Commit graph

70001 commits

Author SHA1 Message Date
Shiji Yang
91c0e9b2fb
editor: vscode: do not trim diff file trailing whitespace
This rule will break the patch structure.

Fixes: af75e1c527 ("vscode: update editor formatting and line endings settings")
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24411
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-25 22:45:06 +02:00
Julius Bairaktaris
6e1fdb9ea1
qualcommbe: dts: disable the driverless QCE crypto nodes
Commit ce120be361 ("kernel: disable qualcomm crypto") dropped the
CRYPTO_DEV_QCE kernel configs, so crypto@73a000 and its BAM no longer
have a driver. Unlike ipq8074, mainline ipq9574.dtsi ships both nodes
enabled by default, and gcc-ipq9574 registers its interconnect provider
with icc_sync_state; an enabled consumer that can never probe defers
that callback forever, so every boot logs

  sync_state() pending due to 73a000.crypto

and the interconnect bandwidth votes are never allowed to drop from
their boot-time maximum. Disable both nodes explicitly in the board
device tree.

Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/24379
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-25 22:41:44 +02:00
Julius Bairaktaris
ed21d383c4
ipq40xx: dts: stop enabling the driverless QCE crypto nodes
Commit ce120be361 ("kernel: disable qualcomm crypto") dropped the
CRYPTO_DEV_QCE kernel configs, so crypto@8e3a000 and its BAM no longer
have a driver. The board device trees still override both nodes to
"okay" (two boards also carry BAM channel properties that only exist
to serve the crypto engine), leaving enabled consumers that can never
probe. Drop the overrides and fall back to the SoC dtsi defaults, which
ship both nodes disabled.

Unlike ipq807x, no supplier on ipq4019 registers a sync_state()
callback, so the stale overrides are only dead code here.

Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/24379
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-25 22:41:43 +02:00
Julius Bairaktaris
31ded2d9ec
qualcommax: dts: stop enabling the driverless QCE crypto nodes
Commit ce120be361 ("kernel: disable qualcomm crypto") dropped the
CRYPTO_DEV_QCE kernel configs, so crypto@73a000 and its BAM no longer
have a driver. The board device trees still override both nodes to
"okay", which leaves an enabled consumer that can never probe. On
ipq807x the GCC clock controller registers the USB GDSC power domains,
the genpd core therefore installs a sync_state() callback on it, and
fw_devlink then defers that callback forever, logging

  qcom,gcc-ipq8074 1800000.clock-controller: sync_state() pending due to 73a000.crypto

on every boot and keeping unused power domains from being released.

Drop the overrides and fall back to the SoC dtsi defaults. On ipq8074
mainline ships both nodes disabled and no mainline board enables them;
on ipq5018/ipq6018 they are enabled by default, but the GCC drivers
there register no power domains, so no sync_state() dependency exists.

Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/24379
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-25 22:41:43 +02:00
Daniel Golle
9b11fa4088 fstools: update to git HEAD of 2026-07-25
2aa1640 block: preen a registered volume before mount on request
 d43ffba block: use preen mode for the f2fs filesystem check
 a71e97d blockd: do not let a slow startup helper hold back readiness
 1c17d24 blockd: expose storage readiness via a queryable status method
 f60b3a3 blockd: pass registrant mount options down to block on autofs mount
 998f6ab blockd: notify when an idle autofs mount is unmounted
 0008996 block: mount ubus-registered devices without an fstab entry
 4fd1502 blockd: coldplug block devices
 89a6f52 blockd: retry interrupted waitpid() in synchronous block() helper
 37cf94d blockd: fix bounds of the ubus event name buffer

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-07-25 17:30:51 +01:00
Shiji Yang
78bc8628a8 mpc85xx: add missing image relocate hack for 6.18 kernel
We also need to refresh the 6.12 kernel patches.

Fixes: 87940bfc69 ("mpc85xx: relocate simpleImage for WS-AP3710i")
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
2026-07-25 17:02:49 +02:00
Josef Schlehofer
69668f8f82
github: switch issue-labeller to bot webhook and add configuration
Remove the standalone GitHub Actions issue-labeller.yml workflow in favor
of the webhook-based openwrt-bot worker.

Enable issue labeller in formalities.json and add a declarative
.github/issue-labeller.yml configuration file for automated validation
and labelling of bug reports (release, target, image kind, device).

The release rule lists two alternative conditions under a single label
key: concrete releases (x.y.z, x.y.z-rcN) are validated against their
Git tag via exists check, while stable-branch snapshots (x.y-SNAPSHOT)
are format-validated only — OpenWrt does not tag snapshot builds.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24382
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2026-07-25 11:24:31 +02:00
Gennaro Cimmino
3b2bc55dcb realtek: eth: reclaim completed TX buffers on RX poll
The transmit path frees a TX skb only when its descriptor slot is
reused, RTETH_TX_RING_SIZE transmissions later. Until then the skb
stays charged to the sending socket's send buffer. With standard
frames the pinned amount is negligible, but with jumbo frames a
handful of completed transmissions is enough to exhaust the sender's
budget: eight ~9k echo replies exceed the kernel ICMP socket limit of
2 * SKB_TRUESIZE(64 * 1024), after which the stack drops every further
reply of any size (Icmp OutErrors) until unrelated transmissions
happen to recycle the slots. Observed on the Hasivo S1100W-8XGT-SE
(RTL9303) as a total ICMP blackout setting in after exactly eight
jumbo echo replies, healed by any sixteen device-originated frames.

Track monotonic send/clean counters in the driver-private ring info
(their difference is the number of unreleased skbs, their low bits the
ring slots), and release the contiguous completed run at the start of
the RX poll, before the received packets are processed, so replies
generated while handling the poll always find their send budget
released. The walk runs under the TX queue lock the
transmit path already holds, stops at the first descriptor the
hardware still owns, and is skipped entirely - no lock taken, no
access to the uncached descriptor memory - while nothing is pending.
The transmit path reuses the same walk for the ring-wrap case instead
of its old per-slot cleanup, and stopped or watchdog-frozen queues
are left to the rteth_tx_timeout() recovery, which keeps releasing
every buffer itself.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Gennaro Cimmino <gcimmino@rayonra.net>
Link: https://github.com/openwrt/openwrt/pull/24406
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-07-24 20:57:26 +02:00
Joshua Covington
66d356edea realtek: add support for ZyXEL GS1900-24E B1
The GS1900-24E B1 is a different hardware revision, not merely a
front-panel relabel as suggested by Zyxel's user guide. Verified
differences vs. A1 (sources: TechInfoDepot for A1 spec data,
https://techinfodepot.shoutwiki.com/wiki/ZyXEL_GS1900-24E):

* PCB: 37ZY-GM2430+212 V1.2 (A1: 37ZY-G724DO+412 V.12)
  - different board part number, not a stepping of the same one
* RAM: 128 MiB DDR3, A1: 128 MiB DDR2
* Flash: mx25l12805d, 16 MiB (A1: 16 MiB SPI-NOR)
* External PHYs: RTL8218D (A1: unknown)
* Rear power switch: absent on this B1 unit (inlet only). A1 is
  described as having one in the *title* of openwrt/openwrt#18620,
  but that issue does not explicitly identify the affected hardware
  as "A1" specifically, nor is it confirmed by a spec sheet or photo
* ZYXEL_VERS firmware family unchanged (AAHK)

The existing MDIO bus addressing and switch-port SerDes layout
from -a1.dts work unmodified on B1, since the PHY driver
identifies the external chip by ID registers at runtime rather
than from DT compatible string, regardless of what chip A1
actually uses.

Deliberately omits the gpio0 mdio-reset gpio-hog present in
-a1.dts (ba57225066, #18620) pending confirmation it's needed on
B1's differing reset-line topology. Tagged 802.1Q VLAN traffic
tested clean across software reboot and full AC power-cycle, on
both kernel 6.6/24.10.5 and current master (6.18), with no sign
of the #18620 stuck-RX regression.

Encapsulates the two external RTL8218D PHY packages per the tree-wide
ethernet-phy-package conversion for RTL8218x chips; ports 8-15 use the
SoC-integrated PHY block and aren't part of an external package.

Signed-off-by: Joshua Covington <joshuacov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24377
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-07-24 17:32:34 +02:00
David Bauer
87940bfc69 mpc85xx: relocate simpleImage for WS-AP3710i
The initramfs image for Snapshots exceed the available space when
booting.

Relocate the simpleImage loader to a different offset to fix booting the
initramfs.

Signed-off-by: David Bauer <mail@david-bauer.net>
2026-07-24 16:10:32 +02:00
Fil Dunsky
7ba90841de
mediatek: cleanup Huasifei WH3000 / WH3000 Pro dts
WH3000 / WH3000 Pro button:
- These routers has no switch button, it's a regular button
  `linux,input-type = <EV_SW>;` removed

WH3000 Pro NAND:
- Add spi-nand calibration
- Align image size with vendor U-Boot partition layout:
  `nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),2048k(fip),231936k(ubi)`
- Remove redundant options from firmware build recipe
- Remove redundant `spi_nand:` label from DTS

Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23227
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-24 09:38:00 +02:00
Stijn Segers
8853c1f2eb
realtek: remove stray PoE budget entries for GS1900-8HP A1/B1
Commits ab649f19ab and 64315f29c4 moved the GS1900-8HP B1 and A1 to the
in-kernel PSE MCU driver, but overlooked the /etc/board.d/02_network
PoE budget entries. Remove them.

Fixes: ab649f19ab realtek: use Realtek PSE MCU driver for GS1900-8HP B1
Fixes: 64315f29c4 realtek: use Realtek PSE MCU driver for GS1900-8HP A1

Signed-off-by: Stijn Segers <foss@volatilesystems.org>
Link: https://github.com/openwrt/openwrt/pull/24380
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-24 09:27:26 +02:00
Russell Senior
1117da9df9
realtek: use Realtek PSE MCU driver for Engenius EWS2910P
Convert both v1 and v3 to PSE MCU driver. Tested on a v3.

Signed-off-by: Russell Senior <russell@personaltelco.net>
Link: https://github.com/openwrt/openwrt/pull/24383
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-24 09:26:43 +02:00
Yalei Zang
a39d5a535b
airoha: raise CPU critical temperature from 110°C to 120°C
The IC maximum operating temperature is 125C. Raise the CPU critical
temperature from 110C to 120C to account for possible temperature sensor
error.

This keeps the trip point below the IC maximum while avoiding premature
critical thermal protection.

Tested on Airoha internal platforms without thermal protection issues.

Signed-off-by: Yalei Zang <yalei.zang@airoha.com>
Link: https://github.com/openwrt/openwrt/pull/24367
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2026-07-24 09:08:54 +02:00
Ahmed Naseef
ee2e25f009
mediatek: add support for Airtel AirFiber AAP4221ZY
The Airtel AirFiber AAP4221ZY is an ISP-provided router that is part
of the ISP's Fixed Wireless Access (FWA) solution. The FWA system
consists of two units: an outdoor 5G unit and this indoor Wi-Fi router
connected via a PoE ethernet link. This commit adds support for the
indoor unit.

The OEM appears to be Zyxel with model number EX3310-T0, although this
is not printed on any label and only found in the vendor firmware DTS,
bootlog, and other internal references.

Hardware
--------
SOC: MediaTek MT7981B
CPU: 2 core Cortex-A53 (1300MHz)
RAM: 512MB DDR3
FLASH: 512MB SPI-NAND (Micron, 4096 page, 256KiB block)
WIFI: MediaTek MT7976 802.11ax 2x2 2.4GHz + 5GHz
ETH: Airoha AN8855 GbE Switch (2x LAN) + MT7981 internal GbE PHY (WAN)
POE: WAN port provides PoE to the outdoor unit (GPIO 10)
UART: 3V3 115200 8N1

Bootloader
----------
The device uses BL2 -> U-Boot -> Zyxel zloader chain. U-Boot has a
hardcoded command to always launch zloader (similar to the Zyxel
EX5601-T0, see commit 1c05388ab0). zloader is the Zyxel secondary
bootloader which handles dual-boot (ubi/ubi2 A/B scheme), firmware
verification, and PoE port enablement.

zloader requires a UBI volume named "zyfwinfo" containing a 256-byte
metadata structure with a "ZYXE" magic header and a valid checksum.
Without this volume, zloader refuses to boot the firmware. The
zyfwinfo structure also contains a sequence number (range 0-9999,
wraps around) used to select which firmware bank to boot - the bank
with the higher sequence number wins. This OpenWrt image sets it to
5555 to always win over stock firmware starting at 0.

During sysupgrade, platform.sh refreshes the zyfwinfo volume before
writing kernel and rootfs to UBI, as rootfs_data is sized to fill the
remaining space.

Note that OpenWrt can only be flashed to ubi (mtd6). The zloader
appends rootubi=ubi or rootubi=ubi2 to the kernel bootargs based on
which partition it selects, but OpenWrt cannot understand this
parameter, so the firmware must always reside on the first bank (ubi).

UART access
-----------
Serial console output is restricted by the U-Boot environment variable
EngDebugFlag which is 0x00 by default. Users need to first obtain root
access on the vendor firmware and run:

  fw_setenv EngDebugFlag 0x01

Then reboot. Connect UART and press Enter to enter the zloader shell
(ZHAL> prompt). Use the ATGU command to switch to the U-Boot shell.
Note: ATGU must be entered twice to get the MT7981> prompt:

  ZHAL> ATGU
  [zloader reloads]
  ZHAL> ATGU
  MT7981>

Installation
------------
1. Enable UART access as described above.
2. Enter U-Boot shell (ATGU twice from ZHAL> prompt).
3. Load the initramfs image via TFTP:

  MT7981> setenv ipaddr 192.168.1.1
  MT7981> setenv serverip 192.168.1.2
  MT7981> tftpboot 0x46000000 openwrt-mediatek-filogic-airtel_aap4221zy-initramfs-kernel.bin
  MT7981> bootm 0x46000000

4. Once OpenWrt boots from initramfs, transfer and flash the
   sysupgrade image:

  sysupgrade -n /tmp/openwrt-mediatek-filogic-airtel_aap4221zy-squashfs-sysupgrade.bin

5. The device will reboot and zloader will boot OpenWrt from flash.

Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22809
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-24 08:58:55 +02:00
Mieczyslaw Nalewaj
d0cf4c8b3e
generic: backport rtl8365mb SGMII/HSGMII support for RTL8367S
Backport two upstream patches adding SGMII and HSGMII support to the
net/dsa/realtek rtl8365mb driver for the RTL8367S switch:

 - 943-01-v7.3-net-dsa-realtek-rtl8365mb-add-SGMII-support.patch
 - 943-02-v7.3-net-dsa-realtek-rtl8365mb-add-HSGMII-support.patch

The RTL8367S SerDes can be muxed to external interface 1 (typically
the CPU port). SGMII/HSGMII were already listed as supported modes
in the chip info table, but only RGMII was implemented. This adds a
phylink PCS for the SerDes, with the configuration derived from the
GPL-licensed Realtek rtl8367c vendor driver.

Tested on a Mercusys MR80X v2.20 (RTL8367S over HSGMII).

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/24373
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-24 08:49:40 +02:00
Gennaro Cimmino
2c88e6eef3 realtek: dts: declare RTL8264 SerDes lane polarity on Hasivo S1100W-8XGT-SE
The rtl826x PHY driver programs the system-side SerDes lane polarity of
the RTL8264 from the "rx-polarity"/"tx-polarity" devicetree properties,
defaulting to normal polarity when they are absent. The Hasivo
S1100W-8XGT-SE routes half of its high-speed lanes with inverted
polarity, which the vendor bootloader compensates for by setting
HSI_INV/HSO_INV (VEND1 0xC1 bits 6/7) per PHY. Without the properties
the driver clears those bits on every PHY (re-)initialization, which
kills the USXGMII link of every port: egress frames never reach the
wire while the port MAC MIB keeps counting them, and ingress dies with
it (issue #24359 for this board).

Declare the polarity for all eight PHYs, matching the values the
bootloader programs (read back on hardware in the U-Boot state:
alternating HSO_INV/HSI_INV per port pair). The already-supported
S1300WP declares these properties the same way.

Verified on hardware: on a pristine build both traffic directions are
dead; with only this devicetree change, ingress runs at full rate,
egress passes traffic, and the link now survives netifd restarts and
renegotiation. 10GBase-T ports also negotiate 10G instead of falling
back to 5G.

Assisted-by: Claude:claude-fable-5
Signed-off-by: Gennaro Cimmino <gcimmino@rayonra.net>
Link: https://github.com/openwrt/openwrt/pull/24393
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-07-24 08:12:54 +02:00
Hauke Mehrtens
aac6df7bdc mac80211: bump to version 6.18.39
This contains many fixes from upstream Linux.

mac80211/371-wifi-mac80211-Add-eMLSR-eMLMR-action-frame-parsing-s.patch
  adapted to upstream split of include/linux/ieee80211.h

Changes:
```
$ git log --oneline  v6.18.26...v6.18.39 -- drivers/net/wireless/ net/mac80211/ net/wireless/ include/linux/ieee80211*
1de92789ce31 wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers
b0b07e04f0c7 wifi: iwlwifi: mld: fix race condition in PTP removal
df626f284cb9 wifi: iwlwifi: mvm: fix race condition in PTP removal
200d58c851b8 wifi: rtw88: usb: fix memory leaks on USB write failures
73d427d271f7 wifi: rtw88: increase TX report timeout to fix race condition
0aeb4d3ff6ce wifi: rtlwifi: rtl8821ae: Fix C2H bit location in RX descriptor
40aa3c2b0cb8 wifi: ath11k: fix warning when unbinding
a7cdc384c9c5 wifi: mt76: mt7925: don't disable AP BSS when removing TDLS peer
7e25b5e22c1f wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
3c499851753a wifi: mt76: add wcid publish check in mt76_sta_add
37c059d4d92f wifi: mac80211: tests: mark HT check strict
4dac39a4db14 wifi: mac80211: skip ieee80211_verify_sta_ht_mcs_support check in non-strict mode
265c07c09c83 wifi: nl80211: reject oversized EMA RNR lists
ac2000be0cbe wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
fb8db813eba2 wifi: fix leak if split 6 GHz scanning fails
9b40c59bab08 wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
9dca67624721 wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
95c82d498d74 wifi: wilc1000: fix dma_buffer leak on bus acquire failure
55c479aae99b wifi: mac80211: fix MLE defragmentation
2d8379834800 wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs
926a08cf19be wifi: ath11k: fix peer resolution on rx path when peer_id=0
3a74aaad0473 wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it
9e360e610a73 wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled
e1b429d8e712 wifi: ath10k: skip WMI and beacon transmission when device is wedged
d94127d04017 wifi: ath11k: fix error path leak in ath11k_tm_cmd_wmi_ftm()
acde4692afcd wifi: ath11k: fix error path leaks in some WMI WOW calls
2dd9304727c7 wifi: mac80211: consume only present negotiated TTLM maps
6cfae4914439 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()
dc31c6947652 wifi: iwlwifi: mld: stop TX during firmware restart
6fe92651b44f wifi: iwlwifi: mvm: fix driver-set TX rates on old devices
614cacec60fe wifi: ath11k: clear shared SRNG pointer state on restart
254633506626 wifi: ath10k: fix station lookup failure during disconnect
a9937a3ac585 wifi: mac80211: handle VHT EXT NSS in ieee80211_determine_our_sta_mode()
cbea71b44803 wifi: brcmfmac: Fix error pointer dereference
6b9694702c37 wifi: rtw89: phy: fix uninitialized variable access in rtw89_phy_cfo_set_crystal_cap()
a1a8a8bdfa21 wifi: mt76: mt7996: fix RRO EMU configuration
dc34c01521bf wifi: mt76: support upgrading passive scans to active
a2cde15af378 wifi: mt76: fix multi-radio on-channel scanning
98e0118ab51c wifi: mt76: mt7996: Decrement sta counter removing the link in mt7996_mac_reset_sta_iter()
e54c6440114d wifi: mt76: mt7996: Switch to the secondary link if the default one is removed
d6f6b3a65660 wifi: mt76: mt7996: use correct link_id when filling TXD and TXP
5a3353b06387 wifi: mt76: mt7996: Remove link pointer dependency in mt7996_mac_sta_remove_links()
7da35e2d2fb7 wifi: mt76: mt7996: Add missing CHANCTX_STA_CSA property
1e0f3e5e2835 wifi: mt76: mt7921: fix 6GHz regulatory update on connection
aa4a31cd89f4 wifi: mt76: mt7996: fix use-after-free bugs in mt7996_mac_dump_work()
6b7cbb13c838 wifi: mt76: mt7915: fix use-after-free bugs in mt7915_mac_dump_work()
419babee9b5c wifi: mt76: mt7996: fix struct mt7996_mcu_uni_event
ae94ef093a15 wifi: mt76: mt7996: fix wrong DMAD length when using MAC TXP
5fc8c5d45e44 wifi: mt76: fix deadlock in remain-on-channel
35180c772f5e wifi: mt76: mt7921: fix potential deadlock in mt7921_roc_abort_sync
153bcba36c87 wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync
e125def8b380 wifi: mt76: mt7925: drop puncturing handling from BSS change path
a1a59bd3cd1e wifi: mt76: mt7925: cqm rssi low/high event notify
dcbc13d19bef wifi: mt76: Fix memory leak destroying device
35835ff71e6e wifi: mt76: mt7921: Place upper limit on station AID
e00c27608536 wifi: mt76: mt7996: fix FCS error flag check in RX descriptor
815db7fd57aa wifi: mt76: mt7925: prevent NULL vif dereference in mt7925_mac_write_txwi
93d0694fb56d wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_tx_check_aggr()
b81a93dc0aed wifi: mt76: mt7915: fix use_cts_prot support
729b4adad191 wifi: mt76: mt7615: fix use_cts_prot support
9aa3b49e1c5b wifi: mt76: mt7925: Fix incorrect MLO mode in firmware control
3880639cec09 wifi: mt76: mt7921: Reset ampdu_state state in case of failure in mt76_connac2_tx_check_aggr()
1e16b0a9b988 wifi: mt76: mt7996: Reset ampdu_state state in case of failure in mt7996_tx_check_aggr()
455a48685fee wifi: mt76: mt7996: Clear wcid pointer in mt7996_mac_sta_deinit_link()
6d7f231d5fff wifi: mt76: mt7996: Reset mtxq->idx if primary link is removed in mt7996_vif_link_remove()
15205c72f1ec wifi: mt76: mt7996: Set mtxq->wcid just for primary link
900579479395 wifi: mt76: mt7996: fix iface combination for different chipsets
096b74331df2 wifi: mt76: mt7996: fix the behavior of radar detection
00c0317cebf4 wifi: libertas: don't kill URBs in interrupt context
a761a1539a55 wifi: libertas: use USB anchors for tracking in-flight URBs
0ee803fc4787 wifi: ieee80211: fix definition of EHT-MCS 15 in MRU
dd827cff429d wifi: ieee80211: split EHT definitions out
df5720d35848 wifi: ieee80211: split HE definitions out
f8d1e8038bc7 wifi: ieee80211: split VHT definitions out
4d5caab09dab wifi: ieee80211: split HT definitions out
3f459076b2d8 wifi: ieee80211: split mesh definitions out
aa10a452e348 wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet
9fe48cacab63 wifi: mwifiex: Fix memory leak in mwifiex_11n_aggregate_pkt()
658d2e46c2e9 wifi: brcmfmac: Fix potential use-after-free issue when stopping watchdog task
d7029879bafd wifi: b43: enforce bounds check on firmware key index in b43_rx()
9e28654f79f4 wifi: mac80211: remove station if connection prep fails
e9f1081bc775 wifi: ath5k: do not access array OOB
7577a4b8a10f wifi: mac80211: use safe list iteration in radar detect work
4f9a4ae8d2c1 wifi: rsi: fix kthread lifetime race between self-exit and external-stop
e131562d6f2b wifi: mac80211: drop stray 'static' from fast-RX rx_result
9d1bc1558029 wifi: b43legacy: enforce bounds check on firmware key index in RX path
6d55948a62ab wifi: mt76: mt7921: fix ROC abort flow interruption in mt7921_roc_work
0aa63d33742b wifi: mt76: mt7921: fix a potential clc buffer length underflow
6fc7c8b414ce wifi: mt76: mt7925: fix incorrect length field in txpower command
5860ab3ddeaa wifi: mt76: mt7925: fix AMPDU state handling in mt7925_tx_check_aggr
8c4339dbab49 wifi: mt76: mt7925: fix incorrect TLV length in CLC command
7d7863018f40 wifi: mt76: mt792x: fix mt7925u USB WFSYS reset handling
0bc155c4ca47 wifi: mt76: mt792x: describe USB WFSYS reset with a descriptor
69c4d137b22d wifi: rtl8xxxu: fix potential use of uninitialized value
4e179a60a60c wifi: mwifiex: fix use-after-free in mwifiex_adapter_cleanup()
000134a20bbf wifi: rtw88: check for PCI upstream bridge existence
```

Link: https://github.com/openwrt/openwrt/pull/24353
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-07-23 21:47:25 +02:00
Markus Stockhausen
db5bb8d065 realtek: mdio: Add polling configuration for RTL8264
RTL8264 polling is not configured until now. Boot log gives
"skip polling setup for phy 0x001ccaf2 on port xx". Add the
PHY features to rtmd_get_phy_info().

Link: https://github.com/openwrt/openwrt/pull/24392
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-07-23 21:45:04 +02:00
Paul Spooren
60cf4aa958
build: make GL.iNet metadata reproducible
The GL.iNet specific metadata contains a `date`-field which takes the current
timestamp instead of using SOURCE_DATE_EPOCH. This commits make use of the
variable, if available.

Signed-off-by: Paul Spooren <mail@aparcar.org>
2026-07-23 14:39:19 +02:00
Paul Spooren
0d42a1258f
mvebu: improve reproducibility of ctera firmware
Tar happily stores the username, which my vary on different build machines. Set
it to numerical and 0.

Signed-off-by: Paul Spooren <mail@aparcar.org>
2026-07-23 13:20:23 +02:00
Paul Spooren
9292f32fd9
toolchain: drop $(REVISION) from GCC version
Storing the ever changing revision in the GCC binary may result in leakage in
package builds. If two equal GCC versions build the same package version with
different OpenWrt revisions, the package becomes unreproducible.

Solve this by dropping the revision.

Below is an example of the `cni` package:

    │ ├── readelf --wide --decompress --string-dump=.comment {}
    │ │ @@ -1,4 +1,4 @@
    │ │
    │ │  String dump of section '.comment':
    │ │ -  [     0]  GCC: (OpenWrt GCC 14.4.0 r35470-1b2aeb4f8a) 14.4.0
    │ │ +  [     0]  GCC: (OpenWrt GCC 14.4.0 r35485-0f256a0a7a) 14.4.0

Signed-off-by: Paul Spooren <mail@aparcar.org>
2026-07-23 13:20:23 +02:00
Kyle Hendry
0622567492
bcm47xx: refresh 6.18 patches
- Manually rebase 830-huawei_e970_support.patch
- Update .remove_new to .remove in 831-old_gpio_wdt.patch, see
commit e70140ba0d2b1a30467d4af6bcfe761327b9ec95
- make target/linux/refresh the rest

Signed-off-by: Kyle Hendry <kylehendrydev@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24358
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-23 09:08:57 +02:00
Kyle Hendry
6fc18a3c3d
bcm47xx: refresh 6.18 config
CONFIG_PAGE_BLOCK_MAX_ORDER was set to the default of 11

Refresh config with make kernel_oldconfig

Signed-off-by: Kyle Hendry <kylehendrydev@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24358
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-23 09:08:56 +02:00
Kyle Hendry
2dee7d415a
bcm47xx: enable 6.18 testing kernel
Allow selecting 6.18 as testing kernel on bcm47xx.

Signed-off-by: Kyle Hendry <kylehendrydev@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24358
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-23 09:08:56 +02:00
Kyle Hendry
3cfc4e4547
bcm47xx: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.

For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html

Signed-off-by: Kyle Hendry <kylehendrydev@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24358
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-23 09:08:56 +02:00
Kyle Hendry
55f8c5b606
bcm47xx: create files for v6.18 (from v6.12)
This is an automatically generated commit.

When doing `git bisect`, consider `git bisect --skip`.

Signed-off-by: Kyle Hendry <kylehendrydev@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24358
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-23 09:08:55 +02:00
David Bauer
f937146fa1 mtd mtdsplit-fit: fix potential out of bounds read
Account the offset_start in the bounds check of the for loop. This was
previously missing, differing in check and actual read.

Signed-off-by: David Bauer <mail@david-bauer.net>
2026-07-23 01:05:30 +02:00
David Bauer
f8386008c0 mtd mtdsplit-fit: fix fit not found case
Attempting to parse the mtdsplit-fit device can lead in a out of bounds
read error, as the driver did not validate a fit was found at all.

This can happen if the fit size in the header at the last scan iteration
is non-zero. In this case, the dmesg reads:

[    6.563676] Creating 6 MTD partitions on "ec000000.nor":
[    6.569058] 0x000000000000-0x000003d60000 : "firmware"
[    6.579192] read error in "firmware" at offset 0x3d60000
[    6.584534] Failed to parse subpartitions: -22
[    6.589010] Deleting MTD partitions on "ec000000.nor":

Validate after the scan loop if a fit image was found and abort in this
stage if it is not found.

Signed-off-by: David Bauer <mail@david-bauer.net>
2026-07-23 01:05:30 +02:00
Josef Schlehofer
7aa4eebc75
github: downgrade require_linked_github_account to warning
Some contributors still submit patches via the mailing list or are
not using GitHub entirely, so an unlinked commit author email
should not be treated as a hard failure.

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24320
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 23:01:54 +02:00
Yubo Zhang
1ea29a6f49
airoha: an7583: adjust thermal polling delays
The CPU thermal zone in an7583.dtsi sets the polling-delay-passive to
10000 ms while the polling-delay is 5000 ms. The thermal driver rejects
zones whose passive polling delay is greater than the regular polling
delay, causing thermal_zone0 registration to fail with -EINVAL.

Reduce the passive polling delay to 1000 ms to fix thermal_zone0
registration.

Boot log:
thermal_sys: Failed to register thermal zone cpu-thermal: -22
... register thermal zone sensor failed
... probe with driver airoha-thermal failed with error -22

Signed-off-by: Yubo Zhang <zyb_1998@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24337
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 17:20:30 +02:00
Caleb James DeLisle
3ae630b5b8
econet: add ChinaMobile GS3101
The ChinaMobile GS3101 has:
256MB RAM
256MB flash (TC58CVG1S3H)
1x MT7603 802.11 b/g/n - DISABLED
1x optical port
On-die MT7530 switch with:
- 1x gigabit ethernet port
- 3x 100Mb ethernet ports
1x USB 2.0 port
1x telephone VoIP port
3 controllable LEDs
1 GPIO button (reset), 1 WPS button (not detected in GPIOs)
UART header inside (solder required) 115200 baud
12v power (5.5mm x 2.1mm barrel connector)

Installation instructions: You will need a USB stick
1. Reformat the USB stick as VFAT with MBR partition table. This is important,
if it is GPT then it will silently fail to load.
2. Download openwrt-econet-en751221-chinamobile_gs3101-squashfs-tclinux.trx and
store it in the USB stick.
3. Start the device with the vendor OS
4. Connect a cable and request an IP address - it will issue in 192.168.1.0/24
5. Use telnet to connect to the modem on 192.168.1.1
6. Login as root@2024 / system
7. Plugin the USB stick
8. cp /mnt/usb1_1/openwrt-econet-en751221-chinamobile_gs3101-squashfs-tclinux.trx /tmp/openwrt.trx
9. mtd -r -f write /tmp/openwrt.trx tclinux
10. You will lose your shell, look at the power light on the device, it should
begin blinking and then go back to solid. You should NOT see any red light.
11. re-request an IP address
12. ssh root@192.168.1.1
13. You should be on OpenWrt now

MAC address matches that of vendor OS but it is not the address on the label
of the device. It is in a compressed xml file in the 'romfile' partition.
WAN is this mac, LAN is mac+1 and 2.4Ghz WLAN is mac+2, there is no 5Ghz WLAN.

Wifi Note: Of the devices tested, there were numerous upon which starting the
wlan chip caused the CPU to hang. In the interest of avoiding bricked boards,
the wlan is disabled in the DT.

Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/23533
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 17:11:24 +02:00
Caleb James DeLisle
77eda1ad1e
econet: add EN7526F chip variant
The EN7526F is a varient of the EN751221 with one USB port and one PCI
port only. Add a dtsi file for this chip varient.

Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/23533
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 17:11:23 +02:00
Caleb James DeLisle
04c747b3fc
econet: tclinux-trx.sh make rootfs optional and move padding to kernel
The TRX header contains a checksum of the full kernel and rootfs length. Vendor
OS uses a raw squashfs on the NAND and relies on the BMT to resolve bad block
issues. OpenWrt typically uses UBI on NAND and places the root squashfs inside
of that. Since UBI changes over time, checksumming over it would cause a boot
failure later on. However, vendor TRX installers typically the entire file as
uploaded, without regard for the declared kernel and rootfs lengths.

Make --rootfs optional so that a UBI rootfs can be appended but excluded from
the checksum.

Secondly, this script previously prepended padding to the rootfs in order to
move the beginning of the rootfs 4MB away from the TRX header (the max kernel
size). That prepended padding was included in the rootfs length/checksum.

There is a bug https://econet-linux.pkt.wiki/en/bootloader#a-length-bug in some
versions of the bootloader which causes the bootloader to always use the length
of the first kernel, even if it is booting the second. The impact of this is if
the second slot kernel is larger than the first, it will fail to boot. Smaller
is okay because LZMA will stop when it is done.

Move padding from rootfs to kernel and include it in the length/checksum of the
kernel so that the kernel will always register as being 4MB-minus-TRX-header in
length. Therefore if A/B upgrading is used in the future, this bug will not
occur even if an upgrade with a larger kernel is installed into slot B.

Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/23533
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 17:11:23 +02:00
Caleb James DeLisle
da78b5a384
econet: add GPIO/LEDs and mtd-concat support to EN751221
In prep for more fully supporting EN751221, add GPIO, LED, and
mtd-concat.

Signed-off-by: Caleb James DeLisle <cjd@cjdns.fr>
Link: https://github.com/openwrt/openwrt/pull/23533
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 17:11:23 +02:00
David Bauer
bd7188a81e ramips esw-rt3050: read port flow-control state
Read flow-control state of the fast ethernet as well as gig-e ports.

The fast ethernet ports only read a combined state for TX and RX
flow-control, the gigabit / CPU ports read a per-direction FC state.

Signed-off-by: David Bauer <mail@david-bauer.net>
2026-07-22 14:46:28 +02:00
Stijn Segers
64315f29c4
realtek: use Realtek PSE MCU driver for GS1900-8HP A1
Switch the GS1900-8HP A1 to the PSE driver that is being upstreamed.

Signed-off-by: Stijn Segers <foss@volatilesystems.org>
Link: https://github.com/openwrt/openwrt/pull/24339
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 10:20:20 +02:00
Andris PE
1186b585ef
kernel: minimize kmod-sched-ctinfo dependencies
Do not pull iptables core for kmod-sched-ctinfo, only nf-conntrack,
reflecting kernel config dependencies.

There is no use of this module in openwrt repos, but it is used by
@hudra0 qosmate
and some less popular qos scripts.

Signed-off-by: Andris PE <neandris@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24104
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 10:17:49 +02:00
Rosen Penev
0ca7895173
kernel: use fwnode for GPIO export driver
Upstream prefers more generic fwnode/device handlers as opposed to OF
ones.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24176
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 10:14:05 +02:00
Rustam Adilov
4ff901f165
realtek: watchdog: backport upstream regmap patch
The patch to replace mmio access in the realtek watchdog
driver with regmap API has been accepted upstream [1].

Backport them here as this is one of the steps required
for a working system with SWAP_IO_SPACE config enabled.

[1] https://lore.kernel.org/linux-watchdog/20260710074316.46643-1-adilov@disroot.org/

Signed-off-by: Rustam Adilov <adilov@tutamail.com>
Link: https://github.com/openwrt/openwrt/pull/24169
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 10:10:05 +02:00
Rustam Adilov
2b156e77ba
realtek: watchdog: backport watchdog fix patches
Some issues were noticed with watchdog driver while the work
on bringing regmap API was being done.
The patches have been long accepted and are already in v7.2
of linux kernel.

As a prerequisite to the regmap patch, backport them to OpenWrt.

Signed-off-by: Rustam Adilov <adilov@tutamail.com>
Link: https://github.com/openwrt/openwrt/pull/24169
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-22 10:10:04 +02:00
Felix Fietkau
2c64257627 wifi-scripts: support multiple device paths per board.json wlan entry
The path field of a board.json wlan entry may now be an array of
device paths. ucidef_add_wlan accepts several leading path arguments
and stores them as a JSON array; a single path is still stored as a
plain string for backwards compatibility. A phy is matched if it
corresponds to any of the listed paths, so a radio that enumerates on
a non-deterministic PCI path still resolves to the correct named phy.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-07-22 09:32:52 +02:00
Hauke Mehrtens
b5191da03c rpcd: update to Git HEAD (2026-07-19)
e37ed9d81469 file: re-authorize ACL against resolved path to close symlink bypass

Link: https://github.com/openwrt/openwrt/pull/24329
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-07-21 22:59:58 +02:00
Markus Stockhausen
fb69055ed5 realtek: eth: rename packet to frag
Since the jumbo frame preparation the driver can work on fragments
and not only on complete packets in the receive path. This might be
implementet in the transmit patch in the future too. So a chunk of
data is best described as a fragment. Rename all occurrences.

Link: https://github.com/openwrt/openwrt/pull/24346
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-07-21 21:02:00 +02:00
Markus Stockhausen
57850d4bef realtek: eth: move tx skb into driver-only structure
The TX path stores the skb information in the coherent part. This
is only needed by the driver. Move it to its proper location.

Link: https://github.com/openwrt/openwrt/pull/24346
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-07-21 21:02:00 +02:00
Markus Stockhausen
25e30fd274 realtek: eth: move page/pool into driver structure
The paged pool handling is only required for the driver and not
for the SOC. Move it into the driver-specific part.

Link: https://github.com/openwrt/openwrt/pull/24346
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-07-21 21:02:00 +02:00
Markus Stockhausen
1588766cee realtek: eth: change skb helper function signatures
It is easier to work with ring/slot when shifting around variables
in the different structures. Replace packet pointers in existing
function signatures.

Link: https://github.com/openwrt/openwrt/pull/24346
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-07-21 21:01:59 +02:00
Markus Stockhausen
771f370d74 realtek: eth: add driver-only transmit info structure
Remove driver-only data from the coherent transmit structure.
It is not needed to keep this in uncached memory as the SOC
does not need access to it.

Link: https://github.com/openwrt/openwrt/pull/24346
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-07-21 21:01:59 +02:00
Markus Stockhausen
289011eac0 realtek: eth: Rename coherent structures
In the past the ring handling was split into a coherent (SOC/driver shared)
and a driver-only part. Give the coherent structure a meaningful name.

Link: https://github.com/openwrt/openwrt/pull/24346
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-07-21 21:01:59 +02:00
Carlo Szelinsky
b3ff21a2ec
realtek: rtl9303: enable PSE on Hasivo S600WP-5GT-2SX-SE
Wire the HS104 controller (0x0d) on the PSE i2c-gpio bus and attach the
four PoE PHYs (lan1-4) via PHY_C45_PSE; lan5 is not PoE. Add the STC8 LED
MCU (0x4d) with per-port PoE LED triggers, and pull the HS104 PSE and STC8
kmods into the image.

Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Link: https://github.com/openwrt/openwrt/pull/22245
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-21 18:59:27 +02:00