QSDK NSS builds utilize skbuff recycling for better handling of memory.

On a Dynalink DL-WRX36 (pbuf script should be set to 'auto') a significant drop in
memory usage was observed as well consistent sustained RX/TX speeds.

BEFORE:
echo 3 >! /proc/sys/vm/drop_caches

free -m
               total        used        free      shared  buff/cache   available
Mem:             867         338         547          90         101         528
Swap:              0           0           0

AFTER:
               total        used        free      shared  buff/cache   available
Mem:             867         242         594           1          81         624
Swap:              0           0           0

NOTE:

For 512MB platforms, users need to test with the following scenarios,
as the patch `999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch` is
really only testable on platforms with 512M or less RAM.

1.) Explicitly setting 'ATH11K_MEM_PROFILE_512M' on and see if system
    crashes on boot.

2.) Explicitly setting 'ATH11K_MEM_PROFILE_1G'

3.) Remove patches
    999-233-ath11k-Disable-rx_header-tlv-for-2K-SKB.patch
    999-311-ath11k-configure-nss-thread-priority-during-pdev_ini.patch

    And re-test with testuser7#1 and testuser7#2

It was incorrectly assumed that setting a 512M for 1G platforms would save
memory, instead it needs to be explicitly set to know proper memory
regions, otherwise it would cause fw crash.

ath11k_nss: fix typo in 512M memory profile

ath11k_nss: remove SFE patch 718-e-mac80211-Deliver-the-frame-to-driver-tx-ops-directly

It is not relevant to NSS builds and only meant for SFE.

ath11k_nss: remove unecessary patches

Color collision should be left on by default, as it's a primary feature
of 802.11AX.

ath11k_nss: fix spacing

ath11k_nss: Remove unnecessary TKIP bloat

Remove TKIP patches that are not being used as 99% of folks are running
modern encryption (AES-CCMP,SAE,etc).

ath11k_nss: parameterize DP_RXDMA_REFILL_RING_SIZE memory profile

ath11k_nss: Remove SFE related code

Cleanup SFE (shortcut fe) related code as we're not using it on NSS

ath11k_nss: idr, ampdu, and skb headroom check optimizations

ath11k_nss: get valid last_rate for rx_bitrate from cpu stats

ath11k_nss: Fix BCCA counter for EMA

Currently BCCA counter is updated to FW via csa counter offs and
beacon with new countdown is updated for every beacon tx completion event.
For EMA, all EMA beacons are updated in one shot, and counter update for
every tx event will mess up the actual sequence of countdown sent over the air.

Allow FW to update the countdown till 1 and finalize the color
change.

ath11k_nss: Fix compile for TRACE feature

Currently, when removing ath11k or any other driver that uses dummy netdev
kernel will crash with:
[  365.004961] ------------[ cut here ]------------
[  365.004992] kernel BUG at net/core/dev.c:10979!
[  365.008642] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
[  365.012898] Modules linked in: pppoe ppp_async nft_fib_inet nf_flow_table_inet ath11k_ahb(O) ath11k(O) pppox ppp_generic nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_c
[  365.064794] CPU: 3 PID: 3896 Comm: procd Tainted: G           O       6.6.52 #0
[  365.087031] Hardware name: QNAP 301w (DT)
[  365.094058] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  365.098229] pc : free_netdev+0x164/0x1a0
[  365.104994] lr : free_netdev+0xec/0x1a0
[  365.109159] sp : ffffffc081d33b90
[  365.112718] x29: ffffffc081d33b90 x28: ffffff80039d3c00 x27: ffffff800307f000
[  365.116199] x26: ffffff800538a000 x25: ffffff8005388000 x24: ffffff800538a4c0
[  365.123317] x23: 00000000000023a4 x22: ffffff8005388f68 x21: ffffff8004e37050
[  365.130434] x20: ffffff8004e37000 x19: ffffff8004e36ee8 x18: 0000000000000152
[  365.137552] x17: 63775f357636712e x16: 3030303030646320 x15: ffffffc081436e20
[  365.144670] x14: ffffff80033f261c x13: 00000000000000d9 x12: 0000000000000002
[  365.151789] x11: 0000000000000000 x10: 00000000000008a0 x9 : ffffffc081d33980
[  365.158906] x8 : ffffff80039d4500 x7 : ffffff803fdda6c0 x6 : 0000000000000007
[  365.166025] x5 : 0000000000000000 x4 : 00000000000000c1 x3 : 00000000000001f4
[  365.173143] x2 : ffffff803fdd4b78 x1 : ffffff8004e37050 x0 : 0000000000000005
[  365.180261] Call trace:
[  365.187370]  free_netdev+0x164/0x1a0
[  365.189630]  0xffffffc079b373f0
[  365.193447]  0xffffffc079b374c0
[  365.196311]  platform_shutdown+0x24/0x34
[  365.199438]  device_shutdown+0x160/0x268
[  365.203605]  kernel_restart+0x40/0xc0
[  365.207510]  __do_sys_reboot+0x104/0x220
[  365.211070]  __arm64_sys_reboot+0x24/0x30
[  365.215063]  invoke_syscall.constprop.0+0x5c/0x108
[  365.218971]  do_el0_svc+0x40/0xc8
[  365.223655]  el0_svc+0x30/0xb8
[  365.227041]  el0t_64_sync_handler+0x120/0x12c
[  365.229995]  el0t_64_sync+0x178/0x17c
[  365.234424] Code: f94013f5 a8c37bfd d50323bf d65f03c0 (d4210000)
[  365.238072] ---[ end trace 0000000000000000 ]---

Wireless backports include alloc_netdev_dummy() backport but they dont have
the required free_netdev change first, so backport it.

Fixes: openwrt#16531
Fixes: 384d079 ("mac80211: update to version 6.11")
Link: openwrt#16549
Signed-off-by: Robert Marko <robimarko@gmail.com>

It looks like VRX518 returns phys addr of data buffer in the 'data_ptr'
field of the RX descriptor and an actual data offset within the buffer
in the 'byte_off' field. In order to map the phys address back to
virtual we need the original phys address of the allocated buffer.

In the same driver applies offset to phys address before the mapping,
what leads to WARN_ON triggering in plat_mem_virt() function with
subsequent kernel panic:

  WARNING: CPU: 0 PID: 0 at .../sw_plat.c:764 0xbf306cd0 [vrx518_tc@8af9f5d0+0x25000]
  ...
  Unable to handle kernel NULL pointer dereference at virtual address 00000000
  pgd = aff5701e
  [00000000] *pgd=00000000
  Internal error: Oops: 5 [#1] SMP ARM

Noticed in ATM mode, when chip always returns byte_off = 4.

In order to fix the issue, pass the phys address to plat_mem_virt() as
is and apply byte_off later for proper DMA syncing and on mapped virtual
address when copying RXed data into the skb.

Run tested with FRITZ!Box 7530 on both ADSL and VDSL (thanks Jan) links.

Fixes: 474bbe2 ("kernel: add Intel/Lantiq VRX518 TC driver")
Tested-by: Jan Hoffmann <jan@3e8.eu> # VDSL link
Reported-and-tested-by: nebibigon93@yandex.ru # ADSL link
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Link: https://patchwork.ozlabs.org/project/openwrt/patch/20250122222654.21833-2-ryazanov.s.a@gmail.com/
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

It looks like VRX518 returns phys addr of data buffer in the 'data_ptr'
field of the RX descriptor and an actual data offset within the buffer
in the 'byte_off' field. In order to map the phys address back to
virtual we need the original phys address of the allocated buffer.

In the same driver applies offset to phys address before the mapping,
what leads to WARN_ON triggering in plat_mem_virt() function with
subsequent kernel panic:

  WARNING: CPU: 0 PID: 0 at .../sw_plat.c:764 0xbf306cd0 [vrx518_tc@8af9f5d0+0x25000]
  ...
  Unable to handle kernel NULL pointer dereference at virtual address 00000000
  pgd = aff5701e
  [00000000] *pgd=00000000
  Internal error: Oops: 5 [#1] SMP ARM

Noticed in ATM mode, when chip always returns byte_off = 4.

In order to fix the issue, pass the phys address to plat_mem_virt() as
is and apply byte_off later for proper DMA syncing and on mapped virtual
address when copying RXed data into the skb.

Run tested with FRITZ!Box 7530 on both ADSL and VDSL (thanks Jan) links.

Fixes: 474bbe2 ("kernel: add Intel/Lantiq VRX518 TC driver")
Tested-by: Jan Hoffmann <jan@3e8.eu> # VDSL link
Reported-and-tested-by: nebibigon93@yandex.ru # ADSL link
Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
Link: https://patchwork.ozlabs.org/project/openwrt/patch/20250122222654.21833-2-ryazanov.s.a@gmail.com/
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 7bd5796)

Add missing function reference for the l2_hash_seed call in rtl931x_reg
in the rtl83xx DSA driver part.
While at it, rename the referenced function to proper naming convention
and simplify its content.

The missing reference causes a hard crash after a short time (on
MS510TXM) because the driver assumes the reference always exists.

[  111.785559] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 00000000, ra == 805469a0
[  111.800991] Oops[#1]:
[  111.801026] CPU: 0 PID: 11 Comm: kworker/u8:0 Tainted: G           O       6.12.33 #0
[  111.801046] Workqueue: dsa_ordered dsa_slave_switchdev_event_work
...
[  111.880600] epc   : 00000000 0x0
[  111.884219] ra    : 805469a0 rtl83xx_port_fdb_add+0x7c/0x204
[  111.890570] Status: 11000403 KERNEL EXL IE
[  111.895263] Cause : 50800008 (ExcCode 02)
[  111.899731] BadVA : 00000000
[  111.902946] PrId  : 0001a120 (MIPS interAptiv (multi))
[  111.956086] Process kworker/u8:0 (pid: 11, threadinfo=0b107c25, task=265aeb31, tls=00000000)
...
[  112.015167] Call Trace:
[  112.019549] [<80170b04>] load_balance+0x494/0x708
[  112.025022] [<807bb368>] dsa_port_do_fdb_add+0x24c/0x340
[  112.031048] [<807bc868>] dsa_switch_event+0xd44/0x13cc
[  112.036845] [<8015867c>] raw_notifier_call_chain+0x48/0x88
[  112.043031] [<807bcf3c>] dsa_tree_notify+0x10/0x3c
[  112.048395] [<807b2a64>] dsa_port_bridge_host_fdb_add+0x15c/0x190
[  112.055459] [<807b4e40>] dsa_slave_switchdev_event_work+0x164/0x1cc
...

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: openwrt#19170
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

Add missing function reference for the l2_hash_seed call in rtl931x_reg
in the rtl83xx DSA driver part.
While at it, rename the referenced function to proper naming convention
and simplify its content.

The missing reference causes a hard crash after a short time (on
MS510TXM) because the driver assumes the reference always exists.

[  111.785559] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 00000000, ra == 805469a0
[  111.800991] Oops[#1]:
[  111.801026] CPU: 0 PID: 11 Comm: kworker/u8:0 Tainted: G           O       6.12.33 #0
[  111.801046] Workqueue: dsa_ordered dsa_slave_switchdev_event_work
...
[  111.880600] epc   : 00000000 0x0
[  111.884219] ra    : 805469a0 rtl83xx_port_fdb_add+0x7c/0x204
[  111.890570] Status: 11000403 KERNEL EXL IE
[  111.895263] Cause : 50800008 (ExcCode 02)
[  111.899731] BadVA : 00000000
[  111.902946] PrId  : 0001a120 (MIPS interAptiv (multi))
[  111.956086] Process kworker/u8:0 (pid: 11, threadinfo=0b107c25, task=265aeb31, tls=00000000)
...
[  112.015167] Call Trace:
[  112.019549] [<80170b04>] load_balance+0x494/0x708
[  112.025022] [<807bb368>] dsa_port_do_fdb_add+0x24c/0x340
[  112.031048] [<807bc868>] dsa_switch_event+0xd44/0x13cc
[  112.036845] [<8015867c>] raw_notifier_call_chain+0x48/0x88
[  112.043031] [<807bcf3c>] dsa_tree_notify+0x10/0x3c
[  112.048395] [<807b2a64>] dsa_port_bridge_host_fdb_add+0x15c/0x190
[  112.055459] [<807b4e40>] dsa_slave_switchdev_event_work+0x164/0x1cc
...

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: openwrt#19170
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

The ix4-200d is a 4 bay NAS supported since OpenWrt 23.05. Drive trays
controller. Due to a kernel-related issue with the SATA controller,
trays #1 and #2 were not recognized. This issue has been fixed in
kernel 6.10, so with the adoption of kernel 6.12 in the Kirkwood
target trays #1 and #2 can now be made accessible. This requires the
kmod-ata-ahci package, which this commit adds as default to the
makefile.

Signed-off-by: Sander van Deijck <sander@vandeijck.com>
Link: openwrt#19435
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

Booting Realtek switches via TFTP will have a chance of ~5% to
fail with the following dump on SMP devices. Sample taken from
RTL931x.

[    1.318320] rtl931x_chip_init: init ENCAP done
[    1.323360] rtl931x_chip_init: init MIB done
[    1.328337] rtl931x_chip_init: init ACL done
[    1.333219] rtl931x_chip_init: init ALE done
[    1.344307] CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == 00000000, ra == 806c5c4c
[    1.356418] Oops[#1]:
[    1.359067] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.12.40 #0
[    1.366582] Hardware name: Linksys LGS352C
[    1.371226] $ 0   : 00000000 00000001 00000000 80b6cc44
[    1.377179] $ 4   : 836b0540 00000000 00000000 83011d38
[    1.383119] $ 8   : 00000000 ffffefff 00000001 80b08c08
[    1.389071] $12   : ffffffea 83011d34 0000007 00000558
[    1.395060] $16   : 836b0540 00000000 00000100 83011ebf
[    1.401003] $20   : 83011ec0 83011ec8 ffff8b3c 80b00000
[    1.406984] $24   : 00000000 80b08c38
[    1.412922] $28   : 83038000 83011e70 82fb37a0 806c5c4c
[    1.418888] Hi    : 0000014b
[    1.422201] Lo    : c74d8000
[    1.425490] epc   : 00000000 0x0
[    1.429191] ra    : 806c5c4c __napi_poll+0x4c/0x208
[    1.434728] Status: 11000403 KERNEL EXL IE
[    1.439497] Cause : 50800008 (ExcCode 02)
[    1.444040] BadVA : 00000000
[    1.447330] PrId  : 0001a120 (MIPS interAptiv (multi))
[    1.453157] Modules linked in:
[    1.456641] Process swapper/0 (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=00000000)
[    1.465742] Stack : 82faf248 80a8d558 817ed500 ffff8b3a 836b0540 8066a348 82fb2bc0 836b0540
[    1.475209]         82fb3600 00000100 0000012c 806c6274 00000000 00000017 00000002 80196134
[    1.484701]         80b00000 83011ed0 83011eb8 83011e00 83011ec0 83011ec0 83011ec8 83011ec8
[    1.494233]         00000001 81920000 81920000 80aefe4c 836b0000 00000000 00000000 00000001
[    1.503686]         00000100 00000000 83011f20 80aefde0 00000000 8019ac14 80b01550 00000000
[    1.513144]         ...
[    1.515957] Call Trace:
[    1.515996]
[    1.520458] [<8066a348>] rtl93xx_net_irq+0x1a4/0x1ac
[    1.526116] [<806c6274>] net_rx_action+0x18c/0x360
[    1.531576] [<80196134>] __handle_irq_event_percpu+0x58/0x16c
[    1.538111] [<8019ac14>] handle_level_irq+0x1e0/0x1f4
[    1.543870] [<80133588>] handle_softirqs+0x14c/0x2ec
[    1.549488] [<801339e4>] irq_exit+0x84/0xb4
[    1.554183] [<805527dc>] plat_irq_dispatch+0x90/0xdc
[    1.559764] [<801019f0>] except_vec_vi_end+0xc4/0xd0
[    1.565337]

A network interrupt may be received before the device is setup
properly. In this case NAPI structures are missing and __napi_poll()
will find a NULL pointer in n->poll. Avoid this by registering the
device after initialization is complete.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: openwrt#19787
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

The receive path of the RTL93xx SoCs is currently discarding packets
in software. Analysis gives the following explanation:

- RX ring size registers are setup with the full software ring size
- When packets are received the packet counter registers are increased
- After RX processing the counter registers are changed the wrong way
- From then SOC is allowed to receive more packets than software allows
- Overflow interrupts are fired
- As a reaction to that the software drops packets

Change the processing as follows:

- Setup ring size registers with a headroom of 2 buffers
- Decrease the counter registers with the real work done

With this change no more overflow interrupts occur because the SoC
disables the queues before they can overflow or hit a buffer that is
still owned by the CPU.

Benchmark from single stream iperf3 run, with server process running
on ZyXEL XGS1210 (RTL930x).

iperf3 run before

-----------------------------------------------------------
Server listening on 5201 (test #1)
-----------------------------------------------------------
Accepted connection from 192.168.2.86, port 54412
[  5] local 192.168.2.71 port 5201 connected to 192.168.2.86 port 54418
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-1.00   sec   384 KBytes  3.14 Mbits/sec
[  5]   1.00-2.00   sec  0.00 Bytes  0.00 bits/sec
[  5]   2.00-3.00   sec  0.00 Bytes  0.00 bits/sec
[  5]   3.00-4.01   sec  5.12 MBytes  42.8 Mbits/sec
[  5]   4.01-5.00   sec  11.4 MBytes  95.8 Mbits/sec
[  5]   5.00-6.00   sec  0.00 Bytes  0.00 bits/sec
[  5]   6.00-7.00   sec  0.00 Bytes  0.00 bits/sec
[  5]   7.00-8.00   sec  0.00 Bytes  0.00 bits/sec
[  5]   8.00-9.00   sec  0.00 Bytes  0.00 bits/sec
[  5]   9.00-10.00  sec  0.00 Bytes  0.00 bits/sec

iperf3 run after

-----------------------------------------------------------
Server listening on 5201 (test #1)
-----------------------------------------------------------
Accepted connection from 192.168.2.86, port 55228
[  5] local 192.168.2.71 port 5201 connected to 192.168.2.86 port 55232
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-1.00   sec  22.8 MBytes   191 Mbits/sec
[  5]   1.00-2.01   sec  25.4 MBytes   211 Mbits/sec
[  5]   2.01-3.00   sec  25.4 MBytes   215 Mbits/sec
[  5]   3.00-4.01   sec  26.5 MBytes   220 Mbits/sec
[  5]   4.01-5.00   sec  26.2 MBytes   222 Mbits/sec
[  5]   5.00-6.00   sec  26.9 MBytes   225 Mbits/sec
[  5]   6.00-7.00   sec  27.0 MBytes   226 Mbits/sec
[  5]   7.00-8.01   sec  26.9 MBytes   224 Mbits/sec
[  5]   8.01-9.00   sec  26.5 MBytes   223 Mbits/sec
[  5]   9.00-10.00  sec  26.8 MBytes   225 Mbits/sec
[  5]  10.00-10.02  sec   640 KBytes   224 Mbits/sec

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: openwrt#19960
Signed-off-by: Robert Marko <robimarko@gmail.com>