* Add a post-release patch for timezone handling in datetime string
matching (affecting at least uhttpd):
bug report: https://www.openwall.com/lists/musl/2026/03/22/3
fix: https://www.openwall.com/lists/musl/2026/03/30/6
new features:
- posix_getdents interface (new in POSIX-2024)
- renameat2 interface (linux extension)
- iconv support for CP858
- vdso clock_gettime for riscv{32,64}, powerpc{,64}, and s390x
- loongarch64 TLSDESC support
- exposed __getauxval for compiler runtime use detecting cpu features
compatibility:
- initgroups no longer artificially limits number of supplementary groups
- getusershell now skips blank lines and comments
- exit is now explicitly thread-safe (possible future requirement)
- atexit now fails rather than deadlocking if called from late dtor
- strerror now has error strings for EUCLEAN and ENAVAIL
- isatty no longer collapses errors to ENOTTY
- sched.h namespace pollution with _GNU_SOURCE is reduced
- hasmntopt now matches only whole options, not arbitrary substrings
- shadow.h no longer declares an unimplemented sgetspent interface
- vdso with missing sysv hash table (only gnu hash) is now supported
conformance:
- pwrite now handles O_APPEND correctly, reports error if it can't
- mbnrtowcs now conforms to new POSIX-2024 requirement for partial character
- iconv GBK now properly includes euro symbol
- strptime now accepts conversion specifiers added in POSIX-2024
- inet_ntop IPv6 "zero compression" now conforms to RFC 5952
bugs fixed:
- iconv euc-kr decoder could do oob writes on invalid inputs (CVE-2025-26519)
- iconv shift_jis decoder could produce wrong outputs for some invalid inputs
- printf did not honor hex float precision correctly in some cases
- lost or delayed wakes in sem_post under race condition
- termios input speed handling was wrong
- strcasestr failed to match zero-length needle
- fma handled corner case with negative zero wrongly
- syslog LOG_MAKEPRI macro was incorrect
- timer_create is no longer affected by known pthread_barrier bugs
- sysconf(_SC_MINSIGSTKSZ) computed min size incorrectly
- statx emulation left some fields uninitialized
- mntent wrongly included final newline in parsed field output
- SIGEV_THREAD timers could abort process if SIGTIMER became unblocked
- bind_textdomain_codeset returned wrong value
arch-specific bugs fixed:
- early dynamic linker handled page size wrong on dynamic pagesize archs
- arm and aarch64 crti/n files had wrong alignment
- m68k POLLWRNORM and POLLWRBAND values were incorrect
- x32 mq ABI was mismatched
bcm47xx: base-files: hack sysinfo to allow ASU sysupgrades
This old platform(no DTS) is using nvram numeric fields (or "unknown"
string) for its board_name [1]. Allow ASU sysupgrades by preserving
that value in /tmp/sysinfo/boardtype for board-detection/configuration
logic, and derive a canonical board_name from /tmp/sysinfo/model in
the form "vendor,device-variant".
Only a few target profile image names are not consistent in the last
suffix, uniform them.
A few images with (NA) and (ROW) variants are only meant to be
compatible with the upgrade process in the OEM firmware using these
NETGEAR_BOARD_ID and NETGEAR_REGION fields but the images are
compatibles(only if the NETGEAR_BOARD_ID is shared,due to platform
check) [2] (i.e. netgear_wnr3500l).
Add SUPPORTED_DEVICES to one of these variant in order to allow ASU
sysupgrade profile identification.
*Since this target has never implemented fwtool's SUPPORTED_DEVICES
metadata check, there is no risk of breaking forceless sysupgrade with
new board_name values.
[1]: bcm47xx board info https://github.com/gregkh/linux/blob/master/arch/mips/bcm47xx/board.c
[2]: sysupgrade platform check https://github.com/openwrt/openwrt/blob/main/target/linux/bcm47xx/base-files/lib/upgrade/platform.sh
Shiji Yang [Sat, 23 May 2026 13:42:19 +0000 (21:42 +0800)]
toolchain/gcc: use configure option to disable TM clone registry
GCC 10 added the new configure option --disable-tm-clone-registry[1].
It is useful for reducing code size in embedded systems. Our local hack
patch is no longer needed.
1. Boot WSR-2533DHP3 with "Router" mode
2. Access to "http://192.168.11.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt factory.bin image and click update ("更新実行")
button
4. Wait ~120 seconds to complete flashing
Note:
- This device has 2x OS images on flash. The first one will always be
used for booting and the secondary is for backup.
Tested:
- initramfs boot
- factory.bin installation from OEM WebUI
- LAN port assignment
- WAN DHCP
- NAT routing
- 2.4 GHz Wi-Fi
- 5 GHz Wi-Fi
- LEDs
- Buttons
MAC Addresses:
LAN : 58:27:8C:xx:xx:90 (board_data, mac (text))
WAN : 58:27:8C:xx:xx:90 (board_data, mac (text))
2.4 GHz: 58:27:8C:xx:xx:91
5 GHz : 58:27:8C:xx:xx:94
Migration to OpenWrt:
- Download the RSA-signed intermediate firmware from the Cudy website: `openwrt-ramips-mt76x8-cudy_wr300-squashfs-flash.bin`
- Connect the computer to the LAN and flash the intermediate firmware via the OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the WAN port (upper port)
- Provide the Cudy firmware as `recovery.bin` in the TFTP server
- Power on the device and hold the reset button immediately after the first LED blink
- The recovery process will start
- When the recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load an initramfs image via U-Boot because there is no option to interrupt U-Boot
Mathew McBride [Fri, 1 May 2026 02:16:33 +0000 (12:16 +1000)]
kernel: armsr: remove duplicate kconfig between generic and armsr
These were found by running:
comm -12 <(sort target/linux/generic/config-6.18) \
<(sort target/linux/armsr/config-6.18)
A similar process has been run between armsr/config-6.18
and armsr/armv8/config-6.18, though I have not pruned
the armv8 as much. Once the main branch switches armsr
to 6.18 we can do a more aggressive deduplication.
kernel: armsr: move framebuffer and DRM related options to top-level
The armv8 configuration has more features enabled compared to armv7,
as armv8 is intended to run on a selection of real hardware, while
armsr/armv7 almost always runs only in QEMU.
Some kmod dependency issues were appearing on armv7 builds which
did not appear elsewhere. To minimise these issues, we will
move the framebuffer feature set to the top level of the target.
Mathew McBride [Tue, 6 Jan 2026 06:40:22 +0000 (17:40 +1100)]
kernel: armsr: kmod-fsl-enetc-net: use common library
NXP has introduced an evolved version of the LS1028A ENETC
IP in their new i.MX94/5 family. While the two devices
share a common lineage, they are different enough that
they cannot be implemented in the same driver.
Hence some functions from the LS1028A ENETC driver have been
split into a 'library'.
When a kmod package for the new ENETC (nxp-enetc4) is introduced then
the packaging for the common library will need to be reworked.
Mathew McBride [Sun, 29 Mar 2026 23:30:00 +0000 (10:30 +1100)]
kernel: armsr: remove duplicated field_get from rzv2h irqchip
In OpenWrt we have backported changes to bitfield.h
from kernel 6.19.
A backport fix, 9966c8cc987e ("irqchip/renesas-rzv2h:
Prevent TINT spurious interrupt during resume") into
linux-stable/linux-6.18.y modified irq-renesas-rzv2h.c
to include it's own field_get, which does not exist
in the 6.18 branch, causing a compile error.
Mathew McBride [Tue, 6 Jan 2026 04:04:22 +0000 (15:04 +1100)]
kernel/armsr: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
We also backported four patches to fix perf tool regression:
- generic/backport-6.12/216-01-revert-perf-cgroup-update-metric-leader-in-evlist__e.patch
- generic/backport-6.12/216-02-revert-perf-tool_pmu-fix-aggregation-on-duration_tim.patch
- generic/backport-6.12/216-03-revert-perf-python-add-parse_events-function.patch
- generic/backport-6.12/216-04-revert-perf-tool_pmu-factor-tool-events-into-their-o.patch
张 鹏 [Mon, 12 Jun 2023 09:21:28 +0000 (17:21 +0800)]
ath79: enable link state reporting for eth1 on Qxwlan e750a/e600g/e600gac
Now, that the support for e750a/e600g/e600gac is merged, enable link state
reporting for the Fast Ethernet port attached through the built-in switch,
so it can generate netifd and hotplug events as well, for example -
- to control DHCP client.
ath79: report link state on ETH2 port of Mikrotik RBmAP-2nD
Add node for swphy1 in qca953x.dtsi, as it is common part - but make it
disabled, as this one is rarely used in other devices. Enable it in
RBmAP-2nD and attach to eth1 as PHY.
ath79: enable link state reporting for eth1 on Ruckus ZF7372
Now, that the support for ZF7372 is merged, enable link state reporting
for the Fast Ethernet port attached through the built-in switch, so
it can generate netifd and hotplug events as well, for example -
- to control DHCP client.
Lech Perczak [Sat, 28 May 2022 20:41:26 +0000 (22:41 +0200)]
ath79: dts: set builtin-switch for SoCs with fixed-link on eth1
Introduce the property from previous commit on the SoCs which use a
fixed 1000FD link to their internal switch. This way, devices which have
a single port attached through it can drop the "fixed-link" node if
needed, and attach proper phy-handle provided by built-in switch to
the port, to report link status information on userspace.
AR7100 is skipped intentionally, because its connection to built-in
switch isn't a fixed-link.
Lech Perczak [Sat, 28 May 2022 20:35:26 +0000 (22:35 +0200)]
ath79: ag71xx: use "builtin-switch" property to set link configuration
To support reporting link state of PHYs attached to built-in switch,
add a device tree knob which allows to force 1000Mbps/FD mode,
which is the link mode between eth1 MAC and the on-chip switch, even if
no "fixed-link" node is present. Re-use the "builtin-switch" name
already used in respective MDIO nodes.
This way, a phy-handle property can be added to eth1 node, and devices,
which have a single port attached through the built-in switch,
can report proper link state of that to userspace.
To perform that, one needs to delete the 'fixed-link' node and map the
correct swphy node to 'phy-handle' property. One of those is still
required to be present in the eth1 node.
Lorenzo Bianconi [Fri, 22 May 2026 15:04:53 +0000 (17:04 +0200)]
airoha: Introduce support multi-serdes on the same GDM port
EN7581 or AN7583 SoCs support connecting multiple external SerDes (e.g.
Ethernet or USB SerDes) to GDM3 or GDM4 ports via a hw arbiter that
manages the traffic in a TDM manner. As a result multiple net_devices can
connect to the same GDM{3,4} port and there is a theoretical "1:n"
relation between GDM ports and net_devices.
This series introduces support for multiple net_devices connected to the
same Frame Engine (FE) GDM port (GDM3 or GDM4) via an external hw
arbiter. Please note GDM1 or GDM2 does not support the connection with
the external arbiter.
Rosen Penev [Thu, 21 May 2026 23:32:49 +0000 (16:32 -0700)]
apm821xx: fix dmesg warning slop
Fix by replacing memset with manual 0 assignments. The first patch was
rightly rejected by upstream as it affects everything so keep it in 9xx.
Upstream message for it is:
dcbz instruction shouldn't be used on non-cached memory. Using
it on non-cached memory can result in alignment exception and
implies a heavy handling.
Instead of silentely emulating the instruction and resulting in high
performance degradation, warn whenever an alignment exception is
taken in kernel mode due to dcbz, so that the user is made aware that
dcbz instruction has been used unexpectedly by the kernel.
Rosen Penev [Sat, 16 May 2026 22:14:50 +0000 (15:14 -0700)]
gpio-button-hotplug: accept GPIO buttons with explicit IRQs
gpio-button-hotplug skips buttons with button->irq set because it cannot
handle true interrupt-only gpio-keys descriptions. That check also skips
valid GPIO-backed buttons that provide a separate interrupt specifier, such
as the Meraki MX60 reset button.
Try to acquire the GPIO descriptor before deciding that an explicit-IRQ
button is unsupported. Continue to skip true interrupt-only buttons, and
make the IRQ setup and teardown paths ignore skipped entries.
Tested on: Cisco Meraki MX60. Reset button now works.
Fixes: 23845fa10bc13 ("gpio-button-hotplug: do not error on interrupt attached keys") Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://github.com/openwrt/openwrt/pull/23382 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Rosen Penev [Fri, 15 May 2026 06:44:14 +0000 (23:44 -0700)]
kernel/apm821xx: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
SoC: MediaTek MT7988A (4 cores)
RAM: 1024MiB
Flash: Winbond SPI-NAND 128 MiB
Network: 1 WAN (2.5G), 3 LAN (1G), 1 SFP+ (10G)
2 SIM slots
Buttons: Reset, WPS
Power: DC 12V 3A (Recommend 19V to avoid voltage drop)
WiFi: MT7996 2.4Ghz, 5.8Ghz and 6Ghz (BE19000)
- 2.4Ghz and 5.8Ghz share same dual band antenna (4)
- 6Ghz uses dedicated 6G antenna (4)
Misc: 1 USB2.0 port, UART header
Installation:
A. Through U-Boot menu:
- Prepare your connecting computer to use a static IP in
network 192.168.1.0/24
- Power down the router and hold in the Reset button.
- While holding in the button power up the router again.
- Hold the button in for 10 seconds and then release.
- Use your browser to go to 192.168.1.1
- If you see a GUI allowing for flashing firmware then
you got the right model.
- Upload the sysupgrade file.
Note 1: Recovery GUI can be used to recover from an incorrect
firmware flash.
Note 2: There is a GPIO watchdog that expires after 2 minutes
so flashing sysupgrade via U-boot needs to be done
quickly within that timer.
B. Through OpenWrt Dashboard:
If your router comes with OpenWrt preinstalled
(modified by the seller), you can easily upgrade
by going to the dashboard (192.168.1.1) and then
navigate to System -> Backup/Flash firmware,
then flash the firmware
**Huasifei WH3000R NAND**
Wi-Fi 6 router based on MediaTek MT7981B SoC.
MT7981B+MT7976CN+MT7531AE
**Specifications**
SoC: Filogic 820 MT7981B (1.3GHz)
RAM: DDR3 512MB
Flash: 256MiB Winbond SPI NAND
WiFi: MT7976C: 2.4GHz 2x2, 5GHz 2x2
Ethernet: MT7531: 3x 1GbE LAN + 1x 1GbE WAN
USB: 1x USB 3.0 port
Two buttons: reset and mesh
LEDs: RGB (red, green, blue together)
UART: 3.3V, TX, RX, GND / 115200 8N1
DC power interface
+---------+-------------------+--------------------------+
| | MAC | Algorithm |
+---------+-------------------+--------------------------+
| LAN | 58:23:BC:xx:xx:x2 | label+1 |
| WAN | 58:23:BC:xx:xx:x1 | label+0 (eeprom) |
| WLAN 2g | 58:23:BC:xx:xx:x3 | label+2 |
| WLAN 5g | 58:23:BC:xx:xx:x4 | label+3 |
+---------+-------------------+--------------------------+
Since it's convenient for the users to check and tell MAC
to their internet providers from the router label, we set
WAN as a base MAC located at 'Factory', 0x4.
Discussed this with the vendor.
**Installation via U-Boot rescue**
1. Set static IP 192.168.1.2 on your computer and default route as 192.168.1.1
2. Connect to the LAN port and hold the reset button while booting the device.
3. Wait for the LED to blink 5 times, and release the reset button.
4. Open U-boot web page on your browser at http://192.168.1.1
5. Select the OpenWrt sysupgrade image, upload it, and start the upgrade.
6. Wait for the router to flash the new firmware.
7. Wait for the router to reboot itself.
**Installation via sysupgrade**
Just flash sysupgrade file via
[LuCI upgrade page](http://192.168.1.1/cgi-bin/luci/admin/system/flash)
without saving the settings.
**Installation via SSH**
Upload the file to the router `/tmp` directory, `ssh root@192.168.1.1`
and issue a command:
```
sysupgrade -n /tmp/openwrt-mediatek-filogic-huasifei_wh3000r-nand-squashfs-sysupgrade.bin
```
MAC addresses come from the 'ledeinfo' partition (mtd6) at offset 0x18
(label macaddr_ledeinfo_18); the stored value is the LAN MAC.
interface this port vendor firmware
------------------- ----------- --------------------------
eth0 / LAN bridge base + 0 base + 0
eth1 / WAN base + 1 base + 1
wifi 2.4 GHz band@0 base + 2 base (driver-derived)
wifi 5 GHz band@1 base + 3 base + LAA bit (driver)
The vendor's ethernet scheme (LAN = base, WAN = base + 1) is reproduced
exactly. For WiFi the vendor's proprietary mt_wifi driver ignores the
stored per-radio MAC and derives each BSSID from the base by setting the
locally-administered bit, so the radios are not given clean unicast
offsets. Under mainline mt76 + DSA, reusing the base (LAN) MAC on a radio
collides at L2 with the gmac0 conduit, so this port assigns the 2.4 GHz
and 5 GHz radios base + 2 and base + 3 — unique unicast addresses in the
same OUI block.
Installation
------------
Stock firmware defaults (verified on shipping units):
LAN IP: 192.168.100.1
SSH/web: user 'root', password 'admin'
Serial: 3.3 V TTL UART header on PCB, 115200 8N1, no flow control
Image artifacts produced by this device definition:
openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-factory.bin
openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-sysupgrade.bin
Before flashing, back up the per-unit partitions (cannot be
regenerated):
Method 2 - U-Boot serial recovery via TFTP (requires 3.3 V USB-UART
adapter):
1. Attach 3.3 V USB-UART (TX, RX, GND) to the PCB header. Open a
terminal at 115200 8N1, no flow control.
2. Configure a TFTP server on the host PC at IP 192.168.2.88.
Place the factory image in the TFTP root, renamed if desired.
3. Power on the router. The BL2/U-Boot banner prints within ~1
second; press any key during the autoboot countdown to enter
the U-Boot menu.
4. From the menu, select 'Upgrade ubi'. U-Boot's default IP is
192.168.2.1 and it expects the TFTP server at 192.168.2.88.
Provide the factory image filename when prompted.
5. Wait for the write to complete; U-Boot reboots into OpenWrt.
Method 3 - From a NAND programmer (brick-recovery path):
1. Clip onto or desolder the SPI-NAND chip and dump the full
128 MiB with a programmer (e.g. RT809H, CH341A with NAND
adapter). Keep the dump as a recovery image.
2. Using the same programmer, write the factory.bin image to
the UBI region of the NAND. The SPI-NOR (BL2/u-boot-env/
Factory/FIP/woem/ledeinfo/nvram) must NOT be erased - those
partitions are per-unit and live on the separate 4 MiB NOR.
3. Reseat the chip and power on. The bootloader on NOR will
load the new kernel and rootfs from UBI.
Note on eMMC configuration (Addressing 52MHz limit on 128GB IC):
Debugfs output from the OEM firmware (/sys/kernel/debug/mmc0/ios) confirms
the manufacturer deliberately limits the eMMC to 52MHz High-Speed mode at 3.3V
(actual clock: 52000000 Hz, bus width: 8 bits, timing spec: mmc high-speed).
Therefore, the conservative DTS properties (max-frequency = <52000000> and
lack of HS200/HS400 support) strictly reflect the OEM hardware design.
Installation instructions:
1. SSH into the stock router (192.168.132.1, user: root, pass: password).
2. Back up existing partitions using dd.
3. Upload the OpenWrt-built GPT partition table (*-gpt.bin) and flash it:
dd if=/tmp/gpt.bin of=/dev/mmcblk0 bs=512 count=34 conv=fsync
echo -e 'w' | fdisk /dev/mmcblk0
4. Flash the OpenWrt-built U-Boot (*-bl31-uboot.fip) to the FIP partition:
dd if=/tmp/uboot.fip of=$(blkid -t PARTLABEL=fip -o device) conv=fsync
5. Disconnect power. Connect PC with static IP 192.168.1.2.
6. Hold reset button, power on, and wait 10 seconds to enter U-Boot web UI.
7. Flash the OpenWrt sysupgrade image.
MAC address layout (factory partition, mmcblk0p2):
WAN: xx:xx:xx:xx:xx:xx (factory offset 0x24)
LAN: xx:xx:xx:xx:xx:xy (factory offset 0x2a)
Label: Matches LAN MAC (0x2a)
2.4G: Base MAC (extracted from factory offset 0x4)
5G: Base MAC with Locally Administered bit set
Jonas Jelonek [Sun, 24 May 2026 21:43:54 +0000 (23:43 +0200)]
qoriq: drop kernel config for 6.12
The target was recently switched to 6.18. However, it was missed to drop
the kernel config 6.12 and a rebase unintendedly reverted previous
changes. Since the config isn't needed anymore, drop it.
Fixes: d3a7e895690b ("qoriq: switch to 6.18 kernel") Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
Jonas Jelonek [Wed, 13 May 2026 19:58:44 +0000 (19:58 +0000)]
realtek: add support for Ubiquiti UniFi USW Aggregation
Add support for the RTL9303-based Ubiquiti UniFi USW Aggregation, an
8-port 10G SFP+ aggregation switch.
Hardware
========
- RTL9303 SoC
- 256 MiB DDR
- 16 MiB SPI-NOR flash
- 8x 1G/10G SFP+ cages
- Per-port LEDs: 1x white LED per SFP+ cage
- Buttons: 1x Reset
- Console: TTL 3.3V, 115200 8N1, internal unpopulated 4-hole THT
footprint (the device must be opened to solder a header)
- pinout (with the front panel facing you, left to right):
VCC/unused, RX, TX, GND
- Front touch display (see below)
- Software chain:
- U-Boot (Ubiquiti-flavoured)
- UniFi OS (OpenWrt-based)
MAC address
===========
Single MAC address derived from the eeprom partition. Applied to all
switch ports.
Front touch display
===================
The unit has a touch-capable front display, driven by a dedicated
STM32-based MCU connected to the host via UART. The MCU runs Ubiquiti's
LCM firmware and exposes a high-level JSON protocol (page selection,
button-press events, etc.); arbitrary pixel-level control is not
possible without replacing the MCU firmware. The display is therefore
not supported beyond what the stock LCM firmware offers.
Disclaimer
==========
Stock uses a dual-bank layout (kernel0/kernel1, 7 MiB each). OpenWrt
replaces both banks with a single contiguous firmware partition.
Flashing OpenWrt overwrites both stock kernel slots; U-Boot remains
intact and can be used for recovery.
The stock firmware blob is RSA-signed and cannot be flashed via the
UniFi web UI. Installation has to be done from a root shell on the
running UniFi OS.
Installation
============
1. Enable SSH on the stock UniFi OS and log in as root.
2. Copy the OpenWrt sysupgrade image to /tmp on the switch (e.g. via
scp).
3. Adjust IMG below to point at the copied file, then run the block as
a whole. It writes kernel0, splits into kernel1 if the image is
larger than that slot (otherwise invalidates kernel1 so U-Boot
cannot pick a stale bank), and reboots:
It does not matter which bank stock booted from when the dd block
runs: both banks are touched in the same pass (kernel0 written, kernel1
either written or invalidated). With kernel1 invalidated, U-Boot's
internal fallback kicks in and permanently switches to kernel0 on the
next boot, so the device stays on OpenWrt as long as kernel0 is
bootable.
Recovery
========
Since the installation procedure invalidates or partially overwrites
the second bank, recovery requires serial console access (see Hardware
above for pinout).
1. Interrupt U-Boot autoboot by spamming a key during early boot to
drop into the U-Boot prompt.
2. Bring up networking:
rtk network on
3. Transfer an OpenWrt initramfs image via TFTP and boot it:
4. From the running initramfs OpenWrt, re-run the installation
procedure above (the dd block, with $IMG pointing at the image on
/tmp).
Return to stock firmware
========================
There is no fully-supported revert path. The stock firmware blob is a
Ubiquiti UBNT archive (header + parts, see firmware-utils' fw.h) that
embeds a u-boot and a kernel0 uImage payload; only the latter is
relevant when writing back to the kernel partitions.
The snippet below extracts the kernel0 uImage from such a blob by
locating the uImage magic and using the size carried in the uImage
header itself, without parsing any UBNT framing. It is provided as a
best-effort starting point; verify the result before flashing,
otherwise you're on your own:
Once you have a clean uImage, write it to both kernel banks (since
the bootselect mechanism is not yet decoded, this guarantees U-Boot
picks the stock image regardless of bank):
dastarothx [Sat, 23 May 2026 16:40:20 +0000 (12:40 -0400)]
wifi-scripts: ucode: fix null dereference for 6GHz-only radios
he_phy_cap and he_mac_cap in phy_capabilities are only populated inside
the iftype_data loop. On 6GHz-only radios (e.g. QCN9074/ath11k_pci),
when capability bytes are unavailable they remain null, causing null
dereferences in device_htmode_append():
Reference error: left-hand side expression is null
if (!(he_phy_cap[3] & 0x80))
Initialise both to [] before the loop and guard the consumer side with
?? [] so bitwise checks conservatively disable beamformer/beamformee/twt
features rather than crashing.
Til Kaiser [Sat, 23 May 2026 19:26:04 +0000 (21:26 +0200)]
generic: 6.18: add missing NET_SCH_BPF symbol
Add CONFIG_NET_SCH_BPF disabled.
NET_SCH_BPF depends on DEBUG_INFO_BTF.
When CONFIG_KERNEL_DEBUG_INFO_BTF is enabled, the symbol
becomes visible and Kconfig prompts for it because it is
missing from the generic 6.18 kernel config.
Hauke Mehrtens [Thu, 21 May 2026 19:15:59 +0000 (21:15 +0200)]
github: LLM-review: run the digest twice a day
Change the schedule from once a day to twice a day (03:00 and 15:00
UTC) and raise the default max_prs from 16 to 24, so more open PRs
get covered now that the per-PR trigger has been removed.
Hauke Mehrtens [Thu, 21 May 2026 19:11:54 +0000 (21:11 +0200)]
github: LLM-review: stop reviewing new PRs automatically
Drop the pull_request_target trigger so the LLM review no longer runs
on opened/reopened PRs. We are limited to 15 Claude routine runs per
day, and the automatic per-PR trigger exhausted that budget on
several days, starving the nightly digest.
The nightly schedule and manual workflow_dispatch triggers remain.
Hauke Mehrtens [Thu, 21 May 2026 19:10:15 +0000 (21:10 +0200)]
github: drop the claude-code-review workflow
Delete .github/workflows/claude-code-review.yml. It is superseded by
the LLM review action, which runs automatically and uses the Claude
routine API instead of the much more expensive Claude API.
Hauke Mehrtens [Sat, 23 May 2026 00:09:47 +0000 (02:09 +0200)]
libubox: update to Git HEAD (2026-05-23)
19e88cc41288 json_script: use size_t for calloc_a() length argument 9afc71053481 udebug-remote: pass size_t to calloc_a() 73a21977c52a treewide: use size_t for length variables to avoid implicit narrowing 1fe93d2fefb2 blob, udebug-remote: silence -Wconversion warnings in trivial cases
Hauke Mehrtens [Sat, 23 May 2026 00:56:36 +0000 (02:56 +0200)]
ubus: update to Git HEAD (2026-05-23)
4b274055ede3 libubus: fix NULL dereference on OOM in ubus_queue_msg 8b5be570f13e libubus-acl: fix dangling pointers on blob_memdup failure in acl_recv_cb 9105ea2a349a ubusd_acl: fix NULL dereference on OOM in ubusd_acl_alloc_obj 07d7f34ac278 ubusd_acl: handle allocation failures in ubusd_acl_init_client 497321a5ea90 ubusd_acl: fix NULL dereference on OOM in ubusd_acl_init f66d52ba983f ubusd_event: fix OOM handling in ubusd_send_event_msg 11ea1b3bdbea ubusd_main: fix async-signal-unsafe SIGHUP handler 0c095592ccb7 ubusd_proto: fix resource leaks and ID tree corruption in ubusd_proto_new_client f61695e6e12a ubusd_proto: fix NULL dereference for user/group in ubusd_handle_add_watch 7ecacfadd9bc ubusd_proto: fix NULL dereference on OOM in ubusd_proto_init_retmsg 3ab9d7759545 lua: fix inverted argument check in ubus_lua_add 43051ca73aec lua: fix unchecked calloc and memory leak in ubus_lua_load_object 4ca0b141e9a7 ubusd_id: use getrandom(2) unconditionally on Linux 7e4356da8abe ubusd_monitor: fix NULL dereference on OOM in ubusd_monitor_message 5849870f2251 libubus-req: fix file descriptor leaks in ubus_process_req_msg f29767f90af1 libubus: fix file descriptor leaks in ubus_process_msg b099d050b59d libubus: make ubus_shutdown idempotent a564b8dcb395 ubusd_main: check strdup return value in mkdir_sockdir 239edcbaaac8 ubusd_id: fix continue in do-while skipping random ID retry 09d2df45bf38 ubusd: fix NULL dereference on OOM in ubus_msg_enqueue bcc45ca981fd libubus: actually set FD_CLOEXEC on the ubus socket 8188f5ce8564 libubus-io: close recv_fd captured before get_next_msg failure 7a068bac5a9b libubus-io: byte-swap peer in HELLO when storing as local_id 747013f6ea05 libubus-io: reset sock.fd to -1 after close on ubus_reconnect error path 020a64b9b169 ubusd_acl: use size_t for strlen result in ubusd_acl_alloc_obj f92ffd289dcc ubusd: use size_t for string and blob length variables 795b32bb96b6 ubusd: use fixed-width types for sequence counters
Lech Perczak [Sat, 23 May 2026 00:29:10 +0000 (02:29 +0200)]
ath79: meraki-mr18: fix MAC address offset after NVMEM switch
The following commit: 27a673916c35 ("ath79: mr18: use nvmem for MACs")
switched MR18 to use NVMEM subsystem for setting MAC addresses, however
it missed the offset in use. Previously 102 (decimal) was used, but in
device tree 0x102 was used, but the correct value is 0x66.
This was found while reviewing code for Z1 port, which shares the MAC
address source.
Replace the offset with the correct one of 0x66.
Fixes: 27a673916c35 ("ath79: mr18: use nvmem for MACs") Signed-off-by: Lech Perczak <lech.perczak@gmail.com> Link: https://github.com/openwrt/openwrt/pull/23486 Signed-off-by: Robert Marko <robimarko@gmail.com>
Jan-Henrik Bruhn [Thu, 21 May 2026 12:05:59 +0000 (14:05 +0200)]
kernel: hwmon lm63: make pwm1 frequency and LUT temp hysteresis writeable
This adds a patch that makes the pwm1 frequency and LUT temperature
hysteresis of lm63 fan controllers writeable, to be able to replicate
vendor cooling behaviour for fans that need a lower PWM frequency
than the default.
x86: onie-installer: wire up sysupgrade via ONIE install mode
This adds support for sysupgrade on ONIE-installed systems.
The install is chained through ONIE (using the ONIE installer image),
rather than attempting to manually upgrade the partition.
The idea is to allow future OpenWRT installs flexibility to use
a different partition table. By putting the installer in charge
of setting up the file system partition, the upgrade process needs
to have no knowledge of the internals of the image.
Config preservation is accomplished by appending the sysupgrade .tar.gz
to the ONIE installer image. Of course this also works for a clean
install using a sysupgrade.tar.gz created via `sysupgrade -b`.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Keno Fischer <keno@juliahub.com> Link: https://github.com/openwrt/openwrt/pull/23062 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The current documentation for using OpenWRT on Mellanox Spectrum
switches (https://openwrt.org/toh/mellanox/spectrum) suggests
reflashing the entire harddrive from the recovery USB. This is not
the most friendly way to install a new OS on these switches. From
factory, they come with ONIE (Open Network Install Environment),
which is a linux-based preboot environment for fetching an OS
image from the network and installing it on disk. The installer
is a self-executing bash script that executes inside the ONIE
environment. The installer is expected to preserve the ONIE partition
for use as recovery environement. To be a better citizen on
these platforms, it would be preferrable to provide OpenWRT as
an ONIE-compatible installer.
This PR adds an ONIE_INSTALLER_IMAGES build option that produces
an ONIE compatible .bin. The generated .bin follows the ONIE demo
installer pattern [1]: it creates a new GPT partition
labelled OPENWRT-ROOT on the ONIE install device, formats ext4, extracts
the OpenWrt rootfs and kernel into it, installs GRUB into the existing
UEFI ESP under bootloader-id "OpenWrt", and adds a NVRAM boot entry via
efibootmgr. ONIE-BOOT is preserved so ONIE rescue remains available.
Tested with the config at [2] on a Mellanox Spectrum SN3800 to produce
a booting OpenWRT install.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Keno Fischer <keno@juliahub.com> Link: https://github.com/openwrt/openwrt/pull/23062 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Jonas Jelonek [Fri, 22 May 2026 20:14:20 +0000 (20:14 +0000)]
realtek: pcs: derive SerDes link count from DT at probe time
Previously, sds->num_of_links was incremented from rtpcs_create() as
each DSA port bound its phylink_pcs. The count therefore relied on a
temporal contract (DSA must finish enumerating before pcs_config runs)
and on rtpcs_create() being the single chokepoint for all consumers.
Replace this with a probe-time scan of pcs-handle references in the
live OF tree: for every available consumer node carrying a pcs-handle
property pointing at one of our SerDes subnodes, bump that SerDes'
num_of_links. After the scan, the count is final regardless of when
or whether DSA later calls in.
To allow of_parse_phandle_with_args() to walk the property correctly,
add #pcs-cells = <0> to every serdes@N node in the 838x/839x/930x/931x
.dtsi files. A future cell-bearing form remains possible without
touching the scan.
Over-references (DT pointing more consumers at one SerDes than the
hardware can carry) are clamped at RTPCS_MAX_LINKS_PER_SDS and warned
about, but do not fail probe — the correctly-wired ports on that
SerDes still come up, and only the surplus reference is dropped.
The bounds check and the bare ++ in rtpcs_create() become redundant
under the scan-driven count and are removed.
This decouples num_of_links from DSA call ordering and is a prereq
for migrating to fwnode_pcs providers, where rtpcs_create() goes away
as the centralised counter.
Felix Fietkau [Sat, 16 May 2026 16:23:07 +0000 (16:23 +0000)]
build: fix apk_package_files wildcard for packages without ABI version
The wildcard combined an apk_package_files pattern of $(pkg)-*.apk with a
gen_package_wildcard that ends in [^a-z]*, so the full glob required two
dashes. Files for packages without an ABI version (e.g. ubbf-0~....apk)
only contain one dash and never matched, so ipkg-remove was never called
on them and stale .apk files accumulated in the bin directory.
Drop the explicit dash from apk_package_files. The [^a-z] in
gen_package_wildcard already serves as the dash matcher, and
scripts/ipkg-remove filters precisely by reading apk metadata.
Fixes: 642d568b0f0a ("build: fix ipkg-remove: add support for removing apk files") Signed-off-by: Felix Fietkau <nbd@nbd.name>
John Crispin [Tue, 14 Apr 2026 11:30:41 +0000 (13:30 +0200)]
wifi-scripts: iwinfo scan() must not abort the interpreter on failure
Replace exit(1) on every failure path with return null so callers that
iterate over multiple radios can collect results from the radios that
did succeed instead of aborting on the first one that refuses an
off-channel scan.
Route diagnostics to stderr via warn() so stdout stays clean for
callers parsing JSON output, and include the device name in each
message to disambiguate per-radio failures.
Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
Robert Marko [Wed, 20 May 2026 14:42:28 +0000 (16:42 +0200)]
fstools: update to Git HEAD (2026-03-17)
1bf2d490484e libfstools: make get_var_from_file() reusable 0b6022439cad mount_root: add kernel parameter to specify the overlay storage name e600d842ce81 mount_root: add kernel parameter to specify the overlay fileystem type
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Eric Fahlgren [Wed, 20 May 2026 15:15:53 +0000 (08:15 -0700)]
imagebuilder: suppress rootfs image when filesystem specified
When using imagebuilder to create images, ROOTFS_FILESYSTEM may be
defined to create just the desired images, but the '*-rootfs.tar.gz'
and '*-rootfs.cpio.gz' images are being created unconditionally
for many targets.
By making generation of these images conditional on the state of
ROOTFS_FILESYSTEM, we can save significant space (measured 3-7 MB
depending on length of package list) and time.
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Balázs Triszka [Wed, 1 Apr 2026 13:32:17 +0000 (15:32 +0200)]
generic: net: phy: realtek: add 5G and 10G PHY support
The functionality/support for 5G and 10G PHYs was extracted from the
realtek-phy driver and ported to the upstream Linux realtek PHY driver.
These PHY chips need a sequence of register writes (and similar operations)
for initialization. These sequences are provided as firmware files which
are interpreted/applied by a new register patch engine.
By switching to the upstream driver, it should be possible to get rid of a
large chunk of (from OpenWrt perspective) unmaintained code from Realtek.
The actual Linux phy-core infrastructure from Linux can be mostly used and
only the Realtek specific quirks need to be handled.
The files which need to be provided are depending on the PHY:
Files which are affected by this change (DEVICE_PACKAGES dependencies,
hwmon paths, default kernel configurations, refresh of patches, ...) are
updated at the same times.
Signed-off-by: Balázs Triszka <info@balika011.hu> Co-authored-by: Semih Baskan <strst.gs@gmail.com> Co-authored-by: Jonas Jelonek <jelonek.jonas@gmail.com> Co-authored-by: Gilly1970 <gilroyscott@hotmail.com> Co-authored-by: Aleksander Jan Bajkowski <olek2@wp.pl> Co-authored-by: Carlo Szelinsky <github@szelinsky.de>
[sven: rebase, integrate suggestions from PR, add device packages, split] Signed-off-by: Sven Eckelmann <sven@narfation.org>
[daniel: stripped to Linux 6.18 only, dropped unrelated changes] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
These PHY chips need a sequence of register writes for initialization.
These are provided as firmware files which are interpreted/applied by a
new register patch engine.
For the moment, the patch instructions in rtl8261-firmware and
rtl8264b-firmware are the same as from the rtl8261n driver. This should
make it possible to first evaluate the patch engine and driver development
for switching over in adjusting the patch instructions.
Signed-off-by: Balázs Triszka <info@balika011.hu>
[sven: rebase, split, fix package version/release, use conf from rtl8261n
driver] Signed-off-by: Sven Eckelmann <sven@narfation.org>
[daniel: define VERSION matching source date for the resulting packages] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Paul Spooren [Mon, 18 May 2026 17:55:26 +0000 (19:55 +0200)]
scripts: add --user-network to qemustart
qemustart is a handy script to quickly test OpenWrt firmware using
qemu. Bringing up networking currently requires a bridge-helper
setup with privileged IP and bridge assignment. To simplify
testing scenarios like the package manager, which need both shell
access and outbound internet, add a user-mode networking option
backed by SLIRP that requires no privileges.
To stay backward compatible, the defaults don't change. The new
flag --user-network attaches two NICs (LAN + WAN) and forwards
three host ports to the guest LAN interface (192.168.1.1):
2222 -> 22 (ssh), 8080 -> 80 (http) and 8443 -> 443 (https). The
host-side ports can be overridden with --ssh-port, --http-port
and --https-port.
Paul Spooren [Mon, 18 May 2026 17:53:49 +0000 (19:53 +0200)]
scripts: fix lan/wan order of malta in qemustart
OpenWrt's 99-default_network assigns eth0 to lan and eth1 to wan
when no target-specific 02_network is present, which is the case
for malta. The qemustart bridge block however placed the wan
-device before the lan -device, so the guest's eth0 (lan) ended
up attached to $BR_WAN and eth1 (wan) to $BR_LAN.
Swap the order to match the guest's actual role assignment.
Right now the driver uses variable names netdev/ndev/dev to access
a net_device structure. Align this with most of the other upstream
drivers and convert everything to dev.
In the network context there might be confusion between "struct netdev"
and "struct device". The driver should avoid variables of type device
and name "dev" where possible. Remove all variables that point to the
device and use pdev->dev instead. This is like other network drivers
do it.
While we are here modernize logging during probing. Remove messages
from helpers and log errors during probing with dev_err_probe().
The function init_mac() can produce errors for the RTL931x devices.
When this happens it throws a message but continues. That can
leave the hardware in a wrong state.
Cleanup the error handling. Remove all messages from the function
and simply return an error value. In the probe() consumer evaluate
this error and abort probing if needed. As there were no reported
issues in the past it is ok to drop the detailed messages and
aggregate them in a single one.
Upstream netdev does not like big guards. Especially
around debugging functions. Convert to scoped_guard()
and only lock the really needed code parts. This way
all debugging can run outside of the lock.
projects / thirdparty / openwrt.git / log
