Update On Tue Apr 30 20:31:49 CEST 2024

2025-10-25 01:01:20 +08:00 · 2024-04-30 20:31:50 +02:00
parent 3e452bc337
commit a350205715
106 changed files with 1428 additions and 769 deletions
--- a/.github/update.log
+++ b/.github/update.log
@@ -632,3 +632,4 @@ Update On Fri Apr 26 20:27:45 CEST 2024
 Update On Sat Apr 27 20:27:55 CEST 2024
 Update On Sun Apr 28 20:28:07 CEST 2024
 Update On Mon Apr 29 20:27:31 CEST 2024
+Update On Tue Apr 30 20:31:38 CEST 2024
--- a/clash-meta-android/README.md
+++ b/clash-meta-android/README.md
@@ -60,7 +60,7 @@ APP package name is `com.github.metacubex.clash.meta`
 - Import a profile
  - URL Scheme `clash://install-config?url=<encoded URI>` or `clashmeta://install-config?url=<encoded URI>`

-### Contribution and Project Maintainance
+### Contribution and Project Maintenance

 #### Meta Kernel

@@ -68,7 +68,7 @@ APP package name is `com.github.metacubex.clash.meta`
  - If you want to contribute to the kernel, make PRs to `Alpha` branch of the Meta kernel repository.
  - If you want to contribute Android-specific patches to the kernel, make PRs to  `android-open` branch of the Meta kernel repository.

-#### Maintainance
+#### Maintenance

 - When `MetaCubeX/Clash.Meta` kernel is updated to a new version, the `Update Dependencies` actions in this repo will be triggered automatically.
  - It will pull the new version of the meta kernel, update all the golang dependencies, and create a PR without manual intervention.
--- a/clash-meta-android/core/src/foss/golang/clash/dns/doh.go
+++ b/clash-meta-android/core/src/foss/golang/clash/dns/doh.go
@@ -515,7 +515,7 @@ func (doh *dnsOverHTTPS) createTransportH3(
 		},
 		DisableCompression: true,
 		TLSClientConfig:    tlsConfig,
-		QuicConfig:         doh.getQUICConfig(),
+		QUICConfig:         doh.getQUICConfig(),
 	}

 	return &http3Transport{baseTransport: rt}, nil
--- a/clash-meta-android/core/src/foss/golang/clash/go.mod
+++ b/clash-meta-android/core/src/foss/golang/clash/go.mod
@@ -19,8 +19,8 @@ require (
 	github.com/lunixbochs/struc v0.0.0-20200707160740-784aaebc1d40
 	github.com/mdlayher/netlink v1.7.2
 	github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759
-	github.com/metacubex/quic-go v0.42.1-0.20240418003344-f006b5735d98
-	github.com/metacubex/sing-quic v0.0.0-20240418004036-814c531c378d
+	github.com/metacubex/quic-go v0.43.1-0.20240428051621-a109abfb4cf6
+	github.com/metacubex/sing-quic v0.0.0-20240429040940-fa3a4ff2533e
 	github.com/metacubex/sing-shadowsocks v0.2.6
 	github.com/metacubex/sing-shadowsocks2 v0.2.0
 	github.com/metacubex/sing-tun v0.2.6
--- a/clash-meta-android/core/src/foss/golang/clash/go.sum
+++ b/clash-meta-android/core/src/foss/golang/clash/go.sum
@@ -78,8 +78,6 @@ github.com/google/tink/go v1.6.1 h1:t7JHqO8Ath2w2ig5vjwQYJzhGEZymedQc90lQXUBa4I=
 github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
 github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
 github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/insomniacslk/dhcp v0.0.0-20240227161007-c728f5dd21c8 h1:V3plQrMHRWOB5zMm3yNqvBxDQVW1+/wHBSok5uPdmVs=
-github.com/insomniacslk/dhcp v0.0.0-20240227161007-c728f5dd21c8/go.mod h1:izxuNQZeFrbx2nK2fAyN5iNUB34Fe9j0nK4PwLzAkKw=
 github.com/insomniacslk/dhcp v0.0.0-20240419123447-f1cffa2c0c49 h1:/OuvSMGT9+xnyZ+7MZQ1zdngaCCAdPoSw8B/uurZ7pg=
 github.com/insomniacslk/dhcp v0.0.0-20240419123447-f1cffa2c0c49/go.mod h1:KclMyHxX06VrVr0DJmeFSUb1ankt7xTfoOA35pCkoic=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
@@ -106,12 +104,12 @@ github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759 h1:cjd4biTvO
 github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759/go.mod h1:UHOv2xu+RIgLwpXca7TLrXleEd4oR3sPatW6IF8wU88=
 github.com/metacubex/gvisor v0.0.0-20240320004321-933faba989ec h1:HxreOiFTUrJXJautEo8rnE1uKTVGY8wtZepY1Tii/Nc=
 github.com/metacubex/gvisor v0.0.0-20240320004321-933faba989ec/go.mod h1:8BVmQ+3cxjqzWElafm24rb2Ae4jRI6vAXNXWqWjfrXw=
-github.com/metacubex/quic-go v0.42.1-0.20240418003344-f006b5735d98 h1:oMLlJV4a9AylNo8ZLBNUiqZ02Vme6GLLHjuWJz8amSk=
-github.com/metacubex/quic-go v0.42.1-0.20240418003344-f006b5735d98/go.mod h1:iGx3Y1zynls/FjFgykLSqDcM81U0IKePRTXEz5g3iiQ=
+github.com/metacubex/quic-go v0.43.1-0.20240428051621-a109abfb4cf6 h1:qqIZ8CjoxVJP38JU9ml1RkWJfaUd7QtmOk1vl7shuRY=
+github.com/metacubex/quic-go v0.43.1-0.20240428051621-a109abfb4cf6/go.mod h1:uXHODgJFUfUnkkCMWLd5Er6L5QY/LFRZb9LD5jyyhsk=
 github.com/metacubex/sing v0.0.0-20240408015159-aa61c96df764 h1:+czGKoynxYA90YaL3NlCAIJHnlqwoUlLWgmOhdm5ZU8=
 github.com/metacubex/sing v0.0.0-20240408015159-aa61c96df764/go.mod h1:+60H3Cm91RnL9dpVGWDPHt0zTQImO9Vfqt9a4rSambI=
-github.com/metacubex/sing-quic v0.0.0-20240418004036-814c531c378d h1:RAe0ND8J5SOPGI623oEXfaHKaaUrrzHx+U1DN9Awcco=
-github.com/metacubex/sing-quic v0.0.0-20240418004036-814c531c378d/go.mod h1:WyY0zYxv+o+18R/Ece+QFontlgXoobKbNqbtYn2zjz8=
+github.com/metacubex/sing-quic v0.0.0-20240429040940-fa3a4ff2533e h1:UW+yfzoLzjEhAoJ6A4mVnov3Aergi7uFM/h7ReNekKI=
+github.com/metacubex/sing-quic v0.0.0-20240429040940-fa3a4ff2533e/go.mod h1:nfqibK+vkBtE6Ch8vYqrFTcaX4BC6TwKqNNl5rORll4=
 github.com/metacubex/sing-shadowsocks v0.2.6 h1:6oEB3QcsFYnNiFeoevcXrCwJ3sAablwVSgtE9R3QeFQ=
 github.com/metacubex/sing-shadowsocks v0.2.6/go.mod h1:zIkMeSnb8Mbf4hdqhw0pjzkn1d99YJ3JQm/VBg5WMTg=
 github.com/metacubex/sing-shadowsocks2 v0.2.0 h1:hqwT/AfI5d5UdPefIzR6onGHJfDXs5zgOM5QSgaM/9A=
--- a/clash-meta-android/core/src/foss/golang/clash/listener/http/proxy.go
+++ b/clash-meta-android/core/src/foss/golang/clash/listener/http/proxy.go
@@ -51,7 +51,8 @@ func HandleConn(c net.Conn, tunnel C.Tunnel, cache *lru.LruCache[string, bool],
 		var resp *http.Response

 		if !trusted {
-			resp, user := authenticate(request, cache)
+			var user string
+			resp, user = authenticate(request, cache)
 			additions = append(additions, inbound.WithInUser(user))
 			trusted = resp == nil
 		}
--- a/clash-meta-android/core/src/foss/golang/clash/transport/hysteria/core/client.go
+++ b/clash-meta-android/core/src/foss/golang/clash/transport/hysteria/core/client.go
@@ -406,7 +406,7 @@ func (c *quicPktConn) WriteTo(p []byte, addr string) error {
 		if errors.As(err, &errSize) {
 			// need to frag
 			msg.MsgID = uint16(fastrand.Intn(0xFFFF)) + 1 // msgID must be > 0 when fragCount > 1
-			fragMsgs := fragUDPMessage(msg, int(errSize.PeerMaxDatagramFrameSize))
+			fragMsgs := fragUDPMessage(msg, int(errSize.MaxDatagramPayloadSize))
 			for _, fragMsg := range fragMsgs {
 				msgBuf.Reset()
 				_ = struc.Pack(&msgBuf, &fragMsg)
--- a/clash-meta-android/core/src/foss/golang/clash/transport/tuic/v4/packet.go
+++ b/clash-meta-android/core/src/foss/golang/clash/transport/tuic/v4/packet.go
@@ -123,7 +123,7 @@ func (q *quicStreamPacketConn) WaitReadFrom() (data []byte, put func(), addr net

 func (q *quicStreamPacketConn) WriteTo(p []byte, addr net.Addr) (n int, err error) {
 	if q.udpRelayMode != common.QUIC && len(p) > q.maxUdpRelayPacketSize {
-		return 0, &quic.DatagramTooLargeError{PeerMaxDatagramFrameSize: int64(q.maxUdpRelayPacketSize)}
+		return 0, &quic.DatagramTooLargeError{MaxDatagramPayloadSize: int64(q.maxUdpRelayPacketSize)}
 	}
 	if q.closed {
 		return 0, net.ErrClosed
--- a/clash-meta-android/core/src/foss/golang/clash/transport/tuic/v5/packet.go
+++ b/clash-meta-android/core/src/foss/golang/clash/transport/tuic/v5/packet.go
@@ -137,7 +137,7 @@ func (q *quicStreamPacketConn) WaitReadFrom() (data []byte, put func(), addr net

 func (q *quicStreamPacketConn) WriteTo(p []byte, addr net.Addr) (n int, err error) {
 	if len(p) > 0xffff { // uint16 max
-		return 0, &quic.DatagramTooLargeError{PeerMaxDatagramFrameSize: 0xffff}
+		return 0, &quic.DatagramTooLargeError{MaxDatagramPayloadSize: 0xffff}
 	}
 	if q.closed {
 		return 0, net.ErrClosed
@@ -189,7 +189,7 @@ func (q *quicStreamPacketConn) WriteTo(p []byte, addr net.Addr) (n int, err erro

 		var tooLarge *quic.DatagramTooLargeError
 		if errors.As(err, &tooLarge) {
-			err = fragWriteNative(q.quicConn, packet, buf, int(tooLarge.PeerMaxDatagramFrameSize)-PacketOverHead)
+			err = fragWriteNative(q.quicConn, packet, buf, int(tooLarge.MaxDatagramPayloadSize)-PacketOverHead)
 		}
 		if err != nil {
 			return
--- a/clash-meta-android/core/src/foss/golang/go.mod
+++ b/clash-meta-android/core/src/foss/golang/go.mod
@@ -47,8 +47,8 @@ require (
 	github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759 // indirect
 	github.com/metacubex/gvisor v0.0.0-20240320004321-933faba989ec // indirect
 	github.com/metacubex/mihomo v1.7.0 // indirect
-	github.com/metacubex/quic-go v0.42.1-0.20240418003344-f006b5735d98 // indirect
-	github.com/metacubex/sing-quic v0.0.0-20240418004036-814c531c378d // indirect
+	github.com/metacubex/quic-go v0.43.1-0.20240428051621-a109abfb4cf6 // indirect
+	github.com/metacubex/sing-quic v0.0.0-20240429040940-fa3a4ff2533e // indirect
 	github.com/metacubex/sing-shadowsocks v0.2.6 // indirect
 	github.com/metacubex/sing-shadowsocks2 v0.2.0 // indirect
 	github.com/metacubex/sing-tun v0.2.6 // indirect
--- a/clash-meta-android/core/src/foss/golang/go.sum
+++ b/clash-meta-android/core/src/foss/golang/go.sum
@@ -98,12 +98,12 @@ github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759 h1:cjd4biTvO
 github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759/go.mod h1:UHOv2xu+RIgLwpXca7TLrXleEd4oR3sPatW6IF8wU88=
 github.com/metacubex/gvisor v0.0.0-20240320004321-933faba989ec h1:HxreOiFTUrJXJautEo8rnE1uKTVGY8wtZepY1Tii/Nc=
 github.com/metacubex/gvisor v0.0.0-20240320004321-933faba989ec/go.mod h1:8BVmQ+3cxjqzWElafm24rb2Ae4jRI6vAXNXWqWjfrXw=
-github.com/metacubex/quic-go v0.42.1-0.20240418003344-f006b5735d98 h1:oMLlJV4a9AylNo8ZLBNUiqZ02Vme6GLLHjuWJz8amSk=
-github.com/metacubex/quic-go v0.42.1-0.20240418003344-f006b5735d98/go.mod h1:iGx3Y1zynls/FjFgykLSqDcM81U0IKePRTXEz5g3iiQ=
+github.com/metacubex/quic-go v0.43.1-0.20240428051621-a109abfb4cf6 h1:qqIZ8CjoxVJP38JU9ml1RkWJfaUd7QtmOk1vl7shuRY=
+github.com/metacubex/quic-go v0.43.1-0.20240428051621-a109abfb4cf6/go.mod h1:uXHODgJFUfUnkkCMWLd5Er6L5QY/LFRZb9LD5jyyhsk=
 github.com/metacubex/sing v0.0.0-20240111014253-f1818b6a82b2 h1:upEO8dt9WDBavhgcgkXB3hRcwVNbkTbnd+xyzy6ZQZo=
 github.com/metacubex/sing v0.0.0-20240111014253-f1818b6a82b2/go.mod h1:9pfuAH6mZfgnz/YjP6xu5sxx882rfyjpcrTdUpd6w3g=
-github.com/metacubex/sing-quic v0.0.0-20240418004036-814c531c378d h1:RAe0ND8J5SOPGI623oEXfaHKaaUrrzHx+U1DN9Awcco=
-github.com/metacubex/sing-quic v0.0.0-20240418004036-814c531c378d/go.mod h1:WyY0zYxv+o+18R/Ece+QFontlgXoobKbNqbtYn2zjz8=
+github.com/metacubex/sing-quic v0.0.0-20240429040940-fa3a4ff2533e h1:UW+yfzoLzjEhAoJ6A4mVnov3Aergi7uFM/h7ReNekKI=
+github.com/metacubex/sing-quic v0.0.0-20240429040940-fa3a4ff2533e/go.mod h1:nfqibK+vkBtE6Ch8vYqrFTcaX4BC6TwKqNNl5rORll4=
 github.com/metacubex/sing-shadowsocks v0.2.6 h1:6oEB3QcsFYnNiFeoevcXrCwJ3sAablwVSgtE9R3QeFQ=
 github.com/metacubex/sing-shadowsocks v0.2.6/go.mod h1:zIkMeSnb8Mbf4hdqhw0pjzkn1d99YJ3JQm/VBg5WMTg=
 github.com/metacubex/sing-shadowsocks2 v0.2.0 h1:hqwT/AfI5d5UdPefIzR6onGHJfDXs5zgOM5QSgaM/9A=
--- a/clash-meta-android/core/src/main/golang/go.mod
+++ b/clash-meta-android/core/src/main/golang/go.mod
@@ -54,8 +54,8 @@ require (
 	github.com/mdlayher/socket v0.4.1 // indirect
 	github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759 // indirect
 	github.com/metacubex/gvisor v0.0.0-20240320004321-933faba989ec // indirect
-	github.com/metacubex/quic-go v0.42.1-0.20240418003344-f006b5735d98 // indirect
-	github.com/metacubex/sing-quic v0.0.0-20240418004036-814c531c378d // indirect
+	github.com/metacubex/quic-go v0.43.1-0.20240428051621-a109abfb4cf6 // indirect
+	github.com/metacubex/sing-quic v0.0.0-20240429040940-fa3a4ff2533e // indirect
 	github.com/metacubex/sing-shadowsocks v0.2.6 // indirect
 	github.com/metacubex/sing-shadowsocks2 v0.2.0 // indirect
 	github.com/metacubex/sing-tun v0.2.6 // indirect
--- a/clash-meta-android/core/src/main/golang/go.sum
+++ b/clash-meta-android/core/src/main/golang/go.sum
@@ -98,12 +98,12 @@ github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759 h1:cjd4biTvO
 github.com/metacubex/gopacket v1.1.20-0.20230608035415-7e2f98a3e759/go.mod h1:UHOv2xu+RIgLwpXca7TLrXleEd4oR3sPatW6IF8wU88=
 github.com/metacubex/gvisor v0.0.0-20240320004321-933faba989ec h1:HxreOiFTUrJXJautEo8rnE1uKTVGY8wtZepY1Tii/Nc=
 github.com/metacubex/gvisor v0.0.0-20240320004321-933faba989ec/go.mod h1:8BVmQ+3cxjqzWElafm24rb2Ae4jRI6vAXNXWqWjfrXw=
-github.com/metacubex/quic-go v0.42.1-0.20240418003344-f006b5735d98 h1:oMLlJV4a9AylNo8ZLBNUiqZ02Vme6GLLHjuWJz8amSk=
-github.com/metacubex/quic-go v0.42.1-0.20240418003344-f006b5735d98/go.mod h1:iGx3Y1zynls/FjFgykLSqDcM81U0IKePRTXEz5g3iiQ=
+github.com/metacubex/quic-go v0.43.1-0.20240428051621-a109abfb4cf6 h1:qqIZ8CjoxVJP38JU9ml1RkWJfaUd7QtmOk1vl7shuRY=
+github.com/metacubex/quic-go v0.43.1-0.20240428051621-a109abfb4cf6/go.mod h1:uXHODgJFUfUnkkCMWLd5Er6L5QY/LFRZb9LD5jyyhsk=
 github.com/metacubex/sing v0.0.0-20240111014253-f1818b6a82b2 h1:upEO8dt9WDBavhgcgkXB3hRcwVNbkTbnd+xyzy6ZQZo=
 github.com/metacubex/sing v0.0.0-20240111014253-f1818b6a82b2/go.mod h1:9pfuAH6mZfgnz/YjP6xu5sxx882rfyjpcrTdUpd6w3g=
-github.com/metacubex/sing-quic v0.0.0-20240418004036-814c531c378d h1:RAe0ND8J5SOPGI623oEXfaHKaaUrrzHx+U1DN9Awcco=
-github.com/metacubex/sing-quic v0.0.0-20240418004036-814c531c378d/go.mod h1:WyY0zYxv+o+18R/Ece+QFontlgXoobKbNqbtYn2zjz8=
+github.com/metacubex/sing-quic v0.0.0-20240429040940-fa3a4ff2533e h1:UW+yfzoLzjEhAoJ6A4mVnov3Aergi7uFM/h7ReNekKI=
+github.com/metacubex/sing-quic v0.0.0-20240429040940-fa3a4ff2533e/go.mod h1:nfqibK+vkBtE6Ch8vYqrFTcaX4BC6TwKqNNl5rORll4=
 github.com/metacubex/sing-shadowsocks v0.2.6 h1:6oEB3QcsFYnNiFeoevcXrCwJ3sAablwVSgtE9R3QeFQ=
 github.com/metacubex/sing-shadowsocks v0.2.6/go.mod h1:zIkMeSnb8Mbf4hdqhw0pjzkn1d99YJ3JQm/VBg5WMTg=
 github.com/metacubex/sing-shadowsocks2 v0.2.0 h1:hqwT/AfI5d5UdPefIzR6onGHJfDXs5zgOM5QSgaM/9A=
--- a/clash-meta/hub/updater/updater.go
+++ b/clash-meta/hub/updater/updater.go
@@ -16,7 +16,6 @@ import (
 	"time"

 	mihomoHttp "github.com/metacubex/mihomo/component/http"
-	"github.com/metacubex/mihomo/constant"
 	C "github.com/metacubex/mihomo/constant"
 	"github.com/metacubex/mihomo/log"

@@ -52,6 +51,10 @@ func init() {
 	if runtime.GOARCH == "amd64" && cpuid.CPU.X64Level() < 3 {
 		amd64Compatible = "-compatible"
 	}
+	if !strings.HasPrefix(C.Version, "alpha") {
+		baseURL = "https://github.com/MetaCubeX/mihomo/releases/latest/download/mihomo"
+		versionURL = "https://github.com/MetaCubeX/mihomo/releases/latest/download/version.txt"
+	}
 }

 type updateError struct {
@@ -73,9 +76,9 @@ func Update(execPath string) (err error) {
 		return err
 	}

-	log.Infoln("current version %s, latest version %s", constant.Version, latestVersion)
+	log.Infoln("current version %s, latest version %s", C.Version, latestVersion)

-	if latestVersion == constant.Version {
+	if latestVersion == C.Version {
 		err := &updateError{Message: "already using latest version"}
 		return err
 	}
--- a/clash-nyanpasu/frontend/nyanpasu/package.json
+++ b/clash-nyanpasu/frontend/nyanpasu/package.json
@@ -49,11 +49,11 @@
    "@types/react": "18.3.1",
    "@types/react-dom": "18.3.0",
    "@types/react-transition-group": "4.4.10",
-    "@typescript-eslint/eslint-plugin": "7.7.1",
-    "@typescript-eslint/parser": "7.7.1",
+    "@typescript-eslint/eslint-plugin": "7.8.0",
+    "@typescript-eslint/parser": "7.8.0",
    "@vitejs/plugin-react": "4.2.1",
    "sass": "1.75.0",
-    "shiki": "1.3.0",
+    "shiki": "1.4.0",
    "vite": "5.2.10",
    "vite-plugin-monaco-editor": "1.1.3",
    "vite-plugin-sass-dts": "1.3.18",
--- a/clash-nyanpasu/manifest/version.json
+++ b/clash-nyanpasu/manifest/version.json
@@ -1,8 +1,8 @@
 {
  "manifest_version": 1,
  "latest": {
-    "mihomo": "v1.18.3",
-    "mihomo_alpha": "alpha-89a097f",
+    "mihomo": "v1.18.4",
+    "mihomo_alpha": "alpha-314c0bb",
    "clash_rs": "v0.1.16",
    "clash_premium": "2023-09-05-gdcc8d87"
  },
@@ -36,5 +36,5 @@
      "darwin-x64": "clash-darwin-amd64-n{}.gz"
    }
  },
-  "updated_at": "2024-04-28T22:19:19.364Z"
+  "updated_at": "2024-04-29T22:19:31.978Z"
 }
--- a/clash-nyanpasu/pnpm-lock.yaml
+++ b/clash-nyanpasu/pnpm-lock.yaml
--- a/clash-verge-rev/UPDATELOG.md
+++ b/clash-verge-rev/UPDATELOG.md
@@ -1,3 +1,20 @@
+## v1.6.1
+
+### Features
+
+- 鼠标悬浮显示当前订阅的名称 [#938](https://github.com/clash-verge-rev/clash-verge-rev/pull/938)
+- 日志过滤支持正则表达式 [#959](https://github.com/clash-verge-rev/clash-verge-rev/pull/959)
+- 更新 Clash 内核到 1.18.4
+
+### Bugs Fixes
+
+- 修复 Linux KDE 环境下系统代理无法开启的问题
+- 窗口最大化图标调整 [#924](https://github.com/clash-verge-rev/clash-verge-rev/pull/924)
+- 修改 MacOS 托盘点击行为(左键菜单，右键点击事件)
+- 修复 MacOS 服务模式安装失败的问题
+
+---
+
 ## v1.6.0

 ### Features
--- a/clash-verge-rev/package.json
+++ b/clash-verge-rev/package.json
@@ -1,6 +1,6 @@
 {
  "name": "clash-verge",
-  "version": "1.6.0",
+  "version": "1.6.1",
  "license": "GPL-3.0-only",
  "scripts": {
    "dev": "tauri dev",
--- a/clash-verge-rev/scripts/check.mjs
+++ b/clash-verge-rev/scripts/check.mjs
@@ -100,7 +100,7 @@ async function getLatestAlphaVersion() {

 /* ======= clash meta stable ======= */
 const META_VERSION_URL =
-  "https://github.com/MetaCubeX/mihomo/releases/download/v1.18.1/version.txt";
+  "https://github.com/MetaCubeX/mihomo/releases/latest/download/version.txt";
 const META_URL_PREFIX = `https://github.com/MetaCubeX/mihomo/releases/download`;
 let META_VERSION;

--- a/clash-verge-rev/src-tauri/Cargo.lock
+++ b/clash-verge-rev/src-tauri/Cargo.lock
@@ -788,7 +788,7 @@ dependencies = [

 [[package]]
 name = "clash-verge"
-version = "1.6.0"
+version = "1.6.1"
 dependencies = [
 "anyhow",
 "auto-launch",
--- a/clash-verge-rev/src-tauri/Cargo.toml
+++ b/clash-verge-rev/src-tauri/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "clash-verge"
-version = "1.6.0"
+version = "1.6.1"
 description = "clash verge"
 authors = ["zzzgydi", "wonfen", "MystiPanda"]
 license = "GPL-3.0-only"
--- a/clash-verge-rev/src-tauri/src/core/service.rs
+++ b/clash-verge-rev/src-tauri/src/core/service.rs
@@ -102,7 +102,7 @@ pub async fn install_service() -> Result<()> {
    if !installer_path.exists() {
        bail!("installer not found");
    }
-    let shell = installer_path.to_string_lossy();
+    let shell = installer_path.to_string_lossy().replace(" ", "\\\\ ");
    let command = format!(r#"do shell script "{shell}" with administrator privileges"#);

    let status = StdCommand::new("osascript")
--- a/clash-verge-rev/src-tauri/src/core/tray.rs
+++ b/clash-verge-rev/src-tauri/src/core/tray.rs
@@ -284,7 +284,7 @@ impl Tray {
        Ok(())
    }

-    pub fn on_left_click(app_handle: &AppHandle) {
+    pub fn on_click(app_handle: &AppHandle) {
        let tray_event = { Config::verge().latest().tray_event.clone() };
        let tray_event = tray_event.unwrap_or("main_window".into());
        match tray_event.as_str() {
@@ -297,7 +297,10 @@ impl Tray {

    pub fn on_system_tray_event(app_handle: &AppHandle, event: SystemTrayEvent) {
        match event {
-            SystemTrayEvent::LeftClick { .. } => Tray::on_left_click(app_handle),
+            #[cfg(not(target_os = "macos"))]
+            SystemTrayEvent::LeftClick { .. } => Tray::on_click(app_handle),
+            #[cfg(target_os = "macos")]
+            SystemTrayEvent::RightClick { .. } => Tray::on_click(app_handle),
            SystemTrayEvent::MenuItemClick { id, .. } => match id.as_str() {
                mode @ ("rule_mode" | "global_mode" | "direct_mode") => {
                    let mode = &mode[0..mode.len() - 5];
--- a/clash-verge-rev/src-tauri/tauri.conf.json
+++ b/clash-verge-rev/src-tauri/tauri.conf.json
@@ -2,7 +2,7 @@
  "$schema": "../node_modules/@tauri-apps/cli/schema.json",
  "package": {
    "productName": "Clash Verge",
-    "version": "1.6.0"
+    "version": "1.6.1"
  },
  "build": {
    "distDir": "../dist",
--- a/clash-verge-rev/src-tauri/tauri.macos.conf.json
+++ b/clash-verge-rev/src-tauri/tauri.macos.conf.json
@@ -3,8 +3,7 @@
  "tauri": {
    "systemTray": {
      "iconPath": "icons/mac-tray-icon.png",
-      "iconAsTemplate": true,
-      "menuOnLeftClick": false
+      "iconAsTemplate": true
    },
    "bundle": {
      "identifier": "io.github.clash-verge-rev.clash-verge-rev",
--- a/clash-verge-rev/src/locales/en.json
+++ b/clash-verge-rev/src/locales/en.json
@@ -187,5 +187,7 @@

  "Portable Updater Error": "The portable version does not support in-app updates. Please manually download and replace it",
  "Tun Mode Info": "The Tun mode requires granting core-related permissions. Please enable service mode before using it",
-  "System and Mixed Can Only be Used in Service Mode": "System and Mixed Can Only be Used in Service Mode"
+  "System and Mixed Can Only be Used in Service Mode": "System and Mixed Can Only be Used in Service Mode",
+
+  "Use Regular Expression": "Use Regular Expression"
 }
--- a/clash-verge-rev/src/locales/ru.json
+++ b/clash-verge-rev/src/locales/ru.json
@@ -187,5 +187,7 @@

  "Portable Updater Error": "Портативная версия не поддерживает обновление внутри приложения, пожалуйста, скачайте и замените вручную",
  "Tun Mode Info": "Режим туннеля требует предоставления разрешений, связанных с ядром. Пожалуйста, включите сервисный режим перед его использованием",
-  "System and Mixed Can Only be Used in Service Mode": "Система и смешанные могут использоваться только в сервисном режиме"
+  "System and Mixed Can Only be Used in Service Mode": "Система и смешанные могут использоваться только в сервисном режиме",
+
+  "Use Regular Expression": "Использование регулярных выражений"
 }
--- a/clash-verge-rev/src/locales/zh.json
+++ b/clash-verge-rev/src/locales/zh.json
@@ -187,5 +187,7 @@

  "Portable Updater Error": "便携版不支持应用内更新，请手动下载替换",
  "Tun Mode Info": "Tun模式需要授予内核相关权限，使用前请先开启服务模式",
-  "System and Mixed Can Only be Used in Service Mode": "System和Mixed只能在服务模式下使用"
+  "System and Mixed Can Only be Used in Service Mode": "System和Mixed只能在服务模式下使用",
+
+  "Use Regular Expression": "使用正则表达式"
 }
--- a/clash-verge-rev/src/pages/logs.tsx
+++ b/clash-verge-rev/src/pages/logs.tsx
@@ -47,8 +47,27 @@ const LogPage = () => {
  const isDark = theme.palette.mode === "dark";
  const [logState, setLogState] = useState("all");
  const [filterText, setFilterText] = useState("");
-
+  const [useRegexSearch, setUseRegexSearch] = useState(true);
+  const [hasInputError, setInputError] = useState(false);
+  const [inputHelperText, setInputHelperText] = useState("");
  const filterLogs = useMemo(() => {
+    setInputHelperText("");
+    setInputError(false);
+    if (useRegexSearch) {
+      try {
+        const regex = new RegExp(filterText);
+        return logData.filter((data) => {
+          return (
+            regex.test(data.payload) &&
+            (logState === "all" ? true : data.type.includes(logState))
+          );
+        });
+      } catch (err: any) {
+        setInputHelperText(err.message.substring(0, 60));
+        setInputError(true);
+        return logData;
+      }
+    }
    return logData.filter((data) => {
      return (
        data.payload.includes(filterText) &&
@@ -107,8 +126,24 @@ const LogPage = () => {
        </StyledSelect>

        <BaseStyledTextField
+          error={hasInputError}
          value={filterText}
          onChange={(e) => setFilterText(e.target.value)}
+          helperText={inputHelperText}
+          placeholder={t("Filter conditions")}
+          InputProps={{
+            sx: { pr: 1 },
+            endAdornment: (
+              <IconButton
+                sx={{ fontWeight: "800", height: "100%", padding: "0" }}
+                color={useRegexSearch ? "primary" : "default"}
+                title={t("Use Regular Expression")}
+                onClick={() => setUseRegexSearch(!useRegexSearch)}
+              >
+                .*
+              </IconButton>
+            ),
+          }}
        />
      </Box>

--- a/filebrowser/CHANGELOG.md
+++ b/filebrowser/CHANGELOG.md
@@ -2,6 +2,32 @@

 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.

+## [2.29.0](https://github.com/filebrowser/filebrowser/compare/v2.28.0...v2.29.0) (2024-04-30)
+
+
+### Features
+
+* Display Upload Progress as Percentage and File Size / Total File Size ([#3111](https://github.com/filebrowser/filebrowser/issues/3111)) ([236ca63](https://github.com/filebrowser/filebrowser/commit/236ca637f99e373adfeaaefc5db6af50bd15b6bf))
+* migrate to vue 3 ([#2689](https://github.com/filebrowser/filebrowser/issues/2689)) ([5100e58](https://github.com/filebrowser/filebrowser/commit/5100e587d73831ecdb5e3bd35a78fef96ad248a4))
+
+
+### Bug Fixes
+
+* abort upload behavior to properly handle server-side deletion and frontend state reset ([#3114](https://github.com/filebrowser/filebrowser/issues/3114)) ([434e49b](https://github.com/filebrowser/filebrowser/commit/434e49bf59e4ddf7ec90893fa3fd53faee8c9cbb))
+* apply proper zindex to modal dialogs ([#3172](https://github.com/filebrowser/filebrowser/issues/3172)) ([821f51e](https://github.com/filebrowser/filebrowser/commit/821f51ea5ad1f5c2eb72441bc761031cacee43e1))
+* correct list item selector ([#3126](https://github.com/filebrowser/filebrowser/issues/3126)) ([#3147](https://github.com/filebrowser/filebrowser/issues/3147)) ([22a05e1](https://github.com/filebrowser/filebrowser/commit/22a05e1f02a083cf7b630e16873dad0de89b7854))
+* don't redirect to login when no auth ([#3165](https://github.com/filebrowser/filebrowser/issues/3165)) ([da5a6e0](https://github.com/filebrowser/filebrowser/commit/da5a6e051faa80134c2adf4e621426cbdf046c88))
+* Frontend bug, administrators unable to delete users ([#3170](https://github.com/filebrowser/filebrowser/issues/3170)) ([bee71d9](https://github.com/filebrowser/filebrowser/commit/bee71d93fee137cdd807cd8f7716c7da0830fae7))
+* handle quotes in healthcheck.sh ([#3130](https://github.com/filebrowser/filebrowser/issues/3130)) ([18f04a7](https://github.com/filebrowser/filebrowser/commit/18f04a7d26186927f51f46354f3b2164a68f1b41))
+* the copy method in clipboard.ts ([#3177](https://github.com/filebrowser/filebrowser/issues/3177)) ([4786187](https://github.com/filebrowser/filebrowser/commit/4786187852b8eef07e40aa00cd159ccc1e7e79dc))
+
+
+### Build
+
+* bump go version to 1.22.1 ([bbd0abb](https://github.com/filebrowser/filebrowser/commit/bbd0abbdfdbb3ddf3326247b7c6d925751dfabcb))
+* bump go version to 1.22.2 ([#3158](https://github.com/filebrowser/filebrowser/issues/3158)) ([a9da7fd](https://github.com/filebrowser/filebrowser/commit/a9da7fd56c849b5a13133136b35ef5ebee622962))
+* **deps:** bump golang.org/x/net from 0.22.0 to 0.23.0 ([#3133](https://github.com/filebrowser/filebrowser/issues/3133)) ([6b77b8d](https://github.com/filebrowser/filebrowser/commit/6b77b8d683f7357ef71af678550e78910c10ddeb))
+
 ## [2.28.0](https://github.com/filebrowser/filebrowser/compare/v2.27.0...v2.28.0) (2024-04-01)


--- a/filebrowser/frontend/src/utils/clipboard.ts
+++ b/filebrowser/frontend/src/utils/clipboard.ts
@@ -33,29 +33,18 @@ export function copy(text: string) {
      document.queryCommandSupported &&
      document.queryCommandSupported("copy")
    ) {
-      const textarea = document.createElement("textarea");
-      textarea.textContent = text;
-      textarea.setAttribute("readonly", "");
-      textarea.style.fontSize = "12pt";
-      textarea.style.position = "fixed";
-      textarea.style.width = "2em";
-      textarea.style.height = "2em";
-      textarea.style.padding = "0";
-      textarea.style.margin = "0";
-      textarea.style.border = "none";
-      textarea.style.outline = "none";
-      textarea.style.boxShadow = "none";
-      textarea.style.background = "transparent";
-      document.body.appendChild(textarea);
+      const textarea = createTemporaryTextarea(text);
+      const body = document.activeElement || document.body;
+      try {
+        body.appendChild(textarea);
        textarea.focus();
        textarea.select();
-      try {
        document.execCommand("copy");
-        document.body.removeChild(textarea);
        resolve();
      } catch (e) {
-        document.body.removeChild(textarea);
        reject(e);
+      } finally {
+        body.removeChild(textarea);
      }
    } else {
      reject(
@@ -64,3 +53,26 @@ export function copy(text: string) {
    }
  });
 }
+
+const styles = {
+  fontSize: "12pt",
+  position: "fixed",
+  top: 0,
+  left: 0,
+  width: "2em",
+  height: "2em",
+  padding: 0,
+  margin: 0,
+  border: "none",
+  outline: "none",
+  boxShadow: "none",
+  background: "transparent"
+};
+
+const createTemporaryTextarea = (text:string) => {
+  const textarea = document.createElement("textarea");
+  textarea.value = text;
+  textarea.setAttribute("readonly", "");
+  Object.assign(textarea.style, styles);
+  return textarea;
+};
--- a/lede/include/kernel-6.6
+++ b/lede/include/kernel-6.6
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .28
-LINUX_KERNEL_HASH-6.6.28 = 818716ed13e7dba6aaeae24e3073993e260812ed128d10272e94b922ee6d3394
+LINUX_VERSION-6.6 = .29
+LINUX_KERNEL_HASH-6.6.29 = 7f26f74c08082c86b1daf866e4d49c5d8276cc1906a89d0e367e457ec167cbd0
--- a/lede/package/boot/uboot-sunxi/patches/260-sunxi-add-USB-support-and-PopStick-support.patch
+++ b/lede/package/boot/uboot-sunxi/patches/260-sunxi-add-USB-support-and-PopStick-support.patch
@@ -1,120 +0,0 @@
-From 08d194d881e10e09cba7551da8079734d89ed16d Mon Sep 17 00:00:00 2001
-From: Icenowy Zheng <uwu@icenowy.me>
-Date: Thu, 16 Jun 2022 00:28:41 +0800
-Subject: [PATCH 1/2] add USB support and PopStick support
-
-Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
---
- arch/arm/dts/Makefile                        |  3 +-
- arch/arm/dts/suniv-f1c100s-licheepi-nano.dts | 16 ++++
- arch/arm/dts/suniv-f1c100s.dtsi              | 26 ++++++
- arch/arm/dts/suniv-f1c200s-popstick.dts      | 89 ++++++++++++++++++++
- drivers/phy/allwinner/phy-sun4i-usb.c        | 14 +++
- drivers/usb/musb-new/sunxi.c                 |  6 ++
- 6 files changed, 153 insertions(+), 1 deletion(-)
- create mode 100644 arch/arm/dts/suniv-f1c200s-popstick.dts
-
--- a/arch/arm/dts/Makefile
-+++ b/arch/arm/dts/Makefile
-@@ -647,7 +647,8 @@ dtb-$(CONFIG_STM32H7) += stm32h743i-disc
- 	stm32h750i-art-pi.dtb
- 
- dtb-$(CONFIG_MACH_SUNIV) += \
-	suniv-f1c100s-licheepi-nano.dtb
-+	suniv-f1c100s-licheepi-nano.dtb \
-+	suniv-f1c200s-popstick.dtb
- dtb-$(CONFIG_MACH_SUN4I) += \
- 	sun4i-a10-a1000.dtb \
- 	sun4i-a10-ba10-tvbox.dtb \
--- /dev/null
-+++ b/arch/arm/dts/suniv-f1c200s-popstick.dts
-@@ -0,0 +1,89 @@
-+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
-+/*
-+ * Copyright 2022 Icenowy Zheng <uwu@icenowy.me>
-+ */
-+
-+/dts-v1/;
-+#include "suniv-f1c100s.dtsi"
-+
-+#include <dt-bindings/gpio/gpio.h>
-+
-+/ {
-+	model = "Popcorn Computer PopStick";
-+	compatible = "sourceparts,popstick", "allwinner,suniv-f1c200s",
-+		     "allwinner,suniv-f1c100s";
-+
-+	aliases {
-+		mmc0 = &mmc0;
-+		serial0 = &uart0;
-+		spi0 = &spi0;
-+	};
-+
-+	chosen {
-+		stdout-path = "serial0:115200n8";
-+	};
-+
-+	reg_vcc3v3: vcc3v3 {
-+		compatible = "regulator-fixed";
-+		regulator-name = "vcc3v3";
-+		regulator-min-microvolt = <3300000>;
-+		regulator-max-microvolt = <3300000>;
-+	};
-+};
-+
-+&mmc0 {
-+	broken-cd;
-+	bus-width = <4>;
-+	disable-wp;
-+	status = "okay";
-+	vmmc-supply = <&reg_vcc3v3>;
-+};
-+
-+&spi0 {
-+	pinctrl-names = "default";
-+	pinctrl-0 = <&spi0_pc_pins>;
-+	status = "okay";
-+
-+	flash@0 {
-+		#address-cells = <1>;
-+		#size-cells = <1>;
-+		compatible = "spi-nand";
-+		reg = <0>;
-+		spi-max-frequency = <1000000>;
-+
-+		partitions {
-+			compatible = "fixed-partitions";
-+			#address-cells = <1>;
-+			#size-cells = <1>;
-+	
-+			partition@0 {
-+				label = "u-boot-with-spl";
-+				reg = <0x0 0x100000>;
-+			};
-+
-+			ubi@100000 {
-+				label = "ubi";
-+				reg = <0x100000 0x7f00000>;
-+			};
-+		};
-+	};
-+};
-+
-+&otg_sram {
-+	status = "okay";
-+};
-+
-+&uart0 {
-+	pinctrl-names = "default";
-+	pinctrl-0 = <&uart0_pe_pins>;
-+	status = "okay";
-+};
-+
-+&usb_otg {
-+	dr_mode = "peripheral";
-+	status = "okay";
-+};
-+
-+&usbphy {
-+	status = "okay";
-+};
--- a/lede/package/boot/uboot-sunxi/patches/261-sunxi-add-popstick-defconfig.patch
+++ b/lede/package/boot/uboot-sunxi/patches/261-sunxi-add-popstick-defconfig.patch
@@ -1,61 +0,0 @@
-From 0d263e1071ee3f63d2047a8bb9af4434f1cd4bb1 Mon Sep 17 00:00:00 2001
-From: Icenowy Zheng <uwu@icenowy.me>
-Date: Thu, 16 Jun 2022 09:46:42 +0800
-Subject: [PATCH 2/2] HACK for UBI env and add defconfig
-
---
- board/sunxi/board.c        |  1 +
- configs/popstick_defconfig | 37 +++++++++++++++++++++++++++++++++++++
- 2 files changed, 38 insertions(+)
- create mode 100644 configs/popstick_defconfig
-
--- a/board/sunxi/board.c
-+++ b/board/sunxi/board.c
-@@ -135,6 +135,7 @@ void i2c_init_board(void)
-  */
- enum env_location env_get_location(enum env_operation op, int prio)
- {
-+	return prio ? ENVL_UNKNOWN : ENVL_UBI;
- 	if (prio > 1)
- 		return ENVL_UNKNOWN;
- 
--- /dev/null
-+++ b/configs/popstick_defconfig
-@@ -0,0 +1,37 @@
-+CONFIG_ARM=y
-+CONFIG_SKIP_LOWLEVEL_INIT_ONLY=y
-+CONFIG_SPL_SKIP_LOWLEVEL_INIT_ONLY=y
-+CONFIG_ARCH_SUNXI=y
-+CONFIG_ENV_SIZE=0x1f000
-+CONFIG_DEFAULT_DEVICE_TREE="suniv-f1c200s-popstick"
-+CONFIG_SPL=y
-+CONFIG_MACH_SUNIV=y
-+CONFIG_DRAM_CLK=156
-+CONFIG_DRAM_ZQ=0
-+# CONFIG_VIDEO_SUNXI is not set
-+CONFIG_SPL_SPI_SUNXI=y
-+CONFIG_SPL_SPI_SUNXI_NAND=y
-+CONFIG_SPL_SPI_SUNXI_NAND_ASSUMED_PAGESIZE=0x800
-+# CONFIG_ANDROID_BOOT_IMAGE is not set
-+CONFIG_SYS_SPI_U_BOOT_OFFS=0x20000
-+CONFIG_CMD_MTD=y
-+# CONFIG_CMD_SF is not set
-+CONFIG_CMD_MTDPARTS=y
-+CONFIG_CMD_UBI=y
-+# CONFIG_ENV_IS_IN_FAT is not set
-+# CONFIG_ENV_IS_IN_SPI_FLASH is not set
-+CONFIG_ENV_IS_IN_UBI=y
-+CONFIG_ENV_UBI_PART="ubi"
-+CONFIG_ENV_UBI_VOLUME="env"
-+# CONFIG_NET is not set
-+CONFIG_MTD=y
-+CONFIG_DM_MTD=y
-+CONFIG_MTD_SPI_NAND=y
-+# CONFIG_SPI_FLASH is not set
-+CONFIG_SF_DEFAULT_SPEED=25000000
-+# CONFIG_UBI_SILENCE_MSG is not set
-+CONFIG_PHY_SUN4I_USB=y
-+CONFIG_SPI=y
-+CONFIG_USB_MUSB_GADGET=y
-+CONFIG_USB_FUNCTION_SDP=y
-+# CONFIG_UBIFS_SILENCE_MSG is not set
--- a/lede/target/linux/generic/backport-5.15/741-v6.9-01-netfilter-flowtable-validate-pppoe-header.patch
+++ b/lede/target/linux/generic/backport-5.15/741-v6.9-01-netfilter-flowtable-validate-pppoe-header.patch
@@ -0,0 +1,85 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Thu, 11 Apr 2024 13:28:59 +0200
+Subject: [PATCH] netfilter: flowtable: validate pppoe header
+
+Ensure there is sufficient room to access the protocol field of the
+PPPoe header. Validate it once before the flowtable lookup, then use a
+helper function to access protocol field.
+
+Reported-by: syzbot+b6f07e1c07ef40199081@syzkaller.appspotmail.com
+Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
+@@ -318,7 +318,7 @@ int nf_flow_rule_route_ipv6(struct net *
+ int nf_flow_table_offload_init(void);
+ void nf_flow_table_offload_exit(void);
+ 
+-static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb)
+static inline __be16 __nf_flow_pppoe_proto(const struct sk_buff *skb)
+ {
+ 	__be16 proto;
+ 
+@@ -334,4 +334,14 @@ static inline __be16 nf_flow_pppoe_proto
+ 	return 0;
+ }
+ 
+static inline bool nf_flow_pppoe_proto(struct sk_buff *skb, __be16 *inner_proto)
+{
+	if (!pskb_may_pull(skb, PPPOE_SES_HLEN))
+		return false;
+
+	*inner_proto = __nf_flow_pppoe_proto(skb);
+
+	return true;
+}
+
+ #endif /* _NF_FLOW_TABLE_H */
+--- a/net/netfilter/nf_flow_table_inet.c
+++ b/net/netfilter/nf_flow_table_inet.c
+@@ -21,7 +21,8 @@ nf_flow_offload_inet_hook(void *priv, st
+ 		proto = veth->h_vlan_encapsulated_proto;
+ 		break;
+ 	case htons(ETH_P_PPP_SES):
+-		proto = nf_flow_pppoe_proto(skb);
+		if (!nf_flow_pppoe_proto(skb, &proto))
+			return NF_ACCEPT;
+ 		break;
+ 	default:
+ 		proto = skb->protocol;
+--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
+@@ -246,10 +246,11 @@ static unsigned int nf_flow_xmit_xfrm(st
+ 	return NF_STOLEN;
+ }
+ 
+-static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto,
+static bool nf_flow_skb_encap_protocol(struct sk_buff *skb, __be16 proto,
+ 				       u32 *offset)
+ {
+ 	struct vlan_ethhdr *veth;
+	__be16 inner_proto;
+ 
+ 	switch (skb->protocol) {
+ 	case htons(ETH_P_8021Q):
+@@ -260,7 +261,8 @@ static bool nf_flow_skb_encap_protocol(c
+ 		}
+ 		break;
+ 	case htons(ETH_P_PPP_SES):
+-		if (nf_flow_pppoe_proto(skb) == proto) {
+		if (nf_flow_pppoe_proto(skb, &inner_proto) &&
+		    inner_proto == proto) {
+ 			*offset += PPPOE_SES_HLEN;
+ 			return true;
+ 		}
+@@ -289,7 +291,7 @@ static void nf_flow_encap_pop(struct sk_
+ 			skb_reset_network_header(skb);
+ 			break;
+ 		case htons(ETH_P_PPP_SES):
+-			skb->protocol = nf_flow_pppoe_proto(skb);
+			skb->protocol = __nf_flow_pppoe_proto(skb);
+ 			skb_pull(skb, PPPOE_SES_HLEN);
+ 			skb_reset_network_header(skb);
+ 			break;
--- a/lede/target/linux/generic/backport-5.15/741-v6.9-02-netfilter-flowtable-incorrect-pppoe-tuple.patch
+++ b/lede/target/linux/generic/backport-5.15/741-v6.9-02-netfilter-flowtable-incorrect-pppoe-tuple.patch
@@ -0,0 +1,24 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Thu, 11 Apr 2024 13:29:00 +0200
+Subject: [PATCH] netfilter: flowtable: incorrect pppoe tuple
+
+pppoe traffic reaching ingress path does not match the flowtable entry
+because the pppoe header is expected to be at the network header offset.
+This bug causes a mismatch in the flow table lookup, so pppoe packets
+enter the classical forwarding path.
+
+Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
+@@ -156,7 +156,7 @@ static void nf_flow_tuple_encap(struct s
+ 		tuple->encap[i].proto = skb->protocol;
+ 		break;
+ 	case htons(ETH_P_PPP_SES):
+-		phdr = (struct pppoe_hdr *)skb_mac_header(skb);
+		phdr = (struct pppoe_hdr *)skb_network_header(skb);
+ 		tuple->encap[i].id = ntohs(phdr->sid);
+ 		tuple->encap[i].proto = skb->protocol;
+ 		break;
--- a/lede/target/linux/generic/backport-6.1/740-v6.9-01-netfilter-flowtable-validate-pppoe-header.patch
+++ b/lede/target/linux/generic/backport-6.1/740-v6.9-01-netfilter-flowtable-validate-pppoe-header.patch
@@ -0,0 +1,87 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Thu, 11 Apr 2024 13:28:59 +0200
+Subject: [PATCH] netfilter: flowtable: validate pppoe header
+
+Ensure there is sufficient room to access the protocol field of the
+PPPoe header. Validate it once before the flowtable lookup, then use a
+helper function to access protocol field.
+
+Reported-by: syzbot+b6f07e1c07ef40199081@syzkaller.appspotmail.com
+Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/include/net/netfilter/nf_flow_table.h
+++ b/include/net/netfilter/nf_flow_table.h
+@@ -335,7 +335,7 @@ int nf_flow_rule_route_ipv6(struct net *
+ int nf_flow_table_offload_init(void);
+ void nf_flow_table_offload_exit(void);
+ 
+-static inline __be16 nf_flow_pppoe_proto(const struct sk_buff *skb)
+static inline __be16 __nf_flow_pppoe_proto(const struct sk_buff *skb)
+ {
+ 	__be16 proto;
+ 
+@@ -351,6 +351,16 @@ static inline __be16 nf_flow_pppoe_proto
+ 	return 0;
+ }
+ 
+static inline bool nf_flow_pppoe_proto(struct sk_buff *skb, __be16 *inner_proto)
+{
+	if (!pskb_may_pull(skb, PPPOE_SES_HLEN))
+		return false;
+
+	*inner_proto = __nf_flow_pppoe_proto(skb);
+
+	return true;
+}
+
+ #define NF_FLOW_TABLE_STAT_INC(net, count) __this_cpu_inc((net)->ft.stat->count)
+ #define NF_FLOW_TABLE_STAT_DEC(net, count) __this_cpu_dec((net)->ft.stat->count)
+ #define NF_FLOW_TABLE_STAT_INC_ATOMIC(net, count)	\
+--- a/net/netfilter/nf_flow_table_inet.c
+++ b/net/netfilter/nf_flow_table_inet.c
+@@ -21,7 +21,8 @@ nf_flow_offload_inet_hook(void *priv, st
+ 		proto = veth->h_vlan_encapsulated_proto;
+ 		break;
+ 	case htons(ETH_P_PPP_SES):
+-		proto = nf_flow_pppoe_proto(skb);
+		if (!nf_flow_pppoe_proto(skb, &proto))
+			return NF_ACCEPT;
+ 		break;
+ 	default:
+ 		proto = skb->protocol;
+--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
+@@ -267,10 +267,11 @@ static unsigned int nf_flow_xmit_xfrm(st
+ 	return NF_STOLEN;
+ }
+ 
+-static bool nf_flow_skb_encap_protocol(const struct sk_buff *skb, __be16 proto,
+static bool nf_flow_skb_encap_protocol(struct sk_buff *skb, __be16 proto,
+ 				       u32 *offset)
+ {
+ 	struct vlan_ethhdr *veth;
+	__be16 inner_proto;
+ 
+ 	switch (skb->protocol) {
+ 	case htons(ETH_P_8021Q):
+@@ -281,7 +282,8 @@ static bool nf_flow_skb_encap_protocol(c
+ 		}
+ 		break;
+ 	case htons(ETH_P_PPP_SES):
+-		if (nf_flow_pppoe_proto(skb) == proto) {
+		if (nf_flow_pppoe_proto(skb, &inner_proto) &&
+		    inner_proto == proto) {
+ 			*offset += PPPOE_SES_HLEN;
+ 			return true;
+ 		}
+@@ -310,7 +312,7 @@ static void nf_flow_encap_pop(struct sk_
+ 			skb_reset_network_header(skb);
+ 			break;
+ 		case htons(ETH_P_PPP_SES):
+-			skb->protocol = nf_flow_pppoe_proto(skb);
+			skb->protocol = __nf_flow_pppoe_proto(skb);
+ 			skb_pull(skb, PPPOE_SES_HLEN);
+ 			skb_reset_network_header(skb);
+ 			break;
--- a/lede/target/linux/generic/backport-6.1/740-v6.9-02-netfilter-flowtable-incorrect-pppoe-tuple.patch
+++ b/lede/target/linux/generic/backport-6.1/740-v6.9-02-netfilter-flowtable-incorrect-pppoe-tuple.patch
@@ -0,0 +1,24 @@
+From: Pablo Neira Ayuso <pablo@netfilter.org>
+Date: Thu, 11 Apr 2024 13:29:00 +0200
+Subject: [PATCH] netfilter: flowtable: incorrect pppoe tuple
+
+pppoe traffic reaching ingress path does not match the flowtable entry
+because the pppoe header is expected to be at the network header offset.
+This bug causes a mismatch in the flow table lookup, so pppoe packets
+enter the classical forwarding path.
+
+Fixes: 72efd585f714 ("netfilter: flowtable: add pppoe support")
+Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
+---
+
+--- a/net/netfilter/nf_flow_table_ip.c
+++ b/net/netfilter/nf_flow_table_ip.c
+@@ -156,7 +156,7 @@ static void nf_flow_tuple_encap(struct s
+ 		tuple->encap[i].proto = skb->protocol;
+ 		break;
+ 	case htons(ETH_P_PPP_SES):
+-		phdr = (struct pppoe_hdr *)skb_mac_header(skb);
+		phdr = (struct pppoe_hdr *)skb_network_header(skb);
+ 		tuple->encap[i].id = ntohs(phdr->sid);
+ 		tuple->encap[i].proto = skb->protocol;
+ 		break;
--- a/lede/target/linux/generic/backport-6.6/752-05-v6.7-net-ethernet-mtk_wed-do-not-assume-offload-callbacks.patch
+++ b/lede/target/linux/generic/backport-6.6/752-05-v6.7-net-ethernet-mtk_wed-do-not-assume-offload-callbacks.patch
@@ -14,7 +14,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>

 --- a/drivers/net/ethernet/mediatek/mtk_wed.c
 +++ b/drivers/net/ethernet/mediatek/mtk_wed.c
-@@ -1713,19 +1713,20 @@ mtk_wed_irq_set_mask(struct mtk_wed_devi
+@@ -1709,19 +1709,20 @@ mtk_wed_irq_set_mask(struct mtk_wed_devi
 int mtk_wed_flow_add(int index)
 {
 	struct mtk_wed_hw *hw = hw_list[index];
@@ -44,7 +44,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 		goto out;
 	}
 
-@@ -1744,14 +1745,15 @@ void mtk_wed_flow_remove(int index)
+@@ -1740,14 +1741,15 @@ void mtk_wed_flow_remove(int index)
 {
 	struct mtk_wed_hw *hw = hw_list[index];
 
--- a/lede/target/linux/generic/backport-6.6/752-06-v6.7-net-ethernet-mtk_wed-introduce-versioning-utility-ro.patch
+++ b/lede/target/linux/generic/backport-6.6/752-06-v6.7-net-ethernet-mtk_wed-introduce-versioning-utility-ro.patch
@@ -52,15 +52,15 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wdma_clr(dev, MTK_WDMA_GLO_CFG,
 			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
@@ -606,7 +606,7 @@ mtk_wed_stop(struct mtk_wed_device *dev)
+ 	wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
 	wdma_w32(dev, MTK_WDMA_INT_GRP2, 0);
- 	wed_w32(dev, MTK_WED_WPDMA_INT_MASK, 0);
 
 -	if (dev->hw->version == 1)
 +	if (mtk_wed_is_v1(dev->hw))
 		return;
 
 	wed_w32(dev, MTK_WED_EXT_INT_MASK1, 0);
-@@ -625,7 +625,7 @@ mtk_wed_deinit(struct mtk_wed_device *de
+@@ -624,7 +624,7 @@ mtk_wed_deinit(struct mtk_wed_device *de
 		MTK_WED_CTRL_WED_TX_BM_EN |
 		MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
 
@@ -69,7 +69,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		return;
 
 	wed_clr(dev, MTK_WED_CTRL,
-@@ -731,7 +731,7 @@ mtk_wed_bus_init(struct mtk_wed_device *
+@@ -730,7 +730,7 @@ mtk_wed_bus_init(struct mtk_wed_device *
 static void
 mtk_wed_set_wpdma(struct mtk_wed_device *dev)
 {
@@ -78,7 +78,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wed_w32(dev, MTK_WED_WPDMA_CFG_BASE,  dev->wlan.wpdma_phys);
 	} else {
 		mtk_wed_bus_init(dev);
-@@ -762,7 +762,7 @@ mtk_wed_hw_init_early(struct mtk_wed_dev
+@@ -761,7 +761,7 @@ mtk_wed_hw_init_early(struct mtk_wed_dev
 	      MTK_WED_WDMA_GLO_CFG_IDLE_DMAD_SUPPLY;
 	wed_m32(dev, MTK_WED_WDMA_GLO_CFG, mask, set);
 
@@ -87,7 +87,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		u32 offset = dev->hw->index ? 0x04000400 : 0;
 
 		wdma_set(dev, MTK_WDMA_GLO_CFG,
-@@ -935,7 +935,7 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+@@ -934,7 +934,7 @@ mtk_wed_hw_init(struct mtk_wed_device *d
 
 	wed_w32(dev, MTK_WED_TX_BM_BUF_LEN, MTK_WED_PKT_SIZE);
 
@@ -96,7 +96,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wed_w32(dev, MTK_WED_TX_BM_TKID,
 			FIELD_PREP(MTK_WED_TX_BM_TKID_START,
 				   dev->wlan.token_start) |
-@@ -968,7 +968,7 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+@@ -967,7 +967,7 @@ mtk_wed_hw_init(struct mtk_wed_device *d
 
 	mtk_wed_reset(dev, MTK_WED_RESET_TX_BM);
 
@@ -105,7 +105,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wed_set(dev, MTK_WED_CTRL,
 			MTK_WED_CTRL_WED_TX_BM_EN |
 			MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
-@@ -1218,7 +1218,7 @@ mtk_wed_reset_dma(struct mtk_wed_device
+@@ -1217,7 +1217,7 @@ mtk_wed_reset_dma(struct mtk_wed_device
 	}
 
 	dev->init_done = false;
@@ -114,7 +114,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		return;
 
 	if (!busy) {
-@@ -1344,7 +1344,7 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+@@ -1343,7 +1343,7 @@ mtk_wed_configure_irq(struct mtk_wed_dev
 		MTK_WED_CTRL_WED_TX_BM_EN |
 		MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
 
@@ -123,7 +123,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wed_w32(dev, MTK_WED_PCIE_INT_TRIGGER,
 			MTK_WED_PCIE_INT_TRIGGER_STATUS);
 
-@@ -1417,7 +1417,7 @@ mtk_wed_dma_enable(struct mtk_wed_device
+@@ -1416,7 +1416,7 @@ mtk_wed_dma_enable(struct mtk_wed_device
 		 MTK_WDMA_GLO_CFG_RX_INFO1_PRERES |
 		 MTK_WDMA_GLO_CFG_RX_INFO2_PRERES);
 
@@ -132,7 +132,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wdma_set(dev, MTK_WDMA_GLO_CFG,
 			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
 	} else {
-@@ -1466,7 +1466,7 @@ mtk_wed_start(struct mtk_wed_device *dev
+@@ -1465,7 +1465,7 @@ mtk_wed_start(struct mtk_wed_device *dev
 
 	mtk_wed_set_ext_int(dev, true);
 
@@ -141,7 +141,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		u32 val = dev->wlan.wpdma_phys | MTK_PCIE_MIRROR_MAP_EN |
 			  FIELD_PREP(MTK_PCIE_MIRROR_MAP_WED_ID,
 				     dev->hw->index);
-@@ -1551,7 +1551,7 @@ mtk_wed_attach(struct mtk_wed_device *de
+@@ -1550,7 +1550,7 @@ mtk_wed_attach(struct mtk_wed_device *de
 	}
 
 	mtk_wed_hw_init_early(dev);
@@ -150,7 +150,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		regmap_update_bits(hw->hifsys, HIFSYS_DMA_AG_MAP,
 				   BIT(hw->index), 0);
 	} else {
-@@ -1619,7 +1619,7 @@ static int
+@@ -1618,7 +1618,7 @@ static int
 mtk_wed_txfree_ring_setup(struct mtk_wed_device *dev, void __iomem *regs)
 {
 	struct mtk_wed_ring *ring = &dev->txfree_ring;
@@ -159,7 +159,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 	/*
 	 * For txfree event handling, the same DMA ring is shared between WED
-@@ -1677,7 +1677,7 @@ mtk_wed_irq_get(struct mtk_wed_device *d
+@@ -1676,7 +1676,7 @@ mtk_wed_irq_get(struct mtk_wed_device *d
 {
 	u32 val, ext_mask = MTK_WED_EXT_INT_STATUS_ERROR_MASK;
 
@@ -168,7 +168,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		ext_mask |= MTK_WED_EXT_INT_STATUS_TX_DRV_R_RESP_ERR;
 	else
 		ext_mask |= MTK_WED_EXT_INT_STATUS_RX_FBUF_LO_TH |
-@@ -1844,7 +1844,7 @@ mtk_wed_setup_tc(struct mtk_wed_device *
+@@ -1840,7 +1840,7 @@ mtk_wed_setup_tc(struct mtk_wed_device *
 {
 	struct mtk_wed_hw *hw = wed->hw;
 
@@ -177,7 +177,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		return -EOPNOTSUPP;
 
 	switch (type) {
-@@ -1918,9 +1918,9 @@ void mtk_wed_add_hw(struct device_node *
+@@ -1914,9 +1914,9 @@ void mtk_wed_add_hw(struct device_node *
 	hw->wdma = wdma;
 	hw->index = index;
 	hw->irq = irq;
--- a/lede/target/linux/generic/backport-6.6/752-07-v6.7-net-ethernet-mtk_wed-do-not-configure-rx-offload-if-.patch
+++ b/lede/target/linux/generic/backport-6.6/752-07-v6.7-net-ethernet-mtk_wed-do-not-configure-rx-offload-if-.patch
@@ -16,15 +16,15 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 --- a/drivers/net/ethernet/mediatek/mtk_wed.c
 +++ b/drivers/net/ethernet/mediatek/mtk_wed.c
@@ -606,7 +606,7 @@ mtk_wed_stop(struct mtk_wed_device *dev)
+ 	wdma_w32(dev, MTK_WDMA_INT_MASK, 0);
 	wdma_w32(dev, MTK_WDMA_INT_GRP2, 0);
- 	wed_w32(dev, MTK_WED_WPDMA_INT_MASK, 0);
 
 -	if (mtk_wed_is_v1(dev->hw))
 +	if (!mtk_wed_get_rx_capa(dev))
 		return;
 
 	wed_w32(dev, MTK_WED_EXT_INT_MASK1, 0);
-@@ -733,16 +733,21 @@ mtk_wed_set_wpdma(struct mtk_wed_device
+@@ -732,16 +732,21 @@ mtk_wed_set_wpdma(struct mtk_wed_device
 {
 	if (mtk_wed_is_v1(dev->hw)) {
 		wed_w32(dev, MTK_WED_WPDMA_CFG_BASE,  dev->wlan.wpdma_phys);
@@ -55,7 +55,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 }
 
 static void
-@@ -974,15 +979,17 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+@@ -973,15 +978,17 @@ mtk_wed_hw_init(struct mtk_wed_device *d
 			MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
 	} else {
 		wed_clr(dev, MTK_WED_TX_TKID_CTRL, MTK_WED_TX_TKID_CTRL_PAUSE);
@@ -82,7 +82,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	}
 
 	wed_clr(dev, MTK_WED_TX_BM_CTRL, MTK_WED_TX_BM_CTRL_PAUSE);
-@@ -1354,8 +1361,6 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+@@ -1353,8 +1360,6 @@ mtk_wed_configure_irq(struct mtk_wed_dev
 
 		wed_clr(dev, MTK_WED_WDMA_INT_CTRL, wdma_mask);
 	} else {
@@ -91,7 +91,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		/* initail tx interrupt trigger */
 		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_TX,
 			MTK_WED_WPDMA_INT_CTRL_TX0_DONE_EN |
-@@ -1374,15 +1379,20 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+@@ -1373,15 +1378,20 @@ mtk_wed_configure_irq(struct mtk_wed_dev
 			FIELD_PREP(MTK_WED_WPDMA_INT_CTRL_TX_FREE_DONE_TRIG,
 				   dev->wlan.txfree_tbit));
 
@@ -121,7 +121,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 		wed_w32(dev, MTK_WED_WDMA_INT_CLR, wdma_mask);
 		wed_set(dev, MTK_WED_WDMA_INT_CTRL,
-@@ -1401,6 +1411,8 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+@@ -1400,6 +1410,8 @@ mtk_wed_configure_irq(struct mtk_wed_dev
 static void
 mtk_wed_dma_enable(struct mtk_wed_device *dev)
 {
@@ -130,7 +130,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	wed_set(dev, MTK_WED_WPDMA_INT_CTRL, MTK_WED_WPDMA_INT_CTRL_SUBRT_ADV);
 
 	wed_set(dev, MTK_WED_GLO_CFG,
-@@ -1420,33 +1432,33 @@ mtk_wed_dma_enable(struct mtk_wed_device
+@@ -1419,33 +1431,33 @@ mtk_wed_dma_enable(struct mtk_wed_device
 	if (mtk_wed_is_v1(dev->hw)) {
 		wdma_set(dev, MTK_WDMA_GLO_CFG,
 			 MTK_WDMA_GLO_CFG_RX_INFO3_PRERES);
@@ -186,7 +186,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 }
 
 static void
-@@ -1473,7 +1485,7 @@ mtk_wed_start(struct mtk_wed_device *dev
+@@ -1472,7 +1484,7 @@ mtk_wed_start(struct mtk_wed_device *dev
 
 		val |= BIT(0) | (BIT(1) * !!dev->hw->index);
 		regmap_write(dev->hw->mirror, dev->hw->index * 4, val);
@@ -195,7 +195,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		/* driver set mid ready and only once */
 		wed_w32(dev, MTK_WED_EXT_INT_MASK1,
 			MTK_WED_EXT_INT_STATUS_WPDMA_MID_RDY);
-@@ -1485,7 +1497,6 @@ mtk_wed_start(struct mtk_wed_device *dev
+@@ -1484,7 +1496,6 @@ mtk_wed_start(struct mtk_wed_device *dev
 
 		if (mtk_wed_rro_cfg(dev))
 			return;
@@ -203,7 +203,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	}
 
 	mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
-@@ -1551,13 +1562,14 @@ mtk_wed_attach(struct mtk_wed_device *de
+@@ -1550,13 +1561,14 @@ mtk_wed_attach(struct mtk_wed_device *de
 	}
 
 	mtk_wed_hw_init_early(dev);
--- a/lede/target/linux/generic/backport-6.6/752-13-v6.7-net-ethernet-mtk_wed-add-mtk_wed_soc_data-structure.patch
+++ b/lede/target/linux/generic/backport-6.6/752-13-v6.7-net-ethernet-mtk_wed-add-mtk_wed_soc_data-structure.patch
@@ -38,7 +38,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 static void
 wed_m32(struct mtk_wed_device *dev, u32 reg, u32 mask, u32 val)
 {
-@@ -747,7 +767,7 @@ mtk_wed_set_wpdma(struct mtk_wed_device
+@@ -746,7 +766,7 @@ mtk_wed_set_wpdma(struct mtk_wed_device
 		return;
 
 	wed_w32(dev, MTK_WED_WPDMA_RX_GLO_CFG, dev->wlan.wpdma_rx_glo);
@@ -47,7 +47,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 }
 
 static void
-@@ -941,22 +961,10 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+@@ -940,22 +960,10 @@ mtk_wed_hw_init(struct mtk_wed_device *d
 	wed_w32(dev, MTK_WED_TX_BM_BUF_LEN, MTK_WED_PKT_SIZE);
 
 	if (mtk_wed_is_v1(dev->hw)) {
@@ -70,7 +70,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wed_w32(dev, MTK_WED_TX_BM_DYN_THR,
 			FIELD_PREP(MTK_WED_TX_BM_DYN_THR_LO_V2, 0) |
 			MTK_WED_TX_BM_DYN_THR_HI_V2);
-@@ -971,6 +979,11 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+@@ -970,6 +978,11 @@ mtk_wed_hw_init(struct mtk_wed_device *d
 			MTK_WED_TX_TKID_DYN_THR_HI);
 	}
 
@@ -82,7 +82,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	mtk_wed_reset(dev, MTK_WED_RESET_TX_BM);
 
 	if (mtk_wed_is_v1(dev->hw)) {
-@@ -1105,13 +1118,8 @@ mtk_wed_rx_reset(struct mtk_wed_device *
+@@ -1104,13 +1117,8 @@ mtk_wed_rx_reset(struct mtk_wed_device *
 	if (ret) {
 		mtk_wed_reset(dev, MTK_WED_RESET_WED_RX_DMA);
 	} else {
@@ -98,7 +98,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wed_w32(dev, MTK_WED_RESET_IDX, 0);
 	}
 
-@@ -1164,7 +1172,8 @@ mtk_wed_reset_dma(struct mtk_wed_device
+@@ -1163,7 +1171,8 @@ mtk_wed_reset_dma(struct mtk_wed_device
 	if (busy) {
 		mtk_wed_reset(dev, MTK_WED_RESET_WED_TX_DMA);
 	} else {
@@ -108,7 +108,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wed_w32(dev, MTK_WED_RESET_IDX, 0);
 	}
 
-@@ -1256,7 +1265,6 @@ static int
+@@ -1255,7 +1264,6 @@ static int
 mtk_wed_wdma_rx_ring_setup(struct mtk_wed_device *dev, int idx, int size,
 			   bool reset)
 {
@@ -116,7 +116,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	struct mtk_wed_ring *wdma;
 
 	if (idx >= ARRAY_SIZE(dev->rx_wdma))
-@@ -1264,7 +1272,7 @@ mtk_wed_wdma_rx_ring_setup(struct mtk_we
+@@ -1263,7 +1271,7 @@ mtk_wed_wdma_rx_ring_setup(struct mtk_we
 
 	wdma = &dev->rx_wdma[idx];
 	if (!reset && mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE,
@@ -125,7 +125,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		return -ENOMEM;
 
 	wdma_w32(dev, MTK_WDMA_RING_RX(idx) + MTK_WED_RING_OFS_BASE,
-@@ -1285,7 +1293,6 @@ static int
+@@ -1284,7 +1292,6 @@ static int
 mtk_wed_wdma_tx_ring_setup(struct mtk_wed_device *dev, int idx, int size,
 			   bool reset)
 {
@@ -133,7 +133,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	struct mtk_wed_ring *wdma;
 
 	if (idx >= ARRAY_SIZE(dev->tx_wdma))
-@@ -1293,7 +1300,7 @@ mtk_wed_wdma_tx_ring_setup(struct mtk_we
+@@ -1292,7 +1299,7 @@ mtk_wed_wdma_tx_ring_setup(struct mtk_we
 
 	wdma = &dev->tx_wdma[idx];
 	if (!reset && mtk_wed_ring_alloc(dev, wdma, MTK_WED_WDMA_RING_SIZE,
@@ -142,7 +142,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		return -ENOMEM;
 
 	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_BASE,
-@@ -1932,7 +1939,12 @@ void mtk_wed_add_hw(struct device_node *
+@@ -1928,7 +1935,12 @@ void mtk_wed_add_hw(struct device_node *
 	hw->irq = irq;
 	hw->version = eth->soc->version;
 
@@ -156,7 +156,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		hw->mirror = syscon_regmap_lookup_by_phandle(eth_np,
 				"mediatek,pcie-mirror");
 		hw->hifsys = syscon_regmap_lookup_by_phandle(eth_np,
-@@ -1946,6 +1958,8 @@ void mtk_wed_add_hw(struct device_node *
+@@ -1942,6 +1954,8 @@ void mtk_wed_add_hw(struct device_node *
 			regmap_write(hw->mirror, 0, 0);
 			regmap_write(hw->mirror, 4, 0);
 		}
--- a/lede/target/linux/generic/backport-6.6/752-14-v6.7-net-ethernet-mtk_wed-introduce-WED-support-for-MT798.patch
+++ b/lede/target/linux/generic/backport-6.6/752-14-v6.7-net-ethernet-mtk_wed-introduce-WED-support-for-MT798.patch
@@ -302,7 +302,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	}
 
 	mtk_wed_set_512_support(dev, false);
-@@ -652,6 +699,14 @@ mtk_wed_deinit(struct mtk_wed_device *de
+@@ -651,6 +698,14 @@ mtk_wed_deinit(struct mtk_wed_device *de
 		MTK_WED_CTRL_RX_ROUTE_QM_EN |
 		MTK_WED_CTRL_WED_RX_BM_EN |
 		MTK_WED_CTRL_RX_RRO_QM_EN);
@@ -317,7 +317,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 }
 
 static void
-@@ -701,21 +756,37 @@ mtk_wed_detach(struct mtk_wed_device *de
+@@ -700,21 +755,37 @@ mtk_wed_detach(struct mtk_wed_device *de
 	mutex_unlock(&hw_lock);
 }
 
@@ -362,7 +362,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 		wed_w32(dev, MTK_WED_PCIE_INT_CTRL,
 			FIELD_PREP(MTK_WED_PCIE_INT_CTRL_POLL_EN, 2));
-@@ -723,19 +794,9 @@ mtk_wed_bus_init(struct mtk_wed_device *
+@@ -722,19 +793,9 @@ mtk_wed_bus_init(struct mtk_wed_device *
 		/* pcie interrupt control: pola/source selection */
 		wed_set(dev, MTK_WED_PCIE_INT_CTRL,
 			MTK_WED_PCIE_INT_CTRL_MSK_EN_POLA |
@@ -385,7 +385,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		break;
 	}
 	case MTK_WED_BUS_AXI:
-@@ -773,18 +834,19 @@ mtk_wed_set_wpdma(struct mtk_wed_device
+@@ -772,18 +833,19 @@ mtk_wed_set_wpdma(struct mtk_wed_device
 static void
 mtk_wed_hw_init_early(struct mtk_wed_device *dev)
 {
@@ -412,7 +412,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	wed_m32(dev, MTK_WED_WDMA_GLO_CFG, mask, set);
 
 	if (mtk_wed_is_v1(dev->hw)) {
-@@ -932,11 +994,18 @@ mtk_wed_route_qm_hw_init(struct mtk_wed_
+@@ -931,11 +993,18 @@ mtk_wed_route_qm_hw_init(struct mtk_wed_
 	}
 
 	/* configure RX_ROUTE_QM */
@@ -436,7 +436,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	/* enable RX_ROUTE_QM */
 	wed_set(dev, MTK_WED_CTRL, MTK_WED_CTRL_RX_ROUTE_QM_EN);
 }
-@@ -949,22 +1018,30 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+@@ -948,22 +1017,30 @@ mtk_wed_hw_init(struct mtk_wed_device *d
 
 	dev->init_done = true;
 	mtk_wed_set_ext_int(dev, false);
@@ -475,7 +475,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wed_w32(dev, MTK_WED_TX_BM_DYN_THR,
 			FIELD_PREP(MTK_WED_TX_BM_DYN_THR_LO_V2, 0) |
 			MTK_WED_TX_BM_DYN_THR_HI_V2);
-@@ -974,9 +1051,6 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+@@ -973,9 +1050,6 @@ mtk_wed_hw_init(struct mtk_wed_device *d
 				   dev->tx_buf_ring.size / 128) |
 			FIELD_PREP(MTK_WED_TX_TKID_CTRL_RSV_GRP_NUM,
 				   dev->tx_buf_ring.size / 128));
@@ -485,7 +485,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	}
 
 	wed_w32(dev, dev->hw->soc->regmap.tx_bm_tkid,
-@@ -986,26 +1060,62 @@ mtk_wed_hw_init(struct mtk_wed_device *d
+@@ -985,26 +1059,62 @@ mtk_wed_hw_init(struct mtk_wed_device *d
 
 	mtk_wed_reset(dev, MTK_WED_RESET_TX_BM);
 
@@ -561,7 +561,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 }
 
 static void
-@@ -1303,6 +1413,24 @@ mtk_wed_wdma_tx_ring_setup(struct mtk_we
+@@ -1302,6 +1412,24 @@ mtk_wed_wdma_tx_ring_setup(struct mtk_we
 					 dev->hw->soc->wdma_desc_size, true))
 		return -ENOMEM;
 
@@ -586,7 +586,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_BASE,
 		 wdma->desc_phys);
 	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_COUNT,
-@@ -1368,6 +1496,9 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+@@ -1367,6 +1495,9 @@ mtk_wed_configure_irq(struct mtk_wed_dev
 
 		wed_clr(dev, MTK_WED_WDMA_INT_CTRL, wdma_mask);
 	} else {
@@ -596,7 +596,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		/* initail tx interrupt trigger */
 		wed_w32(dev, MTK_WED_WPDMA_INT_CTRL_TX,
 			MTK_WED_WPDMA_INT_CTRL_TX0_DONE_EN |
-@@ -1420,33 +1551,60 @@ mtk_wed_dma_enable(struct mtk_wed_device
+@@ -1419,33 +1550,60 @@ mtk_wed_dma_enable(struct mtk_wed_device
 {
 	int i;
 
@@ -668,7 +668,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
 		MTK_WED_WPDMA_GLO_CFG_TX_TKID_KEEP |
 		MTK_WED_WPDMA_GLO_CFG_TX_DMAD_DW3_PREV);
-@@ -1458,11 +1616,22 @@ mtk_wed_dma_enable(struct mtk_wed_device
+@@ -1457,11 +1615,22 @@ mtk_wed_dma_enable(struct mtk_wed_device
 		MTK_WED_WDMA_GLO_CFG_TX_DRV_EN |
 		MTK_WED_WDMA_GLO_CFG_TX_DDONE_CHK);
 
@@ -693,7 +693,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 	for (i = 0; i < MTK_WED_RX_QUEUES; i++)
 		mtk_wed_check_wfdma_rx_fill(dev, i);
-@@ -1502,6 +1671,12 @@ mtk_wed_start(struct mtk_wed_device *dev
+@@ -1501,6 +1670,12 @@ mtk_wed_start(struct mtk_wed_device *dev
 		wed_r32(dev, MTK_WED_EXT_INT_MASK1);
 		wed_r32(dev, MTK_WED_EXT_INT_MASK2);
 
@@ -706,7 +706,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		if (mtk_wed_rro_cfg(dev))
 			return;
 	}
-@@ -1553,6 +1728,7 @@ mtk_wed_attach(struct mtk_wed_device *de
+@@ -1552,6 +1727,7 @@ mtk_wed_attach(struct mtk_wed_device *de
 	dev->irq = hw->irq;
 	dev->wdma_idx = hw->index;
 	dev->version = hw->version;
@@ -714,7 +714,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 	if (hw->eth->dma_dev == hw->eth->dev &&
 	    of_dma_is_coherent(hw->eth->dev->of_node))
-@@ -1620,6 +1796,23 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
+@@ -1619,6 +1795,23 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
 	ring->reg_base = MTK_WED_RING_TX(idx);
 	ring->wpdma = regs;
 
@@ -738,7 +738,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	/* WED -> WPDMA */
 	wpdma_tx_w32(dev, idx, MTK_WED_RING_OFS_BASE, ring->desc_phys);
 	wpdma_tx_w32(dev, idx, MTK_WED_RING_OFS_COUNT, MTK_WED_TX_RING_SIZE);
-@@ -1694,15 +1887,13 @@ mtk_wed_rx_ring_setup(struct mtk_wed_dev
+@@ -1693,15 +1886,13 @@ mtk_wed_rx_ring_setup(struct mtk_wed_dev
 static u32
 mtk_wed_irq_get(struct mtk_wed_device *dev, u32 mask)
 {
@@ -759,7 +759,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 	val = wed_r32(dev, MTK_WED_EXT_INT_STATUS);
 	wed_w32(dev, MTK_WED_EXT_INT_STATUS, val);
-@@ -1943,6 +2134,9 @@ void mtk_wed_add_hw(struct device_node *
+@@ -1939,6 +2130,9 @@ void mtk_wed_add_hw(struct device_node *
 	case 2:
 		hw->soc = &mt7986_data;
 		break;
--- a/lede/target/linux/generic/backport-6.6/752-15-v6.7-net-ethernet-mtk_wed-refactor-mtk_wed_check_wfdma_rx.patch
+++ b/lede/target/linux/generic/backport-6.6/752-15-v6.7-net-ethernet-mtk_wed-refactor-mtk_wed_check_wfdma_rx.patch
@@ -56,7 +56,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 }
 
 static void
-@@ -1546,6 +1537,7 @@ mtk_wed_configure_irq(struct mtk_wed_dev
+@@ -1545,6 +1536,7 @@ mtk_wed_configure_irq(struct mtk_wed_dev
 	wed_w32(dev, MTK_WED_INT_MASK, irq_mask);
 }
 
@@ -64,7 +64,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 static void
 mtk_wed_dma_enable(struct mtk_wed_device *dev)
 {
-@@ -1633,8 +1625,26 @@ mtk_wed_dma_enable(struct mtk_wed_device
+@@ -1632,8 +1624,26 @@ mtk_wed_dma_enable(struct mtk_wed_device
 		wdma_set(dev, MTK_WDMA_WRBK_TX_CFG, MTK_WDMA_WRBK_TX_CFG_WRBK_EN);
 	}
 
--- a/lede/target/linux/generic/backport-6.6/752-16-v6.7-net-ethernet-mtk_wed-introduce-partial-AMSDU-offload.patch
+++ b/lede/target/linux/generic/backport-6.6/752-16-v6.7-net-ethernet-mtk_wed-introduce-partial-AMSDU-offload.patch
@@ -248,7 +248,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 mtk_wed_tx_buffer_alloc(struct mtk_wed_device *dev)
 {
 	u32 desc_size = dev->hw->soc->tx_ring_desc_size;
-@@ -709,6 +840,7 @@ __mtk_wed_detach(struct mtk_wed_device *
+@@ -708,6 +839,7 @@ __mtk_wed_detach(struct mtk_wed_device *
 
 	mtk_wdma_rx_reset(dev);
 	mtk_wed_reset(dev, MTK_WED_RESET_WED);
@@ -256,7 +256,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	mtk_wed_free_tx_buffer(dev);
 	mtk_wed_free_tx_rings(dev);
 
-@@ -1129,23 +1261,6 @@ mtk_wed_ring_reset(struct mtk_wed_ring *
+@@ -1128,23 +1260,6 @@ mtk_wed_ring_reset(struct mtk_wed_ring *
 	}
 }
 
@@ -280,7 +280,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 static int
 mtk_wed_rx_reset(struct mtk_wed_device *dev)
 {
-@@ -1692,6 +1807,7 @@ mtk_wed_start(struct mtk_wed_device *dev
+@@ -1691,6 +1806,7 @@ mtk_wed_start(struct mtk_wed_device *dev
 	}
 
 	mtk_wed_set_512_support(dev, dev->wlan.wcid_512);
@@ -288,7 +288,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 	mtk_wed_dma_enable(dev);
 	dev->running = true;
-@@ -1748,6 +1864,10 @@ mtk_wed_attach(struct mtk_wed_device *de
+@@ -1747,6 +1863,10 @@ mtk_wed_attach(struct mtk_wed_device *de
 	if (ret)
 		goto out;
 
--- a/lede/target/linux/generic/backport-6.6/752-17-v6.7-net-ethernet-mtk_wed-introduce-hw_rro-support-for-MT.patch
+++ b/lede/target/linux/generic/backport-6.6/752-17-v6.7-net-ethernet-mtk_wed-introduce-hw_rro-support-for-MT.patch
@@ -173,7 +173,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 }
 
 static void
-@@ -935,6 +1056,8 @@ mtk_wed_bus_init(struct mtk_wed_device *
+@@ -934,6 +1055,8 @@ mtk_wed_bus_init(struct mtk_wed_device *
 static void
 mtk_wed_set_wpdma(struct mtk_wed_device *dev)
 {
@@ -182,7 +182,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	if (mtk_wed_is_v1(dev->hw)) {
 		wed_w32(dev, MTK_WED_WPDMA_CFG_BASE,  dev->wlan.wpdma_phys);
 		return;
-@@ -952,6 +1075,15 @@ mtk_wed_set_wpdma(struct mtk_wed_device
+@@ -951,6 +1074,15 @@ mtk_wed_set_wpdma(struct mtk_wed_device
 
 	wed_w32(dev, MTK_WED_WPDMA_RX_GLO_CFG, dev->wlan.wpdma_rx_glo);
 	wed_w32(dev, dev->hw->soc->regmap.wpdma_rx_ring0, dev->wlan.wpdma_rx);
@@ -198,7 +198,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 }
 
 static void
-@@ -1763,6 +1895,165 @@ mtk_wed_dma_enable(struct mtk_wed_device
+@@ -1762,6 +1894,165 @@ mtk_wed_dma_enable(struct mtk_wed_device
 }
 
 static void
@@ -364,7 +364,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
 {
 	int i;
-@@ -2216,6 +2507,10 @@ void mtk_wed_add_hw(struct device_node *
+@@ -2212,6 +2503,10 @@ void mtk_wed_add_hw(struct device_node *
 		.detach = mtk_wed_detach,
 		.ppe_check = mtk_wed_ppe_check,
 		.setup_tc = mtk_wed_setup_tc,
--- a/lede/target/linux/generic/backport-6.6/752-20-v6.7-net-ethernet-mtk_wed-add-wed-3.0-reset-support.patch
+++ b/lede/target/linux/generic/backport-6.6/752-20-v6.7-net-ethernet-mtk_wed-add-wed-3.0-reset-support.patch
@@ -205,7 +205,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	wdma_w32(dev, MTK_WDMA_RESET_IDX, MTK_WDMA_RESET_IDX_TX);
 	wdma_w32(dev, MTK_WDMA_RESET_IDX, 0);
 
-@@ -1406,13 +1570,33 @@ mtk_wed_rx_reset(struct mtk_wed_device *
+@@ -1405,13 +1569,33 @@ mtk_wed_rx_reset(struct mtk_wed_device *
 	if (ret)
 		return ret;
 
@@ -239,7 +239,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wed_w32(dev, MTK_WED_WPDMA_RX_D_RST_IDX,
 			MTK_WED_WPDMA_RX_D_RST_CRX_IDX |
 			MTK_WED_WPDMA_RX_D_RST_DRV_IDX);
-@@ -1440,23 +1624,52 @@ mtk_wed_rx_reset(struct mtk_wed_device *
+@@ -1439,23 +1623,52 @@ mtk_wed_rx_reset(struct mtk_wed_device *
 		wed_w32(dev, MTK_WED_RROQM_RST_IDX, 0);
 	}
 
@@ -298,7 +298,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	mtk_wed_reset(dev, MTK_WED_RESET_WDMA_TX_DRV);
 
 	/* reset wed rx dma */
-@@ -1477,6 +1690,14 @@ mtk_wed_rx_reset(struct mtk_wed_device *
+@@ -1476,6 +1689,14 @@ mtk_wed_rx_reset(struct mtk_wed_device *
 			  MTK_WED_CTRL_WED_RX_BM_BUSY);
 	mtk_wed_reset(dev, MTK_WED_RESET_RX_BM);
 
@@ -313,7 +313,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	/* wo change to enable state */
 	val = MTK_WED_WO_STATE_ENABLE;
 	ret = mtk_wed_mcu_send_msg(wo, MTK_WED_MODULE_ID_WO,
-@@ -1494,6 +1715,7 @@ mtk_wed_rx_reset(struct mtk_wed_device *
+@@ -1493,6 +1714,7 @@ mtk_wed_rx_reset(struct mtk_wed_device *
 				   false);
 	}
 	mtk_wed_free_rx_buffer(dev);
@@ -321,7 +321,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 	return 0;
 }
-@@ -1527,15 +1749,41 @@ mtk_wed_reset_dma(struct mtk_wed_device
+@@ -1526,15 +1748,41 @@ mtk_wed_reset_dma(struct mtk_wed_device
 
 	/* 2. reset WDMA rx DMA */
 	busy = !!mtk_wdma_rx_reset(dev);
@@ -364,7 +364,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 		wed_w32(dev, MTK_WED_WDMA_RESET_IDX,
 			MTK_WED_WDMA_RESET_IDX_RX | MTK_WED_WDMA_RESET_IDX_DRV);
 		wed_w32(dev, MTK_WED_WDMA_RESET_IDX, 0);
-@@ -1551,8 +1799,13 @@ mtk_wed_reset_dma(struct mtk_wed_device
+@@ -1550,8 +1798,13 @@ mtk_wed_reset_dma(struct mtk_wed_device
 	wed_clr(dev, MTK_WED_CTRL, MTK_WED_CTRL_WED_TX_FREE_AGENT_EN);
 
 	for (i = 0; i < 100; i++) {
@@ -380,7 +380,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 			break;
 	}
 
-@@ -1574,6 +1827,8 @@ mtk_wed_reset_dma(struct mtk_wed_device
+@@ -1573,6 +1826,8 @@ mtk_wed_reset_dma(struct mtk_wed_device
 		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_INT_AGENT);
 		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_TX_DRV);
 		mtk_wed_reset(dev, MTK_WED_RESET_WPDMA_RX_DRV);
@@ -389,7 +389,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	} else {
 		wed_w32(dev, MTK_WED_WPDMA_RESET_IDX,
 			MTK_WED_WPDMA_RESET_IDX_TX |
-@@ -1590,7 +1845,14 @@ mtk_wed_reset_dma(struct mtk_wed_device
+@@ -1589,7 +1844,14 @@ mtk_wed_reset_dma(struct mtk_wed_device
 		wed_w32(dev, MTK_WED_RESET_IDX, 0);
 	}
 
@@ -405,7 +405,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 }
 
 static int
-@@ -1842,6 +2104,7 @@ mtk_wed_dma_enable(struct mtk_wed_device
+@@ -1841,6 +2103,7 @@ mtk_wed_dma_enable(struct mtk_wed_device
 			MTK_WED_WPDMA_GLO_CFG_RX_DRV_UNS_VER_FORCE_4);
 
 		wdma_set(dev, MTK_WDMA_PREF_RX_CFG, MTK_WDMA_PREF_RX_CFG_PREF_EN);
@@ -413,7 +413,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	}
 
 	wed_clr(dev, MTK_WED_WPDMA_GLO_CFG,
-@@ -1905,6 +2168,12 @@ mtk_wed_start_hw_rro(struct mtk_wed_devi
+@@ -1904,6 +2167,12 @@ mtk_wed_start_hw_rro(struct mtk_wed_devi
 	if (!mtk_wed_get_rx_capa(dev) || !dev->wlan.hw_rro)
 		return;
 
--- a/lede/target/linux/generic/backport-6.6/771-v6.7-01-net-stmmac-improve-TX-timer-arm-logic.patch
+++ b/lede/target/linux/generic/backport-6.6/771-v6.7-01-net-stmmac-improve-TX-timer-arm-logic.patch
@@ -46,7 +46,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>

 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-@@ -3003,13 +3003,25 @@ static void stmmac_tx_timer_arm(struct s
+@@ -2988,13 +2988,25 @@ static void stmmac_tx_timer_arm(struct s
 {
 	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
 	u32 tx_coal_timer = priv->tx_coal_timer[queue];
--- a/lede/target/linux/generic/backport-6.6/771-v6.7-02-net-stmmac-move-TX-timer-arm-after-DMA-enable.patch
+++ b/lede/target/linux/generic/backport-6.6/771-v6.7-02-net-stmmac-move-TX-timer-arm-after-DMA-enable.patch
@@ -18,7 +18,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>

 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-@@ -2551,9 +2551,13 @@ static void stmmac_bump_dma_threshold(st
+@@ -2536,9 +2536,13 @@ static void stmmac_bump_dma_threshold(st
  * @priv: driver private structure
  * @budget: napi budget limiting this functions packet handling
  * @queue: TX queue index
@@ -33,7 +33,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 {
 	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
 	struct stmmac_txq_stats *txq_stats = &priv->xstats.txq_stats[queue];
-@@ -2713,7 +2717,7 @@ static int stmmac_tx_clean(struct stmmac
+@@ -2698,7 +2702,7 @@ static int stmmac_tx_clean(struct stmmac
 
 	/* We still have pending packets, let's call for a new scheduling */
 	if (tx_q->dirty_tx != tx_q->cur_tx)
@@ -42,7 +42,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 	u64_stats_update_begin(&txq_stats->napi_syncp);
 	u64_stats_add(&txq_stats->napi.tx_packets, tx_packets);
-@@ -5605,6 +5609,7 @@ static int stmmac_napi_poll_tx(struct na
+@@ -5590,6 +5594,7 @@ static int stmmac_napi_poll_tx(struct na
 		container_of(napi, struct stmmac_channel, tx_napi);
 	struct stmmac_priv *priv = ch->priv_data;
 	struct stmmac_txq_stats *txq_stats;
@@ -50,7 +50,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	u32 chan = ch->index;
 	int work_done;
 
-@@ -5613,7 +5618,7 @@ static int stmmac_napi_poll_tx(struct na
+@@ -5598,7 +5603,7 @@ static int stmmac_napi_poll_tx(struct na
 	u64_stats_inc(&txq_stats->napi.poll);
 	u64_stats_update_end(&txq_stats->napi_syncp);
 
@@ -59,7 +59,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	work_done = min(work_done, budget);
 
 	if (work_done < budget && napi_complete_done(napi, work_done)) {
-@@ -5624,6 +5629,10 @@ static int stmmac_napi_poll_tx(struct na
+@@ -5609,6 +5614,10 @@ static int stmmac_napi_poll_tx(struct na
 		spin_unlock_irqrestore(&ch->lock, flags);
 	}
 
@@ -70,7 +70,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	return work_done;
 }
 
-@@ -5632,6 +5641,7 @@ static int stmmac_napi_poll_rxtx(struct
+@@ -5617,6 +5626,7 @@ static int stmmac_napi_poll_rxtx(struct
 	struct stmmac_channel *ch =
 		container_of(napi, struct stmmac_channel, rxtx_napi);
 	struct stmmac_priv *priv = ch->priv_data;
@@ -78,7 +78,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	int rx_done, tx_done, rxtx_done;
 	struct stmmac_rxq_stats *rxq_stats;
 	struct stmmac_txq_stats *txq_stats;
-@@ -5647,7 +5657,7 @@ static int stmmac_napi_poll_rxtx(struct
+@@ -5632,7 +5642,7 @@ static int stmmac_napi_poll_rxtx(struct
 	u64_stats_inc(&txq_stats->napi.poll);
 	u64_stats_update_end(&txq_stats->napi_syncp);
 
@@ -87,7 +87,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 	tx_done = min(tx_done, budget);
 
 	rx_done = stmmac_rx_zc(priv, budget, chan);
-@@ -5672,6 +5682,10 @@ static int stmmac_napi_poll_rxtx(struct
+@@ -5657,6 +5667,10 @@ static int stmmac_napi_poll_rxtx(struct
 		spin_unlock_irqrestore(&ch->lock, flags);
 	}
 
--- a/lede/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
+++ b/lede/target/linux/generic/hack-5.15/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
 --- /dev/null
 +++ b/net/netfilter/xt_FLOWOFFLOAD.c
-@@ -0,0 +1,701 @@
+@@ -0,0 +1,702 @@
 +/*
 + * Copyright (C) 2018-2021 Felix Fietkau <nbd@nbd.name>
 + *
@@ -163,7 +163,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +		proto = veth->h_vlan_encapsulated_proto;
 +		break;
 +	case htons(ETH_P_PPP_SES):
-+		proto = nf_flow_pppoe_proto(skb);
+		if (!nf_flow_pppoe_proto(skb, &proto))
+			return NF_ACCEPT;
 +		break;
 +	default:
 +		proto = skb->protocol;
--- a/lede/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
+++ b/lede/target/linux/generic/hack-6.1/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
@@ -59,7 +59,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
 --- /dev/null
 +++ b/net/netfilter/xt_FLOWOFFLOAD.c
-@@ -0,0 +1,702 @@
+@@ -0,0 +1,703 @@
 +/*
 + * Copyright (C) 2018-2021 Felix Fietkau <nbd@nbd.name>
 + *
@@ -124,7 +124,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +		proto = veth->h_vlan_encapsulated_proto;
 +		break;
 +	case htons(ETH_P_PPP_SES):
-+		proto = nf_flow_pppoe_proto(skb);
+		if (!nf_flow_pppoe_proto(skb, &proto))
+			return NF_ACCEPT;
 +		break;
 +	default:
 +		proto = skb->protocol;
--- a/lede/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
+++ b/lede/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
@@ -59,7 +59,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 obj-$(CONFIG_NETFILTER_XT_TARGET_LED) += xt_LED.o
 --- /dev/null
 +++ b/net/netfilter/xt_FLOWOFFLOAD.c
-@@ -0,0 +1,702 @@
+@@ -0,0 +1,703 @@
 +/*
 + * Copyright (C) 2018-2021 Felix Fietkau <nbd@nbd.name>
 + *
@@ -124,7 +124,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +		proto = veth->h_vlan_encapsulated_proto;
 +		break;
 +	case htons(ETH_P_PPP_SES):
-+		proto = nf_flow_pppoe_proto(skb);
+		if (!nf_flow_pppoe_proto(skb, &proto))
+			return NF_ACCEPT;
 +		break;
 +	default:
 +		proto = skb->protocol;
--- a/lede/target/linux/generic/hack-6.6/780-usb-net-MeigLink_modem_support.patch
+++ b/lede/target/linux/generic/hack-6.6/780-usb-net-MeigLink_modem_support.patch
@@ -43,7 +43,7 @@ Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support
 
 #define QUECTEL_VENDOR_ID			0x2c7c
 /* These Quectel products use Quectel's vendor ID */
-@@ -1152,6 +1157,11 @@ static const struct usb_device_id option
+@@ -1156,6 +1161,11 @@ static const struct usb_device_id option
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */
 	  .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) },
@@ -55,7 +55,7 @@ Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support
 	/* Quectel products using Qualcomm vendor ID */
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
-@@ -1193,6 +1203,11 @@ static const struct usb_device_id option
+@@ -1197,6 +1207,11 @@ static const struct usb_device_id option
 	  .driver_info = ZLP },
 	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
 	  .driver_info = RSVD(4) },
--- a/lede/target/linux/generic/hack-6.6/930-usb-net-for-fm350.patch
+++ b/lede/target/linux/generic/hack-6.6/930-usb-net-for-fm350.patch
@@ -1,6 +1,6 @@
 --- a/drivers/usb/serial/option.c
 +++ b/drivers/usb/serial/option.c
-@@ -642,6 +642,7 @@ static void option_instat_callback(struc
+@@ -646,6 +646,7 @@ static void option_instat_callback(struc
 
 
 static const struct usb_device_id option_ids[] = {
@@ -8,7 +8,7 @@
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
 	{ USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA_LIGHT) },
-@@ -2379,6 +2380,15 @@ static int option_probe(struct usb_seria
+@@ -2419,6 +2420,15 @@ static int option_probe(struct usb_seria
 	if (device_flags & NUMEP2 && iface_desc->bNumEndpoints != 2)
 		return -ENODEV;
 
--- a/lede/target/linux/generic/pending-5.15/901-usb-add-more-modem-support.patch
+++ b/lede/target/linux/generic/pending-5.15/901-usb-add-more-modem-support.patch
@@ -12,16 +12,17 @@
 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */
 --- a/drivers/usb/serial/option.c
 +++ b/drivers/usb/serial/option.c
-@@ -2277,6 +2277,12 @@ static const struct usb_device_id option
- 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) },			/* Fibocom FM101-GL (laptop MBIM) */
+@@ -2278,9 +2278,13 @@ static const struct usb_device_id option
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff),			/* Fibocom FM101-GL (laptop MBIM) */
 	  .driver_info = RSVD(4) },
-+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a04, 0xff),			/* Fibocom FM650 ECM */
-+	  .driver_info = RSVD(5) },
-+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff),			/* Fibocom FM650 NCM */
-+	  .driver_info = RSVD(6) },
-+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff),			/* Fibocom FM650 RNDIS */
-+	  .driver_info = RSVD(6) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) },			/* LongSung M5710 */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1402, 0xff) },			/* GosunCn GM800 (Download mode) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1403, 0xff) },			/* GosunCn GM800 (rmnet, old) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1421, 0xff) },			/* GosunCn GM800 (rmnet) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1422, 0xff) },			/* GosunCn GM800 (EAP) */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
--- a/lede/target/linux/generic/pending-6.1/901-usb-add-more-modem-support.patch
+++ b/lede/target/linux/generic/pending-6.1/901-usb-add-more-modem-support.patch
@@ -12,16 +12,17 @@
 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */
 --- a/drivers/usb/serial/option.c
 +++ b/drivers/usb/serial/option.c
-@@ -2277,6 +2277,12 @@ static const struct usb_device_id option
- 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) },			/* Fibocom FM101-GL (laptop MBIM) */
+@@ -2278,9 +2278,13 @@ static const struct usb_device_id option
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff),			/* Fibocom FM101-GL (laptop MBIM) */
 	  .driver_info = RSVD(4) },
-+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a04, 0xff),			/* Fibocom FM650 ECM */
-+	  .driver_info = RSVD(5) },
-+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff),			/* Fibocom FM650 NCM */
-+	  .driver_info = RSVD(6) },
-+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff),			/* Fibocom FM650 RNDIS */
-+	  .driver_info = RSVD(6) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) },			/* LongSung M5710 */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1402, 0xff) },			/* GosunCn GM800 (Download mode) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1403, 0xff) },			/* GosunCn GM800 (rmnet, old) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1421, 0xff) },			/* GosunCn GM800 (rmnet) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1422, 0xff) },			/* GosunCn GM800 (EAP) */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
--- a/lede/target/linux/generic/pending-6.6/150-bridge_allow_receiption_on_disabled_port.patch
+++ b/lede/target/linux/generic/pending-6.6/150-bridge_allow_receiption_on_disabled_port.patch
@@ -15,7 +15,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/net/bridge/br_input.c
 +++ b/net/bridge/br_input.c
-@@ -239,6 +239,9 @@ static void __br_handle_local_finish(str
+@@ -244,6 +244,9 @@ static void __br_handle_local_finish(str
 /* note: already called with rcu_read_lock */
 static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
@@ -25,7 +25,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 	__br_handle_local_finish(skb);
 
 	/* return 1 to signal the okfn() was called so it's ok to use the skb */
-@@ -408,6 +411,17 @@ forward:
+@@ -415,6 +418,17 @@ forward:
 		goto defer_stp_filtering;
 
 	switch (p->state) {
--- a/lede/target/linux/generic/pending-6.6/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
+++ b/lede/target/linux/generic/pending-6.6/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>

 --- a/net/netfilter/nf_tables_api.c
 +++ b/net/netfilter/nf_tables_api.c
-@@ -8260,7 +8260,7 @@ static int nft_register_flowtable_net_ho
+@@ -8268,7 +8268,7 @@ static int nft_register_flowtable_net_ho
 		err = flowtable->data.type->setup(&flowtable->data,
 						  hook->ops.dev,
 						  FLOW_BLOCK_BIND);
--- a/lede/target/linux/generic/pending-6.6/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
+++ b/lede/target/linux/generic/pending-6.6/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 			if (!(p->flags & BR_BCAST_FLOOD) && skb->dev != br->dev)
 --- a/net/bridge/br_input.c
 +++ b/net/bridge/br_input.c
-@@ -362,6 +362,8 @@ static rx_handler_result_t br_handle_fra
+@@ -367,6 +367,8 @@ static rx_handler_result_t br_handle_fra
 		fwd_mask |= p->group_fwd_mask;
 		switch (dest[5]) {
 		case 0x00:	/* Bridge Group Address */
--- a/lede/target/linux/generic/pending-6.6/723-net-mt7531-ensure-all-MACs-are-powered-down-before-r.patch
+++ b/lede/target/linux/generic/pending-6.6/723-net-mt7531-ensure-all-MACs-are-powered-down-before-r.patch
@@ -15,7 +15,7 @@ Signed-off-by: Alexander Couzens <lynxis@fe80.eu>

 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2465,6 +2465,10 @@ mt7530_setup(struct dsa_switch *ds)
+@@ -2467,6 +2467,10 @@ mt7530_setup(struct dsa_switch *ds)
 		return -ENODEV;
 	}
 
--- a/lede/target/linux/generic/pending-6.6/795-mt7530-register-OF-node-for-internal-MDIO-bus.patch
+++ b/lede/target/linux/generic/pending-6.6/795-mt7530-register-OF-node-for-internal-MDIO-bus.patch
@@ -16,7 +16,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>

 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2353,10 +2353,13 @@ mt7530_setup_mdio(struct mt7530_priv *pr
+@@ -2355,10 +2355,13 @@ mt7530_setup_mdio(struct mt7530_priv *pr
 {
 	struct dsa_switch *ds = priv->ds;
 	struct device *dev = priv->dev;
@@ -30,7 +30,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 	bus = devm_mdiobus_alloc(dev);
 	if (!bus)
 		return -ENOMEM;
-@@ -2375,7 +2378,9 @@ mt7530_setup_mdio(struct mt7530_priv *pr
+@@ -2377,7 +2380,9 @@ mt7530_setup_mdio(struct mt7530_priv *pr
 	if (priv->irq)
 		mt7530_setup_mdio_irq(priv);
 
--- a/lede/target/linux/generic/pending-6.6/811-pci_disable_usb_common_quirks.patch
+++ b/lede/target/linux/generic/pending-6.6/811-pci_disable_usb_common_quirks.patch
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 #endif  /*  __LINUX_USB_PCI_QUIRKS_H  */
 --- a/include/linux/usb/hcd.h
 +++ b/include/linux/usb/hcd.h
-@@ -484,7 +484,14 @@ extern int usb_hcd_pci_probe(struct pci_
+@@ -485,7 +485,14 @@ extern int usb_hcd_pci_probe(struct pci_
 extern void usb_hcd_pci_remove(struct pci_dev *dev);
 extern void usb_hcd_pci_shutdown(struct pci_dev *dev);
 
--- a/lede/target/linux/generic/pending-6.6/901-usb-add-more-modem-support.patch
+++ b/lede/target/linux/generic/pending-6.6/901-usb-add-more-modem-support.patch
@@ -0,0 +1,28 @@
+--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
+@@ -1431,6 +1431,9 @@ static const struct usb_device_id produc
+ 	{QMI_FIXED_INTF(0x2692, 0x9025, 4)},    /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */
+ 	{QMI_QUIRK_SET_DTR(0x1546, 0x1312, 4)},	/* u-blox LARA-R6 01B */
+ 	{QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)},	/* u-blox LARA-L6 */
+	{QMI_FIXED_INTF(0x2077, 0x2002, 4)},	/* T&W TW04C */
+	{QMI_FIXED_INTF(0x2077, 0x2003, 4)},	/* T&W TW12G */
+	{QMI_FIXED_INTF(0x2077, 0x2004, 4)},	/* T&W TW510M */
+ 
+ 	/* 4. Gobi 1000 devices */
+ 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */
+--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
+@@ -2278,9 +2278,13 @@ static const struct usb_device_id option
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff),			/* Fibocom FM101-GL (laptop MBIM) */
+ 	  .driver_info = RSVD(4) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) },			/* LongSung M5710 */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1402, 0xff) },			/* GosunCn GM800 (Download mode) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1403, 0xff) },			/* GosunCn GM800 (rmnet, old) */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1421, 0xff) },			/* GosunCn GM800 (rmnet) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1422, 0xff) },			/* GosunCn GM800 (EAP) */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
--- a/lede/target/linux/generic/pending-6.6/920-mangle_bootargs.patch
+++ b/lede/target/linux/generic/pending-6.6/920-mangle_bootargs.patch
@@ -61,7 +61,7 @@ Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
 /*
  * We need to store the untouched command line for future reference.
  * We also need to store the touched command line since the parameter
-@@ -896,6 +919,7 @@ void start_kernel(void)
+@@ -898,6 +921,7 @@ void start_kernel(void)
 	pr_notice("%s", linux_banner);
 	early_security_init();
 	setup_arch(&command_line);
--- a/lede/target/linux/sunxi/patches-6.6/501-h616-Add-cpu-frequency-scaling-support.patch
+++ b/lede/target/linux/sunxi/patches-6.6/501-h616-Add-cpu-frequency-scaling-support.patch
@@ -0,0 +1,270 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: AGM1968 <AGM1968@users.noreply.github.com>
+Date: Tue, 23 May 2023 16:43:00 +0000
+Subject: arm64-dts-allwinner-h616-Add-efuse_xlate-cpu-frequency-scaling
+
+Signed-off-by: AGM1968 <AGM1968@users.noreply.github.com>
+---
+ arch/arm64/boot/dts/allwinner/sun50i-h616-cpu-opp.dtsi       | 75 ++++++++
+ drivers/cpufreq/cpufreq-dt-platdev.c                         |  1 +
+ drivers/cpufreq/sun50i-cpufreq-nvmem.c                       | 91 +++++++---
+ 3 files changed, 143 insertions(+), 24 deletions(-)
+
+--- /dev/null
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h616-cpu-opp.dtsi
+@@ -0,0 +1,75 @@
+//SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+//Testing Version 1  from: AGM1968 <AGM1968@users.noreply.github.com>
+//Noted: PLL_CPUX = 24 MHz*N/P (WIP)
+
+/ {
+	cpu_opp_table: opp-table-cpu {
+		compatible = "allwinner,sun50i-h616-operating-points";
+		nvmem-cells = <&cpu_speed_grade>;
+		opp-shared;
+ 
+		opp-480000000 {
+			clock-latency-ns = <244144>; /* 8 32k periods */
+			opp-hz = /bits/ 64 <480000000>;
+			opp-microvolt-speed0 = <820000 820000 1100000>; 
+			opp-microvolt-speed1 = <880000 880000 1100000>;
+			opp-microvolt-speed2 = <880000 880000 1100000>;
+		};
+
+		opp-600000000 {
+			clock-latency-ns = <244144>; /* 8 32k periods */
+			opp-hz = /bits/ 64 <600000000>;
+			opp-microvolt-speed0 = <820000 820000 1100000>;
+			opp-microvolt-speed1 = <880000 880000 1100000>;
+			opp-microvolt-speed2 = <880000 880000 1100000>;
+		};
+
+		opp-792000000 {
+			clock-latency-ns = <244144>; /* 8 32k periods */
+			opp-hz = /bits/ 64 <792000000>;
+			opp-microvolt-speed0 = <860000 860000 1100000>;
+			opp-microvolt-speed1 = <940000 940000 1100000>;
+			opp-microvolt-speed2 = <940000 940000 1100000>;
+		};
+
+		opp-1008000000 {
+			clock-latency-ns = <244144>; /* 8 32k periods */
+			opp-hz = /bits/ 64 <1008000000>;
+			opp-microvolt-speed0 = <900000 900000 1100000>;
+			opp-microvolt-speed1 = <1020000 1020000 1100000>;
+			opp-microvolt-speed2 = <1020000 1020000 1100000>;
+		};
+
+		opp-1200000000 {
+			clock-latency-ns = <244144>; /* 8 32k periods */
+			opp-hz = /bits/ 64 <1200000000>;
+			opp-microvolt-speed0 = <960000 960000 1100000>;
+			opp-microvolt-speed1 = <1100000 1100000 1100000>;
+			opp-microvolt-speed2 = <1100000 1100000 1100000>;
+		};
+
+		opp-1512000000 {
+			clock-latency-ns = <244144>; /* 8 32k periods */
+			opp-hz = /bits/ 64 <1512000000>;
+			opp-microvolt-speed0 = <1100000 1100000 1100000>;
+			opp-microvolt-speed1 = <1100000 1100000 1100000>;
+			opp-microvolt-speed2 = <1100000 1100000 1100000>;
+		};
+	};
+};
+
+&cpu0 {
+	operating-points-v2 = <&cpu_opp_table>;
+};
+ 
+&cpu1 {
+	operating-points-v2 = <&cpu_opp_table>;
+};
+ 
+&cpu2 {
+	operating-points-v2 = <&cpu_opp_table>;
+};
+ 
+&cpu3 {
+	operating-points-v2 = <&cpu_opp_table>;
+};
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -104,6 +104,8 @@ static const struct of_device_id allowli
+  */
+ static const struct of_device_id blocklist[] __initconst = {
+ 	{ .compatible = "allwinner,sun50i-h6", },
+	{ .compatible = "allwinner,sun50i-h616", },
+	{ .compatible = "allwinner,sun50i-h618", },
+ 
+ 	{ .compatible = "apple,arm-platform", },
+ 
+--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c
+++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c
+@@ -6,6 +6,9 @@
+  * provide the OPP framework with required information.
+  *
+  * Copyright (C) 2019 Yangtao Li <tiny.windzz@gmail.com>
+ *
+ * ADD efuse_xlate to extract SoC version so that h6 and h616 can coexist.
+ * Version 1 AGM1968 <AGM1968@users.noreply.github.com>
+  */
+ 
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+@@ -20,25 +23,62 @@
+ 
+ #define MAX_NAME_LEN	7
+ 
+-#define NVMEM_MASK	0x7
+-#define NVMEM_SHIFT	5
+#define SUN50I_H616_NVMEM_MASK 0x22
+#define SUN50I_H616_NVMEM_SHIFT 5
+#define SUN50I_H6_NVMEM_MASK 0x7
+#define SUN50I_H6_NVMEM_SHIFT 5
+
+struct sunxi_cpufreq_soc_data {
+	u32 (*efuse_xlate) (void *efuse);
+};
+ 
+ static struct platform_device *cpufreq_dt_pdev, *sun50i_cpufreq_pdev;
+ 
+static u32 sun50i_h616_efuse_xlate(void *efuse)
+{
+   u32 efuse_value = (*(u32 *)efuse >> SUN50I_H616_NVMEM_SHIFT) &
+             SUN50I_H616_NVMEM_MASK;
+
+   /* Tested as V1 h616 soc. Expected efuse values are 1 - 3,
+      slowest to fastest */
+   if (efuse_value >=1 && efuse_value <= 3)
+       return efuse_value - 1;
+   else
+       return 0;
+};
+
+static u32 sun50i_h6_efuse_xlate(void *efuse)
+{
+   u32 efuse_value = (*(u32 *)efuse >> SUN50I_H6_NVMEM_SHIFT) &
+             SUN50I_H6_NVMEM_MASK;
+
+   /*
+    * We treat unexpected efuse values as if the SoC was from
+    * the slowest bin. Expected efuse values are 1 - 3, slowest
+    * to fastest.
+   */
+   if (efuse_value >= 1 && efuse_value <= 3)
+       return efuse_value - 1;
+   else
+       return 0;
+};
+
+
+ /**
+  * sun50i_cpufreq_get_efuse() - Determine speed grade from efuse value
+ * @soc_data: pointer to sunxi_cpufreq_soc_data context
+  * @versions: Set to the value parsed from efuse
+  *
+  * Returns 0 if success.
+  */
+-static int sun50i_cpufreq_get_efuse(u32 *versions)
+static int sun50i_cpufreq_get_efuse(const struct sunxi_cpufreq_soc_data *soc_data,
+		u32 *versions)
+ {
+ 	struct nvmem_cell *speedbin_nvmem;
+ 	struct device_node *np;
+ 	struct device *cpu_dev;
+-	u32 *speedbin, efuse_value;
+	u32 *speedbin;
+ 	size_t len;
+-	int ret;
+ 
+ 	cpu_dev = get_cpu_device(0);
+ 	if (!cpu_dev)
+@@ -47,10 +87,9 @@ static int sun50i_cpufreq_get_efuse(u32
+ 	np = dev_pm_opp_of_get_opp_desc_node(cpu_dev);
+ 	if (!np)
+ 		return -ENOENT;
+-
+-	ret = of_device_is_compatible(np,
+-				      "allwinner,sun50i-h6-operating-points");
+-	if (!ret) {
+	if (of_device_is_compatible(np, "allwinner,sun50i-h6-operating-points")) {}
+	else if (of_device_is_compatible(np, "allwinner,sun50i-h616-operating-points")) {}
+	else {
+ 		of_node_put(np);
+ 		return -ENOENT;
+ 	}
+@@ -66,17 +105,7 @@ static int sun50i_cpufreq_get_efuse(u32
+ 	if (IS_ERR(speedbin))
+ 		return PTR_ERR(speedbin);
+ 
+-	efuse_value = (*speedbin >> NVMEM_SHIFT) & NVMEM_MASK;
+-
+-	/*
+-	 * We treat unexpected efuse values as if the SoC was from
+-	 * the slowest bin. Expected efuse values are 1-3, slowest
+-	 * to fastest.
+-	 */
+-	if (efuse_value >= 1 && efuse_value <= 3)
+-		*versions = efuse_value - 1;
+-	else
+-		*versions = 0;
+	*versions = soc_data->efuse_xlate(speedbin);
+ 
+ 	kfree(speedbin);
+ 	return 0;
+@@ -84,18 +113,23 @@ static int sun50i_cpufreq_get_efuse(u32
+ 
+ static int sun50i_cpufreq_nvmem_probe(struct platform_device *pdev)
+ {
+	const struct of_device_id *match;
+ 	int *opp_tokens;
+ 	char name[MAX_NAME_LEN];
+ 	unsigned int cpu;
+ 	u32 speed = 0;
+ 	int ret;
+ 
+	match = dev_get_platdata(&pdev->dev);
+	if (!match)
+		return -EINVAL;
+
+ 	opp_tokens = kcalloc(num_possible_cpus(), sizeof(*opp_tokens),
+ 			     GFP_KERNEL);
+ 	if (!opp_tokens)
+ 		return -ENOMEM;
+ 
+-	ret = sun50i_cpufreq_get_efuse(&speed);
+	ret = sun50i_cpufreq_get_efuse(match-> data, &speed);
+ 	if (ret) {
+ 		kfree(opp_tokens);
+ 		return ret;
+@@ -158,8 +192,18 @@ static struct platform_driver sun50i_cpu
+ 	},
+ };
+ 
+static const struct sunxi_cpufreq_soc_data sun50i_h616_data = {
+    .efuse_xlate = sun50i_h616_efuse_xlate,
+};
+
+static const struct sunxi_cpufreq_soc_data sun50i_h6_data = {
+    .efuse_xlate = sun50i_h6_efuse_xlate,
+};
+
+ static const struct of_device_id sun50i_cpufreq_match_list[] = {
+-	{ .compatible = "allwinner,sun50i-h6" },
+	{ .compatible = "allwinner,sun50i-h6", .data = &sun50i_h6_data },
+	{ .compatible = "allwinner,sun50i-h616", .data = &sun50i_h616_data },
+	{ .compatible = "allwinner,sun50i-h618", .data = &sun50i_h616_data },
+ 	{}
+ };
+ MODULE_DEVICE_TABLE(of, sun50i_cpufreq_match_list);
+@@ -195,8 +239,8 @@ static int __init sun50i_cpufreq_init(vo
+ 		return ret;
+ 
+ 	sun50i_cpufreq_pdev =
+-		platform_device_register_simple("sun50i-cpufreq-nvmem",
+-						-1, NULL, 0);
+		platform_device_register_data(NULL,
+		"sun50i-cpufreq-nvmem", -1, match, sizeof(*match));
+ 	ret = PTR_ERR_OR_ZERO(sun50i_cpufreq_pdev);
+ 	if (ret == 0)
+ 		return 0;
--- a/lede/target/linux/sunxi/patches-6.6/502-arm64-dts-allwinner-h616-Add-cpufreq.patch
+++ b/lede/target/linux/sunxi/patches-6.6/502-arm64-dts-allwinner-h616-Add-cpufreq.patch
@@ -0,0 +1,53 @@
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h616.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h616.dtsi
+@@ -143,6 +143,10 @@
+ 			ths_calibration: thermal-sensor-calibration@14 {
+ 				reg = <0x14 0x8>;
+ 			};
+
+			cpu_speed_grade: cpu_speed_grade@0 {
+				reg = <0x0 0x2>;
+			};
+ 		};
+ 
+ 		watchdog: watchdog@30090a0 {
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts
+@@ -6,12 +6,17 @@
+ /dts-v1/;
+ 
+ #include "sun50i-h616-orangepi-zero.dtsi"
+#include "sun50i-h616-cpu-opp.dtsi"
+ 
+ / {
+ 	model = "OrangePi Zero2";
+ 	compatible = "xunlong,orangepi-zero2", "allwinner,sun50i-h616";
+ };
+ 
+&cpu0 {
+	cpu-supply = <&reg_dcdca>;
+};
+
+ &emac0 {
+ 	allwinner,rx-delay-ps = <3100>;
+ 	allwinner,tx-delay-ps = <700>;
+--- a/arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts
+@@ -6,12 +6,17 @@
+ /dts-v1/;
+ 
+ #include "sun50i-h616-orangepi-zero.dtsi"
+#include "sun50i-h616-cpu-opp.dtsi"
+ 
+ / {
+ 	model = "OrangePi Zero3";
+ 	compatible = "xunlong,orangepi-zero3", "allwinner,sun50i-h618";
+ };
+ 
+&cpu0 {
+	cpu-supply = <&reg_dcdc2>;
+};
+
+ &emac0 {
+ 	allwinner,tx-delay-ps = <700>;
+ 	phy-mode = "rgmii-rxid";
--- a/mihomo/hub/updater/updater.go
+++ b/mihomo/hub/updater/updater.go
@@ -16,7 +16,6 @@ import (
 	"time"

 	mihomoHttp "github.com/metacubex/mihomo/component/http"
-	"github.com/metacubex/mihomo/constant"
 	C "github.com/metacubex/mihomo/constant"
 	"github.com/metacubex/mihomo/log"

@@ -52,6 +51,10 @@ func init() {
 	if runtime.GOARCH == "amd64" && cpuid.CPU.X64Level() < 3 {
 		amd64Compatible = "-compatible"
 	}
+	if !strings.HasPrefix(C.Version, "alpha") {
+		baseURL = "https://github.com/MetaCubeX/mihomo/releases/latest/download/mihomo"
+		versionURL = "https://github.com/MetaCubeX/mihomo/releases/latest/download/version.txt"
+	}
 }

 type updateError struct {
@@ -73,9 +76,9 @@ func Update(execPath string) (err error) {
 		return err
 	}

-	log.Infoln("current version %s, latest version %s", constant.Version, latestVersion)
+	log.Infoln("current version %s, latest version %s", C.Version, latestVersion)

-	if latestVersion == constant.Version {
+	if latestVersion == C.Version {
 		err := &updateError{Message: "already using latest version"}
 		return err
 	}
--- a/openwrt-packages/filebrowser/Makefile
+++ b/openwrt-packages/filebrowser/Makefile
@@ -5,12 +5,12 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=filebrowser
-PKG_VERSION:=2.28.0
+PKG_VERSION:=2.29.0
 PKG_RELEASE:=1

 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://codeload.github.com/filebrowser/filebrowser/tar.gz/v${PKG_VERSION}?
-PKG_HASH:=5e8c5b57783976f454ee7f23df9c36b9566648b7b443287a7f2089771628695d
+PKG_HASH:=399b01a89f22310f2eb9892ec83d798b9af8e94e43c14baf3ae8803c608aaf1b

 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
--- a/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua
+++ b/openwrt-passwall/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua
@@ -175,7 +175,7 @@ if has_xray then
 	o.default = "10-20"
 	o:depends("fragment", true)

-	o = s_xray:option(Flag, "sniffing", translate("Sniffing"), translate("When using the shunt, must be enabled, otherwise the shunt will invalid."))
+	o = s_xray:option(Flag, "sniffing", translate("Sniffing"), translate("When using the shunt, this option will be forced to be enabled."))
 	o.default = 1
 	o.rmempty = false

--- a/openwrt-passwall/luci-app-passwall/luasrc/passwall/util_xray.lua
+++ b/openwrt-passwall/luci-app-passwall/luasrc/passwall/util_xray.lua
@@ -616,10 +616,10 @@ function gen_config(var)
 				settings = {network = "tcp,udp", followRedirect = true},
 				streamSettings = {sockopt = {tproxy = "tproxy"}},
 				sniffing = {
-					enabled = xray_settings.sniffing == "1" and true or false,
+					enabled = xray_settings.sniffing == "1" or node.protocol == "_shunt",
 					destOverride = {"http", "tls", "quic"},
 					metadataOnly = false,
-					routeOnly = (xray_settings.sniffing == "1" and xray_settings.route_only == "1") and true or nil,
+					routeOnly = (xray_settings.sniffing == "1" and xray_settings.route_only == "1") or (xray_settings.sniffing == "0" and node.protocol == "_shunt"),
 					domainsExcluded = (xray_settings.sniffing == "1" and xray_settings.route_only == "0") and get_domain_excluded() or nil
 				}
 			}
--- a/openwrt-passwall/luci-app-passwall/po/zh-cn/passwall.po
+++ b/openwrt-passwall/luci-app-passwall/po/zh-cn/passwall.po
@@ -691,11 +691,11 @@ msgstr "劫持ICMPv6 (IPv6 PING)"
 msgid "Sniffing"
 msgstr "流量嗅探"

-msgid "When using the shunt, must be enabled, otherwise the shunt will invalid."
-msgstr "使用分流时，必须启用，否则分流将无效。"
+msgid "When using the shunt, this option will be forced to be enabled."
+msgstr "使用分流时，将强制启用此选项。"

 msgid "Sniffing Route Only"
-msgstr "流量嗅探只供路由使用"
+msgstr "流量嗅探仅供路由使用"

 msgid "TCP Proxy Way"
 msgstr "TCP 代理方式"
--- a/shadowsocks-rust/Cargo.lock
+++ b/shadowsocks-rust/Cargo.lock
@@ -389,9 +389,9 @@ dependencies = [

 [[package]]
 name = "cc"
-version = "1.0.95"
+version = "1.0.96"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d32a725bc159af97c3e629873bb9f88fb8cf8a4867175f76dc987815ea07c83b"
+checksum = "065a29261d53ba54260972629f9ca6bffa69bac13cd1fed61420f7fa68b9f8bd"
 dependencies = [
 "jobserver",
 "libc",
@@ -645,9 +645,9 @@ dependencies = [

 [[package]]
 name = "data-encoding"
-version = "2.5.0"
+version = "2.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e962a19be5cfc3f3bf6dd8f61eb50107f356ad6270fbb3ed41476571db78be5"
+checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"

 [[package]]
 name = "defmt"
@@ -880,9 +880,9 @@ dependencies = [

 [[package]]
 name = "fastrand"
-version = "2.0.2"
+version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "658bd65b1cf4c852a3cc96f18a8ce7b5640f6b703f905c7d74532294c2a63984"
+checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"

 [[package]]
 name = "ff"
@@ -1199,9 +1199,9 @@ dependencies = [

 [[package]]
 name = "hashbrown"
-version = "0.14.3"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "290f1a1d9242c78d09ce40a5e87e7554ee637af1351968159f4952f028f75604"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"

 [[package]]
 name = "heapless"
@@ -1693,9 +1693,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"

 [[package]]
 name = "libc"
-version = "0.2.153"
+version = "0.2.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c198f91728a82281a64e1f4f9eeb25d82cb32a5de251c6bd1b5154d63a8e7bd"
+checksum = "ae743338b92ff9146ce83992f766a31066a91a8c84a45e0e9f21e7cf6de6d346"

 [[package]]
 name = "libloading"
@@ -2976,9 +2976,9 @@ dependencies = [

 [[package]]
 name = "serde"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9846a40c979031340571da2545a4e5b7c4163bdae79b301d5f86d03979451fcc"
+checksum = "0c9f6e76df036c77cd94996771fb40db98187f096dd0b9af39c6c6e452ba966a"
 dependencies = [
 "serde_derive",
 ]
@@ -2995,9 +2995,9 @@ dependencies = [

 [[package]]
 name = "serde_derive"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e88edab869b01783ba905e7d0153f9fc1a6505a96e4ad3018011eedb838566d9"
+checksum = "11bd257a6541e141e42ca6d24ae26f7714887b47e89aa739099104c7e4d3b7fc"
 dependencies = [
 "proc-macro2",
 "quote",
@@ -3459,7 +3459,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
 dependencies = [
 "cfg-if",
- "fastrand 2.0.2",
+ "fastrand 2.1.0",
 "rustix",
 "windows-sys 0.52.0",
 ]
--- a/shadowsocks-rust/Cross.toml
+++ b/shadowsocks-rust/Cross.toml
@@ -5,5 +5,5 @@ passthrough = ["RUSTFLAGS"]
 pre-build = [
    # Install NVIM for rustls, which deps on aws-lc-rs by default, and it needs NASM
    "apt-get update",
-    "apt-get install --assume-yes nasm",
+    "apt-get install --assume-yes nasm clang",
 ]
--- a/shadowsocks-rust/crates/shadowsocks-service/src/config.rs
+++ b/shadowsocks-rust/crates/shadowsocks-service/src/config.rs
@@ -1450,7 +1450,7 @@ impl Config {
        //
        // local_address is allowed to be NULL, which means to bind to ::1 or 127.0.0.1
        //
-        // https://shadowsocks.org/doc/configs.html
+        // https://shadowsocks.org/en/config/quick-guide.html
        #[inline]
        fn get_local_address(local_address: Option<String>, local_port: u16, ipv6_first: bool) -> ServerAddr {
            match local_address {
--- a/shadowsocks-rust/crates/shadowsocks-service/src/local/dns/upstream.rs
+++ b/shadowsocks-rust/crates/shadowsocks-service/src/local/dns/upstream.rs
@@ -16,13 +16,18 @@ use hickory_resolver::proto::{
    error::{ProtoError, ProtoErrorKind},
    op::Message,
 };
-use log::trace;
+use log::{error, trace};
+use lru_time_cache::{Entry, LruCache};
 use rand::{thread_rng, Rng};
 use shadowsocks::{
    config::ServerConfig,
    context::SharedContext,
    net::{ConnectOpts, TcpStream as ShadowTcpStream, UdpSocket as ShadowUdpSocket},
-    relay::{tcprelay::ProxyClientStream, udprelay::ProxySocket, Address},
+    relay::{
+        tcprelay::ProxyClientStream,
+        udprelay::{options::UdpSocketControlData, ProxySocket},
+        Address,
+    },
 };
 #[cfg(unix)]
 use tokio::net::UnixStream;
@@ -32,7 +37,11 @@ use tokio::{
    time,
 };

-use crate::net::{FlowStat, MonProxySocket, MonProxyStream};
+use crate::{
+    local::net::udp::generate_client_session_id,
+    net::{packet_window::PacketWindowFilter, FlowStat, MonProxySocket, MonProxyStream},
+    DEFAULT_UDP_EXPIRY_DURATION,
+};

 /// Collection of various DNS connections
 #[allow(clippy::large_enum_variant)]
@@ -54,6 +63,8 @@ pub enum DnsClient {
    UdpRemote {
        socket: MonProxySocket,
        ns: Address,
+        control: UdpSocketControlData,
+        server_windows: LruCache<u64, PacketWindowFilter>,
    },
 }

@@ -100,9 +111,18 @@ impl DnsClient {
        connect_opts: &ConnectOpts,
        flow_stat: Arc<FlowStat>,
    ) -> io::Result<DnsClient> {
-        let socket = ProxySocket::connect_with_opts(context, svr_cfg, connect_opts).await?;
-        let socket = MonProxySocket::from_socket(socket, flow_stat);
-        Ok(DnsClient::UdpRemote { socket, ns })
+        let socket = ProxySocket::connect_with_opts(context.clone(), svr_cfg, connect_opts).await?;
+        let socket = MonProxySocket::from_socket(socket, flow_stat.clone());
+        let mut control = UdpSocketControlData::default();
+        control.client_session_id = generate_client_session_id();
+        control.packet_id = 0; // AEAD-2022 Packet ID starts from 1
+        Ok(DnsClient::UdpRemote {
+            socket,
+            ns,
+            control,
+            // NOTE: expiry duration should be configurable. But the Client is held by DnsClientCache, which expires very quickly.
+            server_windows: LruCache::with_expiry_duration(DEFAULT_UDP_EXPIRY_DURATION),
+        })
    }

    /// Make a DNS lookup
@@ -140,12 +160,38 @@ impl DnsClient {
            #[cfg(unix)]
            DnsClient::UnixStream { ref mut stream } => stream_query(stream, msg).await,
            DnsClient::TcpRemote { ref mut stream } => stream_query(stream, msg).await,
-            DnsClient::UdpRemote { ref mut socket, ref ns } => {
+            DnsClient::UdpRemote {
+                ref mut socket,
+                ref ns,
+                ref mut control,
+                ref mut server_windows,
+            } => {
+                control.packet_id = match control.packet_id.checked_add(1) {
+                    Some(i) => i,
+                    None => return Err(ProtoErrorKind::Message("packet id overflows").into()),
+                };
+
                let bytes = msg.to_vec()?;
-                socket.send(ns, &bytes).await?;
+                socket.send_with_ctrl(ns, control, &bytes).await?;

                let mut recv_buf = [0u8; 256];
-                let (n, _) = socket.recv(&mut recv_buf).await?;
+                let (n, _, recv_control) = socket.recv_with_ctrl(&mut recv_buf).await?;
+
+                if let Some(server_control) = recv_control {
+                    let filter = match server_windows.entry(server_control.server_session_id) {
+                        Entry::Occupied(occ) => occ.into_mut(),
+                        Entry::Vacant(vac) => vac.insert(PacketWindowFilter::new()),
+                    };
+
+                    if !filter.validate_packet_id(server_control.packet_id, u64::MAX) {
+                        error!(
+                            "dns client for {} packet_id {} out of window",
+                            ns, server_control.packet_id
+                        );
+
+                        return Err(ProtoErrorKind::Message("packet id out of window").into());
+                    }
+                }

                Message::from_vec(&recv_buf[..n])
            }
--- a/shadowsocks-rust/crates/shadowsocks-service/src/local/net/udp/association.rs
+++ b/shadowsocks-rust/crates/shadowsocks-service/src/local/net/udp/association.rs
@@ -243,8 +243,9 @@ thread_local! {
    static CLIENT_SESSION_RNG: RefCell<SmallRng> = RefCell::new(SmallRng::from_entropy());
 }

+/// Generate an AEAD-2022 Client SessionID
 #[inline]
-fn generate_client_session_id() -> u64 {
+pub fn generate_client_session_id() -> u64 {
    CLIENT_SESSION_RNG.with(|rng| rng.borrow_mut().gen())
 }

--- a/shadowsocks-rust/crates/shadowsocks-service/src/local/net/udp/mod.rs
+++ b/shadowsocks-rust/crates/shadowsocks-service/src/local/net/udp/mod.rs
@@ -1,4 +1,5 @@
-pub use self::association::{UdpAssociationManager, UdpInboundWrite};
+#[allow(unused_imports)]
+pub use self::association::{generate_client_session_id, UdpAssociationManager, UdpInboundWrite};

 pub mod association;
 pub mod listener;
--- a/shadowsocks-rust/crates/shadowsocks/src/relay/tcprelay/aead.rs
+++ b/shadowsocks-rust/crates/shadowsocks/src/relay/tcprelay/aead.rs
@@ -1,6 +1,6 @@
 //! AEAD packet I/O facilities
 //!
-//! AEAD protocol is defined in <https://shadowsocks.org/doc/aead.html>.
+//! AEAD protocol is defined in <https://shadowsocks.org/en/spec/AEAD.html>.
 //!
 //! ```plain
 //! TCP request (before encryption)
@@ -305,7 +305,7 @@ impl DecryptedReader {
        };

        if plen > MAX_PACKET_SIZE {
-            // https://shadowsocks.org/doc/aead.html
+            // https://shadowsocks.org/en/spec/AEAD-Ciphers.html
            //
            // AEAD TCP protocol have reserved the higher two bits for future use
            return Err(ProtocolError::DataTooLong(plen));
--- a/shadowsocks-rust/src/service/local.rs
+++ b/shadowsocks-rust/src/service/local.rs
@@ -174,7 +174,7 @@ pub fn define_command_line_options(mut app: Command) -> Command {
            .action(ArgAction::Set)
            .value_hint(ValueHint::CommandName)
            .requires("SERVER_ADDR")
-            .help("SIP003 (https://shadowsocks.org/doc/sip003.html) plugin"),
+            .help("SIP003 (https://shadowsocks.org/guide/sip003.html) plugin"),
    )
    .arg(
        Arg::new("PLUGIN_MODE")
@@ -199,7 +199,7 @@ pub fn define_command_line_options(mut app: Command) -> Command {
            .action(ArgAction::Set)
            .value_hint(ValueHint::Url)
            .value_parser(vparser::parse_server_url)
-            .help("Server address in SIP002 (https://shadowsocks.org/doc/sip002.html) URL"),
+            .help("Server address in SIP002 (https://shadowsocks.org/guide/sip002.html) URL"),
    )
    .group(ArgGroup::new("SERVER_CONFIG")
        .arg("SERVER_ADDR").arg("SERVER_URL").multiple(true))
@@ -631,8 +631,12 @@ pub fn create(matches: &ArgMatches) -> Result<(Runtime, impl Future<Output = Exi
                    plugin: p,
                    plugin_opts: matches.get_one::<String>("PLUGIN_OPT").cloned(),
                    plugin_args: Vec::new(),
-                    plugin_mode: matches.get_one::<String>("PLUGIN_MODE")
-                        .map(|x| x.parse::<Mode>().expect("plugin-mode must be one of `tcp_only` (default), `udp_only` and `tcp_and_udp`"))
+                    plugin_mode: matches
+                        .get_one::<String>("PLUGIN_MODE")
+                        .map(|x| {
+                            x.parse::<Mode>()
+                                .expect("plugin-mode must be one of `tcp_only` (default), `udp_only` and `tcp_and_udp`")
+                        })
                        .unwrap_or(Mode::TcpOnly),
                };

--- a/shadowsocks-rust/src/service/manager.rs
+++ b/shadowsocks-rust/src/service/manager.rs
@@ -93,7 +93,7 @@ pub fn define_command_line_options(mut app: Command) -> Command {
                .num_args(1)
                .action(ArgAction::Set)
                .value_hint(ValueHint::CommandName)
-                .help("Default SIP003 (https://shadowsocks.org/doc/sip003.html) plugin"),
+                .help("Default SIP003 (https://shadowsocks.org/guide/sip003.html) plugin"),
        )
        .arg(
            Arg::new("PLUGIN_MODE")
@@ -385,8 +385,12 @@ pub fn create(matches: &ArgMatches) -> Result<(Runtime, impl Future<Output = Exi
                    plugin: p,
                    plugin_opts: matches.get_one::<String>("PLUGIN_OPT").cloned(),
                    plugin_args: Vec::new(),
-                    plugin_mode: matches.get_one::<String>("PLUGIN_MODE")
-                        .map(|x| x.parse::<Mode>().expect("plugin-mode must be one of `tcp_only` (default), `udp_only` and `tcp_and_udp`"))
+                    plugin_mode: matches
+                        .get_one::<String>("PLUGIN_MODE")
+                        .map(|x| {
+                            x.parse::<Mode>()
+                                .expect("plugin-mode must be one of `tcp_only` (default), `udp_only` and `tcp_and_udp`")
+                        })
                        .unwrap_or(Mode::TcpOnly),
                });
            }
--- a/shadowsocks-rust/src/service/server.rs
+++ b/shadowsocks-rust/src/service/server.rs
@@ -121,7 +121,7 @@ pub fn define_command_line_options(mut app: Command) -> Command {
                .action(ArgAction::Set)
                .value_hint(ValueHint::CommandName)
                .requires("SERVER_ADDR")
-                .help("SIP003 (https://shadowsocks.org/doc/sip003.html) plugin"),
+                .help("SIP003 (https://shadowsocks.org/guide/sip003.html) plugin"),
        )
        .arg(
            Arg::new("PLUGIN_MODE")
@@ -366,8 +366,12 @@ pub fn create(matches: &ArgMatches) -> Result<(Runtime, impl Future<Output = Exi
                    plugin: p,
                    plugin_opts: matches.get_one::<String>("PLUGIN_OPT").cloned(),
                    plugin_args: Vec::new(),
-                    plugin_mode: matches.get_one::<String>("PLUGIN_MODE")
-                        .map(|x| x.parse::<Mode>().expect("plugin-mode must be one of `tcp_only` (default), `udp_only` and `tcp_and_udp`"))
+                    plugin_mode: matches
+                        .get_one::<String>("PLUGIN_MODE")
+                        .map(|x| {
+                            x.parse::<Mode>()
+                                .expect("plugin-mode must be one of `tcp_only` (default), `udp_only` and `tcp_and_udp`")
+                        })
                        .unwrap_or(Mode::TcpOnly),
                };

@@ -490,7 +494,7 @@ pub fn create(matches: &ArgMatches) -> Result<(Runtime, impl Future<Output = Exi
            eprintln!(
                "missing proxy servers, consider specifying it by \
                    --server-addr, --encrypt-method, --password command line option, \
-                        or configuration file, check more details in https://shadowsocks.org/doc/configs.html"
+                        or configuration file, check more details in https://shadowsocks.org/guide/configs.html"
            );
            return Err(crate::EXIT_CODE_INSUFFICIENT_PARAMS.into());
        }
--- a/shadowsocks-rust/src/vparser/mod.rs
+++ b/shadowsocks-rust/src/vparser/mod.rs
@@ -52,7 +52,7 @@ value_parser_type!(parse_cipher_kind, CipherKind, "invalid cipher");
 pub fn parse_server_url(v: &str) -> Result<ServerConfig, String> {
    match ServerConfig::from_url(v) {
        Ok(t) => Ok(t),
-        Err(..) => Err("should be SIP002 (https://shadowsocks.org/doc/sip002.html) format".to_owned()),
+        Err(..) => Err("should be SIP002 (https://shadowsocks.org/guide/sip002.html) format".to_owned()),
    }
 }

--- a/small/chinadns-ng/Makefile
+++ b/small/chinadns-ng/Makefile
@@ -3,33 +3,33 @@
 include $(TOPDIR)/rules.mk

 PKG_NAME:=chinadns-ng
-PKG_VERSION:=2024.04.27
+PKG_VERSION:=2024.04.30
 PKG_RELEASE:=1

 ifeq ($(ARCH),aarch64)
  PKG_ARCH:=chinadns-ng@aarch64-linux-musl@generic+v8a@fast+lto
-  PKG_HASH:=61eb8132c640bea1879d239169ed55cef79606f273ee46bbf1fd13872d1c8fca
+  PKG_HASH:=4d9c7efd782bd77f215b371faa272e3a503412e0a934ef70bdbd4058f5e0c96f
 else ifeq ($(ARCH),arm)
  ARM_CPU_FEATURES:=$(word 2,$(subst +,$(space),$(call qstrip,$(CONFIG_CPU_TYPE))))
  ifeq ($(ARM_CPU_FEATURES),)
    PKG_ARCH:=chinadns-ng@arm-linux-musleabi@generic+v6+soft_float@fast+lto
-    PKG_HASH:=05c5abfed04c0236bef25742f6753f800a5e14d9743ce18a506f6d205ca848d6
+    PKG_HASH:=02ab8efb0522bc7ee2bf5e9ef0d8011a2916843ad192b473d7c2d7900fb6c498
  else
    PKG_ARCH:=chinadns-ng@arm-linux-musleabihf@generic+v7a@fast+lto
-    PKG_HASH:=489f2ac213391edd169233abeddec3efb1d2a763665db6fc51bddb2ecc553fd4
+    PKG_HASH:=9bff2c01dd0a212a55f5c5a0e048c131a2f1515f7f9140b090f36c723be90aaf
  endif
 else ifeq ($(ARCH),mips)
  PKG_ARCH:=chinadns-ng@mips-linux-musl@mips32+soft_float@fast+lto
-  PKG_HASH:=7d30ffe8496353c9dabda5ff13b53953a10545418c0977b9d6929771a08e3769
+  PKG_HASH:=2c88fa6ba8412b4cd4c344a47d4bfbf6c11855163937308e5d9b8137fe9a2491
 else ifeq ($(ARCH),mipsel)
  PKG_ARCH:=chinadns-ng@mipsel-linux-musl@mips32+soft_float@fast+lto
-  PKG_HASH:=067c04e1aaf1772c9857290a42b47f6ad285dacac281cc48a711c6d804b68d5d
+  PKG_HASH:=db32bf9c40a532bff26822fdf41ebf55ababd2dc58da687f221230999e47bc10
 else ifeq ($(ARCH),i386)
  PKG_ARCH:=chinadns-ng@i386-linux-musl@i686@fast+lto
-  PKG_HASH:=76b03582a5d9618ca95e7dcc712433683f0f74cfa9aba50aaeb2ac6316ef8721
+  PKG_HASH:=46650b1a509b5c8369f5eecaefe09fa8bde78fa339a17258669f73498d63a557
 else ifeq ($(ARCH),x86_64)
  PKG_ARCH:=chinadns-ng@x86_64-linux-musl@x86_64@fast+lto
-  PKG_HASH:=36792a45c39304eca69e1cd5bb38c985c836e54b8672ab8cefe06a915b05f5c9
+  PKG_HASH:=611ccb0f3391798f2289362f4026e2e446f939309f0de6f2689e1551793d8274
 else
  PKG_HASH:=dummy
 endif
--- a/small/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua
+++ b/small/luci-app-passwall/luasrc/model/cbi/passwall/client/other.lua
@@ -175,7 +175,7 @@ if has_xray then
 	o.default = "10-20"
 	o:depends("fragment", true)

-	o = s_xray:option(Flag, "sniffing", translate("Sniffing"), translate("When using the shunt, must be enabled, otherwise the shunt will invalid."))
+	o = s_xray:option(Flag, "sniffing", translate("Sniffing"), translate("When using the shunt, this option will be forced to be enabled."))
 	o.default = 1
 	o.rmempty = false

--- a/small/luci-app-passwall/luasrc/passwall/util_xray.lua
+++ b/small/luci-app-passwall/luasrc/passwall/util_xray.lua
@@ -616,10 +616,10 @@ function gen_config(var)
 				settings = {network = "tcp,udp", followRedirect = true},
 				streamSettings = {sockopt = {tproxy = "tproxy"}},
 				sniffing = {
-					enabled = xray_settings.sniffing == "1" and true or false,
+					enabled = xray_settings.sniffing == "1" or node.protocol == "_shunt",
 					destOverride = {"http", "tls", "quic"},
 					metadataOnly = false,
-					routeOnly = (xray_settings.sniffing == "1" and xray_settings.route_only == "1") and true or nil,
+					routeOnly = (xray_settings.sniffing == "1" and xray_settings.route_only == "1") or (xray_settings.sniffing == "0" and node.protocol == "_shunt"),
 					domainsExcluded = (xray_settings.sniffing == "1" and xray_settings.route_only == "0") and get_domain_excluded() or nil
 				}
 			}
--- a/small/luci-app-passwall/po/zh-cn/passwall.po
+++ b/small/luci-app-passwall/po/zh-cn/passwall.po
@@ -691,11 +691,11 @@ msgstr "劫持ICMPv6 (IPv6 PING)"
 msgid "Sniffing"
 msgstr "流量嗅探"

-msgid "When using the shunt, must be enabled, otherwise the shunt will invalid."
-msgstr "使用分流时，必须启用，否则分流将无效。"
+msgid "When using the shunt, this option will be forced to be enabled."
+msgstr "使用分流时，将强制启用此选项。"

 msgid "Sniffing Route Only"
-msgstr "流量嗅探只供路由使用"
+msgstr "流量嗅探仅供路由使用"

 msgid "TCP Proxy Way"
 msgstr "TCP 代理方式"
--- a/v2ray-core/go.mod
+++ b/v2ray-core/go.mod
@@ -41,7 +41,7 @@ require (
 	gopkg.in/yaml.v3 v3.0.1
 	gvisor.dev/gvisor v0.0.0-20231020174304-b8a429915ff1
 	h12.io/socks v1.0.3
-	lukechampine.com/blake3 v1.2.1
+	lukechampine.com/blake3 v1.2.2
 )

 require (
--- a/v2ray-core/go.sum
+++ b/v2ray-core/go.sum
@@ -586,6 +586,6 @@ honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-lukechampine.com/blake3 v1.2.1 h1:YuqqRuaqsGV71BV/nm9xlI0MKUv4QC54jQnBChWbGnI=
-lukechampine.com/blake3 v1.2.1/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
+lukechampine.com/blake3 v1.2.2 h1:wEAbSg0IVU4ih44CVlpMqMZMpzr5hf/6aqodLlevd/w=
+lukechampine.com/blake3 v1.2.2/go.mod h1:0OFRp7fBtAylGVCO40o87sbupkyIGgbpv1+M1k1LM6k=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
--- a/v2rayn/v2rayN/v2rayN/Handler/ProfileExHandler.cs
+++ b/v2rayn/v2rayN/v2rayN/Handler/ProfileExHandler.cs
@@ -7,7 +7,7 @@ namespace v2rayN.Handler
    internal class ProfileExHandler
    {
        private static readonly Lazy<ProfileExHandler> _instance = new(() => new());
-        private ConcurrentBag<ProfileExItem> _lstProfileEx;
+        private ConcurrentBag<ProfileExItem> _lstProfileEx = [];
        private Queue<string> _queIndexIds = new();
        public ConcurrentBag<ProfileExItem> ProfileExs => _lstProfileEx;
        public static ProfileExHandler Instance => _instance.Value;
@@ -15,6 +15,15 @@ namespace v2rayN.Handler
        public ProfileExHandler()
        {
            Init();
+
+            Task.Run(async () =>
+            {
+                while (true)
+                {
+                    SaveQueueIndexIds();
+                    await Task.Delay(1000 * 600);
+                }
+            });
        }

        private void Init()
@@ -22,24 +31,6 @@ namespace v2rayN.Handler
            SQLiteHelper.Instance.Execute($"delete from ProfileExItem where indexId not in ( select indexId from ProfileItem )");

            _lstProfileEx = new(SQLiteHelper.Instance.Table<ProfileExItem>());
-
-            Task.Run(async () =>
-            {
-                while (true)
-                {
-                    var cnt = _queIndexIds.Count;
-                    for (int i = 0; i < cnt; i++)
-                    {
-                        var id = _queIndexIds.Dequeue();
-                        var item = _lstProfileEx.FirstOrDefault(t => t.indexId == id);
-                        if (item is not null)
-                        {
-                            SQLiteHelper.Instance.Replace(item);
-                        }
-                    }
-                    await Task.Delay(1000 * 60);
-                }
-            });
        }

        private void IndexIdEnqueue(string indexId)
@@ -50,6 +41,49 @@ namespace v2rayN.Handler
            }
        }

+        private void SaveQueueIndexIds()
+        {
+            var cnt = _queIndexIds.Count;
+            if (cnt > 0)
+            {
+                var lstExists = SQLiteHelper.Instance.Table<ProfileExItem>();
+                List<ProfileExItem> lstInserts = [];
+                List<ProfileExItem> lstUpdates = [];
+
+                for (int i = 0; i < cnt; i++)
+                {
+                    var id = _queIndexIds.Dequeue();
+                    var item = lstExists.FirstOrDefault(t => t.indexId == id);
+                    var itemNew = _lstProfileEx?.FirstOrDefault(t => t.indexId == id);
+                    if (itemNew is null)
+                    {
+                        continue;
+                    }
+
+                    if (item is not null)
+                    {
+                        lstUpdates.Add(itemNew);
+                    }
+                    else
+                    {
+                        lstInserts.Add(itemNew);
+                    }
+                }
+                try
+                {
+                    if (lstInserts.Count() > 0)
+                        SQLiteHelper.Instance.InsertAll(lstInserts);
+
+                    if (lstUpdates.Count() > 0)
+                        SQLiteHelper.Instance.UpdateAll(lstUpdates);
+                }
+                catch (Exception ex)
+                {
+                    Logging.SaveLog("ProfileExHandler", ex);
+                }
+            }
+        }
+
        private void AddProfileEx(string indexId, ref ProfileExItem? profileEx)
        {
            profileEx = new()
@@ -73,11 +107,7 @@ namespace v2rayN.Handler
        {
            try
            {
-                //foreach (var item in _lstProfileEx)
-                //{
-                //    SQLiteHelper.Instance.Replace(item);
-                //}
-                SQLiteHelper.Instance.UpdateAll(_lstProfileEx);
+                SaveQueueIndexIds();
            }
            catch (Exception ex)
            {
--- a/yass/.circleci/config.yml
+++ b/yass/.circleci/config.yml
@@ -160,12 +160,14 @@ commands:
            # TODO remove this once upstream fix is available
            # msan fix is here https://github.com/llvm/llvm-project/pull/85142
            sudo sysctl -w vm.mmap_rnd_bits=28
-            ./build/yass_test -logtostderr -v 1 --gtest_shuffle --gtest_repeat=5 --gtest_throw_on_failure
+            ./build/yass_test -logtostderr -v 1 --gtest_shuffle --gtest_repeat=3 --gtest_throw_on_failure
+            ./build/yass_test -logtostderr -v 1 --gtest_shuffle --gtest_repeat=3 --gtest_throw_on_failure --enable_post_quantum_kyber
            # somehow inside the container DNS hosts file resolves localhost to 127.0.0.1 only not ::1
            # due to the incompleteness
            grep localhost /etc/hosts
            sudo sed -i s/ip6-localhost/localhost/g /etc/hosts
-            ./build/yass_test -logtostderr -v 1 --gtest_shuffle --gtest_repeat=5 --gtest_throw_on_failure --ipv6_mode
+            ./build/yass_test -logtostderr -v 1 --gtest_shuffle --gtest_repeat=3 --gtest_throw_on_failure --ipv6_mode
+            ./build/yass_test -logtostderr -v 1 --gtest_shuffle --gtest_repeat=3 --gtest_throw_on_failure --ipv6_mode --enable_post_quantum_kyber
            # alternative for ninja -C build run_tests
            ninja -C build check_boringssl

--- a/yass/src/cli/cli.cpp
+++ b/yass/src/cli/cli.cpp
@@ -69,7 +69,18 @@ int main(int argc, const char* argv[]) {
  }
 #endif

+#if BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_OHOS)
+  // Set C library locale to make sure CommandLine can parse
+  // argument values in the correct encoding and to make sure
+  // generated file names (think downloads) are in the file system's
+  // encoding.
  setlocale(LC_ALL, "");
+  // For numbers we never want the C library's locale sensitive
+  // conversion from number to string because the only thing it
+  // changes is the decimal separator which is not good enough for
+  // the UI and can be harmful elsewhere.
+  setlocale(LC_NUMERIC, "C");
+#endif

  // Major routine
  // - Read config from ss config file
@@ -195,8 +206,8 @@ int main(int argc, const char* argv[]) {
  };
  signals.async_wait(cb);

-#ifdef SIGPIPE
-  signal(SIGPIPE, SIG_IGN);
+#if BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_OHOS)
+  CHECK_NE(SIG_ERR, signal(SIGPIPE, SIG_IGN));
 #endif

  io_context.run();
--- a/yass/src/cli/cli_worker.cpp
+++ b/yass/src/cli/cli_worker.cpp
@@ -41,8 +41,8 @@ Worker::Worker()

  CRYPTO_library_init();

-#ifdef SIGPIPE
-  signal(SIGPIPE, SIG_IGN);
+#if BUILDFLAG(IS_POSIX) && !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_OHOS)
+  CHECK_NE(SIG_ERR, signal(SIGPIPE, SIG_IGN));
 #endif

  thread_ = std::make_unique<std::thread>([this] { WorkFunc(); });
--- a/yass/src/config/config_network.cpp
+++ b/yass/src/config/config_network.cpp
@@ -22,7 +22,6 @@ ABSL_FLAG(int32_t,
          7200,
          "The number of seconds a connection needs to be idle before TCP begins sending out keep-alive probes.");
 ABSL_FLAG(int32_t, tcp_keep_alive_interval, 75, "The number of seconds between TCP keep-alive probes.");
-ABSL_FLAG(bool, tls13_early_data, true, "Enable 0RTTI Early Data (risk at production)");
 ABSL_FLAG(bool, redir_mode, false, "Enable TCP Redir mode support (linux only)");

 ABSL_FLAG(std::string, doh_url, "", "Resolve host names over DoH");
--- a/yass/src/config/config_network.hpp
+++ b/yass/src/config/config_network.hpp
@@ -23,7 +23,6 @@ ABSL_DECLARE_FLAG(bool, tcp_keep_alive);
 ABSL_DECLARE_FLAG(int32_t, tcp_keep_alive_cnt);
 ABSL_DECLARE_FLAG(int32_t, tcp_keep_alive_idle_timeout);
 ABSL_DECLARE_FLAG(int32_t, tcp_keep_alive_interval);
-ABSL_DECLARE_FLAG(bool, tls13_early_data);
 ABSL_DECLARE_FLAG(bool, redir_mode);

 ABSL_DECLARE_FLAG(std::string, doh_url);
--- a/yass/src/config/config_tls.cpp
+++ b/yass/src/config/config_tls.cpp
@@ -24,6 +24,13 @@ ABSL_FLAG(std::string,
          "You can override it with YASS_CA_BUNDLE environment variable");
 ABSL_FLAG(std::string, capath, "", "Tells where to use the specified certificate directory to verify the peer.");

+ABSL_FLAG(bool, tls13_early_data, true, "Enable 0RTTI Early Data (risk at production)");
+ABSL_FLAG(bool,
+          enable_post_quantum_kyber,
+          false,
+          "Enable post-quantum secure TLS key encapsulation mechanism X25519Kyber768, based on a NIST standard "
+          "(ML-KEM) (Client only)");
+
 namespace config {
 bool ReadTLSConfigFile() {
  do {
--- a/yass/src/config/config_tls.hpp
+++ b/yass/src/config/config_tls.hpp
@@ -15,6 +15,8 @@ ABSL_DECLARE_FLAG(std::string, private_key_password);
 ABSL_DECLARE_FLAG(bool, insecure_mode);
 ABSL_DECLARE_FLAG(std::string, cacert);
 ABSL_DECLARE_FLAG(std::string, capath);
+ABSL_DECLARE_FLAG(bool, tls13_early_data);
+ABSL_DECLARE_FLAG(bool, enable_post_quantum_kyber);

 namespace config {
 bool ReadTLSConfigFile();
--- a/yass/src/gtk/yass.cpp
+++ b/yass/src/gtk/yass.cpp
@@ -43,7 +43,16 @@ int main(int argc, const char** argv) {
  size_t rpos = exec_path.rfind('/');
  if (rpos != std::string::npos)
    locale_path = exec_path.substr(0, rpos + 1) + locale_path;
+  // Set C library locale to make sure CommandLine can parse
+  // argument values in the correct encoding and to make sure
+  // generated file names (think downloads) are in the file system's
+  // encoding.
  setlocale(LC_ALL, "");
+  // For numbers we never want the C library's locale sensitive
+  // conversion from number to string because the only thing it
+  // changes is the decimal separator which is not good enough for
+  // the UI and can be harmful elsewhere.
+  setlocale(LC_NUMERIC, "C");
  bindtextdomain("yass", locale_path.c_str());
  textdomain("yass");

--- a/yass/src/gtk4/yass.cpp
+++ b/yass/src/gtk4/yass.cpp
@@ -89,14 +89,21 @@ int main(int argc, const char** argv) {
    return -1;
  }

-  setlocale(LC_ALL, "");
-
  constexpr std::string_view kDefaultLocalePath = "../share/locale";
  std::string locale_path = std::string(kDefaultLocalePath);
  size_t rpos = exec_path.rfind('/');
  if (rpos != std::string::npos)
    locale_path = exec_path.substr(0, rpos + 1) + locale_path;
+  // Set C library locale to make sure CommandLine can parse
+  // argument values in the correct encoding and to make sure
+  // generated file names (think downloads) are in the file system's
+  // encoding.
  setlocale(LC_ALL, "");
+  // For numbers we never want the C library's locale sensitive
+  // conversion from number to string because the only thing it
+  // changes is the decimal separator which is not good enough for
+  // the UI and can be harmful elsewhere.
+  setlocale(LC_NUMERIC, "C");
  bindtextdomain("yass", locale_path.c_str());
  textdomain("yass");

--- a/yass/src/mac/main.mm
+++ b/yass/src/mac/main.mm
@@ -43,7 +43,15 @@ int main(int argc, const char** argv) {
    return -1;
  }

+  // argument values in the correct encoding and to make sure
+  // generated file names (think downloads) are in the file system's
+  // encoding.
  setlocale(LC_ALL, "");
+  // For numbers we never want the C library's locale sensitive
+  // conversion from number to string because the only thing it
+  // changes is the decimal separator which is not good enough for
+  // the UI and can be harmful elsewhere.
+  setlocale(LC_NUMERIC, "C");

  absl::InitializeSymbolizer(exec_path.c_str());
 #ifdef HAVE_CRASHPAD
--- a/Show More
+++ b/Show More