Chad Monroe [Tue, 11 Aug 2026 03:02:00 +0000 (20:02 -0700)]
mediatek: filogic: SDG-8733A: reset the radio through pcie3
GPIO 9 is the reset input of the MT7995 radio module, active low.
The old description used it as a PERST line on pcie0 with active
high polarity, so the port reset toggled the module reset at the
wrong time and with the wrong polarity.
Describe it as wifi-reset-gpios on pcie3, the port wired to the
module reset. The PCIe controller then releases the module from
reset before link training, with a 100 ms delay.
Chad Monroe [Tue, 11 Aug 2026 03:01:34 +0000 (20:01 -0700)]
mediatek: filogic: mt-stuart: limit USB to USB2
USB3 SuperSpeed signaling interferes with the 6 GHz radio. Disable
the SuperSpeed port on ssusb1 with mediatek,u3p-dis-msk; the port
then runs at USB2 speed.
Stop enabling ssusb0 and its xs-phy. Nothing connects to them on
these boards.
Chad Monroe [Tue, 11 Aug 2026 03:01:17 +0000 (20:01 -0700)]
mediatek: filogic: SDG-8733A: point label-mac-device at wan
The MAC address on the product label is the base MAC, mfginfo
cell 0. On this board gmac2 (wan) uses cell 0. The alias pointed
at gmac1 (lan), which uses cell 1, so the reported label MAC did
not match the label.
Chad Monroe [Tue, 11 Aug 2026 03:00:59 +0000 (20:00 -0700)]
mediatek: filogic: SDG-8733A: describe the LAN LEDs per hardware
The board has three LAN LEDs: white on GPIO 59, amber on GPIO 60
and green on GPIO 68. The old description listed two GPIO LEDs
with swapped colors and drove the green LED from the internal
2.5G PHY.
Describe all three as GPIO LEDs and set the netdev triggers to
match: white 2.5G, green 1G, amber 100M. Drop the PHY LED node
and the LED pinctrl state: the PHY LED pad (2p5gbe_led0, pin 68)
now works as the green LED GPIO, so the PHY drives no LED.
Chad Monroe [Tue, 11 Aug 2026 03:00:06 +0000 (20:00 -0700)]
mediatek: filogic: mt-stuart: use in-band-status on usxgmii links
The USXGMII links to the AQR113C PHYs signal link state and rate
adaptation in-band. Set managed "in-band-status" so phylink tracks
the PCS state instead of a fixed link.
Chad Monroe [Tue, 11 Aug 2026 02:59:44 +0000 (19:59 -0700)]
mediatek: filogic: mt-stuart: drive fan from AQR113C temperature
The AQR113C PHYs run hot and sit away from the SoC sensor. Export
the PHY hwmon sensor as a thermal sensor and add a thermal zone per
AQR113C on all three boards. The zones drive the fan with trips at
108/104/100/90/80/40 C.
Set critical-action "reboot" so a runaway zone restarts the board
instead of an unclean thermal shutdown. Raise the trip hysteresis
from 2 C to 4 C to stop the fan from cycling near a trip point.
Stop passive polling; the zones use active cooling only.
Chad Monroe [Tue, 11 Aug 2026 02:57:56 +0000 (19:57 -0700)]
mediatek: filogic: mt-stuart: move AQR113C reset to MDIO bus level
Each board wires one reset line that resets the AQR113C PHYs as a
group: GPIO 71 on SDG-8733/SDG-8734 and GPIO 62 on SDG-8733A.
Describe that line as the MDIO bus reset with the same assert and
deassert times.
Drop the per-PHY reset-gpios. On SDG-8733 the second AQR113C
claimed GPIO 62, which is not connected on that board.
Chad Monroe [Tue, 11 Aug 2026 02:56:59 +0000 (19:56 -0700)]
mediatek: filogic: restructure SmartRG MT7988 device trees
Replace mt7988a-smartrg-mt-stuart.dtsi with layered dtsi files.
The existing 3 boards assemble from shared building blocks instead
of include-then-delete:
* mt798x-smartrg-common.dtsi: thermal trip/cooling-map macros
* mt798x-smartrg-factory.dtsi: eMMC factory/mfginfo nvmem layout
* mt7988-smartrg-base.dtsi: PMIC, regulators, eMMC, ramoops,
console, watchdog, reset button
* mt7988-smartrg-sysled.dtsi: system LED controller and aliases
* mt7988-smartrg-mt-stuart-gsw.dtsi: built-in switch as lan2-4
with the per-port PHY LEDs
* mt7988-smartrg-wifi-pcie3.dtsi / -wifi-mt7995.dtsi: radio second
PCIe function and pcie0 radio wiring for SDG-8733A
* mt7988a-smartrg-mt-stuart-phase1.dtsi plus per-model pair dtsi
for SDG-8733 (AQR113C WAN) and SDG-8734 (SFP+ WAN)
No functional change is intended. Nodes for hardware that a board
does not have are no longer instantiated on that board: the
unstuffed WAN PHY on SDG-8734, unused pin groups per model, and
the PHY LED setup of the disabled switch on SDG-8733A.
Chad Monroe [Tue, 11 Aug 2026 02:49:49 +0000 (19:49 -0700)]
mediatek: filogic: mt-stuart: drop pci=pcie_bus_perf bootarg
The parameter came from the vendor SDK. The default kernel MPS and
MRRS configuration works correctly on these boards. The parameter
gives no measured benefit.
Chad Monroe [Tue, 11 Aug 2026 02:49:32 +0000 (19:49 -0700)]
mediatek: filogic: mt-stuart: fix dtc warnings
Rename the system LED children to led@1..led@4. The nodes have a
reg property, so dtc wants unit addresses. The sysled driver names
the LEDs from the label property, which does not change.
Remove #address-cells and #size-cells from the eMMC card@0 node.
The node has no children with a reg property.
Vitaliy Sochnev [Fri, 7 Aug 2026 10:09:49 +0000 (11:09 +0100)]
airoha: npu: load the firmware without the sysfs fallback
The NPU driver maps a missing firmware file to -EPROBE_DEFER, so that it
can be retried once the rootfs carrying /lib/firmware is mounted. That
mapping holds only while request_firmware() reports -ENOENT, and it does
not when the sysfs fallback is in play: the request goes to a userspace
helper, blocks for the full 60 second loading_timeout and comes back as
-ETIMEDOUT, which dev_err_probe() then turns into a hard failure. The
board boots a minute slower and ends up with no NPU at all, so no
hardware flow offloading either.
Our own config disables FW_LOADER_USER_HELPER for the target, but that
is not a dependable guard: LEDS_LP55XX_COMMON selects it, so any build
that pulls in kmod-leds-lp55xx-common - every image built with
ALL_KMODS, snapshots included - gets it back, and generic's
FW_LOADER_USER_HELPER_FALLBACK=y then arms the fallback.
Add a patch switching the driver to request_firmware_direct(), which
sets FW_OPT_NOFALLBACK_SYSFS and so reports -ENOENT whatever the
firmware loader is configured to do.
request_firmware_direct() also sets FW_OPT_NO_WARN, so the "Direct
firmware load for airoha/en7581_npu_rv32.bin failed with error -2"
line goes away together with the fallback. There is no variant that
skips the fallback but keeps the warning. While the probe is being
deferred that message was noise, but on a board where the firmware
package is genuinely missing it was the only hint naming the file.
Measured on a Nokia XG-040G-MD with FW_LOADER_USER_HELPER=y and
FW_LOADER_USER_HELPER_FALLBACK=y forced on, the two images differing
only by this patch:
without: 2.477 fallback -> 64.555 -ETIMEDOUT -> probe failed -110,
preinit at 69.6s, NPU unbound
with: no fallback and no warning at all, NPU fw version 1456.62
at 3.665s, preinit at 7.6s
Note the fallback is still compiled in and forced in both cases; the
patch does not disable it, it only keeps the driver from falling into
it.
The patch carries Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha
NPU support") and Cc: stable@vger.kernel.org, so it can be dropped once
it lands upstream and reaches us through a stable update.
Vitaliy Sochnev [Fri, 7 Aug 2026 10:09:40 +0000 (11:09 +0100)]
airoha: an7581: reserve NPU Wi-Fi regions only on Wi-Fi boards
an7581.dtsi reserves five no-map regions for the NPU and hands all of
them to the npu node. Four of them - pkt, tx-pkt, tx-bufid and ba,
110 MiB plus 26 KiB - are consumed only by
airoha_npu_wlan_init_memory(), which the mt76 NPU layer calls when it
attaches an Airoha-offloaded Wi-Fi chip. To run its firmware and to
offload flows the NPU needs the binary region alone, and the driver
looks that one up by index rather than by name.
Boards that bind no Wi-Fi chip to the NPU therefore lose 110 MiB of
DRAM for nothing, and they lose it whether or not the NPU probes at
all: the memory is carved out by the reserved-memory node itself. On
AN7581 that is both Nokia XG-040G-MD variants. an7583.dtsi already does
this correctly and reserves npu_binary only.
Move the four regions into a new an7581-npu-wlan.dtsi and include it
from the two NPU overlays the Wi-Fi boards already pull in, so that the
regions and the full memory-region list follow the Wi-Fi chip instead
of the SoC.
an7581-evb includes the new overlay directly instead. It declares two
mediatek,mt76 nodes with airoha,npu and enables the NPU, but pins no
particular chip because the card goes into a PCIe slot, so it is the
one board using the offload that pulls in neither NPU overlay.
Keep the ba region on all four Wi-Fi boards even though it is described
as MT7996-only. It is already optional in the driver, but narrowing it
down to MT7996 would change behaviour on Kite, so leave that for a
separate change.
Verified by building the device trees before and after: the DTBs of
an7581-evb, an7581-evb-emmc-eagle, an7581-evb-emmc-kite,
an7581-nokia-valyrian and an7581-w1700k-ubi are byte for byte
identical, while an7581-nokia_xg-040g-md and an7581-nokia_xg-040g-md-ubi
each shrink by 376 bytes and lose the four regions.
Tested on a Nokia XG-040G-MD. Reserved memory drops from 197296K to
84400K and MemTotal rises from 325900 kB to 438736 kB, 110 MiB given
back. The NPU still comes up on the binary region alone and reports
"NPU fw version: 1456.62", so dropping the four regions costs the board
neither the NPU nor its flow offloading. Not tested on Wi-Fi hardware,
where the argument rests on the DTBs being unchanged.
xiao bo [Sun, 9 Aug 2026 14:44:59 +0000 (22:44 +0800)]
arm-trusted-firmware-airoha: sync an7581-bl31 BUILD_DEVICES with bl2
an7581-bl31 BUILD_DEVICES list was incomplete and missed:
- airoha_an7581-evb-emmc-eagle
- airoha_an7581-evb-emmc-kite
- nokia_valyrian
- nokia_xg-040g-md-ubi
These devices are present in an7581-bl2 but missing for bl31.
When building these targets, an7581‑bl31 package is never built,
causes FIP failure "fopen ...an7581‑bl31.lzma: No such file or directory".
Sync an7581‑bl31 BUILD_DEVICES to exactly match an7581‑bl2.
Fixes: https://github.com/openwrt/openwrt/commit/467c5b90ba1140dcdabc2e2e203c1d91fca9963e Signed-off-by: xiao bo <peterwillcn@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24626 Signed-off-by: Robert Marko <robimarko@gmail.com>
Robert Marko [Sun, 9 Aug 2026 10:58:49 +0000 (12:58 +0200)]
airoha: fix AN7581 chainloader U-Boot filename
The uboot-airoha package now stages compressed U-Boot images using the
u-boot.lzma suffix. The AN7581 chainloader still looks for the previous
u-boot.bin.lzma filename and consequently falls back to a nonexistent
uncompressed image.
Use the staged u-boot.lzma filename when generating the chainloader FIT.
Fixes: 94a21b3fe9bd ("uboot-airoha: move FIP generation to target and enable autoselection") Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Robert Marko [Sun, 9 Aug 2026 10:50:08 +0000 (12:50 +0200)]
airoha: fix U-Boot artifacts for AN7581 eMMC boards
The AN7581 eMMC Eagle and Kite boards use the shared an7581_rfb
U-Boot build, which produces artifacts with the rfb suffix. The image
recipes instead look for nonexistent per-device rfb-emmc-eagle and
rfb-emmc-kite artifacts.
Use the shared rfb artifacts for both boards so their preloader and
BL31/U-Boot FIP artifacts can be generated.
Fixes: 94a21b3fe9bd ("uboot-airoha: move FIP generation to target and enable autoselection") Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Robert Marko [Sun, 9 Aug 2026 10:33:43 +0000 (12:33 +0200)]
uboot-airoha: use separate DTB for Nokia XG-040G-MD
CONFIG_OF_EMBED is intended for debugging and is not recommended for
production devices. Remove it from the Nokia XG-040G-MD defconfig so
Kconfig selects CONFIG_OF_SEPARATE, consistent with the other Airoha
boards.
The existing default device tree and u-boot.bin build target ensure that
the separate DTB is built and appended to the deployable U-Boot image.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Robert Marko [Sun, 9 Aug 2026 09:21:46 +0000 (11:21 +0200)]
arm-trusted-firmware-airoha: fix BL2 packing on Debian 11
Debian 11 ships coreutils 8.32, whose cksum does not support the
-a crc32b option. This leaves crc empty and causes the subsequent shell
arithmetic expression to fail.
Use Python's built-in binascii.crc32 implementation instead. Python 3 is
already required by the OpenWrt build system and produces the same CRC-32
value before the existing final XOR.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
uboot-airoha: move FIP generation to target and enable autoselection
Move FIP handling to target now that we compile ATF. This is to have always
in sync new ATF and new U-Boot if one of the 2 is already compiled.
Also add HIDDEN ops to enable autoselection of the U-Boot for the required
target. This is needed to prevent user to deselect the U-Boot package
causing failure on ARTIFACTS generation.
Drop precompiled BL2 and BL31 as they can be now compiled from source.
Add support for compiling Airoha ATF, based on a modified version of the
TF-A based on 2.10.
The package will clone the base TF-A and apply the modified source and
pre-compiled objects (DDR calibration, eFUSE handling, TX/RX path...) to
correctly compile.
An helper script is added to implement the same format used for special BL2
handling. BL2 is composed of 3 sub-phase with a initial BL21, a BL22 that
loads a LZMA decompressor and BL23 that actually calibrate and loads BL31
ATF.
Also a special flash_table is used to handle SPI-NAND externally to the
BL2, a special Host target is added for that.
The kernel config refresh done with commit ada7ded disabled the Airoha PM Domain driver
due to the broken Kconfig dependency fixed with an earlier commit.
Add the missing symbol to enable the driver again. Also do a another
kernel config refresh to resolve some dependent PM domain symbols.
airoha: an7581: add airoha,chip-scu phandle to scuclk node
The clk-en7523 driver tries to look up the chip-scu regmap via the
"airoha,chip-scu" phandle first. If absent, it falls back to a
compatible-based lookup with syscon_regmap_lookup_by_compatible().
The AN7583 DTSI already had the phandle but AN7581 did not, relying
on the fallback instead. Add it so the DT explicitly describes the
connection and both platforms use the same lookup path.
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
dev_pm_domain_attach_list() returns the number of attached PM domains
on success (a positive count), or a negative error code on failure.
The airoha-cpufreq driver checks 'if (ret)' which treats a successful
attachment as an error.
Fix by checking 'if (ret < 0)' like all other users of this API.
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
airoha: fix Kconfig dependency issue with PM Domain driver
The AIROHA_CPU_PM_DOMAIN option was added inside the MediaTek PM Domains
menu, which depends on ARCH_MEDIATEK || COMPILE_TEST. Since Airoha
platforms use ARCH_AIROHA, the menu is invisible during kernel
configuration, silently dropping AIROHA_CPU_PM_DOMAIN. This breaks
running `make kernel_menuconfig`.
Add ARCH_AIROHA to the menu dependency so that this option and its
dependencies (PM_GENERIC_DOMAINS, PM_GENERIC_DOMAINS_OF) remain
enabled on Airoha targets.
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
Rustam Adilov [Thu, 6 Aug 2026 15:41:58 +0000 (20:41 +0500)]
realtek: board: some family check cleanups
The prom initialization is a bit of a mess now with all these
model and soc family checks. And realtek_read_model() function
is the worst offender of all as it goes through all of the model
info register from different SoCs just to read details from one
of them.
We can make use of the .data property in realtek_of_match to
clean things up so that each soc family has its own way of
initialization and reading model details.
Create a struct that will be used for that and add all of the
soc data structs for all chip families.
With all that, remove realtek_read_model() function and most
of the soc_info.family checks in various functions.
In addition, add the rtl960x compatibles along as well so that
rtl960x model info details has somewhere to be used. RTL8198D
is also added as it is part of RTL9607C family.
Rustam Adilov [Fri, 7 Aug 2026 15:56:36 +0000 (20:56 +0500)]
realtek: dts: fix up the wrong soc compatibles
Some rtl9302 based boards use the realtek,rtl838x-soc compatible
in their device tree instead of the correct realtek,rtl9302-soc.
This is also the case for main rtl931x and rtl930x device tree files.
In preperation for utilizing device data in the board-realtek, fix
this up now so that these boards don't end up breaking due to incorrect
prom initialization caused by rtl838x-soc compatible.
Mikhail Zhilkin [Fri, 7 Aug 2026 11:25:47 +0000 (14:25 +0300)]
airoha: an7583: fix ethernet breakage on Nokia XG-040G-MF
Recent upstream cleanups moved switch port labels to the board level and
disabled switch ports/PHYs by default on the AN7583 SoC dtsi. This broke
ethernet on the Nokia XG-040G-MF since its board DTS was not updated to
explicitly configure and enable them.
Fix this by explicitly enabling gsw_port2-4 along with their respective
PHYs and restoring the "lan2", "lan3", and "lan4" port labels.
Fixes: ce55cdde26a9 ("airoha: an7583: move the switch port label from soc-level to board-level") Fixes: d2698d325b68 ("airoha: an7583: disable all switch ports and PHYs by default") Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24606 Signed-off-by: Robert Marko <robimarko@gmail.com>
Robert Marko [Fri, 7 Aug 2026 11:47:57 +0000 (13:47 +0200)]
airoha: pinctrl: fix AN7583 eMMC pinmux
The SCU IOMUX reset puts AN7583 pins 45-47 into GPIO mode. These pins
are shared with eMMC, but the generic eMMC function group only enables
the eMMC mode bit and leaves the GPIO overrides active, preventing the
card from initializing.
Add an AN7583-specific eMMC function group that also clears the GPIO
mode bits for the shared pins.
Fixes: d0110a25ed ("airoha: add pinctrl fixes for AN7581 and AN7583") Signed-off-by: Robert Marko <robert.marko@sartura.hr>
kernel: fix stale HIFIBERRY_STUDIO symbol, add TOUCHSCREEN_ST7123
The Kconfig symbol backing the HiFiBerry Studio driver was renamed
from SND_BCM2708_SOC_HIFIBERRY_STUDIO_DAC8X to
SND_BCM2708_SOC_HIFIBERRY_STUDIO. Update to the new symbol name.
Also add the new CONFIG_TOUCHSCREEN_ST7123 symbol, disabled by
default, to the generic config.
bcm27xx: drop dwcmshc_remove() timeout_clk disable
The quilt rebase of
0299-mmc-sdhci-of-dwcmshc-define-sdio-timeout-clocks.patch matched
the wrong occurrence of the two clk_disable_unprepare() calls for
pltfm_host->clk and priv->bus_clk, which appear both in
dwcmshc_probe()'s error path and in dwcmshc_remove(). This added a
clk_disable_unprepare(pltfm_host->timeout_clk) call inside
dwcmshc_remove() that is present in neither mainline Linux nor
raspberrypi/linux's rpi-6.18.y.
Drop it for now rather than carry an unverified addition. If it
turns out timeout_clk does need disabling on remove, it can be
reinstated with a clear rationale.
Fixes: 7105bec48f27 ("kernel: bump 6.18 to 6.18.40")
See: https://github.com/openwrt/openwrt/pull/24419
bcm27xx: update patches up to Git HEAD (2026-08-02)
These patches were generated from:
https://github.com/raspberrypi/linux/commits/rpi-6.18.y
Patches were generated from the diff between linux kernel branch linux-6.18.y
and rpi-6.18.y from raspberry pi kernel source:
Use the standard 'led' node name for GPIO LEDs as required by the
devicetree specification.
Signed-off-by: Ziyang Huang <hzyitc@outlook.com>
[ adapted from commit f5bf8c2b9482 ("airoha: correct led nodename") ] Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24264 Signed-off-by: Robert Marko <robimarko@gmail.com>
airoha: an7583: move the switch port label from soc-level to board-level
Different boards use different port maps. Defining the port labels in
board-level is better.
Signed-off-by: Ziyang Huang <hzyitc@outlook.com>
[ adapted from commit e2f7ad08c765 ("airoha: move the switch port label from soc-level to ...-") ] Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24264 Signed-off-by: Robert Marko <robimarko@gmail.com>
airoha: an7583: disable all switch ports and PHYs by default
Some boards only use some of them, so enable as necessary in the
board-level DTS.
Signed-off-by: Ziyang Huang <hzyitc@outlook.com>
[ adapted from commit 007aa5a51ce8 ("airoha: disable all switch port and phy by default") ] Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24264 Signed-off-by: Robert Marko <robimarko@gmail.com>
The LAN MAC (gmac0) is the one printed on the device label.
Installation
------------
Factory bootloader is locked to 64mb partition layout, so OpenWrt U-Boot
has to be flashed first. Steps 1, 2 and 4 are run from a shell on the
stock firmware, where the 'bl2' and 'fip' partitions are writable - in
OpenWrt they are read-only, so the procedure cannot be repeated from
OpenWrt. Back up both partitions before overwriting them:
1. Upload OpenWrt 'bl31-uboot.fip' and 'preloader.bin' images to the /tmp
dir of the router using scp protocol
2. Write fip and bl2 (replace bootloader):
3. Place OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-initramfs-recovery.itb'
image on the tftp server (IP: 192.168.1.254)
4. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
5. U-Boot automatically boots the OpenWrt recovery image from the tftp
server to the RAM
6. Upload OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-squashfs-sysupgrade.itb'
image to the /tmp dir of the router (IP: 192.168.1.1) using scp
protocol
7. Connect to the router using ssh and run:
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-initramfs-recovery.itb'
image on the tftp server (IP: 192.168.1.254)
2. Press "Reset" button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
Reverting to stock firmware requires writing the 'bl2' and 'fip' backups
taken above back with 'mtd write', then flashing the stock image; without
those backups there is no way back, because the stock bootloader cannot
be downloaded from the vendor.
Wrap all swconfig-specific code in mt7530.c with #if IS_ENABLED(CONFIG_SWCONFIG),
including struct switch_dev, the vlan/port mapping tables and all
switch_dev_ops callbacks. Register access helpers (mt7530_r32/w32), the
PSC/HWTRAP definitions, and the small set of swconfig-only register
macros and MIB tables further up the file remain unconditional - the
latter two are unused-but-harmless when swconfig is disabled and are
left alone to keep the diff focused.
When swconfig is not compiled in, the driver performs only minimal
hardware init (disables MAC learning on all ports, applies the HWTRAP
fixup) and skips switch registration, mirroring the existing behaviour
of the "mediatek,no-swconfig" device tree property. This removes the
need for that property when building DSA-only images. The property is
still honoured whenever CONFIG_SWCONFIG is enabled (built-in or as a module).
A distinct log message is used for the compile-time case, to
distinguish it from the runtime "mediatek,no-swconfig" case in dmesg.
Also switch the existing runtime "swconfig disabled" message from
pr_info() to dev_info(), changing its dmesg prefix from "mt7620: " /
"mt7530: " to the device's own prefix.
qualcommax: enable in-band signalling on the USXGMII ports
USXGMII carries the line rate to the MAC in a Clause 37 code word, so the
link needs in-band signalling. Without "managed" the port is PHY managed,
phylink disables in-band on the PHY, and with the PCS now honouring
neg_mode neither end runs autonegotiation, so nothing crosses the system
interface.
Every USXGMII port in this target was missing the property: ten ports
across eight boards, all of them an Aquantia PHY on copper, none of them
an SFP cage. ipq8074-rt-ax89x already carried "in-band-status" on its
SGMII lan8, which is why a file-level search made it look covered.
Only the two ports on ipq8072-301w have been tested on hardware. The
remaining eight are the same PHY family behind the same PCS, are broken
today for the same reason, and cannot regress from a state where they
pass no traffic, but they have not been confirmed on a board.
That test ran on the 6.18 testing kernel, where phylink switches the PHY
side on through phy_config_inband(). On 6.12 the PHY has no such op and
0760-net-phy-aquantia-enable-USXGMII-MAC-autoneg.patch forces the same
bit unconditionally, so the end state matches, but no board has confirmed
it there.
Tested-by: Rudy Andram <rmandrad@gmail.com> Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24420 Signed-off-by: Robert Marko <robimarko@gmail.com>
qualcommax: pcs-qca-uniphy: take the USXGMII link from the receiver
qca_uniphy_pcs_get_state_usxgmii() took the link from the USXGMII code
word's link bit. An AQR113C behind this XPCS never asserts it:
autonegotiation completes, the code word tracks the copper rate as the
media renegotiates and reports full duplex, and the link bit stays clear
the whole time.
Once the port is marked as in-band managed that bit becomes the carrier
gate, so the port never gets carrier, link_up() never runs, the port MAC
is never enabled and the XPCS keeps its 10G reset default.
Take the link from the 10GBASE-R receiver instead, the way
qca_uniphy_pcs_get_state_10base_r() does. It answers the only question a
PCS can answer on its own, whether the system interface is up. The code
word stays the speed source: the Aquantia driver reports RATE_MATCH_NONE
for USXGMII, so phylink does not substitute the PHY's speed and this is
where the port's rate comes from. The link bit is kept as an_complete,
which is what it actually describes.
Confirmed on a QNAP QHora-301w, where 10g-1 now reaches carrier against a
1G link partner and configures an address.
Signed-off-by: Rudy Andram <rmandrad@gmail.com> Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24420 Signed-off-by: Robert Marko <robimarko@gmail.com>
qualcommax: pcs-qca-uniphy: honour neg_mode for USXGMII autoneg
The USXGMII autoneg enable was keyed on the interface alone, so the XPCS
ran Clause 37 autonegotiation whenever the interface was USXGMII, no
matter what negotiation mode phylink had selected.
On an out-of-band link the PHY sends no code words, and the XPCS is left
waiting for them. The SerDes trains and the receiver reaches block lock,
but no traffic crosses the system interface in either direction, so the
port looks up while passing nothing.
Which side turns the PHY off depends on the kernel. From 6.16 the
Aquantia driver implements config_inband, and phylink calls it with
LINK_INBAND_DISABLE on a PHY managed link, which clears
MDIO_PHYXS_VEND_PROV2_USX_AN. On 6.12, the kernel this target builds by
default, that op does not exist and the PHY side is instead forced on
unconditionally by 0760-net-phy-aquantia-enable-USXGMII-MAC-autoneg.patch.
Key the write on neg_mode rather than dropping it, so a link that really
does negotiate in-band keeps working. Once the USXGMII ports are marked
in-band managed, this resolves to the value the driver already wrote, so
no in-tree board changes register state here today.
Diagnosed on the OpenWrt forum by rmandrad, who arrived at the same
condition independently and confirmed on a QNAP QHora-301w that enabling
autonegotiation on both the PHY and the XPCS makes the 10G ports pass
traffic.
Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24420 Signed-off-by: Robert Marko <robimarko@gmail.com>
ipq8074-nbg7815 and ipq8072-mx8500 both place the AQR firmware cell at
offset 0x28 to skip the QCOM MBN header, but their node names still say
0, so the unit address disagrees with reg and dtc warns about it.
nbg7815 also calls the node aqr-fw where every other board calls it
firmware.
Only node names change. Both are referenced by label from the PHY's
nvmem-cells, not by path, and reg is untouched.
Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24420 Signed-off-by: Robert Marko <robimarko@gmail.com>
qualcommax: build the Aquantia PHY driver into the kernel
The PPE driver registers its DSA switch, and with it attaches every user
port's PHY, before the root filesystem is mounted. A PHY driver that is
only available as a module therefore always loses the race:
phy_attach_direct() finds no matching driver, falls back to genphy_c45
and binds it with device_bind_driver(), and nothing rebinds the PHY when
the real driver shows up later.
On the boards with an Aquantia 10G PHY that leaves the AQR running under
the generic Clause 45 driver. It never loads its firmware, from the nvmem
cell or otherwise, and its system interface is never configured, so the
10G port does not pass traffic. Boards that provision the firmware from
flash have therefore never had that path execute at all.
The driver was built in until commit 8c3bcc198936 ("ipq807x: move AQR
driver from built-in to kmod"), which made it a module so that
IS_REACHABLE(CONFIG_HWMON) would evaluate true and the temperature
sensors in the AQR would be usable as thermal zones. That was correct at
the time: the ethernet driver then attached PHYs from userspace, so a
module was in place early enough, and hwmon was not built in.
Neither still holds. HWMON is compiled in on this target, so building the
PHY driver in keeps its hwmon support, and the PPE driver attaches PHYs
from its own probe. Build it in, as is already done for the AT803X and
QCA807X PHYs here.
CRC_ITU_T, which the driver selects for the firmware image
checksum, follows it from module to built-in.
Both symbols go in the ipq807x and ipq60xx config-default rather than
the target's per-kernel config. Every board with an AQR is on one of
those two subtargets and ipq50xx has none, and a subtarget's
config-default is merged for whichever kernel version the target
builds, so the 6.18 kernel picks them up as well.
kmod-phy-aquantia goes with it. The package builds empty once the symbol
is built in, because KernelPackage/install skips a module listed in
modules.builtin, but ModuleAutoLoad still runs and would ship
/etc/modules.d/18-phy-aquantia naming a module that no longer exists.
Drop it from the subtarget defaults and from the one ipq60xx device
that listed it, matching AT803X_PHY and QCA807X_PHY which carry no
kmod on this target.
Reported-by: Rye Sears <xlighting2017@users.noreply.github.com> Tested-by: Rye Sears <xlighting2017@users.noreply.github.com> Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24420 Signed-off-by: Robert Marko <robimarko@gmail.com>
- update dropbear to latest stable 2026.94;
for the changes see https://matt.ucc.asn.au/dropbear/CHANGES
- server-side 2FA is no longer deprecated
- remove previously cherry-picked patches
- automatically refresh patches
realtek: eth: adapt interrupt handling for fragments
The existing interrupt handling of the ethernet driver worked
well until the driver implemented receive fragment handling.
This change uncovered a constellation that did not exist before.
A received packet is written into the page pool with multiple
fragments. On RTL93xx the head-of-line (HOL) feature limits
the number of receivable fragments perfectly. There will never
be a "buffer full" situation where the hardware only encounters
ring buffers that are held by the Linux kernel. On RTL83xx
this is slightly different:
- The driver programs free floating rings
- Only the ownership flag of the ring buffer decides if the
hardware can hand over a packet to the CPU.
- So the hardware can receive a packet even if it does not
completely fit into the available fragments.
With this there is a small chance that
- The buffer has less space than a just received packet
- The hardware generates an overflow (RUN OUT) interrupt
- With no completely received packet the hardware DOES NOT
generate a receive (DONE) interrupt.
So it is not sufficient to just look on the DONE interrupts.
The RUN OUT interrupts must be inspected as well. As the
current logic is quite cryptic enhance this as follows:
- Provide new RTL83xx/RTL93xx specific helpers
- Add new callbacks to the driver configuration structure
- Link the configuration with the new helpers
- Use the callbacks where needed.
While we are here:
- Enable only interrupts for active receive rings. Until
now the driver activated all receive interrupts (8/32)
although it supports only 2 rings.
- Use DIV_ROUND_UP instead of classic division for register
calculation.
Zoltan HERPAI [Mon, 15 Jun 2026 13:04:20 +0000 (13:04 +0000)]
kernel/zynq: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
Jonas Jelonek [Sun, 2 Aug 2026 15:10:38 +0000 (15:10 +0000)]
realtek: pcs: rtl93xx: rename rxcal_ accessors to rxeq_
Split naming convention: rxeq_* accessors control equalizer state
(get/set a coefficient, toggle adapt); rxcal_* functions run an actual
calibration procedure (measure, decide, retry). 930x's accessor layer
predates this split and still used rxcal_ throughout; rename it to
match the convention already applied consistently on 931x.
dfe_taps_adapt/dfe_disable move too - despite looping over TAP1-4,
they just apply a fixed control action with no measurement or
decision-making, same as the single-coefficient accessors. init,
fgcal, leq_adapt_lock and vth_tap0_adapt_lock stay rxcal_ - they're
the calibration-flow entry points that call these accessors as
building blocks, and the *_adapt_lock ones specifically read back a
result to decide what to lock in.
Also rename 931x's dfe_disable_5g to rxeq_dfe_disable_5g for the same
reason - it's a fixed control action, not a calibration procedure.
Jonas Jelonek [Mon, 27 Jul 2026 20:29:37 +0000 (20:29 +0000)]
realtek: pcs: rtl931x: gate symErr success on actual link status
symErr reads 0 both when the link is clean and when there's no signal
at all to decode errors from - the counter only increments when the
PCS is actively decoding something and finds a mismatch, so a dead
link and a healthy one are indistinguishable from symErr alone.
Confirmed on hardware: symErr read 0x0 while the port had no link.
Add rtpcs_931x_sds_10gr_link_up(), reading the same status bit as the
vendor SDK's _phy_rtl9310_linkSts_get() default case, and require it
alongside a low symErr count before declaring a calibration check
successful. A link that isn't actually up yet now keeps the retry
loop going instead of being misread as a clean, working link.
Also observed on hardware: the retry budget sometimes runs out while
symErr is still nonzero, but the link comes up and works fine anyway -
the count just hasn't fully settled within the budget. Since that's
not an actual problem, keep the final message at dev_dbg when
link_up is true; only warn when the link genuinely never came up.
Jonas Jelonek [Wed, 29 Jul 2026 19:41:33 +0000 (19:41 +0000)]
realtek: pcs: rtl931x: average VTH samples instead of one point-sample
rxcal_fiber_adapt() locked in whatever a single rxeq_vth_get() call
returned after a fixed 200ms adapt window - no check that the reading
was representative rather than a transient/noisy excursion. Observed
on hardware: whenever the locked VTH wasn't 0xa (the reset baseline),
the link behaved worse; recalibrating a link that was already working
could leave it worse than before, which a single unlucky sample
locked in as final is a plausible cause of.
RTL930x's own analogous case (leq_adapt_lock) already avoids exactly
this by sampling 10 times over ~100ms and averaging rather than
trusting one read. Do the same here: settle for 100ms, then sample
VTH 10 times over ~100ms and lock in the rounded average, using
DIV_ROUND_CLOSEST() rather than an open-coded round-to-nearest.
Jonas Jelonek [Mon, 27 Jul 2026 18:46:36 +0000 (18:46 +0000)]
realtek: pcs: rtl931x: lock manual mode before reset values
reset_leq_dfe() wrote reset values for LEQ and VTH/TAP0-4 before setting
their manual-mode enable mask, matching the vendor SDK's own instruction
order. On a first-ever call this is harmless, but calibration may leave
those in continuous live auto-adapt when it returns, so on a second
calibration attempt those fields can still be adapt-driven at the moment
reset_leq_dfe() writes "0" into them - the adapt engine can overwrite
that write before the enable-mask lands a few instructions later, locking
in whatever it had drifted to instead of the intended baseline.
Set the manual-mode enable mask first instead, so the fields are
guaranteed passive before their reset values are written, regardless
of what state a previous calibration pass left them in.
Testing on hardware suggests that this matters at least for VTH/TAP0-4,
showing a drift of coefficients throughout multiple calibration runs
without this change. With this change, it remains stable across runs.
Jonas Jelonek [Mon, 27 Jul 2026 18:43:55 +0000 (18:43 +0000)]
realtek: pcs: rtl931x: add some debug prints to RX calibration
Add some debugging aid to the RX calibration, making it easier to spot
eventual issues caused by calibration. While the calibration has been
tested, this happened only on a small set of devices.
Adds rtpcs_931x_sds_rxeq_leq_get_coef() to read back where LEQ
auto-adapt actually settles in rxcal_leq_adapt(), mirroring what
rxcal_fiber_adapt() already does for VTH. Shares the existing
930x gray-to-binary helper since it's pure bit math, not
variant-specific. Promote it to a generic helper instead of
930x-specific.
Jonas Jelonek [Tue, 28 Jul 2026 22:21:01 +0000 (22:21 +0000)]
realtek: pcs: rtl931x: replace open-coded writes with named setters
Replace the plain field writes in rtpcs_931x_sds_reset_leq_dfe() with
the rxeq_* setters, now that both wire-up commits have given them real
calibration callers. Keeps the register-level detail out of the reset
sequence and gives it named accessors instead of raw write_bits() calls.
Some bits touched by the original reset writes fall outside any known
coefficient field (reg 0xd bits [1:0], reg 0x12 bits [15:12]/[3:0]).
These are kept as separate, explicitly commented raw writes rather than
folded into the setters, since the setters are scoped to match the
vendor SDK's real per-field accessors and narrowing them silently would
drop those undocumented-but-required bits.
Jonas Jelonek [Tue, 28 Jul 2026 22:19:49 +0000 (22:19 +0000)]
realtek: pcs: rtl931x: wire up RX calibration for 10G fiber
Port the vendor SDK's _phy_rtl9310_fiber_adapt() as
rtpcs_931x_sds_rxcal_fiber_adapt(), dispatched from post_config for
RTPCS_SDS_ATTACH_FIBER when hw_mode is 10GBase-R (1G/100M fiber isn't
calibrated by the vendor SDK either).
Add the rxeq_tap_*/rxeq_vth_* setters (set_value, set_adapt) needed to
drive it: fiber calibration runs VTH/TAP0 auto-adapt for 200ms, then
samples the auto-adapted VTH and locks it in, forces TAP0 to a fixed
value (31, per the vendor SDK), and re-locks manual mode, before letting
DFE TAP1-4 auto-adapt freely and verifying via a symbol-error recheck
loop.
Sampling VTH needs the SerDes' debug-readback routing. Add
rtpcs_931x_sds_set_debug() and rxeq_vth_get() for it, mirroring
_phy_rtl9310_dbg_set()/_phy_rtl9310_dfe_get().
The final symbol-error recheck deliberately deviates from the vendor
SDK's shape (adapt once, recheck 3x at 150ms, require exactly 0):
symErr's field is only 8 bits wide and reads as a saturated 0xff right
after rx_reset(), which looks like "link hasn't relocked yet" rather
than a genuine error count - 10G optical relock can plausibly take
longer than 150ms. Instead, recheck more times with more patience per
check and no reset in between (so a settling link isn't interrupted),
and tolerate a small nonzero symbol-error count rather than requiring
exactly 0.
rtpcs_931x_sds_fiber_get_symerr() already existed but was unused;
wire it up alongside the existing rtpcs_931x_sds_clear_symerr().
Jonas Jelonek [Tue, 28 Jul 2026 22:09:39 +0000 (22:09 +0000)]
realtek: pcs: rtl931x: wire up RX calibration for PHY-attached ports
Add post_config, run after activate() like on RTL930x, dispatching RX
calibration by attachment. Port the vendor SDK's _phy_rtl9310_leq_adapt()
as rtpcs_931x_sds_rxcal_leq_adapt() for the PHY-attached case, built on
new rxeq_leq_set_coef()/rxeq_leq_set_adapt() setters and the
existing but unused rx_reset().
Add rtpcs_931x_sds_dfe_disable_5g() for the one-shot operation the SDK
issues before calibrating PHY-attached and PCB-adapt ports. Presumably,
this quiesces DFE auto-adapt on the 5G companion analog block to prevent
it from interfering with DFE adaption during calibration.
Fiber and DAC attachments remain a TODO in post_config's dispatch.
kernel: drop redundant TCP fraglist GRO pull check
The patch adds a pre-check to tcp_gro_receive() so that an skb which
cannot be pulled up to the GRO offset is flushed instead of reaching the
BUG() in __skb_pull(). Upstream has since fixed the same bug inside the
callee, which leaves the pre-check with nothing to protect:
skb_gro_receive_list() now rejects the short skb itself and pulls with
skb_pull() rather than the __skb_pull() that carries the BUG(). It is
the only function the is_flist branch of tcp_gro_receive() calls, so no
path is left uncovered. The fix is present in both pinned kernels,
6.12.100 and 6.18.41.
Dropping the pre-check also restores upstream's intended handling: on
failure skb_gro_receive_list() sets NAPI_GRO_CB(skb)->flush, so the skb
is delivered through the normal receive path instead of being held as a
new GRO head. Short-circuiting on the local flush skipped that.
The patch keeps applying cleanly only because the fix landed in a
different function.
Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24524 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The per-partition branch of w_init() tested econet,enable-remap on the parent
nand node (np) instead of the partition being iterated (part_np). That branch
only runs when np does not carry the property, so the test was always false and
the loop skipped every partition. As a result econet,enable-remap on a
partition node was a silent no-op: no partition ever registered a remap range,
and "enable-remap set for ..." was never printed.
Read the property from part_np so per-partition enable-remap works as
documented. Boards that place the property on a partition now register that
range; boards that place it on the nand node are unaffected.
Paweł Owoc [Sun, 2 Aug 2026 06:51:39 +0000 (08:51 +0200)]
tools: elfutils: fix uio header inclusion
Fixes arm64 build failures by replacing <linux/uio.h> with POSIX <sys/uio.h>
to avoid header redefinition conflicts.
gnulib's fcntl.h ends up including glibc's fcntl.h and fcntl-linux.h
which includes glibc's types/struct_iovec.h,
thats where the redefinition happens.
the lines that use <linux/uio.h> are antiquated and were never necessary.
it can be traced back to the original 2014 change that added the file with aarch64 support
in upstream commit 66637fa21044ac0058b25522f473669e73de328b
it was never necessary to use the linux header over the glibc headers,
as elfutils only needs the iovec struct and that struct was present since glibc 2.0 in the 1990s
Restore the original mac80211.sh behavior by setting noscan when
fixed_freq is enabled for sta, adhoc and mesh modes. This ensures
correct channel width operation for fixed-frequency links and
matches the legacy mac80211.sh behavior.
mediatek: filogic: add support for COMFAST CF-WA933
The Comfast CF-WA933[1] is an outdoor dual-band WiFi 6 access
point/router. They also OEM their routers for other providers. This PR
adds support based on, and substantially updates, the downstream device
definition[2] from Wayru, one such white label client.
It can be powered by a 12V DC barrel jack (standard 5.5x2.5mm, center
positive) or via 802.3af POE.
Hardware summary:
- SoC: MediaTek MT7981A
- RAM: 256 MiB
- Flash: SPI-NAND 128 MiB (Factory uses 64M; see details below to use
the full 128M!)
- WiFi (MT7976DA): dual-band 802.11ax
- Ethernet (MT7531AE): 3x gigabit: 1x WAN + 2x LAN (labeled lan1/lan2).
- Button: reset
- LEDs: Power (always on), WLAN, WAN, LAN1, LAN2
- Serial: Internal header (Four unpopulated headers, clearly labeled)
The serial number is stored as an ASCII string at Factory 0xe100.
Disassembly:
Unscrew the six 3mm hex bolts on the dome and the six 5mm bolts on the
side of the arm, then lift the dome. For reassembly, make sure the large
O ring is in the groove in the dome.
OpenWrt installation:
1. Connect to Ethernet on the WAN port. Manually set your IP address to
192.168.1.10 (important!)
2. Upload the OpenWrt sysupgrade image at http://192.168.1.1
The default U-Boot partition layout does not expose the full flash
capacity. Change the mtdparts U-Boot environment variable before
rebooting and then installing the image for the 128 MiB variant through
the same bootloader recovery/upgrade page.
Method 1: Using the serial console
1. Disassemble the unit and connect to the serial console (115200 8N1).
Leave 3.3V disconnected.
2. On the boot loader, go straight to "0. U-Boot console"
3. Then enter:
setenv mtdparts 'nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),2048k(fip),117248k(ubi)'
saveenv
reset
Return to vendor firmware:
1. If you have changed the mtdparts environment variable, undo the
change by setting:
mtdparts 'nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),2048k(fip),65536k(ubi)'
2. Re-enter the same bootloader recovery/upgrade page.
3. Upload a stock COMFAST firmware image, e.g. from
http://www.comfast.com.cn/index.php?m=content&c=index&a=show&catid=85&id=773
Robert Marko [Mon, 3 Aug 2026 09:44:15 +0000 (11:44 +0200)]
qualcommax: ipq50xx: build-in PTP support
When images are built with CONFIG_ALL_KMODS=y which are all buildbot built
images, then the STMMAC_ETH driver will get demoted to a module.
This is due to ALL_KMODS including kmod-ptp which selects the full PTP 1588
support instead of just the auto selected PTP_1588_CLOCK_OPTIONAL.
That causes PTP_1588_CLOCK_OPTIONAL to get deselected, STMMAC driver built
as a module instead of being built-in and then its not shipped in the device
images leading to no working wired networking.
So, lets simply enable full PTP 1588 support as built-in into the kernel so
that STMMAC does not get demoted to a module and restores wired networking.
For 40,000 ns at 100 MHz this is floor(0.061) == 0, so the driver
deterministically returns -ERANGE and pwm-fan fails to probe on every
boot:
pwm-fan pwm-fan: failed to enable PWM
pwm-fan pwm-fan: Failed to configure PWM: -34
pwm-fan pwm-fan: probe with driver pwm-fan failed with error -34
Probe returns before the tachometer IRQ is requested and before
fan-supply is claimed, so the board loses fan RPM reporting and the
vcc_fan 5V regulator stays disabled. The fan never spins and the DTS
cooling-maps (trips at 50/75/100 C) have no cooling device to bind to.
This is the same defect fixed for qualcommbe in commit 8db23dc91a01
("qualcommbe: fix pwm period calculation") by Kenneth Kasilag, whose
rationale explicitly calls out 25 kHz four-wire fan PWM. qualcommax
carries its own copy of the pwm-ipq driver and was not covered by that
fix. The patch added here is that work backported to qualcommax, with
authorship preserved; the base driver differs slightly between targets
so the hunks were rebased onto the qualcommax copy.
Confirmed on hardware. The board was tested on the 6.12 kernel, which
this target has since dropped; the pwm-ipq driver source is identical
under 6.12 and 6.18, so the patch and its effect are unchanged. Before,
driving the PWM directly from userspace on a GL-AXT1800 running
r35591-d0110a25ed:
Jonas Jelonek [Sun, 2 Aug 2026 20:02:10 +0000 (20:02 +0000)]
realtek: board: add patch to fix boot hang
Add a patch to fix boot hang on some devices after 7cc31af7bdd4
("realtek: convert to generic machine initialization"), reusing
upstream's implementation of Realtek board setup. The issue came up on a
Linksys LGS352C device, causing total silence and a hang after
rt-loader's last line "Booting kernel from 0x80100000 ...".
While the OpenWrt downstream version operated on the plain appended
device tree using a pointer, the upstream implementation copies the FDT
into a 16 KiB buffer. Given the following survey, this may be too small
for some devices:
The patch relaxes buf_verify()'s "Non-matching signing type" check so
that an rsa-sha2-256 signature is accepted against an ssh-rsa key.
Dropbear no longer needs the help: both sides of that comparison are now
taken from the wire's own algorithm names, so a compliant client
satisfies expect_sigtype == sigtype unaided.
Tracing the provenance in 2026.92, since it is what the removal rests
on. svr-authpubkey.c:113 reads the algorithm name out of the
SSH_MSG_USERAUTH_REQUEST and :126 turns it into sigtype with
signature_type_from_name(); that value is what :233 hands to buf_verify()
as expect_sigtype. signkey.c:655 parses the type name out of the
signature blob through the same signature_type_from_name(), and :659
compares the two. Neither is derived from the key format found in
authorized_keys: :132 maps the signature type back to the key algorithm
with signkey_type_from_signature() purely for the checkpubkey() lookup.
RFC 8332 section 3 has a client using rsa-sha2-256 send that name in the
userauth request and in the signature both, so the two agree and the
check passes - with an ssh-rsa key in authorized_keys, which is the case
the patch was written for.
Confirmed rather than reasoned: built pristine 2026.92 with this
package's defaults (DROPBEAR_RSA 1, DROPBEAR_RSA_SHA1 0) and logged in
over publickey with an OpenSSH client pinned to
PubkeyAcceptedAlgorithms=rsa-sha2-256. It succeeds, and the server
reports "Pubkey auth succeeded ... with ssh-rsa key" - an ssh-rsa entry
in authorized_keys, an rsa-sha2-256 signature, no patch.
Keeping the patch has an effect of its own. With DROPBEAR_RSA_SHA1 0,
signature_type_from_name("ssh-rsa") falls through to
signkey_type_from_name() and returns DROPBEAR_SIGNKEY_RSA, which is 0.
That is not DROPBEAR_SIGNATURE_NONE, so the patch's own "No signature
type" guard passes it, and expect_sigtype == DROPBEAR_SIGNATURE_RSA_SHA256
skips the type check. buf_rsa_verify() then calls rsa_pad_em(), whose
switch has no case for 0 and ends in default: assert(0), so the process
aborts. Upstream's unconditional check rejects the mismatch instead.
It is also narrower than upstream's in a second way: the replacement
sits inside #if DROPBEAR_RSA / #if DROPBEAR_RSA_SHA256, while the check
it displaces is unconditional. An ECDSA or Ed25519 only build therefore
has no expect_sigtype check at all today, only the "No signature type"
guard. Dropping the patch restores the check for every configuration,
not just this package's default one.
buf_verify() runs only after checkpubkey() has succeeded, so the abort
needs a key already listed in the target's authorized_keys - post-auth,
not an authentication bypass.
The patch's extra DROPBEAR_SIGNATURE_NONE guard is not lost with it:
svr-authpubkey.c rejects that case before buf_verify() is reached.
Murad Rabadanov [Wed, 29 Jul 2026 05:52:42 +0000 (08:52 +0300)]
mediatek: filogic: add support for netis N6 V2
netis N6 V2 is a MT7981B-based router, hardware-compatible with
netis NX32U (confirmed via bootloader cross-flash). GPIO mappings
not covered by the vendor DTS were verified against NX32U and via
live link/carrier testing on switch ports, plus direct LED-toggle
confirmation on the physical device.
Hardware:
SoC: MediaTek MT7981B (Filogic 820)
RAM: 256 MiB DDR3 (ESMT M15T2G16128A-AZR1-EFB, DDR3-1866)
Flash: 128 MiB SPI-NAND
Ethernet: 4x 1GbE (mt7531 switch: wan, lan1, lan2, lan3),
2.5GbE internal CPU-switch link (gmac0, 2500base-x)
WiFi: MT7981 integrated 2.4GHz + MT7976C 5GHz radio,
802.11ax, 2x2 MU-MIMO, HE160 supported (confirmed live;
vendor firmware ships with HE80 for the AX1800 rating)
USB: 1x USB 3.0 (vbus GPIO 23, active high)
Buttons: mesh/rfkill (GPIO 0), reset (GPIO 1)
LEDs: power (GPIO 4), status (GPIO 5), wan (GPIO 9),
wlan 2.4GHz (GPIO 34, phy0tpt trigger),
wlan 5GHz (GPIO 35, phy1tpt trigger),
usb (GPIO 13, usbport trigger)
all active low
UART: 115200n8, uart0
LAN address matches the label on the device enclosure. WAN uses
macaddr_factory_1fef26 on switch port@0, LAN/CPU uses
macaddr_factory_1fef20 on port@6 (mt7531 switch). WiFi MACs are not
set explicitly in DTS -- mt76 derives them from the radio's own
calibration data, confirmed live to match the stock firmware value.
The USB LED (GPIO 13) was missed in the initial GPIO mapping pass --
it isn't referenced anywhere in the vendor DTS or any other board
signal, so it went unnoticed until manual GPIO toggling (`gpio clear
13` at the U-Boot prompt) confirmed it live on the physical device.
The USB LED on GPIO 13 uses the usbport trigger with trigger-sources
on both xhci ports, hence kmod-usb-ledtrig-usbport in DEVICE_PACKAGES.
The included U-Boot defenv for this board also avoids a silent
failure in ubi_write_production/ubi_write_recovery: these call
`ubi remove <vol>` without first detaching/reattaching the UBI
device, which fails silently on a busy volume while the boot script
proceeds as if it succeeded. Worked around here by adding
`ubi detach ; ubi part ubi ;` before the remove, a pattern already
used in other boards' defenvs (see issue #18231). Only this board's
defenv is touched -- other boards' defenv files are unchanged.
Known upstream issue (not specific to this port): probing
u-boot-env-layout on the ubootenv/ubootenv2 UBI volumes logs
"Invalid calculated CRC32" on every boot, see mediatek/filogic
issues #21876 and #22383.
Installation:
Requires network access to stock firmware SSH (enabled by default)
and a TFTP server on the same subnet.
1. Set up a TFTP server on your PC at 192.168.1.254, serving the
files from this release.
2. SSH into stock firmware: ssh root@192.168.1.1
3. Copy bl31-uboot.fip to the router and write it to the FIP
partition: mtd write bl31-uboot.fip FIP
4. Erase the ubi partition: mtd erase ubi
5. Reboot. The new bootloader will detect the missing production
image and automatically fetch initramfs-recovery.itb via TFTP.
6. Once recovery has booted, SSH in again and sysupgrade to the
production image: sysupgrade squashfs-sysupgrade.itb
uboot-airoha: fix eMMC boot failure caused by redundant env
The an7581/an7583 configs enable redundant environment support,
but do not define CONFIG_ENV_OFFSET_REDUND.
When running `saveenv`, U-Boot tries to write the redundant environment
to MMC. Without a valid redundant environment offset, the data may be
written to an incorrect location and overwrite critical boot data such
as the GPT, BL2/preloader or BL31+U-Boot FIP.
This causes the board to fail booting after saving the environment.
Define CONFIG_ENV_OFFSET_REDUND so the redundant environment is stored
at a valid eMMC offset and no longer corrupts the bootchain.
projects / thirdparty / openwrt.git / log
