A loop that accepts the mtd partition to scan,
an offset and the desired variable to test using printenv,
which gets the size and attempts different sizes
for the CRC calculation to find a match with the stored value.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Similar to mtd_get_part_size() but for the erase sector size.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
When the u-boot-env layout driver probes successfully,
all of the variables are available as NVMEM cells in sysfs,
not just the ones used with a phandle in devicetree.
Use the new function mtd_get_mac_nvmem()
over the older deprecated mtd_get_mac_ascii(),
to avoid an unnecessary read of MTD devices.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Devicetree only allows for the base physical address of a device
to be set using NVMEM cells with a phandle to an NVMEM device.
This leaves out the ability to set a VLAN MAC, for example,
a WAN port of a switch to be a VLAN for the WAN firewall side
with a separate MAC address for isolated identification.
When the u-boot-env layout driver probes successfully,
all of the variables are available as NVMEM cells in sysfs,
not just the ones used with a phandle in devicetree.
Add a new function in system.sh that reads the cells in sysfs
based on the MTD device used in the NVMEM driver,
similar to mtd_get_mac_binary() and to how
u-boot tools are patched to detect NVMEM devices.
Ref: 8142c4554ffa ("fw_env: add fallback to Linux's NVMEM based access") # uboot.git
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Similar to a psychopath, the bootloader of the ESR series demands
to check the CRC of the u-boot environment and replace it with
a CRC based on its own calculation on every boot cycle if it differs,
even if it is replaced with a correct and working one after boot.
When these boards were moved to using the u-boot-env layout driver
instead of userspace scripts for setting the MAC address,
some alternatives were discussed on how to handle this.
- a general fix to ignore the CRC would be inappropriate.
- upstream kernel would reject a method for ignoring the CRC.
- a kernel patch series to make NVMEM devices optional causes random MACs.
- a userspace fix to allow using the NVMEM driver as intended afterward.
After a deep investigation, it was discovered that the environment partitions
are 4k sector size despite being reported as 64k block size in bootloader console.
Therefore these other extreme measures are not necessary, however, the method
for fixing the CRC in userspace is provided by parent commits, and a helper function
to determine the correct size that represents an existing CRC is added afterward.
Thanks to recent kernel patches that added the env-size property
we can inform the layout driver of the true range to calculate the CRC with.
NVMEM detection with env-size is also supported in u-boot tools since version v2026.10.
In the uboot-tools scripts, we make sure to delete the "ubootenv" config file,
so that u-boot tools uses the NVMEM device instead of any previous uci settings.
Reviewed-by: Tomasz Maciej Nowak <tmn505@gmail.com>
Tested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Repair of a corrupted CRC in a u-boot environment can be done
with simple shell commands, thanks to the ability to abuse gzip.
When gzip compresses data, it creates a CRC32 little-endian checksum
in exactly the same form that a u-boot environment uses in the gzip footer.
For big-endian systems, u-boot uses a big-endian checksum,
so it must be read backwards from gzip. Therefore,
we have two versions of the function for endianness with mtd devices.
In order to facilitate different situations properly
these script functions allow for a userspace fix as a one-time execution
of a combined action that reads the environment, repairs the CRC,
adds an indicator variable, and writes the u-boot environment back
to the same or different partition so a bootloader doesn't mangle it further.
The success of correcting the CRC, and possibly migration, of the u-boot
environment is indicated by modifying it with a new variable "owrt_crc_fix".
The indicator variable is necessary to differentiate the fixed partition
from the bogus default environment, so that u-boot tools return an exit status
other than success when not properly discovering the fixed CRC partition.
Also, on the next sysupgrade, this prevents the fixup from happening again.
The uboot-tools are not allowed to write to the new partition directly,
as an NVMEM device is considered read-only by the kernel,
however, the mtd utility bypasses this if the parent mtd partition
is not marked as read-only in devicetree.
To handle writing a new variable,
another function writes a temporary uboot-tools environment config
so that the new variable can be written
to the new environment before it is written back to flash.
The function uses an optional while loop with sleep to ensure that
the NVMEM cells are available to use by checking the sysfs
for whether it exists yet so that later scripts can safely get values,
as using this is a rare situation that causes the NVMEM driver to probe late.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Support for changing the probe defer timeout in Kconfig was recently added.
This allows for using Kconfig to extend the time in which
devices are expected to be able to probe since the last probe
before the kernel declares an error and stops trying.
This helps all devices probe in rare cases where a device
takes an exceedingly long time to probe and has a dependent (consumer) device,
or, if an action in userspace is required to allow the device to probe,
the device will be given a chance to probe past late_initcall() during init.
In this case for Openwrt, it is possible to attempt userspace fixes in preinit
where otherwise the probe attempts would not occur again after preinit starts.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
For the rare case in which a u-boot environment CRC is corrupted
and must be fixed in userspace during init in the boot cycle,
allow the associated NVMEM cells to defer their probe.
This allows userspace enough time to fix the CRC and make other changes
or migrate the environment before the last probe attempt,
or to allow debugging attempts during preinit where otherwise
the probe would not be attempted again after preinit starts,
so that dependent devices like ethernet drivers can successfully probe.
This also avoids the need to reboot the device after a fix during preinit
in order to have a working network and with a non-random MAC address.
Use a new devicetree property "allow-probe-defer" to make this hack
more upstream friendly and device optional, whether or not it is acceptable.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Similar to variable names with the pattern eth[0-9]addr,
some vendors have used variable names with the pattern RADIOADDR[0-9]
in order to store MAC addresses in the environment variables.
Because this variable name pattern is not documented,
processing them as binary addresses automatically
may not be upstreamable and the patch may need to be moved to hacks.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Variable names with the pattern eth[0-9]addr is documented by u-boot
in a README file doc/README.enetaddr as being the preferred way
to store MAC addresses in the environment variables,
so process them as a binary address automatically.
Suggested-by: Tomasz Maciej Nowak <tmn505@gmail.com>
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Although it is not common, many other variable names for MAC addresses may be used,
particularly "athaddr", "wlanaddr", "wanaddr", and "mac_addr" in certain models.
Support a longer list of variable names for post processing as a MAC address.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Although it is not common, some board models from some vendors have
a MAC address stored in u-boot environment as a quoted form, e.g.
ethaddr="AA:BB:CC:DD:EE:FF"
This is acceptable formatting for a u-boot environment variable, however,
it makes parsing MACs in post processing inconsistent and currently fails.
Add a second condition for processing to match the MAC address with quotes
by allowing a longer length and setting a shifted offset to compensate.
The mac_pton() function has strict behavior on the length and location
of delimiters for each octet and that each digit is hexadecimal,
so attempting different offsets of the same string is not problematic.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Backport a small change in u-boot-env layout driver
which catches the case where "ethaddr" variable values
are quoted before post processing, in order to prevent
the nvmem cell not being created due to the post processing
function returning invalid when failing to parse due to large length.
This is a small step towards supporting quoted MAC addresses,
and at the very least guarantees that all variables
become an nvmem cell whether or not they can be processed as MACs.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Make the compiler happy by giving this header's functions
an initial NULL value for the created pointers.
An "uninitialized variable" warning was experienced on GCC 10.2.1 20210110.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24866
Signed-off-by: Robert Marko <robimarko@gmail.com>
Enable Kernel Address Space Layout Randomization (KASLR) on the AN7581
and AN7583 subtargets. Note that this requires the bootloader to
provide the kaslr-seed!
Signed-off-by: Vitaliy Sochnev <sochnev.v.74@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25290
Signed-off-by: Robert Marko <robimarko@gmail.com>
The AN7583 carries the same TRNG block as the EN7581, at the same
address and on the same interrupt. CONFIG_HW_RANDOM_AIROHA is already
enabled, so this gives the subtarget a /dev/hwrng.
Signed-off-by: Vitaliy Sochnev <sochnev.v.74@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25290
Signed-off-by: Robert Marko <robimarko@gmail.com>
The AN7583 carries the same TRNG block as the EN7581, at the same
address and on the same interrupt.
Signed-off-by: Vitaliy Sochnev <sochnev.v.74@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25290
Signed-off-by: Robert Marko <robimarko@gmail.com>
Backport U-Boot commit ce82cd191de2 to U-Boot 2026.07 and enable the
TRNG driver for Airoha builds. AN7581 and AN7583 boards have TRNG nodes,
allowing U-Boot to provide /chosen/kaslr-seed.
Signed-off-by: Vitaliy Sochnev <sochnev.v.74@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25290
Signed-off-by: Robert Marko <robimarko@gmail.com>
Every forwarded frame crosses the CPU port twice, so with LAN and WAN
behind switch port 8 alone, traffic in both directions adds up to at
most 1 Gbit/s. AMAC1 is connected to port 7: describe it, put wan1 and
wan2 on it with their DSA conduit, and keep LAN on port 8.
Give the AMAC1 interrupt (eth0) to CPU1 and keep RPS off: with each CPU
port on its own CPU, RPS only adds work, and the br-lan RPS to CPU1
used so far roughly halves bidirectional throughput.
AMAC1 probes first and is now eth0; AMAC2, which carries LAN, is eth1.
TCP forwarded through the router, before and after this commit
(Mbit/s):
before after
both directions, total 898 1554
WAN->LAN 915 922
LAN->WAN 917 921
LAN->WAN, MSS 536 795 685
A single direction with small packets is now handled by one CPU, which
costs that last case.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/26005
Signed-off-by: Robert Marko <robimarko@gmail.com>
Let b53 move user ports to another CPU port with port_change_conduit,
keeping port 8 as the default one, and limit the port based VLAN of a
user port to its own CPU port so the host does not receive flooded
frames twice.
Port 8 of BCM58xx needs the prepended Broadcom tag while its other CPU
ports use the regular one, and a switch tree has one tagging protocol,
so make brcm-prepend use the regular tag layout on CPU ports other than
8.
Nothing changes until a board describes another CPU port and a port is
moved to it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/26005
Signed-off-by: Robert Marko <robimarko@gmail.com>
Move the ath79 PLL clock code from arch/mips/ath79/clock.c to
drivers/clk/clk-ath79.c. With the QCA956x timer workaround and the
bootstrap reference clock now in setup.c, it only uses the clk API and
its own PLL and SRIF registers. Copy the register definitions it needs
from ar71xx_regs.h into the driver, so it no longer depends on the
mach headers. It stays a CLK_OF_DECLARE driver for the MIPS timer.
COMMON_CLK_ATH79 defaults to ATH79 and is set in the target config.
Tested on an Archer C7 v2, together with the PCIe PLL clock on top:
CPU/DDR/AHB/ref stay at 960/800/266.7/40 MHz, the timer runs and
ath10k probes. COMPILE_TEST builds for other architectures are not
tested.
Assisted-by: LLM
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X4fQYZAVx9sEHVTUpfBFRM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/26304
Signed-off-by: Robert Marko <robimarko@gmail.com>
The clock code read the 25/40 MHz bootstrap pins through
ath79_reset_base, although a reference clock rate in the device tree
already took precedence. Every upstream DTS and most OpenWrt boards
give one, but 28 AR933x boards leave it out and rely on the pins.
Read the pins in plat_time_init() instead and register the reference
clock from them only when the device tree has no rate, so the clock
code only uses the clk API. When the device tree does give a rate,
warn if it disagrees with the pins. No board changes behaviour.
Tested on an Archer C7 v2 (QCA9558, pins and DT both 40 MHz):
- With the DT rate there is no warning, and CPU/DDR/AHB/ref stay at
960/800/266.7/40 MHz.
- With the DT rate removed by a test build, the fallback registers ref
at 40 MHz and all rates, MDIO, PCIe and the timer are unchanged.
No AR933x board was tested.
Assisted-by: LLM
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X4fQYZAVx9sEHVTUpfBFRM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/26304
Signed-off-by: Robert Marko <robimarko@gmail.com>
Move the enable of the MIPS timer interrupt in the misc interrupt
controller, which QCA956x needs before the clocks are set up, from
qca956x_clocks_init() to plat_time_init(), right before of_clk_init().
The clock code then no longer writes reset block registers, which is a
step towards moving it to drivers/clk.
The order is unchanged. TP9343 boards include qca956x.dtsi and went
through this path too, so the check covers both. Only boot tested on a
QCA9558 Archer C7 v2, where the code does not run: the clock rates and
the timer are unchanged. There is no QCA956x hardware here.
Assisted-by: LLM
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X4fQYZAVx9sEHVTUpfBFRM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/26304
Signed-off-by: Robert Marko <robimarko@gmail.com>
When pkg-config is not installed on the system and the openwrt
pkg-config has been compiled, the openwrt pkg-config will be invoked to
find the ncurses libraries to link against scripts/configs/mconf for
"make menuconfig". The openwrt pkg-config provides the path
-L/path/to/openwrt/staging_dir/hostpkg/lib, so if the openwrt ncurses
package has been built, the openwrt ncurses library will be what
scripts/configs/mconf gets linked against.
Commit 036016036e62 ("ncurses: Skip terminfo database install on host")
removed the terminfo database because on systems where the host has
pkg-config installed, the database attempted to install at /usr/lib and
would fatally fail on ncurses versions above 6.5. This is fine on
systems with pkg-config since scripts/configs/mconf will get dynamically
linked against the system's ncurses and use the system's terminfo
database. However, on systems where the host does not have pkg-config
installed and the ncurses package has been built and the pkg-config
package has been built, scripts/configs/mconf will get statically linked
against the ncurses package that no longer has a terminfo database,
causing a failure similar to:
$ make menuconfig
ncurses: cannot initialize terminal type ($TERM="xterm-256color"); exiting
To resolve this, pass the staging directory to host ncurses configure
such that the terminfo database will be installed into the correct
location regardless of the system's presence of pkg-config, instead of
skipping the installation.
Fixes: 036016036e62 ("ncurses: Skip terminfo database install on host")
Reported-by: Hannu Nyman <hannu.nyman@iki.fi>
Reported-by: Edoardo Pinci <epinci@outlook.com>
Tested-by: Hannu Nyman <hannu.nyman@iki.fi>
Signed-off-by: Charlie Jenkins <thecharlesjenkins@gmail.com>
The RPM on this board refuses to enable LDO5:
l5: failed to enable: -ENXIO
qcom_rpm_smd_regulator ...: l5: devm_regulator_register() failed, ret=-6
All RPM SMD regulators are registered from a single probe, so this
failure also removes s1, the CPU supply. cpufreq-dt then stays in
deferred probe and the CPUs never leave the 800 MHz set by the
bootloader.
Nothing in this device tree consumes L5, so drop the node. With it
gone, s1 registers and cpufreq scales between 936 MHz and 2.208 GHz.
Signed-off-by: Gael Julien <jgm509@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/26466
Signed-off-by: Robert Marko <robimarko@gmail.com>
Backport three upstream commits that prevent the xHC from being torn
down when a device disconnects mid-transfer:
commit e3d757dc9257 ("xhci: include all root port children in recovery prevention on link error")
commit 042aad8d0db6 ("xhci: prevent endpoint recovery after roothub disconnect")
commit 7e0ef4332ed9 ("xhci: avoid xHC endpoint changes after disconnect or link error.")
On IPQ4019 a Stop Endpoint command landing on a just-soft-retry-reset
endpoint wedges the command ring, and the stop-endpoint watchdog kills
the host five seconds later. Reproducible by unplugging a USB-tethered
phone mid-transfer.
Signed-off-by: Matt Eaton <linux@divinehawk.com>
Link: https://github.com/openwrt/openwrt/pull/24923
Signed-off-by: Robert Marko <robimarko@gmail.com>
rteth_set_features() mapped NETIF_F_RXCSUM onto a bit of the CPU
port's MAC_L2_PORT_CTRL (rx_csum_mask). On RTL838x that bit is
RX_CHK_CRC_EN, and "ethtool -K eth0 rx off" cleared it, so the CPU
port dropped the frames the CPU sent. The bit has nothing to do with
the checksums of received frames, and the hw_en_rxtx() callbacks
already set it.
Drop the callback and rx_csum_mask. NETIF_F_RXCSUM stays and still
controls whether received frames are marked CHECKSUM_UNNECESSARY.
With the default rx on nothing changes on any family. With rx off the
bit set by hw_en_rxtx() now stays set on every family. On an RTL8393M
the CPU's traffic got out with that bit set or cleared by hand.
RTL930x and RTL931x are not tested.
Tested on ZyXEL GS1900-8 A1 (RTL8380M), RAM-booted, host on lan1: with
rx off, MAC_L2_PORT_CTRL of port 28 (0xe360) stays 0x41f, and the host
still gets the CPU's ARP requests (3/3) and ping replies (5/5). In an
earlier round on main, rx off turned it into 0x417 and the CPU's ARP
requests and ping replies stopped reaching the host.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Gennaro Cimmino <gcimmino@rayonra.net>
Link: https://github.com/openwrt/openwrt/pull/26479
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
On RTL8380M the CPU port counts every frame from the NIC as a CRC
error. Two settings decide whether these frames get out:
- RX_CHK_CRC_EN, bit 3 of the CPU port's MAC_PORT_CTRL. With it
cleared the CPU port drops them (rxMacDiscards). The public GPL SDK
also sets it when it enables the CPU port (nic_rtl8380.c).
- CRC_CPU_RC_EN in CRC_CPU_RC_CTRL (0xa4a4). With 0 or 3 the frames
leave the switch, but the link partner counts receive errors
instead of receiving them. 1 and 2 work.
Nothing in the tree wrote CRC_CPU_RC_EN. On the GS1900-8 it reads 1
after the vendor firmware and bootloader have run. Bit 3 was written
twice, by rteth and by the DSA driver.
Set both in rteth_838x_hw_en_rxtx() and drop the DSA write. RTL839x,
RTL930x and RTL931x are not touched. RTL8381M and RTL8382M take the
same path, and the public SDK gives them the same register and field;
they are not tested.
Tested on ZyXEL GS1900-8 A1 (RTL8380M), RAM-booted, host on lan1:
- After boot both read 1. The host gets the CPU's ARP requests (3/3)
and its ping replies (5/5).
- Both cleared by hand: nothing gets out (0/3, 0/5) and rxMacDiscards
of port 28 rises by 11.
- With both still cleared, eth0 down and up: kprobes on
rteth_838x_hw_en_rxtx() read 0xa4a4 = 0 and MAC_PORT_CTRL = 0x414 at
entry, 1 and 0x41c at return. Once a network restart has brought
the ports back up, traffic is back (3/3, 5/5).
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Gennaro Cimmino <gcimmino@rayonra.net>
Link: https://github.com/openwrt/openwrt/pull/26479
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Rename mirror functions to follow the otto_<component>_ naming scheme.
Use otto_mirror_<soc>_ for chip-specific configuration functions.
Update header declarations, DSA callbacks, SoC configuration tables and
TC flower callers. Include mirror.h directly in tc.c. While we are here
rename the configuration structure to otto_mirror_config.
Assisted-by: ChatGPT (OpenAI GPT-6 Astra)
Link: https://github.com/openwrt/openwrt/pull/26475
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Only tl-wdr4900-v1 has on-board usb hub among mpc85xx targets, but its
node name used to be "port" which would trigger
of_graph_get_next_port() and make of_graph_get_next_port_endpoint()
complain its children not named "endpoint" as seen
[here](https://github.com/openwrt/openwrt/pull/25257#discussion_r4067988769),
although the related node structure is not intended to describe
"endpoints".
Renaming it to "hub" could silence these misleading warnings.
The usb vid/pid is also added as the "compatible" property of the hub.
Signed-off-by: Edward Chow <equu@openmail.cc>
Convert the remaining RTL930x and RTL931x policer register accesses to
the existing switch regmap. Obtain the private switch data in callbacks
that previously accessed the global MMIO window directly.
Preserve burst limits, rate encoding, programming order and ingress
flow-control masks. Use forced masked writes to retain the sw_w32_mask()
behavior, and propagate register access errors from the converted TC
callbacks.
Assisted-by: ChatGPT (OpenAI GPT-6 Astra)
Link: https://github.com/openwrt/openwrt/pull/26454
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Pass the switch private data through the STP initialization callback and
use its regmap to program the STP control register on all four SoC
families.
Update the callback type, declarations and probe call together. The MST
table access paths and STP state handling are unchanged.
Assisted-by: ChatGPT (OpenAI GPT-6 Astra)
Link: https://github.com/openwrt/openwrt/pull/26454
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Use the existing switch regmap for statistics setup, reset and MIB
reads. Use regmap_write_bits() to preserve the unconditional masked
writes, including the counter reset trigger.
Keep the high/low/high read sequence and the low-word retry on rollover.
Read into 32-bit temporaries and leave the output untouched when a
regmap read fails, so software counters are not updated from incomplete
samples.
Assisted-by: ChatGPT (OpenAI GPT-6 Astra)
Link: https://github.com/openwrt/openwrt/pull/26454
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Limit both partition-name scans to 31 characters so they cannot overflow
the 32-byte name buffers in the info and extract commands.
Link: https://github.com/openwrt/openwrt/pull/26424
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
f9163076e12d uloop: fill one event entry per descriptor on kqueue
6b4394f900af uloop: report a hangup on kqueue as an error, like epoll
ff8db08443b0 uloop: fix edge trigger on kqueue
531dbb03cbfa uloop: report a full socket hangup on kqueue as an error
da2d205a5cf3 uloop: run kqueue interval callbacks after the events are collected
20bea2ba777d blobmsg_json: avoid out-of-bounds read on non-extended attributes
a396f38a8568 uloop: use volatile sig_atomic_t for uloop_cancelled and uloop_status
Link: https://github.com/openwrt/openwrt/pull/26428
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Document security maintenance for the development branch and latest
stable release series, including when stable releases reach End of Life.
Define when to use public issues or pull requests and when to report
vulnerabilities privately. Link to the reporting forms for OpenWrt, LuCI
and packages, provide an email fallback and reference the security wiki.
Link: https://lists.openwrt.org/pipermail/openwrt-adm/2026-October/003061.html
Link: https://github.com/openwrt/openwrt/pull/26422
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
dnsmasq runs in a jail without CAP_CHOWN since commit a5e96c837e
("dnsmasq: run the jail with only the capabilities it needs"), so it
logs on every start that it could not chown its PID file to the
dnsmasq user. The root-owned file is harmless, because /var/run/dnsmasq
is root:dnsmasq 0775 and the dnsmasq user removes it on exit.
Log the failure only when the PID file directory does not let the
unprivileged daemon remove the file.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
rteth_930x_set_rx_mode() and rteth_931x_set_rx_mode() set the
RMA_CTRL_0 actions to forward, or to trap with promisc or allmulti.
RMA_02_ACT resets to drop, so slow protocol frames (01-80-C2-00-00-02,
e.g. LACP) do not reach the CPU in the default mode, and an 802.3ad
bond on switch ports never converges. b909154ce2 ("realtek: rtl839x:
trap slow protocols to the cpu") and 1fde9f83dc ("realtek: rtl838x:
trap slow protocols to the cpu") fix this for RTL839x and RTL838x.
Do the same on RTL930x and RTL931x: always trap RMA_02 (bits 5:4 of
RMA_CTRL_0) to the CPU. Per the RTL9310 register file a slow protocol
frame set to trap bypasses STP and VLAN filtering, so no bypass bit is
needed. The registers are now updated with regmap_update_bits(), so the
reserved bits 1:0 of RMA_CTRL_0 are no longer cleared.
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Kaloyan Naumov <knaumov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/26458
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Wire the per-port VLAN accept-frame-type register for RTL931x, as
c4abc00778 ("realtek: dsa: rtl838x: drop untagged frames without PVID")
and 46586cb4d6 ("realtek: dsa: rtl930x: drop untagged frames without
PVID") do for RTL838x and RTL930x. Every port is a member of the special
VID 0 used for CPU injection. Without the accept-frame-type gate, a
tagged-only port with no PVID in a VLAN-filtering bridge accepts
untagged ingress, classifies it to VID 0 and floods it, egressing the
uplink priority-tagged VID 0 and leaking into the peer switch's native
VLAN.
VLAN_PORT_AFT lives at offset 0x9400 with a 0x4 per-port stride and the
same 4-bit field layout as the siblings (bit 1 inner-untagged accept,
bit 3 outer-untagged accept, default 0xF accept-all), so the generic
otto_vlan_port_untagged_set() applies unchanged.
Tested on a Horaco ZX-SWTGW2C48NS (RTL9313): removing a port's PVID in
a VLAN-filtering bridge changes its VLAN_PORT_AFT from 0xf to 0xd, and
restoring the PVID sets it back to 0xf. Other ports keep 0xf.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Kaloyan Naumov <knaumov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/26457
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Specifications:
SoC: MediaTek MT7988A (4x Cortex-A73)
RAM: 2048 MiB (early samples: 1024 MiB)
Flash: 64 GB eMMC
Ethernet:
- 4x GbE LAN (lan6-9, MT7988 built-in switch)
- 4x 2.5GbE LAN (lan2-5, YT8824 PHYs) and a 10G SFP cage (sfp,
10GBASE-R) on a Motorcomm YT9224 switch, which links to gmac1 over
a fixed 10G USXGMII and is its own DSA tree
- 1x 10GbE WAN/LAN1 (wan, Realtek RTL8261D PHY, gmac2 USXGMII)
WiFi: MT7996 (2+3+3 variant) 2.4/5/6 GHz (BE)
Display: 240x320 SPI LCD (Sitronix ST7789P3) via panel-mipi-dbi, with
PWM backlight on pwm3_0
Touch: Hynitron CST3530
Buttons: Reset
Cooling: PWM fan (SoC thermal controlled)
USB: 2x USB 3.0, 1x USB-C (power)
Power: DC barrel jack
Boot: vendor U-Boot loads the OpenWrt FIT from the "kernel" GPT
partition and roots on the "rootfs" partition (PARTLABEL=rootfs),
so no bootloader replacement is required. The device also ships an
OpenWrt bootchain as artifacts: the preloader from the BL2 variant
that draws the splash on the panel, and the BL31+U-Boot FIP. They
replace the vendor ones in mmcblk0boot0 and the fip partition and
keep the vendor GPT layout, so the same images boot under either
loader. The vendor U-Boot keeps one copy of its environment and the
OpenWrt U-Boot keeps two, so uboot-envtools detects the layout at
first boot.
The YT8824 ports get no link unless the board MDI swap value is in a
YT9224 common extended register. Only the vendor U-Boot writes it, so
the driver now takes it from the "motorcomm,mdi-swap" property and
writes it after the chip reset.
Preinit uses lan9 for failsafe.
The interface names follow the chassis labels. The YT9224 uses the
four-byte YT922x tag, which the PPE offloads, and bridger offloads the
bridged flows between the two switches. The SFP core drives the
rate-select lines of the cage.
Installation:
Flash the factory image from the GL.iNet U-Boot web recovery, or
via "mtkupgrade fw" from the U-Boot console. The eMMC GPT layout
from the vendor firmware is reused (kernel + rootfs partitions).
To switch to the OpenWrt bootchain, write the preloader to
/dev/mmcblk0boot0 (clear its force_ro first) and the FIP to the
GPT partition labelled "fip", or use "mtkupgrade bl2" and
"mtkupgrade fip" from the vendor U-Boot console.
MAC addresses (factory partition on /dev/mmcblk0p2):
WAN (label) : 0x4000
LAN (lan6-9) : 0x4000 + 2
LAN (lan2-5, sfp) : 0x4000 + 1
2.4GHz : 0x4006
5GHz : 0x4006 + 1
6GHz : 0x4006 + 2
Signed-off-by: Shi Jiayang <shi05275@163.com>
Signed-off-by: Nilanka de Silva <nilankadsilva@gmail.com>
Signed-off-by: Til Kaiser <mail@tk154.de>
Signed-off-by: John Crispin <john@phrozen.org>
The board arrived with its LCD and its touchscreen named in the hardware
description and configured nowhere, and with one flash layout.
The hardware moves into mt7987a-glinet-gl-be10000.dtsi so that two boards
can share it. mt7987a-glinet-gl-be10000.dts keeps the vendor layout with
NMBM. mt7987a-glinet-gl-be10000-ubootmod.dts drops NMBM for a single UBI
across the whole chip, which gives 512 MiB rather than the 480 MiB the
NMBM layer exposed. BL2 hardcodes the UBI start at 0x200000 on MT7987, so
bl2 is 2 MiB there and holds four copies of the preloader. The factory
cells sit in a partition in one layout and in a UBI volume in the other,
so GL_BE10000_NVMEM_LAYOUT is a macro.
The panel is a Sitronix ST7789P3 on spi1, 320x240, driven through
panel-mipi-dbi-spi, with a PWM backlight on pwm2. The touchscreen is a
Hynitron CST3530 on i2c0. The panel is mounted upside down and
compensates in its MADCTL, so the touch axes are swapped and inverted to
match.
The profile carries video-support and input-support, which the
backlight, DRM and evdev modules depend on.
cpu_thermal replaces its trips and its cooling maps with four active
steps between 40C and 110C, and the fan gets cooling levels and a pulse
count, so it is quiet at idle instead of running flat out.
The buttons take the button-reset and button-switch names the binding
asks for, and the switch reports EV_SW rather than a key.
Signed-off-by: John Crispin <john@phrozen.org>
The GL.iNet GL-BE10000 and GL-BE14000 carry a Hynitron CST3530. Its
register addresses are 32 bits wide and big endian, and a touch report
is a 9 byte frame with its own checksum. The mainline hynitron_cstxxx
driver speaks the cst3xx protocol with 16 bit addresses, and stops at
"unable to enter bootloader mode" on this part. On a two byte address
the chip returns unrelated memory, and the cst3xx firmware information
registers read back as zero.
Add the driver and its binding as kernel patches, so that both can go
upstream. 754 adds the compatible to hynitron,cstxxx.yaml, and 755 adds
hynitron-cst3530.c. The driver is based on the one GL.iNet supplied:
- it reports through one multitouch slot with INPUT_MT_DIRECT, which
sets INPUT_PROP_DIRECT and provides BTN_TOUCH, ABS_X and ABS_Y
- a frame that fails to read, fails its checksum or lies outside the
native 240x320 range is reported as a release
- the axis mapping comes from the device tree only
kmod-input-touchscreen-hynitron-cst3530 is defined in the mediatek
modules.mk, and the four mediatek subtarget configs leave the symbol
unset.
Signed-off-by: John Crispin <john@phrozen.org>
The YT922x software tagger supplies the PVID of an access port, and an
untagged access frame does not show that PVID to the PPE. A MAC-only
flow key would then be shared by distinct VLANs.
Keep YT922x VLAN/PPE traffic on the software path until the SoC flow key
and tag actions can represent access PVIDs. Hardware forwarding inside
the switch still uses its VLAN tables. VLAN-unaware PPE is unchanged.
These hunks were part of 967-50. They depend on the four-byte tag
support of 967-41, so they move to a patch of their own after it.
Signed-off-by: Shi Jiayang <shi05275@163.com>
Signed-off-by: John Crispin <john@phrozen.org>
When a hardware subflow expires or its slot is reused, the bridge stats
walk must remove that subflow, not the parent L2 flow. Clearing the
parent removes it from the bridge lookup table and frees all its
subflows, including the next node saved by the ongoing safe iteration.
Clear cur after transferring its accounting to the parent. This retains
the bridge rule and the remaining subflows until tc removes the rule.
The bug is in mtk_flow_entry_update_l2() and hits every PPE user, not
only the YT922x, so the fix is a commit of its own.
Signed-off-by: Shi Jiayang <shi05275@163.com>
Signed-off-by: John Crispin <john@phrozen.org>
Teach the MediaTek PPE path to map YT922x four-byte DSA tags to switch
ports in both directions. Preserve the full tag TCI and fall back to
software when the VLAN and PPPoE tags would exceed the PPE tag depth.
Signed-off-by: Shi Jiayang <shi05275@163.com>
The eight-byte YT922x DSA tag is not understood by the MediaTek checksum
offload parser. Force affected packets through software checksum
handling until a compatible tag format is selected.
The patch extends the RTL8_4 check of the generic hack 739, so it
goes to the generic hacks after 739.
Signed-off-by: Shi Jiayang <shi05275@163.com>
Add the MediaTek PEXTP reset and link-poll recovery changes together
with the post-link reconfiguration required by fixed 10G external switch
trunks such as the YT9224.
All of it sits behind the mediatek,force-fixed-10g device-tree property,
which the patch documents in the binding:
- USXGMII autonegotiation is off, and the rate update mode is on.
- A worker polls the link every second. If the link or the CTLE value
is bad, it marks the cached link down and reconfigures the SerDes.
- pcs_get_state() returns the state the worker cached.
- pcs_link_up() reconfigures the PCS and waits up to 10 s for a link
with a valid CTLE value.
Without the property, pcs_get_state() and pcs_link_up() behave as they
do after 975, so the other MT7988 boards and their SFP ports keep the
5GBASE-R and 10GBASE-R reset sequence.
The autonegotiation change was part of the YT922x patch 967-27 before
the driver moved to the generic patches. phy-mtk-xfi-tphy.c now takes
struct mtk_xfi_tphy from the shared header, so that the PCS and the PHY
driver cannot disagree about its layout.
Signed-off-by: Shi Jiayang <shi05275@163.com>
These patches fix and complete the YT922x support of the yt92xx DSA
driver for the GL-BE14000. They apply on top of the driver in 967-27
and must go upstream together with it. Each patch stays a separate
file so that it can be sent on its own:
967-40 add a selectable four-byte port tag
967-42 enable hardware bridge forwarding
967-45 manage the unicast FDB entries of a bridge
967-46 track the FDB aliases of the default VID
967-48 complete the Clause 22 PCS negotiation
967-49 offload the multicast database entries
967-50 add a constrained 802.1Q VLAN offload
967-51 ignore the auxiliary FDB entries of VID 0
967-52 synchronise the multicast offload with bridge snooping
967-55 expose the hardware MIB statistics
967-50 refuses VLAN protocol changes through the port_vlan_protocol
operation of 644. The patches go to the generic pending patches,
next to the driver. The four target tag protocols that
take value 35 now have YT922X_4B in their context.
967-52 uses the port_bridge_mcast_snooping operation of 645. The PPE
hunks of 967-50 move to 967-53, after the four-byte tag support they
depend on. While the bridge is quarantined after a bus error, 967-42
leaves broadcast without the offload mark, so the software bridge
forwards it again. 967-40 includes <linux/bits.h> for GENMASK() and
BIT().
Signed-off-by: Shi Jiayang <shi05275@163.com>
Signed-off-by: Nilanka de Silva <nilankadsilva@gmail.com>
Signed-off-by: John Crispin <john@phrozen.org>
Michael Pratt
Vitaliy Sochnev
Rosen Penev
Charlie Jenkins
Gael Julien
Matt Eaton
Gennaro Cimmino
Markus Stockhausen
Edward Chow
Hauke Mehrtens
Daniel Golle
Kaloyan Naumov
John Crispin
Shi Jiayang