1
1
Commit Graph

24360 Commits

Author SHA1 Message Date
Hauke Mehrtens
a7bd3b147e uhttpd: update to Git HEAD (2026-05-21)
1b624f8f814e auth: classify $p$ lookups by account state

Link: https://github.com/openwrt/openwrt/pull/23476
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-23 01:52:39 +02:00
Daniel Golle
f2aa412733 rtl826x-firmware: depend on kmod-phy-realtek
Follow the established pattern and let the firmware package select
the driver which uses it.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-05-22 20:53:04 +01:00
Felix Fietkau
74da669505 umdns: update to Git HEAD (2026-05-22)
bd7599d02157 fix calloc_a size argument type

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-22 14:56:09 +02:00
Felix Fietkau
4136443864 unetd: update to Git HEAD (2026-05-22)
090abf9a5521 host: fix type mismatch on calloc_a calls

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-22 14:54:34 +02:00
John Crispin
0c2fb39c5a wifi-scripts: iwinfo scan() must not abort the interpreter on failure
Replace exit(1) on every failure path with return null so callers that
iterate over multiple radios can collect results from the radios that
did succeed instead of aborting on the first one that refuses an
off-channel scan.

Route diagnostics to stderr via warn() so stdout stays clean for
callers parsing JSON output, and include the device name in each
message to disambiguate per-radio failures.

Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-22 14:54:34 +02:00
John Crispin
cb7414055c wifi-scripts: iwinfo: guard assoclist against unknown device
Signed-off-by: John Crispin <john@phrozen.org>
2026-05-22 14:54:34 +02:00
Robert Marko
920a382cb6 fstools: update to Git HEAD (2026-03-17)
1bf2d490484e libfstools: make get_var_from_file() reusable
0b6022439cad mount_root: add kernel parameter to specify the overlay storage name
e600d842ce81 mount_root: add kernel parameter to specify the overlay fileystem type

Signed-off-by: Robert Marko <robert.marko@sartura.hr>
2026-05-22 13:10:42 +02:00
Shiji Yang
de769c6d66 uboot-mediatek: fix malformed patch
The chunk length is not correct.

Fixes: d2fabb974c ("mediatek: add support for Wavlink WL-WNT100X3 ubootmod")
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
2026-05-22 01:47:47 +01:00
Daniel Golle
539f09ade0 rtl8261n-firmware: set PKGARCH:=all
The generated firmware patches for RealTek's PHYs are host architecture
agnostic. Express this with PKGARCH:=all.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-05-21 23:45:07 +01:00
Daniel Golle
8c264cf222 generic: 6.18: drop downstream RTL8261N driver
Now that the upstream RealTek PHY driver is patched to support also
the new 5G and 10G PHYs we can start to phase-out the messy downstream
driver.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-05-21 17:04:55 +01:00
Balázs Triszka
a3395c60ba firmware: add Realtek RTL826X firmware package
This is required by the realtek PHY driver for:

* rtl8261n.bin (package "rtl8261n-firmware" or "rtl8261n-lp-firmware")
  - RTL8251L 5Gbps PHY
  - RTL8261BE 10Gbps PHY
  - RTL8261N 10Gbps PHY
* rtl8264b.bin (package "rtl8264b-firmware")
  - RTL8254B 5Gbps PHY
  - RTL8264 10Gbps PHY
  - RTL8264B 10Gbps PHY

These PHY chips need a sequence of register writes for initialization.
These are provided as firmware files which are interpreted/applied by a
new register patch engine.

For the moment, the patch instructions in rtl8261-firmware and
rtl8264b-firmware are the same as from the rtl8261n driver. This should
make it possible to first evaluate the patch engine and driver development
for switching over in adjusting the patch instructions.

Signed-off-by: Balázs Triszka <info@balika011.hu>
[sven: rebase, split, fix package version/release, use conf from rtl8261n
driver]
Signed-off-by: Sven Eckelmann <sven@narfation.org>
[daniel: define VERSION matching source date for the resulting packages]
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-05-21 17:04:55 +01:00
Andy Chiang
6eead121ee uhttpd: update to Git HEAD (2026-05-20)
6ab9abb56bcb cgi, file: fix crash due to field_len type mismatch with libubox

Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23446
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-20 23:37:23 +02:00
David Bauer
cb4e665da0 uqmi: use configured profile-id if available
Use a user-supplied profile-id when configuring the APN and PDP type.
Fall back to id "1" in case no profile-id is set by the user.

Link: https://github.com/openwrt/openwrt/issues/21617
Suggested-by: S. Hoot <spoot_hoot@protonmail.com>
Signed-off-by: David Bauer <mail@david-bauer.net>
2026-05-20 17:04:18 +02:00
Jonas Jelonek
fb7c14ce7b kernel: pse-pd: auto-select kmod-pse-pd from AddDepends helper
The AddDepends/pse-pd helper appended kmod-pse-pd to DEPENDS without the
'+' prefix, making it a hard dependency rather than an auto-selecting one.
This breaks pulling any PSE controller driver (kmod-pse-pd692x0,
kmod-pse-si3474, kmod-pse-tps23881, kmod-pse-regulator, ...) in via a
device's DEVICE_PACKAGES: the kmod itself is auto-selected, but the
unsatisfied hard dep on kmod-pse-pd silently drops it from .config.

Prefix the kmod-pse-pd entry with '+' so it auto-selects, matching how
the other deps in the same file (kmod-i2c-core, etc.) are expressed. The
helper is the right place to fix this; every PSE controller driver routes
through it.

Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23449
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-20 10:38:35 +02:00
Fil Dunsky
d2fabb974c mediatek: add support for Wavlink WL-WNT100X3 ubootmod
This allows us to use the full size of nand, which increases ubi size
from 90M to 122.25M.

Flashing instructions:
1. Login into the device and backup all your partitions,
especially `Factory` and 'HW' to be able to come back to stock and use all
Wavlink services.

2. Unlock mtd partitions:
```
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
```
3. Upload new `bl2` and `fip` to the router /tmp and write them:
```
mtd write /tmp/openwrt-mediatek-filogic-wavlink_wl-wnt100x3-ubootmod-preloader.bin bl2
mtd write /tmp/openwrt-mediatek-filogic-wavlink_wl-wnt100x3-ubootmod-bl31-uboot.fip fip
mtd erase ubi
```
4. Set static IP on your PC:
   IP 192.168.1.254/24, GW 192.168.1.1
5. Serve OpenWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After OpenWrt initramfs has booted, prepare ubi and envs:
```
ubidetach -p /dev/mtd4 && ubiformat /dev/mtd4 -y && ubiattach -p /dev/mtd4 && ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB && ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
```
8. Perform sysupgrade.

Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22753
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-20 01:59:58 +02:00
sh3ikh-faisal
fe3efbd7da mediatek: add support for JioRouter AX6000 JIDU6101
| Component        | Details                                         |
|------------------|-------------------------------------------------|
| **SoC**          | MediaTek MT7986A (4× ARM Cortex-A53 @ 2.0 GHz) |
| **RAM**          | 512 MB                                          |
| **Flash**        | 256 MB NAND                                     |
| **Ethernet**     | 5× 10/100/1000 Mbps (1 WAN + 4 LAN)            |
| **WLAN 2.4 GHz** | MediaTek MT7976GN — 802.11b/g/n/ax, 4×4 MIMO   |
| **WLAN 5 GHz**   | MediaTek MT7976AN — 802.11n/ac/ax, 4×4 MIMO    |
| **LEDs**         | 1× RGB LED (GPIO-controlled)                    |
| **Button**       | 1× Reset                                        |
| **USB**          | Yes                                             |

**MAC Addresses:**

| Interface  | Source                                          |
|------------|-------------------------------------------------|
| WAN/Label  | u-boot-env MTD partition, "mac" (text)          |
| LAN        | WAN + 1                                         |
| 2.4 GHz    | WAN + 2                                         |
| 5 GHz      | WAN + 3                                         |

---

**1. Prepare TFTP server**

Set a static IP on the ethernet interface of your computer (e.g. default: ip `192.168.1.2`, gateway `192.168.1.1`).

Download the initramfs image and host it with the TFTP server.

**2. Interrupt boot**

Attach UART and power on the router. When the boot menu appears, select **Failsafe Mode**,
then press `Ctrl-C` to interrupt and enter the U-Boot prompt.

**3. Load and run initramfs image**
```sh
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
tftpboot 0x46000000 openwrt-mediatek-filogic-jiorouter_ax6000-jidu6101-initramfs-kernel.bin
fdt addr $(fdtcontroladdr)
fdt rm /signature
bootm
```

**4. Flash sysupgrade image**

Place the sysupgrade image in `/tmp`, then run:
```sh
sysupgrade /tmp/openwrt-mediatek-filogic-jiorouter_ax6000-jidu6101-squashfs-sysupgrade.bin
```
Alternatively, use the sysupgrade option in LuCI.

Note:
- The raw MTD u-boot-env partition is only used for MAC address storage, while the active U-Boot environment is stored in the UBI volume.
- These devices ship with secure boot enabled and stock U-Boot only accepts vendor-signed FIT images.
- BL2/FIP cannot be replaced, so the stock signature verification path cannot be disabled directly.
- Setting ipaddr='' forces U-Boot to exit the web failsafe path and continue into autoboot.
- The custom bootcmd loads OpenWrt from the UBI volume and removes the /signature node before bootm, allowing unsigned OpenWrt FIT images to boot.
- Stock U-Boot expects its environment in a UBI volume named u-boot-env, so it is created during initial setup.

Signed-off-by: sh3ikh-faisal <sheikhfaisal713@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22201
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-20 00:51:40 +02:00
David Bauer
1eabd76d28 wifi-scripts: add option to disable WPS button handling
In case OpenWrt is used to build a custom distribution, the default
button handling logic may be undesired.

Add config options to disable default standard button handling code
at build-time.

Signed-off-by: David Bauer <mail@david-bauer.net>
2026-05-20 00:02:31 +02:00
David Bauer
4bdc2ab93a base-files: add options to disable default button handling
In case OpenWrt is used to build a custom distribution, the default
button handling logic may be undesired.

Add config options to disable default standard button handling code
at build-time.

Signed-off-by: David Bauer <mail@david-bauer.net>
2026-05-20 00:02:31 +02:00
Thomas Weißschuh
e64d688ea4 util-linux: update to 2.42.1
Release notes:
https://www.kernel.org/pub/linux/utils/util-linux/v2.42/v2.42.1-ReleaseNotes

Upstreamed:
0001-meson-test-for-statx-stx_mnt_id-in-sys-stat.h.patch
0001-nsenter-Fix-AT_HANDLE_FID-on-musl.patch

Signed-off-by: Thomas Weißschuh <thomas@t-8ch.de>
Link: https://github.com/openwrt/openwrt/pull/23432
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-19 23:39:29 +02:00
George Moussalem
09e55e1008 qualcommax: ipq50xx: add support for Xiaomi Redmi AX5400
Add support for Xiaomi AX5400 (RA74).

Specifications:
* SoC: Qualcomm IPQ5018 (64-bit dual-core ARM Cortex-A53 @ 1.0Ghz)
* Memory: Etrontech EM6HE16EWAKG 512 MiB DDR3L-933
* Serial Port: 1v8 TTL 115200n8
* Wi-Fi: IPQ5018 (2x2 2.4 Ghz 802.11b/g/n/ax - up to 574 Mbps)
	 QCN9024 (4x4 5 Ghz 802.11an/ac/ax - up to 4804 Mbps)
* Ethernet: IPQ5018 integrated virtual switch connected to an
	    external QCA8337 switch   (3 LAN Ports 10/100/1000)
* Flash: Gigadevice GD5F1GQ5REYIG (128 MiB)
* LEDs: 1x System Blue   (GPIO 24 Active High)
	1x System Yellow (GPIO 25 Active High)
	1x WAN Link Blue (GPIO 26 Active High)
	1x WAN Link Yellow   (GPIO 27 Active High)
* Buttons: 1x Reset  (GPIO 38 Active Low)
	   1x WPS    (GPIO 28 Active Low)
* MAC address layout: LAN (eth1): 0:art @ offset 0x0
		      WAN (eth0): 0:art @ offset 0x6

Flash instructions: (use redmi-ax5400 image for the Redmi AX5400)

Download XMIR Patcher: https://github.com/openwrt-xiaomi/xmir-patcher

First flash a ubinized OpenWrt initramfs that will serve as the intermediate step, since
OpenWrt uses unified rootfs in order to fully utilize NAND and provide enough space for
packages, through either of the below two methods:

Installation via XMIR Patcher:

1. Load the initramfs image: openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi

Installation via ubiformat method, through SSH:

1. If needed, enable SSH using XMIR Patcher.
2. Copy the file openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi to the /tmp directory
3. Open an SSH shell to the router
4. Check which rootfs partition is your router booted in (0 = rootfs | 1 = rootfs_1):
nvram get flag_boot_rootfs
5. Find the rootfs and rootfs_1 mtd indexes respectively:
cat /proc/mtd
Please confirm if mtd18 and mtd19 are the correct indexes from above!
6. Use the command ubiformat to flash the opposite mtd with UBI image:
If nvram get flag_boot_rootfs returned 0:
ubiformat /dev/mtd19 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=1 && nvram set flag_last_success=1 && nvram commit
otherwise:
ubiformat /dev/mtd18 -y -f /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-initramfs-factory.ubi && nvram set flag_boot_rootfs=0 && nvram set flag_last_success=0 && nvram commit
7. Reboot the device by:
reboot

Continue in order to pernamently flash OpenWrt:
1. Upload the sysupgrade image to /tmp/ using SCP:
scp -O <path to image> root@192.168.1.1:/tmp/
2. Open an SSH shell to 192.168.1.1 from a PC within the same subnet
3. Use sysupgrade to flash the sysupgrade image:
sysupgrade -n -v /tmp/openwrt-qualcommax-ipq50xx-xiaomi_redmi-ax5400-squashfs-sysupgrade.bin

Device will reboot with OpenWrt, and then sysupgrade can be used to upgrade the device when desired.

Signed-off-by: George Moussalem <george.moussalem@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23374
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-18 21:39:52 +02:00
Robert Marko
51b5c9dedc ipq-wifi: update to Git HEAD (2026-05-18)
7d851accdab1 ipq40xx: add Linksys MR9000 BDF Link: https://github.com/openwrt/firmware_qca-wireless/pull/114
903e04995ad7 ipq5018: Add BDF for Xiaomi Redmi AX5400
e20f4c6ff197 qcn9074: Add BDF for Xiaomi Redmi AX5400

Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-18 21:39:02 +02:00
Ryan Leung
286f377389 button-hotplug: add KEY_SETUP and KEY_VENDOR handling
Add KEY_SETUP and KEY_VENDOR keys. Many Rockchip devices, including all of those in
e13cbab684 ("rockchip: enable SARADC; add buttons hotplug and ADC kmods to default packages")
have one or both of these buttons.

Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23396
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-18 12:56:33 +02:00
Daniel Golle
a04aed6795 kernel: other: no longer package OSLEC for Linux 6.18
OSLEC has been dropped upstream since Linux 6.16.

Reflect that by no longer providing the kernel module package
`kmod-echo` which essentially became an empty stub.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-05-17 13:29:47 +01:00
Andrii Kuiukoff
eeaafc5ae2 uboot-mediatek: comfast cf-wr632ax: sync with the main DTS
- Sync shared U-Boot DTS nodes with the main device DTS
- Remove duplicate strings

Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22929
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 13:04:23 +02:00
Andrii Kuiukoff
9fb9983467 uboot-mediatek: comfast cf-wr632ax: reduce ram speed to 1866 MT/s
Fix instability by reducing RAM speed to 1866 MT/s
in line with Winbond W634GU6RB-11 specs.

Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22929
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-17 13:04:23 +02:00
Florian Eckert
10d9dbe838 build: add CycloneDX SBOM processing to apk
Currently, there is no SBOM generation in imagebuilder when the package
system 'apk' is used. This commit adds this feature back. This already
worked for the package system 'opkg'.

Furthermore, generating the SBOM using perl is not reproducible if the
input data has not changed. A different file is always generated. This is
not the case with Python. For this reason, Python is now used to generate
the SBOM for the imagebuilder.

The script has already been prepared so that it can also process the opkg
package system for generating the SBOM.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
2026-05-17 12:21:09 +02:00
Hauke Mehrtens
6a608bcf4e uhttpd: update to Git HEAD (2026-05-15)
d2551871b5e5 client: prevent transfer_chunked counter overflow
07f0afb3bf91 client: match Host and URL attributes exactly in tls_redirect_check
05406f70d05c file: scan all entries when matching If-Match / If-None-Match
81527e1f7630 proc: restore default SIGPIPE disposition in spawned child
0df62571f158 ucode: initialize module search path only once
05317bf30a94 proc: store CGI Status message per-client instead of in a shared buffer
1781b6dec414 utils, client: cast char to unsigned before passing to ctype functions
4221eb8b33ea file: respond 500 on uh_handle_alias OOM
8e5b26f93798 file: distinguish parse failure from epoch in date precondition checks
ced7b15c3467 utils: fix one-byte overflow in uh_urldecode
53e7150619a3 file: bail out of file_write_cb on read error
93432149a7ae utils: remove unreachable return statement in uh_addr_rfc1918
add5389470f0 utils: fix off-by-one out-of-bounds read in uh_b64decode
778ccbbf5f8a main: fix daemonization stdio redirection and fd leak
2c869c094c25 client: parse Content-Length safely
9404e6c62bb7 client: parse chunked transfer chunk size safely
b33ca5d37718 auth: do not accept stored crypt hash as plaintext password
6fadf0da5050 auth: replace strcmp with constant-time password comparison

Link: https://github.com/openwrt/openwrt/pull/23379
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-16 00:47:41 +02:00
Stefan Kalscheuer
decb778ed3 uboot-mvebu: update to version 2026.04
Update package to the latest stable version.
Patches unchanged.

Signed-off-by: Stefan Kalscheuer <stefan@stklcode.de>
Link: https://github.com/openwrt/openwrt/pull/23369
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-15 20:59:47 +02:00
David Han
8d844758c2 mediatek: filogic: add support for netis MEX605
This commit adds support for the netis MEX605, which is a variant based on the netis NX30 V2.
1. Update brand naming from Netis to netis to follow the official branding.
2. Rename NX30V2 to NX30 V2 to correctly reflect it as the second version of the NX30.
3. Update variant notation for consistency.

cherry picked from commit c982357
1. Add 'model' to the DTS for netis NX30 V2 and define WiFi LED.
4. Fix typo.

Signed-off-by: Zhiwei Cao <bfdeh@126.com>
Signed-off-by: David Han <h96643864@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22726
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-14 23:07:00 +02:00
Andy Chiang
9cb54a2c4c kernel: r8168: update to v8.056.02
Changelog: https://github.com/openwrt/rtl8168/compare/8.055.00...8.056.02

Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23201
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-14 21:19:22 +02:00
Raylynn Knight
80eeb316a6 x86/base-files + kernel/modules: improve Dell Edge620/640/680 support
This improves on openwrt/openwrt@aeb9028aab by adding support for
other Dell EMC Edge620/640/680 devices and mapping
the interfaces to match the markings on the device.

This modifies the netdevices.mk file to set the boot flag for
ixgbe driver to load it in early stage of the boot process to
allow for proper mapping of the network interface PCI paths
inside the 02_network script. This will also allow other devices
using the ixgbe driver to do proper mapping in 02_network script.
The 02_network script is then modified to support all
dell-emc-620/640/680 devices.  It now maps the network
interfaces via PCI paths to match the markings on the device.
The interface marked GE6 is still used for WAN with
interfaces GE1-GE5 used for LAN.

The SFP1 and SFP2 interfaces are left to be assigned by
the user.

Signed-off-by: Raylynn Knight <rayknight@me.com>
Link: https://github.com/openwrt/openwrt/pull/23110
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-14 20:59:20 +02:00
Qingfang Deng
54d2b5d779 ntfs: update to 2026-05-03
Update to the latest version.

Changes:
- fix NULL dereference in ntfs_index_walk_down()
- fix WSL symlink target leak on reparse failure
- conditionally enable POSIX ACL
- fix error handling in ntfs_write_iomap_end_resident()
- fix VCN overflow in ntfs_mapping_pairs_decompress()
- drop nlink once for WIN32/DOS aliases
- fix invalid PTR_ERR() usage in __ntfs_bitmap_set_bits_in_run()
- Use return instead of goto in ntfs_mapping_pairs_decompress()

Removed upstreamed patch:
- 001-conditionally-enable-posix-acl.patch

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23292
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-14 19:05:45 +02:00
Ryan Leung
f9dd769052 rockchip: add support for FriendlyELEC NanoPi M5
Ethernet LAN port is set to `eth1` (silkscreen "ETH2" and case label "2") next to the 2x USB Type-A
ports and WAN is set to `eth0` (silkscreen "ETH1" and case label "1") next to the USB Type-C port.

The USER ("reset") button serves as the reset button. A short press will reboot and a long press
will reset to factory settings (deleting all data) if using squashfs image.

MASK ("maskrom") and RCRY ("recovery") buttons are enabled but are not set to any specific function

Pressing the POWER button will `poweroff` the device and it will stay off until a power cycle.

Hardware
---------------
* SoC: RockChip RK3576 64-bit ARMv8-A 8 cores big.LITTLE (4x A72 and 4x A53)
* RAM: 3/4GB LPDDR4X or 8/16GB LPDDR5
* Ethernet: 2x GbE (SoC RGMII MAC, RTL8211F PHY)
* 3x LEDs (SYS - red / 1 (WAN) - green / 2 (LAN) - green)
* 4x Buttons (MASK ("maskrom"), RCRY ("recovery"), USER ("reset" - OpenWrt reset), POWER)
* 1x 16MiB SPI NOR on board
* 1x UFS slot for optional UFS 2.0 module (currently not supported)
* 1x microSD card slot (UHS-I)
* 1x HDMI OUT
* 1x Headphone OUT 3.5mm
* 1x M.2 M-key 2280 PCIe slot (PCIe 2.1 x1 supports NVMe SSD)
* 1x M.2 E-key *SDIO* slot for optional RTL8822CS Wi-Fi 5
 * the case has integrated antennae as well as 2x knockouts
 * the device tree is missing the nodes relevant to Wi-Fi operations so it's not supported for now.
* 2x USB 3.2 Gen 1 Type-A Ports
* Power: 1x USB Type-C 6V-20V with both DC and USB PD supported
* Serial: 1500000 8N1 3.3V - 2.54mm 3-pin header next to HDMI

MAC addresses
---------------
WAN (`eth0` case label "1"): generated from /sys/.../mmcblk0/cid (CID of SD card)
LAN (`eth1` case label "2"): WAN + 1

Installation
---------------
Decompress the archive of the OpenWrt sysupgrade image and write it to a microSD card using `dd`
or use Balena Etcher (no need to decompress).

Boot
---------------
Insert microSD card, set boot switch to "UFS/SD" and then supply power.

Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23008
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-14 17:52:56 +02:00
Ryan Leung
54e47e56c2 uboot-rockchip: fix boot from SD card for rk3576
Apply pending U-Boot patches so that Rockchip RK3576 devices can boot from SD card. The problem:
"The BootROM on RK3576 has an issue loading boot images from an SD-card. This issue can be worked
around by injecting an initial boot image before TPL…and return to BootROM to load next image, TPL"

Compilation of the initial boot image has been added to the U-Boot build recipe.

Tested on FriendlyELEC NanoPi M5

Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23008
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-14 17:52:56 +02:00
Ryan Leung
e13cbab684 rockchip: enable SARADC; add buttons hotplug and ADC kmods to default packages
Select `CONFIG_ROCKCHIP_SARADC=y` to enable Rockchip SAR ADC

Add ADC Ladder Buttons driver as a kernel module as well as `kmod-button-hotplug` to the list of
default packages for Rockchip targets that have buttons connected to ADC, not including some
devices (e.g. NanoPi R76S) that have ADC buttons which are not in the device tree.

This is needed to use buttons on Rockchip devices that are connected to ADC and not GPIO

Tested on FriendlyELEC NanoPi M5

Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23008
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-14 17:52:56 +02:00
Mikhail Zhilkin
f3a891e560 uboot-mediatek: fix bl2 dependency for Qihoo 360T7
This commit fixes wrong bl2 dependency which leads to build errors if
non-ubi ddr3-1866 bl2 is not exists in the build dir.

Fixes: 9a87c4b ("uboot-mediatek: add Qihoo 360T7 (UBI) support")
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23354
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-14 11:41:52 +02:00
Hannu Nyman
dc04999b1f dnsmasq: apply six CVE-fix upstream patches to 2.92
Apply upstream patches for the recently published CVEs in dnsmasq.

Source: https://thekelleys.org.uk/dnsmasq/CVE/
Reference: https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/23330
[Added this to main branch first]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-13 01:51:56 +02:00
Shiji Yang
348303a9e2 mt76: build mt7622-firmware only for mt7622 sub-target
kmod-mt7622-firmware package is only used by mt7622 SoC builtin WiFi.

Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/22495
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-12 09:34:32 +02:00
Roberto Almeida Silva
530d27a118 wireguard-tools: increase watchdog idle timeout to 180s
The current 150s watchdog timeout is too aggressive, leading to
premature hostname re-resolution on alive connections.

Even with a 25s keepalive, handshakes may not occur within the 150s window.
Increasing the timeout to 180s aligns the watchdog with WireGuard's
REJECT_AFTER_TIME constant, ensuring we only re-resolve when the connection
is truly considered dead.

Signed-off-by: Roberto Almeida Silva <robertoalmeidasilva1981@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23248
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-12 09:23:35 +02:00
Russell Senior
ee771d3dd0 airoha: increase the size of reserved_bmt partition
The vendor firmware checks for a bmt header in the last 528 erase blocks
of flash. The OpenWrt partition table did not respect that requirement,
and therefore the vendor and openwrt chainloader fight over those blocks
on every boot, potentially corrupting data stored in UBI blocks there.
This commit increases the size of the reserved_bmt partition to avoid
that fight.

Although the vendor bootloader only seems to touch the final 250 erase
blocks[1], the original vendor firmware system partition ended at
0x1be00000[2], so to be conservative, the consensus is to use that as
the end of mtd2 (ubi) partition and leave the last 528 blocks for mtd3
(reserved_bmt).

From https://openwrt.org/toh/gemtek/mxf-w1700k:
[1] OEM bootlog: [    5.324337] bmt pool size: 250
[2] OEM bootlog: [    5.478927] 0x000008600000-0x00001be00000 : "system"

Adds a compat_version to warn users to re-install to accomodate the
shrunken mtd2 ubi partition.

Fixed two nits suggested by Claude, zero padding a hex value and removed
an extra space.

Removed the wildcard setting of compat_version for other boards, as
suggested by Robert Marko, set compat_version only for the w1700k.

Reported-by: Loïc Yhuel <loic.yhuel@gmail.com>
Signed-off-by: Russell Senior <russell@personaltelco.net>
Link: https://github.com/openwrt/openwrt/pull/23061
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-11 14:43:01 +02:00
Paul Spooren
ff16e61084 uhttpd: update to Git HEAD (2026-04-21)
506e24987b97 ubus: unregister ubus subscriber on HTTP client disconnect
e619cb04cddb client: use base-10 parsing for Content-Length header

While at it, use SPDX license tags

Fixes: https://github.com/openwrt/uhttpd/issues/1
Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/23029
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-11 01:20:49 +02:00
Hauke Mehrtens
6421a596a6 libubox: update to Git HEAD (2026-05-03)
895f92164b66 uloop: add ULOOP_PRIORITY support for EPOLLPRI events
f9b1f3ff17ba uloop: revert my flag changes from the ULOOP_PRIORITY change
2982bfb1c325 blob: fix wrong type for realloc result in blob_buffer_grow()
78c20f6c8579 json_script: convert recursive __json_script_file_free() to iterative
e7c13bf8cbca usock: fix off-by-one in nanosecond normalization in poll_restart()
68b3f1588de4 uloop: usock: add error checking for fcntl and remove duplicate include
03821f942c49 uloop: fix undefined behavior in signal bit operations for signals > 32
e6e6fd83e26d blobmsg: fix policy name length overflow and add bounds check in blobmsg_parse()
d30b9cc1a02d usock: fix integer overflow in timeout calculations
406e342bb900 udebug: fix double off-by-one in udebug_entry_vprintf()
700eca0bac66 blobmsg_json: fix integer overflow in blobmsg_puts()
6351fe552162 blobmsg_json: floor strbuf size and tighten the post-format guard
58b6543f1b25 blobmsg: fix unsigned integer overflow in blobmsg_alloc_string_buffer()
d7a3ae699df0 blobmsg: use correct byte-order macro when setting BLOB_ATTR_EXTENDED
23c6618a5b90 blobmsg_json: fix double format string to avoid truncation and data loss
1edf1d704e76 jshn: fix integer overflow and type confusion in jshn_parse_file
9b488010c4a7 utils: fix integer overflow in __calloc_a()
40a87f734b94 blob: fix integer overflow in buffer growth functions
02fccb465651 blob: use size_t for blob_memdup() length
0fa612ca08f7 json_script: avoid alloca() on attacker-controlled pattern length
8c9862b6921b blobmsg: fix integer overflow in blobmsg_realloc_string_buffer()
5fbef5bb94fb ustream: avoid INT_MAX overflow on malloc in ustream_vprintf()
1501e60e5554 md5: detect read errors in md5sum() instead of returning a bogus hash

Link: https://github.com/openwrt/openwrt/pull/23212
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-11 01:16:43 +02:00
Mieczyslaw Nalewaj
4e26edb2e3 kernel: sound: fix kmod-sound-midi2 packaging
kmod-sound-midi2 expects sound/core/snd-ump.ko, but
CONFIG_SND_UMP=y builds it in-kernel rather than as
a module. Replace the forced built-in setting with
plain CONFIG_SND_UMP so the module can be packaged
correctly.

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/23265
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-10 12:45:41 +02:00
Mikhail Zhilkin
b7af9b49f8 mediatek: add support for Qihoo 360T7 (UBI layout)
This commit adds support for Qihoo 360T7 (UBI layout).

Aims
----
1. +20 MB additional free space for the packages
2. More reliable storage for the factory and fip partitions (in UBI)

Install (from non-UBI OpenWrt)
------------------------------
1. Navigate http://192.168.1.1/ and download mtd backups
2. Upgrade OpenWrt with installer initramfs image (force upgrade, don't
   keep settings). Wait until OpenWrt reboots and until installer:
   - Prepare new factory partition
   - Format new ubi
   - Make ubi volumes
   - Write new fip and bl2
3. Navigate http://192.168.1.1/ and Upgrade with OpenWrt 'sysupgrade.bin'
   image (don't keep settings)

Installer
---------
Based on OpenWrt UBI Installer Image Generator for Linksys E8450 and
Belkin RT3200
Link: https://github.com/dangowrt/owrt-ubi-installer

Ready installer image
Link: https://github.com/csharper2005/owrt-ubi-installer/tree/qihoo/bin

Installer script
Link: https://github.com/csharper2005/owrt-ubi-installer/blob/qihoo/files/
installer/install.sh

Committing to the parent Daniel's repository is not yet possible because
there are no official images and imagebuilder for Qihoo 360T7 (UBI) yet.

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22797
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-09 15:42:27 +02:00
Mikhail Zhilkin
9a87c4b768 uboot-mediatek: add Qihoo 360T7 (UBI) support
This commit adds U-Boot for Qihoo 360T7 (UBI layout).

Aims:
1. +20 MB additional free space for the packages;
2. More reliable storage for the factory and fip partitions (in UBI).

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22797
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-09 15:42:26 +02:00
Mikhail Zhilkin
d45840e0a8 atf-mediatek: add mt7981 UBI DDR3-1866 build
The mt7981 UBI DDR3-1866 build is required for Qihoo 360T7 (UBI).

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22797
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-09 15:42:26 +02:00
Mikhail Zhilkin
2f4a052260 mediatek: filogic: Qihoo 360T7: fix DDR3 rate
According to the datasheet GigaDevice GDP1BFLM-CB is 1866 Mbps DDR3 chip.
This commit reduces DDR3 rate from 2133 to 1866 Mbps.

Link: https://static6.arrow.com/aropdfconversion/c24b4942a41810a1c921df04a
99d72101eb8cd30/ds-00843-gdp1bflm-rev1.0.pdf
Fixes: c51eb17 ("uboot-mediatek: add Qihoo 360T7 support")
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22797
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-09 15:42:26 +02:00
Zoltan HERPAI
716661d562 sunxi: add T113-S3 support
The Allwinner T113-s3 (sun8i) SoC features a dual-core Cortex-A7 ARM CPU and
128MB of DDR3 memory in the same physical package. It supports industrial
temperature ranges. Most of the IP blocks are shared with the D1/D1s core.
There are multiple variants of the SoC, which may vary in the included memory
size, with some of them including a C906 RISC-V co-processor.

Boards supported:
 - MangoPi MQDual T113
   - wireless-only (RTL8723DS)

 - MYIR MYD-YT113 eMMC
   - 1Gbit ethernet (Motorcomm YT8531 PHY)
   - 4GByte eMMC
   - M.2-type slot for 4G/5G cards, plus 2x SIM slot
   - USB 2.0 ports
   - GPIO/I2C/SPI/CAN ports
   - FNLink 6131 (rtl8733bu) wifi module

 - MYIR MYD-YT113 SPI
   - Same as above but with 256Mbyte SPI-NAND flash instead of eMMC

 - Rongpin RP-T113
   - 100Mbit ethernet (ICplus IP101GR PHY)
   - miniPCIe slot for 4G cards, plus 1x SIM slot
   - 3x USB 2.0 ports
   - RTL8723BS wireless
   - HYM8563 RTC
   - GPIO/I2C/SPI/CAN ports

 - Olimex T113-Olinuxino
   - 100Mbit ethernet (ICplus IP101GR)
   - UEXT connector (GPIO/I2C/SPI ports)
   - 1x USB 2.0
   - audio jack, LEDC

Installation:
Use the standard sunxi installation to an SD-card.

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2026-05-09 11:19:22 +02:00
Til Kaiser
ed3e2178af kernel: lantiq: vrx518_tc: replace EXTRA_CFLAGS with ccflags-y
Replace EXTRA_CFLAGS with ccflags-y to fix builds on Linux 6.18.

Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://github.com/openwrt/openwrt/pull/22930
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-05-09 00:23:52 +02:00
Til Kaiser
0ddad1a593 kernel: lantiq: vrx518_ep: replace EXTRA_CFLAGS with ccflags-y
Replace EXTRA_CFLAGS with ccflags-y to fix builds on Linux 6.18.

Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://github.com/openwrt/openwrt/pull/22930
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-05-09 00:23:52 +02:00
Wei-Ting Yang
febc349ab4 libmnl: assign PKG_LICENSE_FILES
Ref: https://git.netfilter.org/libmnl/tree/COPYING

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23257
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-08 10:22:40 +02:00
Sander Schutten
472c325fb8 intel-microcode: fix dirty build
rebuilding x86 did fail in an existing build directory
mkdir fails if the folder exists already

Signed-off-by: Sander Schutten <schutten@hotmail.com>
Signed-off-by: Florian Maurer <fmaurer@disroot.org>
2026-05-07 21:14:08 +02:00
Florian Maurer
8810ecd5ed wifi-scripts: fix basic_rate mapping in supplicant ucode
The ucode migration wrote "basic_rate" into the wpa_supplicant network
block, but that is not a valid wpa_supplicant network field, causing:

  Line 15: unknown network field 'basic_rate'.
  failed to parse network block.

Map UCI basic_rate to the correct wpa_supplicant fields, matching the
behavior of the legacy shell script (hostapd.sh):

  - mesh mode:  mesh_basic_rates (space-separated, 100 kb/s units)
  - sta/adhoc:  rates            (comma-separated Mbps)

Link: a854d833ea

Signed-off-by: Florian Maurer <f.maurer@outlook.de>
[fix commit message link]
Signed-off-by: David Bauer <mail@david-bauer.net>
2026-05-07 21:11:43 +02:00
Michael Pfeifroth
ab8cebbc97 pcre2: fix PKG_LICENSE_FILES after upstream rename
PCRE2 10.47 renamed LICENCE to LICENCE.md. Update PKG_LICENSE_FILES
to match the actual filename in the source tarball.

Signed-off-by: Michael Pfeifroth <michael.pfeifroth@westermo.com>
Link: https://github.com/openwrt/openwrt/pull/23164
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-07 18:20:24 +02:00
Christoph Krapp
695d41c49c ipq-wifi: fix sorting
Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23216
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-07 11:12:15 +02:00
Christoph Krapp
8b68067e14 ipq-wifi/ath10k: fix 5GHz radio detection on TP-Link EAP225-Wall v2
Add IPQ Wifi entry for ath79 TP-Link EAP225-Wall v2.

Signed-off-by: Christoph Krapp <achterin@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23216
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-07 11:12:14 +02:00
Robert Marko
56ee07b8e2 ipq-wifi: update to Git HEAD (2026-05-05)
fc4cf4873873 qca9888: add TP-Link EAP225-Wall v2 BDF

Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-07 11:11:06 +02:00
Andre Heider
e3271a6786 treewide: remove unused archs leftovers
These are all unused by the current targets, clean up and stop
irritating the user with irrelevant grep results.

Signed-off-by: Andre Heider <a.heider@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23240
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-07 10:58:47 +02:00
Edward Chow
65a57d7159 mpc85xx: ws-ap3715i: enable access to u-boot env
find_mtd_part() outputs /dev/mtdblockX, to which fw_setenv cannot
write, "/dev/mtd$(find_mtd_index '<vol name>')" could be used instead.

The envsize should also be changed to 0x1000 to make the CRC checksum
valid and the env block recognized by the uboot-envtools, but the
flash sector size remains 0x10000, otherwise the env block will be
readable but not writable.

The "read-only" mark within device tree is also removed.

Signed-off-by: Edward Chow <equu@openmail.cc>
Link: https://github.com/openwrt/openwrt/pull/23121
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-05 14:09:38 +02:00
Magnus Kroken
e65001e3e7 mbedtls: backport upstream patches to fix TLS 1.2 client issues
Fix a TLS 1.2 regression that caused clients to reject valid
ServerKeyExchange signatures using RSA-PSS signature algorithms.

The TLS 1.2 regression resulted in errors like:
$ curl https://api.domeneshop.no/v0/
curl: (35) ssl_handshake returned: (-0x6600) SSL - A field in a message was incorrect or inconsistent with other fields

Fixes: https://github.com/openwrt/openwrt/issues/22874
Fixes: https://github.com/openwrt/openwrt/issues/23116
Fixes: f48ef0040b ("mbedtls: update to 3.6.6")
Signed-off-by: Magnus Kroken <mkroken@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23066
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-05 00:27:58 +02:00
Felix Fietkau
a6969351a7 hostapd: clear start_disabled when adding a BSS to an enabled iface
In AP+STA mode, wifi-scripts emits start_disabled=1 in the per-BSS
section of the generated hostapd config so that hostapd defers
beaconing on every BSS until apsta_state up clears the flag for the
whole iface (uc_hostapd_iface_start clears start_disabled on every BSS
and calls ieee802_11_set_beacon).

When a new BSS is added later via iface.add_bss while the iface is
already in HAPD_IFACE_ENABLED state, the freshly parsed config still
carries start_disabled=1 for that BSS. hostapd_setup_bss is invoked
with start_beacon=true, but hostapd_start_beacon then skips
ieee802_11_set_beacon because conf->start_disabled is set. The kernel
netdev is created without ever starting beacons, the carrier never
comes up, and probe-response transmission attempts fail with
"handle_probe_req: send failed".

Mirror what iface.start does: when the iface is already enabled, the
apsta channel selection has happened, so clear start_disabled for the
incoming BSS before starting it.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-04 16:29:37 +02:00
Felix Fietkau
a86da0bd1e hostapd: emit ubus key-mismatch event for SAE confirm failures
Surface SAE confirm mismatches (wrong password) through the same
key-mismatch ubus notification that is already used for PSK failures, so
consumers can react uniformly regardless of the authentication method.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-04 16:29:37 +02:00
Felix Fietkau
94fc66cce9 hostapd: avoid spurious interface reload on empty MLD config
mld_set_config() treated any call with empty prev_mld as a fresh
configuration and triggered a full Reload all interfaces, even when the
new config was also empty (the typical path on non-MLD devices).
Reloading every BSS on each netifd reconf disrupted associated stations
including PMF-protected backhaul STAs, which would self-deauth after the
SA Query timeout.

Only treat the call as a new configuration when the new config is
actually non-empty.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-04 16:29:36 +02:00
Felix Fietkau
572fb14e7e kernel: remove ax25
It is going away upstream and it's highly unlikely that there are any
users left.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-04 16:29:36 +02:00
Felix Fietkau
4ae4759e0b ucode: update to Git HEAD (2026-04-24)
3d999b21f4ba socket: add include for older kernels
552ca3cf55ed compiler: allow export function declarations without trailing semicolon
d9e24e4ad13d compiler: add function forward declaration syntax
de986520017a fs: add statvfs flags and fs error codes
e6bf0a9dca79 nl80211: fix listener.request() dropping multicast events
520d9f4c8781 nl80211: fix waitfor() busy-spinning on non-blocking event socket
05328e33f078 nl80211: fix memory leak in waitfor() on repeated matching events
e4a165976dbb nl80211: don't report waitfor() match on event parse failure
57367e880e9d nl80211: add missing survey info attributes
a39b74fe329e nl80211: fix dfs_cac_time attribute type
beafcff845fc compiler, lib, resolv: fix const string pointers
4170c8dcc568 lib: fix system() inheriting blocked SIGCHLD mask in child process
d2c74298e22d fs: document glob
8a8b4d12a867 types: fix regexp `/.../s` flag inversion
d7bc7adcb99d lib: slightly expand regexp() JSDoc
826fbfef2df9 nl80211: fix HE MCS set parsing
617967a3ceb9 socket: strip brackets from IPv6 addresses in addrinfo()
a078b72a90bb socket: increase IPv6 scope ID buffer to support 15-char interface names
ed23cf5aa182 rtnl, nl80211: fix segfault when listener.close() is called explicitly
3e585662394b docs: add function forward declarations to syntax tutorial
bda4a0e454de vm: free thread context on vm_free to prevent memory leak
13158a73c96b nl80211: get iftype extended capabilites
30ffbd6c07dc ubus: add module documentation
ce0c8fc0ffea docs: spelling fixes and usage notes
35a74e92ad69 docs: rewrite ubus module intro to expand pub/sub and fix OpenWrt capitalization
b3380068a7e1 docs: flatten ubus class hierarchy and fix capitalization
3c9d3b5272d7 docs: math: fix spelling mistakes in documentation
aae2250ab519 fs: fix popen() documentation
eff52f0d262a digest: implement FNV-1a 64 bit hash algorithm
35ed1d1efd64 ubus: fix refcounting bug
c7e7dfa7b64a ubus: avoid double close of externally owned channel fds
896ac72caffb tests: make run_tests.uc default to build/
b50372e8e8a0 tests: implement automatic library test skipping
81066c54a07f math: degrees <-> radians convertors
388ef3f35e0a ubus: drop unconditional garbage collection calls
aebdb2c0262e main: fix option argument parsing on glibc

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-04 16:29:36 +02:00
Hauke Mehrtens
bcaa6a8367 mac80211: bump to version 6.18.26
This contains many fixes from upstream Linux.

The code block from this patch was moved a bit in the function:
  subsys/110-mac80211_keep_keys_on_stop_ap.patch

This patch was applied upstream:
  subsys/330-mac80211-fix-crash-in-ieee80211_chan_bw_change-for-A.patch

Link: https://github.com/openwrt/openwrt/pull/23167
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-03 17:23:16 +02:00
INAGAKI Hiroshi
c7aa06da9d uboot-tools: envtools: add support for ELECOM WRC-X6000GSD
Add support for ELECOM WRC-X6000GSD, to update U-Boot environment
variables.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22926
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-03 01:14:11 +02:00
INAGAKI Hiroshi
7970a6841e uboot-tools: envtools: add support for ELECOM WRC-X6000QS
Add support for ELECOM WRC-X6000QS, to update U-Boot environment
variables.

Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22926
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-03 01:14:11 +02:00
Hauke Mehrtens
164428d2d6 iw: backport scan print of RSN Element Override IEs
Backport upstream iw commit d90618809e06 ("iw: scan: print RSN
Element Override IEs") as 001-*.patch so `iw scan` decodes the
RSNOE (vendor WFA type 41) and RSNO2E (type 42) elements that
hostapd emits for WPA3 Compatibility / RSN Overriding APs.

Also refresh the hunk offsets in 200-reduce_size.patch.

Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:22 +02:00
Hauke Mehrtens
957b921721 iw: fix IW_FULL guards in size reduction patch
Two of the IW_FULL guards in 200-reduce_size.patch were inverted
or incomplete:

 * the "unknown event" handler unconditionally replaced the
   verbose print with the short form, so IW_FULL builds lost
   the command name decoding;
 * the early return before the vendor IE parser used
   #ifdef IW_FULL, which suppressed parsing in the full build
   instead of the size-reduced one.

Wrap both with the correct #ifndef IW_FULL / #else so the full
and reduced builds produce the intended output.

Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:22 +02:00
Hauke Mehrtens
0ca11b32eb wifi-scripts: ucode: default sae_groups to NIST ECP 19/20/21
The WPA3 and Wi-Fi Enhanced Open Deployment Guide v1.1 (Table 4,
"SAE Groups") recommends that WPA3-Personal APs advertise support
for SAE groups 19, 20 and 21:

  * group 19 - ECP 256-bit (NIST P-256)
  * group 20 - ECP 384-bit (NIST P-384)
  * group 21 - ECP 521-bit (NIST P-521)

hostapd's default is group 19 only, which leaves the two larger
ECP groups unavailable even though the peer may prefer them.

Set sae_groups = "19 20 21" as the default for any BSS whose
auth_type is sae or psk-sae (SAE, SAE Transition and SAE
Compatibility modes).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:22 +02:00
Hauke Mehrtens
68165c85c8 wifi-scripts: ucode: default BIP cipher from wpa_pairwise
The WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide
v1.1 (Tables 4, 5, 6) requires the group-management cipher (BIP) to
match the mode and strength of the pairwise cipher: GCM-mode pairwise
ciphers pair with BIP-GMAC integrity, CCM-mode pairwise ciphers with
BIP-CMAC integrity.  The ucode pipeline hard-coded group_mgmt_cipher
to AES-128-CMAC (BIP-CMAC-128) regardless of the pairwise cipher,
except for the eap192 special case that already forced BIP-GMAC-256.
An EHT WPA3-Personal BSS therefore emitted wpa_pairwise=GCMP-256
alongside group_mgmt_cipher=AES-128-CMAC -- the integrity cipher two
steps weaker than the data cipher and a spec violation on EHT.

hostapd has a single group_mgmt_cipher knob, so the selected BIP has
to be compatible with every pairwise cipher in wpa_pairwise.  Picking
from the first token would mis-select on mixed lists -- e.g.
wpa_pairwise=\"GCMP-256 CCMP\" would yield BIP-GMAC-256, which a
CCMP-only STA cannot negotiate.

Walk the wpa_pairwise tokens and pick the BIP that matches the
weakest cipher present:

  CCMP / TKIP -> AES-128-CMAC (BIP-CMAC-128)
  CCMP-256    -> BIP-CMAC-256
  GCMP        -> BIP-GMAC-128
  GCMP-256    -> BIP-GMAC-256

Token matching uses fnmatch wildcards against a copy of wpa_pairwise
that is padded with leading and trailing spaces, so each token is
space-bounded regardless of its position in the list.

The RSN override pairwise lists are not consulted: in the only
caller that sets them (WPA3-Personal Compatibility Mode), Tables 6
and 7 require BIP-CMAC-128 across RSNE/RSNOE/RSNO2E even when the
override lists advertise GCMP-256, so wpa_pairwise=CCMP already
yields the correct BIP.

An explicit ieee80211w_mgmt_cipher UCI value still wins over the
derived default.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:22 +02:00
Hauke Mehrtens
2db148c062 wifi-scripts: ucode: advertise Transition Disable on WPA3-only BSSes
WPA3 Specification v3.5 §13 defines the Transition Disable element sent
inside message 3 of the 4-way handshake.  An AP that is no longer
offering a transition mode for its SSID sets the matching bit so that
compliant STAs permanently stop falling back to WPA-PSK / WPA-EAP /
open for that SSID, hardening against downgrade attacks and against
operator mistakes where a transition-mode BSS is briefly brought up on
an SSID that previously ran WPA3-only.

Expose this as a UCI list 'transition_disable' with three classes of
entries:

  * The existing OpenWrt encryption tokens 'sae' (bit 0x01), 'sae-pk'
    (0x02), 'wpa3' (0x04) and 'owe' (0x08) OR into the bitmap.  SAE-PK
    itself is not yet wired through wifi-scripts; the token only lets
    an operator who configured SAE-PK out of band also hand the
    matching bit to hostapd.

  * 'on' derives the bitmap from the AP's auth_type ('sae' -> 0x01,
    'eap2'/'eap192' -> 0x04, pure 'owe' -> 0x08) and overrides any
    other explicit tokens in the same list.  Transition BSSes
    (psk-sae, eap-eap2, owe with owe_transition set) produce no
    bits even under 'on' because they are by definition still in
    transition.

  * 'off' unconditionally suppresses the element regardless of any
    other entries.  Operators who need to revert a WPA3-only SSID back
    to a transition mode can set this proactively, giving compliant
    STAs time to forget the permanent bit before the mode change.

Leave the list unset by default.  Advertising Transition Disable is a
one-way door -- once a compliant STA has seen the permanent bit for an
SSID it will refuse to associate to a transition-mode BSS of the same
name ever again -- so it must be opted in to per SSID, never flipped
on by a firmware bump.  This also matches the WPA3 and Wi-Fi Enhanced
Open Deployment and Implementation Guide v1.1 Table 4 requirement that
Transition Disable be MAND disabled by default on APs.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:22 +02:00
Hauke Mehrtens
3b22050040 wifi-scripts: ucode: default sae_pwe to H2E-only on 6 GHz
The WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide
v1.1 (Tables 7 and 8) mandates "H2E Only" for SAE on 6 GHz, in both
WPA3-Personal Only and WPA3-Personal Compatibility Mode: the 6 GHz
band disallows the legacy Hunting-and-Pecking password element, so
the AP must advertise BSS Membership Selector 123 to force STAs onto
H2E.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:22 +02:00
Hauke Mehrtens
86b9eec8f0 wifi-scripts: ucode: add WPA3-Personal Compatibility Mode
The WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide
v1.1 §2.4 (Tables 6 and 7) defines WPA3-Personal Compatibility Mode:
the AP advertises a legacy-looking RSNE (WPA-PSK, CCMP-128, PMF
Disabled) while RSN Override Elements layered on top expose SAE and,
on EHT, SAE-EXT-KEY.  WPA2-only STAs and STAs that ignore RSN
Overriding associate unchanged; modern STAs pick up the stronger WPA3
AKM via RSNOE or RSNO2E.

Only the pairwise cipher differs between elements: RSNE and RSNOE
advertise CCMP-128, RSNO2E advertises GCMP-256 (EHT only).  Group
data (CCMP-128) and group management cipher (BIP-CMAC-128) are the
same in all three per Tables 6/7, so hostapd's BSS-wide group_cipher
and group_mgmt_cipher singletons produce the spec-correct values.

Unlike WPA3-Personal Transition Mode (sae-mixed), which puts PSK and
SAE together in the main RSNE with PMF Capable, Compatibility Mode
keeps the main RSNE strictly WPA2-shaped so clients that choke on a
mixed AKM list or PMF=Capable still see a pure WPA2 BSS.  The trade-
off is that clients without RSN Overriding support never pick up SAE.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:22 +02:00
Hauke Mehrtens
ef393caee2 wifi-scripts: ucode: enable Beacon Protection by default with PMF
The WPA3 and Wi-Fi Enhanced Open Deployment and Implementation Guide
v1.1, Table 4 (Common security configuration) marks Beacon Protection
as MAND for EHT-enabled APs and RECOM otherwise for all WPA3 and
Wi-Fi Enhanced Open modes.

The ucode path blindly passed beacon_prot through from UCI in iface
setup, which ran before encryption and MFP had been configured, and
left hostapd at its insecure default of 0 when the user did not
explicitly opt in.

Default beacon_prot to 1 in iface_mfp after MFP has been confirmed to
be enabled, and emit it there instead of in iface_setup so the option
is only written when PMF support is actually negotiated. Users can
still disable it explicitly via UCI.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:22 +02:00
Hauke Mehrtens
a12cec9ea3 wifi-scripts: ucode: advertise SAE-EXT-KEY AKM alongside SAE
WPA3 Specification v3.5 §2.5.4 mandates that an AP's BSS Configuration
enables AKM suite selector 00-0F-AC:24 (SAE-EXT-KEY, SAE with a
group-dependent hash) whenever EHT or MLO is enabled. The WPA3 and
Wi-Fi Enhanced Open Deployment Guide v1.1 also recommends it on
non-EHT APs (Tables 3, 5, 6, 8).

Add a new sae_ext_key UCI option (enabled by default) that advertises
SAE-EXT-KEY, and FT-SAE-EXT-KEY when 802.11r is enabled, alongside
plain SAE/FT-SAE for the sae and psk-sae encryption modes.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:21 +02:00
Hauke Mehrtens
1f86f4e471 wifi-scripts: ucode: simplify wpa_pairwise default selection
parse_encryption() stashed a preliminary wpa_pairwise value in a
local wpa3_pairwise variable, cleared it per auth_type, then let a
switch default either copy it back or special-case wpa3-192.  The
result was three separate places where wpa_pairwise was clobbered
and behavior that was awkward to trace when the explicit cipher
suffix (encryption[1]) and the auth_type disagreed.

Replace the scaffolding with a single block at the end of
parse_encryption() that only assigns wpa_pairwise via ??= when no
earlier branch (explicit cipher suffix, wpa3-192, or sae-compat)
has already set one:

  no WPA              -> null
  60 GHz (hw_mode=ad) -> GCMP
  HE or EHT htmode    -> GCMP-256 CCMP
  everything else     -> CCMP

wpa3-192 now sets wpa_pairwise='GCMP-256' directly in its switch
case, so the final default block can stay short.  No functional
change for existing encryption values.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:21 +02:00
Hauke Mehrtens
588330e92b wifi-scripts: ucode: drop the generic rsn_override UCI knob
The rsn_override UCI number was scaffolding that let a Transition
Mode BSS (sae-mixed, wpa3-mixed) automatically overlay a WPA3
Compatibility-Mode-like layout: WPA3 AKMs were moved from the main
RSNE into RSNOE/RSNO2E, and with rsn_override=2 the main RSNE even
dropped SAE entirely to placate clients that refuse to associate to
a mixed AKM list.

This layout does not match any mode defined in the WPA3 and Wi-Fi
Enhanced Open Deployment and Implementation Guide v1.1: Transition
Mode (Table 5) advertises the full AKM list in a single RSNE, and
Compatibility Mode (§2.4, Tables 6 and 7) requires a specific
combination of RSNE, RSNOE and RSNO2E contents that the knob cannot
express.  In practice it also triggers interop failures: Pixel 10
phones refuse to associate to a Transition-Mode BSS whose SAE-EXT-KEY
AKM has been shoved into RSNO2E by this scaffolding, even though the
same BSS works fine when the full AKM list stays in the main RSNE.

Keep the generated configuration honest by removing the knob; the RSN
override plumbing stays in place for a future caller that sets the
override fields explicitly.  SAE-EXT-KEY advertisement will be added
back in a later commit via a dedicated sae_ext_key path that places
the AKM where the Deployment Guide actually requires it.

Drop the rsn_override schema entry and every wifi-scripts path that
read it:

  * parse_encryption no longer diverts the WPA3 pairwise cipher
    into rsn_override_pairwise.
  * wpa_key_mgmt no longer mirrors WPA-EAP into
    rsn_override_key_mgmt, moves SAE/SAE-EXT-KEY into the override
    for psk-sae, or drops the main RSNE AKM list when
    rsn_override > 1.
  * generate() no longer back-fills missing rsn_override_* fields
    from the main RSNE or duplicates the override element into an
    MLO-gated RSNO2E.

The RSN override elements are now emitted only when each of
(rsn_override_key_mgmt, rsn_override_pairwise, rsn_override_mfp) --
and their _2 counterparts -- has been populated explicitly, which
keeps the machinery from firing on transition modes where it was
never spec-compliant.

Fixes: https://github.com/openwrt/openwrt/issues/21486
Fixes: https://github.com/openwrt/openwrt/issues/22200
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:21 +02:00
Hauke Mehrtens
9aeea77b8d wifi-scripts: ucode: do not leak SAE options onto non-SAE BSSes
sae_require_mfp and sae_pwe are SAE-specific knobs but iface_auth_type()
set them on every auth type that requires PMF (sae, owe, eap2, eap192,
dpp) and on both PMF-optional transition modes (psk-sae, eap-eap2).
hostapd silently ignores the stray settings on non-SAE BSSes, but they
clutter the generated configuration and make it harder to tell at a
glance which knobs actually apply.

Split the grouping: keep ieee80211w (and rsn_override_mfp for transition
modes) where it was, and move sae_require_mfp / sae_pwe into a separate
check that only fires for the two auth types that actually run SAE (sae
and psk-sae).

No functional change on the air.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/23009
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-02 20:34:21 +02:00
xiao bo
ce7bc7ac22 wireless-regdb: update to version 2026.03.18
Changes:
  update regulatory database based on preceding
  Update regulatory rules for India (IN) on 6GHz
  Replace M2Crypto with cryptography package
  Fix regulatory.bin signing with new

Signed-off-by: xiao bo <peterwillcn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23101
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-04-30 02:10:03 +02:00
Fengyu Wu
403c52db37 ca-certificates: update to 20260223
Debian changelog:

  * Update Mozilla certificate authority bundle to version 2.82
    The following certificate authorities were added (+):
    + TrustAsia TLS ECC Root CA
    + TrustAsia TLS RSA Root CA
    + SwissSign RSA TLS Root CA 2022 - 1
    + OISTE Server Root ECC G1
    +  OISTE Server Root RSA G1
    The following certificate authorities were removed (-):
    - GlobalSign Root CA
    - Entrust.net Premium 2048 Secure Server CA
    - Baltimore CyberTrust Root (closes: #1121936)
    - Comodo AAA Services root
    - XRamp Global CA Root
    - Go Daddy Class 2 CA
    - Starfield Class 2 CA
    - CommScope Public Trust ECC Root-01
    - CommScope Public Trust ECC Root-02
    - CommScope Public Trust RSA Root-01
    - CommScope Public Trust RSA Root-02
  * Use dh_usrlocal to create /usr/local/share/ca-certificates
    (closes: #1127100)

Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23155
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-04-30 00:17:59 +02:00
Ivan Romanov
a6a865e533 dropbear: require busybox pidof applet
The dropbear init script uses pidof, but BusyBox may be built
without it. Add a Kconfig dependency on BUSYBOX_CONFIG_PIDOF
to ensure the applet is available at runtime.

Signed-off-by: Ivan Romanov <drizt72@zoho.eu>
Link: https://github.com/openwrt/openwrt/pull/23128
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-29 10:12:18 +02:00
Ivan Romanov
148830a11d dnsmasq: require busybox pidof applet
The dnsmasq init script uses pidof, but BusyBox may be built
without it. Add a Kconfig dependency on BUSYBOX_CONFIG_PIDOF
to ensure the applet is available at runtime.

Signed-off-by: Ivan Romanov <drizt72@zoho.eu>
Link: https://github.com/openwrt/openwrt/pull/23132
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-29 10:09:20 +02:00
Philip Prindeville
052665be21
dropbear: don't spread conffiles across two packages
For some reason, /etc/config/dropbear is enumerated as a
conffile for dropbear packaging, but /etc/dropbear/ is
part of base-files packaging.  If you're an openssh-server
user, then you don't have this directory on your router in
any case.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Link: https://github.com/openwrt/openwrt/pull/23041
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2026-04-29 09:32:03 +02:00
Mieczyslaw Nalewaj
54cb211d50 ramips: remove hack and use safexcel-eip93ies
Remove legacy hack patch, switch mt7621 crypto node to the intended
Safexcel insecure EIP93 compatible string and simplify crypto module
packaging to use the inside-secure eip93 driver.

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/22871
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-04-28 09:44:04 +02:00
Daniel Golle
da61d63638 netifd: update to Git HEAD (2026-04-23)
e45b890 ethtool: avoid unneeded ioctl
 8c31959 system-linux: gate ethtool reapply on apply_mask
 1375538 device: live-apply pure-sysctl config changes without teardown
 5bddddb device: centralise device-attr diff handling in device_set_config
 18ba5f3 device: realign DEV_OPT_* bits with DEV_ATTR_* enum positions

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-04-28 01:38:08 +01:00
Paweł Owoc
c9a87914a9 modules: video: Fix DRM client lib dependency
Fix dependency for kmod-drm-client-lib module:
error: recursive dependency detected!
	symbol LINUX_6_18 is selected by PACKAGE_kmod-drm-client-lib
	symbol PACKAGE_kmod-drm-client-lib is selected by LINUX_6_18

Fixes: e75ba35ed8 ("modules: video: introduce DRM client setup module")
Signed-off-by: Paweł Owoc <frut3k7@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23124
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-27 14:09:38 +02:00
Alexandru Ardelean
a6cd7ace35 refpolicy: update to 2.20260312
Changelog:
  This release consists mainly of small fixes in the policy.

  New Modules:
  - ofono
  - pd_mapper
  - tee_supplicant
  - xdsprpcd
  - wayland

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Link: https://github.com/openwrt/openwrt/pull/23082
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-27 10:50:54 +02:00
Alexandru Ardelean
bbae0e5c09 secilc: update to 3.10
Release Notes:
https://github.com/SELinuxProject/selinux/wiki/Releases#release-310

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Link: https://github.com/openwrt/openwrt/pull/23082
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-27 10:50:54 +02:00
Alexandru Ardelean
153a2cba71 policycoreutils: update to 3.10
Release Notes:
https://github.com/SELinuxProject/selinux/wiki/Releases#release-310

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Link: https://github.com/openwrt/openwrt/pull/23082
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-27 10:50:53 +02:00
Alexandru Ardelean
e14133919c checkpolicy: update to 3.10
Release Notes:
https://github.com/SELinuxProject/selinux/wiki/Releases#release-310

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Link: https://github.com/openwrt/openwrt/pull/23082
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-27 10:50:53 +02:00
Alexandru Ardelean
589ad78db1 libsemanage: update to 3.10
Release Notes:
https://github.com/SELinuxProject/selinux/wiki/Releases#release-310

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Link: https://github.com/openwrt/openwrt/pull/23082
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-27 10:50:53 +02:00
Alexandru Ardelean
50d79fdb3b libselinux: update to 3.10
Release Notes:
https://github.com/SELinuxProject/selinux/wiki/Releases#release-310

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Link: https://github.com/openwrt/openwrt/pull/23082
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-27 10:50:53 +02:00
Alexandru Ardelean
36870b804d libsepol: update to 3.10
Release Notes:
https://github.com/SELinuxProject/selinux/wiki/Releases#release-310

Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Link: https://github.com/openwrt/openwrt/pull/23082
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-04-27 10:50:53 +02:00
Philip Prindeville
793ceff149 modules: amazon-ena: fix ptp dependency
Going from 6.12 to 6.18 I see breakage with a missing dependency
that drivers/net/ethernet/amazon/ena/ena_netdev.c has on ptp.ko.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
Link: https://github.com/openwrt/openwrt/pull/23098
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-04-27 00:40:59 +02:00
Rany Hany
5968b584ba wifi-scripts: ucode: add missing fields for station/vlan schema
This adds the missing 'iface' field for both station and VLAN.
On VLAN, we add all network_config_attr to the schema as well
per wireless.uc.

Fixes: https://github.com/openwrt/openwrt/issues/22165
Signed-off-by: Rany Hany <rany_hany@riseup.net>
Link: https://github.com/openwrt/openwrt/pull/22617
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-04-26 14:12:20 +02:00
Rany Hany
7255109cad wifi-scripts: ucode: add bridge_isolate and network_vlan to schema
These were missing from schema. Add them.

Fixes: https://github.com/openwrt/openwrt/issues/22620
Signed-off-by: Rany Hany <rany_hany@riseup.net>
Link: https://github.com/openwrt/openwrt/pull/22617
[Reordered attributes]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-04-26 14:12:04 +02:00
Qingfang Deng
4f59715716 ntfs: update to 2026-04-25
Update to the latest version, and fix build on targets without
FS_POSIX_ACL.

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23090
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-04-26 10:05:41 +02:00
Andrew LaMarche
907dd7bd93 kernel: crypto: fix build with Linux >= 6.18 after octeon-md5 removal
Linux commit c9e5ac0 ("lib/crypto: mips/md5: Migrate optimized code into
library") removed the MIPS-Octeon-specific MD5 implementation
(octeon-md5.ko) and replaced it with an optimized library implementation
in lib/crypto.

As a result, CONFIG_CRYPTO_MD5_OCTEON and the module
arch/mips/crypto/octeon-md5.ko no longer exist in kernels >= 6.18.

Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23031
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-04-26 10:03:37 +02:00