Kernel 6.19 will get rid of of_node_to_fwnode(). Switch to its
successor of_fwnode_handle() that is already available in 6.18.
This will simplify a future kernel upgrade.
generic: update pending PCS patch with .fill_available_pcs OP
While implementing standalone PCS support for DSA, it was found that making
the MAC driver passing the available_pcs array is limiting and problematic
for memory handling and allocation. To better handle this, change the logic
and make phylink allocate the struct and make the MAC driver implement a
function in phylink_config .fill_available_pcs to fill the PCS array.
Update the Airoha and Mediatek driver to reflect this new implementation.
Paul Spooren [Mon, 18 May 2026 11:32:39 +0000 (13:32 +0200)]
imagebuilder: allow to specify filesystem
The ImageBuilder creates by default all filesystems enabled during it's own
build, which are typically squashfs and sometimes ext4.
This commit allows to set ROOTFS_FILESYSTEM to specify which specific
filesystem should be build (instead of all).
Motivation is to reduce the load on sysupgrade servers but also fix corner
cases where a squashfs filesystem results in a working image while the ext4
image fails, resulting in a ImageBuilder failure.
qualcommax: ipq50xx: add support for Xiaomi Redmi AX5400
Add support for Xiaomi AX5400 (RA74).
Specifications:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Etrontech EM6HE16EWAKG 512 MiB DDR3L-933
* Serial Port: 1v8 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax - up to 574 Mbps)
QCN9024 (4x4 5 Ghz 802.11an/ac/ax - up to 4804 Mbps)
* Ethernet: IPQ5018 integrated virtual switch connected to an
external QCA8337 switch (3 LAN Ports 10/100/1000)
* Flash: Gigadevice GD5F1GQ5REYIG (128 MiB)
* LEDs: 1x System Blue (GPIO 24 Active High)
1x System Yellow (GPIO 25 Active High)
1x WAN Link Blue (GPIO 26 Active High)
1x WAN Link Yellow (GPIO 27 Active High)
* Buttons: 1x Reset (GPIO 38 Active Low)
1x WPS (GPIO 28 Active Low)
* MAC address layout: LAN (eth1): 0:art @ offset 0x0
WAN (eth0): 0:art @ offset 0x6
Flash instructions: (use redmi-ax5400 image for the Redmi AX5400)
First flash a ubinized OpenWrt initramfs that will serve as the intermediate step, since
OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for
packages, through either of the below two methods:
Installation via XMIR Patcher:
1. Load the initramfs image: openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi
Installation via ubiformat method, through SSH:
1. If needed, enable SSH using XMIR Patcher.
2. Copy the file openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi to the /tmp directory
3. Open an SSH shell to the router
4. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs
5. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd18 and mtd19 are the correct indexes from above!
6. Use the command ubiformat to flash the opposite mtd with UBI image:
If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit
otherwise:
ubiformat /dev/mtd18 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit
7. Reboot the device by:
reboot
Continue in order to pernamently flash OpenWrt:
1. Upload the sysupgrade image to /tmp/ using SCP:
scp -O <path to image> root@192.168.1.1:/tmp/
2. Open an SSH shell to 192.168.1.1 from a PC within the same subnet
3. Use sysupgrade to flash the sysupgrade image:
sysupgrade -n -v /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-squashfs-sysupgrade.bin
Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.
Commit 6cc149f167 (ipq806x: mr42/mr52: use nvmem for caldata, 2026-02-25)
broke wifi on meraki mr42/52 by making caldata inaccessible.
This commit adds UBI nvmem to ipq806x target and corrects art partition address
Signed-off-by: Aleksander Wałęski <olewales@gmail.com>
Lorenzo Bianconi [Mon, 18 May 2026 10:25:41 +0000 (12:25 +0200)]
airoha: Add the capability to offload dscp field via netfilter flowtable
Introduce the capability to hw offload via netfilter flowtable APIs the
IP TOS info. Implement the sw offloading for DSCP field via the
netfilter flowtable APIs.
Ryan Leung [Sat, 16 May 2026 00:46:33 +0000 (10:46 +1000)]
button-hotplug: add KEY_SETUP and KEY_VENDOR handling
Add KEY_SETUP and KEY_VENDOR keys. Many Rockchip devices, including all of those in e13cbab6840b ("rockchip: enable SARADC; add buttons hotplug and ADC kmods to default packages")
have one or both of these buttons.
kernel: replace aes-lib with aes-generic in testmgr tests
The name “aes-lib” is used since kernel 7.0. In kernels 6.12 and 6.18,
the name “aes-generic” is used. This change makes it possible to run
comparative selftests of the generic and hardware implementations.
This will help identify any potential differences in the results.
Jonas Jelonek [Thu, 30 Apr 2026 09:13:11 +0000 (09:13 +0000)]
realtek: add support for Zyxel XGS1930-28HP
Add support for the RTL9301-based Zyxel XGS1930-28HP, a 28-port Gigabit
PoE+ switch. The XGS1930 is an EOL Zyxel series of RTL9301-based
switches available with 28 or 52 ports, with and without PoE.
Hardware
========
- RTL9301 SoC
- 512 MiB DDR3 RAM
- 32 MiB SPI-NOR flash
- 24x 10/100/1000M RJ45 ports
- 4x 1G/10G SFP+ cages
- PoE:
- 802.3af/at on all 24 RJ45 ports
- 375 W total power budget
- RTL8231 for port LEDs
- Front LEDs: PWR, SYS, CLOUD, LOCATOR, PoE usage bar (5 steps)
- Buttons: 1x "Restore"
- Console: TTL 3.3V, 115200 8N1, 4-pin header
- pinout (front to back): GND RX TX -
- Software chain:
- Bootbase/stripped-down U-Boot
- RAS/ZyNOS
MAC address
===========
Single MAC address derived from the board partition. Applied to all
switch ports.
Disclaimer
==========
PoE is not yet supported.
Flashing OpenWrt overwrites ZyNOS. The Bootbase/U-Boot remains intact
and can be used for recovery.
Installation
============
Simple web upgrade:
1. Take the OpenWrt factory.bin image generated by the build.
2. In the ZyNOS web UI, login and go to Maintenance -> Firmware Upgrade.
3. If the device runs ZyNOS 5.00, untick "Enhanced firmware integrity
check sha256sum". Otherwise the upload check will reject the image.
4. Select and upload the factory.bin image and click upgrade.
5. After flashing has finished, reboot the switch. It will now boot
into OpenWrt.
Initramfs boot
==============
Luckily the switch uses a standard design, thus networking works with
a default hardware profile of RTK U-boot.
1. Connect to the serial console and interrupt the boot process by
spamming '$' during the DRAM test to drop into Bootbase/U-Boot.
2. Bring up the network:
> rtk network on
Use a copper port; the SFP+ cages are likely not usable from the
bootloader.
3. Load the initramfs image via TFTP:
> tftpboot 0x82000000 <server>:<image>
4. Run the image (not bootm, the image has no uImage header):
> go 0x82000000
Return to stock firmware
========================
1. Download the stock firmware for the switch from the Zyxel website
and unzip it; there should be a .bin file with an alphanumeric name.
2. Upload that file to the running OpenWrt instance.
3. Flash it (use -F since the image has no OpenWrt metadata):
> sysupgrade -F <stock-firmware>.bin
4. Wait for sysupgrade to finish and the switch to reboot. ZyNOS should
come up again.
Not yet enabled:
----------------
* Fan control: it's controlled via simple i2c registers, but no driver
has been written yet.
Installation:
-------------
This device uses an obfuscated bootloader and an obfuscated image. As such,
the installation can only be performed using the console ports.
1. Set the switch to boot from the first image.
2. Attach console cable and hold Ctrl+C while powering on the switch
3. After a few seconds, a very basic U-Boot menu appears. Wait for the user
input to appear, then press "z" to get to the message "Please input auth
code".
4. Type "jiangks" as the password, the RTL9300 prompt appears.
In rtpcs_probe_serdes_bus(), the code manages the device
tree node reference incorrectly:
- It acquires a node pointer np via of_find_compatible_node(),
which increments the reference count.
- It calls of_mdio_find_bus(np) to locate the bus.
- It calls of_node_put(np), which decrements the reference
count. If this was the last reference, the node is freed.
- It then attempts to check if (!of_device_is_available(np)).
The pointer np is used after its reference has been released.
This can lead to a kernel oops or unpredictable behavior if
the memory has been reclaimed.
Fixes: fe27cce1e ("realtek: add SerDes PCS driver") Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://github.com/openwrt/openwrt/pull/23391 Signed-off-by: Robert Marko <robimarko@gmail.com>
realtek: eth: create phylink before device registration
As soon as devm_register_netdev returns, the network
interface is "live" and the kernel can call rteth_open().
If the interface is brought up immediately (e.g., by a
userspace script), rteth_open will attempt to call
phylink_start(ctrl->phylink), which will crash the
system because ctrl->phylink has not been assigned yet.
packet->dma is overwritten with a new mapping before
the previous buffer is unmapped. This causes the kernel
to unmap the wrong memory address, leading to memory
leaks and potential corruption.
Additionally set skb pointer to NULL to avoid a free
when the buffer is recycled next time.
Reorder unmapping/mapping sequence.
Fixes: 41300fd88 ("refactor transmit function") Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://github.com/openwrt/openwrt/pull/23375 Signed-off-by: Robert Marko <robimarko@gmail.com>
The mdio driver currently leaves the phy polling disabled after
setup. The dsa driver takes over and mangles the polling registers
so that they fit its needs. While polling is something in between
mdio (PHY) and dsa (MAC) it should be controlled by the mdio
driver.
Add a final "polling enable" function to the mdio driver so that
the MAC registers are filled automatically. For this
- split valid_ports into phy_ports (attached to PHY) and sds_ports
(attached to SerDes)
- Improve the probing so it can differentiate between a phy and a
sds port. This is resolved by the "phy-handle" attribute.
- Split the for_each_port macro into a phy and sds version.
- After probing enable polling for all phy and sds ports.
With this in place the dsa driver can remove the polling setup
completely.
Currently, there is no SBOM generation in imagebuilder when the package
system 'apk' is used. This commit adds this feature back. This already
worked for the package system 'opkg'.
Furthermore, generating the SBOM using perl is not reproducible if the
input data has not changed. A different file is always generated. This is
not the case with Python. For this reason, Python is now used to generate
the SBOM for the imagebuilder.
The script has already been prepared so that it can also process the opkg
package system for generating the SBOM.
airoha: backport upstream fix for Airoha reported bug for ethernet
Airoha reported some additional bug and fixes were pushed for the ethernet
driver. Backport the additional patch merged upstream and refresh all
affected patch.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Shiji Yang [Thu, 19 Mar 2026 11:26:00 +0000 (19:26 +0800)]
ath79: tiny: set default BLOCKSIZE to 4 KB
The NOR Flash mtd erase block size is 4 KB on ath79 tiny sub-target.
Squashfs-split driver always check and create the jffs2 rootfs_data
partition on the first free block. However, sysupgrade script append
the config backup to the end of the sysupgrade image. If we pad the
image to the 64 KB boundary, the kernel will be unable to find a
valid jffs2 partition and then recreate the rootfs_data partition.
Users may lose their config during upgrades. Fix this issue by setting
BLOCKSIZE to 4 KB so that the sysupgrade image can be aligned to the
4 KB boundary.
Fixes: https://github.com/openwrt/openwrt/issues/20495 Fixes: 05d35403b211 ("ath79-tiny: enable 4k sectors") Signed-off-by: Shiji Yang <yangshiji66@outlook.com> Link: https://github.com/openwrt/openwrt/pull/22497 Signed-off-by: Robert Marko <robimarko@gmail.com>
Hauke Mehrtens [Fri, 15 May 2026 01:00:14 +0000 (03:00 +0200)]
uhttpd: update to Git HEAD (2026-05-15)
d2551871b5e5 client: prevent transfer_chunked counter overflow 07f0afb3bf91 client: match Host and URL attributes exactly in tls_redirect_check 05406f70d05c file: scan all entries when matching If-Match / If-None-Match 81527e1f7630 proc: restore default SIGPIPE disposition in spawned child 0df62571f158 ucode: initialize module search path only once 05317bf30a94 proc: store CGI Status message per-client instead of in a shared buffer 1781b6dec414 utils, client: cast char to unsigned before passing to ctype functions 4221eb8b33ea file: respond 500 on uh_handle_alias OOM 8e5b26f93798 file: distinguish parse failure from epoch in date precondition checks ced7b15c3467 utils: fix one-byte overflow in uh_urldecode 53e7150619a3 file: bail out of file_write_cb on read error 93432149a7ae utils: remove unreachable return statement in uh_addr_rfc1918 add5389470f0 utils: fix off-by-one out-of-bounds read in uh_b64decode 778ccbbf5f8a main: fix daemonization stdio redirection and fd leak 2c869c094c25 client: parse Content-Length safely 9404e6c62bb7 client: parse chunked transfer chunk size safely b33ca5d37718 auth: do not accept stored crypt hash as plaintext password 6fadf0da5050 auth: replace strcmp with constant-time password comparison
generic: permit support of standalone PCS for external kernel module
The current code permits support of the standalone PCS feature only for
in-tree kernel module but doesn't correctly support PCS from external
kernel module.
This is caused by the fact that the FWNODE_PCS config flag is internally
selected by any PCS driver and can't be selected directly. This is
problematic for any external kernel module that wants to use the standalone
PCS feature and needs the OPs provided by the generic PCS code.
Moreover compiling the standalone PCS code as a module is problematic and
would cause link error caused by the late PCS code that introduce a
notifier where phylink code depends on.
To address both problem, permit to select the FWNODE_PCS and change it to a
simple bool preventing it to compile as a module.
Daniel Pawlik [Fri, 15 May 2026 08:30:26 +0000 (10:30 +0200)]
airoha: use in-band phylink for RTL8261N USXGMII ports in W1700k
After the standalone Airoha PCS driver and pcs-handle binding, wan (gdm2)
and lan2 (gdm4) netdevs probe but do not pass traffic.
Similar to the Aeonsemi PHY it seems also the RTL PHY needs in-band to the
PCS for USXGMII to work correctly. This still needs to be better
investigated but in the meantime lets apply this workaround to restore
traffic.
Signed-off-by: Daniel Pawlik <pawlik.dan@gmail.com>
[ improve commit description ] Link: https://github.com/openwrt/openwrt/pull/23383 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
David Han [Tue, 28 Apr 2026 17:06:51 +0000 (02:06 +0900)]
mediatek: filogic: add support for netis MEX605
This commit adds support for the netis MEX605, which is a variant based on the netis NX30 V2.
1. Update brand naming from Netis to netis to follow the official branding.
2. Rename NX30V2 to NX30 V2 to correctly reflect it as the second version of the NX30.
3. Update variant notation for consistency.
cherry picked from commit c982357
1. Add 'model' to the DTS for netis NX30 V2 and define WiFi LED.
4. Fix typo.
Signed-off-by: Zhiwei Cao <bfdeh@126.com> Signed-off-by: David Han <h96643864@gmail.com> Link: https://github.com/openwrt/openwrt/pull/22726 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
econet: add EN751627 subtarget and Zyxel EX3301-T0 board
The EN751627 EcoNet subtarget consists of the EN7516 DSL SoC and the
(rare) EN7527 xPON SoC.
We currently support pci / wifi, usb and flash, but the EN751221 eth
driver is not portable to this family right now.
Zyxel EX3301-T0 is a wifi router based on the EN7516, it is a DSL SoC
but lacks the DSL port.
Installation instructions:
1. Serial access is required, stop the Zyxel bootloader.
2. Use ATENv3 https://github.com/cjdelisle/ATENv3 to unlock bootloader
3. "ATLD x" on the prompt to start a TFTP server
4. Connect ethernet cable from any lan (yellow) port on modem to a
device.
5. On your device, configure network to 192.168.1.2/30
6. On your device, send TRX file to 192.168.1.1 with name x, i.e.
tftp -p -l ./econet/tclinux -r x 192.168.1.1
7. On modem, you should see a line like this:
"Total 8022324 (0x7A6934) bytes received" note the hex value
8. "ATGU" to enter econet bootloader
9. "flash 80000 80020000 <the hex number without 0x>"
For example: flash 80000 80020000 7A6934
10. "reboot 1" -- start the system
If it boots back into the factory OS, you need to switch OS, from the
ZHAL prompt:
1. "ATCB" -- load data from flash
2. "ATCF 0" -- switch to OS 0
3. "ATBT 1" -- enable flash write
4. "ATSB" -- save data
5. "ATSR 1" -- reboot system
x86/base-files + kernel/modules: improve Dell Edge620/640/680 support
This improves on openwrt/openwrt@aeb9028aabf6bf90638a822d563f54a2c4146e6d by adding support for
other Dell EMC Edge620/640/680 devices and mapping
the interfaces to match the markings on the device.
This modifies the netdevices.mk file to set the boot flag for
ixgbe driver to load it in early stage of the boot process to
allow for proper mapping of the network interface PCI paths
inside the 02_network script. This will also allow other devices
using the ixgbe driver to do proper mapping in 02_network script.
The 02_network script is then modified to support all
dell-emc-620/640/680 devices. It now maps the network
interfaces via PCI paths to match the markings on the device.
The interface marked GE6 is still used for WAN with
interfaces GE1-GE5 used for LAN.
The SFP1 and SFP2 interfaces are left to be assigned by
the user.
!!! BACKUP YOUR ROM !!!
=======================
Please always have your FULL flash image backup before flashing
anything. The vendor firmware varies a lot depending on your ISP and
location. You will have a hard time finding the right regional firmware
if you don't have a backup.
Notes
=====
* Due to the target `econet` being incomplete, WiFi, DSA switch, and
many other features are not supported yet. Do not flash the image unless
you know the consquences or `econet` is declared stable.
* This device, and apparently many other devices of this platform, use
a dual-image layout. OpenWRT (with `econet` target) only uses slot A.
Slot B is not used by OpenWRT, and is applicable for dual-booting to
vendor firmware.
* If you do not use vendor firmware anymore, you can erase and reuse
anything after `configuration_b`, which gives you ~110 MiB free space.
Again, backup your flash first.
Installation
============
Within shell
------------
Note that acquiring the shell access to the vendor firmware can be a bit
tricky depending on the firmware variation. If you can't play with the
vendor firmware, boot to OpenWrt using debricking method below.
0. (Optional) Back up your flash, and / or move the vendor firmware to
slot B
1. Build and then locate the `kernel.bin` and `rootfs.bin` image files
2. Upload `kernel.bin` and `rootfs.bin` to the device (via HTTP or USB
stick), then type:
```
mtd write -f -e KernelA kernel.bin KernelA
mtd erase RootfsA
mtd write -f -r -e AppA rootfs.bin AppA
```
From bootloader
---------------
1. Build and then locate the `kernel.bin` and `rootfs.bin` image files
2. Switch device on and press a key within 3 seconds
3. Upload `kernel.bin` via TFTP as described below
4. Once the transfer has completed successfully, bootloader will give
you the file length in "Total %d (0x%X) bytes received", then type
`flash 200000 80020000 <file length hex>`
5. Upload `rootfs.bin` then flash with
`flash 600000 80020000 <file length hex>`
6. Restart the device to boot into OpenWRT
> [!IMPORTANT]
> Do not try `httpd` in the bootloader. It writes to the wrong address
and will corrupt the flash.
Debricking
==========
1. Build and then locate the `initramfs-kernel.bin` image files
2. Switch device on and press a key within 3 seconds
3. Connect to device via ethernet, set the IP address to `192.168.1.X`,
then upload the image via TFTP
`tftp 192.168.1.1 -m binary -v -c put initramfs-kernel.bin`
The file name can be anything except `tcboot.bin` or `tclinux.bin`,
they will corrupt the flash.
4. Type `jump 80020000` to boot the kernel from memory
Dual boot
=========
Use `en75_chboot` tool to switch between vendor firmware and OpenWrt. If
you are soft-locked, you can also switch the flag in the bootloader:
1. Switch device on and press a key within 3 seconds
2. Select the kernel that you wish to use:
- `memwl 8002000030ffffff` for `KernelA` (OpenWrt)
- `memwl 8002000031ffffff` for `KernelB` (Factory)
3. Select the rootfs, which should be the same as the kernel:
- `memwl 8002000430ffffff` for `RootfsA` (OpenWrt)
- `memwl 8002000431ffffff` for `RootfsB` (Factory)
3. Commit the data to flash: `flash 1e0000 80020000 8`
4. Restart the device to boot into the selected OS
MAC addresses
=============
`//configuration_a/factory.conf` contains MAC addresses, along with
other pre-configured settings. OpenWrt uses `brmac`, `internetmac`,
`APMAC`, and `APMAC_5G`, while `tr069mac`, `voipmac`, `priprotocolmac`,
and `PONMac` are not used for now.
econet: add PCIe driver for EN751221 and enable wifi
Extend the EN7528 PCIe driver to EN751221 with a specific PHY
tuning ritual. Also enable wifi drivers on SmartFiber XP8421-B,
TpLink Archer VR1200V v2 and Zyxel PMG5617GA.
Daniel Pawlik [Wed, 1 Apr 2026 11:20:03 +0000 (13:20 +0200)]
airoha: w1700k: drop RTL8261N phy interrupt
The AN7531N SoC has currently problems communicating using `phy_mmd_...`
when irqbalance is active. But when there is a communication error in the
interrupt handler, the interrupt will be disabled. This can usually be seen
in the logs as:
This is not a problem with the rtl8261n driver because it is not
registering an interrupt handler. But with the kernel realtek PHY driver, a
interrupt handler is registered which can trigger this problem on bootup.
To avoid is, disable the interrupt and use the PHY polling mode also wit
the upcoming realtek PHY driver support for RTL8261.
Co-authored-by: Aleksander Jan Bajkowski <olek2@wp.pl> Co-authored-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Daniel Pawlik <pawlik.dan@gmail.com> Link: https://github.com/openwrt/openwrt/pull/23078 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Some W1700K and XR1701G boards with Realtek RTL8261N/RTL8261BE 10G PHYs
fail to bring up the USXGMII link on cold boot. The PHY enters a bad
state during initialization and the link stays down permanently until
power cycle.
Root cause: the GPIO reset assert/deassert timing (40ms/150ms) is too
short for the RTL8261N to complete its internal firmware load. The OEM
firmware uses 200ms/200ms.
Increase both PHY reset timings to 200ms/200ms to match OEM values.
Confirmed to fix intermittent boot failures on both W1700K (Gemtek)
and XR1701G boards.
Qingfang Deng [Mon, 11 May 2026 02:50:06 +0000 (10:50 +0800)]
ntfs: update to 2026-05-03
Update to the latest version.
Changes:
- fix NULL dereference in ntfs_index_walk_down()
- fix WSL symlink target leak on reparse failure
- conditionally enable POSIX ACL
- fix error handling in ntfs_write_iomap_end_resident()
- fix VCN overflow in ntfs_mapping_pairs_decompress()
- drop nlink once for WIN32/DOS aliases
- fix invalid PTR_ERR() usage in __ntfs_bitmap_set_bits_in_run()
- Use return instead of goto in ntfs_mapping_pairs_decompress()
The RTL8365MB_DIGITAL_INTERFACE_SELECT_MODE_MASK macro was shifting
the 4-bit mask (0xF) by only (_extint % 2) bits instead of
(_extint % 2) * 4. This caused the mask to overlap with the adjacent
nibble when configuring odd-numbered external interfaces, selecting
the wrong bits entirely.
Align the shift calculation with the existing ...MODE_OFFSET macro.
Ryan Leung [Sat, 9 May 2026 00:42:59 +0000 (10:42 +1000)]
rockchip: add support for FriendlyELEC NanoPi M5
Ethernet LAN port is set to `eth1` (silkscreen "ETH2" and case label "2") next to the 2x USB Type-A
ports and WAN is set to `eth0` (silkscreen "ETH1" and case label "1") next to the USB Type-C port.
The USER ("reset") button serves as the reset button. A short press will reboot and a long press
will reset to factory settings (deleting all data) if using squashfs image.
MASK ("maskrom") and RCRY ("recovery") buttons are enabled but are not set to any specific function
Pressing the POWER button will `poweroff` the device and it will stay off until a power cycle.
Hardware
---------------
* SoC: RockChip RK3576 64-bit ARMv8-A 8 cores big.LITTLE (4x A72 and 4x A53)
* RAM: 3/4GB LPDDR4X or 8/16GB LPDDR5
* Ethernet: 2x GbE (SoC RGMII MAC, RTL8211F PHY)
* 3x LEDs (SYS - red / 1 (WAN) - green / 2 (LAN) - green)
* 4x Buttons (MASK ("maskrom"), RCRY ("recovery"), USER ("reset" - OpenWrt reset), POWER)
* 1x 16MiB SPI NOR on board
* 1x UFS slot for optional UFS 2.0 module (currently not supported)
* 1x microSD card slot (UHS-I)
* 1x HDMI OUT
* 1x Headphone OUT 3.5mm
* 1x M.2 M-key 2280 PCIe slot (PCIe 2.1 x1 supports NVMe SSD)
* 1x M.2 E-key *SDIO* slot for optional RTL8822CS Wi-Fi 5
* the case has integrated antennae as well as 2x knockouts
* the device tree is missing the nodes relevant to Wi-Fi operations so it's not supported for now.
* 2x USB 3.2 Gen 1 Type-A Ports
* Power: 1x USB Type-C 6V-20V with both DC and USB PD supported
* Serial: 1500000 8N1 3.3V - 2.54mm 3-pin header next to HDMI
MAC addresses
---------------
WAN (`eth0` case label "1"): generated from /sys/.../mmcblk0/cid (CID of SD card)
LAN (`eth1` case label "2"): WAN + 1
Installation
---------------
Decompress the archive of the OpenWrt sysupgrade image and write it to a microSD card using `dd`
or use Balena Etcher (no need to decompress).
Boot
---------------
Insert microSD card, set boot switch to "UFS/SD" and then supply power.
Ryan Leung [Sat, 9 May 2026 00:42:50 +0000 (10:42 +1000)]
uboot-rockchip: fix boot from SD card for rk3576
Apply pending U-Boot patches so that Rockchip RK3576 devices can boot from SD card. The problem:
"The BootROM on RK3576 has an issue loading boot images from an SD-card. This issue can be worked
around by injecting an initial boot image before TPL…and return to BootROM to load next image, TPL"
Compilation of the initial boot image has been added to the U-Boot build recipe.
Ryan Leung [Sat, 9 May 2026 00:42:39 +0000 (10:42 +1000)]
rockchip: enable SARADC; add buttons hotplug and ADC kmods to default packages
Select `CONFIG_ROCKCHIP_SARADC=y` to enable Rockchip SAR ADC
Add ADC Ladder Buttons driver as a kernel module as well as `kmod-button-hotplug` to the list of
default packages for Rockchip targets that have buttons connected to ADC, not including some
devices (e.g. NanoPi R76S) that have ADC buttons which are not in the device tree.
This is needed to use buttons on Rockchip devices that are connected to ADC and not GPIO
kernel: modules: netdevices: rtl8365mb: add support for RTL8367SB
Add chip info entry for the Realtek RTL8367SB switch. This device has
chip ID 0x6367 and version 0x0010. It exposes two external interfaces:
port 6 supports MII, TMII, RMII, RGMII, SGMII and HSGMII, while port 7
supports MII, TMII, RMII and RGMII. Use the existing 8365MB-VC jam table
for initialization.
Flash instructions:
The stock firmware is OpenWrt-based (Chaos Calmer 15.05.1).
Flash the OpenWrt sysupgrade image via vendor Web UI at 192.168.99.1
(admin/admin), section System - Firmware Upgrade.
Recovery (requires UART access):
- UART: Connect to ttyS0 @ 57600, press 4 during boot delay (5 seconds)
- TFTP: Server 10.10.10.3, client 10.10.10.123, load image to 0x80000000
Matt Brent [Tue, 3 Feb 2026 23:54:58 +0000 (01:54 +0200)]
ramips: add support for Ruijie RG-EW1300G (V1.00)
The RG-EW1300G is a router with 1 x WAN and 3 x LAN gigabit ports.
The router runs on Ruijie OS by default.
- Specifications:
* SoC: MT7621A
* RAM: 128MB DDR3
* Flash: 16MB SPI NOR flash (GD25Q128C)
* WiFi0: Mediatek MT7615 2.4GHz 802.11b/g/n
* WiFi1: Mediatek MT7615 5GHz 802.11ac
* Ethernet: MT7530, 4x 1000Base-T.
* UART: Serial console - As marked on PCB, baudrate is 57600. DO NOT CONNECT 3.3V.
* Buttons: Reset, WPS.
* LED: Programmable LEDs via GPIO working for Red+Green status, and Mesh/WPS at the rear of the chassis.
- Default Flash:
```
GD25Q128C(c8 40180000) (16384 Kbytes)
mtd .name = raspi, .size = 0x01000000 (16M) .erasesize = 0x00010000 (64K) .numeraseregions = 0
6 cmdlinepart partitions found on MTD device raspi
Creating 6 MTD partitions on "raspi":
0x000000000000-0x000000050000 : "u-boot"
0x000000050000-0x000000060000 : "u-boot-env"
0x000000060000-0x000000070000 : "Factory"
0x000000070000-0x000000080000 : "product_info"
0x000000080000-0x000000090000 : "kdump"
0x000000090000-0x000001000000 : "firmware"
0x00000031a847-0x000001000000 : "rootfs"
mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
mtd: partition "rootfs_data" created automatically, ofs=0xae0000, len=0x520000
0x000000ae0000-0x000001000000 : "rootfs_data"
register mt_drv
```
1. Open the case, solder to the marked 4 pin header
2. Connect it to a USB-UART TTL (do not connect to 3.3v)
3. Open a terminal with baud 57600.
4. Power on device, and repeatedly press "2" key to catch bootloader option
5. Set IP, TFTP server IP, and image file to load (eg, openwrt-ramips-mt7621-ruijie_rg-ew1300g-v1-squashfs-sysupgrade.bin)
6. System will reboot into OpenWRT.
The nRESET pins of the RTL8224 PHYs on the PSX8/PSX10 are wired to GPIO6
(lan1-4) + GPIO10 (lan5-8) of the SoC, but this was never described in the
devicetree.
GPIO 6 is the global reset shared by (logical) PHYs 0-3 on MDIO bus0. GPIO
10 is the global reset shared by (logical) PHYs 8-11 on mdio bus0. It is
intentionally not declared as reset-gpios on any bus: the MDIO driver /
phylink only support a single reset GPIO per bus, not two (or more). And a
GPIO can only be used as reset-gpio on a single PHY. Attaching it to a
single PHY would still reset the other PHYs on the same chip as a side
effect, leaving their software state out of sync with the hardware and
likely breaking them.
The nRESET pins of the RTL8224 PHYs on the PSX28/ESX28 are wired to GPIO29
of the SoC, but this was never described in the devicetree.
GPIO 29 is the global reset shared by all PHYs across all MDIO busses. It
is intentionally not declared as reset-gpios on any bus: the MDIO driver /
phylink only support a reset GPIO per bus, not on the parent controller.
Attaching it to a single bus would still reset the PHYs on the other busses
as a side effect, leaving their software state out of sync with the
hardware and likely breaking them.
Remove the four T8 screws on the bottom of the device under the rubber feet.
Using a guitar pick or similar plastic tool, insert it on the side between
the bottom case and the side, pry up gently. The plastic bottom has 18 latches
around the perimeter (but none on the rear by the Ethernet ports).
Remember to remove the SIM tray!
Gently remove the metal RF shield on the bottom of the PCB.
The TSOP48 NAND flash (U30, Spansion S34ML01G200TFV00) is located on the bottom
side of the PCB (facing you as you remove the bottom plastic). To flash, you
will need to desolder the TSOP48. Attempts to flash in-circuit using a 360 clip
were unsuccessful.
The SOIC8 I2C EEPROM (U32, Atmel 24C64) is located on the bottom side of the PCB
under a metal RF shield. It can be flashed in circuit using a chip clip. You may
have to bend the RF shield up to fit the chip clip.
The UART header is on the top (opposite) side of the PCB. You do not need to
remove any more screws to remove the PCB. The PCB has some thermal interface
material for heat dissipation and will be slightly difficult to remove the
first time. Gently pry up on the green PCB from one of the front corners until
the thermal pads break contact with the top case. You can then lift out the
entire PCB, including the attached LTE/WiFi antennas.
Installation:
The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/z3c
The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```
* Dump your original NAND (if using nanddump, include OOB data).
* Decompress `u-boot.bin.gz` dump (contains OOB data) and overwrite the
`u-boot` portion of NAND from `0x738000-0x948000` (length `0x210000`).
* Decompress `ubi.bin.gz` dump (contains OOB data) and overwrite the `ubi`
portion of NAND from `0xc60000-0x8400000` (length `0x77a0000`).
* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x2a`). Remember to re-write the EEPROM with the
modified data.
* This can be done on Linux via the following command:
`printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`
**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.
* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.
OpenWrt Installation:
* After flashing NAND and EEPROM with external programmers. Plug in an
Ethernet cable and power up the device.
* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.
* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_z3c-initramfs-uImage.itb
```
* Once booted into the OpenWrt initramfs, created the `ART` ubivol with
the WiFi radio calibration from the mtd partition:
```
cat /dev/mtd10 > /tmp/ART.bin
ubiupdatevol /dev/ubi0_1 /tmp/ART.bin
```
* `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_z3c-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_z3c-squashfs-sysupgrade.bin"
```
* OpenWrt should now be installed on the device.
* Note: To use the LTE modem as a WWAN, you must install `modemmanager`
(you probably also want `luci-proto-modemmanager`) and then configure
the modem for your provider.
Due to OpenWrt policies these packages are not included in the
initramfs/sysupgrade image.
Hal Martin [Tue, 12 May 2026 10:41:59 +0000 (12:41 +0200)]
ipq40xx: remove unused dtsi for Meraki devices
Remove target/linux/ipq40xx/dts/qcom-ipq4029-wired-qca-common.dtsi
This file is no longer used after the ipq40xx Meraki device tree
refactoring that occurred last year when adding support for the MR30H.
Hauke Mehrtens [Tue, 12 May 2026 20:31:41 +0000 (22:31 +0200)]
toolchain: musl: backport patches with CVE fixes
This fixes:
* CVE-2026-6042: Algorithmic Complexity DoS in musl libc iconv
* CVE-2026-40200: musl libc: stack corruption in qsort with sufficiently large inputs
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi> Link: https://github.com/openwrt/openwrt/pull/23330
[Added this to main branch first] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
airoha: update PCS node in DTSI for new PCS implementation
Update the PCS node in AN7581/AN7583 .dtsi for new PCS implementation.
The #pcs-cell is now needed for the produced/consumer implementation.
Also add entry for USB and PCIe PCS for AN7581 but keep them disabled
by default. USB and PCIe PCS for AN7583 node will be added later once PHY
code will stabilize.
Migrate Airoha PCS/Ethernet pending patch to PCS standalone implementation.
This new implementation drop the hack of reading and accessing the dev from
a different device and drop the legacy pcs_create/drop implementation in
favor of fwnode one with a provider/consumer approach.
This is also to sync with the proposed series posted upstream for revision.
The new PCS patch for AN7581 implement full support for USB and PCIe PCS.
Backport phylink_replay_link() API patch from upstream kernel. This is
mostly needed for force_major_config bool in phylink struct needed for new
standalone PCS series.
While at it also rename the current 703 patch to 703-01 as it's part of the
same series merged upstream.
With Kernel 6.18 the kernel size exceeds 4MB. Without additional changes
to the partition layout or kernel size reduction, the image will not be
usable. Disable this sub-target until necessary changes or a decision
regarding its removal have been made.
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
wireguard-tools: increase watchdog idle timeout to 180s
The current 150s watchdog timeout is too aggressive, leading to
premature hostname re-resolution on alive connections.
Even with a 25s keepalive, handshakes may not occur within the 150s window.
Increasing the timeout to 180s aligns the watchdog with WireGuard's
REJECT_AFTER_TIME constant, ensuring we only re-resolve when the connection
is truly considered dead.
Chukun Pan [Wed, 6 May 2026 12:30:16 +0000 (20:30 +0800)]
mediatek: fix patch to enable an8855 eFuse
Although the AN8855 eFuse driver was merged upstream, other
drivers were not. Restore Kconfig dependencies to enable it.
Also remove useless change logs from the patch.
Fixes: 2129465 ("mediatek: fix patches for Linux 6.18") Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn> Link: https://github.com/openwrt/openwrt/pull/23250 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Hauke Mehrtens [Sun, 10 May 2026 14:34:54 +0000 (16:34 +0200)]
github: separate concurrency group per event for kernel and packages
Manual workflow_dispatch and push share the same ref on main, so
they previously landed in the same concurrency group
'Build Kernel-refs/heads/main' (and the equivalent for the packages
workflow). With cancel-in-progress: false for non-PR events, only
one run can be pending per group: a newer queued run cancels the
older pending one.
That made the manual trigger unreliable in both directions. A push
landing while a dispatch was queued displaced the dispatch (so the
ccache reseed never ran), and dispatching while a push was queued
displaced the push (so the legitimate per-commit build was lost).
Adding github.event_name to the concurrency group puts pushes,
dispatches, and pull_requests in separate buckets on the same ref,
so they no longer compete with each other.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Link: https://github.com/openwrt/openwrt/pull/23283 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Hauke Mehrtens [Sun, 10 May 2026 14:27:26 +0000 (16:27 +0200)]
github: add workflow_dispatch trigger to kernel and packages
Allow the Build Kernel and Build all core packages workflows to be
launched manually from the Actions tab. The shared workflow side
detects workflow_dispatch and, for Build Kernel, rebuilds the full
target/subtarget matrix including testing kernel versions, so a
manual run can re-seed the s3 ccache when a queued push run got
displaced from the concurrency queue by the next commit on main.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> Link: https://github.com/openwrt/openwrt/pull/23283 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Russell Senior [Thu, 23 Apr 2026 05:38:51 +0000 (22:38 -0700)]
airoha: increase the size of reserved_bmt partition
The vendor firmware checks for a bmt header in the last 528 erase blocks
of flash. The OpenWrt partition table did not respect that requirement,
and therefore the vendor and openwrt chainloader fight over those blocks
on every boot, potentially corrupting data stored in UBI blocks there.
This commit increases the size of the reserved_bmt partition to avoid
that fight.
Although the vendor bootloader only seems to touch the final 250 erase
blocks[1], the original vendor firmware system partition ended at
0x1be00000[2], so to be conservative, the consensus is to use that as
the end of mtd2 (ubi) partition and leave the last 528 blocks for mtd3
(reserved_bmt).
From https://openwrt.org/toh/gemtek/mxf-w1700k:
[1] OEM bootlog: [ 5.324337] bmt pool size: 250
[2] OEM bootlog: [ 5.478927] 0x000008600000-0x00001be00000 : "system"
Adds a compat_version to warn users to re-install to accomodate the
shrunken mtd2 ubi partition.
Fixed two nits suggested by Claude, zero padding a hex value and removed
an extra space.
Removed the wildcard setting of compat_version for other boards, as
suggested by Robert Marko, set compat_version only for the w1700k.
Reported-by: Loïc Yhuel <loic.yhuel@gmail.com> Signed-off-by: Russell Senior <russell@personaltelco.net> Link: https://github.com/openwrt/openwrt/pull/23061 Signed-off-by: Robert Marko <robimarko@gmail.com>
Jonas Jelonek [Sun, 10 May 2026 18:44:30 +0000 (18:44 +0000)]
realtek: pcs: rtl930x: drop superfluous debug prints
The RTL930x calibration code is especially chatty. There are debug
prints for every start and end of a section corresponding to the
sections the SDK uses. In the end, this doesn't help a user much and
just wastes CPU cycles. Moreover it doesn't help in understand what is
done there. As a first step, drop "start" and "end" prints but preserve
their meaning as comments.
While at it, slightly adjust two other prints and drop one confusing
print.
Jonas Jelonek [Sat, 9 May 2026 21:25:51 +0000 (21:25 +0000)]
realtek: pcs: rtl930x: reduce chattiness and reg ops
There is no need to be extra chatty for simple writes which set a single
bit. As a nice side effect, without the prints there's no need to have
open-coded register access when there a helper that covers that.
Jonas Jelonek [Sat, 9 May 2026 20:31:46 +0000 (20:31 +0000)]
realtek: pcs: rtl931x: reduce chattiness
The SerDes setup code for RTL931x still has a lot of debug prints as
pr_info from former times. A lot has changed and we don't need that
rather useless chattiness anymore. We reached a state where we have a
standalone setup of most hardware modes. The registers printed are still
"documented" in rtpcs_931x_sds_config_hw_mode and
rtpcs_93xx_sds_config_cmu. For every other issues we rely on comparison
of full SerDes dumps instead of cherry-picked registers.
Flashing OpenWrt will overwrite BootExtension + ZyNOS. BootExtension
functionality is not available anymore then. The U-boot/Bootbase still
has some limited functionality which can be used in emergency cases.
Installation
============
Simple web upgrade:
1. Take the OpenWrt factory.bin image generated by the build.
2. In the ZyNOS web UI, login and go to Maintenance -> Firmware Upgrade.
3. Under "Boot Image", make sure the Config Boot Image is set to 1. In
other words, make sure the switch booted from firmware image 1 or it
will do so on next reboot.
This is crucial, otherwise OpenWrt cannot boot.
4. Below, select and upload the factory.bin image. After clicking
upgrade, the image will be flashed.
5. After flashing has finished, reboot the switch. It will now boot into
OpenWrt.
U-Boot
======
This device ships with U-boot masked as Bootbase. After the device is
powered, a DRAM test is performed. Spamming $ during that test will drop
you into a shell after test finished. You'll have a limited command set
at first.
Unlocking the shell with [1] or [2] will give you a normal U-boot
command set. From here, you can perform initramfs boot or recovery.
Initramfs boot:
> loady 0x82000000 + go 0x82000000
Recovery:
> upgradeY image2 0x82000000 115200
Return to stock firmware
========================
1. Download the firmware for the switch from Zyxel website.
2. Unzip the download, there should be a .bin file with a alphanumeric
name.
3. Upload this file to running OpenWrt.
4. Run (use -F since the image doesn't have image metadata):
> sysupgrade -F <stock-firmware>.bin
5. Wait for the sysupgrade to succeed and the switch reboot. At the next
boot, ZyNOS should come up again.
projects / thirdparty / openwrt.git / log
