staging/svanheule/package, branch main

openssl: update to 3.5.7

2026-06-18T10:21:05Z

This release incorporates the following bug fixes and mitigations: * Fixed heap use-after-free in PKCS7_verify(). (CVE-2026-45447) * Fixed CMS AuthEnvelopedData processing may accept forged messages. (CVE-2026-34182) * Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler. (CVE-2026-34183) * Fixed NULL pointer dereference in QUIC server initial packet handling. (CVE-2026-42764) * Fixed AES-OCB IV ignored on EVP_Cipher() path. (CVE-2026-45445) * Fixed possible heap buffer overflow in ASN.1 multibyte string conversion. (CVE-2026-7383) * Fixed out-of-bounds read in CMS password-based decryption. (CVE-2026-9076) * Fixed heap buffer over-read in ASN.1 content parsing. (CVE-2026-34180) * Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys. (CVE-2026-34181) * Fixed possible NULL dereference in password-dased CMS decryption. (CVE-2026-42766) * Fixed NULL pointer dereference in CRMF EncryptedValue decryption. (CVE-2026-42767) * Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt(). (CVE-2026-42768) * Fixed trust anchor substitution via cert/issuer typo in CMP rootCaKeyUpdate. (CVE-2026-42769) * Fixed FFC-DH peer validation uses attacker-supplied q. (CVE-2026-42770) * Fixed incorrect tag processing for empty messages in AES-GCM-SIV and AES-SIV modes. (CVE-2026-45446) Link: https://github.com/openwrt/openwrt/pull/23852 Signed-off-by: Hauke Mehrtens

odhcpd: update to Git HEAD (2026-06-18)

2026-06-17T23:30:57Z

0320032ae313 odhcpd: fix out of bounds write in dhcpv6_ia_handle_IAs 26b122007030 dhcpv6-ia: avoid dangling first lease pointer 03dacc23356b dhcpv6-ia: fix Reconfigure Accept Auth option write offset Signed-off-by: Hauke Mehrtens

mediatek: creatlentem clt-r30b1: add all-in-UBI layout

2026-06-17T07:09:25Z

This commit introduces OpenWrt U-Boot all-in-ubi layout support for the CreatLentem CLT-R30B1, enabling: - Fully-featured U-Boot - Effective recovery mechanisms - Prolonged device lifetime by allocating most of the flash to UBI (which takes care of wear-leveling) - Maximum available storage space for OpenWrt - Unified firmware across different device variants OpenWrt U-Boot UBI flash instructions ------------------------------------- Using the installer image ------------------------- To simplify the installation process, this method uses a fork of Daniel Golle's (@dangowrt) UBI Installer https://github.com/dangowrt/owrt-ubi-installer 1. Ensure your router is running the latest generic OpenWrt firmware. Upgrade it if necessary. 2. Obtain the installer image: Build the installer from source https://github.com/andros-ua/owrt-ubi-installer/tree/clt-r30b1 or download a prebuilt image from the https://github.com/andros-ua/owrt-ubi-installer/releases 3. Flash the openwrt*creatlentem_clt-r30b1-ubi-initramfs-recovery-installer.itb image using sysupgrade. 4. Wait for installation: the green status LED will blink rapidly, indicating that the all-in-UBI installer is running. 5. Once the installation finishes, the status LED will turn solid white (lime) for 5 seconds. 6. After the device reboots, perform a final sysupgrade using the openwrt*creatlentem_clt-r30b1-ubi-squashfs-sysupgrade.itb image. Return to stock layout ---------------------- 1. Flash openwrt*creatlentem_clt-r30b1(-112m)-initramfs-kernel.bin via sysupgrade 2. Copy files to /tmp on the device via SCP: BL2.bin u-boot-env.bin Factory.bin FIP.bin openwrt*creatlentem_clt-r30b1(-112m)-squashfs-sysupgrade.bin 3. Restore stock MTD partitions: apk add kmod-mtd-rw insmod mtd-rw i_want_a_brick=1 mtd write /tmp/BL2.bin BL2 mtd write /tmp/u-boot-env.bin u-boot-env mtd write /tmp/Factory.bin Factory mtd write /tmp/FIP.bin FIP 4. Install the system: sysupgrade /tmp/*sysupgrade.bin Recovery -------- Use mtk_uartboot to recover corrupted BL2 or FIP via UART: https://github.com/981213/mtk_uartboot Stock layout ---------------------------------------- | dev: size erasesize name | | mtd0: 00100000 00020000 "BL2" | | mtd1: 00080000 00020000 "u-boot-env" | | mtd2: 00200000 00020000 "Factory" | | mtd3: 00200000 00020000 "FIP" | | mtd4: 07000000 00020000 "ubi" | ---------------------------------------- OpenWrt U-Boot UBI layout ---------------------------------- | dev: size erasesize name | | mtd0: 00100000 00020000 "BL2" | | mtd1: 07f00000 00020000 "ubi" | ---------------------------------- Signed-off-by: Andrii Kuiukoff Link: https://github.com/openwrt/openwrt/pull/20666 Signed-off-by: Jonas Jelonek

zynq: add Bitmain Antminer S9 control board support

2026-06-16T18:19:24Z

This board is the control board for the Antminer S9 miners. SoC: Xilinx XC7Z010 - dual-core Cortex-A9 with FPGA stack Memory: 512Mb DDR3 NIC: 1Gbit ethernet (BCM B50612E PHY) Flash: 256Mb NAND (Micron MT29F2G08ABAEAWP) Storage: SD-card slot Other: control pins available via FPGA stack Admittedly, there is a limited number of use cases available for these boards outside of the miners and the lack of FPGA tooling in OpenWrt. However, for one, they are easily and cheaply available, for two, the reason for adding this is to provide an easy addition to the boardfarm for continuous testing of this target. Notes: For u-boot, an additional patch is required to support booting from SD-cards. This is because EXTRA_ENV_SETTINGS is already defined in the board's u-boot config, which is the same place where the zynq-common.dtsi defines the required envvars. Signed-off-by: Zoltan HERPAI

uboot-zynq: fix boot process on MMC

2026-06-16T18:19:24Z

A regression was introduced when upgrading to 2019.07, whereas the bootloader did not proceed to load the FIT image. A fix was reported but not upstreamed here [1]. Patch the uEnv file to bring back these boards to an operational state. [1] https://forum.openwrt.org/t/bugreport-regression-in-zynq-cpu-platform-not-bootiing-any-more-zedboard-zybo/182609/7 Fixes: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=5ca243153b110ceddffecb70ba8a8cd0e33c8f0b Signed-off-by: Zoltan HERPAI

ipq806x: add apboot package for AP-32x

2026-06-16T14:08:11Z

This is unfortunately needed to disable the signature verification in the stock bootloader. Co-authored-by: Paul Spooren Signed-off-by: Lukas Stockner Link: https://github.com/openwrt/openwrt/pull/20738 Signed-off-by: Paul Spooren

ipq806x: add support for Aruba AP-32x

2026-06-16T14:08:08Z

This is a dual-radio 802.11a/b/g/n/ac access point with dual Gigabit Ethernet. There are two closely related models: The AP-324, which has external antenna connectors, and the AP-325, which has internal antennas. The board appears to be identical, and the same image works on both. Additionally, the Siemens Scalance W1750D is an OEM variant using the same board, so the image also works on that. Unfortunately the factory APBoot bootloader enforces cryptographic signatures on the firmware before booting, so a modified version must be flashed via the serial port. See [^1] for details. Specifications ============== * Device: Aruba AP-325 / AP-324 * SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A * RAM: 512MiB (2x Winbond W632GU6MB-12) * SPI flash: 4MiB Macronix MX25U3235F * NAND flash: 128MiB Winbond W29N01HZBINF * WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G) * Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable * Power: PoE 802.3at or 12V DC jack * LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED * Buttons: 1x, behind hole next to DC jack * Console: RJ45 connector, Cisco pinout * USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0 host but board is only wired for 2.0 * BLE: TI CC2540 SoC, connected to USB and UART, unpopulated debug header on PCB * TPM: Atmel AT97SC3205T How to install ============== The stock bootloader APBoot appears to be vendor fork of U-Boot, which disables much of the usual functionality and comes with its own booting and firmware upgrade logic. Unfortunately, this logic enforces RSA signatures on images, even for the default boot from NAND. Therefore, a patched bootloader is needed, which is built as a package. In addition to the signature check removal, this also changes the serial baudrate to 115200. Luckily, the stock firmware does not disable the `sf` command (it just hides it until you run `diag`), so the patched bootloader can be fetched via TFTP and then flashed via console. Flashing patched APBoot ----------------------- * Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn` * Connect serial cable and wired ethernet * Access stock APBoot console at Baud 9600 * Flash patched bootloader: ``` setenv serverip setenv autostart n netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn sf probe 0 sf erase 220000 100000 sf write 44000000 220000 100000 reset ``` Booting OpenWrt --------------- * Connect serial cable and wired ethernet * Access patched APBoot console at Baud 115200 * Run `setenv serverip ` * Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari` Installing OpenWrt ------------------ * Connect serial cable and wired ethernet * Access patched APBoot console at Baud 115200 * Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`) by booting into OpenWrt via initramfs (see above) and dumping them * Wipe and repartition NAND flash (see below for explanation): ``` nand device 0 nand erase.chip reset ubi part ubifs ubi remove ubifs ubi create ubifs 1 ubi create rootfs_data ``` * Follow steps above to boot OpenWrt via initramfs * From OpenWrt, persist installation via sysupgrade Reverting to stock FW --------------------- The patched bootloader remains compatible with the original firmware, so you can just wipe the NAND, let APBoot recreate the partitions, and flash back the `aos0`/`aos1` backup from above. Current status ============== Tested and working ------------------ * Console * Wired GbE (both ports) * WiFi (both 2.4G and 5G) * LEDs * Restart Button * USB port * External watchdog * TPM * BLE SoC Future work ----------- * GPIOs for: * power source (8 indicates DC jack, 59 indicates 802.3at) * reset source (64 for warm reset, 65 for watchdog) * USB overcurrent (63) * BLE SoC reflashing * CC2540 comes with Aruba-specific FW out of the box * Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset), but that requires disassembly * Stock BLE FW appears to support reflashing via UART, but protocol would need to be reverse-engineered * ramoops/pstore * It appears that APBoot clears the RAM on boot, might be something we can patch out as well * Porting a modern U-Boot Flash layout ============ SPI flash --------- ``` 0x000000-0x020000 sbl1 0x020000-0x040000 mibib 0x040000-0x080000 sbl2 0x080000-0x100000 sbl3 0x100000-0x110000 ddrconfig 0x110000-0x120000 ssd 0x120000-0x1a0000 tz 0x1a0000-0x220000 rpm 0x220000-0x320000 appsbl 0x320000-0x330000 appsblenv 0x330000-0x370000 art 0x370000-0x380000 panicdump 0x380000-0x390000 certificate 0x390000-0x3a0000 mfginfo 0x3a0000-0x3b0000 flashcache 0x3b0000-0x400000 aosspare ``` Factory NAND flash ------------------ * 32MiB MTD partition `aos0`, formatted as UBI * 32MiB UBI volume `aos0` * contains kernel+initrd of the primary firmware, initrd contains the entire root FS * 32MiB MTD partition `aos1`, formatted as UBI * 32MiB UBI volume `aos1` * contains kernel+initrd of the secondary firmware, initrd contains the entire root FS * 64MiB MTD partition `ubifs`, formatted as UBI * 64MiB UBI volume `ubifs` * Contains UBIFS, overlay-mounted on top of the initrd, shared between firmware slots APBoot understands UBI, and will read the kernel from the `aos0` or `aos1` volume (depending on `os_partition`) with fallback to the other one in case a check fails. Kernels are expected to have a vendor-specific header, the included script will add that header with the correct checksum but no signature. OpenWrt NAND flash ------------------ OpenWrt assumes separate UBI volumes for kernel and rootfs, as well as a volume that must be named `rootfs_data` for the UBIFS. Unfortunately, APBoot actively checks the UBI volumes at boot, and will repartition if it doesn't find the volumes that it expects (listed above). Luckily, it doesn't check their size, only their existence. Therefore, we can use the following layout: * 32MiB MTD partition `aos0`, formatted as UBI * 32MiB UBI volume `aos0` * contains OpenWrt kernel+initrd * 32MiB MTD partition `aos1`, formatted as UBI * 32MiB UBI volume `aos1` * contains OpenWrt root squashfs * 64MiB MTD partition `ubifs`, formatted as UBI * small (single-LEB) UBI volume `ubifs` * Dummy volume, only there to satisfy APBoot * almost 64MiB UBI volume `rootfs_data` * contains UBIFS, overlay-mounted on top of the rootfs [^1]: https://github.com/lukasstockner/ap325-apboot-openwrt Signed-off-by: Lukas Stockner Link: https://github.com/openwrt/openwrt/pull/20738 Signed-off-by: Paul Spooren

base-files: handle name collision between kernel UBI volume and MTD partition

2026-06-16T14:07:58Z

On the AP-325 (and variants), the bootloader enforces a particular UBI volume layout and naming, so unfortunately the kernel's UBI volume and MTD partition end up with the name, which confuses the current logic. Therefore, add an option to ignore the MTD partition. Signed-off-by: Lukas Stockner Link: https://github.com/openwrt/openwrt/pull/20738 Signed-off-by: Paul Spooren

base-files: support rootfs_data on its own partition

2026-06-16T14:07:48Z

The current code assumes that the rootfs_data UBI volume is on the same MTD partition as the rootfs. Unfortunately, this does not work on the Aruba AP-325 (and variants), since the bootloader enforces a particular UBI volume layout. Therefore, this adds a separate variable to set the rootfs_data partition, and updates all existing devices with a non-default rootfs partition to also specify the new variable. Signed-off-by: Lukas Stockner Link: https://github.com/openwrt/openwrt/pull/20738 Signed-off-by: Paul Spooren

Revert "base-files: support rootfs_data on its own partition"

2026-06-16T14:05:25Z

This reverts commit 13fc688f033895e0ba91c1d752ffd63a06760ef5. Wrong Signed-off-by line was used, reverting and re-applying. Signed-off-by: Paul Spooren