staging/stintel, branch master

kernel: fix FM25G01B/FM25G02B Quad I/O read dummy

2026-08-18T08:32:12Z

The FM25G01B/FM25G02B datasheets specify a single dummy byte for the 0xEB Quad I/O read-from-cache, but the generic read_cache_variants set issues two. The extra dummy byte shifts the data phase and returns corrupted data with no ECC error, breaking boot on NC-1812/KN-1812. Use a dedicated read-from-cache variant set with ndummy=1 for 0xEB. Both the FM25G{01,02}B support (d5a5c9eb2ee9) and this fix (8211f2d74b35) were merged into the mtd tree (nand/next). Backport both patches to backport-6.18 using the actual upstream commits, so they apply to the OpenWrt kernel tree and upstream nand/next as is. FM25G01B datasheet: https://www.fmsh.com/nvm/FM25G01B_ds_eng.pdf FM25G02B datasheet: https://www.fmsh.com/nvm/FM25G02B_ds_eng.pdf Signed-off-by: Aleksandr Mineev Link: https://github.com/openwrt/openwrt/pull/24007 Signed-off-by: Jonas Jelonek

mediatek: filogic: add support for GL.iNet BE10000

2026-08-18T00:01:37Z

This patch adds support for GL.iNet BE10000(Slate 7 Pro) The GL.iNet BE10000 is a portable device with Wi-Fi 7, featuring two 2.5G Ethernet ports, one of which is a LAN port and the other a WAN port. Hardware Specification: - SoC: MediaTek MT7987A (Quad-core ARM Cortex-A53 2.0 GHz) - RAM: 1024 MiB DDR4 - Flash: 512 MiB SPI-NAND - WiFi: MediaTek MT7995AV (WiFi 7) - 2.4GHz: b/g/n/ax/be (2x2 MIMO) - 5GHz: a/n/ac/ax/be (3x3 MIMO) - 6GHz: ax/be (3x3 MIMO) - Ethernet: - 1x 10/100/1000/2500 Mbps WAN (Realtek RTL8221 PHY) - 1x 10/100/1000/2500 Mbps LAN (SoC internal PHY) - Buttons: Reset,Switch - UART: 115200 8n1 (VCC, RX, TX, GND) Flash Layout: - 0x0~0x100000 : bl2 - 0x100000~0x180000 : u-boot-env - 0x180000~0x580000 : Factory - 0x580000~0x880000 : fip - 0x880000~0x8c0000 : log - 0x8c0000~0x900000 : CFG - 0x900000~0x1e000000 : ubi MAC Addresses: - Base MAC located at Factory partition offset 0x4000 - gmac0 (WAN) : Base - 0 (Label MAC) - gmac1 (LAN) : Base - 1 Installation: 1. You can directly upgrade using the openwrt-mediatek-filogic-glinet_gl-be10000-squashfs-sysupgrade.bin image on the official GL firmware upgrade page. 2. Access the device and use the sysupgrade command to upgrade. Note: When upgrading from official firmware, use the -n parameter to preserve no configuration. Signed-off-by: GLiNet Tech Link: https://github.com/openwrt/openwrt/pull/22485 Signed-off-by: Hauke Mehrtens

wifi-scripts: fix default cipher selection for 11ad in iface.uc

2026-08-17T23:30:39Z

hw_mode property is only present in device configuration section, not the interface section, so testing for config.hw_mode in iface.parse_encryption is wrong. Test for (dev_config.band == 60g) instead, this will cause GCMP to be properly selected instead of CCMP unless set explicitly, and while at that will cover both hostapd and wpa_supplicant cases. Signed-off-by: Lech Perczak Link: https://github.com/openwrt/openwrt/pull/24586 Signed-off-by: Hauke Mehrtens

wifi-scripts: set hw_mode = 'ad' for 60GHz radios in hostapd config

2026-08-17T23:30:39Z

ucode version of hostapd handler, when setting hw_mode property based on band, incorrectly matches hw_mode = "a" for 5, 6, and 60GHz, while 60GHz radios need this set explicitly as "ad". This causes broken frequency display in LuCI, and potentially other issues, so add an explicit check for 60GHz band. Signed-off-by: Lech Perczak Link: https://github.com/openwrt/openwrt/pull/24586 Signed-off-by: Hauke Mehrtens

wifi-scripts: add 60G band to mac80211.uc to support 802.11ad

2026-08-17T23:30:38Z

/etc/config/wireless is missing 60G band for routers supporting it. This support was enabled in OpenWrt v23 but somehow disappeared in v24. Run-tested-on: TP-Link Talon AD7200 v2 [Originally authored by Konstantin Glukhov, replaced SoB, because of lack of real email, reworded commit message] Signed-off-by: Lech Perczak Link: https://github.com/openwrt/openwrt/pull/24586 Signed-off-by: Hauke Mehrtens

realtek: add rtl960x Ethernet (GMAC) driver

2026-08-17T19:30:40Z

Add a driver for the RTL960X on-chip Gigabit MAC: a single combined-NAPI RX/TX datapath over the descriptor rings. When paired with the RTL960X DSA switch driver, it converts the rtl_otto TX trailer to descriptor port steering and passes the RX descriptor source port through METADATA_HW_PORT_MUX. The DSA core derives offload_fwd_mark from bridge membership; this metadata path cannot preserve the per-frame trap reason. Configure TX completion coalescing with the 28-packet trigger, TX_PKT_TMR=7, and REG_INI_TMR_SEL=3. On the tested hardware this gives a roughly 469-472 us low-rate tail and fixed-window-side behavior; the exact arming event remains unresolved. Retain the 10 ms software timer only as a failure backstop. Align the DMA burst size, early TX, TX FIFO threshold, RX FIFO size, and RX interrupt trigger with the vendor driver. Keep the shorter RX packet timer because the vendor field value reproducibly added about 0.9 ms of ingress latency. The resulting IO_CMD value is 0xd71f31f0. Program the RX filter through ndo_set_rx_mode, and use separate vendor flow-control assert and deassert thresholds. The RX path bounds accepted lengths to RX_BUF_SIZE - RX_SHIFT because the hardware writes each frame 2 bytes into the buffer. The GMAC register block mixes 8/16/32-bit registers (IMR is 16-bit and shares a 32-bit word with the write-1-to-clear ISR), so use three width-specific regmap-MMIO instances over its private resource. Keep the default value endianness to preserve the target's non-swapping MMIO semantics. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Taiga Ogawa Link: https://github.com/openwrt/openwrt/pull/24737 Signed-off-by: Markus Stockhausen

realtek: move rtl838x Ethernet driver under realtek/

2026-08-17T19:30:40Z

Move the existing rtl838x Ethernet driver under drivers/net/ethernet/realtek/ without changing its source. Moving NET_RTL838X under if NET_VENDOR_REALTEK would otherwise hide it on MACH_REALTEK_RTL targets, which do not depend on PCI or parport. Extending NET_VENDOR_REALTEK for MACH_REALTEK_RTL is the only non-mechanical change and preserves the pre-move selection. Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Taiga Ogawa Link: https://github.com/openwrt/openwrt/pull/24737 Signed-off-by: Markus Stockhausen

realtek: fix SMP IRQ 7 storm by restoring CEVT_R4K

2026-08-17T19:09:19Z

The transition to generic machine initialization dropped the legacy Realtek setup code. Without it, disabling CEVT_R4K results in an unhandled IRQ 7 (MIPS CP0 timer) storm on secondary VPEs, leading to an "irq 7: nobody cared" kernel panic. The performance impact is negligible. Once the Realtek timer (timer@3100) is loaded, it seamlessly takes over the tick duties due to its higher rating. The MIPS R4K timer goes completely dormant and only triggers harmlessly when the 32-bit counter overflows (a couple of times per minute), avoiding the panic without core modifications. Fixes: 7cc31af7bdd4 ("realtek: convert to generic machine initialization") Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Luiz Angelo Daros de Luca Link: https://github.com/openwrt/openwrt/pull/24702 Signed-off-by: Markus Stockhausen

tools: zip: fix command injection in -T

2026-08-17T08:36:17Z

[backport from Debian zip 3.0-16] https://sources.debian.org/data/main/z/zip/3.0-16/debian/patches/fix-command-injection.patch Info-ZIP 3.0 builds a shell command with the archive name when -T tests an archive. A crafted archive name can inject additional shell commands. Backport Debian's fix. Quote the archive name before it is added to the test command. Link: https://sintonen.fi/advisories/infozip-test-option-command-injection.txt Signed-off-by: Peter Polonec Link: https://github.com/openwrt/openwrt/pull/24730 Signed-off-by: Robert Marko

ipq40xx: enable display feature on generic subtarget

2026-08-16T10:33:20Z

The Ubiquiti UniFi Travel Router lists kmod-drm-panel-mipi-dbi and kmod-backlight-pwm in DEVICE_PACKAGES. Both resolve through packages gated on @DISPLAY_SUPPORT, which is only selected when the target advertises the 'display' feature. Without it those packages are never built, and the image step fails with: ERROR: unable to select packages: kmod-backlight-pwm (no such package) kmod-drm-panel-mipi-dbi (no such package) This has broken every ipq40xx/generic snapshot build since r35795. Signed-off-by: Matt Eaton Link: https://github.com/openwrt/openwrt/pull/24757 Signed-off-by: Robert Marko