Paul Spooren [Fri, 12 Jun 2026 14:49:44 +0000 (16:49 +0200)]
build: fixup version.date creation for source archives
Published sources archives may contain a mixture of MTIMEs, so taking the time
of the first file found varies based on filesystem order. To fix this, sort all
MTIMEs and take the latest.
Since piping into a file directly creates that file, we also need to
specifically tell `find` to ignore `version.date`.
Furthermore, move this prior to the ./src copy step, since for some packages,
the OpenWrt build system ships extra ./src files, which would introduce the
wrong timestamps again.
generic: mxl862xx: allow CPU/SerDes ports to probe on firmware < 1.0.84
The firmware-version gate in mxl862xx_phylink_get_caps() leaves
config->supported_interfaces empty for the CPU/SerDes ports (9, 13) when
the switch runs firmware older than 1.0.84. phylink rejects an empty
supported_interfaces bitmap, so the switch fails to probe at all:
mxl862xx mdio-bus:10: switch ready after 2480ms, firmware 1.0.70 (build 70)
mxl862xx mdio-bus:10: phylink: error: empty supported_interfaces
error creating PHYLINK: -22
mxl862xx mdio-bus:10: probe with driver mxl862xx failed with error -22
This regresses boards still shipping the older vendor firmware (e.g. the
BananaPi BPi-R4 Pro 8X, which ships 1.0.70) where all LAN ports disappear.
Ungate only the CPU/SerDes ports (9, 13) so the switch probes and the user
can update the firmware; ports 10..12 and 14..16 stay gated as they are
genuinely unsupported by the old firmware.
Tested on a BPi-R4 Pro 8X with switch firmware 1.0.70 (kernel 6.18); the
6.12 patch receives the identical change for parity.
Michał Kępień [Fri, 12 Jun 2026 07:28:03 +0000 (09:28 +0200)]
ath79: mikrotik: also compile AG71XX_LEGACY as a module
Commit 9091c9f8cbd9 ("ath79: mikrotik: compile SWCONFIG and AR8216_PHY
as modules") caused the hybrid PHY/MDIO ar8xxx driver to be built as a
module instead of built-in. On at least MikroTik RouterBOARD 951G-2HnD,
this prevents the kernel from binding the correct PHY driver at boot
because the ar8xxx driver is not yet available when the MDIO bus is
probed:
- before:
ag71xx-legacy 19000000.eth: invalid MAC address, using random address
switch0: Atheros AR8327 rev. 4 switch registered on mdio.0
ag71xx-legacy 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd034, driver=Atheros AR8216/AR8236/AR8316]
eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii
- after:
ag71xx-legacy 19000000.eth: invalid MAC address, using random address
ag71xx-legacy 19000000.eth: connected to PHY at mdio.0:00 [uid=004dd034, driver=Generic PHY]
eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii
As the PHY is already bound to the fallback "Generic PHY" driver when
the ar8xxx module is loaded, the switch remains non-functional and the
router has no network connectivity.
Fix by also compiling the MAC driver (ag71xx-legacy) as a module,
deferring switch initialization until control is transferred to
userspace during boot. The configured module autoload priorities
(ar8xxx: 43, ag71xx-legacy: 50) ensure that the ar8xxx driver is loaded
before ag71xx-legacy.
Fixes: https://github.com/openwrt/openwrt/issues/23739 Fixes: 9091c9f8cbd9 ("ath79: mikrotik: compile SWCONFIG and AR8216_PHY as modules") Suggested-by: Daniel Golle <daniel@makrotopia.org> Signed-off-by: Michał Kępień <openwrt@kempniu.pl> Link: https://github.com/openwrt/openwrt/pull/23748 Signed-off-by: Robert Marko <robimarko@gmail.com>
Jonas Jelonek [Thu, 11 Jun 2026 22:05:16 +0000 (22:05 +0000)]
realtek: pcs: rtl838x: drop redundant reset writes
Sometimes redundancy is so obvious that one likely misses it. Trying to
bring all SerDes setup into a unified shape, one thinks twice if
something is really needed or not.
For the RTL838x case, the single writes for take/release reset were still
an outlier. Looking closer at them one can see that the same bits are all
covered already in deactivate/activate. So before, they have been put
into the desired state but those outlier writes mess with them again.
[0, 3, 0x7146/0x7106] just deals with the SOFT_RST bit that is already
covered by rtpcs_838x_sds_reset.
[0, 0, 0xc00] touches multiple bits, amongst the EN_RX/EN_TX bits
already covered in deactivate/active. Moreover, it potentially forces
other bits into a state causing broken functionality, e.g.
INV_HSI/INV_HSO which deal with the polarity. This has no effect right
no right now but might be a latent issue in the future.
Also move the reset call down to the end of the function, doing a
soft/RX reset after every configuration is done. This is likely what the
SDK also intended, and mirrors the 839x behavior.
Jonas Jelonek [Thu, 11 Jun 2026 18:40:32 +0000 (18:40 +0000)]
realtek: pcs: rtl838x: replace literal with macro
Replace 0 with MII_BMCR because in this context, it maps cleanly to
normal PHY register structure. BMCR_PDOWN is already used there to show
which bits are set.
Jonas Jelonek [Sat, 6 Jun 2026 21:03:07 +0000 (21:03 +0000)]
realtek: pcs: rtl838x: merge and simplify patching
Reduce the per-SerDes patching to a per-mode patching since they share a
lot of similarities, especially for QSGMII.
For fiber patching, the differences are bigger. This takes an approach
to merge the sequences completely despite applying some settings which
weren't applied before on one of the SerDes. Testing and SerDes dumps
showed no or minimal differences, and no practical effect on
functionality. A look at the SerDes register documentation we have shows
reordering the writes isn't problematic because most of the bits aren't
any trigger bits.
With all its users gone, we can now drop also the workaround SDS macro.
Jonas Jelonek [Thu, 11 Jun 2026 08:28:27 +0000 (08:28 +0000)]
realtek: pcs: rtl838x: carve out writes for SerDes 0/1
For an attempt to simplify and reduce patching, carve out two special
writes for SerDes 0/1. While their exact purpose isn't fully known, they
need to match to make QSGMII on those two SerDes work. In order to be
able to merge the per-SerDes QSGMII patching sequences, carve them out
to the patching function one level above.
Jonas Jelonek [Sat, 6 Jun 2026 19:17:32 +0000 (19:17 +0000)]
realtek: pcs: rtl838x: set mode after patching
In order to have a unified SerDes setup sequence, align RTL838x to all
other variants. Set the mode after patching has been applied. Testing on
devices showed the order is rather irrelevant.
Jonas Jelonek [Wed, 22 Apr 2026 13:54:15 +0000 (13:54 +0000)]
realtek: pcs: rtl838x: fold lane enables and fiber path into {de,}activate
Expand the 838x deactivate/activate helpers to also cover the analog lane
enables (REG0 EN_RX/EN_TX) and the fiber path power-down (FIB_REG0
CFG_FIB_PDOWN), which are operational-state concerns rather than reset
concerns:
- _deactivate: clear EN_RX/EN_TX and set CFG_FIB_PDOWN in addition to
block-level power off.
- _activate: clear CFG_FIB_PDOWN and set EN_RX/EN_TX before block-level
power on. The pulse-start EN=0 is omitted since _deactivate already
established EN=0 and nothing in between touches REG0[1:0].
Shrink rtpcs_838x_sds_reset() accordingly: it now owns only the SOFT_RST
toggle, making it a pure digital reset primitive. The stale "SerDes %d
reset" dev_info was dropped along with the analog/fiber writes.
Behavioural note: the EN and FIB_PDOWN writes now happen *after* the
SOFT_RST release inside rtpcs_838x_sds_reset(), rather than before it as
in the old combined sds_reset. This creates a brief window where the
SerDes is out of digital reset with lanes still disabled, before
activate re-enables them. Consistent with the new
power_off/deactivate -> configure -> reset -> activate/power_on phase
structure, but diverges from the SDK ordering (EN pulse before SOFT_RST
release). Testing on real hardware shows no difference.
Backport several fixes and enhancements for the rtl8365mb DSA driver
from upstream.
The backport includes the following changes:
- Fix for rtl8_4 tag (from v7.1)
- VLAN and Forwarding offload (from v7.2)
Before this backport, all bridge forwarding was handled by the CPU,
causing a significant performance drop between LAN ports, similar
to standard WAN/LAN routing. Enabling hardware forwarding offload
alleviates CPU overhead and restores line-rate switching performance.
Shine [Sun, 31 May 2026 13:16:09 +0000 (15:16 +0200)]
scripts: dhcp/dhcpv6: handling of invalid client ID values
Verify and clean up client ID and global DUID config values before use, in
order to prevent DHCP client malfunction and loss of IPv4 and/or IPv6
connectivity.
- Accept common separators in the string (colon, dash, spaces/tabs, lf)
- Ignore invalid values (non-hex or odd-numbered length)
- Log a warning for invalid settings
The fall back mechanism is as follows:
If a (user-configured) network.<ifname>.clientid setting is found invalid,
ignore and fall back to using network.globals.dhcp_default_duid. In case
that's also invalid (e.g. has been tampered with), don't pass a client
ID to updhc/odhcpc. In that case, udhcpc/odhcpc will use their defaults,
which currently is the i/f MAC address resp. the i/f DUID-LL.
Only error handling is introduced, no behavior change for valid settings.
Paul Spooren [Wed, 10 Jun 2026 14:21:40 +0000 (16:21 +0200)]
package: nftables backport of reproducible builds patches
Building `nftables` twice results in slightly different binaries and since
it's including in the OpenWrt default firmware, breaks reproducibility of
shipped artifacts.
Enabling autoreconf, since the patches introduce a `nftvbersion.h.in` file.
This commit backports patches netfilter to fix this:
Paul Spooren [Wed, 10 Jun 2026 15:18:37 +0000 (17:18 +0200)]
package: make APK embedded help gzip reproducible
APK compresses it's helptext using LUA and require `zlib`, which isn't
available on the Buildbots. It thens falls back to `gzip`, which embeds the
MTIME, making the binary itself unreproducible.
This commits adds a downstream patch to run `gzip` with `-n`, setting the time
to 0.
Rosen Penev [Thu, 4 Dec 2025 03:15:05 +0000 (19:15 -0800)]
ath79: fix label-mac-device
It appears 683-of_net-add-mac-address-to-of-tree.patch relies on the
mac-address nvmem property being present. These nodes don't need it as
they take it from the eeprom but label-mac-device needs it.
1. Attach to serial console using a Cisco cable, 115200 8n1
2. Power on the switch and rapidly press Esc to interrupt U-Boot
3. Initialize the RJ45 ports by running `rtk network on`
4. Serve the initramfs-kernel.bin image on TFTP, IP 192.168.1.111
5. Use any RJ45 port to connect to your TFTP server
6. Run `tftpboot 0x81000000 initramfs-kernel.bin; bootm`
7. Use `mtd dump` or `dd` to backup the original firmware at `mtd5` first
8. Run sysupgrade to flash sysupgrade.bin into the switch and reboot
Restoring original firmware
-----------------------------
Vendor does not provide firmware images, so you should have made a backup.
Use `mtd write` to restore your backed up copy into the `mtd5` partition.
MAC Address
------------
All interfaces are assigned the same MAC address, from the U-Boot env
`ethaddr`. This MAC address is also printed on the device label.
Thomas Richard [Sat, 18 Apr 2026 12:37:33 +0000 (14:37 +0200)]
stm32: 6.18: disable some unnecessary options
The COMMON_CLK_STM32MP215 option is for clock support on MP215 platforms,
and PINCTRL_STM32_HDP is for Hardware Debug Port pin control. They can be
safely removed.
Thomas Richard [Mon, 18 May 2026 08:36:04 +0000 (10:36 +0200)]
stm32: fix return value of phy_power_on() in dwmac-stm32 driver
Patch 700-net-stmmac-dwmac-stm32-add-support-of-phy-supply-pro.patch
introduces phy-supply support in dwmac-stm32 driver. But the phy_power_on()
function always returns 0 even if it failed to drive the regulator. So fix
phy_power_on() to return an error if something wrong happened.
Thomas Richard [Fri, 17 Apr 2026 18:55:39 +0000 (20:55 +0200)]
kernel/stm32: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
Hauke Mehrtens [Sun, 7 Jun 2026 11:31:36 +0000 (13:31 +0200)]
uclient: update to Git HEAD (2026-06-07)
f227ab4f1285 uclient: fix memory leak of url when backend alloc fails 645236607a3d uclient: free proxy_url in uclient_free 53d2d11fb00d uclient-http: fix NULL deref when digest WWW-Authenticate lacks params 0ba1b8718be5 ucode: check calloc return in uc_uclient_new 5cb19466d076 uclient-fetch: reset redirect counter per request 568c447950c1 uclient-fetch: retry short writes and surface errors 4c4a61a69ac3 uclient-fetch: use strtoull to parse Content-Length 440ca260622d uclient-http: validate Content-Length and chunk sizes from the server 8658324bd234 uclient: cast to unsigned char before ctype classifications bf403fa0f8e5 uclient-fetch: reject CR in --header values ec47f4176b1e uclient-fetch: always allocate auth_str and free it on exit 391dacd10d31 uclient-http: fail digest auth when the cnonce cannot be randomized ba1f4311b099 ucode: clamp read length to the size of the static buffer 0ba47f319b09 uclient-fetch: advance to the next URL between requests 9dd0055d527d uclient: initialize *port for unknown address families f816506651d5 uclient-http: start digest nonce count at 1 9b9b2da40835 uclient-http: fix 2-byte buffer undercount in digest add_field 80fb1e5ee68b ucode: avoid double-free of SSL context on ssl_init error d44fb561bbcf ucode: don't clear an unrelated registry slot on free 02562403d2a3 uclient-fetch: close the output file before fetching the next URL 4a63561d0012 uclient-http: initialize fd to -1 so a failed connect can't close stdin 428ae8342118 uclient: cancel pending timers in uclient_free() ffd8db308289 uclient-fetch: guard SSL debug setup against a missing SSL context 9f4db039a263 ucode: release callback argument references d2af92b0aad9 uclient-http: resolve redirects against the proxy target URL 5dddda023267 uclient-utils: avoid out-of-bounds pointer in get_url_filename 8507588e7ce7 uclient-http: use the proxy target URL for HTTP authentication 322c89c6ca0a uclient-http: retry 401 auth for all body-less request methods db3bb00ddda7 uclient-http: accept unquoted digest auth parameter values 5ce9983b2a11 uclient-http: follow 303 and 308 redirects 070c868486dc uclient-fetch: finalize request on invalid 206 Content-Range 83659a5a9bc1 uclient-fetch: concatenate multiple URLs into a single -O file 43bed2753998 ucode: don't leak string references in status()/get_headers() 03b17e4fc793 uclient-fetch: attach credentials to the proxy target, not the proxy 74c07b12f7ab uclient-fetch: don't run the progress meter in spider mode daad21fa2c17 uclient-fetch: handle init_request failure on the 204 resume retry
Anna Kiri [Mon, 8 Jun 2026 09:07:05 +0000 (11:07 +0200)]
mtd: fix buffer leak and fd leak in mtd_dump()
Two leaks in mtd_dump():
- The buffer allocated with malloc(erasesize) is never freed before
returning, leaking erasesize bytes on every call.
- The pre-existing malloc-NULL early return path also leaked the just-
opened fd by returning directly instead of going through cleanup.
Initialize buf to NULL, route the malloc-NULL case through the
existing 'out:' label, and add free(buf) on the cleanup path so both
fd and buf are released consistently on every exit.
Anna Kiri [Mon, 8 Jun 2026 09:06:32 +0000 (11:06 +0200)]
mtd: check malloc() return value in mtd_check()
After malloc(erasesize) in mtd_check(), the result was never checked
for NULL. On allocation failure, the buf pointer remained NULL and
would later be used in image_check() via read(imagefd, buf + buflen,
...), causing a NULL pointer dereference.
Add a NULL check after the allocation and return early. The early
return path also closes the just-opened fd and frees the strdup'd
colon-separated device-list copy to avoid leaks.
Anna Kiri [Mon, 8 Jun 2026 09:05:55 +0000 (11:05 +0200)]
mtd: check return values of lseek() and write() in mtd_write_buffer()
Two ignored return values in mtd_write_buffer() caused silent failures:
- lseek() return value was ignored. A failed seek (e.g. EBADF, ESPIPE)
followed by write() would silently write at the wrong offset.
- write() return value was ignored, silently discarding write errors.
This could lead to data corruption on the MTD device without any
indication.
Check both return values, report errors to stderr and return -1 on
failure.
Improve some descriptions so that they make the purpose of the
particular firmware package clearer to the user (e.g. as viewed in
verbose package listings).
Grische [Sun, 3 May 2026 14:34:46 +0000 (16:34 +0200)]
ipq806x: ap3935: disable hibernation on LAN1
The Extreme Networks AP3935's LAN1 port (gmac0/RGMII to AR8035 at MDIO
addr 1) fails to acquire a link if no Ethernet cable is connected at
power-on; the port stays dead even after a cable is later inserted, and
only a network restart recovers it.
The AR803x family enables hibernation mode by default, this setting
overrides it.
Jonas Jelonek [Tue, 2 Jun 2026 21:44:22 +0000 (21:44 +0000)]
realtek: pcs: replace __free() auto-cleanup stuff
Upstream netdev maintainers disregard both variable declarations
mid-function and usage of __free() for auto-cleanup [1]. To avoid any
pain when trying to upstream the PCS driver at some point, adjust that
now before forgetting it.
John Audia [Sat, 6 Jun 2026 12:17:46 +0000 (08:17 -0400)]
x86/64: config-6.18 remove obsolete options from config
Remove some dead weight from the config due to changes in the CRYPTO API
in 6.18. These are now internal library optimizations rather than selectable
algorithms, the corresponding Kconfig options were removed.
Andre Heider [Wed, 1 Apr 2026 13:13:40 +0000 (15:13 +0200)]
kernel/omap: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
ramips: enable fw_printenv for D-Link COVR-X1860 A1
Vendor U-Boot stores its environment at offset 0x2000 inside the
"config" partition (size 0x4000). The offset is not erase-block
aligned, so the fw_env tool's alignment check rejects the natural
secsize=0x20000. Declaring secsize=0x2000 passes the check, lets
fw_printenv read the real env (factory_mac, hw_version,
bundle_number, ...), and causes fw_setenv to fail cleanly on erase
rather than corrupting anything (the kernel rejects sub-erase-block
MEMERASE).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Florian Maurer <fmaurer@disroot.org> Link: https://github.com/openwrt/openwrt/pull/23192 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Fabian Groffen [Fri, 6 Mar 2026 15:27:03 +0000 (16:27 +0100)]
ramips: expand storage space on U6 lite
While still sufficient for the base image, space runs out quickly with
the ~15MiB available in kernel0. The identical space in kernel1 is
unused, and standard installation instructions flash to both areas so it
isn't an easy fallback to stock either.
Merge the regions for kernel0 and kernel1 so there's more space
available to the user to install packages and some data.
* Remove ca-certificates-local example (closes: #988912, #1127101).
* Update Mozilla certificate authority bundle to version 2.86
The following certificate authority was added (+):
+ e-Szigno TLS Root CA 2023
The following certificate authorities were removed (-):
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
- certSIGN ROOT CA
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- TeliaSonera Root CA v1
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- GLOBALTRUST 2020
- GTS Root R2
- FIRMAPROFESIONAL CA ROOT-A WEB
The following certificate authority was renamed (~):
~ "OISTE Server Root RSA G1" (removed leading space)
Ryan Leung [Sun, 7 Jun 2026 02:22:33 +0000 (10:22 +0800)]
ramips: yuncore 1200f: fix label-mac-device alias and remove comments
Fix label-mac-device alias (from "label-mac") and remove MAC address comments.
Fixes: 1ba7b38cfc82 ("ramips: add support for Yuncore 1200F") Signed-off-by: Ryan Leung <untilscour@protonmail.com> Link: https://github.com/openwrt/openwrt/pull/23691 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
A network interface card (NIC) hardware ring of the Realtek Otto switch
SoCs is nothing more than a list of pointers to the ring headers. I.E.
address | content | comment
--------+-----------+------------------------
x + 0 | pointer 0 | points to ring header 0
x + 4 | pointer 1 | points to ring header 1
...
x + 4*n | pointer n | points to ring header n
Headers must be 4 byte aligend. So the lower two bits of the pointers
are unused. Hardware designers desided to give them special meanings.
- Bit 0: Owner of this ring entry, 1 = hardware, 0 = software
- Bit 1: Wrap, 1 = last ring pointer, 0 = normal ring pointer
The driver uses constant defines with slightly confusing naming. Replace
OWN_CPU with OWN_HW to make clear what it is about. Align prefix and
make the defines bitmasks for better readability.
The Yuncore 1200F is an outdoor 802.11ac access point based on the
MediaTek MT7628AN SoC with an MT7663E PCIe 5 GHz radio. The device is
also sold under the KuWFi AP1200F name.
Network:
- LAN: eth0.1, switch port 4
- WAN: eth0.2, switch port 3
Installation:
- Build the sysupgrade image:
openwrt-ramips-mt76x8-yuncore_1200f-squashfs-sysupgrade.bin
- The stock firmware provides a U-Boot recovery web interface. It can be
entered by holding the reset button while powering on the device. Connect to
http://192.168.0.100/ and upload openwrt-sysupgrade.bin file.
Recovery:
- Reverting to stock firmware has not been tested.
The 5 GHz radio is detected as PCI ID 14c3:7663 and uses mt7615e
together with the MT7663 AP firmware. kmod-mt76x2 is explicitly
excluded because this board uses MT7663E, not MT76x2.
Tested:
- Build succeeds for ramips/mt76x8
- Sysupgrade image boots
- Ethernet LAN/WAN work
- 2.4 GHz AP starts on phy0
- 5 GHz AP starts on phy1
- Stable MAC addresses are assigned to Ethernet, phy0 and phy1
Jonas Jelonek [Fri, 5 Jun 2026 22:15:13 +0000 (22:15 +0000)]
realtek: pcs: rtl931x: enable XSGMII setup
The setup path has been adjusted before to at least not break a working
XSGMII setup. On the currently single affected device, the U-boot
pre-init runs unconditionally anyway. Thus, we can drop the top-level
gate and let our driver "setup" this mode. This enables further
structural changes.
Jonas Jelonek [Fri, 5 Jun 2026 22:09:07 +0000 (22:09 +0000)]
realtek: pcs: rtl931x: fix media config for XSGMII
While this doesn't claim to be a standalone setup for XSGMII, at least
it doesn't break the working XSGMII setup from U-boot on Linksys
LGS352C, the currently only supported device using this mode. Later
during further refactoring, this should be improved to make sure
everything is properly set.
Jonas Jelonek [Thu, 4 Jun 2026 22:32:07 +0000 (22:32 +0000)]
realtek: pcs: rtl931x: release IP mode force-lock for XSGMII
rtpcs_931x_sds_deactivate() forces the SerDes IP mode register to OFF
(force-bit set, mode OFF) via apply_ip_mode(OFF). For IP-driven modes a
subsequent bring-up re-asserts the force-bit with the target mode, so the
lock is released. XSGMII, however, is MAC-driven: rtpcs_931x_sds_set_mode
only wrote the MAC mode and never released the IP force-lock, leaving the
IP block pinned OFF. XSGMII therefore only worked when the bootloader had
already configured the SerDes before deactivate ran.
Route the XSGMII branch through rtpcs_93xx_sds_set_mac_driven_mode(),
which unforces the IP mode (page 0x1f reg 0x09 bit 6) before writing the
MAC mode -- the same fix applied to RTL930x in 383c4469e4fd.
The MAC-driven set_mode path on RTL930x performs three steps: release the
IP mode force-lock so the MAC side takes over (deactivate forces IP=OFF),
write the MAC mode, then apply the USXGMII submode for modes that need
one. Pull these into a shared rtpcs_93xx_sds_set_mac_driven_mode() helper.
No functional change: rtpcs_930x_sds_set_mode now calls the helper instead
of open-coding the sequence. This prepares the helper for reuse by the
RTL931x XSGMII path, which currently lacks the IP force-unlock and so is
left pinned OFF by a preceding deactivate.
Jonas Jelonek [Thu, 4 Jun 2026 17:59:04 +0000 (17:59 +0000)]
generic: mips: add pending patch to fix reboot
Add a pending hotfix to fix reboot functionality on MIPS platforms, at
least the Realtek target being affected.
The kernel bump from 6.18.33 to 6.18.34 introduced a backported commit
intending to fix a use-after-free issue [1]. As a side effect, it also
causes RCU to wait for CPUs which are already dead but RCU doesn't know
of.
The mutex file via '/tmp/.config_pending' should prevent the command
'/sbin/wifi config' from being called in the ieee80211 hotplug when loading
the kernel modules [1]. Since the file '/etc/board.json' does not yet exist
and could be incomplete.
The '/etc/board.json' file is modified in the '/sbin/wifi config' script.
This is only generated during the first boot when '/bin/config_generate' is
called.
This whole handling is unclean. Therefore the creation of the default
configuration '/etc/config/network', '/etc/config/system' and
'/etc/board.json' via '/sbin/config_generate' is moved to the preinint
after the rootfile system has been mounted
The advantage now is that on an ieee80211 hotplug event, the
'/etc/board.json' is already present which simplifies the whole thing.
- Aggregated per-family (lan/wan/wlan).
- Family and flags are taken from device tree properties:
- "family" : simple family string "lan" | "wan" | "wlan"
- "mode" : any combination of "link", "tx", "rx" flags
Priority/combination:
* If "mode" present: flags come from "mode" and take precedence.
Family is taken from "family" if present, otherwise from the LED name.
* If only "family" present: use its family and default flags = link+tx+rx.
* If neither present: fall back to LED device name parsing.
- Suffix "-online" is valid ONLY in the LED name (label),
e.g. "green:wlan-online". It indicates the online variant but is applied
only when DT "mode" is absent.
Behaviour:
- wlan (normal): blink/solid driven by throughput table
- lan/wan (normal): one-shot blink on TX/RX packet change
- *-online variants: steady ON while any interface of the family has carrier
Interfaces are auto-tracked by name match (lan0, wan1, wlan2, phy0, wl1,
ath0, ra0...). Up to MAX_IFACES (16) interfaces per family
This trigger is intended for board/device authors and drivers to provide simple
network-activity LED behaviour without per-interface wiring in userspace.
Refresh bcm27xx patches in the same commit to account for line shifts in
drivers/leds/trigger/Kconfig and Makefile, ensuring clean applies for
bisectability.
Hafiz Zafran [Sat, 30 May 2026 22:31:08 +0000 (06:31 +0800)]
wireless-regdb: update to version 2026.05.30
Change-log since version 2026.03.18, retrieved from the wireless-regdb mailing lists:
wireless-regdb: update regulatory database based on preceding changes
wireless-regdb: Update regulatory info for Brunei Darussalam (BN) for 2022
wireless-regdb: allow 320MHz channel width for Russia
wireless-regdb: Update 6 GHz rules for Hong Kong (HK)
wireless-regdb: Update 5/6 GHz power rules for Russia (RU)
wireless-regdb: Fix 60 GHz power unit for Ukraine (UA)
wireless-regdb: Update 6 GHz rules for South Africa (ZA)
wireless-regdb: Update 6 GHz rules for South Korea (KR)
wireless-regdb: Update regulatory rules for Sri Lanka (LK)
wireless-regdb: Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by WiFi Alliance
Hauke Mehrtens [Wed, 3 Jun 2026 23:40:29 +0000 (01:40 +0200)]
odhcp6c: update to Git HEAD (2026-06-04)
08bd058e0246 ra: skip malformed options instead of aborting RA processing 2550a1dd276e dhcpv6: fix inverted Authentication option validation in Reply 496e55d43de6 dhcpv6: use host-order option length in Authentication validation b6f0c70f5fc2 dhcpv6: fix out-of-bounds end pointer when parsing IA in Advertise 92fd11cd9547 dhcpv6: fix OOB read and 1-byte heap overflow on captive-portal option 0dab8feec55a ra: fix OOB read on captive-portal option comparison a4d6a3232c24 script: fix string_to_env writing garbage and reading past input 2521bf732b9f script: avoid kill(0) when SIGCHLD races script_call 56cec7a15816 odhcp6c: drop stale hash_ifname() declaration 49d9c0112bb8 odhcp6c: propagate allocation failure from insert_state 4bd976fd60c0 dhcpv6: ensure hostname buffer is NUL-terminated for dn_comp 6d12865fb89c ubus: validate element type when parsing reconfigure_dhcp opt_send 01130f80338a script: handle allocation failures in env helpers 0a19052dc9fb odhcp6c: refuse to follow symlinks when writing pidfile d6c2fbdc255c odhcp6c: skip malformed /proc/net/if_inet6 entries b6add6c0e30e dhcpv6: avoid signed-shift undefined behaviour in IAID derivation ce52fe118b13 ubus: clear cached object type id on disconnect 91f88c694f6f config: stop mutating caller-supplied buffers in send-options parser c938c168cbef script: handle fork() failure when launching state script 1546a48255b2 ubus: avoid out-of-bounds read when serializing captive-portal URI 3270f081039d all: fix inverted captive-portal URI equality check (RFC 8910 §3) e9a9e9d45f38 odhcp6c: bound the address length when parsing the -P argument 5ad94c86e864 script: walk entries with odhcp6c_next_entry in entry_to_env df4f199c02fc ubus: walk entries correctly and don't leak an open table in entry_to_blob 6c1c4c48d4a2 ubus: don't leak an open table on malformed S46 rule/bind in s46_to_blob 1797d2bca3c0 odhcp6c: remove pidfile on exit 86a6665e4bb0 ra: clear captive-portal state when router signals unrestricted URI 0a4e51db30d5 dhcpv6: require known SERVERID when validating Reconfigure afc3c8534864 dhcpv6: reject Reconfigure with malformed or duplicate Message option df27a49c98d8 dhcpv6: enforce monotonic replay counter on Reconfigure RKAP 9177f236c2d7 odhcp6c: do not treat DHCPv6 option type 0 as end-of-list daf4ec3054e7 example: write all DNS servers to resolv.conf
Hauke Mehrtens [Wed, 3 Jun 2026 23:41:05 +0000 (01:41 +0200)]
rpcd: update to Git HEAD (2026-06-04)
69b62b1990bc rpc-sys: packagelist: increase input buffer size e655a0d69492 exec: defer async reply teardown to avoid use-after-free 5b078674a592 optimize by reusing timeout member d005c885dbe4 session: clamp uloop timeout to avoid int overflow a545f008da91 ucode: add request.defer() for async method handling ab6549a99c7c file: avoid sending uninitialized stack memory for broken symlinks 7af2dd81cd53 main: prevent integer overflow when parsing -t timeout argument 680705e4b76d plugin: use snprintf in ubus lookup callback to prevent buffer overflow fb0302dc0e51 session: detect short read of /dev/urandom in rpc_random() dc091afa5860 rpc-sys: packagelist: check calloc() result for world array 4fbd48515d6a rpc-sys: packagelist: avoid size_t underflow when stripping ABI version 46fce7d5efc9 ucode: fix off-by-one truncation of generated ubus object type name 26dba5206e17 exec: prevent double close() of exec pipe descriptors af5d6f431186 uci: prevent integer overflow of client supplied apply timeout d06d2a81dc29 rc: fix memory leak of list request context 0de666811559 rc: copy list "name" filter to avoid use-after-free 75470f4b5124 rc: use a per-request blob_buf for the list reply 3037a0e36856 treat exec failures in forked children with _exit() instead of return f5ffec54d7c7 rc: reap killed child on list "running" check timeout fd4fcdeb186b rpc-sys: packagelist: close status file on world parsing error paths e22aea1a51df rpc-sys: packagelist: read world file instead of mmap to avoid SIGBUS 79c8087c8e8e file: avoid zero-length b64_decode() on empty write data cd1d9588da63 ucode: bound recursion when converting blob arguments to ucode values 2decaec3ef1b iwinfo: fix error handling and backend leak in survey 28faf6403792 cast char arguments to unsigned char for ctype.h functions
Dixiao-L [Tue, 2 Jun 2026 13:17:54 +0000 (21:17 +0800)]
ramips: fix Phicomm K2G WAN by enabling rgmii1
The K2G's WAN port is an external RTL8211F gigabit PHY on switch
port 5, reached over the SoC's rgmii1 pins. The device tree only
requests rgmii2_pins though, so nothing ever claims rgmii1 and the
pins keep whatever the bootloader left them as.
When rgmii1 is muxed to GPIO the WAN port comes up but receives
nothing: port 5 RxGPC stays at 0 and wan never gets a DHCP lease.
rgmii1 vs GPIO is GPIOMODE (SYSC + 0x60) bit 9. Requesting
rgmii1_pins makes the pinmux driver clear it, which is enough to
get the WAN RX path working again. The rgmii1 pads (GPIO 24-35)
aren't used for anything else on this board.
Tested on a K2G: WAN gets a DHCP lease and passes traffic.
projects / thirdparty / openwrt.git / log
