This version fixes some security problems:
* Client impersonation while resuming a TLS 1.3 session
(CVE-2026-34873)
* Entropy on Linux can fall back to /dev/urandom (CVE-2026-34871)
* PSA random generator cloning (CVE-2026-25835)
* Compiler-induced constant-time violations (CVE-2025-66442)
* Null pointer dereference when setting a distinguished name
(CVE-2026-34874)
* Buffer overflow in FFDH public key export (CVE-2026-34875)
* FFDH: lack of contributory behaviour due to improper input validation
(CVE-2026-34872)
* Signature Algorithm Injection (CVE-2026-25834)
* CCM multipart finish tag-length validation bypass (CVE-2026-34876)
* Risk of insufficient protection of serialized session or context data
leading to potential memory safety issues (CVE-2026-34877)
* Buffer underflow in x509_inet_pton_ipv6() (CVE-2026-25833)
Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.6
Size increases by 470 bytes on aarch64:
343995 bin/packages/aarch64_generic/base/libmbedtls21-3.6.5-r1.apk
344465 bin/packages/aarch64_generic/base/libmbedtls21-3.6.6-r1.apk
Link: https://github.com/openwrt/openwrt/pull/22787
(cherry picked from commit f48ef0040b7e4a80283d0775d397b8a3c66b7275)
Link: https://github.com/openwrt/openwrt/pull/23362
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit c334b9a9d59f2d572da006469976f29989eb2565)
It was discovered that the internal PHY interrupt are not always connected
and PHY link up/down is not correctly detected.
This is the case of the Nokia Valyrian board that suffer from this problem.
To handle this, drop the internal PHY interrupt property from DTSI and add
it only to the Gemtek W1700K DTS where it was reported to work correctly.
(cherry picked from commit 89d8dc13d066e5dc44586e3db670cb8daabf7c23)
[ drop Gemtek W1700K ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit af35693db2ec3faa81ef2042135f14308e9b286d)
Backport new field_prep()/get() particularly useful to handle case where a
bitmask is not const and FIELD_PREP can't be used. This permit to replace
manual shift with these macro. (also needed to permit backport of some
patch without modification)
Backport reworked patch that drop the local field_prep()/get() macro in
favor of the global one.
Link: https://github.com/openwrt/openwrt/pull/22479
(cherry picked from commit 25f92aaae1795f992fc288c5c877724249d59296)
[ fix conflict error, drop invalid patch ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 72dbda434454c615979fbd8cc1f25bbd7860f487)
Backport more upstream patch to include all the fixes pushed upstream and
add all the preliminary patch for multi-serdes support.
While at it also move 2 patch in the 6xx numbering to the 000-1xx backport
numbering to keep things tidy.
All the affected patch manually and automatically refreshed.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
[ add comment, renumber patch, add more patch, fix PCS patch ]
Link: https://github.com/openwrt/openwrt/pull/22479
(cherry picked from commit c5a8ddd0acb3163d3c1a4ef13b9963cc0340557f)
[ fix conflict errors ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 6bbc109633252c04d59c227a6184c47d6637b2f2)
Initialize NPU Block Ack memory region if reserved via DTS.
Block Ack memory region is used by NPU MT7996 (Eagle) offloading.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://github.com/openwrt/openwrt/pull/22289
(cherry picked from commit 305f685f83fc1332102273cb09bb386ff1561d94)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit ecb7f66949bc9c52f5dc506c58f49d9c358add7f)
Implement the .get_link_ksettings to get the rate, duplex, and
auto-negotiation status.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/21530
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 4953db3aeff052223e4588fe892f94a32e917a05)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 0c77a7d8dd1bdec2e7c1158eadd36ab2743aa227)
Renumber ASoC and PCS patch to 2xx and 3xx numbering to leave space for
more backport patch in the 000-1xx numbering.
Link: https://github.com/openwrt/openwrt/pull/22479
(cherry picked from commit 9b21478d961ae791e93b69ad460a97050ee2544b)
[ fix conflict errors ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit eab260115a1f037786d1cc3f52cd08cababa2835)
Commit 8f1914053b24 ("airoha: replace I2S patch with upstream pending
version") introduced a kernel panic with I2S driver.
Add the fixed patch to fix the kernel panic.
Fixes: 8f1914053b24 ("airoha: replace I2S patch with upstream pending version")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit cc57e155a60891631c5040b9c4a3a2c0d1dbf38f)
(cherry picked from commit 62dc186272e3757d02e9cb43e530158b56e26cd2)
Replace I2S sound patch with upstream pending version. This adds ETDM
support and fix various bug in the downstream implementation.
(cherry picked from commit 8f1914053b24f56c101057390a0a83707864cf71)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 6f66bee6ba189d014c9fb5f7834161d157037491)
'CONFIG_NET_AIROHA_FLOW_STATS=y' currently breaks NPU
offload for AN7581+MT7996, so disable it for now.
Signed-off-by: Kenneth Kasilag <kenneth@kasilag.me>
Link: https://github.com/openwrt/openwrt/pull/22300
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit d09041eb8a8e791c399ce5c3ec0b517b9655ef23)
(cherry picked from commit 530d3329f4d070162c6cd53d6775edb42183f19e)
Drop airoha,x2-mode related property from the DTSI and enable them only in
the relevant devices that use a PCIe0 line. x2-mode should be enabled only
for the WiFi card that would use it as it might cause problem for WiFi card
that expect 2 single PCIe x1 line instead of a single PCIe x2 line.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 0bf18702459a9de160bb0ee599e4b3c8662fd9a7)
(cherry picked from commit 6bd5ed7254438214830b2d909abcbd83f5474d0b)
Fix two hardware initialization issues in the EN7581 PCIe controller
and add support for x2 (2-lane) link mode.
Fixes:
The upstream EN7581 PCIe initialization writes EQ presets and PIPE
configuration registers before clk_bulk_prepare_enable(). Since the
MAC clocks are not yet running at that point, these register writes
are silently dropped, leaving the hardware with default values. This
can cause link training failures or suboptimal equalization.
Additionally, after link training the MAC may only advertise Gen1-Gen2
capability in the Link Capabilities 2 register despite the PHY being
configured for Gen3. A serdes reset toggle forces the MAC to re-read
PHY capability, recovering Gen3 8GT/s link speed.
Both issues are addressed by separating PERST from the clock callbacks
(patch 911), allowing the PCIe controller driver to properly sequence
PERST, clock enable, and register writes (patch 912).
New feature:
PCIe x2 mode support for EN7581 using the NP_SCU system controller
for serdes mux routing, PERST management, and lane configuration.
Both bonded MACs are configured for x2 operation with proper EQ
presets before link training begins.
Signed-off-by: Ryan Chen <rchen14b@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21978
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 8b9bd686e7c705dca28849882f53cf416559e1df)
[ refresh patch ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit db4a0d5935899ac955a84fc1e9d60d419f4f9c93)
Add specific DTSI for NPU firmware based on the supported WiFi chip and
update the supported device by including the relevant new DTSI.
(cherry picked from commit f075c1148d992aa06d342fc64ac8f15b6b0db920)
[ drop W1700K dts change ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 4699a8ad45d12e3e2577ed87125ca5ff7b673a08)
Introduce the capability to read the firmware binary names from device-tree
using the firmware-name property if available.
This is a preliminary patch to enable NPU offloading for MT7996 (Eagle)
chipset since it requires a different binary with respect to the one
used for MT7992 on the EN7581 SoC.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://github.com/openwrt/openwrt/pull/22289
(cherry picked from commit 123557f0e293169ca647f07fff527e45fcf8b7dc)
[ refresh patch ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 503ffed6c4c5cc0be35f7566b9f5b98dc2d50f14)
OpenSSL 3.0.20 is a security patch release. The most severe CVE fixed in
this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fixed incorrect failure handling in RSA KEM RSASVE encapsulation.
(CVE-2026-31790)
* Fixed potential use-after-free in DANE client code.
(CVE-2026-28387)
* Fixed NULL pointer dereference when processing a delta CRL.
(CVE-2026-28388)
* Fixed possible NULL dereference when processing CMS
KeyAgreeRecipientInfo.
(CVE-2026-28389)
* Fixed possible NULL dereference when processing CMS
KeyTransportRecipientInfo.
(CVE-2026-28390)
* Fixed heap buffer overflow in hexadecimal conversion.
(CVE-2026-31789)
Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
Link: https://github.com/openwrt/openwrt/pull/23346
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 44d98eec231534487cbec4ba8f852c1acf67a32d)
Stop overriding CCACHE_COMPILERCHECK from rules.mk and rely on
ccache's default, which hashes the compiler binary's mtime and
size.
For a local tree that is enough: the toolchain only changes when
it is rebuilt, and a rebuild updates mtime and size. Users who
want a stricter check can still set CCACHE_COMPILERCHECK in their
environment.
CI does not depend on this export either. The workflow writes a
secondary ccache.conf with
compiler_check=string:<toolchain-commit-sha>
so the cache key is tied to the toolchain source revision. That
is both stricter than the previous "%compiler% -v -c" setting
and portable across runners, where compiler mtimes would not
match after restoring a cache archive.
Link: https://github.com/openwrt/openwrt/pull/22995
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3956287514e5457723070f4b8bc7ed8084019d39)
(cherry picked from commit a6149ff867c92daa1aaa050b27ba8c6053d7cfe0)
Update the compiler check for ccache so we don't
end up with the wrong binaries. Right now the
compiler check will not be able to correctly
distinguish the compiler used for build
ARMv8 binaries from the one used to build
ARMv7 binaries.
Signed-off-by: Markus Gothe <markus.gothe@genexis.eu>
Link: https://github.com/openwrt/openwrt/pull/16290
Signed-off-by: John Crispin <john@phrozen.org>
(cherry picked from commit 3859e8eeb82950d8594f60d40e5ee23fd02207c9)
(cherry picked from commit 71d259b59998a214049c9e456f330cd8f292468f)
This fixes a simple logic error in the macaddr existence check in mac80211.uc.
Signed-off-by: Harin Lee <me@harin.net>
Link: https://github.com/openwrt/openwrt/pull/21277
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 2ebcda1ea6b757864c4700e543a9767752ca766e)
Link: https://github.com/openwrt/openwrt/pull/23100
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit b76c38f9e2316e3ad125f6f2e4c7e27d025fad6e)
Drop HIDDEN option from U-Boot default for Airoha while support for ATF
gets pushed.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit cce81ed05bf944bb8188875757f2ab2ddfbfa4a8)
(cherry picked from commit c5de245171de11c694bb7720f5d30ab4467829ca)
Introduce support for U-Boot for Airoha EN7581/AN7583. For EN7581
initial patch are already in U-Boot mainline and doesn't require
backport, for AN7583 some patch are still pending but already posted
upstream.
Also add for now, precompiled binary for ATF BL2 and BL31. Support for
ATF is planned and will come later.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 04f6769a4a87ed6de4c8a875d35743ca1783e947)
(cherry picked from commit 507bd4c77520af2bf68406654b4b9e146c27b4a6)
The GitHub CI was sometimes still building some tools again even when
the same version was already pre-built. This change fixes the problem
and should improve the speed of the GitHub CI actions. The duration of
the "Build tools" step will be reduced from 5 to 20 minutes down to
10 to 15 seconds.
make also checks that dependencies are not more recent than the target
it wants to build. Previously find returned files in an arbitrary order
and touch set the current timestamp. Since touch is called per file the
timestamps differ in fractional seconds, so not all files got the same
time. make detected a more recent dependency and started to rebuild.
Now all files are set to the same timestamp and make will assume
everything is up to date.
It is sufficient to only touch the stamp files to prevent rebuilding.
Link: https://github.com/openwrt/openwrt/pull/22888
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit cd6cb9f765df46eea7aefaab9d61e143c3996423)
(cherry picked from commit 44df9972d59ea1ec9365bc821af974f1e8686e02)
Swig 4.3.0 has changed SWIG_Python_AppendOutput, which now requires an
additional parameter `is_void`. SWIG_AppendOutput remains unchanged.
This was fixed upstream in u-boot/u-boot@a63456b
```
scripts/dtc/pylibfdt/libfdt_wrap.c: In function '_wrap_fdt_next_node':
scripts/dtc/pylibfdt/libfdt_wrap.c:5581:17: error: too few arguments to function 'SWIG_Python_AppendOutput'
5581 | resultobj = SWIG_Python_AppendOutput(resultobj, val);
| ^~~~~~~~~~~~~~~~~~~~~~~~
```
This is the same fix as applied in 363e07d.
Signed-off-by: Trix Taiclet <git@trix.moe>
Link: https://github.com/openwrt/openwrt/pull/22870
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 9d0bafca525d8309b836e7fa1780f9decb3a0c20)
Swig 4.3.0 has changed SWIG_Python_AppendOutput, which now requires an
additional parameter `is_void`. SWIG_AppendOutput remains unchanged.
This was fixed upstream in u-boot/u-boot@a63456b
```
scripts/dtc/pylibfdt/libfdt_wrap.c: In function '_wrap_fdt_next_node':
scripts/dtc/pylibfdt/libfdt_wrap.c:5581:17: error: too few arguments to function 'SWIG_Python_AppendOutput'
5581 | resultobj = SWIG_Python_AppendOutput(resultobj, val);
| ^~~~~~~~~~~~~~~~~~~~~~~~
```
This is the same fix as applied in 363e07d.
Signed-off-by: Trix Taiclet <git@trix.moe>
Link: https://github.com/openwrt/openwrt/pull/22870
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 1e61a54d7224eaa5c5067ca9d0edd3c8374fe75f)
No need to add another aliases node just for the label-mac-device,
luckily DTC was smart enough to combine them together in the final DTB.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 1f535037b19731cd37512ed00b648a35b40ad13c)
(cherry picked from commit fbca86e8bd815921a37d432f4007564974eb3fc5)
The correct label mac is needed in a downstream project.
Signed-off-by: Steffen Förster <nemesis@chemnitz.freifunk.net>
Link: https://github.com/openwrt/openwrt/pull/22802
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit beaf298c4cb6f0d678cfdc251060af207ee4bab8)
The Xiaomi Redmi/Mi Router AC2100 does have the correct label mac on the WAN interface.
This MAC is available as gmac1.
Signed-off-by: Florian Maurer <f.maurer@outlook.de>
Link: https://github.com/openwrt/openwrt/pull/22567
(cherry picked from commit b1713d623be30d26da0bd48ecff9032881ce5684)
Link: https://github.com/openwrt/openwrt/pull/22624
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit a64f028d39597448f5949c34b4fdd646deca92d8)
Release previously allocated memory and OF node before return.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/22276
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 4778e35464d4ae38f2dc508be5caf3861e1799b3)
Link: https://github.com/openwrt/openwrt/pull/22348
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 2120db27b569d5242ba9d1baef645d578678dc25)
The bootcount init script is missing the executable bit (644 instead of 755),
causing the script to not be executable:
/etc/preinit: line 44: /etc/init.d/bootcount: Permission denied
Fixes: c3b8108a2be4 ("ramips: Add support for Xiaomi MiWiFi 3A")
Signed-off-by: Oliver Sedlbauer <os@dev.tdt.de>
Link: https://github.com/openwrt/openwrt/pull/22446
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit a15b224e8309fa203dcc23fe95c8cf8dd748255d)
(cherry picked from commit 81be8a8869a36828ded87c8f5de09214d594d433)
The MIPS code assigns the clock node based on the device tree node name.
This name was renamed with kernel 6.12.58 and v6.6.117. Adapt our out of
tree device tree files to this rename to fix loading the STP GPIO
driver.
Without this fix the driver fails like this:
```
[ 0.320000] gpio-stp-xway 1e100bb0.stp: Failed to get clock
[ 0.330000] gpio-stp-xway 1e100bb0.stp: probe with driver gpio-stp-xway failed with error -2
```
Link: https://git.kernel.org/linus/b0d04fe6a633ada2c7bc1b5ddd011cbd85961868
Fixes: https://github.com/openwrt/openwrt/issues/21697
Co-Authored-By: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/22444
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit d405685b44c61b8d0f1ec046d58adfd8b1426893)
[Fix danube.dtsi too]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3214b8a3289bfa219706447804a2f1daad3521d9)
Cherry pick an upstream patch to fix a memory leak.
Fixed in OpenWrt main branch in commit
2c2cea8864db ("package: update jsonfilter to latest HEAD 2026-03-12")
Link: e086664e6a
Link: https://github.com/openwrt/openwrt/pull/22440
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 77d54cca84ffbb7754d592712ee96b0fcbff0d92)
Update procd cherry-picking fixes from main branch to dedicated
openwrt-24.10 backport branch.
c59f2d8 instance: don't print error in case cgroups are disabled
196291a instance: use positive error numbers for strerror()
d23ddec rcS, ubus: constify char * arguments and variables where appropriate
aeeef20 instance: use mkdir_p helper
d033b7c signal: handle SIGUSR1 as halt
8bc8377 cgroups: fix syntax error
909d02b instance: check length of names when creating cgroups
5ec782f procd: jail/cgroups: fix OOB write in cgroups_apply()
8581313 hotplug-dispatch: fix filter disallowing setting PATH
6265463 service instance: Improve handling of watchdog config changes
45bef92 service instance: Fix overwriting of watchdog linked list members
8294471 coldplug: fix missing header include
fb1c92b hotplug-dispatch: fix missing header include
6dafa86 initd/coldplug: create /dev/null before running udevtrigger
c268f13 hotplug-dispatch: redirect output to /dev/null
b8c4f86 hotplug-dispatch: use stat if d_type is DT_UNKNOWN
1f2aa1a system: fix arguments validation in ubus handler
7e5e049 service: fix use-after-free on service data update
3f48d76 instance: convert jail feature flags to bitmap
2c7c0d2 rcS: avoid duplicate pending "running" calls
5a9b16d service: re-run init script "running" command after instance restart
d5a45ff jail: fix NULL-pointer dereference when connection to ubus failed
8de8cdf jail: always handle mkdir() return value
fa594db jail: seccomp-oci: fix uninitialized pointer read in error path
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 3e77f8c7abdefa321f2fbc97a27e9d482789a183)
a52cdb354d13 dns: validate IPv4 record addresses
b798c24205b5 dns: validate IPv6 record addresses
a3dcb4adc635 dns: validate reverse dns query name lengths
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
(cherry picked from commit 8a7eb57ab8366045d7e1470c003827391e37684b)
(cherry picked from commit 68befe26ac033d7817014ff014e8eedc4c701360)
75bedc5 wireless-regdb: Update regulatory info for Australia (AU) for 2025
a6e5195 wireless-regdb: Update broken link in regulatory.bin(5) manpage
9e8c67f wireless-regdb: Update regulatory info for Malaysia (MY) for 2024
61a4637 wireless-regdb: Update regulatory info for Malaysia (MY) for 2025
5cefe55 wireless-regdb: Update regulatory info for Tunisia (TN) on 6GHz for 2025
1a729ae wireless-regdb: Update regulatory info for Canada (CA) for 2025
ea20dfa wireless-regdb: update regulatory database based on preceding changes
Link: https://github.com/openwrt/openwrt/pull/22150
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 7c5e329b541066613c09aafd89f7bb6cd8b3bc67)
(cherry picked from commit fb624926e3ed1165a40f07e9a47b6ea5ebacb487)
The MT7531 has an incorrect interrupt number described in the DTS.
This commit also adds PHY interrupts. They work the same as on
the MT7988.
Tested on Gemtek W1700k.
Suggested-by: Benjamin Larsson <benjamin.larsson@genexis.eu>
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/21016
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 788958880b66dd3f451d53801c8d25e5e6cfe1b8)
[ fix conflict error, adapt for kernel 6.6 ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 6f55a705896900d199a338a82d2e5e3238b74681)
