
+  grouping inline-or-keystore-end-entity-cert-with-key-grouping {
+    description
+      "A grouping for the configuration of an asymmetric key and
+       its associated end-entity certificate.  The asymmetric key
+       and its associated end-entity certificate may be defined
+       inline or as a reference to an asymmetric key (and its
+       associated end-entity certificate) in the central keystore.
+
+       Servers that do not define the 'central-keystore-supported'
+       feature SHOULD augment in custom 'case' statements enabling
+       references to alternate keystore locations.";
+    choice inline-or-keystore {
+      nacm:default-deny-write;
+      mandatory true;
+      description
+        "A choice between an inlined definition and a definition
+         that exists in the keystore.";
+      case inline {
+        if-feature "inline-definitions-supported";
+        container inline-definition {
+          description
+            "Container to hold the local key definition.";
+          uses ct:asymmetric-key-pair-with-cert-grouping;
+        }
+      }
+      case central-keystore {
+        if-feature "central-keystore-supported";
+        if-feature "asymmetric-keys";
+        container central-keystore-reference {
+          description
+            "A reference to a specific certificate associated with
+             an asymmetric key stored in the central keystore.";
+          uses asymmetric-key-certificate-ref-grouping;
+        }
+      }
+    }
+  }
+
+  grouping keystore-grouping {
+    description
+      "Grouping definition enables use in other contexts.  If ever
+       done, implementations MUST augment new 'case' statements
+       into the various inline-or-keystore 'choice' statements to
+       supply leafrefs to the model-specific location(s).";
+    container asymmetric-keys {
+      nacm:default-deny-write;
+      if-feature "asymmetric-keys";
+      description
+        "A list of asymmetric keys.";
+      list asymmetric-key {
+        key "name";
+        description
+          "An asymmetric key.";
+        leaf name {
+          type string;
+          description
+            "An arbitrary name for the asymmetric key.";
+        }
+        uses ct:asymmetric-key-pair-with-certs-grouping;
+      }
+    }
+    container symmetric-keys {
+      nacm:default-deny-write;
+      if-feature "symmetric-keys";
+      description
+        "A list of symmetric keys.";
+      list symmetric-key {
+        key "name";
+        description
+          "A symmetric key.";
+        leaf name {
+          type string;
+          description
+            "An arbitrary name for the symmetric key.";
+        }
+        uses ct:symmetric-key-grouping;
+      }
+    }
+  }
+
+  container keystore {
+    nacm:default-deny-write;
+    if-feature "central-keystore-supported";
+    description
+      "A central keystore containing a list of symmetric keys and
+       a list of asymmetric keys.";
+    uses keystore-grouping {
+      augment "symmetric-keys/symmetric-key/key-type/encrypted-key/encrypted-key/encrypted-by" {
+        description
+          "Augments in a choice statement enabling the encrypting
+           key to be any other symmetric or asymmetric key in the
+           central keystore.";
+        uses encrypted-by-grouping;
+      }
+      augment "asymmetric-keys/asymmetric-key/private-key-type/encrypted-private-key/encrypted-private-key/encrypted-by" {
+        description
+          "Augments in a choice statement enabling the encrypting
+           key to be any other symmetric or asymmetric key in the
+           central keystore.";
+        uses encrypted-by-grouping;
+      }
+    }
+  }
+}
@@ -0,0 +1,316 @@
+module ietf-tls-common {
+  yang-version 1.1;
+  namespace "urn:ietf:params:xml:ns:yang:ietf-tls-common";
+  prefix tlscmn;
+
+  import iana-tls-cipher-suite-algs {
+    prefix tlscsa;
+    reference
+      "RFC FFFF: YANG Groupings for TLS Clients and SSH Servers";
+  }
+
+  import ietf-crypto-types {
+    prefix ct;
+    reference
+      "RFC AAAA: YANG Data Types and Groupings for Cryptography";
+  }
+
+  import ietf-keystore {
+    prefix ks;
+    reference
+      "RFC CCCC: A YANG Data Model for a Keystore";
+  }
+
+  organization
+    "IETF NETCONF (Network Configuration) Working Group";
+
+  contact
+    "WG List:  NETCONF WG list <mailto:netconf@ietf.org>
+     WG Web:   https://datatracker.ietf.org/wg/netconf
+     Author:   Kent Watsen <mailto:kent+ietf@watsen.net>
+     Author:   Jeff Hartley <mailto:jeff.hartley@commscope.com>
+     Author:   Gary Wu <mailto:garywu@cisco.com>";
+
+   description
+    "This module defines a common features and groupings for
+     Transport Layer Security (TLS).
+
+     Copyright (c) 2023 IETF Trust and the persons identified
+     as authors of the code. All rights reserved.
+
+     Redistribution and use in source and binary forms, with
+     or without modification, is permitted pursuant to, and
+     subject to the license terms contained in, the Revised
+     BSD License set forth in Section 4.c of the IETF Trust's
+     Legal Provisions Relating to IETF Documents
+     (https://trustee.ietf.org/license-info).
+
+     This version of this YANG module is part of RFC FFFF
+     (https://www.rfc-editor.org/info/rfcFFFF); see the RFC
+     itself for full legal notices.
+
+     The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
+     'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
+     'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
+     are to be interpreted as described in BCP 14 (RFC 2119)
+     (RFC 8174) when, and only when, they appear in all
+     capitals, as shown here.";
+
+  revision 2023-12-28 {
+    description
+      "Initial version";
+    reference
+      "RFC FFFF: YANG Groupings for TLS Clients and TLS Servers";
+  }
+
+  // Features
+
+  feature tls10 {
+    status "obsolete";
+    description
+      "TLS Protocol Version 1.0 is supported.  TLS 1.0 is obsolete
+       and thus it is NOT RECOMMENDED to enable this feature.";
+    reference
+      "RFC 2246: The TLS Protocol Version 1.0";
+  }
+
+  feature tls11 {
+    status "obsolete";
+    description
+      "TLS Protocol Version 1.1 is supported.  TLS 1.1 is obsolete
+       and thus it is NOT RECOMMENDED to enable this feature.";
+    reference
+      "RFC 4346: The Transport Layer Security (TLS) Protocol
+                 Version 1.1";
+  }
+
+  feature tls12 {
+    status "deprecated";
+    description
+      "TLS Protocol Version 1.2 is supported. TLS 1.2 is obsolete
+       and thus it is NOT RECOMMENDED to enable this feature.";
+    reference
+      "RFC 5246: The Transport Layer Security (TLS) Protocol
+                 Version 1.2";
+  }
+
+  feature tls13 {
+    description
+      "TLS Protocol Version 1.3 is supported.";
+    reference
+      "RFC 8446: The Transport Layer Security (TLS)
+                 Protocol Version 1.3";
+  }
+
+  feature hello-params {
+    description
+      "TLS hello message parameters are configurable.";
+  }
+
+  feature public-key-generation {
+    description
+      "Indicates that the server implements the
+       'generate-public-key' RPC.";
+  }
+
+  // Identities
+
+  identity tls-version-base {
+    description
+      "Base identity used to identify TLS protocol versions.";
+  }
+
+  identity tls10 {
+    if-feature "tls10";
+    base tls-version-base;
+    status "obsolete";
+    description
+      "TLS Protocol Version 1.0.";
+    reference
+      "RFC 2246: The TLS Protocol Version 1.0";
+  }
+
+  identity tls11 {
+    if-feature "tls11";
+    base tls-version-base;
+    status "obsolete";
+    description
+      "TLS Protocol Version 1.1.";
+    reference
+      "RFC 4346: The Transport Layer Security (TLS) Protocol
+                 Version 1.1";
+  }
+
+  identity tls12 {
+    if-feature "tls12";
+    base tls-version-base;
+    status "deprecated";
+    description
+      "TLS Protocol Version 1.2.";
+    reference
+      "RFC 5246: The Transport Layer Security (TLS) Protocol
+                 Version 1.2";
+  }
+
+  identity tls13 {
+    if-feature "tls13";
+    base tls-version-base;
+    description
+      "TLS Protocol Version 1.3.";
+    reference
+      "RFC 8446: The Transport Layer Security (TLS)
+                 Protocol Version 1.3";
+  }
+
+  // Typedefs
+
+  typedef epsk-supported-hash {
+    type enumeration {
+      enum sha-256 {
+        description
+          "The SHA-256 Hash.";
+      }
+      enum sha-384 {
+        description
+          "The SHA-384 Hash.";
+      }
+    }
+    description
+      "As per Section 4.2.11 of RFC 8446, the hash algorithm
+       supported by an instance of an External Pre-Shared
+       Key (EPSK).";
+    reference
+      "RFC 8446: The Transport Layer Security (TLS)
+                 Protocol Version 1.3";
+  }
+
+
+  // Groupings
+
+  grouping hello-params-grouping {
+    description
+      "A reusable grouping for TLS hello message parameters.";
+    reference
+      "RFC 5246: The Transport Layer Security (TLS) Protocol
+                 Version 1.2
+       RFC 8446: The Transport Layer Security (TLS) Protocol
+                 Version 1.3";
+    container tls-versions {
+      description
+        "Parameters regarding TLS versions.";
+      leaf-list tls-version {
+        type identityref {
+          base tls-version-base;
+        }
+        ordered-by user;
+        description
+          "Acceptable TLS protocol versions.
+
+           If this leaf-list is not configured (has zero elements)
+           the acceptable TLS protocol versions are implementation-
+           defined.";
+      }
+    }
+    container cipher-suites {
+      description
+        "Parameters regarding cipher suites.";
+      leaf-list cipher-suite {
+        type identityref {
+          base tlscsa:cipher-suite-alg-base;
+        }
+        ordered-by user;
+        description
+          "Acceptable cipher suites in order of descending
+           preference.  The configured host key algorithms should
+           be compatible with the algorithm used by the configured
+           private key.  Please see Section 5 of RFC FFFF for
+           valid combinations.
+
+           If this leaf-list is not configured (has zero elements)
+           the acceptable cipher suites are implementation-
+           defined.";
+        reference
+          "RFC FFFF: YANG Groupings for TLS Clients and TLS Servers";
+      }
+    }
+  } // hello-params-grouping
+
+  rpc generate-public-key {
+    if-feature "public-key-generation";
+    description
+      "Requests the device to generate an public key using
+       the specified key algorithm.";
+    input {
+      leaf algorithm {
+        type tlscsa:cipher-suite-algorithm-ref;
+        mandatory true;
+        description
+          "The cipher suite algorithm that the generated key is
+           to work with.  Implementations derive the public key
+           algorithm from the cipher suite algorithm.  Example:
+           cipher suite 'tls-rsa-with-aes-256-cbc-sha256' maps
+           to the RSA public key.";
+      }
+      leaf num-bits {
+        type uint16;
+        description
+          "Specifies the number of bits in the key to create.
+           For RSA keys, the minimum size is 1024 bits and
+           the default is 3072 bits. Generally, 3072 bits is
+           considered sufficient. DSA keys must be exactly 1024
+           bits as specified by FIPS 186-2.  For elliptical
+           keys, the 'num-bits' value determines the key length
+           of the curve (e.g., 256, 384 or 521), where valid
+           values supported by the server are conveyed via an
+           unspecified mechanism.  For some public algorithms,
+           the keys have a fixed length and thus the 'num-bits'
+           value is not specified.";
+      }
+      container private-key-encoding {
+        description
+          "Indicates how the private key is to be encoded.";
+        choice private-key-encoding {
+          mandatory true;
+          description
+            "A choice amongst optional private key handling.";
+          case cleartext {
+            if-feature "ct:cleartext-private-keys";
+            leaf cleartext {
+              type empty;
+              description
+                "Indicates that the private key is to be returned
+                 as a cleartext value.";
+            }
+          }
+          case encrypted {
+            if-feature "ct:encrypted-private-keys";
+            container encrypted {
+              description
+                 "Indicates that the key is to be encrypted using
+                  the specified symmetric or asymmetric key.";
+              uses ks:encrypted-by-grouping;
+            }
+          }
+          case hidden {
+            if-feature "ct:hidden-private-keys";
+            leaf hidden {
+              type empty;
+              description
+                "Indicates that the private key is to be hidden.
+
+                 Unlike the 'cleartext' and 'encrypt' options, the
+                 key returned is a placeholder for an internally
+                 stored key.  See the 'Support for Built-in Keys'
+                 section in RFC CCCC for information about hidden
+                 keys.";
+            }
+          }
+        }
+      }
+    }
+    output {
+      uses ct:asymmetric-key-pair-grouping;
+    }
+  } // end generate-public-key
+
+}
@@ -0,0 +1,359 @@
+module ietf-truststore {
+  yang-version 1.1;
+  namespace "urn:ietf:params:xml:ns:yang:ietf-truststore";
+  prefix ts;
+
+  import ietf-netconf-acm {
+    prefix nacm;
+    reference
+      "RFC 8341: Network Configuration Access Control Model";
+  }
+  import ietf-crypto-types {
+    prefix ct;
+    reference
+      "RFC AAAA: YANG Data Types and Groupings for Cryptography";
+  }
+
+  organization
+    "IETF NETCONF (Network Configuration) Working Group";
+  contact
+    "WG Web  : https://datatracker.ietf.org/wg/netconf
+     WG List : NETCONF WG list <mailto:netconf@ietf.org>
+     Author  : Kent Watsen <kent+ietf@watsen.net>";
+  description
+    "This module defines a 'truststore' to centralize management
+     of trust anchors including certificates and public keys.
+
+     Copyright (c) 2023 IETF Trust and the persons identified
+     as authors of the code. All rights reserved.
+
+     Redistribution and use in source and binary forms, with
+     or without modification, is permitted pursuant to, and
+     subject to the license terms contained in, the Revised
+     BSD License set forth in Section 4.c of the IETF Trust's
+     Legal Provisions Relating to IETF Documents
+     (https://trustee.ietf.org/license-info).
+
+     This version of this YANG module is part of RFC BBBB
+     (https://www.rfc-editor.org/info/rfcBBBB); see the RFC
+     itself for full legal notices.
+
+     The key words 'MUST', 'MUST NOT', 'REQUIRED', 'SHALL',
+     'SHALL NOT', 'SHOULD', 'SHOULD NOT', 'RECOMMENDED',
+     'NOT RECOMMENDED', 'MAY', and 'OPTIONAL' in this document
+     are to be interpreted as described in BCP 14 (RFC 2119)
+     (RFC 8174) when, and only when, they appear in all
+     capitals, as shown here.";
+
+  revision 2023-12-28 {
+    description
+      "Initial version";
+    reference
+      "RFC BBBB: A YANG Data Model for a Truststore";
+  }
+
+  feature central-truststore-supported {
+    description
+      "The 'central-truststore-supported' feature indicates that
+       the server supports the truststore (i.e., implements the
+       'ietf-truststore' module).";
+  }
+
+  feature inline-definitions-supported {
+    description
+      "The 'inline-definitions-supported' feature indicates that
+       the server supports locally-defined trust anchors.";
+  }
+
+  feature certificates {
+    description
+      "The 'certificates' feature indicates that the server
+       implements the /truststore/certificate-bags subtree.";
+  }
+
+  feature public-keys {
+    description
+      "The 'public-keys' feature indicates that the server
+       implements the /truststore/public-key-bags subtree.";
+  }
+
+  typedef certificate-bag-ref {
+    type leafref {
+      path "/ts:truststore/ts:certificate-bags/ts:certificate-bag/ts:name";
+    }
+    description
+      "This typedef defines a reference to a certificate bag
+       in the central truststore.";
+  }
+
+  typedef certificate-ref {
+    type leafref {
+      path "/ts:truststore/ts:certificate-bags/ts:certificate-bag[ts:name = current()/../certificate-bag]/ts:certificate/ts:name";
+    }
+    description
+      "This typedef defines a reference to a specific certificate
+       in a certificate bag in the central truststore. This typedef
+       requires that there exist a sibling 'leaf' node called
+       'certificate-bag' that SHOULD have the typedef
+       'certificate-bag-ref'.";
+  }
+
+  typedef public-key-bag-ref {
+    type leafref {
+      path "/ts:truststore/ts:public-key-bags/ts:public-key-bag/ts:name";
+    }
+    description
+      "This typedef defines a reference to a public key bag
+       in the central truststore.";
+  }
+
+  typedef public-key-ref {
+    type leafref {
+      path "/ts:truststore/ts:public-key-bags/ts:public-key-bag[ts:name = current()/../public-key-bag]/ts:public-key/ts:name";
+    }
+    description
+      "This typedef defines a reference to a specific public key
+       in a public key bag in the truststore.  This typedef
+       requires that there exist a sibling 'leaf' node called
+       'public-key-bag' that SHOULD have the typedef
+       'public-key-bag-ref'.";
+  }
+
+  grouping certificate-ref-grouping {
+    description
+      "Grouping for the reference to a certificate in a
+       certificate-bag in the central truststore.";
+    leaf certificate-bag {
+      nacm:default-deny-write;
+      if-feature "central-truststore-supported";
+      if-feature "certificates";
+      type ts:certificate-bag-ref;
+      must "../certificate";
+      description
+        "Reference to a certificate-bag in the truststore.";
+    }
+    leaf certificate {
+      nacm:default-deny-write;
+      type ts:certificate-ref;
+      must "../certificate-bag";
+      description
+        "Reference to a specific certificate in the
+         referenced certificate-bag.";
+    }
+  }
+
+  grouping public-key-ref-grouping {
+    description
+      "Grouping for the reference to a public key in a
+       public-key-bag in the central truststore.";
+    leaf public-key-bag {
+      nacm:default-deny-write;
+      if-feature "central-truststore-supported";
+      if-feature "public-keys";
+      type ts:public-key-bag-ref;
+      description
+        "Reference of a public key bag in the truststore inlucding
+         the certificate to authenticate the TLS client.";
+    }
+    leaf public-key {
+      nacm:default-deny-write;
+      type ts:public-key-ref;
+      description
+        "Reference to a specific public key in the
+         referenced public-key-bag.";
+    }
+  }
+
+  grouping inline-or-truststore-certs-grouping {
+    description
+      "A grouping for the configuration of a list of certificates.
+       The list of certificate may be defined inline or as a
+       reference to a certificate bag in the central truststore.
+
+       Servers that do not define the 'central-truststore-supported'
+       feature SHOULD augment in custom 'case' statements enabling
+       references to alternate truststore locations.";
+    choice inline-or-truststore {
+      nacm:default-deny-write;
+      mandatory true;
+      description
+        "A choice between an inlined definition and a definition
+         that exists in the truststore.";
+      case inline {
+        if-feature "inline-definitions-supported";
+        container inline-definition {
+          description
+            "A container for locally configured trust anchor
+             certificates.";
+          list certificate {
+            key "name";
+            min-elements 1;
+            description
+              "A trust anchor certificate.";
+            leaf name {
+              type string;
+              description
+                "An arbitrary name for this certificate.";
+            }
+            uses ct:trust-anchor-cert-grouping {
+              refine "cert-data" {
+                mandatory true;
+              }
+            }
+          }
+        }
+      }
+      case central-truststore {
+        if-feature "central-truststore-supported";
+        if-feature "certificates";
+        leaf central-truststore-reference {
+          type ts:certificate-bag-ref;
+          description
+            "A reference to a certificate bag that exists in the
+             central truststore.";
+        }
+      }
+    }
+  }
+
+  grouping inline-or-truststore-public-keys-grouping {
+    description
+      "A grouping that allows the public keys to be either
+       configured locally, within the using data model, or be a
+       reference to a public key bag stored in the truststore.
+
+       Servers that do not define the 'central-truststore-supported'
+       feature SHOULD augment in custom 'case' statements enabling
+       references to alternate truststore locations.";
+    choice inline-or-truststore {
+      nacm:default-deny-write;
+      mandatory true;
+      description
+        "A choice between an inlined definition and a definition
+         that exists in the truststore.";
+      case inline {
+        if-feature "inline-definitions-supported";
+        container inline-definition {
+          description
+            "A container to hold local public key definitions.";
+          list public-key {
+            key "name";
+            description
+              "A public key definition.";
+            leaf name {
+              type string;
+              description
+                "An arbitrary name for this public key.";
+            }
+            uses ct:public-key-grouping;
+          }
+        }
+      }
+      case central-truststore {
+        if-feature "central-truststore-supported";
+        if-feature "public-keys";
+        leaf central-truststore-reference {
+          type ts:public-key-bag-ref;
+          description
+            "A reference to a bag of public keys that exists
+             in the central truststore.";
+        }
+      }
+    }
+  }
+
+  grouping truststore-grouping {
+    description
+      "A grouping definition that enables use in other contexts.
+       Where used, implementations MUST augment new 'case'
+       statements into the various inline-or-truststore 'choice'
+       statements to supply leafrefs to the model-specific
+       location(s).";
+    container certificate-bags {
+      nacm:default-deny-write;
+      if-feature "certificates";
+      description
+        "A collection of certificate bags.";
+      list certificate-bag {
+        key "name";
+        description
+          "A bag of certificates.  Each bag of certificates SHOULD
+           be for a specific purpose.  For instance, one bag could
+           be used to authenticate a specific set of servers, while
+           another could be used to authenticate a specific set of
+           clients.";
+        leaf name {
+          type string;
+          description
+            "An arbitrary name for this bag of certificates.";
+        }
+        leaf description {
+          type string;
+          description
+            "A description for this bag of certificates.  The
+             intended purpose for the bag SHOULD be described.";
+        }
+        list certificate {
+          key "name";
+          description
+            "A trust anchor certificate.";
+          leaf name {
+            type string;
+            description
+              "An arbitrary name for this certificate.";
+          }
+          uses ct:trust-anchor-cert-grouping {
+            refine "cert-data" {
+              mandatory true;
+            }
+          }
+        }
+      }
+    }
+    container public-key-bags {
+      nacm:default-deny-write;
+      if-feature "public-keys";
+      description
+        "A collection of public key bags.";
+      list public-key-bag {
+        key "name";
+        description
+          "A bag of public keys.  Each bag of keys SHOULD be for
+           a specific purpose.  For instance, one bag could be used
+           authenticate a specific set of servers, while another
+           could be used to authenticate a specific set of clients.";
+        leaf name {
+          type string;
+          description
+            "An arbitrary name for this bag of public keys.";
+        }
+        leaf description {
+          type string;
+          description
+            "A description for this bag public keys.  The
+             intended purpose for the bag SHOULD be described.";
+        }
+        list public-key {
+          key "name";
+          description
+            "A public key.";
+          leaf name {
+            type string;
+            description
+              "An arbitrary name for this public key.";
+          }
+          uses ct:public-key-grouping;
+        }
+      }
+    }
+  }
+
+  container truststore {
+    nacm:default-deny-write;
+    if-feature "central-truststore-supported";
+    description
+      "The truststore contains bags of certificates and
+       public keys.";
+    uses truststore-grouping;
+  }
+}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Mattias Walström	e3fe203005	Minor changes in changelog	2025-04-11 16:27:01 +02:00
Mattias Walström	18f7c779c9	Changelog: Prepare for release 25.03.01	2025-04-11 14:09:57 +02:00
Mattias Walström	454207c185	Fix migration when SSH server settings exist This fix #1015	2025-04-11 14:05:53 +02:00
Richard AlpeandMattias Walström	d877806e2b	confd: remove prefix from version leaf in migrate Signed-off-by: Richard Alpe <richard@bit42.se>	2025-04-11 14:04:38 +02:00
Richard AlpeandMattias Walström	5ed7182361	confd: fix indentation of bin/migrate Don't mix tabs and spaces. Signed-off-by: Richard Alpe <richard@bit42.se>	2025-04-11 14:04:24 +02:00
Mattias Walström	3f695b6c62	Fix symlink in release packages Fix #1002	2025-04-11 14:03:57 +02:00
Mattias Walström	4f3605a5f7	migrate: Fix typo resulting in not logging correctly	2025-04-11 14:03:42 +02:00
Joachim WibergandMattias Walström	e89dde0d25	confd: set correct file version of migrated files in backup Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-04-11 14:03:28 +02:00
Joachim WibergandMattias Walström	e1ecf6b71d	board/common: set wheel group on /cfg/backup dir Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2025-04-11 14:03:16 +02:00