Kernel: T8147: upgrade to 6.18

* Forwared port all out-of-tree driver patches
* Add Intel QAT patch to make it compile for LInux 6.18
* Remove out-of-tree OpenVPN DCO module - now available upstream

12 files changed, 263 insertions, 131 deletions

diff --git a/scripts/package-build/linux-kernel/build-intel-qat.sh b/scripts/package-build/linux-kernel/build-intel-qat.sh
index c2c364a9..e393a4bc 100755
--- a/scripts/package-build/linux-kernel/build-intel-qat.sh
+++ b/scripts/package-build/linux-kernel/build-intel-qat.sh
@@ -14,7 +14,7 @@ fi
 
 . ${KERNEL_VAR_FILE}
 
-url="https://packages.vyos.net/source-mirror/QAT.L.4.24.0-00005.tar.gz"
+url="https://packages.vyos.net/source-mirror/QAT.L.4.28.0-00004.tar.gz"
 
 cd ${CWD}
 
@@ -53,6 +53,15 @@ if [ -z $KERNEL_DIR ]; then
     exit 1
 fi
 
+# Apply local patches (for newer kernels/backports)
+if [ -d "${CWD}/patches/intel-qat" ]; then
+    for p in "${CWD}"/patches/intel-qat/*.patch; do
+        [ -e "$p" ] || continue
+        echo "I: Applying Intel-QAT patch: $(basename "$p")"
+        patch -p1 < "$p" || exit 1
+    done
+fi
+
 echo "I: Compile Kernel module for Intel ${DRIVER_NAME} driver"
 mkdir -p \
     ${DEBIAN_DIR}/lib/firmware \
diff --git a/scripts/package-build/linux-kernel/build-linux-firmware.sh b/scripts/package-build/linux-kernel/build-linux-firmware.sh
index 2b1fa7b7..948a06fd 100755
--- a/scripts/package-build/linux-kernel/build-linux-firmware.sh
+++ b/scripts/package-build/linux-kernel/build-linux-firmware.sh
@@ -4,11 +4,12 @@
 # the magic word "UNIQUE_ID_firmware" which identifies firmware files.
 
 CWD=$(pwd)
-LINUX_SRC="linux"
 LINUX_FIRMWARE="linux-firmware"
 KERNEL_VAR_FILE=${CWD}/kernel-vars
 
-if [ ! -d ${LINUX_SRC} ]; then
+. ${KERNEL_VAR_FILE}
+
+if [ ! -d ${KERNEL_DIR} ]; then
     echo "Kernel source missing"
     exit 1
 fi
@@ -18,11 +19,8 @@ if [ ! -d ${LINUX_FIRMWARE} ]; then
     exit 1
 fi
 
-. ${KERNEL_VAR_FILE}
-
-result=()
 # Retrieve firmware blobs from source files
-FW_FILES=$(find ${LINUX_SRC}/debian/linux-image/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/kernel/drivers/net -name *.ko | xargs modinfo | grep "^firmware:" | awk '{print $2}')
+FW_FILES=$(find ${KERNEL_DIR}/debian/linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX}/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/kernel/drivers/net -name *.ko | xargs modinfo | grep "^firmware:" | awk '{print $2}')
 
 # Debian package will use the descriptive Git commit as version
 GIT_COMMIT=$(cd ${CWD}/${LINUX_FIRMWARE}; git describe --always)
diff --git a/scripts/package-build/linux-kernel/build-openvpn-dco.sh b/scripts/package-build/linux-kernel/build-openvpn-dco.sh
deleted file mode 100755
index 518729ee..00000000
--- a/scripts/package-build/linux-kernel/build-openvpn-dco.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/sh
-CWD=$(pwd)
-KERNEL_VAR_FILE=${CWD}/kernel-vars
-
-SRC=${CWD}/ovpn-dco
-if [ ! -d ${SRC} ]; then
-    echo "OpenVPN DCO source not found"
-    exit 1
-fi
-
-if [ ! -f ${KERNEL_VAR_FILE} ]; then
-    echo "Kernel variable file '${KERNEL_VAR_FILE}' does not exist, run ./build_kernel.sh first"
-    exit 1
-fi
-
-. ${KERNEL_VAR_FILE}
-
-cd ${SRC}
-git reset --hard HEAD
-git clean --force -d -x
-make KERNEL_SRC=$KERNEL_DIR
-
-# Copy binary to package directory
-DEBIAN_DIR=tmp/lib/modules/${KERNEL_VERSION}${KERNEL_SUFFIX}/extra
-mkdir -p ${DEBIAN_DIR}
-cp drivers/net/ovpn-dco/ovpn-dco-v2.ko ${DEBIAN_DIR}
-
-# Sign generated Kernel modules
-${CWD}/sign-modules.sh ${DEBIAN_DIR}
-
-# Build Debian Package
-fpm --input-type dir --output-type deb --name openvpn-dco \
-    --version $(git describe | sed s/^v//) --deb-compression gz \
-    --maintainer "VyOS Package Maintainers <maintainers@vyos.net>" \
-    --description "OpenVPN Data Channel Offload" \
-    --depends linux-image-${KERNEL_VERSION}${KERNEL_SUFFIX} \
-    --license "GPL2" --chdir tmp
-
-mv *.deb ..
diff --git a/scripts/package-build/linux-kernel/build.py b/scripts/package-build/linux-kernel/build.py
index 4d243622..605a2194 100755
--- a/scripts/package-build/linux-kernel/build.py
+++ b/scripts/package-build/linux-kernel/build.py
@@ -160,9 +160,6 @@ def build_package(package: dict, dependencies: list) -> None:
             build_jool()
         elif package['build_cmd'] == 'build_ipt_netflow':
             build_ipt_netflow(package['commit_id'], package['scm_url'])
-        elif package['build_cmd'] == 'build_openvpn_dco':
-            build_openvpn_dco(package['commit_id'], package['scm_url'])
-            create_tarball(f'{package["name"]}-{package["commit_id"]}', f'{package["name"]}')
         elif package['build_cmd'] == 'build_nat_rtsp':
             build_nat_rtsp(package['commit_id'], package['scm_url'])
         else:
@@ -260,12 +257,6 @@ def build_ipt_netflow(commit_id, scm_url):
     clone_or_update_repo(repo_dir, scm_url, commit_id)
     run(['./build-ipt-netflow.sh'], check=True, shell=True)
 
-def build_openvpn_dco(commit_id, scm_url):
-    """Build OpenVPN DCO"""
-    repo_dir = Path('ovpn-dco')
-    clone_or_update_repo(repo_dir, scm_url, commit_id)
-    run(['./build-openvpn-dco.sh'], check=True)
-
 
 def build_nat_rtsp(commit_id, scm_url):
     """Build RTSP netfilter helper"""
diff --git a/scripts/package-build/linux-kernel/config/10-networking.config b/scripts/package-build/linux-kernel/config/10-networking.config
index 62228fc8..3fd1e585 100644
--- a/scripts/package-build/linux-kernel/config/10-networking.config
+++ b/scripts/package-build/linux-kernel/config/10-networking.config
@@ -129,3 +129,4 @@ CONFIG_BRIDGE_NETFILTER=m
 
 CONFIG_WIREGUARD=m
 # CONFIG_WIREGUARD_DEBUG is not set
+CONFIG_OVPN=m
diff --git a/scripts/package-build/linux-kernel/package.toml b/scripts/package-build/linux-kernel/package.toml
index 0a9fe0a3..ffed8b39 100644
--- a/scripts/package-build/linux-kernel/package.toml
+++ b/scripts/package-build/linux-kernel/package.toml
@@ -23,12 +23,6 @@ scm_url = "https://github.com/accel-ppp/accel-ppp-ng.git"
 build_cmd = "build_accel_ppp_ng"
 
 [[packages]]
-name = "ovpn-dco"
-commit_id = "v0.2.20231117"
-scm_url = "https://github.com/OpenVPN/ovpn-dco"
-build_cmd = "build_openvpn_dco"
-
-[[packages]]
 name = "nat-rtsp"
 commit_id = "5aeee02"
 scm_url = "https://github.com/maru-sama/rtsp-linux.git"
diff --git a/scripts/package-build/linux-kernel/patches/intel-qat/0001-qdm-use-iommu_paging_domain_alloc-on-linux-6.18.patch b/scripts/package-build/linux-kernel/patches/intel-qat/0001-qdm-use-iommu_paging_domain_alloc-on-linux-6.18.patch
new file mode 100644
index 00000000..ff2fc572
--- /dev/null
+++ b/scripts/package-build/linux-kernel/patches/intel-qat/0001-qdm-use-iommu_paging_domain_alloc-on-linux-6.18.patch
@@ -0,0 +1,62 @@
+From: Christian Breunig <christian@breunig.cc>
+Date: Tue, 28 Apr 2026 16:21:56 +0200
+Subject: [PATCH] iommu: add LINUX_VERSION_CODE conditional for 6.18
+
+---
+ .../qat/drivers/crypto/qat/qat_common/qdm.c   | 22 ++++++++++++++++++-
+ 1 file changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/quickassist/qat/drivers/crypto/qat/qat_common/qdm.c b/quickassist/qat/drivers/crypto/qat/qat_common/qdm.c
+index e4ca0e9..36090fb 100644
+--- a/quickassist/qat/drivers/crypto/qat/qat_common/qdm.c
++++ b/quickassist/qat/drivers/crypto/qat/qat_common/qdm.c
+@@ -9,10 +9,12 @@
+ 
+ #include <linux/iommu.h>
+ #include <linux/module.h>
++#include <linux/mutex.h>
+ #include <linux/pci.h>
+ #include "qdm.h"
+ 
+ static struct iommu_domain *domain;
++static DEFINE_MUTEX(qdm_domain_lock);
+ 
+ static bool iommu_configured_passthrough(void)
+ {
+@@ -70,6 +72,18 @@ int qdm_attach_device(struct device *dev)
+ 		return -ENODEV;
+ 	}
+ 
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 18, 0)
++	if (!domain && qdm_iommu_present() && !iommu_under_pt()) {
++		mutex_lock(&qdm_domain_lock);
++		if (!domain) {
++			domain = iommu_paging_domain_alloc(dev);
++			if (!domain)
++				pr_err("QAT: Failed to allocate a domain\n");
++		}
++		mutex_unlock(&qdm_domain_lock);
++	}
++#endif
++
+ 	if (!domain) {
+ 		if (iommu_under_pt()) {
+ 			dma_addr_t daddr;
+@@ -202,7 +216,13 @@ int __init qdm_init(void)
+ 	if (!qdm_iommu_present() || iommu_under_pt())
+ 		return 0;
+ 
+-#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0)
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 18, 0)
++	/*
++	 * Kernel 6.18+ no longer provides the legacy iommu_domain_alloc() API.
++	 * Allocate the paging domain lazily when the first device attaches.
++	 */
++	return 0;
++#elif LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0)
+ 	domain = iommu_domain_alloc();
+ #else
+ 	domain = iommu_domain_alloc(&pci_bus_type);
+-- 
+2.39.5
+
diff --git a/scripts/package-build/linux-kernel/patches/intel-qat/0002-libusdm-kernel-space-fix-include-paths.patch b/scripts/package-build/linux-kernel/patches/intel-qat/0002-libusdm-kernel-space-fix-include-paths.patch
new file mode 100644
index 00000000..299cd89a
--- /dev/null
+++ b/scripts/package-build/linux-kernel/patches/intel-qat/0002-libusdm-kernel-space-fix-include-paths.patch
@@ -0,0 +1,23 @@
+From: Christian Breunig <christian@breunig.cc>
+Subject: [PATCH] libusdm_drv: fix EXTRA_CFLAGS include handling for kernel builds
+
+The kernel Makefile incorrectly concatenates "-I" with $(INCLUDES), but
+$(INCLUDES) already contains "-I..." entries from linux_2.6_kernel_space.mk.
+
+That yields broken compiler arguments like "-I-I/path/...", which breaks header
+lookup on newer GCC (observed as missing qae_mem.h / Osal.h during out-of-tree
+module builds against Linux 6.18).
+
+--- a/quickassist/utilities/libusdm_drv/linux/Makefile
++++ b/quickassist/utilities/libusdm_drv/linux/Makefile
+@@ -187,7 +187,9 @@ export OUTPUT_NAME
+ #kernel space rules here 
+ #produce two artefacts: module and static library and copy them
+ ifeq ($(OS),linux)
+-EXTRA_CFLAGS+=-I$(INCLUDES) -Werror -ftree-ter
++# INCLUDES already contains "-I..." entries (see env_files/linux_2.6_kernel_space.mk).
++# Prefixing with "-I" again breaks header lookup on newer toolchains (GCC 14+).
++EXTRA_CFLAGS+=$(INCLUDES) -Werror -ftree-ter
+ obj-m+=$(OUTPUT_NAME).o
+ $(OUTPUT_NAME)-objs :=$(patsubst %.c,%.o, $(MODULE_SOURCES)) $(ADDITIONAL_KERNEL_LIBS)
+ lib-m := $(patsubst %.c,%.o, $(SOURCES)) $(patsubst %.S,%.o, $(ASM_SOURCES))
diff --git a/scripts/package-build/linux-kernel/patches/intel-qat/0003-qat-kbuild-map-extra_cflags-to-ccflags-y.patch b/scripts/package-build/linux-kernel/patches/intel-qat/0003-qat-kbuild-map-extra_cflags-to-ccflags-y.patch
new file mode 100644
index 00000000..acdd0c68
--- /dev/null
+++ b/scripts/package-build/linux-kernel/patches/intel-qat/0003-qat-kbuild-map-extra_cflags-to-ccflags-y.patch
@@ -0,0 +1,26 @@
+From: Christian Breunig <christian@breunig.cc>
+Subject: [PATCH] qat: map EXTRA_CFLAGS into ccflags-y for Linux 6.x kbuild
+
+Linux kbuild no longer applies EXTRA_CFLAGS for out-of-tree module builds the
+way older kernels did. Intel QAT's build system still funnels include paths and
+defines through EXTRA_CFLAGS (via env_files/linux_2.6_kernel_space.mk), which
+results in missing vendor headers (qae_mem.h, Osal.h, etc.) when building
+against newer kernels.
+
+Mirror EXTRA_CFLAGS into ccflags-y after including OS-specific rules so the
+flags reach the compiler.
+
+--- a/quickassist/build_system/build_files/rules.mk
++++ b/quickassist/build_system/build_files/rules.mk
+@@ -121,3 +121,11 @@
+ 
+ #include specific rules according to $(PROG_ACY)_OS and $(PROG_ACY)_OS_LEVEL
+ include $($(PROG_ACY)_BUILDSYSTEM_PATH)/build_files/OS/$($(PROG_ACY)_OS)_$($(PROG_ACY)_OS_LEVEL)_rules.mk
++
++# Linux kbuild (v6.x+) no longer honors EXTRA_CFLAGS for out-of-tree modules.
++# Intel QAT historically routes include paths and defines through EXTRA_CFLAGS via
++# env_files/linux_2.6_kernel_space.mk. Mirror those flags into ccflags-y so they
++# actually reach the compiler when invoking the kernel build system.
++ifdef KERNELRELEASE
++ccflags-y += $(EXTRA_CFLAGS)
++endif
diff --git a/scripts/package-build/linux-kernel/patches/intel-qat/0004-lac-kernel-space-ccflags-y.patch b/scripts/package-build/linux-kernel/patches/intel-qat/0004-lac-kernel-space-ccflags-y.patch
new file mode 100644
index 00000000..d2cffb62
--- /dev/null
+++ b/scripts/package-build/linux-kernel/patches/intel-qat/0004-lac-kernel-space-ccflags-y.patch
@@ -0,0 +1,27 @@
+From: Christian Breunig <christian@breunig.cc>
+Subject: [PATCH] lac: mirror EXTRA_CFLAGS into ccflags-y for kernel_space builds
+
+Lookaside Crypto access_layer skips rules.mk when ICP_OS_LEVEL is kernel_space.
+Linux 6.x kbuild ignores EXTRA_CFLAGS for external modules, so compilation of
+linux/icp_qa_module.c fails to find headers such as cpa.h.
+
+Mirror EXTRA_CFLAGS into ccflags-y for kernel-space builds before pulling in
+Core/OS fragments.
+
+--- a/quickassist/lookaside/access_layer/src/Makefile
++++ b/quickassist/lookaside/access_layer/src/Makefile
+@@ -227,6 +227,14 @@
+ include $(ICP_BUILDSYSTEM_PATH)/build_files/rules.mk
+ endif
+ 
++# Kernel-space builds skip rules.mk above. Linux 6.x kbuild ignores EXTRA_CFLAGS for
++# external modules; mirror flags into ccflags-y so headers like cpa.h resolve.
++ifeq ($(ICP_OS_LEVEL),kernel_space)
++ifdef KERNELRELEASE
++ccflags-y += $(EXTRA_CFLAGS)
++endif
++endif
++
+ include $(ICP_BUILDSYSTEM_PATH)/build_files/Core/$(ICP_CORE).mk
+ include $(ICP_BUILDSYSTEM_PATH)/build_files/OS/$(ICP_OS).mk
+ 
diff --git a/scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch b/scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch
index 56694532..ff0bc955 100644
--- a/scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch
+++ b/scripts/package-build/linux-kernel/patches/kernel/0001-linkstate-ip-device-attribute.patch
@@ -1,4 +1,3 @@
-From 81d38c4a32e059ad7835f7dc254e7627642afbe9 Mon Sep 17 00:00:00 2001
 From: Stephen Hemminger <stephen@networkplumber.org>
 Date: Mon, 29 Apr 2013 18:50:15 -0700
 Subject: [PATCH] VyOS: Add linkstate IP device attribute
@@ -7,6 +6,15 @@ Backport of earlier Vyatta patch.
 
 (cherry picked from commit 7c5a851086686be14ae937c80d6cee34814dbefc)
 
+Refreshed against Linux 6.18.x:
+  * include/uapi/linux/ipv6.h gained DEVCONF_FORCE_FORWARDING; insert
+    DEVCONF_LINK_FILTER after it so the new sentinel keeps a stable value.
+  * include/linux/ipv6.h grew ra_honor_pio_life / ra_honor_pio_pflag
+    members before sysctl_header.
+  * net/ipv6/addrconf.c::ipv6_store_devconf() now uses READ_ONCE() and
+    publishes DEVCONF_FORCE_FORWARDING; use READ_ONCE() for link_filter
+    and append after force_forwarding.
+  * net/ipv6/route.c context shifted; rt6_link_filter() unchanged.
 ---
  Documentation/networking/ip-sysctl.rst | 11 +++++++++++
  include/linux/inetdevice.h             |  1 +
@@ -19,10 +27,9 @@ Backport of earlier Vyatta patch.
  8 files changed, 34 insertions(+)
 
 diff --git a/Documentation/networking/ip-sysctl.rst b/Documentation/networking/ip-sysctl.rst
-index 531a070df2a6..d455a01b91e9 100644
 --- a/Documentation/networking/ip-sysctl.rst
 +++ b/Documentation/networking/ip-sysctl.rst
-@@ -1754,6 +1754,17 @@ src_valid_mark - BOOLEAN
+@@ -2042,6 +2042,17 @@ src_valid_mark - BOOLEAN
  
  	Default value is 0.
  
@@ -41,34 +48,31 @@ index 531a070df2a6..d455a01b91e9 100644
  	- 1 - Allows you to have multiple network interfaces on the same
  	  subnet, and have the ARPs for each interface be answered
 diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
-index b157ff4f727f..0cbab4c57b8b 100644
 --- a/include/linux/inetdevice.h
 +++ b/include/linux/inetdevice.h
-@@ -137,6 +137,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
+@@ -139,6 +139,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev)
  #define IN_DEV_ARP_NOTIFY(in_dev)	IN_DEV_MAXCONF((in_dev), ARP_NOTIFY)
  #define IN_DEV_ARP_EVICT_NOCARRIER(in_dev) IN_DEV_ANDCONF((in_dev), \
  							  ARP_EVICT_NOCARRIER)
 +#define IN_DEV_LINKFILTER(in_dev)	IN_DEV_MAXCONF((in_dev), LINKFILTER)
  
  struct in_ifaddr {
- 	struct hlist_node	hash;
+ 	struct hlist_node	addr_lst;
 diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
-index af8a771a053c..ece8ac89d317 100644
 --- a/include/linux/ipv6.h
 +++ b/include/linux/ipv6.h
-@@ -84,6 +84,7 @@ struct ipv6_devconf {
+@@ -91,6 +91,7 @@ struct ipv6_devconf {
  	__u8		ndisc_evict_nocarrier;
+ 	__u8		ra_honor_pio_life;
+ 	__u8		ra_honor_pio_pflag;
++	__s32		link_filter;
  
  	struct ctl_table_header *sysctl_header;
-+	__s32           link_filter;
  };
- 
- struct ipv6_params {
 diff --git a/include/uapi/linux/ip.h b/include/uapi/linux/ip.h
-index 283dec7e3645..8067941a635e 100644
 --- a/include/uapi/linux/ip.h
 +++ b/include/uapi/linux/ip.h
-@@ -173,6 +173,7 @@ enum
+@@ -189,6 +189,7 @@ enum
  	IPV4_DEVCONF_DROP_GRATUITOUS_ARP,
  	IPV4_DEVCONF_BC_FORWARDING,
  	IPV4_DEVCONF_ARP_EVICT_NOCARRIER,
@@ -77,22 +81,20 @@ index 283dec7e3645..8067941a635e 100644
  };
  
 diff --git a/include/uapi/linux/ipv6.h b/include/uapi/linux/ipv6.h
-index cf592d7b630f..e8915701aa73 100644
 --- a/include/uapi/linux/ipv6.h
 +++ b/include/uapi/linux/ipv6.h
-@@ -199,6 +199,7 @@ enum {
- 	DEVCONF_NDISC_EVICT_NOCARRIER,
+@@ -200,6 +200,7 @@ enum {
  	DEVCONF_ACCEPT_UNTRACKED_NA,
  	DEVCONF_ACCEPT_RA_MIN_LFT,
+ 	DEVCONF_FORCE_FORWARDING,
 +	DEVCONF_LINK_FILTER,
  	DEVCONF_MAX
  };
  
 diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
-index 798497c8b192..0b4510b06ab5 100644
 --- a/net/ipv4/devinet.c
 +++ b/net/ipv4/devinet.c
-@@ -2608,6 +2608,7 @@ static struct devinet_sysctl_table {
+@@ -2652,6 +2652,7 @@ static struct devinet_sysctl_table {
  					      "route_localnet"),
  		DEVINET_SYSCTL_FLUSHING_ENTRY(DROP_UNICAST_IN_L2_MULTICAST,
  					      "drop_unicast_in_l2_multicast"),
@@ -101,18 +103,17 @@ index 798497c8b192..0b4510b06ab5 100644
  };
  
 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 4958452cd332..608ad0b164e3 100644
 --- a/net/ipv6/addrconf.c
 +++ b/net/ipv6/addrconf.c
-@@ -5699,6 +5699,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
- 	array[DEVCONF_NDISC_EVICT_NOCARRIER] = cnf->ndisc_evict_nocarrier;
- 	array[DEVCONF_ACCEPT_UNTRACKED_NA] = cnf->accept_untracked_na;
- 	array[DEVCONF_ACCEPT_RA_MIN_LFT] = cnf->accept_ra_min_lft;
-+	array[DEVCONF_LINK_FILTER] = cnf->link_filter;
+@@ -5716,6 +5716,7 @@ static void ipv6_store_devconf(const struct ipv6_devconf *cnf,
+ 		READ_ONCE(cnf->accept_untracked_na);
+ 	array[DEVCONF_ACCEPT_RA_MIN_LFT] = READ_ONCE(cnf->accept_ra_min_lft);
+ 	array[DEVCONF_FORCE_FORWARDING] = READ_ONCE(cnf->force_forwarding);
++	array[DEVCONF_LINK_FILTER] = READ_ONCE(cnf->link_filter);
  }
  
  static inline size_t inet6_ifla6_size(void)
-@@ -7143,6 +7144,13 @@ static const struct ctl_table addrconf_sysctl[] = {
+@@ -7251,6 +7252,13 @@ static const struct ctl_table addrconf_sysctl[] = {
  		.extra1		= (void *)SYSCTL_ZERO,
  		.extra2		= (void *)SYSCTL_ONE,
  	},
@@ -127,10 +128,9 @@ index 4958452cd332..608ad0b164e3 100644
  		.procname	= "ioam6_id",
  		.data		= &ipv6_devconf.ioam6_id,
 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
-index 5a6cc828855d..00f98d4f3860 100644
 --- a/net/ipv6/route.c
 +++ b/net/ipv6/route.c
-@@ -716,6 +716,14 @@ static inline void rt6_probe(struct fib6_nh *fib6_nh)
+@@ -714,6 +714,14 @@ static inline void rt6_probe(struct fib6_nh *fib6_nh)
  }
  #endif
  
@@ -145,7 +145,7 @@ index 5a6cc828855d..00f98d4f3860 100644
  /*
   * Default Router Selection (RFC 2461 6.3.6)
   */
-@@ -757,6 +765,8 @@ static int rt6_score_route(const struct fib6_nh *nh, u32 fib6_flags, int oif,
+@@ -755,6 +763,8 @@ static int rt6_score_route(const struct fib6_nh *nh, u32 fib6_flags, int oif,
  
  	if (!m && (strict & RT6_LOOKUP_F_IFACE))
  		return RT6_NUD_FAIL_HARD;
diff --git a/scripts/package-build/linux-kernel/patches/kernel/0003-build-linux-perf-package.patch b/scripts/package-build/linux-kernel/patches/kernel/0003-build-linux-perf-package.patch
index 7a4691d9..32254849 100644
--- a/scripts/package-build/linux-kernel/patches/kernel/0003-build-linux-perf-package.patch
+++ b/scripts/package-build/linux-kernel/patches/kernel/0003-build-linux-perf-package.patch
@@ -1,62 +1,102 @@
-diff --git c/scripts/package/builddeb i/scripts/package/builddeb
-index d7dd0d04c70c..6f4a9a7c2c62 100755
---- c/scripts/package/builddeb
-+++ i/scripts/package/builddeb
-@@ -182,6 +182,16 @@ install_libc_headers () {
- 	mv $pdir/usr/include/asm $pdir/usr/include/$host_arch/
+From: Christian Breunig <christian@breunig.cc>
+Subject: [PATCH] VyOS: build a linux-perf Debian package alongside the kernel
+
+The upstream "make bindeb-pkg" target stopped emitting a perf package
+quite a while ago. Re-add it by hooking into the new builddeb / mkdebian
+infrastructure:
+
+  * mkdebian: emit a "linux-perf-${KERNELRELEASE}" stanza in
+    debian/control whenever the architecture is not user-mode-linux.
+  * scripts/package/debian/rules: add a "binary-perf" target so the
+    binary build loop processes the new package.
+  * builddeb: add an install_perf() helper that invokes
+    "make -C tools/perf install" with prefix=/usr and DESTDIR pointing
+    at the package staging directory, plus a dispatch case for
+    "linux-perf-*" packages.
+
+Refreshed for Linux 6.18.x: the old patch targeted the previous loop
+based scripts/package/builddeb (one-shot builddeb invocation that
+iterated over every package); since v6.7 the package build is driven
+per-package from debian/rules, so we have to extend that mechanism
+instead.
+---
+ scripts/package/builddeb      | 16 ++++++++++++++++
+ scripts/package/debian/rules  |  3 ++-
+ scripts/package/mkdebian      | 12 ++++++++++++
+ 3 files changed, 30 insertions(+), 1 deletion(-)
+
+diff --git a/scripts/package/builddeb b/scripts/package/builddeb
+--- a/scripts/package/builddeb
++++ b/scripts/package/builddeb
+@@ -156,6 +156,20 @@ install_libc_headers () {
+ 	mv "$pdir/usr/include/asm" "$pdir/usr/include/${DEB_HOST_MULTIARCH}"
  }
  
 +install_perf () {
-+	pdir=$1
++	pdir=debian/$1
 +
-+	rm -rf $pdir
-+
-+	$MAKE -C tools/ perf_install prefix=$pdir/usr
-+	mv tools/perf/$pdir/usr $srctree/$pdir
++	rm -rf "$pdir"
++	mkdir -p "$pdir"
 +
++	# In-source kernel builds export srctree as a relative path (".").
++	# "make -C tools/perf" changes the working directory, which breaks
++	# Makefile.perf's "include $(srctree)/tools/build/Makefile.include"
++	# unless srctree is absolute. Force an absolute path here.
++	$MAKE -C "$srctree/tools/perf" srctree="$(realpath "$srctree")" \
++		prefix=/usr DESTDIR="$(pwd)/$pdir" install
 +}
 +
- rm -f debian/files
+ package=$1
  
- packages_enabled=$(dh_listpackages)
-@@ -199,6 +209,8 @@ do
- 		install_libc_headers debian/linux-libc-dev;;
- 	linux-headers-*)
- 		install_kernel_headers debian/linux-headers ${package#linux-headers-};;
-+	linux-perf-*)
-+		install_perf debian/linux-perf ${package};;
- 	esac
- done
+ case "${package}" in
+@@ -167,4 +181,6 @@ linux-libc-dev)
+ 	install_libc_headers "${package}";;
+ linux-headers-*)
+ 	install_kernel_headers "${package}";;
++linux-perf-*)
++	install_perf "${package}";;
+ esac
+diff --git a/scripts/package/debian/rules b/scripts/package/debian/rules
+--- a/scripts/package/debian/rules
++++ b/scripts/package/debian/rules
+@@ -27,13 +27,14 @@ make-opts = ARCH=$(ARCH) KERNELRELEASE=$(KERNELRELEASE) \
+     $(addprefix KBUILD_BUILD_VERSION=,$(revision)) \
+     $(addprefix CROSS_COMPILE=,$(CROSS_COMPILE))
  
-@@ -213,6 +225,8 @@ do
- 		create_package ${package} debian/linux-libc-dev;;
- 	linux-headers-*)
- 		create_package ${package} debian/linux-headers;;
-+	linux-perf-*)
-+		create_package ${package} debian/linux-perf;;
- 	esac
- done
+-binary-targets := $(addprefix binary-, image image-dbg headers libc-dev)
++binary-targets := $(addprefix binary-, image image-dbg headers libc-dev perf)
  
-diff --git c/scripts/package/mkdebian i/scripts/package/mkdebian
-index 5044224cf671..21f98ae50be0 100755
---- c/scripts/package/mkdebian
-+++ i/scripts/package/mkdebian
-@@ -238,6 +238,18 @@ Description: Linux support headers for userspace development
- Multi-Arch: same
- EOF
+ all-packages = $(shell dh_listpackages)
+ image-package = $(filter linux-image-% user-%, $(filter-out %-dbg, $(all-packages)))
+ image-dbg-package = $(filter %-dbg, $(all-packages))
+ libc-dev-package = $(filter linux-libc-dev, $(all-packages))
+ headers-package = $(filter linux-headers-%, $(all-packages))
++perf-package = $(filter linux-perf-%, $(all-packages))
  
+ mk-files = $(patsubst binary-%,debian/%.files,$1)
+ package = $($(@:binary-%=%-package))
+diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian
+--- a/scripts/package/mkdebian
++++ b/scripts/package/mkdebian
+@@ -247,6 +247,18 @@ Description: Linux kernel headers for ${KERNELRELEASE} on $debarch
+  This is useful for people who need to build external modules
+ EOF
+ fi
++
 +cat <<EOF >> debian/control
 +
-+Package: linux-perf-$version
++Package: linux-perf-${KERNELRELEASE}
 +Section: devel
 +Architecture: $debarch
 +Depends: libpfm4, libslang2, libtraceevent1
-+Description: Performance analysis tools for Linux $version
++Description: Performance analysis tools for Linux ${KERNELRELEASE}
 + This package contains the 'perf' performance analysis tools for Linux
-+ kernel version $version .
++ kernel version ${KERNELRELEASE}.
 +Multi-Arch: same
 +EOF
-+
- if is_enabled CONFIG_MODULES; then
- cat <<EOF >> debian/control
+ fi
  
+ if is_enabled CONFIG_DEBUG_INFO; then
+-- 
+2.39.5
+