kernel: bump 6.12 to 6.12.40

Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.40
Removed upstreamed patches:
   generic/pending-6.12/680-net-fix-TCP-UDP-fraglist-GRO.patch
   generic/pending-6.12/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch
1- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.40&id=7c532f222361191fe228e54c5d3e0026fef8a5a0
2- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.40&id=c29a2328af96338d327cd851803338423c6f07a1
All other patches auto-refreshed.

Signed-off-by: Leo Barsky <[email protected]>
Link: https://github.com/openwrt/openwrt/pull/19514
Signed-off-by: Hauke Mehrtens <[email protected]>

target/linux/bcm27xx/patches-6.12/950-0054-Add-dwc_otg-driver.patch

@@ -1248,7 +1248,7 @@ Signed-off-by: Jonathan Bell <[email protected]>
  }
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -5757,7 +5757,7 @@ static void port_event(struct usb_hub *h
+@@ -5786,7 +5786,7 @@ static void port_event(struct usb_hub *h
  		port_dev->over_current_count++;
  		port_over_current_notify(port_dev);
  

target/linux/bcm27xx/patches-6.12/950-0154-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch

@@ -21,7 +21,7 @@ Signed-off-by: Dave Stevenson <[email protected]>
  
  static const struct vchiq_platform_info bcm2835_info = {
  	.cache_line_size = 32,
-@@ -1759,6 +1760,7 @@ static int vchiq_probe(struct platform_d
+@@ -1760,6 +1761,7 @@ static int vchiq_probe(struct platform_d
  
  	vchiq_debugfs_init(&mgmt->state);
  
@@ -29,7 +29,7 @@ Signed-off-by: Dave Stevenson <[email protected]>
  	bcm2835_audio = vchiq_device_register(&pdev->dev, "bcm2835-audio");
  	bcm2835_camera = vchiq_device_register(&pdev->dev, "bcm2835-camera");
  
-@@ -1777,6 +1779,7 @@ static void vchiq_remove(struct platform
+@@ -1778,6 +1780,7 @@ static void vchiq_remove(struct platform
  
  	vchiq_device_unregister(bcm2835_audio);
  	vchiq_device_unregister(bcm2835_camera);

target/linux/bcm27xx/patches-6.12/950-0155-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch

@@ -22,7 +22,7 @@ Signed-off-by: Dave Stevenson <[email protected]>
  static struct vchiq_device *vcsm_cma;
  
  static const struct vchiq_platform_info bcm2835_info = {
-@@ -1761,6 +1762,7 @@ static int vchiq_probe(struct platform_d
+@@ -1762,6 +1763,7 @@ static int vchiq_probe(struct platform_d
  	vchiq_debugfs_init(&mgmt->state);
  
  	vcsm_cma = vchiq_device_register(&pdev->dev, "vcsm-cma");
@@ -30,7 +30,7 @@ Signed-off-by: Dave Stevenson <[email protected]>
  	bcm2835_audio = vchiq_device_register(&pdev->dev, "bcm2835-audio");
  	bcm2835_camera = vchiq_device_register(&pdev->dev, "bcm2835-camera");
  
-@@ -1779,6 +1781,7 @@ static void vchiq_remove(struct platform
+@@ -1780,6 +1782,7 @@ static void vchiq_remove(struct platform
  
  	vchiq_device_unregister(bcm2835_audio);
  	vchiq_device_unregister(bcm2835_camera);

target/linux/bcm27xx/patches-6.12/950-0161-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch

@@ -234,7 +234,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  	dev_dbg(&pdev->dev, "arm: vchiq_init - done (slots %pK, phys %pad)\n",
  		vchiq_slot_zero, &slot_phys);
  
-@@ -1710,6 +1776,7 @@ void vchiq_platform_conn_state_changed(s
+@@ -1711,6 +1777,7 @@ void vchiq_platform_conn_state_changed(s
  static const struct of_device_id vchiq_of_match[] = {
  	{ .compatible = "brcm,bcm2835-vchiq", .data = &bcm2835_info },
  	{ .compatible = "brcm,bcm2836-vchiq", .data = &bcm2836_info },

target/linux/bcm27xx/patches-6.12/950-0163-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch

@@ -21,7 +21,7 @@ Signed-off-by: Naushir Patuck <[email protected]>
  static struct vchiq_device *vcsm_cma;
  
  static const struct vchiq_platform_info bcm2835_info = {
-@@ -1857,6 +1858,7 @@ static int vchiq_probe(struct platform_d
+@@ -1858,6 +1859,7 @@ static int vchiq_probe(struct platform_d
  	bcm2835_codec = vchiq_device_register(&pdev->dev, "bcm2835-codec");
  	bcm2835_audio = vchiq_device_register(&pdev->dev, "bcm2835-audio");
  	bcm2835_camera = vchiq_device_register(&pdev->dev, "bcm2835-camera");
@@ -29,7 +29,7 @@ Signed-off-by: Naushir Patuck <[email protected]>
  
  	return 0;
  
-@@ -1871,6 +1873,7 @@ static void vchiq_remove(struct platform
+@@ -1872,6 +1874,7 @@ static void vchiq_remove(struct platform
  	struct vchiq_drv_mgmt *mgmt = dev_get_drvdata(&pdev->dev);
  	struct vchiq_arm_state *arm_state;
  

target/linux/bcm27xx/patches-6.12/950-0325-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch

@@ -22,7 +22,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  #include <linux/of_irq.h>
  #include <linux/platform_device.h>
  #include <linux/scatterlist.h>
-@@ -1347,8 +1346,8 @@ static int bcm2835_probe(struct platform
+@@ -1348,8 +1347,8 @@ static int bcm2835_probe(struct platform
  	struct device *dev = &pdev->dev;
  	struct clk *clk;
  	struct bcm2835_host *host;
@@ -32,7 +32,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  	int ret;
  
  	dev_dbg(dev, "%s\n", __func__);
-@@ -1361,23 +1360,13 @@ static int bcm2835_probe(struct platform
+@@ -1362,23 +1361,13 @@ static int bcm2835_probe(struct platform
  	host->pdev = pdev;
  	spin_lock_init(&host->lock);
  

target/linux/bcm27xx/patches-6.12/950-0758-mmc-bcm2835-Add-downstream-overclocking-support.patch

@@ -65,7 +65,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  }
  
  static void bcm2835_reset(struct mmc_host *mmc)
-@@ -595,6 +607,25 @@ static void bcm2835_finish_request(struc
+@@ -596,6 +608,25 @@ static void bcm2835_finish_request(struc
  
  	mrq = host->mrq;
  
@@ -91,7 +91,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  	host->mrq = NULL;
  	host->cmd = NULL;
  	host->data = NULL;
-@@ -1091,8 +1122,13 @@ static void bcm2835_dma_complete_work(st
+@@ -1092,8 +1123,13 @@ static void bcm2835_dma_complete_work(st
  static void bcm2835_set_clock(struct bcm2835_host *host, unsigned int clock)
  {
  	struct mmc_host *mmc = mmc_from_priv(host);
@@ -105,7 +105,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  	/* The SDCDIV register has 11 bits, and holds (div - 2).  But
  	 * in data mode the max is 50MHz wihout a minimum, and only
  	 * the bottom 3 bits are used. Since the switch over is
-@@ -1114,38 +1150,78 @@ static void bcm2835_set_clock(struct bcm
+@@ -1115,38 +1151,78 @@ static void bcm2835_set_clock(struct bcm
  	 * clock divisor at all times.
  	 */
  
@@ -205,7 +205,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  }
  
  static void bcm2835_request(struct mmc_host *mmc, struct mmc_request *mrq)
-@@ -1175,6 +1251,9 @@ static void bcm2835_request(struct mmc_h
+@@ -1176,6 +1252,9 @@ static void bcm2835_request(struct mmc_h
  		return;
  	}
  
@@ -215,7 +215,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  	mutex_lock(&host->mutex);
  
  	WARN_ON(host->mrq);
-@@ -1198,7 +1277,7 @@ static void bcm2835_request(struct mmc_h
+@@ -1199,7 +1278,7 @@ static void bcm2835_request(struct mmc_h
  		return;
  	}
  
@@ -224,7 +224,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  		bcm2835_prepare_dma(host, mrq->data);
  
  	host->use_sbc = !!mrq->sbc && host->mrq->data &&
-@@ -1333,8 +1412,8 @@ static int bcm2835_add_host(struct bcm28
+@@ -1334,8 +1413,8 @@ static int bcm2835_add_host(struct bcm28
  	}
  
  	pio_limit_string[0] = '\0';
@@ -235,7 +235,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  	dev_info(dev, "loaded - DMA %s%s\n",
  		 host->use_dma ? "enabled" : "disabled", pio_limit_string);
  
-@@ -1344,10 +1423,13 @@ static int bcm2835_add_host(struct bcm28
+@@ -1345,10 +1424,13 @@ static int bcm2835_add_host(struct bcm28
  static int bcm2835_probe(struct platform_device *pdev)
  {
  	struct device *dev = &pdev->dev;
@@ -250,7 +250,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  	int ret;
  
  	dev_dbg(dev, "%s\n", __func__);
-@@ -1367,6 +1449,23 @@ static int bcm2835_probe(struct platform
+@@ -1368,6 +1450,23 @@ static int bcm2835_probe(struct platform
  	}
  
  	host->phys_addr = iomem->start;
@@ -274,7 +274,7 @@ Signed-off-by: Phil Elwell <[email protected]>
  
  	host->dma_chan = NULL;
  	host->dma_desc = NULL;
-@@ -1389,6 +1488,24 @@ static int bcm2835_probe(struct platform
+@@ -1390,6 +1489,24 @@ static int bcm2835_probe(struct platform
  		goto err;
  	}
  

target/linux/generic/hack-6.12/661-kernel-ct-size-the-hashtable-more-adequately.patch

@@ -14,7 +14,7 @@ Signed-off-by: Rui Salvaterra <[email protected]>
 
 --- a/net/netfilter/nf_conntrack_core.c
 +++ b/net/netfilter/nf_conntrack_core.c
-@@ -2634,7 +2634,7 @@ int nf_conntrack_init_start(void)
+@@ -2648,7 +2648,7 @@ int nf_conntrack_init_start(void)
  
  	if (!nf_conntrack_htable_size) {
  		nf_conntrack_htable_size

target/linux/generic/kernel-6.12

@@ -1,2 +1,2 @@
-LINUX_VERSION-6.12 = .39
-LINUX_KERNEL_HASH-6.12.39 = 6e562502a8fd11639f558e43b74f0df0d85fa85e60f5332acb275a75a35f5345
+LINUX_VERSION-6.12 = .40
+LINUX_KERNEL_HASH-6.12.40 = 4811af1317f98d2cccea3c7695969a2c03a27cb02fd2d5327032dd5341842933

target/linux/generic/pending-6.12/630-packet_socket_type.patch

@@ -87,7 +87,7 @@ Signed-off-by: Felix Fietkau <[email protected]>
  	if (!net_eq(dev_net(dev), sock_net(sk)))
  		goto drop;
  
-@@ -3430,6 +3432,7 @@ static int packet_create(struct net *net
+@@ -3429,6 +3431,7 @@ static int packet_create(struct net *net
  	mutex_init(&po->pg_vec_lock);
  	po->rollover = NULL;
  	po->prot_hook.func = packet_rcv;
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <[email protected]>
  
  	if (sock->type == SOCK_PACKET)
  		po->prot_hook.func = packet_rcv_spkt;
-@@ -4097,6 +4100,16 @@ packet_setsockopt(struct socket *sock, i
+@@ -4096,6 +4099,16 @@ packet_setsockopt(struct socket *sock, i
  		packet_sock_flag_set(po, PACKET_SOCK_QDISC_BYPASS, val);
  		return 0;
  	}
@@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau <[email protected]>
  	default:
  		return -ENOPROTOOPT;
  	}
-@@ -4159,6 +4172,13 @@ static int packet_getsockopt(struct sock
+@@ -4158,6 +4171,13 @@ static int packet_getsockopt(struct sock
  	case PACKET_COPY_THRESH:
  		val = READ_ONCE(pkt_sk(sk)->copy_thresh);
  		break;

target/linux/generic/pending-6.12/640-net-bridge-fix-switchdev-host-mdb-entry-updates.patch

@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <[email protected]>
 
 --- a/net/bridge/br_switchdev.c
 +++ b/net/bridge/br_switchdev.c
-@@ -568,10 +568,18 @@ static void br_switchdev_host_mdb(struct
+@@ -571,10 +571,18 @@ static void br_switchdev_host_mdb(struct
  				  struct net_bridge_mdb_entry *mp, int type)
  {
  	struct net_device *lower_dev;

target/linux/generic/pending-6.12/641-net-bridge-switchdev-Don-t-drop-packets-between-port.patch

@@ -27,7 +27,7 @@ Signed-off-by: Leon M. Busch-George <[email protected]>
 
 --- a/net/bridge/br_switchdev.c
 +++ b/net/bridge/br_switchdev.c
-@@ -67,7 +67,7 @@ bool nbp_switchdev_allowed_egress(const
+@@ -70,7 +70,7 @@ bool nbp_switchdev_allowed_egress(const
  	struct br_input_skb_cb *cb = BR_INPUT_SKB_CB(skb);
  
  	return !test_bit(p->hwdom, &cb->fwd_hwdoms) &&

target/linux/generic/pending-6.12/680-net-fix-TCP-UDP-fraglist-GRO.patch

@@ -1,35 +0,0 @@
-From: Felix Fietkau <[email protected]>
-Date: Sat, 5 Jul 2025 13:44:10 +0200
-Subject: [PATCH] net: fix TCP/UDP fraglist GRO
-
-Since "net: gro: use cb instead of skb->network_header", the skb network
-header is no longer set in the GRO path.
-This breaks fraglist segmentation, which relies on ip_hdr()/tcp_hdr()
-to check for address/port changes.
-Fix this regression by selectively setting the network header for merged
-segment skbs.
-
-Fixes: 186b1ea73ad8 ("net: gro: use cb instead of skb->network_header")
-Signed-off-by: Felix Fietkau <[email protected]>
----
-
---- a/net/ipv4/tcp_offload.c
-+++ b/net/ipv4/tcp_offload.c
-@@ -355,6 +355,7 @@ struct sk_buff *tcp_gro_receive(struct l
- 		flush |= skb->ip_summed != p->ip_summed;
- 		flush |= skb->csum_level != p->csum_level;
- 		flush |= NAPI_GRO_CB(p)->count >= 64;
-+		skb_set_network_header(skb, skb_gro_receive_network_offset(skb));
- 
- 		if (flush || skb_gro_receive_list(p, skb))
- 			mss = 1;
---- a/net/ipv4/udp_offload.c
-+++ b/net/ipv4/udp_offload.c
-@@ -604,6 +604,7 @@ static struct sk_buff *udp_gro_receive_s
- 					NAPI_GRO_CB(skb)->flush = 1;
- 					return NULL;
- 				}
-+				skb_set_network_header(skb, skb_gro_receive_network_offset(skb));
- 				ret = skb_gro_receive_list(p, skb);
- 			} else {
- 				skb_gro_postpull_rcsum(skb, uh,

target/linux/generic/pending-6.12/681-net-remove-NETIF_F_GSO_FRAGLIST-from-NETIF_F_GSO_SOF.patch

@@ -65,7 +65,7 @@ Signed-off-by: Felix Fietkau <[email protected]>
  
 --- a/net/8021q/vlan.h
 +++ b/net/8021q/vlan.h
-@@ -108,7 +108,7 @@ static inline netdev_features_t vlan_tnl
+@@ -109,7 +109,7 @@ static inline netdev_features_t vlan_tnl
  	netdev_features_t ret;
  
  	ret = real_dev->hw_enc_features &

target/linux/generic/pending-6.12/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch

@@ -1,45 +0,0 @@
-From 0e71cac033bb7689c4dfa2e6814191337ef770f5 Mon Sep 17 00:00:00 2001
-From: INAGAKI Hiroshi <[email protected]>
-Date: Thu, 13 Oct 2022 00:51:33 +0900
-Subject: [PATCH] nvmem: layouts: u-boot-env: align endianness of crc32 values
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This patch fixes crc32 error on Big-Endianness system by conversion of
-calculated crc32 value.
-
-Little-Endianness system:
-
-  obtained crc32: Little
-calculated crc32: Little
-
-Big-Endianness system:
-
-  obtained crc32: Little
-calculated crc32: Big
-
-log (APRESIA ApresiaLightGS120GT-SS, RTL8382M, Big-Endianness):
-
-[    8.570000] u_boot_env 18001200.spi:flash@0:partitions:partition@c0000: Invalid calculated CRC32: 0x88cd6f09 (expected: 0x096fcd88)
-[    8.580000] u_boot_env: probe of 18001200.spi:flash@0:partitions:partition@c0000 failed with error -22
-
-Fixes: f955dc1445069 ("nvmem: add driver handling U-Boot environment variables")
-
-Signed-off-by: INAGAKI Hiroshi <[email protected]>
-Acked-by: Rafał Miłecki <[email protected]>
-Tested-by: Christian Lamparter <[email protected]>
-Signed-off-by: Srinivas Kandagatla <[email protected]>
----
-
---- a/drivers/nvmem/layouts/u-boot-env.c
-+++ b/drivers/nvmem/layouts/u-boot-env.c
-@@ -148,7 +148,7 @@ int u_boot_env_parse(struct device *dev,
- 	crc32_data_len = dev_size - crc32_data_offset;
- 	data_len = dev_size - data_offset;
- 
--	calc = crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L;
-+	calc = le32_to_cpu((__le32)crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L);
- 	if (calc != crc32) {
- 		dev_err(dev, "Invalid calculated CRC32: 0x%08x (expected: 0x%08x)\n", calc, crc32);
- 		err = -EINVAL;

target/linux/ramips/patches-6.12/825-i2c-MIPS-adds-ralink-I2C-driver.patch

@@ -45,7 +45,7 @@ Signed-off-by: John Crispin <[email protected]>
 +};
 --- a/drivers/i2c/busses/Kconfig
 +++ b/drivers/i2c/busses/Kconfig
-@@ -1061,6 +1061,11 @@ config I2C_RK3X
+@@ -1062,6 +1062,11 @@ config I2C_RK3X
  	  This driver can also be built as a module. If so, the module will
  	  be called i2c-rk3x.
  

target/linux/realtek/patches-6.12/310-add-i2c-rtl9300-support.patch

@@ -17,7 +17,7 @@ Submitted-by: Birger Koblitz <[email protected]>
 
 --- a/drivers/i2c/busses/Kconfig
 +++ b/drivers/i2c/busses/Kconfig
-@@ -1061,6 +1061,16 @@ config I2C_RK3X
+@@ -1062,6 +1062,16 @@ config I2C_RK3X
  	  This driver can also be built as a module. If so, the module will
  	  be called i2c-rk3x.