mediatek: filogic: drop dead eth0 MAC assignment on TP-Link BE450
The eth0 assignment never takes effect. 05_set_preinit_iface brings eth0
up in its default case before 10_fix_eth_mac.sh runs, and the kernel
refuses a MAC change on a running interface, so ip link fails with EBUSY.
This script cannot run any earlier either, since it needs /tmp/tp_data
mounted by 09_mount_cfg_part.
Nothing is lost by dropping it: the DSA user ports carry their own
addresses, which the lan1-3 assignments below already take care of, and
br-lan takes its address from them.
Verified on a BE450 running an image built from main: eth0 comes up with
a different random address on every boot regardless of this line, while
lan1-3 and br-lan keep the label MAC across reboots even with no macaddr
in /etc/config/network.
Fixes: 1513da34bb1a ("mediatek: filogic: set eth0 and LAN port MACs on TP-Link BE450") Signed-off-by: Semih Baskan <strst.gs@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24325 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
mediatek: filogic: set label MAC address on TP-Link BE450
The label-mac-device alias cannot work on this device: it is resolved
by reading the mac-address property of the aliased DT node, but gmac0
never has one. The MAC is stored in a file inside the tp_data UBIFS
volume, so there is no fixed flash offset an nvmem-layout could point
at, and the vendor bootloader does not fix up the FDT either. Drop the
dead alias.
Record the label MAC in board.d instead and assign it to the lan
interface, as is already done for the other devices reading
/tmp/tp_data/default-mac (Mercusys MR90X v1, Archer AX80 v1,
RE6000XD). The explicit lan MAC also makes the br-lan address
independent of the order of the bridge ports.
Suggested-by: Felix Baumann <felix.bau@gmx.de> Signed-off-by: Semih Baskan <strst.gs@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24180 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
mediatek: filogic: set eth0 and LAN port MACs on TP-Link BE450
eth0 (gmac0) is declared label-mac-device, but nothing assigns its MAC,
so it and the DSA lan ports come up with a random locally administered
address that changes every boot. Assign the base MAC from tp_data
default-mac to eth0 and the lan ports, as is already done for eth1 and
eth2.
Each lan port needs its own assignment: a DSA user port copies the
conduit's MAC once when it is created, at driver probe before preinit
runs, and ignores later changes to eth0.
Run-tested on a BE450 on 25.12.5, where the case is identical.
Two boots without the fix each came up with a different
random address; with the fix applied, eth0 and the lan ports get the
label MAC and keep it across reboots.
Andris PE [Mon, 13 Jul 2026 10:41:50 +0000 (10:41 +0000)]
kernel: load vmware net modules early
Load vmware network modules early to make them available for failsafe
mode and first-time scripts
REF:
`https://knowledge.broadcom.com/external/article/321259/choosing-a-network-adapter-for-a-virtual.html`
Additionally add e1000 which is default on "Other Linux" vm profiles
ledtrig-network: default missing family to WLAN on non-DT LEDs
For LEDs that have no network trigger configuration in Device Tree
(no mode or family properties), net_activate() infers the family
from the LED name or function string. If that inference fails,
the trigger previously returned -EINVAL and refused to activate.
This is too strict for manual activation via sysfs (e.g.
echo "network" > /sys/class/leds/<led>/trigger) on LEDs that
were not declared for the network trigger in DT. In that case
the user expects the trigger to load with sensible defaults.
Change the non-DT activation path to fall back to NET_TRIG_WLAN
instead of failing, while keeping the condition visible via pr_warn().
Device Tree paths with dt_mode or dt_family are left unchanged
and continue to fail on invalid parameters
fe_poll_rx() takes the packet length directly from the RX descriptor and
passes it to skb_put() without checking that it fits in the allocated
buffer. A malformed or stale descriptor can therefore extend the skb
beyond its tailroom and corrupt memory.
Reject lengths larger than skb_tailroom(), account the packet in
rx_length_errors and rx_dropped, free the affected skb, and continue by
installing the replacement descriptor.
fe_txd_unmap() uses dma_len0 and dma_len1 to decide whether each TX
mapping must be passed to dma_unmap_page(). After unmapping, however,
the code passed the dma_addr0 and dma_addr1 field identifiers to
dma_unmap_len_set().
This leaves the actual length fields unchanged. A reused descriptor
slot can therefore retain a non-zero length and attempt to unmap an old
DMA mapping again.
Clear dma_len0 and dma_len1 after the mappings have been released.
Jonas Jelonek [Mon, 20 Jul 2026 06:52:05 +0000 (06:52 +0000)]
realtek: pcs: drop unneeded pointer cast
The return value of device_get_match_data was still explicitly casted to
the driver-internal type. However, since this function returns 'const
void *' and in C void pointers are automatically casted, this isn't
needed. Thus, drop it.
Jonas Jelonek [Fri, 17 Jul 2026 08:45:41 +0000 (08:45 +0000)]
realtek: pcs: rtl930x: apply only needed patching
For 10GBase-R and 2500Base-X, the patching sequences for the slower
modes are also applied. This mirrors the SDK which uses some automatic
detection and only does a one-time initialization. However, Linux works
different. The PCS is configured to a specific mode on demand. Thus,
there is no need to apply the other patching when it isn't really
needed.
Those patching sequences seem to initialize AFE blocks within the
SerDes, thus a 1G AFE shouldn't be needed for 10GBase-R. Testing
confirms this so far, no difference in any link characteristics when
e.g. 1G and 2.5G sequences aren't applied for a 10GBase-R link.
Jonas Jelonek [Thu, 16 Jul 2026 23:31:10 +0000 (23:31 +0000)]
realtek: pcs: rtl931x: do not configure 1000Base-X for 10GBase-R
So far, the 10GBase-R configuration mirrored the SDK which in addition
also sets up 1000Base-X and lets it run in a special mode having
autodetection of 10G/1G. This doesn't make that much sense given that
Linux will trigger PCS reconfiguration once the interface mode has
changed. Thus, we should only provide that for each mode standalone, not
for some proprietary and special mixed auto mode.
Jonas Jelonek [Thu, 16 Jul 2026 23:03:36 +0000 (23:03 +0000)]
realtek: pcs: rtl931x: drop RX channel resets during USXGMII config
The mode configuration calls LEQ/DFE reset and RX reset before doing
USXGMII configuration. Though the SDK does that similar, these calls are
actually unneeded because essentially the same is executed later again
in the attachment configuration. This is also the place where it
rather belongs. Thus, drop those calls in mode configuration.
Jonas Jelonek [Thu, 16 Jul 2026 22:59:40 +0000 (22:59 +0000)]
realtek: pcs: rtl931x: drop unused helper
Drop the unused helper rtpcs_931x_sds_reset because it is unused and -
if it was used - would actively mess with the defined SerDes
deactivation/activation in pcs_config.
Jonas Jelonek [Sun, 19 Jul 2026 18:53:38 +0000 (18:53 +0000)]
realtek: pcs: rtl931x: fix 1000Base-X config
Commit 7899dfa6ef71 ("realtek: pcs: rtl931x: separate and reuse
1000base-x config") introduced an issue by accident, using the register
value 0x12 instead of 0x13. A regression hasn't been noticed before, for
yet unknown reasons the 1000Base-X still worked here and there. Probably
due to some external setup.
However, this currently breaks 1000Base-X functionality on at least one
switch. Correcting the register value instantly restores 1000Base-X,
allowing the link to come up. It is unclear yet what this field means,
according to the SerDes register defines from related RTL8295 this might
be TX mode configuration field.
Also add another write which is present in several SDK versions.
Referring from related RTL8295, this might be a field called
EN_LINK_FIB1G, enabling 1000Base-X operation.
Fixes: 7899dfa6ef71 ("realtek: pcs: rtl931x: separate and reuse 1000base-x config") Link: https://github.com/openwrt/openwrt/pull/24310 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Eric Fahlgren [Sun, 12 Jul 2026 17:33:48 +0000 (10:33 -0700)]
package: rtl826x-firmware: make package versions consistent
The two packages rtl826x-firmware and rtl826x-lp-firmware are built
from the same source, yet have 'VERSION=xxx' overrides that modify
the package name and metadata. This causes issues with apk, as
it always selects the package with the higher version number (the
'-lp-' one), irrespective of which package is desired.
Remove the VERSION overrides and use the actual package version so
that apk can install the correct package. The binary contents of
the packages remain unaffect, this only changes the package file
name and metadata related to versioning.
Before
rtl826x-firmware-20221115.apk
rtl826x-lp-firmware-20240729.apk
After
rtl826x-firmware-2026.01.24~0cd4abe2-r4.apk
rtl826x-lp-firmware-2026.01.24~0cd4abe2-r4.apk
Fixes: https://github.com/openwrt/openwrt/issues/24145 Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24201 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Felix Fietkau [Thu, 16 Jul 2026 18:28:27 +0000 (20:28 +0200)]
ucode-mod-bpf: add map info method and map type constants
Scripts need the map type to know how to interact with a map, e.g.
per-CPU value handling or keyless queue/stack semantics. Add an
info() map method returning type, key/value size and max_entries,
along with BPF_MAP_TYPE constants for comparison.
Felix Fietkau [Thu, 16 Jul 2026 18:27:46 +0000 (20:27 +0200)]
ucode-mod-bpf: add ring buffer and perf event buffer support
Add consumer support for BPF_MAP_TYPE_RINGBUF and
BPF_MAP_TYPE_PERF_EVENT_ARRAY maps. ringbuf(callback) and
perf_buffer(callback, pages, lost_callback) map methods return a
buffer resource with fileno, poll and consume methods. The fileno
method exposes the epoll fd and matches the interface uloop.handle()
expects, so a buffer can be passed directly to uloop for event loop
integration.
The ring buffer callback receives the sample data and may return a
negative integer to stop consumption; the perf callbacks additionally
receive the CPU number.
Felix Fietkau [Thu, 16 Jul 2026 18:26:30 +0000 (20:26 +0200)]
ucode-mod-bpf: add map-in-map and prog array support
Updates on array/hash-of-maps and prog array maps take the fd of the
inner object as a 4-byte value. Accept bpf.map and bpf.program
resources as map values and convert them to their fd.
Lookups on map-in-map types return the inner map id; add open_map_id
and open_program_id to obtain a usable object from such an id.
Felix Fietkau [Thu, 16 Jul 2026 18:25:50 +0000 (20:25 +0200)]
ucode-mod-bpf: add support for keyless maps
Queue and stack maps have zero-sized keys and require a NULL key
pointer; the kernel rejects any non-NULL key with EINVAL, making
these maps unusable. Accept a null key argument on maps without a
key, mapping get() to peek, set() to push and delete() with return
to pop.
Felix Fietkau [Thu, 16 Jul 2026 18:25:17 +0000 (20:25 +0200)]
ucode-mod-bpf: add per-CPU map support
Lookup, update and lookup-and-delete on per-CPU maps use buffers of
roundup(value_size, 8) * num_possible_cpus bytes. The previous code
sized buffers for a single value, so get() on a per-CPU map made the
kernel overflow the stack buffer and set() passed undersized data.
Track the map type and size the buffers accordingly. get() and
delete() with return now yield an array with one value per CPU, set()
accepts either such an array or a single value replicated to all
CPUs.
Felix Fietkau [Thu, 16 Jul 2026 18:07:21 +0000 (20:07 +0200)]
ucode-mod-bpf: fix error reporting in tc hook setup
Failures in the detach path returned NULL without recording any error
state, so error() reported a stale or empty error. Attach failures
reported a hardcoded ENOENT regardless of the actual cause. Record
errno for all failures; if_nametoindex, bpf_tc_attach and
bpf_tc_detach all set it.
Felix Fietkau [Thu, 16 Jul 2026 18:07:01 +0000 (20:07 +0200)]
ucode-mod-bpf: fix stale errno when rodata map is missing
bpf_object__next_map does not set errno when it runs out of maps, so
the reported error code was whatever errno happened to hold. With
errno 0 the failure was invisible to error(). Report ENOENT instead.
Felix Fietkau [Thu, 16 Jul 2026 18:05:55 +0000 (20:05 +0200)]
ucode-mod-bpf: fix unaligned access in integer iterator
The iterator key buffer is a flexible array member placed directly
after a bool, leaving it without natural alignment for the u32/u64
loads in next_int. Copy the key via memcpy instead of dereferencing
a misaligned pointer, which traps on strict-alignment targets.
Felix Fietkau [Thu, 16 Jul 2026 18:05:28 +0000 (20:05 +0200)]
ucode-mod-bpf: fix key/value aliasing in map argument conversion
uc_bpf_map_arg converted integer arguments through a single static
buffer. When map set was called with both an integer key and an integer
value, the second conversion overwrote the first, so the element was
written at the wrong key. Convert into a caller-provided buffer
instead.
uc_fn_thisval can return NULL when a method is called with a foreign or
missing this context. pin, foreach and the iterator next functions
dereferenced the result without checking it, crashing the VM.
Firmware image signing in append-metadata/append-gl-metadata was conditional
only by the presence of the build key. Add an explicit SIGN_FIRMWARE option
(default enabled except with BUILDBOT) so appending the fwtool signature can be
toggled on its own.
It's disable on buildbot since we use a decentralized building with no
individual keys on builders. Instead, a fake key is currently used, which adds
an insecure signature.
The future of signing firmware and key distribution across the build
infrastructure should be discussed separately.
Flash instructions:
1. Connect the bundled PoE injector to power.
2. Connect the PC to the LAN1 or LAN2 port of the device.
3. Configure a static IP on the computer's Ethernet adapter:
IP: 192.168.1.x (x = 2 to 254)
Mask: 255.255.255.0
Gateway: empty
DNS: empty
4. Connect a second Ethernet cable to the PoE port of the
bundled injector.
5. Press and hold the reset button on the device.
6. While holding the reset button, plug the other end of the
second Ethernet cable into the WAN port.
7. Wait at least 3 seconds, then release the reset button.
8. Browse to http://192.168.1.1: the MediaTek U-Boot System
Recovery page should appear.
9. Click Upload and select the *-sysupgrade.bin firmware file.
10. After flashing completes, browse to http://192.168.1.1
again: the LuCI login page should appear.
Factory data:
2.4 GHz EEPROM: factory offset 0x0000
5 GHz EEPROM: factory offset 0x8000
LAN MAC address: factory offset 0xe000
WAN MAC address: factory offset 0xe000 (+1)
LED layout:
The Comfast CF-EW84 has five physical LEDs, but only the WLAN
LED is software-controllable through the Linux GPIO-LEDs
subsystem.
Carlo Szelinsky [Sat, 18 Jul 2026 20:09:03 +0000 (22:09 +0200)]
realtek: add support for Zyxel GS1900-10HP B1
The GS1900-10HP B1 keeps the RTL8380M SoC and port layout but replaces the
A1's Broadcom PoE (Gen1) with a Realtek RTL8238 PSE fronted by a Nuvoton
MCU speaking the Gen2 protocol at 115200 baud. It reuses the shared
rtl8380_zyxel_gs1900-10hp.dtsi and only overrides the PSE compatible and
UART speed.
Carlo Szelinsky [Sat, 18 Jul 2026 20:08:34 +0000 (22:08 +0200)]
realtek: gs1900-10hp: move A1 PoE to in-kernel PSE driver
The GS1900-10HP A1 (Broadcom BCM59121 behind a Gen1 MCU on UART) was
driven by the userspace realtek-poe daemon. Move it to the in-kernel
realtek-pse-mcu (Gen1) driver so PoE is managed through the standard
PSE-PD / ethtool interface, and factor the board description shared with
the upcoming B1 variant into rtl8380_zyxel_gs1900-10hp.dtsi.
realtek: dts: adapt RTL8214FC bus location on RTL839x
The RTL839x has the following hard-coded bus topology:
- Bus 0: Port 0-23
- Bus 1: Port 24-51
So the bus number and the PHY address in the dts are mostly
ignored. Nevertheless fix the assignment for the Zyxel GS1920.
This does not change the functionality it just describes the
hardware correctly. While we are here add the PHY package
description too.
Josef Schlehofer [Thu, 16 Jul 2026 21:52:35 +0000 (23:52 +0200)]
CI: remove labeler workflow and enable webhook-based labeling
Remove the .github/workflows/labeler.yml workflow and enable the "enable_labeler_yml" option in .github/formalities.json to let the webhook bot handle pull request labeling. This avoids running on GitHub Actions, so it is faster and uses fewer resources.
It uses the existing .github/labeler.yml for labels.
Josef Schlehofer [Thu, 16 Jul 2026 17:57:35 +0000 (19:57 +0200)]
CI: migrate to webhook bot and simplify labeler
This commit migrates the repository validation to a webhook-based bot instead of the GitHub Actions workflow (.github/workflows/formal.yml).
Since the bot handles stable branch labeling automatically (via the "branch_labeling: true" configuration option), the redundant branch check and labeling steps are removed from .github/workflows/labeler.yml.
The following configuration choices are applied in formalities.json:
- check_space_after_assignment: false (Disabled temporarily to catch any issues since it is a newly implemented check)
- check_makefile_indentation: false (Disabled temporarily to catch any issues since it is a new feature)
- check_patch_headers: 'warning' (Changed to warning instead of hard error since many legacy patches lack headers)
- enable_stale_bot: false (Disabled for now)
Other configurations can be adjusted in formalities.json based on the openwrt-bot-worker repository [1].
Mikhail Zhilkin [Mon, 15 Jun 2026 14:27:49 +0000 (17:27 +0300)]
airoha: add initial support for Nokia XG-040G-MF
This commit adds initial support for Nokia XG-040G-MF XG-PON ONU.
Specification
-------------
- SoC : Airoha AN7583DT (dual-core ARM Cortex-A53 1.2 GHz)
- RAM : 512 MiB DDR4 (Winbond W664GG6RB-06)
- Flash : SPI-NAND 256 MiB (GigaDevice GD5F2GM7UEYIG)
- WLAN : -
- Ethernet : 1x 2500 Mbps (LAN1, Airoha EN8811HN)
3x 10/100/1000 Mbps (LAN2-LAN4, Airoha AN7583 SoC switch)
- XG-PON : ECONET EN7572, SLIC: MaxLinear PEF32001VSV12
- USB : 1x USB2 (with power control via gpio)
1x USB3 (with power control via gpio)
- Buttons : Reset
- LEDs : 1x Power (green)
1x WAN (green)
1x WAN (red)
4x LAN (green)
2x USB (green)
- Power : 12 VDC, 1 A
Unsupported functions, limitations and known issues
---------------------------------------------------
1. XG-PON won't be available after installing OpenWrt.
2. USB ports: AN7583 SoC in OpenWrt doesn't support USB at this time.
Installation (UART)
-------------------
1. Attach UART and run picocom:
picocom -b 115200 --send-cmd "sb -vv" /dev/ttyUSB0
2. Interrupt boot process by pressing Enter key to enter u-boot
Username: telecomadmin
Password: nE7jA%5m
3. Start download firmware via ymodem protocol (via UART):
loady 0x85000000
4. Press Ctrl + A then Ctrl + S in the picocom terminal (if you are using
a different terminal, please refer to the documentation) to start
upload OpenWrt initramfs image using ymodem protocol. Enter local path
to the OpenWrt initramfs image and press Enter.
5. Load OpenWrt initramfs image from the memory:
bootm 0x85000000
5. Sysupgrade with OpenWrt sysupgrade image
Alternative for the p.3-4. Load and boot OpenWrt initramfs from tftp IP
192.168.1.254:
tftpboot 0x85000000 192.168.1.254:openwrt-initramfs-uImage.itb
bootm 0x85000000
Backup and installation (without UART)
--------------------------------------
1. Unplug Fiber
2. Make ONU Reset
3. Navigate: http://192.168.1.1
Username: CMCCAdmin
Password: aDm8H%MdA
4. Go to Apps -> Home Storage -> FTP and check Enable FTP
5. Go to Apps -> Home Storage -> SAMBA Sharing and check Enable Samba
6. Visit the following URL to open Telnet:
http://192.168.1.1/system.cgi?telnet
7. Telnet account login:
Username: user
Password: <see ONU label>
8. Get root privileges:
su user_ftp
Password: <see ONU label>
9. Copy 'squashfs-factory-kernel.bin', 'squashfs-factory-rootfs.bin' and
'OpenWrt.mtd2.u-boot-env.bin' (backup of 'u-boot-env' partition from
the another Nokia XG-040G-MF with OpenWrt installed)
9. Attach USB flash drive and check the new dir in /mnt:
ls /mnt
10. Change current dir to the flash drive (change D to your flash drive
label):
cd /mnt/D
11. Make backup:
for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16; \
do cat /dev/mtd$i | gzip -9 > mtd$i.bin.gz; done
12. Check image sizes:
ls -l | awk '{if(NR>1) {$5=sprintf("0x%x", $5); print}}'
13. Write images:
mtd_debug erase /dev/mtd0 0x60000 0x20000
mtd_debug write /dev/mtd0 0x60000 0x20000 OpenWrt.mtd2.u-boot-env.bin
mtd_debug erase /dev/mtd14 0x0 0x2880000
mtd_debug write /dev/mtd14 0x0 0x3e6cfc squashfs-factory-kernel.bin
mtd_debug erase /dev/mtd11 0x0 0x80e0000
mtd_debug write /dev/mtd11 0x0 0x440000 squashfs-factory-rootfs.bin
0x3e6cfc - size of your 'squashfs-factory-kernel.bin'
0x440000 - size of your 'squashfs-factory-rootfs.bin'
14. Reboot:
reboot
Recovery
--------
The same as described in Installation (UART).
Return to stock
---------------
1. Follow the steps 1-5 of the Installation (UART)
2. Once in OpenWrt upload you backup to the /tmp dir of the router:
scp -O mtd16.bin.gz root@192.168.1.1:/tmp
5. Connect to the router using ssh and install kmod-mtd-rw:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
6. Unlock bootloader:
mtd unlock bootloader
7. Restore stock:
zcat /tmp/mtd16.bin.gz | mtd write - all_flash
8. Reboot:
reboot
UART
----
A view from the back side of the PCB:
------------------------
| GND RX TX
| X X X
Connection parameters:
115200, 8N1, 3.3V
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | e0:xx:xx:xx:xx:a0 | label |
| WAN | e0:xx:xx:xx:xx:a1 | label + 1 |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'ri', 0x3e
Mikhail Zhilkin [Mon, 29 Jun 2026 18:52:26 +0000 (21:52 +0300)]
airoha: move common Nokia XG-040G properties to dtsi files
Move shared DTS properties for Nokia XG-040G-MD and XG-040G-MF into
common DTSI files to reduce duplication:
- an758x-nokia_xg-040g-common.dtsi
- an758x-nokia_xg-040g-stock-parts.dtsi
- an758x-nokia_xg-040g-ubi-parts.dtsi
Mikhail Zhilkin [Tue, 16 Jun 2026 05:12:57 +0000 (08:12 +0300)]
airoha: an7583: remove source-only flag
Remove source-only flag from Airoha an7583 subtarget for upcoming Nokia
XG-040G-MF support. Also disable builds for airoha_an7583-evb and
airoha_an7583-evb-emmc evaluation boards.
Mikhail Zhilkin [Sat, 27 Jun 2026 15:44:28 +0000 (18:44 +0300)]
airoha: use standard LED function and enumerators for PHY LEDs
Configure shared LAN PHY LED templates with standard LED_FUNCTION_LAN
macros and initial function-enumerators. These nodes remain disabled
by default.
Board-specific DTS files enabling them must provide the required 'color'
property, and must override the 'function-enumerator' values if identical
colors are used to guarantee unique sysfs names.
Paul Spooren [Fri, 17 Jul 2026 19:19:46 +0000 (21:19 +0200)]
kernel: use iremap for assembly
Currently assembly code of the Kernel may contain the build path, resulting in
unreproducible firmware images (and Kernels). Fix this by adding a iremap
KAFLAG.
Jonas Jelonek [Wed, 27 May 2026 14:26:47 +0000 (14:26 +0000)]
realtek: add PoE support for GS1920-24HP
Add PoE support for GS1920-24HP by providing the device tree
definition and selecting the Realtek PSE MCU driver package for build.
Support includes both versions of the device since they basically share
the same PSE frontend. The common DTSI includes the shared definitions,
the device DTS files then set the correct compatibles.
Jonas Jelonek [Sun, 3 May 2026 22:17:30 +0000 (22:17 +0000)]
realtek: add PoE support for XGS1930-28HP
Add support for PoE on Zyxel XGS1930-28HP by leveraging the new Realtek
PSE driver. Define the PSE controller with all its properties in DTS of
the device and link it to the PHYs.
Jonas Jelonek [Sun, 31 May 2026 07:40:01 +0000 (07:40 +0000)]
realtek: switch to PSE driver for Plasma Cloud PSX28
Use the kernel PSE driver for PoE functionality on this device instead
relying on userspace apps. Drop the automatic selection for poemgr in
favor of the driver module.
Jonas Jelonek [Tue, 14 Jul 2026 22:08:27 +0000 (22:08 +0000)]
realtek: add PoE support for Linksys LGS328MPCv2
Add PoE support to Linksys LGS328MPCv2 by adding the required device
tree definition and select the needed kernel module package, making use
of the Realtek PSE MCU driver.
Jonas Jelonek [Wed, 15 Jul 2026 08:34:19 +0000 (08:34 +0000)]
realtek: add macro for pse-pi
Add a macro PSE_PI for the common pse-pi definition, helping with
devices which make use of the Realtek PSE MCU driver. While those
definitions stay manageable for low port counts, this adds too much
visual boilerplate with 24 or even 48 ports. The macro keeps it short
with one line per pse-pi.
Also make use of this macro directly for the two devices XS1930-12HP and
XMG1915-10EP.
Anna Kiri [Tue, 26 May 2026 17:10:36 +0000 (19:10 +0200)]
mtd: fis: fix buffer overflow from negative memset size
In fis_remap(), when desc < last, the memset size is computed as
'tmp - end'. Since tmp is calculated as 'end - positive_value', tmp is
always less than end, making 'tmp - end' negative. When cast to size_t,
this wraps to a very large value, causing a massive buffer overflow.
Fix by swapping the operands to 'end - tmp' which correctly computes the
number of bytes to clear.
Maxim Anisimov [Mon, 29 Jun 2026 13:14:20 +0000 (16:14 +0300)]
mediatek: fix nmbm max-reserved-blocks for Keenetic/Netcraze devices
The devicetree set mediatek,bmt-max-reserved-blocks to 64, but the
factory firmware uses 256. With the lower value NMBM fails to locate
its signature on some boards, and the device does not boot.
Restore the factory value of 256 to match stock firmware and fix
boot on affected units.
Vendor nmbm max blocks value:
https://github.com/keenetic/kernel-49/blob/master/drivers/mtd/nmbm/nmbm-mtd.c#L31
MAX_RX_PKT_LEN value 2 selects 1552-byte frames, not jumbo mode.
Select value 3 so the configured 2 KiB frames are actually accepted by
the switch.
Tested on a ZBT-WE826 (MT7620). With value 2, 1534-byte IPv4
packets pass while 1535-byte packets are dropped. With value 3,
1792-byte and 1800-byte DF IPv4 packets pass.
Ran a treewide trailing-whitespace cleanup for *.c, *.h, *.dts and *.dtsi.
Only files under target/linux/lantiq/... and target/linux/qualcommax/...
required changes, so the diff is limited to those paths.
Done by executing commands:
find . -type f | grep "\.c$" | xargs sed -i 's/[ \t]\+$//'
find . -type f | grep "\.h$" | xargs sed -i 's/[ \t]\+$//'
find . -type f | grep "\.dts$" | xargs sed -i 's/[ \t]\+$//'
find . -type f | grep "\.dtsi$" | xargs sed -i 's/[ \t]\+$//'
ipq40xx: ipqess: recover TX queue on watchdog timeout
The current ipqess TX timeout handler only logs the timeout. If TX
completion interrupts are lost or left masked, descriptors can remain
pending indefinitely and the master Ethernet device stays wedged until a
reboot.
Log the TX ring indexes and interrupt state to make future failures
useful, then force the TX completion NAPI path to run and re-kick the TX
producer index. This gives the driver a chance to reclaim pending TX
descriptors and wake the queue instead of reporting the same watchdog
forever.
The ipqess driver is carried locally in OpenWrt and is not present in
upstream Linux. Move the driver sources out of the source-adding kernel
patch and into target/linux/ipq40xx/files/ so the local source is easier
to maintain.
Keep the kernel patch only for the upstream-style Kconfig, Makefile and
MAINTAINERS wiring, and refresh the dependent ipqess patches.
Use the void-returning platform driver .remove callback.
Georgi Valkov [Wed, 15 Jul 2026 14:16:29 +0000 (17:16 +0300)]
kernel: set MACOSX_DEPLOYMENT_TARGET to host version
Fix a warning interpreted as error when building the Linux kernel
on macOS host, by setting MACOSX_DEPLOYMENT_TARGET to the version
of the host. Fixes:
make[5]: Entering directory '/Volumes/test/openwrt/build_dir/target-x86_64_musl/linux-x86_64/linux-6.18.38'
HOSTCC scripts/mod/modpost.o
scripts/mod/modpost.c:1719:9: error: 'strchrnul' is only available on macOS 15.4 or newer [-Werror,-Wunguarded-availability-new]
1719 | sep = strchrnul(namespace, ',');
| ^~~~~~~~~
Jonas Jelonek [Thu, 16 Jul 2026 07:04:51 +0000 (07:04 +0000)]
realtek: fix fan control for Plasma Cloud PSX28/ESX28
Commit 82ddc472d722 ("realtek: dts: convert to upstream switch
notation") adjusted the switch description in the device tree to match
upstream. This was a correct change, however it broke the fan control
script for Plasma Cloud PSX28/ESX28 devices because it uses a
full-fledged platform device path including the switch node (because the
I2C is a child of the switch):
Since the mentioned change, this path doesn't exist anymore. Instead of
just changing the intermediate parts to match the DT structure again, do
not rely on that at all. Instead, use
/sys/bus/i2c/devices/4-002e/hwmon/
as the path which relies less on the DT structure and still points to
the same device. This makes fan control on those device work again,
reducing the fan speed during boot which has been broken since the
commit.
Fixes: 82ddc472d722 ("realtek: dts: convert to upstream switch notation") Fixes: 2b5555c1950d ("realtek: rtl931x: Add support for Plasma Cloud PSX28 Switch") Link: https://github.com/openwrt/openwrt/pull/24248 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Robert Marko [Thu, 16 Jul 2026 12:27:41 +0000 (14:27 +0200)]
airoha: an7583: fix AN7583 PCS port count
The AN7583 PCS match data does not initialize num_port. This leaves it at
zero, so probe allocates a zero-sized ports array and a later PCS lookup
returns a pointer derived from NULL.
Set the number of ports for each AN7583 PCS instance. Also reject
out-of-range PCS indices defensively.
Fixes kernel crashing on boot once ethernet starts probing on AN7583.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Felix Fietkau [Mon, 13 Jul 2026 09:33:44 +0000 (11:33 +0200)]
ucode: update to Git HEAD (2026-07-09)
20a2ae469089 io: support older linux ioctls 16929698e2d3 fs: implement ioctl for macOS 395bb888bd69 io: implement ioctl for macOS 8d7d15ee1a08 compiler: add support for shorthand method declarations 7d9febd13305 nl80211: add mesh peer link enum macros to constants list e851bb64df91 lib: avoid allocating print buffer before NULL check in uc_error_message_indent 5f3a7b87d962 compiler: prevent unbounded recompilation on failed module imports e2493b577250 compiler: scope named function expression names to their own body c3f0d27d812e tests: add regression test for named function expression scoping 738b55299966 vm: release owned value when property assignment fails 1ffd7c5a1011 vm: fix out-of-bounds read in single-name module import a255256db106 vm: fix SIGFPE on INT64_MIN division and modulo by -1 3f4b313d7d78 vm: do not assign to undeclared variables in strict mode e523682670a2 vm: release upvalue reference when resolving it on stack push 6a837090bea3 vm: release module scope reference in dynamic import 395a0a16b4f9 vm: guard error context capture against empty callframe stack 04f103bb2270 vm: respect exponent parity in integer exponentiation bd814a4b2ae3 vm: use UC_ARRAY instead of json_type_array in object spread 5a79aa56c15e vm: release resource type prototypes after the final GC 9c5f16c8e33a lexer: do not treat /*/ as a complete block comment a018067fd12e lexer: preserve NUL bytes in regular expression literals 65d41a1929de lexer: do not consume a sign into hexadecimal number literals 05f9bf9e5d53 lexer: fix source position of ternary question mark token 7bca646e5f88 lib: preserve embedded NUL bytes in reverse() 6fc93bf5bd95 lib: preserve embedded NUL bytes in lc() and uc() a51f4843bce5 lib: avoid passing a signed char to isxdigit() in hex() e8af70e4375c compiler: fix use-after-free of shorthand method name 467fb4406a47 compiler: declare leading variable in counting for loop initializer d256e153799b rtnl: fix stack buffer overflow parsing IFLA_LINKINFO f741ac0a144c rtnl: fix stack buffer overflow parsing RTA_MULTIPATH nexthops c41310f7c2df rtnl: fix inverted address check in multipath nexthop parsing
Felix Fietkau [Fri, 10 Jul 2026 13:06:14 +0000 (15:06 +0200)]
wifi-scripts: don't swap handler config under a running setup script
A reload during an in-flight setup ran wdev_config_init() immediately,
replacing handler_config/handler_data while the script was still running, so
its set_data notifications resolved against the new (renumbered) interface
table and link up/down calls became asymmetric. Defer the re-init in
check() while a handler run is in progress and re-apply from the setup and
teardown callbacks once it completes.
Felix Fietkau [Fri, 10 Jul 2026 13:03:54 +0000 (15:03 +0200)]
wifi-scripts: only manage wdev interfaces recorded in the statefile
wdev.uc adopted every operstate-down netdev on the phy and then removed any
not in its new config. hostapd BSS netdevs are legitimately operstate-down
while stopped (co-located STA down, or start_disabled), so a reload deleted
them and hostapd, seeing an unchanged config, never recreated them. Drop the
adopt-existing step; the statefile already tracks the interfaces wdev.uc
owns.
Felix Fietkau [Fri, 10 Jul 2026 13:02:20 +0000 (15:02 +0200)]
wifi-scripts: give the OWE-transition BSS its own MAC address
The transition BSS is a copy of the main BSS with the MAC already set, so
iface.prepare() was a no-op and both BSSes emitted the same bssid; with a
fixed or random MAC the duplicate was never reassigned and the second
interface failed to come up. Clear the address (and stale flags) and
prepare a fresh one, plumbing the phy/num_global/macaddr_base through
iface_setup().
append() space-joins list options into one line, which breaks hostapd
options that are parsed one entry per line: anqp_elem, nai_realm,
venue_name, venue_url, hs20_conn_capab and the radius req_attr lists (a
parse error there fails the whole phy). Add append_list() to emit one line
per element and route those options through it. vendor_elements is instead
a single concatenated hex blob (join ''), and iface_interworking() no
longer overwrites domain_name with the 3GPP cell-net data (and uses ';').
Felix Fietkau [Fri, 10 Jul 2026 12:53:29 +0000 (14:53 +0200)]
wifi-scripts: use country_code for iw reg set in setup_phy
validate() converts the country alias to country_code and deletes country
before setup_phy() runs, so the iw reg set branch tested a null
config.country and never ran, leaving wdev-only radios (adhoc/mesh/monitor)
on the world regdomain. Use config.country_code.
Felix Fietkau [Fri, 10 Jul 2026 12:52:38 +0000 (14:52 +0200)]
hostapd: ucode: keep comment lines out of the config comparison data
The generator emits a '# Setup interface: <ifname>' comment before each
interface, so the first one landed in config.radio.data and made the radio
comparison depend on the first BSS's ifname: renaming it forced a full
radio restart instead of the rename path. Skip comment lines when parsing
radio.data/bss.data.
Felix Fietkau [Fri, 10 Jul 2026 12:51:32 +0000 (14:51 +0200)]
hostapd: ucode: filter MLD loops by phy in phy_set_state/phy_status
The per-wiphy radio-mask loops iterated all MLDs without checking the phy,
so a stop/start or status query for one wiphy touched MLDs on another wiphy
with the same radio index (clearing present bits, tearing links down, or
reporting a foreign MLD). Skip MLDs that do not belong to the phy, matching
mld_update_phy().
Felix Fietkau [Fri, 10 Jul 2026 12:50:23 +0000 (14:50 +0200)]
wifi-scripts: quote dpp_connector in the station config
dpp_connector was emitted unquoted, but wpa_supplicant parses it as a
string and hex-decodes an unquoted value; a base64url connector then failed
to parse and the network block was rejected. Emit it via the quoted-string
list. dpp_csign/dpp_netaccesskey stay raw, as they are hex.
Felix Fietkau [Fri, 10 Jul 2026 12:49:49 +0000 (14:49 +0200)]
hostapd: ucode: unregister ucode/ubus objects when deleting an unstarted BSS
hostapd_free_hapd_data() skips hostapd_ucode_free_bss()/hostapd_ubus_free_bss()
for a bss that never started, so bss.delete() on such a bss freed hapd while
the ucode registry entry and ubus object still referenced it. Call both
explicitly before os_free(); they are idempotent for the started case.
Felix Fietkau [Fri, 10 Jul 2026 12:48:10 +0000 (14:48 +0200)]
hostapd: ucode: initialise conf in iface.add_bss
The early error path jumps to out: before conf is assigned, where
hostapd_config_free(conf) frees an indeterminate pointer. Initialise it to
NULL (hostapd_config_free tolerates NULL).
Felix Fietkau [Fri, 10 Jul 2026 12:47:35 +0000 (14:47 +0200)]
hostapd: ucode: pass phy to the bss_remove callback
hostapd_ucode_free_bss() pushed only two arguments, but the bss_remove
handler (like bss_add/bss_reload) takes three (phy, name, obj), so name
received the bss resource: the DPP hook was never removed and the removal
event was malformed. Push the phy as well.
Felix Fietkau [Fri, 10 Jul 2026 12:46:58 +0000 (14:46 +0200)]
wifi-scripts: use the base phy name for config_get_macaddr_list
phydev.name is already radio-suffixed, and the hostapd handler re-applies
the suffix, so on multi-radio phys the lookup missed and the returned MAC
list was always empty, letting wdev.uc reuse a MAC hostapd had reserved for
an AP BSS. Pass the base phy and radio index.
Felix Fietkau [Fri, 10 Jul 2026 12:46:37 +0000 (14:46 +0200)]
wifi-scripts: pass device config to parse_encryption for station mode
setup_sta() called parse_encryption() without the device config, so the
sae-compat branch dereferenced a null dev_config.band and threw, aborting
the whole radio setup. Pass the device config through.
Felix Fietkau [Fri, 10 Jul 2026 12:46:09 +0000 (14:46 +0200)]
wifi-scripts: map the configured pairwise cipher for station mode
Only an exact GCMP cipher was mapped to the network block; other explicit
ciphers (CCMP-256, GCMP-256, TKIP variants) left pairwise unset, so
wpa_supplicant offered its default set and could not associate with an AP
restricted to the configured cipher. Pass wpa_pairwise through, keeping the
GCMP special case that also pins group.
Felix Fietkau [Fri, 10 Jul 2026 12:45:38 +0000 (14:45 +0200)]
wifi-scripts: do not treat WDS-station VLAN subinterfaces as the base wdev
The hotplug match /(.+)\.sta.+/ also matched VLAN subinterfaces of a WDS
station (e.g. wlan0.sta1.100 -> wlan0), so the tagged subinterface was added
into the vif base networks, breaking VLAN separation. Anchor the pattern to
the plain station suffix.
Felix Fietkau [Fri, 10 Jul 2026 12:45:10 +0000 (14:45 +0200)]
wifi-scripts: pass multicast_to_unicast as an integer
handle_link() passed the option as a ucode boolean, but the netifd
device_set binding reads it with prop_get_int (UC_INTEGER only) and ignored
a boolean, so the option was a no-op. Convert it to 0/1.
Felix Fietkau [Fri, 10 Jul 2026 12:44:51 +0000 (14:44 +0200)]
wifi-scripts: reset the retry counter on successful setup
retry was only reset on config change/start, never on a successful setup,
so occasional transient setup failures accumulated over a device lifetime
and latched retry_setup_failed after three cumulative failures. Reset it
when the device comes up.
Felix Fietkau [Fri, 10 Jul 2026 12:44:25 +0000 (14:44 +0200)]
wifi-scripts: fix VLAN key for service-injected wifi-iface
Service data VLANs were stored under vif_data.vlans, but every consumer
reads vif.vlan, so per-VLAN config from a procd service was silently
dropped. Use the singular key, matching the adjacent station handling.
Felix Fietkau [Fri, 10 Jul 2026 12:44:07 +0000 (14:44 +0200)]
wifi-scripts: return the interface-creation result from wdev_add
wdev_add() dropped the wdev_create() result, so every caller's error check
was dead and an nl80211 NEW_INTERFACE failure was silently ignored (hostapd
and wpa_supplicant then proceeded on a missing netdev with stale MLD
bookkeeping). Return the result.
Felix Fietkau [Fri, 10 Jul 2026 12:43:53 +0000 (14:43 +0200)]
hostapd: ucode: fix dead reload-all check in mld_set_config
new_config was tested against the freshly emptied new_mld object, so it was
always false and the reload-all-interfaces block never ran. Test the
incoming config instead, so the first MLD config re-adds the spliced-out
MLD BSSes.
Felix Fietkau [Fri, 10 Jul 2026 12:43:40 +0000 (14:43 +0200)]
hostapd: ucode: force restart on unresolvable static BSSID conflict
The guard meant to bail to a full restart read `!mac_idx < 0`, which parses
as `(!mac_idx) < 0` and is always false, so a static BSSID colliding with
the first (or a foreign-owned) BSS fell through and reassigned the wrong
BSS's address. Use `mac_idx <= 0`.
Felix Fietkau [Fri, 10 Jul 2026 12:21:45 +0000 (14:21 +0200)]
wifi-scripts: fix extended-feature bit test
device_extended_features() used bitwise OR instead of AND, so every
extended-feature query returned true regardless of the driver bitmap:
ftm_responder and radar_background were always reported present.
Felix Fietkau [Fri, 10 Jul 2026 12:19:48 +0000 (14:19 +0200)]
wifi-scripts: do not report a disabled wifi-device as up
A disabled wifi-device is intentionally still run through the setup path
(with no interfaces) to reliably tear down hostapd/wpa_supplicant and to
handle disabled/enabled flapping, so it reaches state "up" and status
reported up: true alongside disabled: true. Exclude disabled devices from
the up state in status instead.
Felix Fietkau [Fri, 10 Jul 2026 11:59:30 +0000 (13:59 +0200)]
hostapd: ucode: clear start_disabled when reloading a started BSS
On a radio shared with a STA every AP BSS is generated with
start_disabled=1. A smart reload that takes the full bss.set_config() path
restarts the BSS but never cleared start_disabled, so hostapd_start_beacon()
skipped beaconing and the AP went silently quiet until an unrelated
apsta_state event. Clear it when the BSS was already started, matching the
add_bss path.
Felix Fietkau [Fri, 10 Jul 2026 11:58:55 +0000 (13:58 +0200)]
wifi-scripts: emit a raw 64-hex PSK unquoted for station mode
A 64-character hex PSK was always quoted, but wpa_supplicant rejects a
quoted passphrase longer than 63 characters, so the network block failed
and the STA never associated while netifd still reported the radio up. Emit
the key unquoted when it is a 64-character raw PMK, matching the AP path.
The sae_password branch keeps quoting, as SAE passwords are arbitrary
strings.
Felix Fietkau [Fri, 10 Jul 2026 11:58:33 +0000 (13:58 +0200)]
wifi-scripts: honour a cancelled setup when the handler reports up
stop() and destroy() set cancel_setup while a setup handler is running, but
nothing read it, so a device brought down (or removed) mid-setup still went
up and stayed up, holding its interface links. Check the flag (and
autostart/delete) in wdev_mark_up and tear the device down instead of
completing the up transition.
Felix Fietkau [Fri, 10 Jul 2026 11:58:10 +0000 (13:58 +0200)]
hostapd: ucode: fix per-station PSK list parsing in sta_auth
Two defects handling the psk array returned by an auth handler: strlen()
ran before the string was validated (strlen(NULL) on a non-string entry),
and the hex-PMK branch tested the array length instead of the entry length.
A 64-character passphrase therefore reached the passphrase branch and its
memcpy of str_len + 1 overflowed passphrase[MAX_PASSPHRASE_LEN + 1] by one
byte. Validate the type first and branch on the string length.
Felix Fietkau [Fri, 10 Jul 2026 11:57:49 +0000 (13:57 +0200)]
wifi-scripts: fix undeclared variable in service wifi-device injection
The wifi-device injection path used object shorthand `name` where no such
variable is in scope (the loop binds radio/config), so under the strict VM
config_init threw and the whole wireless configuration for that reload was
skipped. Use the radio key as the device name.
Felix Fietkau [Fri, 10 Jul 2026 11:57:16 +0000 (13:57 +0200)]
hostapd: ucode: handle null config in iface_set_config again
config_reset and shutdown call iface_set_config(name) with no config, but
the null-config guard was dropped in the MLO rework, so config.phy
dereferenced null and threw: config_reset reset nothing and shutdown left
hostapd-created interfaces behind. Restore the guard, removing the stale
config entry and tearing the interface down via iface_config_remove.
Felix Fietkau [Fri, 10 Jul 2026 11:13:32 +0000 (13:13 +0200)]
hostapd: ucode: restart on config-initiated channel switch failure
iface.switch_channel() only reports whether a CSA was started, not whether
it completed, so a config-driven channel switch that the driver never
finishes would leave the AP stuck without recovery. After issuing the CSA,
arm a timer and, if the switch has not completed by the deadline
(csa_in_progress still set), fall back to a full interface restart. The
timer is armed only on the config-initiated path, so ubus- and
apsta-triggered channel switches keep their own recovery.
Add an iface.csa_in_progress() ucode method wrapping hostapd_csa_in_progress().
Felix Fietkau [Fri, 10 Jul 2026 10:31:37 +0000 (12:31 +0200)]
hostapd: ucode: apply channel/width changes via CSA instead of restart
A config change that only alters the channel or channel width previously
failed the radio comparison in iface_reload_config() and forced a full
interface restart, disconnecting every client. Classify the radio diff:
apply a channel/width-only change through iface.switch_channel() (CSA) so
clients stay associated, keep the full restart for any other radio change.
When a co-located STA on the same band owns the runtime channel
(#channel_owned_by_sta), the change is a no-op on the AP side, which keeps
following the STA via apsta_state. MLD APs and DFS targets fall back to a
full restart, as a single iface-level CSA cannot handle them.
projects / thirdparty / openwrt.git / log
