This version fixes multiple security problems:
CVE-2025-7395: Problem in certificate verification on Apple devices
CVE-2025-7394: Predictable results from RAND_bytes() after fork call in OpenSSL compatibility layer
CVE-2025-7396: Activate Curve25519 blinding support
See Release notes:
https://github.com/wolfSSL/wolfssl/releases/tag/v5.8.0-stablehttps://github.com/wolfSSL/wolfssl/releases/tag/v5.8.2-stable
wolfSSL is now GPLv3 instead of GPLv2, see:
629c5b4cf6
The file size increased a bit:
```
546060 bin/packages/mipsel_24kc/base/libwolfssl5.7.6.e624513f-5.7.6-r1.apk
560684 bin/packages/mipsel_24kc/base/libwolfssl5.8.2.e624513f-5.8.2-r1.apk
```
Link: https://github.com/openwrt/openwrt/pull/20547
(cherry picked from commit 92f07864c1f29b39df73b0f3858c500a8d8fa931)
Link: https://github.com/openwrt/openwrt/pull/23363
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 4c472ca84d9e3ce18fbe052762b2bd235fa35cc7)
This version fixes some security problems:
* Client impersonation while resuming a TLS 1.3 session
(CVE-2026-34873)
* Entropy on Linux can fall back to /dev/urandom (CVE-2026-34871)
* PSA random generator cloning (CVE-2026-25835)
* Compiler-induced constant-time violations (CVE-2025-66442)
* Null pointer dereference when setting a distinguished name
(CVE-2026-34874)
* Buffer overflow in FFDH public key export (CVE-2026-34875)
* FFDH: lack of contributory behaviour due to improper input validation
(CVE-2026-34872)
* Signature Algorithm Injection (CVE-2026-25834)
* CCM multipart finish tag-length validation bypass (CVE-2026-34876)
* Risk of insufficient protection of serialized session or context data
leading to potential memory safety issues (CVE-2026-34877)
* Buffer underflow in x509_inet_pton_ipv6() (CVE-2026-25833)
Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.6
Size increases by 470 bytes on aarch64:
343995 bin/packages/aarch64_generic/base/libmbedtls21-3.6.5-r1.apk
344465 bin/packages/aarch64_generic/base/libmbedtls21-3.6.6-r1.apk
Link: https://github.com/openwrt/openwrt/pull/22787
(cherry picked from commit f48ef0040b7e4a80283d0775d397b8a3c66b7275)
Link: https://github.com/openwrt/openwrt/pull/23362
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit c334b9a9d59f2d572da006469976f29989eb2565)
It was discovered that the internal PHY interrupt are not always connected
and PHY link up/down is not correctly detected.
This is the case of the Nokia Valyrian board that suffer from this problem.
To handle this, drop the internal PHY interrupt property from DTSI and add
it only to the Gemtek W1700K DTS where it was reported to work correctly.
(cherry picked from commit 89d8dc13d066e5dc44586e3db670cb8daabf7c23)
[ drop Gemtek W1700K ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit af35693db2ec3faa81ef2042135f14308e9b286d)
Backport new field_prep()/get() particularly useful to handle case where a
bitmask is not const and FIELD_PREP can't be used. This permit to replace
manual shift with these macro. (also needed to permit backport of some
patch without modification)
Backport reworked patch that drop the local field_prep()/get() macro in
favor of the global one.
Link: https://github.com/openwrt/openwrt/pull/22479
(cherry picked from commit 25f92aaae1795f992fc288c5c877724249d59296)
[ fix conflict error, drop invalid patch ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 72dbda434454c615979fbd8cc1f25bbd7860f487)
Backport more upstream patch to include all the fixes pushed upstream and
add all the preliminary patch for multi-serdes support.
While at it also move 2 patch in the 6xx numbering to the 000-1xx backport
numbering to keep things tidy.
All the affected patch manually and automatically refreshed.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
[ add comment, renumber patch, add more patch, fix PCS patch ]
Link: https://github.com/openwrt/openwrt/pull/22479
(cherry picked from commit c5a8ddd0acb3163d3c1a4ef13b9963cc0340557f)
[ fix conflict errors ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 6bbc109633252c04d59c227a6184c47d6637b2f2)
Initialize NPU Block Ack memory region if reserved via DTS.
Block Ack memory region is used by NPU MT7996 (Eagle) offloading.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://github.com/openwrt/openwrt/pull/22289
(cherry picked from commit 305f685f83fc1332102273cb09bb386ff1561d94)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit ecb7f66949bc9c52f5dc506c58f49d9c358add7f)
Implement the .get_link_ksettings to get the rate, duplex, and
auto-negotiation status.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/21530
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 4953db3aeff052223e4588fe892f94a32e917a05)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 0c77a7d8dd1bdec2e7c1158eadd36ab2743aa227)
Renumber ASoC and PCS patch to 2xx and 3xx numbering to leave space for
more backport patch in the 000-1xx numbering.
Link: https://github.com/openwrt/openwrt/pull/22479
(cherry picked from commit 9b21478d961ae791e93b69ad460a97050ee2544b)
[ fix conflict errors ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit eab260115a1f037786d1cc3f52cd08cababa2835)
Commit 8f1914053b24 ("airoha: replace I2S patch with upstream pending
version") introduced a kernel panic with I2S driver.
Add the fixed patch to fix the kernel panic.
Fixes: 8f1914053b24 ("airoha: replace I2S patch with upstream pending version")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit cc57e155a60891631c5040b9c4a3a2c0d1dbf38f)
(cherry picked from commit 62dc186272e3757d02e9cb43e530158b56e26cd2)
Replace I2S sound patch with upstream pending version. This adds ETDM
support and fix various bug in the downstream implementation.
(cherry picked from commit 8f1914053b24f56c101057390a0a83707864cf71)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 6f66bee6ba189d014c9fb5f7834161d157037491)
'CONFIG_NET_AIROHA_FLOW_STATS=y' currently breaks NPU
offload for AN7581+MT7996, so disable it for now.
Signed-off-by: Kenneth Kasilag <kenneth@kasilag.me>
Link: https://github.com/openwrt/openwrt/pull/22300
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit d09041eb8a8e791c399ce5c3ec0b517b9655ef23)
(cherry picked from commit 530d3329f4d070162c6cd53d6775edb42183f19e)
Drop airoha,x2-mode related property from the DTSI and enable them only in
the relevant devices that use a PCIe0 line. x2-mode should be enabled only
for the WiFi card that would use it as it might cause problem for WiFi card
that expect 2 single PCIe x1 line instead of a single PCIe x2 line.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 0bf18702459a9de160bb0ee599e4b3c8662fd9a7)
(cherry picked from commit 6bd5ed7254438214830b2d909abcbd83f5474d0b)
Fix two hardware initialization issues in the EN7581 PCIe controller
and add support for x2 (2-lane) link mode.
Fixes:
The upstream EN7581 PCIe initialization writes EQ presets and PIPE
configuration registers before clk_bulk_prepare_enable(). Since the
MAC clocks are not yet running at that point, these register writes
are silently dropped, leaving the hardware with default values. This
can cause link training failures or suboptimal equalization.
Additionally, after link training the MAC may only advertise Gen1-Gen2
capability in the Link Capabilities 2 register despite the PHY being
configured for Gen3. A serdes reset toggle forces the MAC to re-read
PHY capability, recovering Gen3 8GT/s link speed.
Both issues are addressed by separating PERST from the clock callbacks
(patch 911), allowing the PCIe controller driver to properly sequence
PERST, clock enable, and register writes (patch 912).
New feature:
PCIe x2 mode support for EN7581 using the NP_SCU system controller
for serdes mux routing, PERST management, and lane configuration.
Both bonded MACs are configured for x2 operation with proper EQ
presets before link training begins.
Signed-off-by: Ryan Chen <rchen14b@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21978
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 8b9bd686e7c705dca28849882f53cf416559e1df)
[ refresh patch ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit db4a0d5935899ac955a84fc1e9d60d419f4f9c93)
Add specific DTSI for NPU firmware based on the supported WiFi chip and
update the supported device by including the relevant new DTSI.
(cherry picked from commit f075c1148d992aa06d342fc64ac8f15b6b0db920)
[ drop W1700K dts change ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 4699a8ad45d12e3e2577ed87125ca5ff7b673a08)
Introduce the capability to read the firmware binary names from device-tree
using the firmware-name property if available.
This is a preliminary patch to enable NPU offloading for MT7996 (Eagle)
chipset since it requires a different binary with respect to the one
used for MT7992 on the EN7581 SoC.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Link: https://github.com/openwrt/openwrt/pull/22289
(cherry picked from commit 123557f0e293169ca647f07fff527e45fcf8b7dc)
[ refresh patch ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 503ffed6c4c5cc0be35f7566b9f5b98dc2d50f14)
OpenSSL 3.0.20 is a security patch release. The most severe CVE fixed in
this release is Moderate.
This release incorporates the following bug fixes and mitigations:
* Fixed incorrect failure handling in RSA KEM RSASVE encapsulation.
(CVE-2026-31790)
* Fixed potential use-after-free in DANE client code.
(CVE-2026-28387)
* Fixed NULL pointer dereference when processing a delta CRL.
(CVE-2026-28388)
* Fixed possible NULL dereference when processing CMS
KeyAgreeRecipientInfo.
(CVE-2026-28389)
* Fixed possible NULL dereference when processing CMS
KeyTransportRecipientInfo.
(CVE-2026-28390)
* Fixed heap buffer overflow in hexadecimal conversion.
(CVE-2026-31789)
Signed-off-by: Jan Kardell <jan.kardell@telliq.com>
Link: https://github.com/openwrt/openwrt/pull/23346
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 44d98eec231534487cbec4ba8f852c1acf67a32d)
Stop overriding CCACHE_COMPILERCHECK from rules.mk and rely on
ccache's default, which hashes the compiler binary's mtime and
size.
For a local tree that is enough: the toolchain only changes when
it is rebuilt, and a rebuild updates mtime and size. Users who
want a stricter check can still set CCACHE_COMPILERCHECK in their
environment.
CI does not depend on this export either. The workflow writes a
secondary ccache.conf with
compiler_check=string:<toolchain-commit-sha>
so the cache key is tied to the toolchain source revision. That
is both stricter than the previous "%compiler% -v -c" setting
and portable across runners, where compiler mtimes would not
match after restoring a cache archive.
Link: https://github.com/openwrt/openwrt/pull/22995
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3956287514e5457723070f4b8bc7ed8084019d39)
(cherry picked from commit a6149ff867c92daa1aaa050b27ba8c6053d7cfe0)
Update the compiler check for ccache so we don't
end up with the wrong binaries. Right now the
compiler check will not be able to correctly
distinguish the compiler used for build
ARMv8 binaries from the one used to build
ARMv7 binaries.
Signed-off-by: Markus Gothe <markus.gothe@genexis.eu>
Link: https://github.com/openwrt/openwrt/pull/16290
Signed-off-by: John Crispin <john@phrozen.org>
(cherry picked from commit 3859e8eeb82950d8594f60d40e5ee23fd02207c9)
(cherry picked from commit 71d259b59998a214049c9e456f330cd8f292468f)
This fixes a simple logic error in the macaddr existence check in mac80211.uc.
Signed-off-by: Harin Lee <me@harin.net>
Link: https://github.com/openwrt/openwrt/pull/21277
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 2ebcda1ea6b757864c4700e543a9767752ca766e)
Link: https://github.com/openwrt/openwrt/pull/23100
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit b76c38f9e2316e3ad125f6f2e4c7e27d025fad6e)
Drop HIDDEN option from U-Boot default for Airoha while support for ATF
gets pushed.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit cce81ed05bf944bb8188875757f2ab2ddfbfa4a8)
(cherry picked from commit c5de245171de11c694bb7720f5d30ab4467829ca)
Introduce support for U-Boot for Airoha EN7581/AN7583. For EN7581
initial patch are already in U-Boot mainline and doesn't require
backport, for AN7583 some patch are still pending but already posted
upstream.
Also add for now, precompiled binary for ATF BL2 and BL31. Support for
ATF is planned and will come later.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 04f6769a4a87ed6de4c8a875d35743ca1783e947)
(cherry picked from commit 507bd4c77520af2bf68406654b4b9e146c27b4a6)
The GitHub CI was sometimes still building some tools again even when
the same version was already pre-built. This change fixes the problem
and should improve the speed of the GitHub CI actions. The duration of
the "Build tools" step will be reduced from 5 to 20 minutes down to
10 to 15 seconds.
make also checks that dependencies are not more recent than the target
it wants to build. Previously find returned files in an arbitrary order
and touch set the current timestamp. Since touch is called per file the
timestamps differ in fractional seconds, so not all files got the same
time. make detected a more recent dependency and started to rebuild.
Now all files are set to the same timestamp and make will assume
everything is up to date.
It is sufficient to only touch the stamp files to prevent rebuilding.
Link: https://github.com/openwrt/openwrt/pull/22888
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit cd6cb9f765df46eea7aefaab9d61e143c3996423)
(cherry picked from commit 44df9972d59ea1ec9365bc821af974f1e8686e02)
Swig 4.3.0 has changed SWIG_Python_AppendOutput, which now requires an
additional parameter `is_void`. SWIG_AppendOutput remains unchanged.
This was fixed upstream in u-boot/u-boot@a63456b
```
scripts/dtc/pylibfdt/libfdt_wrap.c: In function '_wrap_fdt_next_node':
scripts/dtc/pylibfdt/libfdt_wrap.c:5581:17: error: too few arguments to function 'SWIG_Python_AppendOutput'
5581 | resultobj = SWIG_Python_AppendOutput(resultobj, val);
| ^~~~~~~~~~~~~~~~~~~~~~~~
```
This is the same fix as applied in 363e07d.
Signed-off-by: Trix Taiclet <git@trix.moe>
Link: https://github.com/openwrt/openwrt/pull/22870
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 9d0bafca525d8309b836e7fa1780f9decb3a0c20)
Swig 4.3.0 has changed SWIG_Python_AppendOutput, which now requires an
additional parameter `is_void`. SWIG_AppendOutput remains unchanged.
This was fixed upstream in u-boot/u-boot@a63456b
```
scripts/dtc/pylibfdt/libfdt_wrap.c: In function '_wrap_fdt_next_node':
scripts/dtc/pylibfdt/libfdt_wrap.c:5581:17: error: too few arguments to function 'SWIG_Python_AppendOutput'
5581 | resultobj = SWIG_Python_AppendOutput(resultobj, val);
| ^~~~~~~~~~~~~~~~~~~~~~~~
```
This is the same fix as applied in 363e07d.
Signed-off-by: Trix Taiclet <git@trix.moe>
Link: https://github.com/openwrt/openwrt/pull/22870
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 1e61a54d7224eaa5c5067ca9d0edd3c8374fe75f)
No need to add another aliases node just for the label-mac-device,
luckily DTC was smart enough to combine them together in the final DTB.
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 1f535037b19731cd37512ed00b648a35b40ad13c)
(cherry picked from commit fbca86e8bd815921a37d432f4007564974eb3fc5)
The correct label mac is needed in a downstream project.
Signed-off-by: Steffen Förster <nemesis@chemnitz.freifunk.net>
Link: https://github.com/openwrt/openwrt/pull/22802
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit beaf298c4cb6f0d678cfdc251060af207ee4bab8)
The Xiaomi Redmi/Mi Router AC2100 does have the correct label mac on the WAN interface.
This MAC is available as gmac1.
Signed-off-by: Florian Maurer <f.maurer@outlook.de>
Link: https://github.com/openwrt/openwrt/pull/22567
(cherry picked from commit b1713d623be30d26da0bd48ecff9032881ce5684)
Link: https://github.com/openwrt/openwrt/pull/22624
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit a64f028d39597448f5949c34b4fdd646deca92d8)
Release previously allocated memory and OF node before return.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/22276
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 4778e35464d4ae38f2dc508be5caf3861e1799b3)
Link: https://github.com/openwrt/openwrt/pull/22348
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 2120db27b569d5242ba9d1baef645d578678dc25)
The bootcount init script is missing the executable bit (644 instead of 755),
causing the script to not be executable:
/etc/preinit: line 44: /etc/init.d/bootcount: Permission denied
Fixes: c3b8108a2be4 ("ramips: Add support for Xiaomi MiWiFi 3A")
Signed-off-by: Oliver Sedlbauer <os@dev.tdt.de>
Link: https://github.com/openwrt/openwrt/pull/22446
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit a15b224e8309fa203dcc23fe95c8cf8dd748255d)
(cherry picked from commit 81be8a8869a36828ded87c8f5de09214d594d433)
The MIPS code assigns the clock node based on the device tree node name.
This name was renamed with kernel 6.12.58 and v6.6.117. Adapt our out of
tree device tree files to this rename to fix loading the STP GPIO
driver.
Without this fix the driver fails like this:
```
[ 0.320000] gpio-stp-xway 1e100bb0.stp: Failed to get clock
[ 0.330000] gpio-stp-xway 1e100bb0.stp: probe with driver gpio-stp-xway failed with error -2
```
Link: https://git.kernel.org/linus/b0d04fe6a633ada2c7bc1b5ddd011cbd85961868
Fixes: https://github.com/openwrt/openwrt/issues/21697
Co-Authored-By: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/22444
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit d405685b44c61b8d0f1ec046d58adfd8b1426893)
[Fix danube.dtsi too]
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 3214b8a3289bfa219706447804a2f1daad3521d9)
