Jonas Jelonek [Wed, 13 May 2026 19:58:44 +0000 (19:58 +0000)]
realtek: add support for Ubiquiti UniFi USW Aggregation
Add support for the RTL9303-based Ubiquiti UniFi USW Aggregation, an
8-port 10G SFP+ aggregation switch.
Hardware
========
- RTL9303 SoC
- 256 MiB DDR
- 16 MiB SPI-NOR flash
- 8x 1G/10G SFP+ cages
- Per-port LEDs: 1x white LED per SFP+ cage
- Buttons: 1x Reset
- Console: TTL 3.3V, 115200 8N1, internal unpopulated 4-hole THT
footprint (the device must be opened to solder a header)
- pinout (with the front panel facing you, left to right):
VCC/unused, RX, TX, GND
- Front touch display (see below)
- Software chain:
- U-Boot (Ubiquiti-flavoured)
- UniFi OS (OpenWrt-based)
MAC address
===========
Single MAC address derived from the eeprom partition. Applied to all
switch ports.
Front touch display
===================
The unit has a touch-capable front display, driven by a dedicated
STM32-based MCU connected to the host via UART. The MCU runs Ubiquiti's
LCM firmware and exposes a high-level JSON protocol (page selection,
button-press events, etc.); arbitrary pixel-level control is not
possible without replacing the MCU firmware. The display is therefore
not supported beyond what the stock LCM firmware offers.
Disclaimer
==========
Stock uses a dual-bank layout (kernel0/kernel1, 7 MiB each). OpenWrt
replaces both banks with a single contiguous firmware partition.
Flashing OpenWrt overwrites both stock kernel slots; U-Boot remains
intact and can be used for recovery.
The stock firmware blob is RSA-signed and cannot be flashed via the
UniFi web UI. Installation has to be done from a root shell on the
running UniFi OS.
Installation
============
1. Enable SSH on the stock UniFi OS and log in as root.
2. Copy the OpenWrt sysupgrade image to /tmp on the switch (e.g. via
scp).
3. Adjust IMG below to point at the copied file, then run the block as
a whole. It writes kernel0, splits into kernel1 if the image is
larger than that slot (otherwise invalidates kernel1 so U-Boot
cannot pick a stale bank), and reboots:
It does not matter which bank stock booted from when the dd block
runs: both banks are touched in the same pass (kernel0 written, kernel1
either written or invalidated). With kernel1 invalidated, U-Boot's
internal fallback kicks in and permanently switches to kernel0 on the
next boot, so the device stays on OpenWrt as long as kernel0 is
bootable.
Recovery
========
Since the installation procedure invalidates or partially overwrites
the second bank, recovery requires serial console access (see Hardware
above for pinout).
1. Interrupt U-Boot autoboot by spamming a key during early boot to
drop into the U-Boot prompt.
2. Bring up networking:
rtk network on
3. Transfer an OpenWrt initramfs image via TFTP and boot it:
4. From the running initramfs OpenWrt, re-run the installation
procedure above (the dd block, with $IMG pointing at the image on
/tmp).
Return to stock firmware
========================
There is no fully-supported revert path. The stock firmware blob is a
Ubiquiti UBNT archive (header + parts, see firmware-utils' fw.h) that
embeds a u-boot and a kernel0 uImage payload; only the latter is
relevant when writing back to the kernel partitions.
The snippet below extracts the kernel0 uImage from such a blob by
locating the uImage magic and using the size carried in the uImage
header itself, without parsing any UBNT framing. It is provided as a
best-effort starting point; verify the result before flashing,
otherwise you're on your own:
Once you have a clean uImage, write it to both kernel banks (since
the bootselect mechanism is not yet decoded, this guarantees U-Boot
picks the stock image regardless of bank):
dastarothx [Sat, 23 May 2026 16:40:20 +0000 (12:40 -0400)]
wifi-scripts: ucode: fix null dereference for 6GHz-only radios
he_phy_cap and he_mac_cap in phy_capabilities are only populated inside
the iftype_data loop. On 6GHz-only radios (e.g. QCN9074/ath11k_pci),
when capability bytes are unavailable they remain null, causing null
dereferences in device_htmode_append():
Reference error: left-hand side expression is null
if (!(he_phy_cap[3] & 0x80))
Initialise both to [] before the loop and guard the consumer side with
?? [] so bitwise checks conservatively disable beamformer/beamformee/twt
features rather than crashing.
Til Kaiser [Sat, 23 May 2026 19:26:04 +0000 (21:26 +0200)]
generic: 6.18: add missing NET_SCH_BPF symbol
Add CONFIG_NET_SCH_BPF disabled.
NET_SCH_BPF depends on DEBUG_INFO_BTF.
When CONFIG_KERNEL_DEBUG_INFO_BTF is enabled, the symbol
becomes visible and Kconfig prompts for it because it is
missing from the generic 6.18 kernel config.
Hauke Mehrtens [Thu, 21 May 2026 19:15:59 +0000 (21:15 +0200)]
github: LLM-review: run the digest twice a day
Change the schedule from once a day to twice a day (03:00 and 15:00
UTC) and raise the default max_prs from 16 to 24, so more open PRs
get covered now that the per-PR trigger has been removed.
Hauke Mehrtens [Thu, 21 May 2026 19:11:54 +0000 (21:11 +0200)]
github: LLM-review: stop reviewing new PRs automatically
Drop the pull_request_target trigger so the LLM review no longer runs
on opened/reopened PRs. We are limited to 15 Claude routine runs per
day, and the automatic per-PR trigger exhausted that budget on
several days, starving the nightly digest.
The nightly schedule and manual workflow_dispatch triggers remain.
Hauke Mehrtens [Thu, 21 May 2026 19:10:15 +0000 (21:10 +0200)]
github: drop the claude-code-review workflow
Delete .github/workflows/claude-code-review.yml. It is superseded by
the LLM review action, which runs automatically and uses the Claude
routine API instead of the much more expensive Claude API.
Hauke Mehrtens [Sat, 23 May 2026 00:09:47 +0000 (02:09 +0200)]
libubox: update to Git HEAD (2026-05-23)
19e88cc41288 json_script: use size_t for calloc_a() length argument 9afc71053481 udebug-remote: pass size_t to calloc_a() 73a21977c52a treewide: use size_t for length variables to avoid implicit narrowing 1fe93d2fefb2 blob, udebug-remote: silence -Wconversion warnings in trivial cases
Hauke Mehrtens [Sat, 23 May 2026 00:56:36 +0000 (02:56 +0200)]
ubus: update to Git HEAD (2026-05-23)
4b274055ede3 libubus: fix NULL dereference on OOM in ubus_queue_msg 8b5be570f13e libubus-acl: fix dangling pointers on blob_memdup failure in acl_recv_cb 9105ea2a349a ubusd_acl: fix NULL dereference on OOM in ubusd_acl_alloc_obj 07d7f34ac278 ubusd_acl: handle allocation failures in ubusd_acl_init_client 497321a5ea90 ubusd_acl: fix NULL dereference on OOM in ubusd_acl_init f66d52ba983f ubusd_event: fix OOM handling in ubusd_send_event_msg 11ea1b3bdbea ubusd_main: fix async-signal-unsafe SIGHUP handler 0c095592ccb7 ubusd_proto: fix resource leaks and ID tree corruption in ubusd_proto_new_client f61695e6e12a ubusd_proto: fix NULL dereference for user/group in ubusd_handle_add_watch 7ecacfadd9bc ubusd_proto: fix NULL dereference on OOM in ubusd_proto_init_retmsg 3ab9d7759545 lua: fix inverted argument check in ubus_lua_add 43051ca73aec lua: fix unchecked calloc and memory leak in ubus_lua_load_object 4ca0b141e9a7 ubusd_id: use getrandom(2) unconditionally on Linux 7e4356da8abe ubusd_monitor: fix NULL dereference on OOM in ubusd_monitor_message 5849870f2251 libubus-req: fix file descriptor leaks in ubus_process_req_msg f29767f90af1 libubus: fix file descriptor leaks in ubus_process_msg b099d050b59d libubus: make ubus_shutdown idempotent a564b8dcb395 ubusd_main: check strdup return value in mkdir_sockdir 239edcbaaac8 ubusd_id: fix continue in do-while skipping random ID retry 09d2df45bf38 ubusd: fix NULL dereference on OOM in ubus_msg_enqueue bcc45ca981fd libubus: actually set FD_CLOEXEC on the ubus socket 8188f5ce8564 libubus-io: close recv_fd captured before get_next_msg failure 7a068bac5a9b libubus-io: byte-swap peer in HELLO when storing as local_id 747013f6ea05 libubus-io: reset sock.fd to -1 after close on ubus_reconnect error path 020a64b9b169 ubusd_acl: use size_t for strlen result in ubusd_acl_alloc_obj f92ffd289dcc ubusd: use size_t for string and blob length variables 795b32bb96b6 ubusd: use fixed-width types for sequence counters
Lech Perczak [Sat, 23 May 2026 00:29:10 +0000 (02:29 +0200)]
ath79: meraki-mr18: fix MAC address offset after NVMEM switch
The following commit: 27a673916c35 ("ath79: mr18: use nvmem for MACs")
switched MR18 to use NVMEM subsystem for setting MAC addresses, however
it missed the offset in use. Previously 102 (decimal) was used, but in
device tree 0x102 was used, but the correct value is 0x66.
This was found while reviewing code for Z1 port, which shares the MAC
address source.
Replace the offset with the correct one of 0x66.
Fixes: 27a673916c35 ("ath79: mr18: use nvmem for MACs") Signed-off-by: Lech Perczak <lech.perczak@gmail.com> Link: https://github.com/openwrt/openwrt/pull/23486 Signed-off-by: Robert Marko <robimarko@gmail.com>
Jan-Henrik Bruhn [Thu, 21 May 2026 12:05:59 +0000 (14:05 +0200)]
kernel: hwmon lm63: make pwm1 frequency and LUT temp hysteresis writeable
This adds a patch that makes the pwm1 frequency and LUT temperature
hysteresis of lm63 fan controllers writeable, to be able to replicate
vendor cooling behaviour for fans that need a lower PWM frequency
than the default.
x86: onie-installer: wire up sysupgrade via ONIE install mode
This adds support for sysupgrade on ONIE-installed systems.
The install is chained through ONIE (using the ONIE installer image),
rather than attempting to manually upgrade the partition.
The idea is to allow future OpenWRT installs flexibility to use
a different partition table. By putting the installer in charge
of setting up the file system partition, the upgrade process needs
to have no knowledge of the internals of the image.
Config preservation is accomplished by appending the sysupgrade .tar.gz
to the ONIE installer image. Of course this also works for a clean
install using a sysupgrade.tar.gz created via `sysupgrade -b`.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Keno Fischer <keno@juliahub.com> Link: https://github.com/openwrt/openwrt/pull/23062 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The current documentation for using OpenWRT on Mellanox Spectrum
switches (https://openwrt.org/toh/mellanox/spectrum) suggests
reflashing the entire harddrive from the recovery USB. This is not
the most friendly way to install a new OS on these switches. From
factory, they come with ONIE (Open Network Install Environment),
which is a linux-based preboot environment for fetching an OS
image from the network and installing it on disk. The installer
is a self-executing bash script that executes inside the ONIE
environment. The installer is expected to preserve the ONIE partition
for use as recovery environement. To be a better citizen on
these platforms, it would be preferrable to provide OpenWRT as
an ONIE-compatible installer.
This PR adds an ONIE_INSTALLER_IMAGES build option that produces
an ONIE compatible .bin. The generated .bin follows the ONIE demo
installer pattern [1]: it creates a new GPT partition
labelled OPENWRT-ROOT on the ONIE install device, formats ext4, extracts
the OpenWrt rootfs and kernel into it, installs GRUB into the existing
UEFI ESP under bootloader-id "OpenWrt", and adds a NVRAM boot entry via
efibootmgr. ONIE-BOOT is preserved so ONIE rescue remains available.
Tested with the config at [2] on a Mellanox Spectrum SN3800 to produce
a booting OpenWRT install.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> Signed-off-by: Keno Fischer <keno@juliahub.com> Link: https://github.com/openwrt/openwrt/pull/23062 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Jonas Jelonek [Fri, 22 May 2026 20:14:20 +0000 (20:14 +0000)]
realtek: pcs: derive SerDes link count from DT at probe time
Previously, sds->num_of_links was incremented from rtpcs_create() as
each DSA port bound its phylink_pcs. The count therefore relied on a
temporal contract (DSA must finish enumerating before pcs_config runs)
and on rtpcs_create() being the single chokepoint for all consumers.
Replace this with a probe-time scan of pcs-handle references in the
live OF tree: for every available consumer node carrying a pcs-handle
property pointing at one of our SerDes subnodes, bump that SerDes'
num_of_links. After the scan, the count is final regardless of when
or whether DSA later calls in.
To allow of_parse_phandle_with_args() to walk the property correctly,
add #pcs-cells = <0> to every serdes@N node in the 838x/839x/930x/931x
.dtsi files. A future cell-bearing form remains possible without
touching the scan.
Over-references (DT pointing more consumers at one SerDes than the
hardware can carry) are clamped at RTPCS_MAX_LINKS_PER_SDS and warned
about, but do not fail probe — the correctly-wired ports on that
SerDes still come up, and only the surplus reference is dropped.
The bounds check and the bare ++ in rtpcs_create() become redundant
under the scan-driven count and are removed.
This decouples num_of_links from DSA call ordering and is a prereq
for migrating to fwnode_pcs providers, where rtpcs_create() goes away
as the centralised counter.
Felix Fietkau [Sat, 16 May 2026 16:23:07 +0000 (16:23 +0000)]
build: fix apk_package_files wildcard for packages without ABI version
The wildcard combined an apk_package_files pattern of $(pkg)-*.apk with a
gen_package_wildcard that ends in [^a-z]*, so the full glob required two
dashes. Files for packages without an ABI version (e.g. ubbf-0~....apk)
only contain one dash and never matched, so ipkg-remove was never called
on them and stale .apk files accumulated in the bin directory.
Drop the explicit dash from apk_package_files. The [^a-z] in
gen_package_wildcard already serves as the dash matcher, and
scripts/ipkg-remove filters precisely by reading apk metadata.
Fixes: 642d568b0f0a ("build: fix ipkg-remove: add support for removing apk files") Signed-off-by: Felix Fietkau <nbd@nbd.name>
John Crispin [Tue, 14 Apr 2026 11:30:41 +0000 (13:30 +0200)]
wifi-scripts: iwinfo scan() must not abort the interpreter on failure
Replace exit(1) on every failure path with return null so callers that
iterate over multiple radios can collect results from the radios that
did succeed instead of aborting on the first one that refuses an
off-channel scan.
Route diagnostics to stderr via warn() so stdout stays clean for
callers parsing JSON output, and include the device name in each
message to disambiguate per-radio failures.
Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
Robert Marko [Wed, 20 May 2026 14:42:28 +0000 (16:42 +0200)]
fstools: update to Git HEAD (2026-03-17)
1bf2d490484e libfstools: make get_var_from_file() reusable 0b6022439cad mount_root: add kernel parameter to specify the overlay storage name e600d842ce81 mount_root: add kernel parameter to specify the overlay fileystem type
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Eric Fahlgren [Wed, 20 May 2026 15:15:53 +0000 (08:15 -0700)]
imagebuilder: suppress rootfs image when filesystem specified
When using imagebuilder to create images, ROOTFS_FILESYSTEM may be
defined to create just the desired images, but the '*-rootfs.tar.gz'
and '*-rootfs.cpio.gz' images are being created unconditionally
for many targets.
By making generation of these images conditional on the state of
ROOTFS_FILESYSTEM, we can save significant space (measured 3-7 MB
depending on length of package list) and time.
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Balázs Triszka [Wed, 1 Apr 2026 13:32:17 +0000 (15:32 +0200)]
generic: net: phy: realtek: add 5G and 10G PHY support
The functionality/support for 5G and 10G PHYs was extracted from the
realtek-phy driver and ported to the upstream Linux realtek PHY driver.
These PHY chips need a sequence of register writes (and similar operations)
for initialization. These sequences are provided as firmware files which
are interpreted/applied by a new register patch engine.
By switching to the upstream driver, it should be possible to get rid of a
large chunk of (from OpenWrt perspective) unmaintained code from Realtek.
The actual Linux phy-core infrastructure from Linux can be mostly used and
only the Realtek specific quirks need to be handled.
The files which need to be provided are depending on the PHY:
Files which are affected by this change (DEVICE_PACKAGES dependencies,
hwmon paths, default kernel configurations, refresh of patches, ...) are
updated at the same times.
Signed-off-by: Balázs Triszka <info@balika011.hu> Co-authored-by: Semih Baskan <strst.gs@gmail.com> Co-authored-by: Jonas Jelonek <jelonek.jonas@gmail.com> Co-authored-by: Gilly1970 <gilroyscott@hotmail.com> Co-authored-by: Aleksander Jan Bajkowski <olek2@wp.pl> Co-authored-by: Carlo Szelinsky <github@szelinsky.de>
[sven: rebase, integrate suggestions from PR, add device packages, split] Signed-off-by: Sven Eckelmann <sven@narfation.org>
[daniel: stripped to Linux 6.18 only, dropped unrelated changes] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
These PHY chips need a sequence of register writes for initialization.
These are provided as firmware files which are interpreted/applied by a
new register patch engine.
For the moment, the patch instructions in rtl8261-firmware and
rtl8264b-firmware are the same as from the rtl8261n driver. This should
make it possible to first evaluate the patch engine and driver development
for switching over in adjusting the patch instructions.
Signed-off-by: Balázs Triszka <info@balika011.hu>
[sven: rebase, split, fix package version/release, use conf from rtl8261n
driver] Signed-off-by: Sven Eckelmann <sven@narfation.org>
[daniel: define VERSION matching source date for the resulting packages] Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Paul Spooren [Mon, 18 May 2026 17:55:26 +0000 (19:55 +0200)]
scripts: add --user-network to qemustart
qemustart is a handy script to quickly test OpenWrt firmware using
qemu. Bringing up networking currently requires a bridge-helper
setup with privileged IP and bridge assignment. To simplify
testing scenarios like the package manager, which need both shell
access and outbound internet, add a user-mode networking option
backed by SLIRP that requires no privileges.
To stay backward compatible, the defaults don't change. The new
flag --user-network attaches two NICs (LAN + WAN) and forwards
three host ports to the guest LAN interface (192.168.1.1):
2222 -> 22 (ssh), 8080 -> 80 (http) and 8443 -> 443 (https). The
host-side ports can be overridden with --ssh-port, --http-port
and --https-port.
Paul Spooren [Mon, 18 May 2026 17:53:49 +0000 (19:53 +0200)]
scripts: fix lan/wan order of malta in qemustart
OpenWrt's 99-default_network assigns eth0 to lan and eth1 to wan
when no target-specific 02_network is present, which is the case
for malta. The qemustart bridge block however placed the wan
-device before the lan -device, so the guest's eth0 (lan) ended
up attached to $BR_WAN and eth1 (wan) to $BR_LAN.
Swap the order to match the guest's actual role assignment.
Right now the driver uses variable names netdev/ndev/dev to access
a net_device structure. Align this with most of the other upstream
drivers and convert everything to dev.
In the network context there might be confusion between "struct netdev"
and "struct device". The driver should avoid variables of type device
and name "dev" where possible. Remove all variables that point to the
device and use pdev->dev instead. This is like other network drivers
do it.
While we are here modernize logging during probing. Remove messages
from helpers and log errors during probing with dev_err_probe().
The function init_mac() can produce errors for the RTL931x devices.
When this happens it throws a message but continues. That can
leave the hardware in a wrong state.
Cleanup the error handling. Remove all messages from the function
and simply return an error value. In the probe() consumer evaluate
this error and abort probing if needed. As there were no reported
issues in the past it is ok to drop the detailed messages and
aggregate them in a single one.
Upstream netdev does not like big guards. Especially
around debugging functions. Convert to scoped_guard()
and only lock the really needed code parts. This way
all debugging can run outside of the lock.
realtek: mdio: convert to consistent a_to_b() helpers
Majority of kernel uses a_to_b(a) instead of b_from_a(a).
Convert to that to be consistent with all helpers in the
driver. Additionally drop inline function definitions.
Let the compiler decide what is best.
Jonas Jelonek [Mon, 18 May 2026 13:07:36 +0000 (13:07 +0000)]
realtek: add hog for PHY reset for XS1930-10 and -12HP
Add a GPIO hog for those two switches to avoid having a dangling GPIO
which might be pulled accidentally breaking all PHYs, and to have that
GPIO documented.
Jonas Jelonek [Mon, 18 May 2026 12:52:30 +0000 (12:52 +0000)]
realtek: improve DTS readability for XS1930 switches
Improve the readability of the DTS files for XS1930 switches by mostly
making nodes with only a single property a one-liner. This wastes less
visual space and makes it more fluent to read.
Jonas Jelonek [Mon, 18 May 2026 09:45:26 +0000 (09:45 +0000)]
realtek: make LED set config for XS1930 more generic
The led_set node was previously duplicated in the per-device DTS for
-10/-12HP and -12F, even though all three share the same Base-T LED
encoding. Move the shared led_set with the Base-T mapping into the
common DTSI as set 0, and have XS1930-12F append its SFP-port mapping
as led_set1 via a property override. Swap the led-set index on the
-12F ports accordingly so SFP ports use set 1 and the two Base-T
ports use set 0.
Jonas Jelonek [Mon, 18 May 2026 09:06:38 +0000 (09:06 +0000)]
realtek: add additional LED for XS1930-12HP
The -12HP variant has a dedicated red LED on GPIO 3 that lights up
when the PoE budget is exhausted. Add it as led_poe_max with
function = "poe-usage" so userspace can drive it from the PoE stack.
Jonas Jelonek [Mon, 18 May 2026 09:01:11 +0000 (09:01 +0000)]
realtek: fix LED function for XS1930 switches
The cloud and locator LEDs were declared with no function (cloud) or
with the generic LED_FUNCTION_INDICATOR (locator), which doesn't
match what the hardware actually exposes. Use the descriptive
function strings "cloud" and "locator" instead so the LEDs end up
with sensible names in sysfs.
Jonas Jelonek [Sun, 17 May 2026 22:12:51 +0000 (22:12 +0000)]
realtek: fix SYS LED for XS1930-12HP
The XS1930-12HP model from Zyxel doesn't actually use the same GPIOs for
the SYS LED. This was assumed first but proved wrong now. Instead, the
green part of the SYS LED is on another GPIO and the red part of the SYS
LED is on GPIO 0 instead of the green part. Adjust that accordingly in
the device tree.
Jonas Jelonek [Sun, 17 May 2026 22:07:52 +0000 (22:07 +0000)]
realtek: free restore button of XS1930 switches
The support addition for those switches defined the restore button as a
button to trigger a restart. However, those switches also have a reset
button which is wired to the SoC's reset line, causing a reset upon
pressing. Thus, using the restore button for basically the same purpose
doesn't make sense. Change the 'linux,code' property to 'BTN_0' to
assign no real function to that button, allowing it to be used for
different purposes.
Jonas Jelonek [Sun, 17 May 2026 22:02:19 +0000 (22:02 +0000)]
realtek: wire up GPIO fan for Zyxel XS1930 switches
The switches from Zyxels XS1930 have one or two fans in the case. They
might be controlled in a limited fashion. There's a single GPIO which -
depending on the state - drives the fan in slow or fast mode. Wire that
up as a device tree node to be able to control that in userspace.
XS1930-10 and XS1930-12HP use the same GPIO while XS1930-12F moves that
to one of its GPIO expanders. Also add 'kmod-hwmon-gpiofan' for all
three devices to be selected by default.
Jonas Jelonek [Mon, 18 May 2026 07:44:49 +0000 (07:44 +0000)]
realtek: reorganize DTS for Zyxel XS1930
XS1930-10 and XS1930-12HP share most of their layout: the same
8-port AQR813 Base-T block, the same SFP+ GPIO mux, identical I2C
master config and serdes polarity. Carve those shared pieces out
into a new intermediate rtl9313_zyxel_xs1930-aqr813.dtsi and have both
device DTS files include it, leaving only their device-specific
differences (LED-set masks, extra PoE bits on -12HP, extra AQR113C
PHYs on -12HP) in the per-device files. XS1930-12F continues to
include the common DTSI directly since its layout differs too much
to share usefully.
Jonas Jelonek [Mon, 18 May 2026 08:36:05 +0000 (08:36 +0000)]
realtek: move XS1930 LED definitions to common DTSI
The power, cloud and locator LEDs exist on all three XS1930 variants
with the same colors and roles, only the GPIOs differ. Declare them
once in the common DTSI with the -10/-12HP pinout and let -12F
override the gpios properties via phandle references. This removes
three near-identical led-node blocks from the device DTS files.
realtek: thermal: separate initialization/operation
The driver uses lazy initialization - during first temperature
get. Checking enabled status over and over again does not make
sense. Provide separate setup functions for this. With this split
the error handling will be improved. If initialization fails, the
sensor will not be registered at all.
Jonas Jelonek [Tue, 19 May 2026 12:32:52 +0000 (12:32 +0000)]
kernel: pse-pd: auto-select kmod-pse-pd from AddDepends helper
The AddDepends/pse-pd helper appended kmod-pse-pd to DEPENDS without the
'+' prefix, making it a hard dependency rather than an auto-selecting one.
This breaks pulling any PSE controller driver (kmod-pse-pd692x0,
kmod-pse-si3474, kmod-pse-tps23881, kmod-pse-regulator, ...) in via a
device's DEVICE_PACKAGES: the kmod itself is auto-selected, but the
unsatisfied hard dep on kmod-pse-pd silently drops it from .config.
Prefix the kmod-pse-pd entry with '+' so it auto-selects, matching how
the other deps in the same file (kmod-i2c-core, etc.) are expressed. The
helper is the right place to fix this; every PSE controller driver routes
through it.
Sven Eckelmann [Tue, 19 May 2026 19:43:16 +0000 (21:43 +0200)]
ramips: pax1800-lite: fix label-mac-device
The gmac1 is not used and doesn't have any mac address configured. The
gmac0 has the nvmem-cells set and can actually be used to retrieve the
correct mac address.
Fixes: c7c54f313425 ("ramips: add support for Plasma Cloud PAX1800-Lite") Signed-off-by: Sven Eckelmann <sven@narfation.org> Link: https://github.com/openwrt/openwrt/pull/23441 Signed-off-by: Robert Marko <robimarko@gmail.com>
mediatek: add support for Wavlink WL-WNT100X3 ubootmod
This allows us to use the full size of nand, which increases ubi size
from 90M to 122.25M.
Flashing instructions:
1. Login into the device and backup all your partitions,
especially `Factory` and 'HW' to be able to come back to stock and use all
Wavlink services.
2. Unlock mtd partitions:
```
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
```
3. Upload new `bl2` and `fip` to the router /tmp and write them:
```
mtd write /tmp/openwrt-mediatek-filogic-wavlink_wl-wnt100x3-ubootmod-preloader.bin bl2
mtd write /tmp/openwrt-mediatek-filogic-wavlink_wl-wnt100x3-ubootmod-bl31-uboot.fip fip
mtd erase ubi
```
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt initramfs has booted, prepare ubi and envs:
```
ubidetach -p /dev/mtd4 && ubiformat /dev/mtd4 -y && ubiattach -p /dev/mtd4 && ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB && ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
```
8. Perform sysupgrade.
1.Log in to the web management page.
2.Select the country code and time zone, set the Wi-Fi password, and
click Save.
3.Click "More", navigate to "Developer Options", and enable the SSH
function.
4.Log in to the device via an SSH client (default IP is usually
192.168.20.1).
5.Use scp to upload the OpenWrt
image(openwrt-mediatek-filogic-wavlink_wl-wnt100x3-squashfs-sysupgrade.bin)
to the /tmp directory
6.Perform the flash by running the sysupgrade command (use -n to
overwrite the existing configuration)
7.Wait for the device to reboot automatically. Once finished, access the
OpenWrt web interface (LuCI) at the default IP 192.168.1.1.
MAC Addresses
-----------------------------
2.4GHz: 80:3F:5D:xx:xx:93 (Factory 0x4)
LAN : 80:3F:5D:xx:xx:91 (Factory, 0x3fff4)
WAN : 80:3F:5D:xx:xx:92 (Factory, 0x3fffa)
5GHz : 02:3F:5D:xx:xx:93 (derived from 2.4GHz MAC, LAA))
Add support for TP-Link Festa F65, an AX3000 ceiling mount WiFi 6 AP.
Hardware
--------
SOC : MediaTek MT7981B 2x A53
RAM : ESMT M15T4G16256A 512MiB
Flash : ESMT F50L1G41LB 128 MiB
ETH : 1x 1GbE
WiFi : MT7976
Buttons : Reset
Leds : Blue status led on top
Power : DC 12V 1.2A / PoE
Installation
------------
1. Disassemble the device
2. Solder UART to pins VGRT right of the ethernet port
3. Connect UART console (3.3V)
4. Press Ctrl+b to stop in u-boot shell
5. Use `mtkload` to boot `openwrt-initramfs-kernel.bin` via tftp
6. Flash `openwrt-squashfs-sysupgrade.bin` via sysupgrade
Revert to OEM firmware
----------------------
1. Hold reset button while plugging in power
2. Configure host ethernet to 192.168.0.1/24
3. Go to http://192.168.0.254
4. Upload OEM firmware
MAC Addresses
-------------
LAN : DC:62:79:xx:xx:28 (printed on label)
2.4GHz: DC:62:79:xx:xx:28
5GHz : DC:62:79:xx:xx:29
| Interface | Source |
|------------|-------------------------------------------------|
| WAN/Label | u-boot-env MTD partition, "mac" (text) |
| LAN | WAN + 1 |
| 2.4 GHz | WAN + 2 |
| 5 GHz | WAN + 3 |
---
**1. Prepare TFTP server**
Set a static IP on the ethernet interface of your computer (e.g. default: ip `192.168.1.2`, gateway `192.168.1.1`).
Download the initramfs image and host it with the TFTP server.
**2. Interrupt boot**
Attach UART and power on the router. When the boot menu appears, select **Failsafe Mode**,
then press `Ctrl-C` to interrupt and enter the U-Boot prompt.
Place the sysupgrade image in `/tmp`, then run:
```sh
sysupgrade /tmp/openwrt-mediatek-filogic-jiorouter_ax6000-jidu6101-squashfs-sysupgrade.bin
```
Alternatively, use the sysupgrade option in LuCI.
Note:
- The raw MTD u-boot-env partition is only used for MAC address storage, while the active U-Boot environment is stored in the UBI volume.
- These devices ship with secure boot enabled and stock U-Boot only accepts vendor-signed FIT images.
- BL2/FIP cannot be replaced, so the stock signature verification path cannot be disabled directly.
- Setting ipaddr='' forces U-Boot to exit the web failsafe path and continue into autoboot.
- The custom bootcmd loads OpenWrt from the UBI volume and removes the /signature node before bootm, allowing unsigned OpenWrt FIT images to boot.
- Stock U-Boot expects its environment in a UBI volume named u-boot-env, so it is created during initial setup.
David Berdik [Mon, 18 May 2026 20:33:33 +0000 (16:33 -0400)]
mediatek/filogic: add support for COMFAST CF-XR186
The COMFAST CF-XR186 is a WiFi repeater. The original OEM firmware is a
fork of OpenWrt 21.02.
To replace the OEM firmware with OpenWrt, flash the sysupgrade image
through the firmware upgrade option via the OEM firmware's web UI.
The OEM firmware upgrade page does not provide an option to perform a
factory reset, so after the flash completes and the device reboots,
perform a reset by holding in the WPS/Reset button until the WiFi
LED flashes red.
The led-boot, led-failsafe, led-upgrade, and led-running aliases all
point at the red WLAN GPIO LED.
The green and blue WLAN GPIO LEDs are used to indicate activity on the
2.4GHz and 5GHz radios. 01_leds assigns netdev triggers for those LEDs
to phy0-ap0 and phy1-ap0 respectively; if neither AP interface exists
(e.g. station-only repeater setups), both LEDs stay dark even when WiFi
traffic is flowing.
Specificaitons:
- MediaTek MT7621AT SoC
- 256 MB RAM
- 16MB SPI NOR Flash
- 256MB NAND (split in half for firmware fallback)
- 4x 10/100/1000 Mbps Ethernet, with passive PoE support on LAN1
- WLAN : MediaTek dual-band WiFi 5
- 2.4 GHz : b/g/n, MIMO 2x2
- 5 GHz : n/ac, MIMO 2x2
- Quectel EG060K-EA 4G CAT6 modem
- 2.0 USB Type-A HOST port
- 1x Digital input
- 1x Digital output
- 2x SIM slot (can be swapped via GPIO)
GPIO:
- 1 button (Reset)
- 14 LEDs (power, 4x WAN status, Wifi 2G, Wifi 5G, 3G, 4G, 5x RSSI)
- 3 Modem control (power button, reset, sim select)
- 1 Digital input
- 1 Digital output
Installation
------------
Notice: update OEM firmware to 7.19 or later, earlier versions will
fail to flash openwrt factory firmware.
1. Check from which partition the device is currently running from
$ cat /proc/bootconfig/chosen
In case this output reads rutos-b, install a software update from
Teltonika first. After upgrade completion, check this file now reads
rutos-a before continuing.
2. Download the *-squashfs-factory.bin firmware image
3. Flash firmware image via WEB interface
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile connection:
- EG060K-EA:
Execute AT commands:
echo -ne 'AT+QCFG="usbnet",2\r\n' > /dev/ttyUSB2
echo -ne 'AT+CFUN=1,1\r\n' > /dev/ttyUSB2
Use ModemManager to establish mobile connection.
Signed-off-by: Simonas Tamošaitis <simsasss@gmail.com>
Installation
------------
Notice: update OEM firmware to 7.19 or later, earlier versions will
fail to flash openwrt factory firmware.
1. Check from which partition the device is currently running from
$ cat /proc/bootconfig/chosen
In case this output reads rutos-b, install a software update from
Teltonika first. After upgrade completion, check this file now reads
rutos-a before continuing.
2. Download the *-squashfs-factory.bin firmware image
3. Flash firmware image via WEB interface
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile connection:
- RG520N-EB:
Use "ModemManager" to establish mobile data connection.
- RG500U-EB:
echo -ne 'AT+QNETDEVCTL=1,3,1\r\n' > /dev/ttyUSB2
Create DHCP interface with usb0 device.
Signed-off-by: Simonas Tamošaitis <simsasss@gmail.com>
ramips: mt7621: add Teltonika RUTM50/RUTM51 support
Specifications:
- MediaTek MT7621AT SoC
- 256 MB RAM
- 16MB SPI NOR Flash
- 256MB NAND (split in half for firmware fallback)
- 5x 10/100/1000 Mbps Ethernet, with passive PoE support on LAN1
- WLAN : MediaTek dual-band WiFi 5
- 2.4 GHz : b/g/n, MIMO 2x2
- 5 GHz : n/ac, MIMO 2x2
- Quectel RG520N-NA 5G R16 modem (RUTM50) or RG500U-EB 5G (RUTM51)
- 2.0 USB Type-A HOST port
- 1x Digital input
- 1x Digital output
- 2x SIM slot (can be swapped via AT commands)
GPIO:
- 1 button (Reset)
- 13 LEDs (power, 4x WAN status, Wifi 2G, Wifi 5G, 3G, 4G, 5G, RSSI
1,2,3)
- 2 Modem control (power button, reset)
- 1 Digital input
- 1 Digital output
Installation
------------
Notice: update OEM firmware to 7.19 or later, earlier versions will
fail to flash openwrt factory firmware.
1. Check from which partition the device is currently running from
$ cat /proc/bootconfig/chosen
In case this output reads rutos-b, install a software update from
Teltonika first. After upgrade completion, check this file now reads
rutos-a before continuing.
2. Download the *-squashfs-factory.bin firmware image
3. Flash firmware image via WEB interface
To revert back to OEM firmware:
https://wiki.teltonika-networks.com/view/Bootloader_menu
Mobile connection:
- RG520N-NA:
Use "ModemManager" to establish mobile data connection.
- RG500U-EB:
echo -ne 'AT+QNETDEVCTL=1,3,1\r\n' > /dev/ttyUSB2
Create DHCP interface with usb0 device.
Signed-off-by: Simonas Tamošaitis <simsasss@gmail.com>
Kernel 6.19 will get rid of of_node_to_fwnode(). Switch to its
successor of_fwnode_handle() that is already available in 6.18.
This will simplify a future kernel upgrade.
generic: update pending PCS patch with .fill_available_pcs OP
While implementing standalone PCS support for DSA, it was found that making
the MAC driver passing the available_pcs array is limiting and problematic
for memory handling and allocation. To better handle this, change the logic
and make phylink allocate the struct and make the MAC driver implement a
function in phylink_config .fill_available_pcs to fill the PCS array.
Update the Airoha and Mediatek driver to reflect this new implementation.
Paul Spooren [Mon, 18 May 2026 11:32:39 +0000 (13:32 +0200)]
imagebuilder: allow to specify filesystem
The ImageBuilder creates by default all filesystems enabled during it's own
build, which are typically squashfs and sometimes ext4.
This commit allows to set ROOTFS_FILESYSTEM to specify which specific
filesystem should be build (instead of all).
Motivation is to reduce the load on sysupgrade servers but also fix corner
cases where a squashfs filesystem results in a working image while the ext4
image fails, resulting in a ImageBuilder failure.
qualcommax: ipq50xx: add support for Xiaomi Redmi AX5400
Add support for Xiaomi AX5400 (RA74).
Specifications:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Etrontech EM6HE16EWAKG 512 MiB DDR3L-933
* Serial Port: 1v8 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax - up to 574 Mbps)
QCN9024 (4x4 5 Ghz 802.11an/ac/ax - up to 4804 Mbps)
* Ethernet: IPQ5018 integrated virtual switch connected to an
external QCA8337 switch (3 LAN Ports 10/100/1000)
* Flash: Gigadevice GD5F1GQ5REYIG (128 MiB)
* LEDs: 1x System Blue (GPIO 24 Active High)
1x System Yellow (GPIO 25 Active High)
1x WAN Link Blue (GPIO 26 Active High)
1x WAN Link Yellow (GPIO 27 Active High)
* Buttons: 1x Reset (GPIO 38 Active Low)
1x WPS (GPIO 28 Active Low)
* MAC address layout: LAN (eth1): 0:art @ offset 0x0
WAN (eth0): 0:art @ offset 0x6
Flash instructions: (use redmi-ax5400 image for the Redmi AX5400)
First flash a ubinized OpenWrt initramfs that will serve as the intermediate step, since
OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for
packages, through either of the below two methods:
Installation via XMIR Patcher:
1. Load the initramfs image: openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi
Installation via ubiformat method, through SSH:
1. If needed, enable SSH using XMIR Patcher.
2. Copy the file openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi to the /tmp directory
3. Open an SSH shell to the router
4. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs
5. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd18 and mtd19 are the correct indexes from above!
6. Use the command ubiformat to flash the opposite mtd with UBI image:
If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit
otherwise:
ubiformat /dev/mtd18 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit
7. Reboot the device by:
reboot
Continue in order to pernamently flash OpenWrt:
1. Upload the sysupgrade image to /tmp/ using SCP:
scp -O <path to image> root@192.168.1.1:/tmp/
2. Open an SSH shell to 192.168.1.1 from a PC within the same subnet
3. Use sysupgrade to flash the sysupgrade image:
sysupgrade -n -v /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-squashfs-sysupgrade.bin
Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.
Commit 6cc149f167 (ipq806x: mr42/mr52: use nvmem for caldata, 2026-02-25)
broke wifi on meraki mr42/52 by making caldata inaccessible.
This commit adds UBI nvmem to ipq806x target and corrects art partition address
Signed-off-by: Aleksander Wałęski <olewales@gmail.com>
Lorenzo Bianconi [Mon, 18 May 2026 10:25:41 +0000 (12:25 +0200)]
airoha: Add the capability to offload dscp field via netfilter flowtable
Introduce the capability to hw offload via netfilter flowtable APIs the
IP TOS info. Implement the sw offloading for DSCP field via the
netfilter flowtable APIs.
Ryan Leung [Sat, 16 May 2026 00:46:33 +0000 (10:46 +1000)]
button-hotplug: add KEY_SETUP and KEY_VENDOR handling
Add KEY_SETUP and KEY_VENDOR keys. Many Rockchip devices, including all of those in e13cbab6840b ("rockchip: enable SARADC; add buttons hotplug and ADC kmods to default packages")
have one or both of these buttons.
kernel: replace aes-lib with aes-generic in testmgr tests
The name “aes-lib” is used since kernel 7.0. In kernels 6.12 and 6.18,
the name “aes-generic” is used. This change makes it possible to run
comparative selftests of the generic and hardware implementations.
This will help identify any potential differences in the results.
Jonas Jelonek [Thu, 30 Apr 2026 09:13:11 +0000 (09:13 +0000)]
realtek: add support for Zyxel XGS1930-28HP
Add support for the RTL9301-based Zyxel XGS1930-28HP, a 28-port Gigabit
PoE+ switch. The XGS1930 is an EOL Zyxel series of RTL9301-based
switches available with 28 or 52 ports, with and without PoE.
Hardware
========
- RTL9301 SoC
- 512 MiB DDR3 RAM
- 32 MiB SPI-NOR flash
- 24x 10/100/1000M RJ45 ports
- 4x 1G/10G SFP+ cages
- PoE:
- 802.3af/at on all 24 RJ45 ports
- 375 W total power budget
- RTL8231 for port LEDs
- Front LEDs: PWR, SYS, CLOUD, LOCATOR, PoE usage bar (5 steps)
- Buttons: 1x "Restore"
- Console: TTL 3.3V, 115200 8N1, 4-pin header
- pinout (front to back): GND RX TX -
- Software chain:
- Bootbase/stripped-down U-Boot
- RAS/ZyNOS
MAC address
===========
Single MAC address derived from the board partition. Applied to all
switch ports.
Disclaimer
==========
PoE is not yet supported.
Flashing OpenWrt overwrites ZyNOS. The Bootbase/U-Boot remains intact
and can be used for recovery.
Installation
============
Simple web upgrade:
1. Take the OpenWrt factory.bin image generated by the build.
2. In the ZyNOS web UI, login and go to Maintenance -> Firmware Upgrade.
3. If the device runs ZyNOS 5.00, untick "Enhanced firmware integrity
check sha256sum". Otherwise the upload check will reject the image.
4. Select and upload the factory.bin image and click upgrade.
5. After flashing has finished, reboot the switch. It will now boot
into OpenWrt.
Initramfs boot
==============
Luckily the switch uses a standard design, thus networking works with
a default hardware profile of RTK U-boot.
1. Connect to the serial console and interrupt the boot process by
spamming '$' during the DRAM test to drop into Bootbase/U-Boot.
2. Bring up the network:
> rtk network on
Use a copper port; the SFP+ cages are likely not usable from the
bootloader.
3. Load the initramfs image via TFTP:
> tftpboot 0x82000000 <server>:<image>
4. Run the image (not bootm, the image has no uImage header):
> go 0x82000000
Return to stock firmware
========================
1. Download the stock firmware for the switch from the Zyxel website
and unzip it; there should be a .bin file with an alphanumeric name.
2. Upload that file to the running OpenWrt instance.
3. Flash it (use -F since the image has no OpenWrt metadata):
> sysupgrade -F <stock-firmware>.bin
4. Wait for sysupgrade to finish and the switch to reboot. ZyNOS should
come up again.
Not yet enabled:
----------------
* Fan control: it's controlled via simple i2c registers, but no driver
has been written yet.
Installation:
-------------
This device uses an obfuscated bootloader and an obfuscated image. As such,
the installation can only be performed using the console ports.
1. Set the switch to boot from the first image.
2. Attach console cable and hold Ctrl+C while powering on the switch
3. After a few seconds, a very basic U-Boot menu appears. Wait for the user
input to appear, then press "z" to get to the message "Please input auth
code".
4. Type "jiangks" as the password, the RTL9300 prompt appears.
In rtpcs_probe_serdes_bus(), the code manages the device
tree node reference incorrectly:
- It acquires a node pointer np via of_find_compatible_node(),
which increments the reference count.
- It calls of_mdio_find_bus(np) to locate the bus.
- It calls of_node_put(np), which decrements the reference
count. If this was the last reference, the node is freed.
- It then attempts to check if (!of_device_is_available(np)).
The pointer np is used after its reference has been released.
This can lead to a kernel oops or unpredictable behavior if
the memory has been reclaimed.
Fixes: fe27cce1e ("realtek: add SerDes PCS driver") Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://github.com/openwrt/openwrt/pull/23391 Signed-off-by: Robert Marko <robimarko@gmail.com>
realtek: eth: create phylink before device registration
As soon as devm_register_netdev returns, the network
interface is "live" and the kernel can call rteth_open().
If the interface is brought up immediately (e.g., by a
userspace script), rteth_open will attempt to call
phylink_start(ctrl->phylink), which will crash the
system because ctrl->phylink has not been assigned yet.
packet->dma is overwritten with a new mapping before
the previous buffer is unmapped. This causes the kernel
to unmap the wrong memory address, leading to memory
leaks and potential corruption.
Additionally set skb pointer to NULL to avoid a free
when the buffer is recycled next time.
Reorder unmapping/mapping sequence.
Fixes: 41300fd88 ("refactor transmit function") Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://github.com/openwrt/openwrt/pull/23375 Signed-off-by: Robert Marko <robimarko@gmail.com>
projects / thirdparty / openwrt.git / log
