Hauke Mehrtens [Sun, 5 Oct 2025 17:31:09 +0000 (19:31 +0200)]
mac80211: Update to version 6.12.52
This includes the following commits from upstream Linux between 6.12.44
and 6.12.52:
```
$ git log --reverse --oneline v6.12.44...v6.12.52 -- drivers/net/wireless/ net/mac80211/ net/wireless/ 5b7ae04969f8 wifi: cfg80211: fix use-after-free in cmp_bss() 3e789f8475f6 wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work d9f2fb6a2ac8 wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() 1fb26fd3f601 wifi: mt76: prevent non-offchannel mgmt tx during scan/roc 2aef3667e6b0 wifi: mt76: free pending offchannel tx frames on wcid cleanup e4d5a5fc61fd wifi: mt76: fix linked list corruption c2e32ac3f107 wifi: iwlwifi: uefi: check DSM item validity 609a8ffff5a0 wifi: ath11k: fix group data packet drops during rekey cedbbba8a8e8 wifi: cw1200: cap SSID length in cw1200_do_join() 92bedee7168d wifi: libertas: cap SSID len in lbs_associate() 31229145e6ba wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() 06616410a3e5 wifi: mwifiex: Initialize the chan_stats array to zero a001c2f6a40c wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete eefa2ad9009b wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() 089fd41902ee wifi: mt76: mt7925: fix the wrong bss cleanup for SAP 26618c039b78 wifi: ath11k: update channel list in reg notifier instead reg worker fa4abd439f27 wifi: ath11k: update channel list in worker when wait flag is set 2203ef417044 wifi: wilc1000: avoid buffer overflow in WID string configuration 32adb020b0c3 wifi: mac80211: increase scan_ies_len for S1G 8df33f4d4a0b wifi: mac80211: fix incorrect type for ret 79dc6d4932de wifi: virt_wifi: Fix page fault on connect 1f52119809b7 wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() 895cccf639ac wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() 914d02595ba6 wifi: rtlwifi: rtl8192cu: Don't claim USB ID 07b8:8188 1713796d6538 wifi: rtl8xxxu: Don't claim USB ID 07b8:8188
```
Removed ath11k/940-ath11k-Revert-clear-the-keys-properly-when-DISABLE_K.patch
This problem is fixed by: 609a8ffff5a0 wifi: ath11k: fix group data packet drops during rekey
Coia Prant [Tue, 10 Dec 2024 15:18:13 +0000 (23:18 +0800)]
ramips: add support for Qding QC202
This is a smart door lock device equipped with OpenWrt 14.07 OEM
modified version Qdwrt
The OEM has closed down, This commit is intended to maximize the
remaining value of these devices. It can flash OpenWrt to become
an AP
Specification:
- SoC: MediaTek MT7628NN
- Flash: 8 MB
- RAM: 64 MB
- Power: DC 5V - 25V
- Ethernet: 1 x RJ45 (10/100 Mbps)
- Wireless radio: 802.11n 2.4g-only
- On-Board LED:
Status 1: GPIO/43 active-low
Status 2: GPIO/44 active-low
Power: AlwaysOn
- Button:
WPS / RESET: GPIO/14 active-low
- Bluetooth: CC2541 via UART1 (ttyS1) and GPIO/26-29
- RFID: MF RC522 on I2C@28
- RTC: DS1339 on I2C@68
- Shell (via CON1 cable)
- LED (Swipe card area):
- Green GPIO/3 active-high
- Red GPIO/11 active-high
- Matrix keypad: (active-low)
GPIO/20 GPIO/21 GPIO/19 (Rows)
GPIO/24 1 2 3
GPIO/25 4 5 6
GPIO/22 7 8 9
GPIO/23 BACK 0 ENTER
(Cols)
- UART: 1 x UART on PCB - 57600 8N1
- GPIO Relay: GPIO/42 active-high
- GPIO Buzzer: GPIO/15 active-high
Warning:
The original firmware does not use the device tree.
This device tree is written based on the content of /sys/devices/platform
and has been tested
Note:
- On the device, matrix keypad rows actually are columns, and the columns actually are rows
- The key code of the CLEAR key of the matrix keypad is BACK in the original firmware.
Issue:
- No drivers in mainline kernel for RFID and Bluetooth.
Flash Instruction:
Using SSH/Telnet:
1. Connect the board to the computer via RJ45 Ethernet
2. Login 10.10.10.1 with root password "szqdingnet123" (SSH Port 22, Telnet Port 9900)
3. Download openwrt firmware on the computer.
4. Setup a http server on computer. And use wget download openwrt firmware from computer
5. Use command "mtd -r write openwrt-ramips-mt76x8-qding_qc202-squashfs-sysupgrade.bin firmware"
to flash
Using U-Boot WebUI:
1. Configure PC with a static IP address 10.10.10.2/24.
2. Open http://10.10.10.1
3. Use "mkqdimg -B qc202 -f openwrt-ramips-mt76x8-qding_qc202-squashfs-sysupgrade.bin" to
make image.
4. Upload factory.bin via U-Boot WebUI.
Original Firmware Dump / More details:
https://blog.gov.cooking/archives/research-qianding-smart-locker-and-flash.html
Original U-Boot firmware image tools:
https://gitlab.com/CoiaPrant/mkqdimg
Coia Prant [Wed, 1 Oct 2025 07:55:57 +0000 (15:55 +0800)]
ramips: Fix Hongdian H7920 v40 pinctrl default state
According to the MT7628 hardware datasheet:
- GPIO/4 was originally used for I2C, but is now used as the Modem Power.
- GPIO/5 was originally used for I2C, but is now used as the SIM card select. (n/a for this device)
- GPIO/6 was originally used for SPI CS1, but is now used as the Serial mode switch.
- GPIO/36 was originally used for PERST, but is now used as the GPS OE. (n/a for this device)
- GPIO/38 was originally used for WDT, but is now used as the Modem2 Power. (n/a for this device)
- GPIO/44 was used for WLED_AN, but is now controlled by `gpio-leds`.
Corrected pinctrl to ensure it works properly in the future.
Ondrej Cierny [Fri, 27 Jun 2025 02:39:37 +0000 (19:39 -0700)]
download: improve rawgit tar reliability
Packages that depend on rawgit can fail on systems with the tar UID
issue (https://bugzilla.redhat.com/show_bug.cgi?id=913406).
Fix this by adding tar flags to overwrite UID/GID, as in the
dl_tar_pack method.
mac80211: ath: improve ath10k "failed to flush transmit queue" errors
Currently, in busy environments, ath10k logs "failed to flush transmit
queue" errors and have a spiking CPU usage, making the wireless barely
usable.
With this patch, taken from https://patchwork.kernel.org/project/linux-wireless/patch/20250806070005.1429-1-hujy652@gmail.com/
this does not occur in normal operation and the wifi is much more stable
John Audia [Thu, 11 Sep 2025 19:37:51 +0000 (15:37 -0400)]
x86: config: add CONFIG_MITIGATION_VMSCAPE=y
Introduced in the 6.6.106 update, set this new mitigation option to
be enabled. See: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/diff/arch/x86/Kconfig?id=v6.6.106&id2=v6.6.105
Oliver Sedlbauer [Fri, 19 Sep 2025 10:42:15 +0000 (12:42 +0200)]
mac80211: backport EHT 1024 MPDU TX aggregation
Backport support for 1024 MPDU TX aggregation in EHT from upstream
kernel. Without this fix, TX performance on WiFi-7 links
is severely limited, making the link practically unusable.
Signed-off-by: Oliver Sedlbauer <osedlbauer@tdt.de>
David Bauer [Sun, 14 Sep 2025 09:07:38 +0000 (11:07 +0200)]
uqmi: fix data-format parsing
wda-get-data-format now returns an object instead of a single string.
Account for this change when reading the packet data format.
Suggested-by: Sebastian Ertz (https://github.com/sebastianertz) Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit cd20ae44f22d7a10d3522ad94894ca34828fa163)
gettext-full only provides libintl which is not licensed under
GPL-3.0.-or-later but under LGPL-2.1-or-later as stated in
gettext-runtime/intl/COPYING.LIB
elfutils libraries are not licensed under GPL-3.0-or-later, they are dual
licensed: GPL-2.0-or-later OR LGPL-3.0-or-later as clearly stated in
source files as well as on https://sourceware.org/elfutils:
The libraries and backends are dual GPLv2+/LGPLv3+. The utilities are GPLv3+.
Jan Kardell [Mon, 8 Sep 2025 06:52:40 +0000 (08:52 +0200)]
libxml2: Add abi version
The version of libxml2 was bumped from 2.13.6 to 2.14.5. Since version
2.14, libxml2 is not binary compatible with older versions. Therefore
add an abi version.
From the NEWS file:
Binary compatibility is restricted to versions 2.14 or newer. On ELF
systems, the soname was bumped from libxml2.so.2 to libxml2.so.16.
MAC address
-----------
+-----------+-------------------+-----------------------+
| Interface | MAC | Algorithm |
+-----------+-------------------+-----------------------+
| WLAN 2.4G | B0:38:6C:48:xx:xx | label |
| WLAN 5G | B2:38:6C:48:xx:xx | label with LA Bit Set |
| WAN | B0:38:6C:48:xx:xx | label + 1 |
| LAN | B0:38:6C:48:xx:xx | label + 3 |
+-----------+-------------------+-----------------------+
The WLAN 2.4G MAC was found in 'Factory' partition, 0x4
Installation
------------
1. Download the OEM recovery software from the manufacturer's website
2. Download the *squashfs-factory.bin file from the OpenWrt website
3. Press a reset button, and power up the router(keep pressing the reset button)
4. Wait more than 10 seconds until the CPU LED stop blinking
5. Connect the router(LAN port) to the PC
6. Replace a file in the OEM recovery software with the file from step 2
7. Run the OEM recovery software and follow the instructions
8. Wait for the router to boot from *squashfs-factory.bin
Donghyun Ko [Tue, 22 Jul 2025 17:20:27 +0000 (02:20 +0900)]
mediatek: add factory image for ipTIME AX3000SM
Adds the capability to flash the factory image using the OEM recovery
software, ipTIME Firmware Wizard(11ac).
Installation
------------
1. Download the OEM recovery software from the manufacturer's website
2. Download the *squashfs-factory.bin file from the OpenWrt website
3. Press a reset button, and power up the router(keep pressing the reset button)
4. Wait more than 10 seconds until the CPU LED stop blinking
5. Connect the router(LAN port) to the PC
6. Run the OEM recovery software and follow the instructions
7. Select the *squashfs-factory.bin file during the router recovery process
8. Wait for the router to boot from *squashfs-factory.bin
update patch to upstream function change
bcm53x/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
changed function xhci_disable_and_free_slot() upstream [3]
lantiq/patches-6.6/0152-lantiq-VPE.patch [9]
rockchip: fix eMMC corruption on NanoPC-T6 with A3A444 chips
Some NanoPC-T6 boards with A3A444 eMMC chips experience I/O errors and
corruption when using HS400 mode. Downgrade to HS200 mode to ensure
stable operation.
Hauke Mehrtens [Sun, 31 Aug 2025 23:52:47 +0000 (01:52 +0200)]
rpcd: update to git openwrt-24.10 branch HEAD
8b320f9 ucode: adjust for new ext resource type e61d2be sys: use strstr() to detect installed packages bba9519 rpc-sys: packagelist: don't truncate input lines on read
tools: firmware-utils: update to Git HEAD (2025-07-24)
075cdc0 iptime-crc32: add support for ipTIME AX3000Q 48ababa iptime-crc32: add support for ipTIME AX3000SM f29de74 iptime-crc32: Add device support for ipTIME AX6000M
realtek: avoid interrupt storm on mass packet receive
RTL83xx devices have two types of receive interrupts for each of its
8 rings. One for packet received and another for ring overflow. When
the switch is flooded with incoming packets the receive handler will
disable the packet receive notification but still keeps the overflow
notification enabled. While the receive path "slowly" processes the
received packets each new packet triggers the overflow IRQ again. The
device becomes unresponsive and eventually produces messages like:
[18441.709764] rcu: Stack dump where RCU GP kthread last ran:
[18441.727892] Sending NMI from CPU 1 to CPUs 0:
[18441.742300] NMI backtrace for cpu 0 skipped: idling at 0x8080e994
[18415.251700] rcu: INFO: rcu_sched detected stalls on CPUs/tasks:
[18415.271350] rcu: 0-...!: (0 ticks this GP) idle=d740/0/0x0 ...
[18415.303046] rcu: (detected by 1, t=6004 jiffies, g=230925, ...
[18415.326095] Sending NMI from CPU 1 to CPUs 0:
[18415.340540] NMI backtrace for cpu 0
Fix this issue by always disabling receive and overflow interrupts at
the same time.
Test with hping3 --udp -p 5021 -d 1400 --flood 192.168.2.72
Before (3sec run):
[183260.324846] rtl838x-eth 1b00a300.ethernet eth0: RX buffer overrun: status 0x101, mask: 0x7ffeff
[183260.340524] rtl838x-eth 1b00a300.ethernet eth0: RX buffer overrun: status 0x1, mask: 0x7ffeff
[183260.345799] net_ratelimit: 489997 callbacks suppressed
After (3 sec run):
[ 373.981479] rtl838x-eth 1b00a300.ethernet eth0: rx ring overrun: status 0x101, mask: 0x7fffff
[ 374.031118] rtl838x-eth 1b00a300.ethernet eth0: rx ring overrun: status 0x101, mask: 0x7fffff
[ 377.919996] net_ratelimit: 34 callbacks suppressed
Daniel Golle [Tue, 10 Jun 2025 16:51:14 +0000 (18:51 +0200)]
ipq-wifi: add BDF for IgniteNet SS-W2-AC2600
The IgniteNet SunSpot AC Wave2 comes with 2x QCA9994 ath10k chips
connected to the IPQ8068 SoC via PCIe.
Add board-2.bin for both radios on this board.
3ac4a64 qca9984: add BDFs for IgniteNet SS-W2-AC2600
Mathew McBride [Thu, 16 Jan 2025 01:27:58 +0000 (12:27 +1100)]
armsr: remove 'console=tty1' from kernel command line
We have modified the kernel to setup all "default" consoles,
including serial ports and framebuffers/screens, providing
no console= argument is supplied on the kernel command line.
Adding 'console=tty1' caused the 'default' serial port on
device tree systems to break, as the kernel would not carry
over the settings (like baud rate) from the bootloader.
The system administrator can still force the use of a
specific console by adding their own console= arguments.
Mathew McBride [Thu, 16 Jan 2025 01:20:56 +0000 (12:20 +1100)]
armsr: add patch (hack) to enable all "default" consoles
A previous change added 'console=tty1' to the default kernel command
line on armsr, in order to ensure the framebuffer console is enabled
on systems capable of graphics output.
Unfortunately, this change broke boards that used device tree
(DT) firmware with serial consoles, as the serial console
specified by the system firmware (stdout-path) was no longer
setup by the kernel.
A bit of probing determined that the SPCR (serial port console
direction table) on ACPI systems was preventing Linux from setting
up a default framebuffer console on these systems (which is why
console=tty1 was added).
(The affected ACPI systems are usually VMs using QEMU's
'virt' machine and EDK2 firmware. The firmware on these systems
does not remove the SPCR when a screen is present)
So to ensure all possible systems are setup correctly, we modify
the kernel so all "default" console types (serial and screen)
are setup when no console= arguments are specified on the kernel
command line.
Felix Fietkau [Sun, 24 Aug 2025 05:18:43 +0000 (07:18 +0200)]
udebug: update to Git HEAD (2025-08-24)
6e4ffe2c6657 ucode: add function for getting the number of entries in a snapshot a62edd89255b ucode: add support for fetching kernel tracepoint events edeb4d6dc690 udebug-cli: add support for streaming tracing data
Hauke Mehrtens [Thu, 21 Aug 2025 20:07:06 +0000 (22:07 +0200)]
kernel: Remove patch for fixed bug
The problem was fixed in upstream kernel in a different way and the
change was backported to kernel 6.6 in the following change:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-6.6.y&id=48e8791843206baf76827df1b6ee3cb88a2a17d8
The removed patch changes the endianness again and breaks the
functionality, use only the upstream code and remove our unneeded patch.
The 823-v6.12-0003-nvmem-layouts-add-U-Boot-env-layout.patch patch was
adapted in the kernel bump too. It moves the code with the fix now.
Stefan Dösinger [Sat, 9 Aug 2025 14:29:38 +0000 (17:29 +0300)]
ramips: fix TP-Link mr600 radio partition offset
This makes 5ghz WiFi work out of the box on these devices, eliminating
the need to flash a magic blob to the radio partition.
This was found by user BulldozerBSG on the OpenWRT Forums:
https://forum.openwrt.org/t/tp-link-archer-mr600-exploration/65489/20
All credit belongs to them. I can confirm the correctness of the
findings. At least one other user (Iggy87100) confirmed them too.
The vendor DTS defined incorrect GPIOs for the LEDs, which caused them
to not function properly. Initially, the WAN, WLAN LEDs appeared to
work, but further testing showed that they were non-functional.
This patch corrects the GPIO assignments in the DTS, restoring full LED
functionality including blinking, except the power LED which cannot be
software controlled.
Daniel Golle [Thu, 31 Jul 2025 18:48:32 +0000 (19:48 +0100)]
kernel: add backport to fix broken PHY LEDs
A commit which broke netdev trigger LEDs offloaded to PHYs recently made
it all the way down to the Linux 6.6 stable branch. The revert has been
accepted to linux-next, however, a backport to the various -stable trees
is still pending.
Import the backported revert commit to fix in OpenWrt in the meantime
until the revert also gets picked to linux-stable.
This enables software that requires this cipher suite (e.g. OpenThread Border
Router) to be compiled against the shared library rather than a separate copy.
[ Alexander Kanavin ]
* update-ca-certificates: add a --sysroot option
[ Julien Cristau ]
* Update Mozilla certificate authority bundle to version 2.74.
The following certificate authorities were added (+):
+ D-TRUST BR Root CA 2 2023
+ D-TRUST EV Root CA 2 2023
The following certificate authorities were removed (-):
- Entrust Root Certification Authority - G4
- SecureSign RootCA11
- Security Communication RootCA3
- SwissSign Silver CA - G2
Note inspiration for this script to give credit where it's due
There is some confusion in the Git log of this file. Specifically,
the commit message on 7b7f1702 incorrectly indicates that there was
"potential fear" about copyright infringement.
Upon review of this situation, there is, in my opinion, no concern of
copyright infringement here. This is not legal advice; it is my
opinion based of years of work on copyright policy for FOSS.
However, Elliott Mitchell's idea was obviously helpful as inspiration
in writing this script and deserves credit. Ideas alone, however,
are not to my knowledge copyrightable anywhere in the world.
Jan Hoffmann [Fri, 11 Jul 2025 18:31:29 +0000 (20:31 +0200)]
ltq-adsl-mei: check status register before reading mailbox messages
The interrupt handler reads from the mailbox if no other reason for the
interrupt is known. If a spurious interrupt is received just after a
mailbox message has been sent, this means that the response to the
previous message is read again and returned by DSL_BSP_SendCMV instead
of the actual response.
To fix this, check the status register before reading from the mailbox
in the interrupt handler.
Tested on Fritzbox 7320. Without this change, there is occasionally a
kernel panic due to an out-of-bounds memory access in the ltq-adsl
driver (in DSL_DRV_DEV_G997_SnrAllocationNscGet), as a result of an
incorrect value returned by DSL_DRV_DANUBE_CmvRead. This is reproducible
by calling "dsl_cpe_pipe.sh g997dsnrg 1 1" multiple times.
projects / thirdparty / openwrt.git / log
