変更履歴

tools/squashfs4: fix compile on Alpine Linux

This backports upstream commit 05a895b3f996[1] to fix
compilation when using musl on the host machine.

[1]: https://github.com/plougher/squashfs-tools/commit/05a895b3f996d1ac157d95b04980f5f047e7dbf7

Signed-off-by: Rany Hany <rany_hany@riseup.net>
Link: https://github.com/openwrt/openwrt/pull/19285
Signed-off-by: Robert Marko <robimarko@gmail.com>
 (commit: 7f939d9)

realtek: add RTL931x support to rt-loader

The RTL931x devices have an other register that describes the
current RAM configuration. Enhance the identification routine.

Tested on LGS352C (RTL9311).

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/19284
Signed-off-by: Robert Marko <robimarko@gmail.com>
 (commit: 9d31db2)

imagebuilder: implement STRIP_ABI option for manifest target

When using apk as the package manager, imagebuilder make command

    make manifest STRIP_ABI=1

does not strip package names of their ABI-version suffix.  The ASU
server relies on this to validate builds, so many snapshot build
requests are failing.

Fix this by using the already existing package data parser in
make-index-json.py and augment it to write the result in manifest
format.

Fixes: https://github.com/openwrt/openwrt/issues/19274
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19278
Signed-off-by: Robert Marko <robimarko@gmail.com>
 (commit: 23dc466)

openssl: update to 3.5.1

Automatically rebased: 100-Configure-afalg-support.patch

Changes between 3.5.0 and 3.5.1:
Fix x509 application adds trusted use instead of rejected use.
Issue summary: Use of -addreject option with the openssl x509 application
adds a trusted use instead of a rejected use for a certificate.

Impact summary: If a user intends to make a trusted certificate rejected
for a particular use it will be instead marked as trusted for that use.
(CVE-2025-4575)

Aligned the behaviour of TLS and DTLS in the event of a no_renegotiation
alert being received. Older versions of OpenSSL failed with DTLS if a
no_renegotiation alert was received. All versions of OpenSSL do this for TLS.
From 3.2 a bug was exposed that meant that DTLS ignored no_rengotiation.
We have now restored the original behaviour and brought DTLS back into line
with TLS.

Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/19283
Signed-off-by: Robert Marko <robimarko@gmail.com>
 (commit: e2cdcf8)

usbgadget: add OS descriptors support

Add OS descriptors support. Configuring OS descriptors allows Microsoft
Windows to bind the right drivers without any additional configuration.

Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
Link: https://github.com/openwrt/openwrt/pull/19237
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
 (commit: c5c894f)

mbedtls: update to 3.6.4

This release includes fixes for security issues.

Mbed TLS 3.6 is a long-term support (LTS) branch. It will be supported with bug-fixes and security fixes until at least March 2027.

Security Advisories

For full details, please see the following links:

    Race condition in AESNI support detection [1]
    Heap buffer under-read when parsing PEM-encrypted material [2]
    Unchecked return value in LMS verification allows signature bypass [3]
    Out-of-bounds read in mbedtls_lms_import_public_key() [4]
    Timing side-channel in block cipher decryption with PKCS#7 padding [5]
    NULL pointer dereference after using mbedtls_asn1_store_named_data() [6]
    Misleading memory management in mbedtls_x509_string_to_names() [7]

[1] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-06-1/
[2] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-06-2/
[3] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-06-3/
[4] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-06-4/
[5] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-06-5/
[6] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-06-6/
[7] https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-06-7/

Signed-off-by: Antony Kolitsos <zeusomighty@hotmail.com>
Link: https://github.com/openwrt/openwrt/pull/19291
Signed-off-by: Robert Marko <robimarko@gmail.com>
 (commit: 2c8a433)

usbgadget: bump PKG_RELEASE for os descriptors support

Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
 (commit: b5c90ed)

mediatek: spinand: force update_cache_variants to use reset for Foresee NAND

Force update_cache_variantsvariants to use reset for Foresee NAND with bad blocks.

Tested on Xiaomi AX3000T + F35SQA001G with bad blocks and without bad blocks

Signed-off-by: Dim Fish <dimfish@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17963
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
 (commit: edc7cb9)

uboot-mediatek: force update_cache_variants to use reset for Foresee NAND

Force update_cache_variantsvariants to use reset for Foresee NAND with bad blocks.

Tested on Xiaomi AX3000T + F35SQA001G with bad blocks and without bad blocks

Signed-off-by: Dim Fish <dimfish@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17963
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>
 (commit: 94f043b)

libnetfilter-conntrack: bump to 1.1.0

Updates libnetfilter-conntrack to version 1.1.0.
Removes patches which should no longer be needed according to changelog for
libnetfilter-conntrack 1.1.0

Signed-off-by: Ian Ladd <ianwladd@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19282
Signed-off-by: Robert Marko <robimarko@gmail.com>
 (commit: 3a41c63)

config: drop kernel config symbols removed before v6.6

Since we don't support any kernel versions below v6.6, Kconfig options
that were removed upstream before 6.6 are no longer relevant and should be
dropped.

This commit removes the following obsolete kernel config options:
- KERNEL_UBSAN_NULL: Removed in v4.18 (3ca17b1f3628)
- KERNEL_DEBUG_LL_UART_NONE: Removed in v4.0 (6f5194553c84)
- KERNEL_SLABINFO: Removed in v4.15 (5b36577109be)
- KERNEL_RESOURCE_COUNTERS: Removed in v3.18 (5b1efc027c0b)
- KERNEL_MM_OWNER: Removed in v3.16 (f98bafa06a28)
- KERNEL_MEMCG_SWAP: Removed in v6.1 (e55b9f96860f)
- KERNEL_MEMCG_SWAP_ENABLED: Removed in v5.7 (2d1c498072de)
- KERNEL_DEVPTS_MULTIPLE_INSTANCES: Removed in v4.7 (eedf265aa003)
- KERNEL_DEVKMEM: Removed in v5.13 (bbcd53c96071)
- KERNEL_SECURITY_SELINUX_DISABLE: Removed in v6.4 (f22f9aaf6c3d)

Signed-off-by: Harrison Boyd <harrisonboyd400@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19287
Signed-off-by: Robert Marko <robimarko@gmail.com>
 (commit: 6f9ff39)

ramips: fix wifi nodes to upstream standards

Replaced all mt76@ with wifi@ per upstream requirement for all wifi
nodes.

Added missing compatible string where appropriate as stated by mt76.yaml
upstream.

Also updated reg value to be consistent everywhere.

Replace all pci14c3 entries to use mediatek,mt76.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/19067
Signed-off-by: Robert Marko <robimarko@gmail.com>
 (commit: f955716)

airoha: replace PCIe patch with upstream version

Replace PCIe patch with upstream version and update DTS with new PBUS
CSR property now required.

Tested-by: Aleksander Jan Bajkowski <olek2@wp.pl> # tested on Quantum W1700k
Tested-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18166
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 (commit: 921d438)

generic: backport some flow offload helper patch

Backport some flow offload helper patch in preparation for Airoha Flow
Offload support.

Link: https://github.com/openwrt/openwrt/pull/18166
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 (commit: 34ba7e8)

airoha: backport minor fixes for ethernet driver

Backport some upstream patch for Airoha ethernet driver in preparation
for Flow Offload support.

Tested-by: Aleksander Jan Bajkowski <olek2@wp.pl> # tested on Quantum W1700k
Tested-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18166
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 (commit: afea8bd)

airoha: backport upstream patch for Flow Offload support for AN7581

Backpot upstream patch for Flow Offload support for AN7581 and refresh
all affected patch. To correctly work a dedicated firmware is needed to
use the dedicated Network Coprocessor (NPU).

This also introduce good cleanup and moves the driver in a dedicated
Airoha directory. While currently not totally usable (due to lack of
firmware blob) this is needed to backport support for external PHY/SFP
support.

Refresh all affected patch.

Tested-by: Aleksander Jan Bajkowski <olek2@wp.pl> # tested on Quantum W1700k
Tested-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18166
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 (commit: ad20771)

generic: 6.6: drop netdev backported patch for netdev_tx_reset_subqueue

Patch backporting netdev_tx_reset_subqueue new OP has been already
backported in recent minor kernel version for 6.6.

Drop the related patch to fix compilation error on 6.6.

Fixes: 34ba7e8a8ab1 ("generic: backport some flow offload helper patch")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 (commit: f827d23)

mac80211: add WIFI_SCRIPTS_UCODE to PKG_CONFIG_DEPENDS

It affects package depdendencies

Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: 87f130a)

ucode: add patches to improve exception handling for ubus/uloop

Add API to allow setting an exception handler for user provided callbacks

Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: 185b48e)

wifi-scripts: ucode: fix iwinfo crash on untracked interfaces

Deal with data.radio being null

Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: 14b6862)

hostapd: fix potential double free in ubus code

Ensure that the object name is never freed twice

Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: 6e1d4af)

hostapd: disable 802.11be support in the mini variant

802.11be capable platforms are big enough to not need the mini variant,
and removing it here saves space for other other devices.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: 39580b1)

hostapd: update to version 2025-06-27

Manually refreshed:

140-tests-Makefile-make-run-tests-with-CONFIG_TLS.patch
601-ucode_support.patch

Fixed in upstream:

804-hostapd-revert-ACS-Validate-6-GHz-AP-criteria-before.patch [1]

Automatically rebased all other patches.

[1] https://w1.fi/cgit/hostap/commit/?id=0b60826a66885bffa2fd709ed5e48cd5fe241b6b

Signed-off-by: Agustin Lorenzo <agustin.lorenzo@thinco.es>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: 2ac791e)

mac80211: update to version 6.14.11

Update to version 6.14.11

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: 88f4c32)

mediatek: fix switch mdio id on mt7622-rfb1 on linux 6.12

Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: e618ad0)

hostapd: removed OSU support from configuration files, it was removed in the last hostapd update.

Ref: https://w1.fi/cgit/hostap/commit/hostapd?id=e835288592fd672469f46dc35a03e64115b996e5
Ref: https://w1.fi/cgit/hostap/commit/hostapd?id=7bb11e35d55e3d50199efc45921e76696bebd8ef

Fixes: https://github.com/openwrt/openwrt/issues/19142
Link: https://github.com/openwrt/openwrt/pull/19273
Signed-off-by: Agustin Lorenzo <agustin.lorenzo@thinco.es>
 (commit: 9738853)

fstools: update to Git HEAD (2025-07-05)

e8cd820cdbb8 libfstools: add support for EroFS based images

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 (commit: df1bf35)

tools: add erofs-utils

Add erofs-utils to create an EROFS-based rootfs for image generation.

Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://github.com/openwrt/openwrt/pull/19244
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 (commit: 9ece943)

image: add support for EROFS rootfs image generation

Add support for generating EROFS rootfs images.

The EROFS filesystem can offer competitive I/O performance while
minimizing final image size when using the MicroLZMA compressor.

Target platform: linux-x86_generic (target-i386_pentium4_musl)

Filesystem     Image Size
=============  ==========
root.erofs     4882432
root.ext4      109051904
root.squashfs  4903302

Co-Developed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Link: https://github.com/openwrt/openwrt/pull/19244
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 (commit: f7fa414)

kernel: fix fraglist GRO on linux 6.12

Merged segments had a broken skb network header offset.

Fixes: https://github.com/openwrt/openwrt/issues/19130
Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: 604355e)

image: only calculate EROFS_PCLUSTERSIZE when needed

Fixes shell warning on any makefile including image.mk when EROFS
is not enabled

Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: 5adc663)

mac80211: fix rt2x00 build error on 6.12

Fix missing remove callback type signature conversion

Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: e1d39bd)

hostapd: revert a broken upstream patch that was breaking multi-band operation

nl80211 events were propagated to the wrong interfaces

Fixes: 2ac791e87d3d ("hostapd: update to version 2025-06-27")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: bb279e1)

ath9k: add back previous DT compatible strings for ahb

The ath9k ahb patch was updated to match the latest upstream version,
however the openwrt DT files still use the older names.
Add those as extra entries in order to remain compatible until DT files
are fixed.

Fixes: 88f4c32060f7 ("mac80211: update to version 6.14.11")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: d2b2670)

ucode: fix an issue in exception handling improvement for ubus/uloop

Remove an uloop_end() call from a user cb that wasn't there before

Signed-off-by: Felix Fietkau <nbd@nbd.name>
 (commit: 77b9393)