5851 Commits
Author SHA1 Message Date
Jan Klos 07b3c86b35 kernel: modules: add kmod-tpm-crb kernel module package
It is used by firmware-based TPMs in modern AMD/Intel/ARM processors.

Signed-off-by: Jan Klos <jan@klos.xyz>
Link: https://github.com/openwrt/openwrt/pull/24443
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-10-13 00:45:26 +02:00
André Valentin ef552acd91 linux/modules: add kmod-leds-lp5569
Add a kernel module package for the TI LP5569 RGB LED controller driver,
used by the front panel LEDs of the Zyxel NBG7815.

The driver registers an i2c and an of device table, so AutoProbe is
enough and no load priority is needed. The boot flag is kept, as the
other LED modules do, so that the module is available to preinit on a
device that signals boot state through one of its LEDs.

Signed-off-by: André Valentin <avalentin@marcant.net>
2026-10-11 21:28:57 +02:00
Julius Bairaktaris cd649934dc kernel: crypto: package the ChaCha20 cipher for chacha20poly1305 on 6.18
On 6.18 the rfc7539(chacha20,poly1305) template takes its ChaCha20
skcipher from crypto/chacha.ko, which CRYPTO_CHACHA20POLY1305 selects
but no package ships, and which needs lib/crypto/libchacha.ko.
Instantiating rfc7539esp(chacha20,poly1305) for IPsec then fails with
ENOSYS.

Ship chacha.ko with kmod-crypto-chacha20poly1305 on 6.18, load it
before the template and depend on kmod-crypto-lib-chacha20 for
libchacha.ko.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25544
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-11 20:59:07 +02:00
Julius Bairaktaris f2ec42706e kernel: select evdev for HID only with input-support
Since kmod-input-evdev depends on input-support, kmod-hid and
kmod-usb-hid are hidden without it, and so is everything selecting
kmod-hid: kmod-bluetooth, kmod-hci-uart and kmod-btusb. A device that
lists one of them in DEVICE_PACKAGES fails to build as a single profile:

  ERROR: unable to select packages:
    kmod-hci-uart (no such package):

Neither module needs evdev, so select it only with input-support.

Fixes: a7c50f7d73 ("input-support: add a package for input device handling")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25565
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-11 20:08:34 +02:00
Gary Dotzler acd6f78a80 kernel: add kmod-phram package
phram exposes a physical memory range as a read-write MTD device. This
can be used to access RAM regions reserved by firmware or described in
the device tree.

Of particular interest, phram nodes carved out of the reserved region
can survive soft reboots, making it a useful primitive to pass one-shot
bootenv overrides to uboot (fw_setenv -c) without the risk of bricking,
having to wire up a serial console etc.

This patch does the kernel module enablement, paving the way for
potential userspace integrations further down the line (ubus, procd,
sysupgrade etc.)

Run-tested on Linksys E8450 (UBI) with OpenWrt uboot.

Signed-off-by: Gary Dotzler <geldot@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/25692
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-11 09:53:36 +02:00
Nick Hainke a000ba05a4 kernel: netsupport: add kmod-sched-dualpi2
Add the Dual Queue Coupled AQM (RFC 9332) queuing discipline, which
gives L4S traffic a low latency without starving classic traffic. It
is available since kernel 6.17, tc supports it already.

Link: https://github.com/openwrt/openwrt/pull/25779
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-11 09:36:43 +02:00
Nick Hainke 26ad76b186 kernel: netsupport: add kmod-sched-act-gate
Add the gate tc action (IEEE 802.1Qci), which passes or drops ingress
packets based on a time schedule. It is used for Time-Sensitive
Networking.

Link: https://github.com/openwrt/openwrt/pull/25777
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-11 09:29:58 +02:00
Nick Hainke 75db232e46 kernel: netsupport: add kmod-sched-etf
Add the Earliest TxTime First queuing discipline, which sends packets
at the time set with SO_TXTIME. It is used for Time-Sensitive
Networking, also together with taprio in txtime-assist mode.

Link: https://github.com/openwrt/openwrt/pull/25777
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-11 09:29:58 +02:00
Nick Hainke 08071e1036 kernel: netsupport: add kmod-sched-taprio
Add the Time Aware Priority (IEEE 802.1Qbv) queuing discipline, used
for Time-Sensitive Networking.

The Hellcreek switch driver depends on taprio, so disable it to avoid
a new config prompt.

Link: https://github.com/openwrt/openwrt/pull/25777
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-11 09:29:57 +02:00
Nick Hainke 63ebf08f1f kernel: netsupport: add kmod-sched-cbs
Add the Credit Based Shaper (IEEE 802.1Qav) queuing discipline, used
for Time-Sensitive Networking.

Link: https://github.com/openwrt/openwrt/pull/25777
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-11 09:29:57 +02:00
Rosen PenevandClaude Opus 5.5 7f434d332a kernel: dsa-qca8k: depend on kmod-phy-qca83xx
The internal PHYs of the QCA8327/8334/8337 switches are handled by the
qca83xx PHY driver. Without it they silently fall back to genphy and
lose the chip-specific setup and fixups. Every device using
kmod-dsa-qca8k already pulls it in manually except the MikroTik
RB960PGS, which was missing it.

Add the dependency, like other DSA packages do with their PHY drivers,
and drop the now-redundant device package entries.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25767
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-11 09:04:47 +02:00
Felix Fietkau 98b1185d03 mt76: update to Git HEAD (2026-10-08)
162f8985525f wifi: mt76: mt7925: don't put the band auto marker in TGID
047558e81f6b wifi: mt76: mt792x: fix UAF in SDIO TX path when out of memory
f3e7928585db wifi: mt76: fix memory leak in USB TX path
c50f17ec046e wifi: mt76: mt7603: initialize global station WCID
1297eb4e49fc wifi: mt76: mt7615: restore DBDC state after ext PHY failure
2009416d3f90 wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit
7f30d9cb0d3e wifi: mt76: mt792x: pick the SAR table layout from the table itself
20f0979088b3 wifi: mt76: mt7915: publish wcid before MCU add commands
8f69e214f057 wifi: mt76: fix unlocked wcid check in mt76_tx_status_skb_add()
7ff2f295a629 wifi: mt76: fix wcid teardown ordering in mt76_reset_device()
7fec0ac4e12c wifi: mt76: connac2: fill TXD spe_idx for connac2 fixed-rate frames
5073b08ce0c4 wifi: mt76: take rcu_read_lock in the USB/SDIO tx completion path
d7675366ff03 wifi: mt76: mt7925: cancel mlo_pm_work on the USB stop path
bbde131e8f2c wifi: mt76: move the channel survey when the channel changes
9e96501e32e5 wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()
a2a78703435c wifi: mt76: mt7915: check default EEPROM firmware size before copying
56c8b4a4b407 wifi: mt76: mt7996: validate firmware event lengths before parsing
fee59a3f8bca wifi: mt76: mt7915: unregister thermal cooling device on hwmon failure
fd3dc2614c73 wifi: mt76: mt7915: guard firmware memory dump write on disabled memdump
40bd3ff75a69 wifi: mt76: mt7996: bound RRO session id before indexing addr_elem[]
27a48eed077f wifi: mt76: mt76x02: validate RX padding before use
17bfd775f483 wifi: mt76: mt7615: cancel reset work during unregister
c228f918e321 wifi: mt76: mt7925: keep MLD membership consistent during link add
c02187d15016 wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.
3318ff5daa93 wifi: mt76: mt7921: keep the join ROC until the station is authorized
fddc43d51481 wifi: mt76: mt7925: keep the join ROC until the station is authorized
790d1ae1e534 wifi: mt76: mt792x: defer the MCU shutdown past unregister on USB
4e819092f203 wifi: mt76: usb: fix source overread in mt76u_copy
be33bbd93f1a wifi: mt76: mt7615: usb: fix source overread in mt7663u_copy
a0a409c3091d wifi: mt76: mt7915: fix thermal zone use-after-free
a374cac12909 wifi: mt76: mt7603: don't drop short frames looped back on PS entry
210948383adf wifi: mt76: mt7996: refresh the tx BA session timer on NPU devices
9559d859e64e wifi: mt76: avoid iter_keys_rcu() where not needed
d17b8d5eff29 wifi: mt76: mt7996: validate TLV length in mt7996_mcu_ie_countdown()
e51abae4a28e wifi: mt76: Fix spelling mistake "dowload" -> "download"
ecc63ee35093 wifi: mt76: mt7996: Fix spelling mistake "retriving" -> "retrieving"
b1bc93f95379 wifi: mt76: fix wcid->pktid corruption in mt76_wcid_cleanup()
c4809c50393c wifi: mt76: mt7925: Remove useless condition
08dd35bb504c wifi: mt76: mt7615: read MT7663 temperature from the correct offset
b94b75e4edcf wifi: mt76: Fix of_node reference leak in mt76_get_rate_power_limits()
1c9854c4365a wifi: mt76: mt7615: validate MCU response lengths
6163958192b9 wifi: mt76: connac: pass the command to mt76_connac_mcu_chip_config()
2fe9842d4a5f wifi: mt76: mt7921: enable thermal protection
c7dba52baf55 wifi: mt76: mt7996: guard station-only MLO TX handling
d855630e62e2 wifi: mt76: mt792x: fix negative errno truncation in offload capability
175a9b92ff39 wifi: mt76: mt7996: fix PCI device reference leak in mt7996_pci_init_hif2()
0f7f2f6fd028 wifi: mt76: mt7925: fix reset panic caused by the WM2 rx irq mask
ed623597107c wifi: mt76: feed the station RSSI average from the chain signals
aa0868c8a105 wifi: mt76: mt7921: clear WM2 from MT7902 RX all_complete_mask
7adc7a8e8398 wifi: mt76: mt7925: Fix MCU command timeouts during module unload
42bd01d693c6 wifi: mt76: mt7925: add AXI DMA calibration cache for MT7928
b260b1861071 wifi: mt76: abort a scan only for a link change on the scanning radio
5a9b590919a6 wifi: mt76: mt7996: enable the SKU power limit table
490519f8fb53 wifi: mt76: mt7996: set sniffer mode on a radio that is already running
53c7bed27b21 wifi: mt76: mt7996: update the address of an AP link that is added again
bc69664723f9 wifi: mt76: mt7996: size the MLD setup TLV by the links it describes
45f8f94c7cf1 wifi: mt76: mt7996: find the last MLD link among the links torn down
39bd92a3a5d7 wifi: mt76: mt7996: upload only the keys of the link being set up
a2464b215715 wifi: mt76: mt7996: do not walk the vif keys when a link is destroyed
b0ce6b0d6143 wifi: mt76: mt7996: report station statistics from the primary link
f2d50d200941 wifi: mt76: mt7996: clear all link wcid entries in sta_pre_rcu_remove
e46d47df718d wifi: mt76: mt7996: free the WTBL index if a link allocation fails
3aa923dc58e2 wifi: mt76: mt7996: pick the secondary link from links with driver state
965aa0ec734c wifi: mt76: mt7996: make a returning link primary if a station has none
50193c8fba22 wifi: mt76: mt7996: do not reuse the deflink of a removed station link
cf73928ba1a5 wifi: mt76: mt7996: keep a returning link when adding station links fails
f06234e078fa wifi: mt76: mt7996: add the station BMC entry as new once per BSSID
df395b4054af wifi: mt76: mt7996: keep 4-address and decap state per station
f6bb3fab6315 wifi: mt76: mt7996: do not add a station link in disconnected state
6db96c229855 wifi: mt76: mt7996: record the connection state of a station
bfa293034c38 wifi: mt76: mt7996: keep the block ack session parameters per station
0ea35bbe67f7 wifi: mt76: mt7996: set up the BSS of a late station link before its peer
8fce9b01ca98 wifi: mt76: mt7996: bring up station links added after association
42f455d1c817 wifi: mt76: mt7996: set up block ack sessions on station links added later
9ff341e9c17e wifi: mt76: mt7996: restore a station link that returns after a removal
8d6bbe90bedf wifi: mt76: mt7996: fix PLE free page and AC queue register offsets
8d0f3dbd4708 wifi: mt76: mt7996: fix the hw-queues debugfs queue requests
d39a5b53249c wifi: mt76: mt7996: disable the RX NAPIs before the DMA cleanup
dbdcc627e24c wifi: mt76: mt7996: keep the airtime weight of a station for HW ATF
d5ead84240fe wifi: mt76: mt7996: refuse scan and ROC until the hardware restart is done
960c1a94baf5 wifi: mt76: report an aborted scan or ROC to mac80211 during a reset
f6dbd94a444c wifi: mt76: mt7921: fix of_node reference leaks in regd update
b68c3cb175e6 wifi: mt76: mt792x: compute the assoc RSSI from the chain signals
0f37e419a340 wifi: mt76: remove the unused signal field from struct mt76_rx_status
bd5d316e5604 wifi: mt76: mt7996: take the offchannel link of a frame from its wcid
44625d0665e7 wifi: mt76: scan all radios of a request at the same time
65dce9c22385 wifi: mt76: mt7996: scan all bands with one request
d80e427a17db wifi: mt76: keep beacons from queueing the scan work during an abort
467ae2e3f190 wifi: mt76: bypass DPD on a scan channel while a monitor is active

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:39 +02:00
Felix Fietkau bc1235bc58 mac80211: resolve the RX link of each station on its own
When several stations match addr2 of a data frame, a failed link lookup
for one station kept every station after it from getting the frame.
Also, the link_id of an MLO station leaked to the stations after it,
which dropped the frame for a non-MLO station.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:39 +02:00
Felix Fietkau d772048670 mac80211: add the MLO client patches for AP station lookup, CSA and debugfs
399 looks up the AP station by the AP MLD address, 400 matches a channel
switch action against the link that received it, and 401 reports the
BSSID of each link in debugfs. The vbed image of 2026-10-02 builds and
runs with them.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau 0e9f811708 mac80211: report the totals of an MLO station when it is removed
The station removal event of an MLO station carried the counters of
the default link alone. It now carries the sum over the station's links
and its removed links, as the station dump does.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau 6343a98608 mac80211_hwsim: free a frame whose rate is wider than the channel
The path that warns about such a frame returned without freeing it.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau b66365b233 mac80211_hwsim: report the TX statistics of each station link
mac80211 books all TX of an MLO station on the association link, so a
per-link station dump showed every TX byte, packet and the TX rate on
that link and none on the others.

- 417 exports the conversion of a TX rate to a rate info, with the
  documentation of its arguments.
- 418 makes mac80211 ask the driver for the counters of a link before
  it removes the link from the driver, and add them to the station's
  totals of removed links.
- 419 lets hwsim count TX per link and report it through
  link_sta_statistics. It counts the length of a frame before
  encryption and one packet per MSDU, only where the frame resolves to
  a station link. It starts the record of a link again when the link
  station changes, and clears the records of removed links.

Measured on the virtual bed: each link reports its own TX counts and
rate, and the station totals are the sum of the links.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau 7289c37c7e mac80211: convert the TX rate of a link with the band of that link
sta_set_link_sinfo() took the band of a legacy TX rate from
ieee80211_get_sband(), which warns on an MLD interface and does not
return the band of the link. 416 converts the rate with the band of the
channel context of the link.

The last TX rate of an MLO station comes from the TX status of a frame
on any link, so a legacy index can lie beyond the bitrate table of the
band it is converted with. The conversion checks the index against
that table.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau 8c5a44a58e mac80211: report the MLD address and link of a dumped station
415 fixes 727afb05ef63 of the backport above: a station dump stopped
carrying NL80211_ATTR_MLD_ADDR and NL80211_ATTR_MLO_LINK_ID, so a reader
of the dump no longer saw that a station is an MLD or which link it
associated on. NL80211_CMD_GET_STATION for one station
still carried both. Mainline has the same gap.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau 976da463de mac80211: backport the per-link station statistics of the station dump
001 to 005 are mainline 5c660b243435, 4b40378ac203, 727afb05ef63,
dd21d1844aa0 and f9202a374ec3. NL80211_ATTR_STA_DUMP_LINK_STATS then
asks a station dump for one message per link of an MLD station after
the aggregated one, so userspace can read the counters and rates of
each affiliated station. Without the flag the dump is as before.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau cce5c06c7a mac80211: take an MLO station's rates from the links that report them
414 fixes cfg80211_sta_set_mld_sinfo(). It took the TX and RX rate of an
MLO station from the link with the least inactive time, but compared
against a value it had just set to that link's own, so only the first
link could decide. mac80211 records the last TX rate on the association
link, so a station associated on any other link reported no TX bit rate
at all. The TX and RX durations had the same condition and counted the
first link only.

Measured on a mac80211_hwsim bed: an MLO backhaul station associated on
link 1 now reports its TX rate, and the backhaul rates derived from it
read 270 and 3120 Mbit/s instead of 65535.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau 22e7917d8e mac80211: hwsim: make the interface limit of a radio a parameter
Add the max_interfaces module parameter. A radio combines up to 2048
interfaces, and userspace that derives the number of BSSes of a radio
from the interface combinations reports that value. The default stays
2048.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau 2190bd93b1 mac80211: stop only the MBSSID set of the stopped AP link
ieee80211_stop_ap() stops one link, but ieee80211_stop_mbssid() walks
every active link of the interface. The STOP_AP of one link of an AP
MLD thus took apart the MBSSID set of each other link and stopped the
interfaces of those sets, on radios that keep running.

Add a patch that takes apart only the MBSSID set of the link that
stops. The stop of the whole interface still walks all its links.

With it, hostapd can remove an affiliated AP of an AP MLD whose other
links carry an MBSSID set. A link that is itself in an MBSSID set still
takes that set apart, and cfg80211_stop_iface() stops each member
interface with all its links.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau 6db50863fc mac80211: keep the interface state of an AP MLD while a link stops
A link STOP_AP cleared state that belongs to the interface, while the
other links of the AP MLD kept beaconing: cfg80211 the SSID, the owner
and the QoS map, mac80211 the SSID, the S1G and beacon rate flags and
the carrier of every AP_VLAN. The kept links then ran without a DSCP
map, reported no SSID, and their 4-address stations lost their bridge
port carrier.

Add two patches that clear this state only with the last link that
beacons.

With the SSID kept, cfg80211 refuses a START_AP that changes the SSID
of one link while another link beacons with the old one ("require
identical SSID for MLO"). hostapd.uc stops every link of an AP MLD
before an SSID change (the previous commit).

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:38 +02:00
Felix Fietkau 80d75155ad mac80211: take a group addressed deauth from any link of the AP MLD
A non-AP MLD dropped the broadcast deauth an AP sends from a link whose
address differs from the AP MLD address, and kept a dead association.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau a1d2502ce5 mac80211: hwsim: restore the MLD addresses of a frame before its TX status
Add a pending patch. hwsim rewrites the addresses of a frame to an MLO
station to link addresses and then reported the TX status with them,
so mac80211 found no station for that status and recorded no ACK,
retry, lost frame or TX rate for it. hwsim now puts the MLD addresses
back before it reports the TX status.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau dc0d51559f mac80211: fix the addresses of 4-address frames on an MLD
Add two pending patches. A 4-address AP_VLAN of an AP MLD sends to a
station that is not an MLD with the address of the station's link as
TA, not the AP MLD address. A 4-address MLO station sends with the AP
MLD address as RA, not the BSSID of the default link, which an MLO
connection does not set.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 18d0619283 mac80211: backport the band fix for 802.3 encap offload frames
ieee80211_8023_xmit() leaves info->band at 0 on an interface that is not
an MLD, so ieee80211_get_tx_rates() uses the wrong band for these
frames. The fix is in the wireless tree.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 1d2fb1e9ba mac80211: hwsim: send a frame with no rate at the peer's highest rate
With HAS_RATE_CONTROL, mac80211 leaves the rate entries of every frame
cleared, so hwsim reported no rate for it, an MLD station reported no
TX bit rate, and a medium in userspace sent the frame at the lowest
rate.

Send such a frame at one rate, with one attempt and the rate list ended
after that entry. For a data frame to a peer, take the highest VHT or
HT MCS that the peer receives on the channel width in use, as a rate
controller settles on for an ideal channel; otherwise take the highest
legacy rate of the band. Stop at four streams, as minstrel_ht does
(MINSTREL_MAX_STREAMS): hwsim declares MCS 0-9 for all eight streams,
and ieee80211_get_rate_duration() warns for more than four streams on
a VHT rate.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau ddb9998587 mac80211: retransmit the 4-address null frame until it is acknowledged
A station in 4-address mode sends one 4-address null data frame, and the
access point sets up the 4-address station only when it receives it. If
the driver reports ACK status, send the frame again every second until
the access point acknowledges it, for at most ten transmissions.

Based on 0089-mtk-mac80211-retransmit-4addr-nullfunc-if-the-ACK-is.patch
by Peter Chiu <chui-hao.chiu@mediatek.com> in the MediaTek feed.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 8acb3afe15 mac80211: hwsim: let mac80211 monitor the connection of an MLO station
An MLO radio of hwsim declares CONNECTION_MONITOR but reports neither a
beacon loss nor a connection loss, so a station whose AP went away
without a deauthentication that it accepts stayed associated. Leave the
flag out, so that mac80211 monitors the active links of the station.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 385dadffe2 mac80211: hwsim: declare the MLD capabilities of a station
An MLO radio of hwsim declares extended, EML and MLD capabilities for
the AP interface type only, so a station interface reports no
simultaneous links. Declare the station interface type as well. The
Association Request of an MLO station of hwsim then announces the
maximum number of simultaneous links of the AP entry instead of 0.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 610b6b6d15 mac80211: report the combination error when NAN evacuation fails
When ieee80211_check_combinations() refuses a channel,
_ieee80211_link_use_channel() tries to evacuate a NAN channel and then
returns the result of that attempt. Without a NAN interface the attempt
returns -ENOENT, so a refused interface combination reaches userspace as
"No such file or directory" instead of the error of the check.

Keep the error of the combination check when the evacuation does not
help.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau f0e07e5fad mac80211: hwsim: keep radar detection on a multi-radio wiphy
A radio that uses channel contexts gets no radar detection widths in its
global interface combination, because DFS requires a combination with a
single channel. A multi-radio radio always uses channel contexts, and
its global combination multiplies the channel count by the number of
radios. So it loses the radar detection widths as well, while each
per-radio combination keeps them.

mac80211 checks the channel of a radar detection against the global
combination (ieee80211_check_combinations() with radio_idx -1 from
_ieee80211_link_use_channel()). No combination matches, and every CAC on
a multi-radio hwsim radio fails. hostapd reports it as "start_dfs_cac()
failed" and disables the interface.

cfg80211 exempts the global combination of a multi-radio wiphy from the
single channel rule for DFS (wiphy_verify_iface_combinations()), since
it only sums up the radios. Keep the radar detection widths there when
each radio has one channel. With more than one channel per radio, clear
them in the per-radio combination too, which cfg80211 would refuse
otherwise.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 8a3ba049c1 mac80211: find the sender of a data frame by its link address
The station hash holds the MLD address of an MLO station. When a driver
neither passes the station nor translates the addresses, a data frame
of an MLO station carries a link address in addr2, and
__ieee80211_rx_handle_packet() does not find the sender. The frame goes
through the per-interface loop, which skips AP_VLAN interfaces. A
4-address MLO station associates and gets its AP_VLAN, but no data
frame of it arrives.

403 looks up the sender in the link station hash when the station hash
has no match, and hands the frame to the interface of that station, as
upstream does since the RX rework.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 1225466911 mac80211: hwsim: reserve headroom for software encryption
mac80211_hwsim accepts CCMP and GCMP keys in mac80211_hwsim_set_key()
and encrypts unicast data frames itself in mac80211_hwsim_tx(), through
ieee80211_encrypt_tx_skb(). It asks mac80211 to reserve tailroom for the
MIC, but not headroom for the CCMP or GCMP header.

For a hardware key without IEEE80211_KEY_FLAG_GENERATE_IV or
IEEE80211_KEY_FLAG_PUT_IV_SPACE, ieee80211_xmit_fast() resizes the frame
with ENCRYPT_NO and reserves only the 802.11 header and
hw.extra_tx_headroom. A locally generated frame usually has room to
spare, but a frame forwarded from a bridge can arrive with none. The
room check in ccmp_encrypt_skb() then warns, ieee80211_encrypt_tx_skb()
returns an error and the frame is freed. An access point that bridges
traffic to its clients sends no downlink unicast data at all.

Reserve the header as driver headroom. IEEE80211_CCMP_HDR_LEN,
IEEE80211_CCMP_256_HDR_LEN and IEEE80211_GCMP_HDR_LEN are all 8 bytes.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 595166fcfc mac80211: select the link a management frame asks for
ieee80211_mgmt_tx() walks the links of an AP MLD to decide whether a
frame needs an off-channel transmission. It pins the link that holds the
requested channel only when the destination is a station that already
associated as an MLD. A frame to an address the access point does not
know keeps link_id at -1, the link reaches the driver unspecified, and
the driver picks the default link, which holds a different channel and a
different address.

A DPP Authentication Request shows this: the enrollee announces itself
on channel 6, the access point answers under the address of its 5 GHz
link, and the enrollee never sees the frame.

Pin the link whenever an active link holds the requested channel.
ieee80211_tx_skb_tid() warns on a link id for an interface that is not
an MLD and on one that names an inactive link, and active_links is zero
for an interface that is not an MLD, so that one test covers both. A
station MLD that sends from its MLD address to an address other than its
AP gets the same pin.

A link whose own address is the MLD address also matched the frame on
that address and ended the search, so a lower link that uses the MLD
address hid the link with the requested channel. Skip such a link when
the frame names another channel.

Frames to a station keep their present behaviour: the branch runs only
where the caller named a channel, and where the destination is a station
that associated as an MLD the same branch already pinned the link.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Daniel Golle 61f19fda28 kernel: add the IMX415 camera sensor module
The Sony IMX415 is the sensor on the Radxa Camera 4K and on several
other MIPI CSI-2 modules, and the driver is in the kernel already. Add
kmod-video-imx415 so a board with a camera connector has a sensor to
go with its capture driver.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:13 +01:00
Daniel Golle a9f9bd074f kernel: add ASoC simple card, HDMI and ES8316 codec modules
Package the simple-audio-card and audio-graph-card drivers with their
shared utilities, the HDMI codec used by DRM bridges with an HDMI
audio path, and the Everest ES8316 codec.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle 146a31c962 kernel: add V4L2 codec helpers and the Hantro VPU module
Package the H.264, VP9 and JPEG helper modules on their own so several
stateless codec drivers can share them, and add the Hantro VPU driver
used by i.MX8M, Rockchip, Allwinner, Microchip and ST SoCs. The i.MX
CODA package takes the JPEG helper from the new package.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle 4e8f881ecc kernel: add DRM bridge, GPUVM and Panthor modules
Package the Synopsys DW DisplayPort, HDMI, HDMI QP, MIPI DSI and MIPI
DSI2 bridges, the Analogix DisplayPort bridge with the DP AUX bus, the
GPUVM helper and the Panthor driver for ARM Mali CSF GPUs. The HDMI QP
bridge depends on the HDMI codec module for its audio path.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle f673169be9 kernel: ship v4l2-dv-timings with kmod-video-core
CONFIG_VIDEO_DEV builds v4l2-dv-timings.ko next to videodev.ko, but the
package only installs the latter, so a driver that needs the DV timings
helpers, such as the Synopsys HDMI receiver, cannot be packaged.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle 6e55a3c331 kernel: video: load MIPI DBI panel and PWM backlight early
AutoProbe places a module in etc/modules.d, which kmodloader loads
from /etc/init.d/boot once preinit has finished, so a MIPI DBI panel
only lights up late in the boot. With the boot flag the module is
linked into etc/modules-boot.d as well, which is loaded before the
preinit scripts, together with its dependencies.

Set the flag on the panel driver and on pwm_bl, because the panel
defers its probe until the backlight it references has registered.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 00:03:51 +01:00
Daniel Golle 2bba9c1ba5 kernel: modules: package driver for Hynitron CST816x touch sensor
Package kernel driver for the Hynitron CST816x touch sensor, found on
ST7789V-based 240x240 px MIPI-DBI display of the Adtran SmartRG SDG-9000.
Import pending patches improving the driver.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 00:03:51 +01:00
Daniel Golle 49b409e6d5 kernel: add kmod-drm-xen-frontend
A Xen guest without emulated graphics has two ways to be given a display,
and the kernel drivers for them are unrelated: xen-fbfront speaks the vfb
protocol through legacy fbdev, while xen_drm_front speaks displif on a
vdispl xenbus device. Only the second has a DRM driver, and nothing in
the tree packaged it.

Package it for the three targets whose kernels have Xen guest support. It
needs xen-front-pgdir-shbuf, a hidden tristate with no package of its
own, so both modules ship together.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-06 18:35:40 +01:00
Daniel Golle 791c30a253 kernel: cut fbdev out of the DRM kmod chain
kmod-drm pulled kmod-fb in unconditionally and kmod-drm-kms-helper pulled
in six fbdev helper packages, so any target that shipped a DRM kmod got
CONFIG_FB, the framebuffer console, the fonts and CONFIG_VT switched on
whatever its kernel fragment said. Drop those dependencies, along with
the fbdev emulation that kmod-drm-imx and kmod-drm-panel-mipi-dbi forced
on and the DRM_KMS_FB_HELPER, DRM_IMX_FB_HELPER and FB_INTEL symbols that
no kernel in the tree defines.

kmod-fb and the fbdev helpers stay selectable on bcm27xx, sunxi, x86
legacy and geode, whose kernels keep fbdev, and fbtft narrows to bcm27xx,
the only target with in-tree users. kmod-drm-client-lib goes: the targets
that keep fbdev emulation build DRM into the kernel, so DRM_CLIENT_LIB is
built in there, and on a target with DRM as modules nothing selects it,
where drm_client_setup() is an empty inline.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-06 18:35:40 +01:00
Robert Marko d374b6e974 mac80211: ath11k: add NVMEM caldata support
Add support for getting the caldata via NVMEM cells.

It will first try to use the ath10k style calibration NVMEM cells, and then
failover to the existing file based loading.

It should allow dropping most of the userspace caldata loading.

Link: https://github.com/openwrt/openwrt/pull/25566
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-05 22:16:54 +02:00
Manuel Fombuena af6b5f161f kernel: leds-st1202: load the module in preinit
OpenWrt sources diag.sh at the preinit_main hook stage (02_default_set_state),
resolving LED aliases from the device tree so that set_state() can blink the
boot LED through the preinit and preinit_regular phases before init takes
over. For that to work the LED driver must be present before the preinit
scripts run.

Without the boot flag, AutoProbe only places the module in etc/modules.d,
which is loaded by /etc/init.d/boot once preinit has finished. By that
point the entire preinit LED window has passed and the boot indication on
any ST LED1202-backed LED is silently skipped.

Set the boot flag so the module is also linked into etc/modules-boot.d,
which procd loads before running the preinit scripts. The previous commits
bring the driver to a state where loading it at early boot is appropriate.

Assisted-by: LLM
Signed-off-by: Manuel Fombuena <fombuena@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23456
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-04 17:15:03 +02:00
Julius Bairaktaris 3bab3a63a1 mac80211: reset the LED state when ifup fails
Backport upstream commit 78183e833195 ("wifi: mac80211: reset the LED
state when ifup fails"). When the first interface fails to come up, the
throughput LED timer keeps running, and unloading the driver afterwards
frees it while it is still armed.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25539
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-03 11:47:13 +02:00
Daniel Golle c375123b3b kernel: drop the audio and display feature gates
The sound and DRM modules carry a dependency on audio-support and
video-support, which is what decides whether an image handles those
devices. The AUDIO_SUPPORT and DISPLAY_SUPPORT tokens beside them add a
second, per-SoC-family condition that a board cannot influence, and that
DISPLAY_SUPPORT is half derived from whatever kernel configuration was
copied into a target's fragment.

Drop the tokens from the module dependencies and from fbtest.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-09-29 15:29:43 +01:00