Felix Fietkau [Wed, 27 May 2026 10:24:40 +0000 (12:24 +0200)]
mac80211: add ieee80211_txq_aql_pending()
Add a function to allow drivers to query the pending AQL airtime
for a given txq, for both unicast and broadcast.
This will be used for mt76 to limit buffering in AP mode for power-save
stations.
Lorenzo Bianconi [Mon, 25 May 2026 12:17:39 +0000 (14:17 +0200)]
airoha: Improve LRO performances
Add hardware TCP Large Receive Offload (LRO) support to the airoha_eth
driver, leveraging the EN7581/AN7583 SoC's 8 dedicated LRO hardware queues
mapped to RX queues 24–31. LRO hw offloading does not support
Scatter-Gather (SG) so it is required to increase the page_pool allocation
order to 2 for RX queues 24–31 (LRO queues).
Performance comparison between GRO and hw LRO has been carried out using
a 10Gbps NIC:
GRO: ~2.7 Gbps
LRO: ~8.1 Gbps
Tested-by: Madhur Agrawal <madhur.agrawal@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://github.com/openwrt/openwrt/pull/23530 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Robert Marko [Mon, 25 May 2026 19:26:14 +0000 (21:26 +0200)]
mvebu: cortexa53: uDPU/eDPU: update active bootscript as well
Currently, sysupgrade will only upgrade the unused slot, however since the
whole dual firmware logic is in the bootscript U-boot will just use the
first bootscript it finds.
So, in a case that you are running slot A it will upgrade slot B, however
that means that slot B will be still booted by the old bootscript that came
with the previous firmware version.
This is an issue if you need to change anything, so lets add a custom
function that upgrades the active bootscript as well after flashing the
slot firmware.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Robert Marko [Mon, 23 Feb 2026 16:41:18 +0000 (17:41 +0100)]
mvebu: cortexa53: uDPU/eDPU convert to dual firmware (A/B)
Methode uDPU and eDPU devices are one of the rare ones with a completely
custom image format being used with custom partition table with F2FS.
Instead of converting the boards to dual firmware (A/B style) and further
expand the already convoluted custom scripts, especially considering that
dual firmware conversion is a breaking change anyway, lets convert to using
the generic eMMC sysupgrade based images.
F2FS ZSTD compression is preserved thanks to fstools now supporting its use
on overlays.
Dual firmware support is implemented via U-Boot scripts so no U-Boot
upgrade is required.
Since there is a partition table layout change, eMMC must be wiped and
reflashed with the generated GPT image from OpenWrt initramfs.
Then on each sysupgrade the firmware slot will be altered.
Instructions:
1. Boot into OpenWrt initramfs
2. Copy openwrt-mvebu-cortexa53-methode_edpu-squashfs-emmc-gpt.img.gz to
the device into /tmp
3. Erase eMMC:
dd if=/dev/zero of=/dev/mmcblk0 bs=1M
4. Extract image
gzip -d /tmp/openwrt-mvebu-cortexa53-methode_edpu-squashfs-emmc-gpt.img.gz
5. Flash image
dd if=/tmp/openwrt-mvebu-cortexa53-methode_edpu-squashfs-emmc-gpt.img of=/dev/mmcblk0
6. Reboot
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Taiga Ogawa [Tue, 19 May 2026 02:11:36 +0000 (02:11 +0000)]
qualcommax: ipq50xx: add support for ELECOM WRC-X3000GST2
ELECOM WRC-X3000GST2 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router based on
IPQ5018. The only hardware difference from the WRC-X3000GS2 is the RAM
capacity; all other peripherals are identical. This port therefore
reuses the GS2 board-2.bin (ipq-wifi-elecom_wrc-x3000gs2) and ath11k
calibration variant.
1. Boot WRC-X3000GST2 normally in router mode
2. Access the WebUI ("http://192.168.2.1/") and open the firmware
update page ("ファームウェア更新")
3. Select the OpenWrt factory.bin image and click apply ("適用")
4. After the device reboots automatically, wait until the green power LED
stops blinking and stays solid
5. When the green power LED is solid, hold the reset button until the red
LED starts blinking to clear remaining stock firmware settings
- This device has dual-boot feature and it's managed by the index in the
0:bootconfig and 0:bootconfig1 partitions.
- Wi-Fi BDF is shared with WRC-X3000GS2 (ipq-wifi-elecom_wrc-x3000gs2)
as the hardware (SoC, QCN6122, antennas) is identical between the two
models.
- GST2 stock firmware keeps its configuration even when sysupgrade is
called with -n. When installing from the OEM WebUI, those stock
settings can be restored into OpenWrt overlay, so settings must be
initialized after the first OpenWrt boot.
Jan-Henrik Bruhn [Tue, 19 May 2026 22:30:36 +0000 (00:30 +0200)]
realtek: add support for Linksys LGS328MPCv2
Hardware specification
----------------------
* RTL9301 SoC, 1 MIPS 34KEc core @ 800MHz
* 512MB DRAM
* 2MB NOR Flash
* 128MB NAND Flash
* 24 x 10/100/1000BASE-T ports with PoE+
* 4 x 10G SFP+ ports
* Power LED, Fault LED, PoE Max LED, LAN Mode LED, PoE Mode LED
* Reset button and LED Mode button on front panel
* LM63 Fan Controller
* UART (115200 8N1) via RJ45
* PSE: Nuvoton M0516LDE via I2C + 3x RTL8238B (not supported yet)
Installation using serial interface
-----------------------------------
1. Press "a" "c" "p" during message "Enter correct key to stop autoboot"
2. Start network "rtk network on"
3. Load image "tftpboot <TFTP IP>:openwrt-realtek-rtl930x_nand-linksys_lgs328mpc-v2-initramfs-kernel.bin"
4. Boot image "bootm"
5. Switch to first bootpartition "fw_setsys bootpartition 0"
6. Download sysupgrade "scp <IP>:openwrt-realtek-rtl930x_nand-linksys_lgs328mpc-v2-squashfs-sysupgrade.bin /tmp/."
7. Install sysupgrade "sysupgrade /tmp/openwrt-realtek-rtl930x_nand-linksys_lgs328mpc-v2-squashfs-sysupgrade.bin"
Installation using OEM webinterface
-----------------------------------
This is not possible because the OpenWrt NAND Flash layout is different
from the vendor layout. To be precise. Vendor uses:
Jonas Jelonek [Wed, 20 May 2026 21:43:33 +0000 (21:43 +0000)]
realtek: pcs: rtl930x: force IP mode OFF in deactivate, unforce for MAC modes
Make deactivate fully restore the SerDes to an inert state at both the
MAC and IP layers. Previously deactivate only zeroed the MAC mode via
set_mode(OFF), which on the default branch only writes the MAC mode
register and leaves the IP mode register untouched. The IP mode register
then retained whatever the previous bring-up left behind (force=1 with
a stale mode value, or force=0 from boot defaults), making "deactivate"
not fully deactivate the SerDes.
Replace the set_mode(OFF) call with explicit set_mac_mode(OFF) plus
set_ip_mode(OFF). The latter writes force=1 with mode=OFF, pinning the
IP block to OFF until a subsequent bring-up takes a defined action.
This forced-OFF state would break MAC-driven modes (USXGMII / QSGMII /
XSGMII), which set only the MAC mode register and rely on the IP block
following along. To compensate, add an explicit unforce of the IP mode
force-bit (page 0x1f reg 0x09 bit 6) at the start of the MAC-mode branch
of rtpcs_930x_sds_set_mode. IP-mode bring-up via apply_ip_mode is
unaffected -- it re-asserts force=1 with the target mode value, which
overrides the deactivate force-OFF.
Net result: deactivate fully and explicitly deactivates the SerDes; each
set_mode path takes its own responsibility for the IP mode register
state. The previous asymmetric behaviour (set_mode default branch silently
not touching the IP register) is now explicit code rather than an
implicit accident-of-dispatch.
Verified on RTL930x hardware: SGMII, 2500BASE-X, 10GBASE-R, USXGMII-QX
and XSGMII all bring up correctly with link, traffic and iperf3 as
expected.
Jonas Jelonek [Wed, 20 May 2026 19:57:32 +0000 (19:57 +0000)]
realtek: pcs: rtl930x: lift SerDes core power-cycle into {de,}activate
Move rtpcs_930x_sds_set_power() and rtpcs_930x_sds_rx_reset() out of
rtpcs_930x_sds_apply_ip_mode() and into rtpcs_930x_sds_{de,}activate().
After this, apply_ip_mode is pure IP-mode/CMU/state-machine programming
and the SerDes-core analog power is owned by the outer phase pair, the
same place that already owns the 1G/10G PHY block and fiber RX power.
Behavioural change: USXGMII / QSGMII / XSGMII modes did not previously
go through apply_ip_mode and therefore never had the SerDes-core power
gated on mode transitions. After this commit, every mode transition
power-cycles the SerDes core via the outer deactivate/activate.
For the SGMII / 1000BASE-X / 2500BASE-X / 10GBASE-R path the set of
register writes is unchanged; only the relative ordering vs. the
fiber/PHY power writes shifts: set_power(false) now precedes those
writes (was after), set_power(true) now follows them (was before).
Verified on RTL930x hardware: SGMII, 2500BASE-X, 10GBASE-R, USXGMII-QX
and XSGMII all come up with link, ping and iperf3 throughput as
expected.
Jonas Jelonek [Wed, 20 May 2026 18:33:40 +0000 (18:33 +0000)]
realtek: pcs: rtl931x: run set_mode before activate
Move rtpcs_931x_sds_set_mode(sds, hw_mode) ahead of
rtpcs_931x_sds_activate() in rtpcs_931x_setup_serdes(). The IP-block
mode registers latch with the SerDes powered down, so the mode can be
committed during the configure phase rather than after power-on.
This matches the phase order already used by 838x and 930x
(deactivate -> configure -> set_mode -> activate) and is a step toward
a unified bring-up sequence across variants.
Verified on RTL931x hardware: USXGMII, SGMII and 10GBASE-R modes all
come up, link is established, L2 forwarding works, and iperf3 reports
expected throughput.
Jonas Jelonek [Wed, 22 Apr 2026 14:35:18 +0000 (14:35 +0000)]
realtek: pcs: rtl930x: fold 1G/10G PHY power into {de,}activate
Move the 1G and 10G PHY block power-up writes (clear BMCR_PDOWN on pages
0x02 and 0x04) out of rtpcs_930x_phy_enable_10g_1g() and into
rtpcs_930x_sds_activate(), and add the mirror writes (set BMCR_PDOWN) to
rtpcs_930x_sds_deactivate(). Same for the fiber RX bit.
With 1G PHY / 10G PHY / fiber RX all now handled symmetrically, drop the
rtpcs_930x_phy_enable_10g_1g() helper. The remaining write it contained
(set medium = fiber on page 0x1f reg 11 bit 1) is unrelated to power
management, unconditionally applied, and to-be-inspected for non-fiber
modes. Move it inline into setup_serdes with a TODO comment; proper
mode-aware handling is out of scope for this commit.
Behavioural note: the 1G/10G PHY blocks and fiber RX are now
power-cycled on every mode transition. Previously they were only
powered up (never explicitly down) and the state persisted across
reconfigure. The new behaviour makes each setup_serdes a standalone
bring-up that does not rely on the prior state of these bits.
Mirror of the previous sds_deactivate commit: add rtpcs_{838x,931x}_sds_activate()
helpers that each wrap the variant-specific "bring the SerDes back to operational"
block-power call at the end of setup_serdes, and replace the inline call.
RTL839x and RTL930x are intentionally not given an activate helper in this
commit:
- RTL839x calls rtpcs_839x_sds_reset() at the end of setup_serdes. That is
a reset pulse whose internals (per-type 10G/5G analog sequences, internal
REG3 0x7146 -> 0x7106 dance) are not yet fully characterized. Aliasing
it as _activate would misrepresent the function.
- RTL930x has no separate activation step: rtpcs_930x_sds_set_mode(sds,
hw_mode) is what commits the new mode and is intended to be surfaced
as its own "set mode" phase in a later commit rather than hidden inside
a variant-specific _activate wrapper.
Both variants will be revisited when their respective phases are clarified.
This commit is a pure refactor, no behavioural change.
Add rtpcs_{838x,930x,931x}_sds_deactivate() helpers that each encapsulate
the variant-specific "make SerDes inert before reconfigure" sequence, and
replace the inline calls at the start of each setup_serdes with a single
call to the new helper:
RTL839x has no deactivate step to factor out and is left unchanged.
This is a pure refactor: same register writes, same order, same return-
value handling at the call site. The helpers give each variant a named
hook for the deactivate phase and prepare for a subsequent commit that
promotes it to an rtpcs_sds_ops entry and hoists the call site into
rtpcs_pcs_config.
Hauke Mehrtens [Mon, 25 May 2026 23:17:13 +0000 (01:17 +0200)]
libiwinfo: update to Git HEAD (2026-05-26)
f35c47d50bf2 devices: add device id for MediaTek MT7921E 6e198d375752 nl80211: fix corrupt scan results from wpa_supplicant cd7db6194a71 devices: add device id for Qualcomm Technologies QCN6224/9224/9274 66bdd1a07189 devices: add device id for Qualcomm Atheros QCA9994
Štěpán Dalecký [Tue, 19 May 2026 06:17:43 +0000 (08:17 +0200)]
mvebu: add mwifiex sdio kernel module for Turris Mox
Turris Mox boards may include an SDIO Wi-Fi module based on the
Marvell 88W8997 chip. Add kmod-mwifiex-sdio to the default package
list so the driver is included in the image out of the box.
Štěpán Dalecký [Tue, 19 May 2026 06:17:43 +0000 (08:17 +0200)]
mvebu: add fw_env.config for Turris Mox
Turris Mox stores the U-Boot environment in SPI NOR flash. Add the
fw_env.config entry pointing to MTD partition 2 at offset 0x0 with
64 KiB env size and sector size, so userspace tools fw_printenv and
fw_setenv work correctly on this board.
Štěpán Dalecký [Tue, 19 May 2026 06:17:43 +0000 (08:17 +0200)]
mvebu: fix squashfs boot for Turris Mox
The bootscript had several issues that prevented squashfs from booting:
- bootpath was set to "/" causing double slashes in load paths (e.g.
"//Image"); changed to "" so "${bootpath}/Image" resolves to "/Image"
- rootflags was set to "commit=5" (a btrfs-specific mount option) for
the ext4/squashfs case; cleared to empty string
- rootfstype was missing in the non-btrfs branch; added "auto" to let
the kernel detect the filesystem; the btrfs branch now sets "btrfs"
explicitly
- bootargs incorrectly referenced ${bootfstype} (the distroboot input
variable) instead of the locally constructed ${rootfstype}
- has_dtb assignment used shell-style "has_dtb=1" but was cleared with
"setenv has_dtb 0"; unified both to use setenv
- DTB load failure message now includes the attempted file path
- Fixed Image.lzma error echo that still used a stale "${subvol}/boot/"
prefix; now consistently uses ${bootpath}
- Removed undefined variable "rootpart" from env delete
xinmu [Thu, 14 May 2026 09:34:17 +0000 (17:34 +0800)]
loongarch64: add upstream dwmac-loongson patches for 2K3000/3B6000M
Add three backported patches from Linux upstream to fix the onboard
Ethernet controller (dwmac-loongson) detection and driver issues on
Loongson 2K3000 and 3B6000M platforms.
These patches are taken from the upstream Linux kernel and retain the
original authorship and commit logs. No other modifications are made
to the loongarch64 target.
The patches address the following symptoms:
- Onboard network interface not recognized
- Driver probe failures on 2K3000/3B6000M boards
Mikhail Zhilkin [Wed, 20 May 2026 20:22:29 +0000 (23:22 +0300)]
mediatek: add support for netis EAP930 V1
This commit adds support for netis EAP930 V1 ceiling access point.
Specification
-------------
- SoC : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz
- RAM : 256 MiB DDR3 (ESMT M15T2G16128A-EFB)
- Flash : SPI-NAND 128 MiB (ESMT F50L1G41LB-104)
- WLAN : MediaTek MT7976CN dual-band WiFi 6
- 2.4 GHz : b/g/n/ax, MIMO 2x2
- 5 GHz : a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x1 (SoC internal phy)
- USB : No
- Buttons : Reset
- LEDs : 1x Status (red), gpio-controlled
1x Status (blue), gpio-controlled
- Power : 48 VDC (PoE) or 12 VDC, 1.5 A
Installation
------------
1. Connect to the access point using ssh (user: admin, pass: web interface
password)
2. Make mtd backup:
cat /dev/mtd0 | gzip -1 -c > /tmp/mtd0_spi0.0.bin.gz
cat /dev/mtd1 | gzip -1 -c > /tmp/mtd1_BL2.bin.gz
cat /dev/mtd2 | gzip -1 -c > /tmp/mtd2_u-boot-env.bin.gz
cat /dev/mtd3 | gzip -1 -c > /tmp/mtd3_Factory.bin.gz
cat /dev/mtd4 | gzip -1 -c > /tmp/mtd4_FIP.bin.gz
cat /dev/mtd5 | gzip -1 -c > /tmp/mtd5_ubi.bin.gz
3. Download mtd backup from the /tmp dir of the router to your PC using
scp protocol
4. Upload OpenWrt 'bl31-uboot.fip', 'preloader.bin' images to the /tmp
dir of the router using scp protocol
5. Write FIP and BL2 (replace bootloader):
mtd write /tmp/bl31-uboot.fip FIP
mtd write /tmp/preloader.bin spi0.0
6. Place OpenWrt
'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
on the tftp server (IP: 192.168.1.254)
7. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
8. U-Boot automatically boot OpenWrt recovery image from tftp server to
the RAM (1 Gbps link is required)
9. Upload OpenWrt 'sysupgrade.itb' image to the /tmp dir of the router
(IP: 192.168.1.1) using scp protocol
10. Connect to the router using ssh and run:
sysupgrade -n squashfs-sysupgrade.itb
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
on the tftp server (IP: 192.168.1.254)
2. Press Reset button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
Return to stock
---------------
1. Upload stock BL2, FIP, ubi partitions backup archives to the /tmp dir
of the router using scp protocol
2. Connect to the router using ssh and run:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd unlock FIP
4. Restore backups:
zcat /tmp/mtd1_BL2.bin.gz | mtd write - BL2
zcat /tmp/mtd4_FIP.bin.gz | mtd write - FIP
zcat /tmp/mtd5_ubi.bin.gz | mtd write - ubi
3. Reboot the router:
reboot
UART
----
Connection parameters: 115200, 8N1, 3.3V
UART pins are silkscreened on the PCB.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 88:xx:xx:88:xx:d3 | label |
| WLAN 2g | 88:xx:xx:18:xx:d4 | |
| WLAN 5g | 88:xx:xx:78:xx:d4 | |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'Factory', 0x1fef20
The WLAN 2g/5g MAC prototype (hex) was found in 'Factory', 0x4
U-Boot v2026.01 introduced drivers/mtd/nand/spi/otp.c which adds `spinand_user_otp_size()` and
`spinand_fact_otp_size()`. These functions are called unconditionally from `spinand_init()` in
drivers/mtd/nand/spi/core.c to determine whether to set up OTP methods:
if (spinand_user_otp_size(spinand) || spinand_fact_otp_size(spinand)) {
ret = spinand_set_mtd_otp_ops(spinand); /* drivers/mtd/nand/spi/core.c:2369 */
...
}
Both OTP size functions pass `&spinand->user_otp->layout` or `&spinand->fact_otp->layout` to
`spinand_otp_size()` without first checking whether the pointer is NULL. In the standard probing
path, these pointers are assigned by `spinand_match_and_init()` from the per-chip `spinand_info`
table. `100-21-mtd-spi-nand-add-CASN-page-support.patch` adds CASN detection to `spinand_detect()`
so that when a CASN page is found, `spinand_init_via_casn()` is called instead of
`spinand_id_detect()`. As `spinand_match_and_init()` is only called via `spinand_id_detect()`, it
is never invoked for CASN-probed devices.
As a result, `spinand->user_otp` and `spinand->fact_otp` remain NULL from the zero-initialised DM
priv allocation. Both `spinand_user_otp_size()` and `spinand_fact_otp_size()` spuriously return
non-zero by reading `layout->npages` from a small mapped address computed from their respective
NULL pointer, causing `spinand_init()` to call `spinand_set_mtd_otp_ops()` which reads
`spinand->user_otp->ops` and thereby silently assigns a garbage value to `user_ops` that is then
dereferenced at `if (user_ops->info)`.
On COMFAST CF-WR632AX (MT7981, Winbond W25N01GV) this results in a "Synchronous Abort" during boot.
The crash was confirmed via `addr2line` on the U-Boot ELF:
"Synchronous Abort" handler, esr 0x96000004, far 0xeafffffeeafffffe
elr: 0000000041e2ff44 (drivers/mtd/nand/spi/otp.c:343)
lr : 0000000041e2f2f8 (drivers/mtd/nand/spi/core.c:2369)
The same was observed on Acer Predator Connect W6x (MT7986, Winbond W25N02KV):
"Synchronous Abort" handler, esr 0x96000004, far 0xeafffffeeafffffe
elr: 0000000041e2c868 (drivers/mtd/nand/spi/otp.c:343)
lr : 0000000041e2bc1c (drivers/mtd/nand/spi/core.c:2369)
Fix this by adding NULL guards to both OTP size functions so that they return 0 when the pointer is
NULL. With both functions returning 0, the condition in `spinand_init()` evaluates to false and
`spinand_set_mtd_otp_ops()` is never called, skipping setup of OTP methods entirely for CASN-probed
SPI NAND chips.
This change has no effect on SPI NAND chips that do have OTP data but not CASN. For those chips,
`spinand_match_and_init()` sets `spinand->user_otp` and `spinand->fact_otp` to non-NULL values from
the per-chip table, the NULL guard does not activate, and the existing behaviour is unchanged.
Fixes: https://github.com/openwrt/openwrt/issues/23430 Fixes: b94de14bafd06660536691ed633f364edf5fbe4d ("uboot-mediatek: update to v2026.01") Signed-off-by: Ryan Leung <untilscour@protonmail.com> Link: https://github.com/openwrt/openwrt/pull/23447 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Installation:
Log in via SSH to the unit, default username and password are 'root' and
'dragino', respectively. SSH listens on port 2222.
Just 'sysupgrade -n' from vendor firmware, dropping old configuration.
Restore vendor firmware:
the same as installation, just 'sysupgrade -F -n', dropping configuration.
Lech Perczak [Wed, 20 May 2026 13:46:09 +0000 (15:46 +0200)]
ath79: support Dragino MS14
Dragino MS14 is a small router/development kit with two Fast Ethernet
ports, with single 1x1 2,4GHz Wi-Fi radio and expansion headers.
Specifications:
CPU: Atheros AR9330 SoC @400MHz,
RAM: 64MB DDR,
Flash: 16MB SPI-NOR,
Ethernet: Two 100Mbps ports, LAN on eth0, WAN on eth1,
Wireless: built-in 1x1 802.11 2.4GHz radio,
USB: single USB2.0 High speed host port,
LEDs: 4 status LEDs for system, LAN, WAN and WLAN.
UART: 115200-8-N-1 at the 2x8 header
Label MAC: Wi-Fi interface.
The board support is ported over from old ar71xx target, and only
partially verified using LPS8 board, which will be introduced next.
Installation:
Log in via SSH to the unit, default username and password are 'root' and
'dragino', respectively. SSH listens on port 2222.
Just 'sysupgrade -n' from vendor firmware, dropping old configuration.
Update with configuration from ar71xx builds may be possible, but isn't
guaranteed, as the builds are many releases apart.
Restore vendor firmware:
the same as installation, just 'sysupgrade -F -n', dropping configuration.
* Add a post-release patch for timezone handling in datetime string
matching (affecting at least uhttpd):
bug report: https://www.openwall.com/lists/musl/2026/03/22/3
fix: https://www.openwall.com/lists/musl/2026/03/30/6
new features:
- posix_getdents interface (new in POSIX-2024)
- renameat2 interface (linux extension)
- iconv support for CP858
- vdso clock_gettime for riscv{32,64}, powerpc{,64}, and s390x
- loongarch64 TLSDESC support
- exposed __getauxval for compiler runtime use detecting cpu features
compatibility:
- initgroups no longer artificially limits number of supplementary groups
- getusershell now skips blank lines and comments
- exit is now explicitly thread-safe (possible future requirement)
- atexit now fails rather than deadlocking if called from late dtor
- strerror now has error strings for EUCLEAN and ENAVAIL
- isatty no longer collapses errors to ENOTTY
- sched.h namespace pollution with _GNU_SOURCE is reduced
- hasmntopt now matches only whole options, not arbitrary substrings
- shadow.h no longer declares an unimplemented sgetspent interface
- vdso with missing sysv hash table (only gnu hash) is now supported
conformance:
- pwrite now handles O_APPEND correctly, reports error if it can't
- mbnrtowcs now conforms to new POSIX-2024 requirement for partial character
- iconv GBK now properly includes euro symbol
- strptime now accepts conversion specifiers added in POSIX-2024
- inet_ntop IPv6 "zero compression" now conforms to RFC 5952
bugs fixed:
- iconv euc-kr decoder could do oob writes on invalid inputs (CVE-2025-26519)
- iconv shift_jis decoder could produce wrong outputs for some invalid inputs
- printf did not honor hex float precision correctly in some cases
- lost or delayed wakes in sem_post under race condition
- termios input speed handling was wrong
- strcasestr failed to match zero-length needle
- fma handled corner case with negative zero wrongly
- syslog LOG_MAKEPRI macro was incorrect
- timer_create is no longer affected by known pthread_barrier bugs
- sysconf(_SC_MINSIGSTKSZ) computed min size incorrectly
- statx emulation left some fields uninitialized
- mntent wrongly included final newline in parsed field output
- SIGEV_THREAD timers could abort process if SIGTIMER became unblocked
- bind_textdomain_codeset returned wrong value
arch-specific bugs fixed:
- early dynamic linker handled page size wrong on dynamic pagesize archs
- arm and aarch64 crti/n files had wrong alignment
- m68k POLLWRNORM and POLLWRBAND values were incorrect
- x32 mq ABI was mismatched
bcm47xx: base-files: hack sysinfo to allow ASU sysupgrades
This old platform(no DTS) is using nvram numeric fields (or "unknown"
string) for its board_name [1]. Allow ASU sysupgrades by preserving
that value in /tmp/sysinfo/boardtype for board-detection/configuration
logic, and derive a canonical board_name from /tmp/sysinfo/model in
the form "vendor,device-variant".
Only a few target profile image names are not consistent in the last
suffix, uniform them.
A few images with (NA) and (ROW) variants are only meant to be
compatible with the upgrade process in the OEM firmware using these
NETGEAR_BOARD_ID and NETGEAR_REGION fields but the images are
compatibles(only if the NETGEAR_BOARD_ID is shared,due to platform
check) [2] (i.e. netgear_wnr3500l).
Add SUPPORTED_DEVICES to one of these variant in order to allow ASU
sysupgrade profile identification.
*Since this target has never implemented fwtool's SUPPORTED_DEVICES
metadata check, there is no risk of breaking forceless sysupgrade with
new board_name values.
[1]: bcm47xx board info https://github.com/gregkh/linux/blob/master/arch/mips/bcm47xx/board.c
[2]: sysupgrade platform check https://github.com/openwrt/openwrt/blob/main/target/linux/bcm47xx/base-files/lib/upgrade/platform.sh
Shiji Yang [Sat, 23 May 2026 13:42:19 +0000 (21:42 +0800)]
toolchain/gcc: use configure option to disable TM clone registry
GCC 10 added the new configure option --disable-tm-clone-registry[1].
It is useful for reducing code size in embedded systems. Our local hack
patch is no longer needed.
1. Boot WSR-2533DHP3 with "Router" mode
2. Access to "http://192.168.11.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt factory.bin image and click update ("更新実行")
button
4. Wait ~120 seconds to complete flashing
Note:
- This device has 2x OS images on flash. The first one will always be
used for booting and the secondary is for backup.
Tested:
- initramfs boot
- factory.bin installation from OEM WebUI
- LAN port assignment
- WAN DHCP
- NAT routing
- 2.4 GHz Wi-Fi
- 5 GHz Wi-Fi
- LEDs
- Buttons
MAC Addresses:
LAN : 58:27:8C:xx:xx:90 (board_data, mac (text))
WAN : 58:27:8C:xx:xx:90 (board_data, mac (text))
2.4 GHz: 58:27:8C:xx:xx:91
5 GHz : 58:27:8C:xx:xx:94
Migration to OpenWrt:
- Download the RSA-signed intermediate firmware from the Cudy website: `openwrt-ramips-mt76x8-cudy_wr300-squashfs-flash.bin`
- Connect the computer to the LAN and flash the intermediate firmware via the OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the WAN port (upper port)
- Provide the Cudy firmware as `recovery.bin` in the TFTP server
- Power on the device and hold the reset button immediately after the first LED blink
- The recovery process will start
- When the recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load an initramfs image via U-Boot because there is no option to interrupt U-Boot
Mathew McBride [Fri, 1 May 2026 02:16:33 +0000 (12:16 +1000)]
kernel: armsr: remove duplicate kconfig between generic and armsr
These were found by running:
comm -12 <(sort target/linux/generic/config-6.18) \
<(sort target/linux/armsr/config-6.18)
A similar process has been run between armsr/config-6.18
and armsr/armv8/config-6.18, though I have not pruned
the armv8 as much. Once the main branch switches armsr
to 6.18 we can do a more aggressive deduplication.
kernel: armsr: move framebuffer and DRM related options to top-level
The armv8 configuration has more features enabled compared to armv7,
as armv8 is intended to run on a selection of real hardware, while
armsr/armv7 almost always runs only in QEMU.
Some kmod dependency issues were appearing on armv7 builds which
did not appear elsewhere. To minimise these issues, we will
move the framebuffer feature set to the top level of the target.
Mathew McBride [Tue, 6 Jan 2026 06:40:22 +0000 (17:40 +1100)]
kernel: armsr: kmod-fsl-enetc-net: use common library
NXP has introduced an evolved version of the LS1028A ENETC
IP in their new i.MX94/5 family. While the two devices
share a common lineage, they are different enough that
they cannot be implemented in the same driver.
Hence some functions from the LS1028A ENETC driver have been
split into a 'library'.
When a kmod package for the new ENETC (nxp-enetc4) is introduced then
the packaging for the common library will need to be reworked.
Mathew McBride [Sun, 29 Mar 2026 23:30:00 +0000 (10:30 +1100)]
kernel: armsr: remove duplicated field_get from rzv2h irqchip
In OpenWrt we have backported changes to bitfield.h
from kernel 6.19.
A backport fix, 9966c8cc987e ("irqchip/renesas-rzv2h:
Prevent TINT spurious interrupt during resume") into
linux-stable/linux-6.18.y modified irq-renesas-rzv2h.c
to include it's own field_get, which does not exist
in the 6.18 branch, causing a compile error.
Mathew McBride [Tue, 6 Jan 2026 04:04:22 +0000 (15:04 +1100)]
kernel/armsr: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
We also backported four patches to fix perf tool regression:
- generic/backport-6.12/216-01-revert-perf-cgroup-update-metric-leader-in-evlist__e.patch
- generic/backport-6.12/216-02-revert-perf-tool_pmu-fix-aggregation-on-duration_tim.patch
- generic/backport-6.12/216-03-revert-perf-python-add-parse_events-function.patch
- generic/backport-6.12/216-04-revert-perf-tool_pmu-factor-tool-events-into-their-o.patch
张 鹏 [Mon, 12 Jun 2023 09:21:28 +0000 (17:21 +0800)]
ath79: enable link state reporting for eth1 on Qxwlan e750a/e600g/e600gac
Now, that the support for e750a/e600g/e600gac is merged, enable link state
reporting for the Fast Ethernet port attached through the built-in switch,
so it can generate netifd and hotplug events as well, for example -
- to control DHCP client.
ath79: report link state on ETH2 port of Mikrotik RBmAP-2nD
Add node for swphy1 in qca953x.dtsi, as it is common part - but make it
disabled, as this one is rarely used in other devices. Enable it in
RBmAP-2nD and attach to eth1 as PHY.
ath79: enable link state reporting for eth1 on Ruckus ZF7372
Now, that the support for ZF7372 is merged, enable link state reporting
for the Fast Ethernet port attached through the built-in switch, so
it can generate netifd and hotplug events as well, for example -
- to control DHCP client.
Lech Perczak [Sat, 28 May 2022 20:41:26 +0000 (22:41 +0200)]
ath79: dts: set builtin-switch for SoCs with fixed-link on eth1
Introduce the property from previous commit on the SoCs which use a
fixed 1000FD link to their internal switch. This way, devices which have
a single port attached through it can drop the "fixed-link" node if
needed, and attach proper phy-handle provided by built-in switch to
the port, to report link status information on userspace.
AR7100 is skipped intentionally, because its connection to built-in
switch isn't a fixed-link.
Lech Perczak [Sat, 28 May 2022 20:35:26 +0000 (22:35 +0200)]
ath79: ag71xx: use "builtin-switch" property to set link configuration
To support reporting link state of PHYs attached to built-in switch,
add a device tree knob which allows to force 1000Mbps/FD mode,
which is the link mode between eth1 MAC and the on-chip switch, even if
no "fixed-link" node is present. Re-use the "builtin-switch" name
already used in respective MDIO nodes.
This way, a phy-handle property can be added to eth1 node, and devices,
which have a single port attached through the built-in switch,
can report proper link state of that to userspace.
To perform that, one needs to delete the 'fixed-link' node and map the
correct swphy node to 'phy-handle' property. One of those is still
required to be present in the eth1 node.
Lorenzo Bianconi [Fri, 22 May 2026 15:04:53 +0000 (17:04 +0200)]
airoha: Introduce support multi-serdes on the same GDM port
EN7581 or AN7583 SoCs support connecting multiple external SerDes (e.g.
Ethernet or USB SerDes) to GDM3 or GDM4 ports via a hw arbiter that
manages the traffic in a TDM manner. As a result multiple net_devices can
connect to the same GDM{3,4} port and there is a theoretical "1:n"
relation between GDM ports and net_devices.
This series introduces support for multiple net_devices connected to the
same Frame Engine (FE) GDM port (GDM3 or GDM4) via an external hw
arbiter. Please note GDM1 or GDM2 does not support the connection with
the external arbiter.
Rosen Penev [Thu, 21 May 2026 23:32:49 +0000 (16:32 -0700)]
apm821xx: fix dmesg warning slop
Fix by replacing memset with manual 0 assignments. The first patch was
rightly rejected by upstream as it affects everything so keep it in 9xx.
Upstream message for it is:
dcbz instruction shouldn't be used on non-cached memory. Using
it on non-cached memory can result in alignment exception and
implies a heavy handling.
Instead of silentely emulating the instruction and resulting in high
performance degradation, warn whenever an alignment exception is
taken in kernel mode due to dcbz, so that the user is made aware that
dcbz instruction has been used unexpectedly by the kernel.
Rosen Penev [Sat, 16 May 2026 22:14:50 +0000 (15:14 -0700)]
gpio-button-hotplug: accept GPIO buttons with explicit IRQs
gpio-button-hotplug skips buttons with button->irq set because it cannot
handle true interrupt-only gpio-keys descriptions. That check also skips
valid GPIO-backed buttons that provide a separate interrupt specifier, such
as the Meraki MX60 reset button.
Try to acquire the GPIO descriptor before deciding that an explicit-IRQ
button is unsupported. Continue to skip true interrupt-only buttons, and
make the IRQ setup and teardown paths ignore skipped entries.
Tested on: Cisco Meraki MX60. Reset button now works.
Fixes: 23845fa10bc13 ("gpio-button-hotplug: do not error on interrupt attached keys") Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://github.com/openwrt/openwrt/pull/23382 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Rosen Penev [Fri, 15 May 2026 06:44:14 +0000 (23:44 -0700)]
kernel/apm821xx: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
SoC: MediaTek MT7988A (4 cores)
RAM: 1024MiB
Flash: Winbond SPI-NAND 128 MiB
Network: 1 WAN (2.5G), 3 LAN (1G), 1 SFP+ (10G)
2 SIM slots
Buttons: Reset, WPS
Power: DC 12V 3A (Recommend 19V to avoid voltage drop)
WiFi: MT7996 2.4Ghz, 5.8Ghz and 6Ghz (BE19000)
- 2.4Ghz and 5.8Ghz share same dual band antenna (4)
- 6Ghz uses dedicated 6G antenna (4)
Misc: 1 USB2.0 port, UART header
Installation:
A. Through U-Boot menu:
- Prepare your connecting computer to use a static IP in
network 192.168.1.0/24
- Power down the router and hold in the Reset button.
- While holding in the button power up the router again.
- Hold the button in for 10 seconds and then release.
- Use your browser to go to 192.168.1.1
- If you see a GUI allowing for flashing firmware then
you got the right model.
- Upload the sysupgrade file.
Note 1: Recovery GUI can be used to recover from an incorrect
firmware flash.
Note 2: There is a GPIO watchdog that expires after 2 minutes
so flashing sysupgrade via U-boot needs to be done
quickly within that timer.
B. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled
(modified by the seller), you can easily upgrade
by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware,
then flash the firmware
**Huasifei WH3000R NAND**
Wi-Fi 6 router based on MediaTek MT7981B SoC.
MT7981B+MT7976CN+MT7531AE
**Specifications**
SoC: Filogic 820 MT7981B (1.3GHz)
RAM: DDR3 512MB
Flash: 256MiB Winbond SPI NAND
WiFi: MT7976C: 2.4GHz 2x2, 5GHz 2x2
Ethernet: MT7531: 3x 1GbE LAN + 1x 1GbE WAN
USB: 1x USB 3.0 port
Two buttons: reset and mesh
LEDs: RGB (red, green, blue together)
UART: 3.3V, TX, RX, GND / 115200 8N1
DC power interface
+---------+-------------------+--------------------------+
| | MAC | Algorithm |
+---------+-------------------+--------------------------+
| LAN | 58:23:BC:xx:xx:x2 | label+1 |
| WAN | 58:23:BC:xx:xx:x1 | label+0 (eeprom) |
| WLAN 2g | 58:23:BC:xx:xx:x3 | label+2 |
| WLAN 5g | 58:23:BC:xx:xx:x4 | label+3 |
+---------+-------------------+--------------------------+
Since it's convenient for the users to check and tell MAC
to their internet providers from the router label, we set
WAN as a base MAC located at 'Factory', 0x4.
Discussed this with the vendor.
**Installation via U-Boot rescue**
1. Set static IP 192.168.1.2 on your computer and default route as 192.168.1.1
2. Connect to the LAN port and hold the reset button while booting the device.
3. Wait for the LED to blink 5 times, and release the reset button.
4. Open U-boot web page on your browser at http://192.168.1.1
5. Select the OpenWrt sysupgrade image, upload it, and start the upgrade.
6. Wait for the router to flash the new firmware.
7. Wait for the router to reboot itself.
**Installation via sysupgrade**
Just flash sysupgrade file via
[LuCI upgrade page](http://192.168.1.1/cgi-bin/luci/admin/system/flash)
without saving the settings.
**Installation via SSH**
Upload the file to the router `/tmp` directory, `ssh root@192.168.1.1`
and issue a command:
```
sysupgrade -n /tmp/openwrt-mediatek-filogic-huasifei_wh3000r-nand-squashfs-sysupgrade.bin
```
MAC addresses come from the 'ledeinfo' partition (mtd6) at offset 0x18
(label macaddr_ledeinfo_18); the stored value is the LAN MAC.
interface this port vendor firmware
------------------- ----------- --------------------------
eth0 / LAN bridge base + 0 base + 0
eth1 / WAN base + 1 base + 1
wifi 2.4 GHz band@0 base + 2 base (driver-derived)
wifi 5 GHz band@1 base + 3 base + LAA bit (driver)
The vendor's ethernet scheme (LAN = base, WAN = base + 1) is reproduced
exactly. For WiFi the vendor's proprietary mt_wifi driver ignores the
stored per-radio MAC and derives each BSSID from the base by setting the
locally-administered bit, so the radios are not given clean unicast
offsets. Under mainline mt76 + DSA, reusing the base (LAN) MAC on a radio
collides at L2 with the gmac0 conduit, so this port assigns the 2.4 GHz
and 5 GHz radios base + 2 and base + 3 — unique unicast addresses in the
same OUI block.
Installation
------------
Stock firmware defaults (verified on shipping units):
LAN IP: 192.168.100.1
SSH/web: user 'root', password 'admin'
Serial: 3.3 V TTL UART header on PCB, 115200 8N1, no flow control
Image artifacts produced by this device definition:
openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-factory.bin
openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-sysupgrade.bin
Before flashing, back up the per-unit partitions (cannot be
regenerated):
Method 2 - U-Boot serial recovery via TFTP (requires 3.3 V USB-UART
adapter):
1. Attach 3.3 V USB-UART (TX, RX, GND) to the PCB header. Open a
terminal at 115200 8N1, no flow control.
2. Configure a TFTP server on the host PC at IP 192.168.2.88.
Place the factory image in the TFTP root, renamed if desired.
3. Power on the router. The BL2/U-Boot banner prints within ~1
second; press any key during the autoboot countdown to enter
the U-Boot menu.
4. From the menu, select 'Upgrade ubi'. U-Boot's default IP is
192.168.2.1 and it expects the TFTP server at 192.168.2.88.
Provide the factory image filename when prompted.
5. Wait for the write to complete; U-Boot reboots into OpenWrt.
Method 3 - From a NAND programmer (brick-recovery path):
1. Clip onto or desolder the SPI-NAND chip and dump the full
128 MiB with a programmer (e.g. RT809H, CH341A with NAND
adapter). Keep the dump as a recovery image.
2. Using the same programmer, write the factory.bin image to
the UBI region of the NAND. The SPI-NOR (BL2/u-boot-env/
Factory/FIP/woem/ledeinfo/nvram) must NOT be erased - those
partitions are per-unit and live on the separate 4 MiB NOR.
3. Reseat the chip and power on. The bootloader on NOR will
load the new kernel and rootfs from UBI.
Note on eMMC configuration (Addressing 52MHz limit on 128GB IC):
Debugfs output from the OEM firmware (/sys/kernel/debug/mmc0/ios) confirms
the manufacturer deliberately limits the eMMC to 52MHz High-Speed mode at 3.3V
(actual clock: 52000000 Hz, bus width: 8 bits, timing spec: mmc high-speed).
Therefore, the conservative DTS properties (max-frequency = <52000000> and
lack of HS200/HS400 support) strictly reflect the OEM hardware design.
Installation instructions:
1. SSH into the stock router (192.168.132.1, user: root, pass: password).
2. Back up existing partitions using dd.
3. Upload the OpenWrt-built GPT partition table (*-gpt.bin) and flash it:
dd if=/tmp/gpt.bin of=/dev/mmcblk0 bs=512 count=34 conv=fsync
echo -e 'w' | fdisk /dev/mmcblk0
4. Flash the OpenWrt-built U-Boot (*-bl31-uboot.fip) to the FIP partition:
dd if=/tmp/uboot.fip of=$(blkid -t PARTLABEL=fip -o device) conv=fsync
5. Disconnect power. Connect PC with static IP 192.168.1.2.
6. Hold reset button, power on, and wait 10 seconds to enter U-Boot web UI.
7. Flash the OpenWrt sysupgrade image.
MAC address layout (factory partition, mmcblk0p2):
WAN: xx:xx:xx:xx:xx:xx (factory offset 0x24)
LAN: xx:xx:xx:xx:xx:xy (factory offset 0x2a)
Label: Matches LAN MAC (0x2a)
2.4G: Base MAC (extracted from factory offset 0x4)
5G: Base MAC with Locally Administered bit set
Jonas Jelonek [Sun, 24 May 2026 21:43:54 +0000 (23:43 +0200)]
qoriq: drop kernel config for 6.12
The target was recently switched to 6.18. However, it was missed to drop
the kernel config 6.12 and a rebase unintendedly reverted previous
changes. Since the config isn't needed anymore, drop it.
Fixes: d3a7e895690b ("qoriq: switch to 6.18 kernel") Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
Jonas Jelonek [Wed, 13 May 2026 19:58:44 +0000 (19:58 +0000)]
realtek: add support for Ubiquiti UniFi USW Aggregation
Add support for the RTL9303-based Ubiquiti UniFi USW Aggregation, an
8-port 10G SFP+ aggregation switch.
Hardware
========
- RTL9303 SoC
- 256 MiB DDR
- 16 MiB SPI-NOR flash
- 8x 1G/10G SFP+ cages
- Per-port LEDs: 1x white LED per SFP+ cage
- Buttons: 1x Reset
- Console: TTL 3.3V, 115200 8N1, internal unpopulated 4-hole THT
footprint (the device must be opened to solder a header)
- pinout (with the front panel facing you, left to right):
VCC/unused, RX, TX, GND
- Front touch display (see below)
- Software chain:
- U-Boot (Ubiquiti-flavoured)
- UniFi OS (OpenWrt-based)
MAC address
===========
Single MAC address derived from the eeprom partition. Applied to all
switch ports.
Front touch display
===================
The unit has a touch-capable front display, driven by a dedicated
STM32-based MCU connected to the host via UART. The MCU runs Ubiquiti's
LCM firmware and exposes a high-level JSON protocol (page selection,
button-press events, etc.); arbitrary pixel-level control is not
possible without replacing the MCU firmware. The display is therefore
not supported beyond what the stock LCM firmware offers.
Disclaimer
==========
Stock uses a dual-bank layout (kernel0/kernel1, 7 MiB each). OpenWrt
replaces both banks with a single contiguous firmware partition.
Flashing OpenWrt overwrites both stock kernel slots; U-Boot remains
intact and can be used for recovery.
The stock firmware blob is RSA-signed and cannot be flashed via the
UniFi web UI. Installation has to be done from a root shell on the
running UniFi OS.
Installation
============
1. Enable SSH on the stock UniFi OS and log in as root.
2. Copy the OpenWrt sysupgrade image to /tmp on the switch (e.g. via
scp).
3. Adjust IMG below to point at the copied file, then run the block as
a whole. It writes kernel0, splits into kernel1 if the image is
larger than that slot (otherwise invalidates kernel1 so U-Boot
cannot pick a stale bank), and reboots:
It does not matter which bank stock booted from when the dd block
runs: both banks are touched in the same pass (kernel0 written, kernel1
either written or invalidated). With kernel1 invalidated, U-Boot's
internal fallback kicks in and permanently switches to kernel0 on the
next boot, so the device stays on OpenWrt as long as kernel0 is
bootable.
Recovery
========
Since the installation procedure invalidates or partially overwrites
the second bank, recovery requires serial console access (see Hardware
above for pinout).
1. Interrupt U-Boot autoboot by spamming a key during early boot to
drop into the U-Boot prompt.
2. Bring up networking:
rtk network on
3. Transfer an OpenWrt initramfs image via TFTP and boot it:
4. From the running initramfs OpenWrt, re-run the installation
procedure above (the dd block, with $IMG pointing at the image on
/tmp).
Return to stock firmware
========================
There is no fully-supported revert path. The stock firmware blob is a
Ubiquiti UBNT archive (header + parts, see firmware-utils' fw.h) that
embeds a u-boot and a kernel0 uImage payload; only the latter is
relevant when writing back to the kernel partitions.
The snippet below extracts the kernel0 uImage from such a blob by
locating the uImage magic and using the size carried in the uImage
header itself, without parsing any UBNT framing. It is provided as a
best-effort starting point; verify the result before flashing,
otherwise you're on your own:
Once you have a clean uImage, write it to both kernel banks (since
the bootselect mechanism is not yet decoded, this guarantees U-Boot
picks the stock image regardless of bank):
dastarothx [Sat, 23 May 2026 16:40:20 +0000 (12:40 -0400)]
wifi-scripts: ucode: fix null dereference for 6GHz-only radios
he_phy_cap and he_mac_cap in phy_capabilities are only populated inside
the iftype_data loop. On 6GHz-only radios (e.g. QCN9074/ath11k_pci),
when capability bytes are unavailable they remain null, causing null
dereferences in device_htmode_append():
Reference error: left-hand side expression is null
if (!(he_phy_cap[3] & 0x80))
Initialise both to [] before the loop and guard the consumer side with
?? [] so bitwise checks conservatively disable beamformer/beamformee/twt
features rather than crashing.
Til Kaiser [Sat, 23 May 2026 19:26:04 +0000 (21:26 +0200)]
generic: 6.18: add missing NET_SCH_BPF symbol
Add CONFIG_NET_SCH_BPF disabled.
NET_SCH_BPF depends on DEBUG_INFO_BTF.
When CONFIG_KERNEL_DEBUG_INFO_BTF is enabled, the symbol
becomes visible and Kconfig prompts for it because it is
missing from the generic 6.18 kernel config.
Hauke Mehrtens [Thu, 21 May 2026 19:15:59 +0000 (21:15 +0200)]
github: LLM-review: run the digest twice a day
Change the schedule from once a day to twice a day (03:00 and 15:00
UTC) and raise the default max_prs from 16 to 24, so more open PRs
get covered now that the per-PR trigger has been removed.
Hauke Mehrtens [Thu, 21 May 2026 19:11:54 +0000 (21:11 +0200)]
github: LLM-review: stop reviewing new PRs automatically
Drop the pull_request_target trigger so the LLM review no longer runs
on opened/reopened PRs. We are limited to 15 Claude routine runs per
day, and the automatic per-PR trigger exhausted that budget on
several days, starving the nightly digest.
The nightly schedule and manual workflow_dispatch triggers remain.
Hauke Mehrtens [Thu, 21 May 2026 19:10:15 +0000 (21:10 +0200)]
github: drop the claude-code-review workflow
Delete .github/workflows/claude-code-review.yml. It is superseded by
the LLM review action, which runs automatically and uses the Claude
routine API instead of the much more expensive Claude API.
Hauke Mehrtens [Sat, 23 May 2026 00:09:47 +0000 (02:09 +0200)]
libubox: update to Git HEAD (2026-05-23)
19e88cc41288 json_script: use size_t for calloc_a() length argument 9afc71053481 udebug-remote: pass size_t to calloc_a() 73a21977c52a treewide: use size_t for length variables to avoid implicit narrowing 1fe93d2fefb2 blob, udebug-remote: silence -Wconversion warnings in trivial cases
Hauke Mehrtens [Sat, 23 May 2026 00:56:36 +0000 (02:56 +0200)]
ubus: update to Git HEAD (2026-05-23)
4b274055ede3 libubus: fix NULL dereference on OOM in ubus_queue_msg 8b5be570f13e libubus-acl: fix dangling pointers on blob_memdup failure in acl_recv_cb 9105ea2a349a ubusd_acl: fix NULL dereference on OOM in ubusd_acl_alloc_obj 07d7f34ac278 ubusd_acl: handle allocation failures in ubusd_acl_init_client 497321a5ea90 ubusd_acl: fix NULL dereference on OOM in ubusd_acl_init f66d52ba983f ubusd_event: fix OOM handling in ubusd_send_event_msg 11ea1b3bdbea ubusd_main: fix async-signal-unsafe SIGHUP handler 0c095592ccb7 ubusd_proto: fix resource leaks and ID tree corruption in ubusd_proto_new_client f61695e6e12a ubusd_proto: fix NULL dereference for user/group in ubusd_handle_add_watch 7ecacfadd9bc ubusd_proto: fix NULL dereference on OOM in ubusd_proto_init_retmsg 3ab9d7759545 lua: fix inverted argument check in ubus_lua_add 43051ca73aec lua: fix unchecked calloc and memory leak in ubus_lua_load_object 4ca0b141e9a7 ubusd_id: use getrandom(2) unconditionally on Linux 7e4356da8abe ubusd_monitor: fix NULL dereference on OOM in ubusd_monitor_message 5849870f2251 libubus-req: fix file descriptor leaks in ubus_process_req_msg f29767f90af1 libubus: fix file descriptor leaks in ubus_process_msg b099d050b59d libubus: make ubus_shutdown idempotent a564b8dcb395 ubusd_main: check strdup return value in mkdir_sockdir 239edcbaaac8 ubusd_id: fix continue in do-while skipping random ID retry 09d2df45bf38 ubusd: fix NULL dereference on OOM in ubus_msg_enqueue bcc45ca981fd libubus: actually set FD_CLOEXEC on the ubus socket 8188f5ce8564 libubus-io: close recv_fd captured before get_next_msg failure 7a068bac5a9b libubus-io: byte-swap peer in HELLO when storing as local_id 747013f6ea05 libubus-io: reset sock.fd to -1 after close on ubus_reconnect error path 020a64b9b169 ubusd_acl: use size_t for strlen result in ubusd_acl_alloc_obj f92ffd289dcc ubusd: use size_t for string and blob length variables 795b32bb96b6 ubusd: use fixed-width types for sequence counters
projects / thirdparty / openwrt.git / log
