Semih Baskan [Mon, 3 Aug 2026 00:38:01 +0000 (03:38 +0300)]
mediatek: mt7622: drop unused file_type variable
platform_do_upgrade() assigns file_type and never reads it. The call also uses
the argument order from before 715634e6d144, so it returns "unknown" rather than
the real type and would mislead anyone who started using it.
Semih Baskan [Sun, 2 Aug 2026 06:54:44 +0000 (09:54 +0300)]
bcm53xx: fix sysupgrade losing config on NAND devices
The check that decides whether the new rootfs is a UBI image passes one argument
where 715634e6d144 now expects two. Without the extraction command the subshell
runs nothing, the magic comes back empty and the check fails. sysupgrade then
falls back to writing the whole image over the firmware partition, which cannot
carry sysupgrade.tgz into the new rootfs_data volume. After the reboot the
settings are gone, as if -n had been passed, and the UBI erase counters go with
them.
Affects bcm53xx NAND devices flashed with a trx based image, from 24.10.0-rc1
onwards.
The fix lives in the firmware doing the flashing, so upgrading from an affected
build loses the config one last time. Every upgrade from a fixed build onwards
keeps it.
Build tested on main with kernel 6.18, Asus RT-N18U, three consecutive
sysupgrades, config preserved every time.
kernel: add support for HeYangTek HYF1GQ4UDACAE SPI-NAND
The HeYangTek HYF1GQ4UDACAE is a 1 Gbit (128 MiB) SLC SPI-NAND with
2048 + 64 byte pages and on-die 4-bit / 512-byte ECC (JEDEC ID 0xc9),
found among others on some Keenetic KN-3411 (Buddy 6) units.
The driver is accepted upstream and sits in the MTD tree heading for
Linux 7.3, so it goes to backport-6.18 as the upstream commit a837468386 ("mtd: spinand: add support for HeYangTek HYF1GQ4UDACAE").
The Etron and Dosilicon spinand patches are refreshed because the
backport applies before them and touches the same spinand-objs line.
Other SPI-NAND patches in the MediaTek, Airoha, EcoNet and Qualcommax
targets are refreshed for the shifted core offsets.
realtek: clocksource: backport upstream patch for __raw reads & writes
Backport the upstream patch for realtek clocksource driver that
changes register access to instead use __raw_readl and __raw_writel
to not cause unnecessary byteswaps with SWAP_IO_SPACE enabled.
bcm27xx: clean up stray config-6.18/config-6.12 entries
Remove stray/redundant lines from the shared kernel config fragments,
in both config-6.18 and config-6.12:
- CONFIG_COMMON_CLK_RP1_SDIO is listed twice (the second copy has a
double space before "is not set", which is why dedup tooling never
caught it).
- CONFIG_WS2812_PIO_RP1, CONFIG_PWM_PIO_RP1, and CONFIG_RP1_PIO are
each the KCONFIG of a kmod package in modules/other.mk, so
gen_kconfig_overrides() already emits "# ... is not set" for all
three whenever their package is unselected, independently of these
fragments.
KernelPackage/bcm27xx-sound lives under SOUND_MENU and provides
onboard audio support, but the package definition itself was
misplaced in other.mk. Move it to sound.mk alongside the other
audio-related kernel packages. No functional change.
Add a KernelPackage for CONFIG_SERIAL_RP1_PIO_UART, a software UART
implemented on the RP1 PIO block with DMA-driven TX/RX and a PIO
interrupt for break detection. Only 8N1 with no hardware flow control
is supported.
The package follows the same pattern as the other RP1 PIO consumers
(kmod-pwm-pio-rp1, kmod-ws2812-pio-rp1): it depends on kmod-rp1-pio
and is only available on bcm2712. Guard on 6.18, since the driver is
not available on 6.12.
Semih Baskan [Mon, 3 Aug 2026 02:44:59 +0000 (05:44 +0300)]
kernel: xhci: fix USB3 port events with a single roothub
USB3 port events are dropped whenever the controller has only one roothub.
The check that guards them treats a missing shared hcd as proof the hcd was
removed, which stopped being true with upstream commit 4736ebd7fcaf ("usb:
host: xhci-plat: omit shared hcd if either root hub has no ports"). A
controller whose USB2 root hub has no ports gets a single roothub and never
has a shared one, so every SuperSpeed event is thrown away and nothing
enumerates even though the port reports the device:
Remove HOST_CONFIGURE_VARS. These are not needed any more.
ac_cv_search_setfilecon was removed completely and the others are guarded
by if test "$with_selinux" != no; then now.
Zoltan HERPAI [Fri, 7 Aug 2026 07:59:30 +0000 (07:59 +0000)]
uboot-zynq: bump to 2026.04
While at it, replace the SPI MAC address read patch with a rebased
series from the Digilent u-boot repository. It should be noted that
this feature is still not upstreamed. Refresh patches as required.
As most of the zynq boards are merged into xilinx_zynq_virt, add
UBOOT_CONFIG to the respective boards in the Makefile.
Compile-tested: all Zynq boards
Runtime-tested: Antminer S9
Installation (TFTP):
1. Power off the router.
2. Press and hold the Reset button.
3. Power on the router.
4. Wait 5 seconds, then release the Reset button.
5. Connect your PC to the router with Ethernet cable.
6. Configure a static IP address in the `192.168.1.0/24` subnet (except `192.168.1.1`).
7. Configure your TFTP client to use binary (octet) transfer mode.
8. Upload the firmware image (OpenWrt, stock, or Padavan) to `192.168.1.1`.
The TFTP server accepts any filename.
9. Wait for the firmware flashing process to complete.
WARNING: Flashing the stock firmware after using Padavan may brick
your router due to configuration partition incompatibility.
MAC address layout:
- Wi-Fi 2.4GHz & WAN: label MAC
- Wi-Fi 5GHz & LAN: label MAC + 4
Known issues:
- The RT3352 2.4 GHz iNIC is unsupported because it requires a
proprietary firmware blob and kernel support
- The Wi-Fi LEDs cannot be disabled independently because they share
the LED power rail controlled by GPIO10
This work is based on the earlier draft support by Andrej Valek.
kernel: rtl8367b: add support for RTL8367RB with `ver:2000`
This RTL8367RB variant was found in the ASUS RT-N65U v2.60.
The router revision `v2.60` is not tied to `num:6000 ver:2000`,
as units with `num:6000 ver:1000` have also been confirmed.
Reported-by: Andrej Valek <andy@skyrain.eu> Tested-by: Andrej Valek <andy@skyrain.eu> Signed-off-by: Andrey Trishin <zatrit@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24343 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is a security release fixing 32 CVEs (6 High, 15 Med, 11 Low).
Many of them apply to the configuration built here: --enable-opensslall
and --enable-opensslextra are unconditional, and TLS 1.3, session
tickets and OCSP stapling default to y.
OCSP responder authorization is now strictly enforced per RFC 6960
4.2.2.2. The CheckOcspResponderChain() fallback, which accepted any
responder certificate issued by an ancestor of the target's issuer,
was removed. Setups relying on an indirectly issued OCSP responder
will start to fail validation.
Vitaliy Sochnev [Fri, 7 Aug 2026 20:02:02 +0000 (21:02 +0100)]
airoha: an7583: enable USB on Nokia XG-040G-MF
The board has one USB 2.0 and one USB 3.0 port, both powered from a
5V rail switched by GPIO 30. The device tree already carried the whole
USB description commented out, waiting for SoC support.
Uncomment the 3.3V/5V regulators, the usbport LED triggers and the xHCI
node, enable the USB PHY, and add the LED trigger and regulator kmods to
the image.
Vitaliy Sochnev [Fri, 7 Aug 2026 20:01:40 +0000 (21:01 +0100)]
airoha: an7583: build USB support into the kernel
The AN7583 has a single xHCI controller, the same block as on AN7581 and
the MediaTek SoCs. Build the host controller and its glue driver into the
kernel instead of shipping them as modules: the module route needs a
subtarget dependency in KernelPackage/usb3 plus kmod-usb3 in the
DEVICE_PACKAGES of every board that has USB ports, which is a roundabout
way of getting two drivers loaded.
Boards without USB ports carry the code as well, but they are not size
constrained.
Suggested-by: Robert Marko <robert.marko@sartura.hr> Signed-off-by: Vitaliy Sochnev <sochnev.v.74@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24609 Signed-off-by: Robert Marko <robimarko@gmail.com>
Vitaliy Sochnev [Fri, 7 Aug 2026 20:01:18 +0000 (21:01 +0100)]
airoha: an7583: add USB nodes to SoC dtsi
Add the xHCI controller and the USB PHY node. The single controller
exposes two USB 2.0 ports and one USB 3.0 port, all served by one PHY
block: two U2 subnodes at offset 0x0/0x1000 and one U3 subnode that
needs the SCU to switch the shared serdes between USB and HSGMII.
Both nodes are left disabled, boards enable them as needed.
Vitaliy Sochnev [Fri, 7 Aug 2026 20:00:49 +0000 (21:00 +0100)]
airoha: add support for AN7583 USB PHY
The AN7581 USB PHY driver can't be reused on AN7583: the SoC has a
single USB PHY block driving two U2 ports and one U3 port, and both the
PLL init sequence and the U3 calibration differ.
Add the AN7583 USB PHY driver from Christian Marangi, with the PCIe PHY
part dropped (the AN7583 PCIe serdes has no DT node yet) and five bugs
fixed: an uninitialized "ret" passed to dev_err_probe(); a NULL check on
syscon_regmap_lookup_by_phandle(), which returns an ERR_PTR on failure;
a missing per-instance offset in u2_set_mode(), which made it write the
first U2 port's register regardless of the PHY it was called on; an
off-by-one bound in parse_subnode() allowing a write past the end of
priv->phys[]; and a discarded return value in phy_init(), which
swallowed the U3 calibration failure reported by u3_init().
Enable the driver on the an7583 subtarget. The an7581 subtarget keeps
its own PHY_AIROHA_USB driver untouched.
Vitaliy Sochnev [Sun, 9 Aug 2026 16:28:50 +0000 (17:28 +0100)]
airoha: an7583: add DT binding for AN7583 USB PHY
The airoha,an7583-usb-phy compatible added by the USB PHY driver had no
matching binding document. The AN7581 equivalent ships one as a separate
patch (220-05), which is also where the AIROHA_USB2_MONCLK_SEL* defines
used by an7583.dtsi come from.
The AN7583 binding is not simply "same as AN7581": the SoC has a single
PHY block with four named reg regions, per-port child nodes carrying
#phy-cells, and airoha,scu on the USB 3.0 child rather than on the PHY
node itself.
The AIROHA_USB2_MONCLK_SEL* defines are reused from the AN7581 binding
header, as the values are identical on AN7583.
lantiq: xrx200: skip DSL configuration on AVM 5490/5491
Skip the DSL configuration since AVM 5490 and 5491 support fiber instead
of DSL. The DSL configuration overwrites the WAN port configuration.
Fixes: 48b2df5a4164 ("lantiq: add support for AVM Fritzbox 5490/5491") Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Link: https://github.com/openwrt/openwrt/pull/24652 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
lantiq: xrx200: fix fiber port support on AVM 5490/5491
The fiber port on the AVM 5490/5491 is only partially working. Frames are sent
correctly. Most received frames are dropped due to an invalid FCS. It turns out
that delays are needed between the MAC and the PHY. This commit enables RGMII
delays on the PHY side. Traffic now flows in both directions.
Fiber port topology:
SWITCH<-----RGMII----->PHY<-----SGMII----->SFP/SFF cage
Tested on the AVM 5490. On the other end is a network card with a 1000Base-BX10
SFP module (HiKivision HK-SFP-1.25G-20-1550).
The fiber port on the AVM5491 should also work. The AVM 5490 and 5491 share the
same PCB and are almost identical. The only difference is that the AVM5491 has
a standard SFP cage with an external GPON module, while the 5490 has a soldered
1000Base-BX SFF module.
Fixes: 48b2df5a4164 ("lantiq: add support for AVM Fritzbox 5490/5491") Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Link: https://github.com/openwrt/openwrt/pull/24652 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Hauke Mehrtens [Tue, 11 Aug 2026 20:46:05 +0000 (22:46 +0200)]
uhttpd: update to Git HEAD (2026-08-03)
f6c2fcfa539d client: cap cumulative header count and bytes per request 4f307a2156f3 client: verify chunk data is followed by CRLF before resyncing 628a073fef44 listen: set IP_FREEBIND so binding to a not-yet-present address works 0910904b75a3 client: reject empty chunk size lines in chunked transfer parsing 893fed8577d7 client: use strict chunk size parsing to fix issue #3 8867514f51fa client: fix parse_chunksize() return type and stale comment daa5078b959b client: reject invalid header names to prevent request smuggling 69f9cabd0d7d http: use chartypes table consistently, drop ctype.h 003cd188b8f9 http: further consolidate character classification and header parsing f682ccabee9e client: parse and discard chunked trailer sections, use enum chunked_state e76736e5676f ubus: guard params type in uh_ubus_send_request() 42e30caa704e ubus: set d->free unconditionally to fix url_path leak d6205aad6176 client: move unread-body guard into uh_request_done() 3c48b9e17d20 ubus: release client refcount on successful /ubus/subscribe d0b89eb7c70b utils: strip trailing whitespace from header field-values 067466662368 file: dereference symlinks when looking up MIME type c54ba119cf54 lua, ucode: use buffered stdio for script output 60f64bec40c8 tls: add SNI-based redirect support
This closes five published security advisories, three of them rated
high: an unauthenticated header-accumulation memory-exhaustion DoS,
an out-of-bounds write via ubus params type confusion, a url_path
leak, a CL.0 request smuggling desync and a leaked client refcount
that wedges the listener.
Chad Monroe [Fri, 7 Aug 2026 01:43:05 +0000 (18:43 -0700)]
unetmsg: fix TCP_USER_TIMEOUT socket option level
The ucode socket module exports no SOL_TCP so setopt() was called
with level 0 and silently failed. This left inter-node connections
without the 5 second user timeout. A peer that stopped reading
could then stall a blocking channel write forever, deadlocking
every unetmsgd in the mesh along with their local clients.
Daniel Pawlik [Tue, 4 Aug 2026 13:45:57 +0000 (15:45 +0200)]
airoha: use coherent DMA for NPU mailbox buffers
On EN7581 + MT7996, 6f884eb (DMA_BIDIRECTIONAL mailbox map) can make
WLAN_FUNC_GET_WAIT_NPU_VERSION read as 0.0 despite MBOX success.
Allocate one device-managed coherent bounce buffer per NPU core at
probe and reuse it under the existing per-core mailbox lock. That also
keeps the buffer valid if the NPU completes a write after a mailbox
timeout.
Myeongjae SONG [Tue, 4 Aug 2026 16:35:08 +0000 (01:35 +0900)]
ramips: iptime,t5004: fix U-Boot environment size
The U-Boot environment data on the ipTIME T5004 occupies one
128 KiB NAND erase block.
The nvmem layout specified an environment size of 0x1000.
This caused CRC32 validation to fail and prevented the MAC
address cells from being created.
Set env-size to 0x20000 to match the U-Boot environment data
size used for CRC validation.
Fixes: 8dd95cc6b532 ("ramips: iptime,t5004: use nvmem for ubootenv") Signed-off-by: Myeongjae SONG <devparlair@outlook.com> Link: https://github.com/openwrt/openwrt/pull/24530 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Fil Dunsky [Wed, 12 Aug 2026 03:14:46 +0000 (06:14 +0300)]
mediatek: filogic: fix sysupgrade for Wavlink WL-WNT100X3
The stock layout of the WL-WNT100X3 splits the SPI-NAND into
bl2/u-boot-env/factory/fip/ubi/hw and the sysupgrade image is a
sysupgrade-tar that has to be unpacked into the "ubi" partition.
The board was however added to the default_do_upgrade() case, which
writes the image to ${PART_NAME:-image}, i.e. to the "firmware" MTD
partition that does not exist on this device:
find_mtd_index firmware -> []
mtd: Could not open mtd device: firmware
mtd fails, do_stage2 exits before flashing anything and the board
reboots into the old firmware without a visible error, so every
OpenWrt-to-OpenWrt sysupgrade looks like a silent no-op. Only the
initial installation works, since that one is performed by the sysupgrade
of the vendor firmware.
Drop the entry so the board falls through to the generic
nand_do_upgrade() case with CI_UBIPART defaulting to "ubi", like the
identically partitioned WL-WN586X3B.
The WL-WNT100X3 (OpenWrt U-Boot layout) variant uses fit_do_upgrade()
and is not affected.
Fixes: 829d432ecda3 ("mediatek: add support for Wavlink WL-WNT100X3") Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24684 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Magnus Kroken [Tue, 11 Aug 2026 20:33:15 +0000 (22:33 +0200)]
mbedtls: update to 3.6.7
This version fixes security issues and bugs.
Security fixes:
* Fix a side channel in RSA PKCS#1 v1.5 decryption. (CVE-2026-50587)
* Fix a bug where transcript-hash computation errors during TLS 1.2 extended master secret calculation could be ignored instead of causing the handshake to fail. (CVE-2026-50581)
* Fix a TLS 1.3 server-side error-handling bug affecting session ticket generation. (CVE-2026-50640)
* Fix renegotiation failing and potentially causing a buffer overflow in DTLS when badmac_limit is enabled. (CVE-2026-50713)
* Reject ChaCha20 operations that would make the 32-bit block counter wrap around, which could otherwise reuse keystream and compromise confidentiality. (CVE-2026-50584)
* Fixed a TLS 1.3 record-boundary validation issue that could allow unauthenticated plaintext data to be processed across a key change.
* Fix a possible buffer overflow in mbedtls_ecdh_calc_secret() (CVE-2026-35336)
* Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when CBC is disabled. (CVE-ID-50580)
* Fix a side channel in ECC computations that allows a powerful local attacker (typically, untrusted OS attacking a secure enclave) to fully recover long-term secret keys). (CVE-2026-54435)
* Fix a potential information disclosure in TLS 1.2 servers using session tickets. (CVE-2026-50586)
* Fix timing side channel in RSA key generation, prime generation and primality testing, on platforms where division is not constant-time.
* Fix a 1-byte buffer overread when parsing a malformed ECC public key in the PK module. (CVE-2026-50583)
* Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. (CVE-2026-50588)
* Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. (CVE-2026-50579)
* PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224, SHA3-224) on signature verification.
* Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that this function only sets signature algorithms that are enforced during TLS key exchange and not on certificate verification. (CVE-2026-54441)
* Ensure 'dtls_srtp_info' field from 'mbedtls_ssl_context' is properly zeroized when mbedtls_ssl_session_reset() is called. (CVE-2026-50585)
* Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return 1 instead of an error code if the random generator failed when a server called these functions before the end of a TLS 1.3 handshake.
* Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was not advertised in the original ClientHello. (CVE-2026-25832)
* Fix two bugs in the X.509 certificate parser that caused some inputs with a malformed basicConstraints extension to be accepted. (CVE-2026-49300)
Full release notes: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.7
Remove backported upstream patches that are included in this release.
Russell Senior [Mon, 3 Aug 2026 02:18:38 +0000 (19:18 -0700)]
realtek: set power management mode
Discovered that EnGenius EWS2910P v1 appears to require a Set Power
Management Mode command for the port control to function. Ensure
that the power management mode is set to dynamic power management
mode with priority. This should be safe for all gen1 and gen2 boards,
issue a warning if an error is detected.
Charles Joynson [Sat, 8 Aug 2026 04:40:01 +0000 (00:40 -0400)]
base-files: add mtd_get_mac_uci_config()
Add mtd_get_mac_uci_config() for reading a MAC address from a UCI-style
config stored in an MTD partition. This is needed to support the
TP-Link ER605 v1; the existing UBI helper already covers the ER605 v2.
Also refactor common sed logic into a shared helper used by both
variants and drop the redundant cat pipe.
TP-Link ER605 v2 device support is unaffected. The one and only MAC
address on the tddp partition for v1/v2 is the label MAC address.
Lars Gierth [Sun, 9 Aug 2026 14:44:16 +0000 (16:44 +0200)]
realtek: rtl930x: add STC8 MCU support for Hasivo F1100W/WP-4SX-4XGT
This MCU is present on most Hasivo devices and controls basic things
such as watchdog, sensor, and RTC if available.
On devices with PoE PSE support, it also controls the PSE chip and LEDs.
One funny detail is that while the watchdog is present on most Hasivo devices
and (unless armed) resets the whole device, here it only resets the PoE LEDs.
The PoE LEDs reset and blink twice every 75s, even if PoE is unmanaged or off.
Lars Gierth [Sun, 9 Aug 2026 14:10:25 +0000 (16:10 +0200)]
realtek: rtl930x: split PoE variant off of Hasivo F1100W-4SX-4XGT
Now that there's the potential for PoE support on this device,
we make the PoE variant its own device, so that later commits can add
the respective device tree items.
While at it, be explicit about the real SoC in the root compatible.
Chad Monroe [Tue, 11 Aug 2026 03:02:00 +0000 (20:02 -0700)]
mediatek: filogic: SDG-8733A: reset the radio through pcie3
GPIO 9 is the reset input of the MT7995 radio module, active low.
The old description used it as a PERST line on pcie0 with active
high polarity, so the port reset toggled the module reset at the
wrong time and with the wrong polarity.
Describe it as wifi-reset-gpios on pcie3, the port wired to the
module reset. The PCIe controller then releases the module from
reset before link training, with a 100 ms delay.
Chad Monroe [Tue, 11 Aug 2026 03:01:34 +0000 (20:01 -0700)]
mediatek: filogic: mt-stuart: limit USB to USB2
USB3 SuperSpeed signaling interferes with the 6 GHz radio. Disable
the SuperSpeed port on ssusb1 with mediatek,u3p-dis-msk; the port
then runs at USB2 speed.
Stop enabling ssusb0 and its xs-phy. Nothing connects to them on
these boards.
Chad Monroe [Tue, 11 Aug 2026 03:01:17 +0000 (20:01 -0700)]
mediatek: filogic: SDG-8733A: point label-mac-device at wan
The MAC address on the product label is the base MAC, mfginfo
cell 0. On this board gmac2 (wan) uses cell 0. The alias pointed
at gmac1 (lan), which uses cell 1, so the reported label MAC did
not match the label.
Chad Monroe [Tue, 11 Aug 2026 03:00:59 +0000 (20:00 -0700)]
mediatek: filogic: SDG-8733A: describe the LAN LEDs per hardware
The board has three LAN LEDs: white on GPIO 59, amber on GPIO 60
and green on GPIO 68. The old description listed two GPIO LEDs
with swapped colors and drove the green LED from the internal
2.5G PHY.
Describe all three as GPIO LEDs and set the netdev triggers to
match: white 2.5G, green 1G, amber 100M. Drop the PHY LED node
and the LED pinctrl state: the PHY LED pad (2p5gbe_led0, pin 68)
now works as the green LED GPIO, so the PHY drives no LED.
Chad Monroe [Tue, 11 Aug 2026 03:00:06 +0000 (20:00 -0700)]
mediatek: filogic: mt-stuart: use in-band-status on usxgmii links
The USXGMII links to the AQR113C PHYs signal link state and rate
adaptation in-band. Set managed "in-band-status" so phylink tracks
the PCS state instead of a fixed link.
Chad Monroe [Tue, 11 Aug 2026 02:59:44 +0000 (19:59 -0700)]
mediatek: filogic: mt-stuart: drive fan from AQR113C temperature
The AQR113C PHYs run hot and sit away from the SoC sensor. Export
the PHY hwmon sensor as a thermal sensor and add a thermal zone per
AQR113C on all three boards. The zones drive the fan with trips at
108/104/100/90/80/40 C.
Set critical-action "reboot" so a runaway zone restarts the board
instead of an unclean thermal shutdown. Raise the trip hysteresis
from 2 C to 4 C to stop the fan from cycling near a trip point.
Stop passive polling; the zones use active cooling only.
Chad Monroe [Tue, 11 Aug 2026 02:57:56 +0000 (19:57 -0700)]
mediatek: filogic: mt-stuart: move AQR113C reset to MDIO bus level
Each board wires one reset line that resets the AQR113C PHYs as a
group: GPIO 71 on SDG-8733/SDG-8734 and GPIO 62 on SDG-8733A.
Describe that line as the MDIO bus reset with the same assert and
deassert times.
Drop the per-PHY reset-gpios. On SDG-8733 the second AQR113C
claimed GPIO 62, which is not connected on that board.
Chad Monroe [Tue, 11 Aug 2026 02:56:59 +0000 (19:56 -0700)]
mediatek: filogic: restructure SmartRG MT7988 device trees
Replace mt7988a-smartrg-mt-stuart.dtsi with layered dtsi files.
The existing 3 boards assemble from shared building blocks instead
of include-then-delete:
* mt798x-smartrg-common.dtsi: thermal trip/cooling-map macros
* mt798x-smartrg-factory.dtsi: eMMC factory/mfginfo nvmem layout
* mt7988-smartrg-base.dtsi: PMIC, regulators, eMMC, ramoops,
console, watchdog, reset button
* mt7988-smartrg-sysled.dtsi: system LED controller and aliases
* mt7988-smartrg-mt-stuart-gsw.dtsi: built-in switch as lan2-4
with the per-port PHY LEDs
* mt7988-smartrg-wifi-pcie3.dtsi / -wifi-mt7995.dtsi: radio second
PCIe function and pcie0 radio wiring for SDG-8733A
* mt7988a-smartrg-mt-stuart-phase1.dtsi plus per-model pair dtsi
for SDG-8733 (AQR113C WAN) and SDG-8734 (SFP+ WAN)
No functional change is intended. Nodes for hardware that a board
does not have are no longer instantiated on that board: the
unstuffed WAN PHY on SDG-8734, unused pin groups per model, and
the PHY LED setup of the disabled switch on SDG-8733A.
Chad Monroe [Tue, 11 Aug 2026 02:49:49 +0000 (19:49 -0700)]
mediatek: filogic: mt-stuart: drop pci=pcie_bus_perf bootarg
The parameter came from the vendor SDK. The default kernel MPS and
MRRS configuration works correctly on these boards. The parameter
gives no measured benefit.
Chad Monroe [Tue, 11 Aug 2026 02:49:32 +0000 (19:49 -0700)]
mediatek: filogic: mt-stuart: fix dtc warnings
Rename the system LED children to led@1..led@4. The nodes have a
reg property, so dtc wants unit addresses. The sysled driver names
the LEDs from the label property, which does not change.
Remove #address-cells and #size-cells from the eMMC card@0 node.
The node has no children with a reg property.
Vitaliy Sochnev [Fri, 7 Aug 2026 10:09:49 +0000 (11:09 +0100)]
airoha: npu: load the firmware without the sysfs fallback
The NPU driver maps a missing firmware file to -EPROBE_DEFER, so that it
can be retried once the rootfs carrying /lib/firmware is mounted. That
mapping holds only while request_firmware() reports -ENOENT, and it does
not when the sysfs fallback is in play: the request goes to a userspace
helper, blocks for the full 60 second loading_timeout and comes back as
-ETIMEDOUT, which dev_err_probe() then turns into a hard failure. The
board boots a minute slower and ends up with no NPU at all, so no
hardware flow offloading either.
Our own config disables FW_LOADER_USER_HELPER for the target, but that
is not a dependable guard: LEDS_LP55XX_COMMON selects it, so any build
that pulls in kmod-leds-lp55xx-common - every image built with
ALL_KMODS, snapshots included - gets it back, and generic's
FW_LOADER_USER_HELPER_FALLBACK=y then arms the fallback.
Add a patch switching the driver to request_firmware_direct(), which
sets FW_OPT_NOFALLBACK_SYSFS and so reports -ENOENT whatever the
firmware loader is configured to do.
request_firmware_direct() also sets FW_OPT_NO_WARN, so the "Direct
firmware load for airoha/en7581_npu_rv32.bin failed with error -2"
line goes away together with the fallback. There is no variant that
skips the fallback but keeps the warning. While the probe is being
deferred that message was noise, but on a board where the firmware
package is genuinely missing it was the only hint naming the file.
Measured on a Nokia XG-040G-MD with FW_LOADER_USER_HELPER=y and
FW_LOADER_USER_HELPER_FALLBACK=y forced on, the two images differing
only by this patch:
without: 2.477 fallback -> 64.555 -ETIMEDOUT -> probe failed -110,
preinit at 69.6s, NPU unbound
with: no fallback and no warning at all, NPU fw version 1456.62
at 3.665s, preinit at 7.6s
Note the fallback is still compiled in and forced in both cases; the
patch does not disable it, it only keeps the driver from falling into
it.
The patch carries Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha
NPU support") and Cc: stable@vger.kernel.org, so it can be dropped once
it lands upstream and reaches us through a stable update.
Vitaliy Sochnev [Fri, 7 Aug 2026 10:09:40 +0000 (11:09 +0100)]
airoha: an7581: reserve NPU Wi-Fi regions only on Wi-Fi boards
an7581.dtsi reserves five no-map regions for the NPU and hands all of
them to the npu node. Four of them - pkt, tx-pkt, tx-bufid and ba,
110 MiB plus 26 KiB - are consumed only by
airoha_npu_wlan_init_memory(), which the mt76 NPU layer calls when it
attaches an Airoha-offloaded Wi-Fi chip. To run its firmware and to
offload flows the NPU needs the binary region alone, and the driver
looks that one up by index rather than by name.
Boards that bind no Wi-Fi chip to the NPU therefore lose 110 MiB of
DRAM for nothing, and they lose it whether or not the NPU probes at
all: the memory is carved out by the reserved-memory node itself. On
AN7581 that is both Nokia XG-040G-MD variants. an7583.dtsi already does
this correctly and reserves npu_binary only.
Move the four regions into a new an7581-npu-wlan.dtsi and include it
from the two NPU overlays the Wi-Fi boards already pull in, so that the
regions and the full memory-region list follow the Wi-Fi chip instead
of the SoC.
an7581-evb includes the new overlay directly instead. It declares two
mediatek,mt76 nodes with airoha,npu and enables the NPU, but pins no
particular chip because the card goes into a PCIe slot, so it is the
one board using the offload that pulls in neither NPU overlay.
Keep the ba region on all four Wi-Fi boards even though it is described
as MT7996-only. It is already optional in the driver, but narrowing it
down to MT7996 would change behaviour on Kite, so leave that for a
separate change.
Verified by building the device trees before and after: the DTBs of
an7581-evb, an7581-evb-emmc-eagle, an7581-evb-emmc-kite,
an7581-nokia-valyrian and an7581-w1700k-ubi are byte for byte
identical, while an7581-nokia_xg-040g-md and an7581-nokia_xg-040g-md-ubi
each shrink by 376 bytes and lose the four regions.
Tested on a Nokia XG-040G-MD. Reserved memory drops from 197296K to
84400K and MemTotal rises from 325900 kB to 438736 kB, 110 MiB given
back. The NPU still comes up on the binary region alone and reports
"NPU fw version: 1456.62", so dropping the four regions costs the board
neither the NPU nor its flow offloading. Not tested on Wi-Fi hardware,
where the argument rests on the DTBs being unchanged.
xiao bo [Sun, 9 Aug 2026 14:44:59 +0000 (22:44 +0800)]
arm-trusted-firmware-airoha: sync an7581-bl31 BUILD_DEVICES with bl2
an7581-bl31 BUILD_DEVICES list was incomplete and missed:
- airoha_an7581-evb-emmc-eagle
- airoha_an7581-evb-emmc-kite
- nokia_valyrian
- nokia_xg-040g-md-ubi
These devices are present in an7581-bl2 but missing for bl31.
When building these targets, an7581‑bl31 package is never built,
causes FIP failure "fopen ...an7581‑bl31.lzma: No such file or directory".
Sync an7581‑bl31 BUILD_DEVICES to exactly match an7581‑bl2.
Fixes: https://github.com/openwrt/openwrt/commit/467c5b90ba1140dcdabc2e2e203c1d91fca9963e Signed-off-by: xiao bo <peterwillcn@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24626 Signed-off-by: Robert Marko <robimarko@gmail.com>
Robert Marko [Sun, 9 Aug 2026 10:58:49 +0000 (12:58 +0200)]
airoha: fix AN7581 chainloader U-Boot filename
The uboot-airoha package now stages compressed U-Boot images using the
u-boot.lzma suffix. The AN7581 chainloader still looks for the previous
u-boot.bin.lzma filename and consequently falls back to a nonexistent
uncompressed image.
Use the staged u-boot.lzma filename when generating the chainloader FIT.
Fixes: 94a21b3fe9bd ("uboot-airoha: move FIP generation to target and enable autoselection") Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Robert Marko [Sun, 9 Aug 2026 10:50:08 +0000 (12:50 +0200)]
airoha: fix U-Boot artifacts for AN7581 eMMC boards
The AN7581 eMMC Eagle and Kite boards use the shared an7581_rfb
U-Boot build, which produces artifacts with the rfb suffix. The image
recipes instead look for nonexistent per-device rfb-emmc-eagle and
rfb-emmc-kite artifacts.
Use the shared rfb artifacts for both boards so their preloader and
BL31/U-Boot FIP artifacts can be generated.
Fixes: 94a21b3fe9bd ("uboot-airoha: move FIP generation to target and enable autoselection") Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Robert Marko [Sun, 9 Aug 2026 10:33:43 +0000 (12:33 +0200)]
uboot-airoha: use separate DTB for Nokia XG-040G-MD
CONFIG_OF_EMBED is intended for debugging and is not recommended for
production devices. Remove it from the Nokia XG-040G-MD defconfig so
Kconfig selects CONFIG_OF_SEPARATE, consistent with the other Airoha
boards.
The existing default device tree and u-boot.bin build target ensure that
the separate DTB is built and appended to the deployable U-Boot image.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Robert Marko [Sun, 9 Aug 2026 09:21:46 +0000 (11:21 +0200)]
arm-trusted-firmware-airoha: fix BL2 packing on Debian 11
Debian 11 ships coreutils 8.32, whose cksum does not support the
-a crc32b option. This leaves crc empty and causes the subsequent shell
arithmetic expression to fail.
Use Python's built-in binascii.crc32 implementation instead. Python 3 is
already required by the OpenWrt build system and produces the same CRC-32
value before the existing final XOR.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
uboot-airoha: move FIP generation to target and enable autoselection
Move FIP handling to target now that we compile ATF. This is to have always
in sync new ATF and new U-Boot if one of the 2 is already compiled.
Also add HIDDEN ops to enable autoselection of the U-Boot for the required
target. This is needed to prevent user to deselect the U-Boot package
causing failure on ARTIFACTS generation.
Drop precompiled BL2 and BL31 as they can be now compiled from source.
Add support for compiling Airoha ATF, based on a modified version of the
TF-A based on 2.10.
The package will clone the base TF-A and apply the modified source and
pre-compiled objects (DDR calibration, eFUSE handling, TX/RX path...) to
correctly compile.
An helper script is added to implement the same format used for special BL2
handling. BL2 is composed of 3 sub-phase with a initial BL21, a BL22 that
loads a LZMA decompressor and BL23 that actually calibrate and loads BL31
ATF.
Also a special flash_table is used to handle SPI-NAND externally to the
BL2, a special Host target is added for that.
The kernel config refresh done with commit ada7ded disabled the Airoha PM Domain driver
due to the broken Kconfig dependency fixed with an earlier commit.
Add the missing symbol to enable the driver again. Also do a another
kernel config refresh to resolve some dependent PM domain symbols.
airoha: an7581: add airoha,chip-scu phandle to scuclk node
The clk-en7523 driver tries to look up the chip-scu regmap via the
"airoha,chip-scu" phandle first. If absent, it falls back to a
compatible-based lookup with syscon_regmap_lookup_by_compatible().
The AN7583 DTSI already had the phandle but AN7581 did not, relying
on the fallback instead. Add it so the DT explicitly describes the
connection and both platforms use the same lookup path.
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
dev_pm_domain_attach_list() returns the number of attached PM domains
on success (a positive count), or a negative error code on failure.
The airoha-cpufreq driver checks 'if (ret)' which treats a successful
attachment as an error.
Fix by checking 'if (ret < 0)' like all other users of this API.
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
airoha: fix Kconfig dependency issue with PM Domain driver
The AIROHA_CPU_PM_DOMAIN option was added inside the MediaTek PM Domains
menu, which depends on ARCH_MEDIATEK || COMPILE_TEST. Since Airoha
platforms use ARCH_AIROHA, the menu is invisible during kernel
configuration, silently dropping AIROHA_CPU_PM_DOMAIN. This breaks
running `make kernel_menuconfig`.
Add ARCH_AIROHA to the menu dependency so that this option and its
dependencies (PM_GENERIC_DOMAINS, PM_GENERIC_DOMAINS_OF) remain
enabled on Airoha targets.
Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com>
Rustam Adilov [Thu, 6 Aug 2026 15:41:58 +0000 (20:41 +0500)]
realtek: board: some family check cleanups
The prom initialization is a bit of a mess now with all these
model and soc family checks. And realtek_read_model() function
is the worst offender of all as it goes through all of the model
info register from different SoCs just to read details from one
of them.
We can make use of the .data property in realtek_of_match to
clean things up so that each soc family has its own way of
initialization and reading model details.
Create a struct that will be used for that and add all of the
soc data structs for all chip families.
With all that, remove realtek_read_model() function and most
of the soc_info.family checks in various functions.
In addition, add the rtl960x compatibles along as well so that
rtl960x model info details has somewhere to be used. RTL8198D
is also added as it is part of RTL9607C family.
Rustam Adilov [Fri, 7 Aug 2026 15:56:36 +0000 (20:56 +0500)]
realtek: dts: fix up the wrong soc compatibles
Some rtl9302 based boards use the realtek,rtl838x-soc compatible
in their device tree instead of the correct realtek,rtl9302-soc.
This is also the case for main rtl931x and rtl930x device tree files.
In preperation for utilizing device data in the board-realtek, fix
this up now so that these boards don't end up breaking due to incorrect
prom initialization caused by rtl838x-soc compatible.
Mikhail Zhilkin [Fri, 7 Aug 2026 11:25:47 +0000 (14:25 +0300)]
airoha: an7583: fix ethernet breakage on Nokia XG-040G-MF
Recent upstream cleanups moved switch port labels to the board level and
disabled switch ports/PHYs by default on the AN7583 SoC dtsi. This broke
ethernet on the Nokia XG-040G-MF since its board DTS was not updated to
explicitly configure and enable them.
Fix this by explicitly enabling gsw_port2-4 along with their respective
PHYs and restoring the "lan2", "lan3", and "lan4" port labels.
Fixes: ce55cdde26a9 ("airoha: an7583: move the switch port label from soc-level to board-level") Fixes: d2698d325b68 ("airoha: an7583: disable all switch ports and PHYs by default") Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24606 Signed-off-by: Robert Marko <robimarko@gmail.com>
Robert Marko [Fri, 7 Aug 2026 11:47:57 +0000 (13:47 +0200)]
airoha: pinctrl: fix AN7583 eMMC pinmux
The SCU IOMUX reset puts AN7583 pins 45-47 into GPIO mode. These pins
are shared with eMMC, but the generic eMMC function group only enables
the eMMC mode bit and leaves the GPIO overrides active, preventing the
card from initializing.
Add an AN7583-specific eMMC function group that also clears the GPIO
mode bits for the shared pins.
Fixes: d0110a25ed ("airoha: add pinctrl fixes for AN7581 and AN7583") Signed-off-by: Robert Marko <robert.marko@sartura.hr>
kernel: fix stale HIFIBERRY_STUDIO symbol, add TOUCHSCREEN_ST7123
The Kconfig symbol backing the HiFiBerry Studio driver was renamed
from SND_BCM2708_SOC_HIFIBERRY_STUDIO_DAC8X to
SND_BCM2708_SOC_HIFIBERRY_STUDIO. Update to the new symbol name.
Also add the new CONFIG_TOUCHSCREEN_ST7123 symbol, disabled by
default, to the generic config.
bcm27xx: drop dwcmshc_remove() timeout_clk disable
The quilt rebase of
0299-mmc-sdhci-of-dwcmshc-define-sdio-timeout-clocks.patch matched
the wrong occurrence of the two clk_disable_unprepare() calls for
pltfm_host->clk and priv->bus_clk, which appear both in
dwcmshc_probe()'s error path and in dwcmshc_remove(). This added a
clk_disable_unprepare(pltfm_host->timeout_clk) call inside
dwcmshc_remove() that is present in neither mainline Linux nor
raspberrypi/linux's rpi-6.18.y.
Drop it for now rather than carry an unverified addition. If it
turns out timeout_clk does need disabling on remove, it can be
reinstated with a clear rationale.
Fixes: 7105bec48f27 ("kernel: bump 6.18 to 6.18.40")
See: https://github.com/openwrt/openwrt/pull/24419
bcm27xx: update patches up to Git HEAD (2026-08-02)
These patches were generated from:
https://github.com/raspberrypi/linux/commits/rpi-6.18.y
Patches were generated from the diff between linux kernel branch linux-6.18.y
and rpi-6.18.y from raspberry pi kernel source:
Use the standard 'led' node name for GPIO LEDs as required by the
devicetree specification.
Signed-off-by: Ziyang Huang <hzyitc@outlook.com>
[ adapted from commit f5bf8c2b9482 ("airoha: correct led nodename") ] Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24264 Signed-off-by: Robert Marko <robimarko@gmail.com>
airoha: an7583: move the switch port label from soc-level to board-level
Different boards use different port maps. Defining the port labels in
board-level is better.
Signed-off-by: Ziyang Huang <hzyitc@outlook.com>
[ adapted from commit e2f7ad08c765 ("airoha: move the switch port label from soc-level to ...-") ] Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24264 Signed-off-by: Robert Marko <robimarko@gmail.com>
airoha: an7583: disable all switch ports and PHYs by default
Some boards only use some of them, so enable as necessary in the
board-level DTS.
Signed-off-by: Ziyang Huang <hzyitc@outlook.com>
[ adapted from commit 007aa5a51ce8 ("airoha: disable all switch port and phy by default") ] Signed-off-by: Daniel Schwierzeck <daniel.schwierzeck@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24264 Signed-off-by: Robert Marko <robimarko@gmail.com>
The LAN MAC (gmac0) is the one printed on the device label.
Installation
------------
Factory bootloader is locked to 64mb partition layout, so OpenWrt U-Boot
has to be flashed first. Steps 1, 2 and 4 are run from a shell on the
stock firmware, where the 'bl2' and 'fip' partitions are writable - in
OpenWrt they are read-only, so the procedure cannot be repeated from
OpenWrt. Back up both partitions before overwriting them:
1. Upload OpenWrt 'bl31-uboot.fip' and 'preloader.bin' images to the /tmp
dir of the router using scp protocol
2. Write fip and bl2 (replace bootloader):
3. Place OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-initramfs-recovery.itb'
image on the tftp server (IP: 192.168.1.254)
4. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
5. U-Boot automatically boots the OpenWrt recovery image from the tftp
server to the RAM
6. Upload OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-squashfs-sysupgrade.itb'
image to the /tmp dir of the router (IP: 192.168.1.1) using scp
protocol
7. Connect to the router using ssh and run:
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-initramfs-recovery.itb'
image on the tftp server (IP: 192.168.1.254)
2. Press "Reset" button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
Reverting to stock firmware requires writing the 'bl2' and 'fip' backups
taken above back with 'mtd write', then flashing the stock image; without
those backups there is no way back, because the stock bootloader cannot
be downloaded from the vendor.
Wrap all swconfig-specific code in mt7530.c with #if IS_ENABLED(CONFIG_SWCONFIG),
including struct switch_dev, the vlan/port mapping tables and all
switch_dev_ops callbacks. Register access helpers (mt7530_r32/w32), the
PSC/HWTRAP definitions, and the small set of swconfig-only register
macros and MIB tables further up the file remain unconditional - the
latter two are unused-but-harmless when swconfig is disabled and are
left alone to keep the diff focused.
When swconfig is not compiled in, the driver performs only minimal
hardware init (disables MAC learning on all ports, applies the HWTRAP
fixup) and skips switch registration, mirroring the existing behaviour
of the "mediatek,no-swconfig" device tree property. This removes the
need for that property when building DSA-only images. The property is
still honoured whenever CONFIG_SWCONFIG is enabled (built-in or as a module).
A distinct log message is used for the compile-time case, to
distinguish it from the runtime "mediatek,no-swconfig" case in dmesg.
Also switch the existing runtime "swconfig disabled" message from
pr_info() to dev_info(), changing its dmesg prefix from "mt7620: " /
"mt7530: " to the device's own prefix.
projects / thirdparty / openwrt.git / log
