Commit Graph
71439 Commits
Author SHA1 Message Date
Felix Fietkau 595166fcfc mac80211: select the link a management frame asks for
ieee80211_mgmt_tx() walks the links of an AP MLD to decide whether a
frame needs an off-channel transmission. It pins the link that holds the
requested channel only when the destination is a station that already
associated as an MLD. A frame to an address the access point does not
know keeps link_id at -1, the link reaches the driver unspecified, and
the driver picks the default link, which holds a different channel and a
different address.

A DPP Authentication Request shows this: the enrollee announces itself
on channel 6, the access point answers under the address of its 5 GHz
link, and the enrollee never sees the frame.

Pin the link whenever an active link holds the requested channel.
ieee80211_tx_skb_tid() warns on a link id for an interface that is not
an MLD and on one that names an inactive link, and active_links is zero
for an interface that is not an MLD, so that one test covers both. A
station MLD that sends from its MLD address to an address other than its
AP gets the same pin.

A link whose own address is the MLD address also matched the frame on
that address and ended the search, so a lower link that uses the MLD
address hid the link with the requested channel. Skip such a link when
the frame names another channel.

Frames to a station keep their present behaviour: the branch runs only
where the caller named a channel, and where the destination is a station
that associated as an MLD the same branch already pinned the link.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 1e5d762595 wifi-scripts: pass all wdev.uc interfaces of a radio in one call
setup() ran wdev.uc set_config once per interface, each time with a
configuration of that interface alone. set_config replaces the whole
configuration of the radio, so each call stopped the interfaces of the
calls before it: with two monitors, or a monitor and an adhoc
interface, on one radio, only the last one stayed up. The configuration
also passed through the shell inside single quotes, so a single quote
in an SSID or a mesh_id broke the command, and two of them made the
text between them run as shell code.

Pass all interfaces in one call, also when the radio has none, so that
removed interfaces stop. Pass the arguments as an array, which system()
runs without a shell.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau f892303173 wifi-scripts: stop only the wdevs that wdev.uc created on this radio
drop_inactive() kept every name of the state file whose netdev existed,
and the configuration update then stopped it. A name can belong to
another owner by then: the interface moved to another radio, or it is
now an AP of hostapd or a station of wpa_supplicant. The old radio then
deleted the interface of the new owner.

Record the wdev id of each interface in /var/run/wdev-<phy>.id.json,
and keep a name only if the interface dump shows it on this radio with
the recorded id. A state without recorded ids, from an older version,
falls back to the name.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau f7831b6ebd hostapd: name the interface of a Beacon Report on ubus
rrm_beacon_req takes its Dialog Token from the counter of the BSS whose
ubus object the call reached, and the links of an AP MLD share the one
object of their interface. The token alone therefore names the request a
report answers only per interface: two interfaces can hand out the same
token to requests for one station. The beacon-report notification now
carries "ifname", which is that interface for every link of an MLD.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau b920fc57c9 hostapd: pass the Measurement Token of a Beacon Report to ubus
The beacon-report notification carried the frame's Dialog Token under
"token" and dropped the Measurement Token of the Measurement Report
element, which hostapd_handle_beacon_report() skips before the report.
A subscriber that rebuilds the element put the Dialog Token in its
place. 802.11-2024 9.4.2.20 sets the Measurement Token to that of the
request's Measurement Request element, which hostapd sets to 1. The
notification now carries it as "measurement-token".

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 2c1ba806b4 hostapd: answer rrm_beacon_req with the Dialog Token of the request
A station answers a Beacon Request with a Radio Measurement Report that
carries the request's Dialog Token (802.11-2024 9.6.6.3), and the
beacon-report notification passes that token on. The caller of
rrm_beacon_req never learnt the token hostapd chose, so it could not
tell a report for its request from one for an earlier request to the
same station. rrm_beacon_req now replies with dialog_token.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 04d0bbcdc2 provision: add a backend for a GPT partition named provisioning
A device without UBI, such as an x86 VM or a device on eMMC, can keep its
provisioning data on a block partition named `provisioning`. The data
uses the same header as the UBI volume.

open() and create() prefer the UBI volume and then look for the partition
through the PARTNAME of each block device in sysfs. A commit checks the
flush, because close() reports no error. A partition cannot be removed
from here, so destroy erases the header and the data.

The provision command now exits with an error when a commit or a
destroy fails, for both backends.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 8381b0a352 hostapd: fix two -Wall warnings of the ubus code
__hostapd_bss_mgmt_enable_f() ended its switch without a return, so a
flag outside the enum returned an undefined value (-Wreturn-type). The
callers pass only the flags of the enum, which all return, so it now
returns false after the switch: such a flag changes nothing.

hostapd_notify_ubus() has no caller (-Wunused-function), and is
removed.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 9e0fb47cbe wifi-scripts, hostapd: handle a netdev that does not come up
Bringing a netdev up can fail, for example with ENOTUNIQ from
ieee80211_do_open() when another running interface of the wiphy has the
same address. wdev_set_up() ignored the result, and wpa_supplicant's
iface_start() and mld_add(), hostapd's bss_check_mld() and wdev.uc went
on as if the netdev ran. wpa_supplicant and wdev.uc also went on after a
failed netdev creation.

Return the error from wdev_set_up(). On a failure to create the netdev
or to bring it up, stop there; after a failure to bring it up, also
remove the netdev. wpa_supplicant leaves the interface not running for
the next start_pending() or mld_start(), hostapd skips the links of the
AP MLD, and wdev.uc drops it from its state for the next setup.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau b268edea7f hostapd: start a configuration again whose restart failed
iface_reload_config() returned true when the new BSS configuration
equalled the old one, before it checked that the interface existed.
After a setup whose netdev creation or hostapd.add_iface() failed, the
stored configuration has no interface. The next identical configuration
compared equal, and hostapd never started it, also after the cause went
away.

Take an equal configuration as up to date only if its interface runs or
its setup is pending.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 2883cdbbec wifi-scripts: check the phy of wdev.uc before its use
wdev.uc read phydev.phy before it checked that phy_open() found the
phy, so a missing phy stopped the script with "left-hand side
expression is null" instead of the message "PHY ... does not exist".

Check phydev first and drop the phy variable, which nothing reads. Also
use a logical OR in the check of the command.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 95c635794a wifi-scripts: pass DPP Connectors through, and enable PMF with DPP
ap.uc and supplicant.uc already write dpp_connector, dpp_csign and
dpp_netaccesskey, but the schema did not declare them, so netifd dropped
them before the handlers ran. Declare the three options.

Easy Connect 3.0 section 8.4.2 requires PMF for an association that uses
the DPP AKM, and wpa_supplicant does not enable it by itself. Set
ieee80211w to at least optional on APs and stations that enable dpp.

This also overrides an explicit ieee80211w 0. With sae-compat outside
6 GHz, the base RSNE then advertises PMF, which that mode otherwise
carries only in the RSN override element. On an AP the PMF setting also
enables beacon protection by default. The schema description of dpp
states this.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 71611b11af hostapd: fix the shutdown handlers of the scripts
The global object of hostapd and wpa_supplicant has no ubus property,
so the shutdown handlers raised a reference error on the disconnect
call. The scripts store their connection in data.ubus.

wpa_supplicant's shutdown() called set_config() with two of its six
arguments. Pass the stored phy parameters. Also release its udebug
ubus binding before the disconnect, as hostapd does.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 8b4c110555 hostapd: ubus: count a reference only for a BSS object that was added
hostapd_ubus_add_bss() counted a reference to the ubus context whether
ubus_add_object() succeeded or not, and hostapd_ubus_free_bss() drops
one only for an object with an id. Every BSS whose object could not be
added, such as each further link of an AP MLD, which all ask for the
same name, kept the context referenced after it was freed. Count the
reference only where the object was added.

The context can now go away before such a BSS is freed, and
hostapd_ubus_free_bss() returned without a context before it freed the
name of the object. Free the name in every case.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 327f715b5b hostapd: keep a start_disabled BSS quiet when the interface comes back
On a radio shared with a STA, wifi-scripts generates every AP BSS with
start_disabled=1. The beacons start only when apsta_state goes up.

If the driver disables and enables the interface before that,
hostapd_iface_enable() starts the beacons of every started BSS, on a
channel that the STA possibly does not use.
053-AP-keep-a-start_disabled-BSS-quiet-on-interface-enable skips the
beacon update for a BSS with start_disabled set.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:37 +02:00
Felix Fietkau 22c42571ac hostapd: refresh patches
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-10-08 09:50:36 +02:00
Nick Hainke b7b90e4955 ltq-vdsl-vr11-app: start the DSL control before the network
The modem was started after the LED init script, at the very end of
the boot process, although its driver is ready much earlier. On a
FRITZ!Box 7530 the control application started 61 seconds after power
on, 45 seconds after the driver was loaded, and the line needed
another 90 seconds to synchronize.

The LED is handled by ltq-dsl-base now, so start the modem before the
network. This brings the line up earlier by the time the rest of the
boot process takes.

Assisted-by: Claude:claude-fable-5-1
Link: https://github.com/openwrt/openwrt/pull/25599
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-08 09:21:15 +02:00
Nick Hainke 9ad5c357ad ltq-dsl-base: restore the DSL LED state after the LED init
The LED init script sets the DSL LED to its configured trigger. If the
modem is in the middle of the handshake or the training at that point,
the LED stops blinking until the line changes its state again. That is
why the DSL control scripts start after the LED init script, at the
very end of the boot process.

Remember the last state of the line in dsl_notify.sh, which gets every
event of the modem, and show it again right after the LED init script,
so that the modem can be started earlier. The state is written before
the LED is updated, so an event during the replay is shown afterwards.

Assisted-by: Claude:claude-fable-5-1
Assisted-by: Claude:claude-opus-5-5
Link: https://github.com/openwrt/openwrt/pull/25599
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-08 09:21:15 +02:00
Nick Hainke 076b3e767b uhttpd: add VRF support
Run a uhttpd instance in a VRF, using the procd 'vrf' parameter:

  config uhttpd
        option vrf '<dev>'

The VRF device may not exist at boot, so such an instance is not
started at boot. With a listen address the existing interface trigger
starts it, with a wildcard address any interface coming up does.

Assisted-by: Claude:claude-fable-5-1
Link: https://github.com/openwrt/openwrt/pull/25568
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-08 09:19:35 +02:00
Nick Hainke c82de84430 dropbear: add VRF support
Run a dropbear instance in a VRF, using the procd 'vrf' parameter:

  config dropbear
	option vrf '<dev>'

dropbear starts before the network, when the VRF device doesn't exist
yet. Don't start the instance at boot, the interface triggers start it
later. An instance without interfaces is started when any interface
comes up.

Assisted-by: Claude:claude-fable-5-1
Link: https://github.com/openwrt/openwrt/pull/25568
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-08 09:19:35 +02:00
Nick Hainke 71588f0d76 dnsmasq: add VRF support
Run a dnsmasq instance in a VRF, using the procd 'vrf' parameter:

  config dnsmasq
	option vrf '<dev>'

At boot the interface options are left out, so an instance in a VRF
would collide with the other instances, and the VRF device may not
exist yet. Don't start it at boot, the interface triggers start it
once its interfaces are up.

So far only the interfaces of the dhcp and relay sections have a
trigger. Add one for the interfaces of an instance in a VRF as well,
and start an instance without interfaces when any interface comes up.

Assisted-by: Claude:claude-fable-5-1
Link: https://github.com/openwrt/openwrt/pull/25568
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-08 09:19:35 +02:00
Nick Hainke b6a081337b procd: update to Git HEAD (2026-10-07)
457721d7544d jail: drop the deferred path's own mount-propagation remount
66a33c82f755 jail: keep locked flags on phase-2 read-only remounts
0925850d765b jail: keep locked flags when remounting a noafile mask
ac855770e3b2 jail: apply root_map_uid to a joined user namespace
7f1b26ce3759 jail: join an external userns after build_jail_fs()
88fe395b2cd5 jail: fail on an unresolvable -j specification
638c2ecfaf8a jail: let a joined namespace replace the created one
56e1a2032e0d jail: factor out the MS_* to MOUNT_ATTR_* translation
8c9df2b8ae32 jail: mount sysfs in the parent when the jail lacks a netns
4021843627a4 jail: log a failing mask mount
fa1f24c84ce7 jail: drop all capabilities for a bundle that names none
5670ff93498d uxc: report every failure with one exit status
6a22d3964822 service: add per-instance 'vrf' option

Allow to set the new 'vrf' instance option with procd_set_param. It
binds all sockets of a service to a VRF device, like 'ip vrf exec':

  procd_set_param vrf <dev>

Assisted-by: Claude:claude-opus-5-5
Assisted-by: Claude:claude-fable-5-1
Link: https://github.com/openwrt/openwrt/pull/25568
Signed-off-by: Nick Hainke <vincent@systemli.org>
2026-10-08 09:19:35 +02:00
Markus Stockhausen 76144d6fd2 realtek: dsa: standardize Otto L2 function names
Rename all functions defined in l2.c and declared in l2.h to use
otto_l2_ for generic helpers and otto_l2_<family>_ for device-specific
helpers. Remove redundant l2 components from the remaining function name.
Update all references throughout the driver, including the rtl930x_hash
prototype in rtl-otto.h and the debugfs DEFINE_SHOW_ATTRIBUTE base.

Use set_port_new_sa_fwd for the RTL930x and RTL931x mode setters to
distinguish them from the port_new_sa_fwd register-address helpers.

This is a naming-only change; function signatures and logic are preserved.

Assisted-by: ChatGPT (OpenAI GPT-6 Astra)
Link: https://github.com/openwrt/openwrt/pull/25699
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-10-08 07:28:31 +02:00
Sander van Deijck 2250b8eb93 wolfssl: update to 5.9.4
This updates wolfSSL to the latest version. This update
includes fixes for multiple vulnerabilities, including 3 high:
https://github.com/wolfSSL/wolfssl/releases/tag/v5.9.4-stable

Signed-off-by: Sander van Deijck <sander@vandeijck.com>
Link: https://github.com/openwrt/openwrt/pull/25440
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-10-08 02:12:17 +02:00
Qingfang Deng b928103e17 ppp: update to 2.5.4
Update ppp to 2.5.4.

Changelog: https://github.com/ppp-project/ppp/releases/tag/v2.5.4

Removed upstreamed:
- 501-relax-and-simplify-permission-check.patch

Manually rebased:
- 310-precompile_filter.patch

pppd 2.5.4 now refuses chap/pap-secrets files that are group- or
world-accessible (new default "strict-secrets-files"); such files must
be mode 0600, or "nostrict-secrets-files" restores the old warning.

Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25213
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-10-08 02:11:03 +02:00
Julius Bairaktaris 0ab51fb9c1 qualcommax: qca_edma, qca_ppe: fix coding style
Align continuation lines to the open parenthesis, align the register
defines in qca_edma.h with tabs as qca_ppe.h does, and fix the
operator spacing, blank lines and block comments that checkpatch
reports. No functional change.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25665
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-07 19:35:41 +02:00
Julius Bairaktaris deccf91797 qualcommax: qca_edma, qca_ppe: remove dead code
Remove code that has no effect on kernel 6.18:

- qca_edma: get_drvinfo, which returns what the ethtool core fills in
  from the parent device; NETIF_F_GRO and watchdog_timeo, which the core
  sets itself or never reads without ndo_tx_timeout; the tailroom check
  on a conduit whose needed_tailroom is always 0; the tx_min_size guard
  around skb_put_padto(), which does nothing for a size of 0.
- qca_ppe: port range checks on ports DSA has already validated, NULL
  checks before clk_set_rate(), the never-read ds->priv, the repeated
  "ports" node check in the IPQ6018 mux setup and stores that are always
  overwritten before they are read.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25665
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-07 19:35:41 +02:00
Julius Bairaktaris dd052b4594 qualcommax: qca_ppe: add EEE support
EEE is disabled on every PPE port because the MAC side of LPI was never
programmed. The GMAC has an LPI enable per port, a wake and idle timer
per port and a microsecond prescaler at PPE offset 0x400, as the HPPE
code in qca-ssdk has it. Program them from mac_enable_tx_lpi, offer LPI
at 100 and 1000 Mbit/s on the QSGMII, PSGMII and SGMII ports, enable
EEE by default and add support_eee.

On IPQ8074 EEE negotiates on links whose partner offers it, a 10 minute
soak with bursty traffic loses 0 of 2939 pings, throughput is unchanged
(302 Mbit/s both ways, n=3) and idle ping latency rises from 0.16 to
0.22 ms (n=3). qca-ssdk uses the same LPI registers on IPQ60xx; no
IPQ60xx board was available to run it.

Fixes: a3a6679538 ("qualcommax: qca_ppe: disable EEE to prevent idle-port egress wedge")
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25665
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-07 19:35:41 +02:00
Julius Bairaktaris ad77648ba7 qualcommax: qca_edma, qca_ppe: drop kernel version checks
qualcommax builds only kernel 6.18, so the LINUX_VERSION_CODE checks
for 6.14 and 6.18 are always true. Remove them and linux/version.h.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25665
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-07 19:35:41 +02:00
Quinn O'Shea b4e002dca3 realtek: dsa: rtl930x: fix block 1 L2 hash for VLANs >= 128
The second hash of the L2 table folds the top five bits of the 60-bit
seed, bits 59 to 55, into the key like the first one. It shifted the
seed left instead of right, so that term was always 0. Those bits are
bits 7 to 11 of the VLAN id, and for every VLAN from 128 up the driver
looked for an address learned in block 1 in the wrong bucket.
rtl930x_hash() carries a copy of the expression and gets the same
change.

Seen on RTL9303 with a host learned in bucket 2201 in VLAN 199: making
it static through the bridge wrote a second row for the same address
and VLAN in block 0 instead of converting the learned one, and deleting
the static entry left the learned row behind. A host learned in block 1
in VLAN 1 was found as before.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Quinn O'Shea <qoshea@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25697
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-10-07 17:39:20 +02:00
Gennaro Cimmino 92dc5d9c24 realtek: dsa: report the FDB VLAN from FID_RVID
rtldsa_port_fdb_dump() handed DSA e.vid, which on a unicast entry that
is not a next hop comes from the UC_VID field. The Realtek GPL SDK calls
that field agg_vid, auto-learned by the hardware for MAC-based N:1 VLAN
translation (rtk/l2.h). This driver never sets that translation up, so
the field is 0 on every learned entry, and bridge fdb show printed those
entries without a VLAN.

The VLAN an entry is keyed and forwarded on is FID_RVID, e.rvid.
rtldsa_port_fdb_add() hashes on it and writes it to both fields, which
is why static entries showed the right VLAN, and the RTL931x reader
already fills vid from it. Report e.rvid.

Tested on a Hasivo S1100W-8XGT-SE (RTL9303) with two hosts learned on
lan1 in VLANs 1 and 3. Their L2 entries read back with vid 0, the value
the dump passed on until now, and rvid 1 and 3; bridge fdb show now
lists them as vlan 1 and vlan 3. Compile-tested for rtl838x and rtl839x.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Gennaro Cimmino <gcimmino@rayonra.net>
Link: https://github.com/openwrt/openwrt/pull/25690
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-10-07 17:33:28 +02:00
Markus Stockhausen 4e615a0ecd realtek: dts: align partition naming
The partition "@" naming should align with the real start addresses.
Some devices are inconsistent about that. Adapt that.

Link: https://github.com/openwrt/openwrt/pull/25677
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-10-07 17:31:59 +02:00
Ryan Leung 79bc56cb74 u-boot: add project's new download source
Das U-Boot project is transitioning their infrastructure [1],[2] and now publishes releases on their
GitLab [3]. Add it as the first download source and keep the existing sources which are currently
still available for historical releases.

Also update the U-Boot project web page [1] for the package URL and bump PKG_RELEASE for uboot-tools

[1]: https://lore.kernel.org/u-boot/20260511174116.GJ1858239@bill-the-cat/
[2]: https://lore.kernel.org/u-boot/20260727224922.GB1188@bill-the-cat/
[3]: https://git.u-boot-project.org/u-boot/u-boot/-/releases/

Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/25343
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-07 14:29:03 +02:00
Wei-Ting Yang 935d33d31a base-files: add CONFIG_TARGET_SERIAL to PKG_CONFIG_DEPENDS
Ensure changes to CONFIG_TARGET_SERIAL trigger a base-files rebuild so
that the latest value is used in /etc/inittab.

Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25689
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-07 14:07:47 +02:00
Mieczyslaw Nalewaj 01c0c192c1 generic: backport rtl8365mb BIT()/GENMASK() mask refactor
Backport the upstream patch that converts the rtl8365mb register masks
from hardcoded hex values to BIT() and GENMASK().

Upstream commit:
net: dsa: realtek: rtl8365mb: define masks using BIT() and GENMASK()
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=9b84b36a527ccc831389628058a5bb1fcad66008

This is a pure refactoring with no functional change. It is backported
so that later rtl8365mb backports based on the new macros apply cleanly.

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/25678
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-07 14:01:27 +02:00
Gennaro Cimmino a6b28a9a77 realtek: l3: free egress interfaces
A route through the switch takes an egress interface for the MAC of its
device and its VLAN, 64 of them, and nothing gave one back: it stayed in
hardware after the last route that used it was gone.

Count the routes that hold each egress interface. A route lets go of its
own in otto_l3_route_teardown(), once otto_l3_route_remove() has taken
its entry out of the hardware, except for a prefix route once the rows
are no longer where the driver records them (a failed move or a lookup
that timed out), whose row may still route through it. The IPv4 add path
lets go on its error paths, where nothing was written. The last route to
let go zeroes the interface's source MAC, which is what
otto_l3_alloc_egress_intf() takes for a free one. Driver removal leaves
the hardware as it was. RTL839x allocates none and is unchanged.

Router MACs stay as they were. A router MAC is what makes the switch
route what it receives on that MAC, so it lives as long as the interface
rather than the routes out of it, and following interfaces is a change
of its own.

Tested on a Hasivo S1100W-8XGT-SE (RTL9303) with a kprobe on
otto_table_write_bytes() logging the writes to the router MAC table and
to the egress interface source MACs. switch.3 takes a MAC no route uses,
and two /24 routes via the same gateway share one egress interface.
Deleting the first frees nothing and the second still forwards 5 of 5
echoes. Deleting the second zeroes the source MAC with this change and
writes nothing on main; neither writes the router MAC.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Gennaro Cimmino <gcimmino@rayonra.net>
Link: https://github.com/openwrt/openwrt/pull/25682
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
2026-10-07 11:42:50 +02:00
Daniel Golle 48592abf6f rockchip: translate DMA for the media IOMMU masters
The video codecs sit behind their own IOMMUs, but with the default
domain set to passthrough their buffers have to be physically
contiguous and come out of the 16 MiB CMA pool. A 4K frame needs
15.8 MiB of it, so hardware decoding of 4K video fails allocation and
falls back to software: 10 seconds of 4K HEVC then cost 22 seconds of
CPU, where the decoder does the same work with 0.15.

Have rockchip-iommu ask for a translated domain for the masters it
serves, so the display, codec, ISP and RGA blocks get scatter-gather
while everything behind another IOMMU, PCIe included, keeps the system
default and its throughput.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:13 +01:00
Daniel Golle b14b8d95d9 rockchip: add camera capture kernel modules
The RK3588 camera path is two drivers: the video capture unit and the
MIPI CSI-2 receiver that feeds it. Package both, so a board with a
camera connector can use them.

kmod-video-rockchip-cif pulls in the receiver, since MIPI is the only
input the driver supports on RK3568 and RK3588.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:13 +01:00
Daniel Golle 61f19fda28 kernel: add the IMX415 camera sensor module
The Sony IMX415 is the sensor on the Radxa Camera 4K and on several
other MIPI CSI-2 modules, and the driver is in the kernel already. Add
kmod-video-imx415 so a board with a camera connector has a sensor to
go with its capture driver.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:13 +01:00
Daniel Golle ee65abf03a rockchip: backport the rk3588 camera device tree nodes
Add the MIPI CSI-2 receiver nodes and the video capture unit to the
RK3588 device tree, so the drivers have something to bind to. Both
land disabled, and the CSI D-PHY nodes they connect to are already
in 6.18.

No board enables them yet: the connector wiring lives in a per-board
overlay, and upstream carries one only for the ROCK 5B+ so far.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:13 +01:00
Daniel Golle 3d5db97adc rockchip: backport RK3588 MIPI CSI-2 camera capture
The RK3588 camera path needs two drivers that landed after 6.18: the
Rockchip video capture unit, which gained rk3588 support in 7.2, and
the DesignWare MIPI CSI-2 receiver it is fed from, which arrived in
7.0. The CSI D-PHY and the imx415, imx219 and ov5647 sensors are in
6.18 already, so these two are what is missing.

Backport both drivers with their bindings. The i.MX93 and i.MX95
additions to the receiver come along, which keeps it at an upstream
state so that later fixes apply as they are.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:13 +01:00
Daniel Golle 444686aecc rockchip: add display, GPU, codec and audio kernel modules
Package the Rockchip DRM driver with VOP, VOP2, eDP, DP, HDMI, HDMI QP,
MIPI DSI and MIPI DSI2 support, the Rocket NPU driver, the Samsung
HDPTX and DCPHY and the Innosilicon CSI DPHY, the RKVDEC and RGA V4L2
drivers, the Synopsys HDMI receiver, the I2S, I2S/TDM and S/PDIF ASoC
drivers and the DFI DDR monitor, so that every device in the rk3588
device tree has its driver available.

The DFI DDR monitor is a devfreq event driver, so PM_DEVFREQ_EVENT is
set in the target configuration, which is what lets the driver build as
a module and be installed on a released image. The remaining new
symbols are recorded as disabled defaults in the generic configuration,
where a kernel module package can enable the one it needs. The per-SoC
V4L2 mem2mem drivers go there as well: they have no recorded value
anywhere, so kconfig stops to ask for them on any target whose ARCH
symbol matches once kmod-video-mem2mem opens the mem2mem menu.

The DRM driver and the HDMI PHY are marked for /etc/modules-boot.d, as
procd loads those before preinit runs. Loaded from /etc/modules.d
instead, /dev/dri stays empty until the overlay is mounted, which on a
Rock 5B is several seconds in and too late for anything drawing to the
screen during boot.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle a9f9bd074f kernel: add ASoC simple card, HDMI and ES8316 codec modules
Package the simple-audio-card and audio-graph-card drivers with their
shared utilities, the HDMI codec used by DRM bridges with an HDMI
audio path, and the Everest ES8316 codec.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle 146a31c962 kernel: add V4L2 codec helpers and the Hantro VPU module
Package the H.264, VP9 and JPEG helper modules on their own so several
stateless codec drivers can share them, and add the Hantro VPU driver
used by i.MX8M, Rockchip, Allwinner, Microchip and ST SoCs. The i.MX
CODA package takes the JPEG helper from the new package.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle 4e8f881ecc kernel: add DRM bridge, GPUVM and Panthor modules
Package the Synopsys DW DisplayPort, HDMI, HDMI QP, MIPI DSI and MIPI
DSI2 bridges, the Analogix DisplayPort bridge with the DP AUX bus, the
GPUVM helper and the Panthor driver for ARM Mali CSF GPUs. The HDMI QP
bridge depends on the HDMI codec module for its audio path.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle f673169be9 kernel: ship v4l2-dv-timings with kmod-video-core
CONFIG_VIDEO_DEV builds v4l2-dv-timings.ko next to videodev.ko, but the
package only installs the latter, so a driver that needs the DV timings
helpers, such as the Synopsys HDMI receiver, cannot be packaged.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle 43fef80eaf linux-firmware: add the ARM Mali CSF GPU firmware
The Panthor driver loads arm/mali/arch<version>/mali_csffw.bin for the
Mali GPUs with a command stream front end, such as the G610 in the
RK3588. Package every architecture version so one package serves all
of them.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle da9309fa07 rockchip: select the HDMI codec for the DW HDMI QP output
The DW HDMI QP bridge exposes its audio path through the DRM HDMI audio
helper, which registers an hdmi-audio-codec platform device. Nothing on
that path selects the promptless SND_SOC_HDMI_CODEC, so the RK3588 HDMI
outputs have no audio unless another driver happens to pull the codec
in. Select it from ROCKCHIP_DW_HDMI_QP as the CDN DP option does.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle cde94c23a7 rockchip: backport rk3588 device tree updates
Add the VDPU381 decoder nodes with the register block order and power
domain node names the rkvdec binding expects, correct the PCIe range
mappings and the NPU IOMMU unit addresses, and add the missing eDP
clocks.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00
Daniel Golle d2e03cdc91 rockchip: backport RK3588 video decoder support
Bring in the media/rkvdec series that adds decoder variants, the HEVC
backend and the VDPU381 and VDPU383 H.264 and HEVC backends used by the
RK3588 and RK3576, together with the Hantro AV1 and G2 fixes, the HEVC
control additions and validations in v4l2-ctrls and the v4l2-mem2mem
changes they build on. Fixes that 6.18.44 stable already carries are
left out.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 10:12:12 +01:00