Started by timer with parameters: {BUILD_CFG_TARGET_DEV=WR8750N/WR9500N/WG600HP (AR9344)}BUILD_CFG_DISTCLEANtrueBUILD_CFG_DIFFCONFIGtrueBUILD_CFG_TARGET_DEVWR8750N/WR9500N/WG600HP (AR9344)519795f369b181cd128962fa8f60a03eaf0ac8afac6795f369b181cd128962fa8f60a03eaf0ac8afac6refs/remotes/origin/main795f369b181cd128962fa8f60a03eaf0ac8afac6795f369b181cd128962fa8f60a03eaf0ac8afac6refs/remotes/origin/main795f369b181cd128962fa8f60a03eaf0ac8afac6795f369b181cd128962fa8f60a03eaf0ac8afac6refs/remotes/origin/mainhttps://github.com/openwrt/openwrtconfig.buildinfoconfig.buildinfobin/targets/ath79/tiny/config.buildinfofeeds.buildinfofeeds.buildinfobin/targets/ath79/tiny/feeds.buildinfoopenwrt-ath79-tiny-nec_wg600hp-initramfs-factory.binopenwrt-ath79-tiny-nec_wg600hp-initramfs-factory.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wg600hp-initramfs-factory.binopenwrt-ath79-tiny-nec_wg600hp-initramfs-kernel.binopenwrt-ath79-tiny-nec_wg600hp-initramfs-kernel.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wg600hp-initramfs-kernel.binopenwrt-ath79-tiny-nec_wg600hp-squashfs-sysupgrade.binopenwrt-ath79-tiny-nec_wg600hp-squashfs-sysupgrade.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wg600hp-squashfs-sysupgrade.binopenwrt-ath79-tiny-nec_wg600hp-uboot.binopenwrt-ath79-tiny-nec_wg600hp-uboot.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wg600hp-uboot.binopenwrt-ath79-tiny-nec_wr8750n-initramfs-factory.binopenwrt-ath79-tiny-nec_wr8750n-initramfs-factory.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wr8750n-initramfs-factory.binopenwrt-ath79-tiny-nec_wr8750n-initramfs-kernel.binopenwrt-ath79-tiny-nec_wr8750n-initramfs-kernel.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wr8750n-initramfs-kernel.binopenwrt-ath79-tiny-nec_wr8750n-squashfs-sysupgrade.binopenwrt-ath79-tiny-nec_wr8750n-squashfs-sysupgrade.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wr8750n-squashfs-sysupgrade.binopenwrt-ath79-tiny-nec_wr8750n-uboot.binopenwrt-ath79-tiny-nec_wr8750n-uboot.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wr8750n-uboot.binopenwrt-ath79-tiny-nec_wr9500n-initramfs-factory.binopenwrt-ath79-tiny-nec_wr9500n-initramfs-factory.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wr9500n-initramfs-factory.binopenwrt-ath79-tiny-nec_wr9500n-initramfs-kernel.binopenwrt-ath79-tiny-nec_wr9500n-initramfs-kernel.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wr9500n-initramfs-kernel.binopenwrt-ath79-tiny-nec_wr9500n-squashfs-sysupgrade.binopenwrt-ath79-tiny-nec_wr9500n-squashfs-sysupgrade.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wr9500n-squashfs-sysupgrade.binopenwrt-ath79-tiny-nec_wr9500n-uboot.binopenwrt-ath79-tiny-nec_wr9500n-uboot.binbin/targets/ath79/tiny/openwrt-ath79-tiny-nec_wr9500n-uboot.binopenwrt-ath79-tiny.manifestopenwrt-ath79-tiny.manifestbin/targets/ath79/tiny/openwrt-ath79-tiny.manifestprofiles.jsonprofiles.jsonbin/targets/ath79/tiny/profiles.jsonsha256sumssha256sumsbin/targets/ath79/tiny/sha256sumsversion.buildinfoversion.buildinfobin/targets/ath79/tiny/version.buildinfofalsediffconfig: true, device: WR8750N/WR9500N/WG600HP (AR9344)#51920744652120772OpenWrt (master) for NEC Aterm (NetBSD based) #519519falsefalse51984SUCCESS1793230800229https://taiha.net/jenkins/view/all/job/OpenWrt-master-NEC-BSD-Aterm/519/home-slave02_taihasvtarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.c9d696f9ec1c41e74a4dafd846ecec5ca0052fe841793001377000https://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenmarkus.stockhausen@gmx.derealtek: pie: serialize rule deletion with allocation PIE rule additions hold pie_mutex, but range deletion uses reg_mutex and rule removal clears the allocation bitmap after dropping that lock. The two paths can therefore access the engine concurrently. On RTL838x, deletion can also overwrite lookup changes made by a concurrent addition. Use pie_mutex for rule removal on RTL838x, RTL839x, RTL930x and RTL931x, covering both the hardware deletion and release of the allocated ID. Require callers of the range-deletion helpers to hold that mutex and assert this with lockdep. Hold the same lock during PIE initialization, including the initial range clear and block configuration. This serializes deletion with existing rule-add and RTL839x L3 write paths without nesting pie_mutex inside itself or acquiring reg_mutex. Signed-off-by: João Silva <jgc3silva@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26190 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> 2026-10-26 08:56:17 +01009d696f9ec1c41e74a4dafd846ecec5ca0052fe84realtek: pie: serialize rule deletion with allocationedittarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.ctarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.c14ba4bb0aa8928c98fbf5f3024bdfd2038348dd51793001377000https://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenmarkus.stockhausen@gmx.derealtek: pie: bound rule deletion polling Replace the unbounded deletion-command loops on RTL838x, RTL839x, RTL930x and RTL931x with regmap_read_poll_timeout(). Return register access errors and stop waiting after 100 ms if the command stays busy. Keep affected rule IDs reserved after an error, since a timed-out command may still be pending in hardware. Stop PIE initialization if its initial clear fails, and only release individual IDs after successful deletion. On RTL838x, restore block lookup only after the clear has completed. Signed-off-by: João Silva <jgc3silva@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26190 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> 2026-10-26 08:56:17 +010014ba4bb0aa8928c98fbf5f3024bdfd2038348dd5realtek: pie: bound rule deletion pollingedittarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.ctarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.c3c5ccaaf58d9334d0a150dd5ffbd24da5e41f2d41793001377000https://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenmarkus.stockhausen@gmx.derealtek: pie: convert IPv6 address and mask words consistently Convert IPv6 source and destination address words and their masks from network byte order before packing the RTL838x, RTL839x, RTL930x and RTL931x PIE entries. Use the inverse conversion when unpacking IPv6 destination words in the RTL839x readback path. This makes the register representation independent of CPU byte order and keeps address and mask handling consistent. Use a local word index to keep the conversions readable. Signed-off-by: João Silva <jgc3silva@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26190 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> 2026-10-26 08:56:17 +01003c5ccaaf58d9334d0a150dd5ffbd24da5e41f2d4realtek: pie: convert IPv6 address and mask words consistentlyedittarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.crules.mk7375c575c3ea9871d41a1eaf63a2b9e96c63fc611793002233000https://taiha.net/jenkins/user/ansuelsmthansuelsmthansuelsmth@gmail.comrules: derive GCC_VERSION from the configuration The toolchain writes its version into staging_dir/toolchain-*/info.mk, which rules.mk includes. toolchain/Makefile creates that file from a placeholder whose GCC_VERSION is the literal "unknown", and the only thing that ever replaces it is Host/SetToolchainInfo, called from the gcc prepare step. The two live in different trees: the stamp that suppresses the prepare step sits in build_dir/toolchain-*, while info.mk sits in staging_dir. Remove staging_dir alone and the placeholder is reinstalled while the prepare stamp survives, so nothing rewrites it and every package is built with GCC_VERSION=unknown. apk rejects that outright: ERROR: info field 'version' has invalid value: package version is invalid ERROR: failed to create package: package version is invalid For an internal toolchain the version is already known from CONFIG_GCC_VERSION, which rules.mk reads a few lines earlier as GCCV, so fall back to it when info.mk offers nothing usable. TARGET_CROSS on the line above is defaulted the same way for the same reason. Signed-off-by: Daniel Golle <daniel@makrotopia.org> Link: https://github.com/openwrt/openwrt/pull/26181 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> 2026-10-26 09:10:33 +01007375c575c3ea9871d41a1eaf63a2b9e96c63fc61rules: derive GCC_VERSION from the configurationeditrules.mkpackage/firmware/linux-firmware/Makefile4dbc40c0630fccabc67c5ac7f613e6793a1d690e1793002296000https://taiha.net/jenkins/user/ansuelsmthansuelsmthansuelsmth@gmail.comlinux-firmware: update to 20261019 % git log --no-merges --pretty=oneline --abbrev-commit 20260916...20261019 158cd9ed6ebd rockchip: add PCIe3 PHY firmware for snps-pcie3 733c58c2a8a9 Update ADSP firmware for Qualcomm qcs615 platform. 4d3ecb245971 Revert "amdgpu: update GC 11.0.0 firmware" de4fccc398dc amdgpu: update vangogh firmware 15f6f42c2991 amdgpu: update VPE 6.1.1 firmware 347dcaed1ac0 amdgpu: update VCN 4.0.6 firmware 2012998affe0 amdgpu: update PSP 14.0.1 firmware 7a4a30b05a99 amdgpu: update GC 11.5.1 firmware 9558ec3a8b69 amdgpu: update VCN 4.0.5 firmware cf4b4addc1c4 amdgpu: update PSP 14.0.0 firmware cab2fc931be4 amdgpu: update GC 11.5.0 firmware 6deb84db6373 amdgpu: update renoir firmware a59975400aad amdgpu: update yellow carp firmware 811ee4511577 amdgpu: update raven2 firmware a519eab5dca2 amdgpu: update raven firmware 2d2cb01899a5 amdgpu: update VCN 3.1.2 firmware 93b290fd8e35 amdgpu: update PSP 13.0.5 firmware 9a3d7b4963aa amdgpu: update picasso firmware af63ec014ba7 amdgpu: update PSP 13.0.11 firmware fb52d937c35b amdgpu: update GC 11.0.4 firmware a4748ebfe8e9 amdgpu: update VCN 4.0.2 firmware d612c2461324 amdgpu: update PSP 13.0.4 firmware 94daa4fe9a20 amdgpu: update GC 11.0.1 firmware 7f7e805237cd amdgpu: update VCN 5.0.0 firmware 85232b1cf902 amdgpu: update PSP 14.0.3 firmware 58e210c52e72 amdgpu: update GC 12.0.1 firmware ff4209304cec amdgpu: update PSP 14.0.2 firmware 25cd19c34f83 amdgpu: update GC 12.0.0 firmware 381bbd194f46 amdgpu: update VCN 4.0.4 firmware bc9f817fb104 amdgpu: update PSP 13.0.7 firmware 48d5ac9b57dc amdgpu: update GC 11.0.2 firmware f547110145f6 amdgpu: update PSP 13.0.10 firmware cc6d98c1dc6d amdgpu: update GC 11.0.3 firmware 8dbdfc13ba7c amdgpu: update VCN 4.0.0 firmware f8e341502af0 amdgpu: update PSP 13.0.0 firmware 972f521e428f amdgpu: update GC 11.0.0 firmware 9281ebe07688 amdgpu: update beige goby firmware 921bdaa170f5 amdgpu: update dimgrey cavefish firmware 77887010b3d8 amdgpu: update navy flounder firmware 295a404bfc6b amdgpu: update sienna cichlid firmware 9c2bed6472a6 amdgpu: update navi14 firmware bb48b903db22 amdgpu: update navi12 firmware a97e3b5db17e amdgpu: update navi10 firmware da22110c7203 amdgpu: update VCN 5.0.1 firmware 1cb1bc502d7a amdgpu: update GC 9.4.4 firmware f102a868d206 amdgpu: update PSP 15.0.9 firmware 5478478d2339 amdgpu: update GC 11.7.1 firmware 36e99d99aa38 amdgpu: update VCN 5.3.0 firmware b1ca0bb6caa8 amdgpu: update PSP 15.0.0 firmware 362b09d83a69 amdgpu: update PSP 14.0.5 firmware 94cf07dfc413 amdgpu: update GC 11.5.3 firmware b8dadf247edd amdgpu: update PSP 14.0.4 firmware 19b7ec9a3169 amdgpu: update GC 11.5.2 firmware e301e556e6bf amdgpu: update green sardine firmware c9944b924b18 amdgpu: update VCN 4.0.3 firmware 6f6bfe6fa1e5 amdgpu: update PSP 13.0.6 firmware ac2c59644fb2 amdgpu: update GC 9.4.3 firmware 9ff0f3abf72d amdgpu: DMCUB updates for various ASICs 50dd1bcf2f4b rtw89: init board_elm.bin with stuffs for board ID 1 9f5eaf1e5fa1 rtw89: 8922d: update fw 0.35.119.3 with format suffix -1 3dcdaa69640c rtw89: 8922d: update fw 0.35.115.2 9936de9f9fdd wfx: update to firmware 3.18 bdeb9f0f93f1 nvidia: Update and add missing firmware files for Tegra SoCs ee632be9e54c qcom:Update qdsp6sw firmware for shikra platform 8d279b943f1f aic: Add AIC8800D80 Bluetooth and Wi-Fi firmware 7609749670be qcom: update HPASS firmware for nord platform f45ea109af75 amdgpu: DMCUB updates for various ASICs 9ec083c3aba9 amdgpu: update gc 11.0.1 and 11.0.4 firmware 3eadf1895677 qcom: update LPAICP firmware for shikra platform 575bbe3f8356 ath12k: WCN7850 hw2.0: update board-2.bin 5cdef65aaa63 panthor: Add initial firmware for Architecture 14.8 Arm Mali GPU 6b5ab2d6f060 qcom: update ADSP firmware for glymur platform 9c7ee0c8ef56 cirrus: cs35l41: Add firmware and tuning for Lenovo Thinkbook laptops c3bbdd9de36a cirrus: cs35l63: Add firmware for Cirrus CS35L63 for various Dell laptops ae4b9e72fc5e cirrus: cs42l45: Add CS42L49 SDCA codec firmware for Dell laptops 2180bb08bab1 qcom: fix qcs8300 gpdspr.jsn symlink target 360b6a1c56da qcom: update ADSP firmware for x1e80100 platform 6163f5ba0c33 linux-firmware: Update firmware file for Intel Solar core b95a9e931958 linux-firmware: Update firmware file for Intel Magnetar core 2ce099f2c913 linux-firmware: Update firmware file for Intel BlazaruHrpGfp core b593e397a7c8 linux-firmware: Update firmware file for Intel BlazariGfp core 458831d07217 linux-firmware: Update firmware file for Intel BlazarUFmPArl core a385fbdf1678 linux-firmware: Update firmware file for Intel BlazarI core 8956e3383e94 linux-firmware: Update firmware file for Intel BlazariFmp core 138a87a2591c linux-firmware: Update firmware file for Intel BlazarU core 5c1ebeca629f linux-firmware: Update firmware file for Intel ScorpiusGfp core 8a2941fae0d0 linux-firmware: Update firmware file for Intel Scorpius core c6e051da7ca9 cirrus: cs35l57 cs35l63: Add firmware for some Dell laptops 185df4e8a45a WHENCE: add SPDX license references for non-standard license texts 37d557ab3cc2 WHENCE: add initial SPDX identifiers 8dcbe88cf1c0 cirrus: cs42l45: Add CS42L45 SDCA codec firmware for a Dell laptop 675924146dab cirrus: cs35l41: Add support for Lenovo Yoga Slim 7 Carbon 14ACN6 01d600e69036 linux-firmware: Add ISH firmware files for Intel Nova Lake-H/S platforms 970505040744 qcom: add ADSP firmware for eliza platform e13358126f69 qcom: update ADSP firmware for hawi platform f830e56c110c QCA: Add QCA2066 Bluetooth firmware hpnv21g.30c 11184fe575c7 QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00653 5e7b5bc6a938 Revert "qcom: update ADSP firmware for qcs615 platform"q 28b21de36022 qcom: Add gpu firmwares for Hawi and Maili chipsets a4c4b10b7ed6 qcom: update Rubik Pi 3 ADSP firmware 4203b9738f72 cirrus: cs35l56: Correct firmware instances for 103c8c52 and 103c8c53 d9dd66ff33ed contrib: post the MR comment to the project of the merge request 83f41d84ccdc amdgpu: update VPE 2.0.0 firmware bc5252f2c0de amdgpu: update VCN 5.3.0 firmware c3e8dd75984b amdgpu: update GC 11.7.0 MES firmware 9ab11f1c5767 amdgpu: update PSP 15.0.9 firmware 09c29d394433 amdgpu: update PSP 15.0.0 firmware 39490329b234 qcom: vpu: add Gen2 firmware binary for Hawi f1ea87d9cc84 qcom: vpu: add Gen2 firmware binary for Maili de45f8bef2ce linux-firmware: Update AMD cpu microcode b72356140866 iwlwifi: add Bz/Sc FW for core24.80-41 release 092f5591c585 iwlwifi: Update Bz/Fm firmware for core24.80-41 release 723c52333487 iwlwifi: Add Hr/Gf firmware for core24.80-41 release 72caed25761a iwlwifi: update ty/So/Ma firmwares for core24.80-41 release 0029ab7d3138 iwlwifi: Add cc/Qu/QuZ firmwares for core24.80-41 release ca5fdc3e674b linux-firmware: mwifiex: add IW416 firmware e88807ffbf0f ath12k: WCN7850 hw2.0: update board-2.bin 781bd88c531d ath12k: QCC2072 hw1.0: update board-2.bin 4de2491cbe13 ci: add Qualcomm firmware version diff MR comment job 4e1bb35244b7 qcom: sdx61: add missing firmware version bd59c643be3c qcom: sdx35: add missing firmware version d04b22b2f7b1 qcom: aic100: add missing firmware versions 77b75e7f7c09 qcom: qdu100: add missing firmware versions 3cbed670aaa5 qcom: sdm845: add missing modem firmware version b259e2f9460c qcom: x1e80100: add missing Dell XPS 13 9345 DSP versions 4d9d409cddcb qcom: add missing Adreno ZAP shader versions 630e8b53cc2a contrib: report the version of the Qualcomm Bluetooth firmware 28b24eb3bacf contrib: detect the version of Adreno GMU firmware 0e45740a8632 contrib: detect the version of Adreno RGMU firmware 968bab9bb0a8 contrib: detect the version of Adreno ZAP shaders 4aeb44e73c5f contrib: detect the version of Adreno SQE and AQE microcode 019260ca4ee3 contrib: report Iris video firmware versions in the WHENCE format 30a63ce57b85 contrib: add Qualcomm firmware version scripts 5d6ac99fb005 contrib: move common firmware script helpers to fw_helpers.py 6a3381ca8301 qcom: use the WHENCE version format for the x1e80100 video firmware 5dd792fbcbbc qca: separate the WCN685x uart firmware revisions 16726a813864 qca: group the QCA61x4 USB firmware files 8e96c7fb4935 qca: drop duplicate version lines ffce0cc01642 qca: fix the version of the QCA6698 Bluetooth firmware eedcf262a66a qca: fix the version of the WCN785x USB firmware 828db6bf0dc9 qcom: fix the version of the a660 GMU firmware d77a7ff09172 qcom: fix the version of the Eliza SQE microcode f35ac0f38f83 qcom: fix the version of the QCS615 ZAP shader 837ae0e5becc qcom/shikra: link WiFi firmware from the ath10k subdir 9a7c283fa003 Revert "amdgpu: update GC 11.0.0 firmware" 0a5565a4a888 Revert "amdgpu: update GC 11.0.0 firmware" f5e8adfa1e0c amdgpu: DMCUB updates for various ASICs a98a6daa9f4d intel: Update ibt-00a0-01a1-pci.ddc for BE211 - Whale Peak2 (WhP2) 8fe920c980c3 ath11k: WCN6855 hw2.0: update board-2.bin 30f83ae033e8 cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops c664be6ce9be qcom: add CDSP firmware for hawi platform 10f09227a370 cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops 2ded07e3da99 cirrus: cs35l63: Add Cirrus CS35L63 firmware mappings for some Dell laptops c50e97d36b10 QCA: Update Bluetooth firmware for QCC2072 UART interface: 1.1.0-00340 to 1.1.0-00355 Signed-off-by: John Audia <therealgraysky@proton.me> Link: https://github.com/openwrt/openwrt/pull/26125 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> 2026-10-26 09:11:36 +01004dbc40c0630fccabc67c5ac7f613e6793a1d690elinux-firmware: update to 20261019editpackage/firmware/linux-firmware/Makefiletools/mold/Makefile85398d134e0cce59efbd3c6f384a2da3df8dbfce1793003639000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.commold: bump to 2.42.1 Update mold to 2.42.1 Changelog: https://github.com/rui314/mold/releases/tag/v2.42.1 This is the last version of mold based on C++, newer versions are based on Rust which needs different build systems. Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com> Link: https://github.com/openwrt/openwrt/pull/26188 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:33:59 +010085398d134e0cce59efbd3c6f384a2da3df8dbfcemold: bump to 2.42.1edittools/mold/Makefiletarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.cb771d55b76a8606146eb577e9f06f9647a33ea9a1793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: give a shaped mqprio class ten milliseconds of burst An mqprio class was programmed with a bucket of one frame. A sender's bursts leave the class's queues empty between them, and the tokens that accrue meanwhile are lost, so the class runs well below its rate. Size the bucket to ten milliseconds of the class's rate, as cpu_port_rate already does. On an AX3600 with SQM's hw_ppe.qos at 305/165 Mbit/s, a single TCP download over IPv4 or IPv6 carries 278-284 Mbit/s instead of 226-268 Mbit/s (3 runs each), and loaded RTT to the server stays within 0.3 ms of idle. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +0100b771d55b76a8606146eb577e9f06f9647a33ea9aqualcommax: qca_ppe: give a shaped mqprio class ten milliseconds of burstedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.c1152a41775cabdbae6bce089d3cc10a40ccb4c2d1793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: record VSI 0 for a port outside a bridge qca_ppe_setup() and qca_ppe_port_bridge_leave() bind a port outside a bridge to VSI 0 but record PPE_VSI_INVALID for it in port_vsi[]. Record the VSI the port is bound to. VSI 0 is reserved at setup, so no bridge compares equal to it. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +01001152a41775cabdbae6bce089d3cc10a40ccb4c2dqualcommax: qca_ppe: record VSI 0 for a port outside a bridgeedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.c4a2fc6517d6a18d749d53e0e1907fcf69cd764871793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: size a shaped port's queue from the tbf limit A shaped port's queue limit is 1 ms of the rate, too shallow to hold one flow at that rate, and a static limit per hash queue gives one flow a quarter of the depth at most. Take the depth from the tbf limit, read from the bfifo tbf keeps it in, falling back to 1 ms, and set it before the rate is programmed so a refused rate restores the previous limit. Each shaped port's band queues share a dynamic admission group of that depth, and the queues of its rate-limited mqprio classes share another of 10 ms of each queue's rate. The classes of several ports at the same depth share one group, as each carries a share of the same download, such as every LAN port's band below one WAN rate. Three groups are free; a further bottleneck splits its depth into static per-queue limits. Every such queue has FORCE_AC set and the largest dynamic weight. Measured on IPQ8074 at 50 Mbit/s with a 312 KB limit, one TCP flow to a server 171 ms away, n=3: 38-40 Mbit/s with the depth shared, 14-17 Mbit/s with it split per queue. With SQM shaping the WAN and the download bands of lan1, lan2 and lan3, the three bands share one group and the WAN keeps another, where the third LAN port fell back to static limits before. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +01004a2fc6517d6a18d749d53e0e1907fcf69cd76487qualcommax: qca_ppe: size a shaped port's queue from the tbf limitedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/patches-6.18/0953-net-ethernet-qca-add-EDMA.patchtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/patches-6.18/0952-net-ethernet-qca-add-ppe.patch3844ee698bd81d362a2830985fe81603a35448281793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: add PPE flow table access and debugfs dump The PPE flow, host, nexthop, egress L3 interface and public address tables are unused. Add their register definitions and op engine accessors, enable the lookup with forward on miss so nothing changes yet, set the bucket function of both hash blocks explicitly, and dump the flow table through debugfs. An entry is read back through the op engine because an IPv6 entry spans two flat slots, and a valid host entry is removed through the host op engine, not by zeroing it. Table sizes are per-SoC data, and the age period follows the board's PPE clock rate. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +01003844ee698bd81d362a2830985fe81603a3544828qualcommax: qca_ppe: add PPE flow table access and debugfs dumpedittarget/linux/qualcommax/patches-6.18/0953-net-ethernet-qca-add-EDMA.patchedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.haddtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.cedittarget/linux/qualcommax/patches-6.18/0952-net-ethernet-qca-add-ppe.patchtarget/linux/qualcommax/patches-6.18/0953-net-ethernet-qca-add-EDMA.patchtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/patches-6.18/0952-net-ethernet-qca-add-ppe.patchtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_vlan.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.h882844eb2319d584df9970d07ab383cb7d73c45d1793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: add netfilter flowtable hardware offload Routed and NAT connections are forwarded by the CPU although the PPE has a flow table. Implement flowtable offload as mtk_ppe does: each rule becomes one route, SNAT or DNAT entry with shared, refcounted host, nexthop, egress L3 interface and public address entries, and the stats callback reads the entry's age and counters and credits the bridge and VLAN uppers. Each egress L3 interface owns its index and carries the egress MTU, because a nexthop naming interface 0 sent every LAN-to-WAN PPPoE packet to the CPU as L3_EXP_MTU_DF_FAIL, and a PPPoE-over-802.1Q uplink gets a dedicated VSI with VLAN translation and a PPPoE session entry so its download reaches the flow lookup. Rules rewriting both addresses, IPv6 NAT, non-switch ingress and untranslated ingress tags stay in software, fragments bypass the lookup, and flows are purged when their VSI is released, a port's MTU changes or the flowtable block is released. DSA hands a flowtable bound to a user port to the conduit, as for mtk_eth, and qca_edma passes it on to the switch. On IPQ8074 with a PPPoE-over-VID7 uplink, both directions of an offloaded connection stay off the conduit. A routed flow that leaves by its ingress port, a VLAN on a stick for one, is forwarded by its entry as well: routed TCP between two subnets on one port ran at 866-882 Mbit/s with the receive softirq rate at its idle level (3 runs). Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +0100882844eb2319d584df9970d07ab383cb7d73c45dqualcommax: qca_ppe: add netfilter flowtable hardware offloadedittarget/linux/qualcommax/patches-6.18/0952-net-ethernet-qca-add-ppe.patchaddtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_vlan.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.cedittarget/linux/qualcommax/patches-6.18/0953-net-ethernet-qca-add-EDMA.patchedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.c46e3391b905f696d4d932c62effceaa78275595f1793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: offload GRE flowtable flows A GRE flow has no ports key, and the driver refuses it. Encode it as a three-tuple entry whose protocol field names no L4 protocol and which carries the IP protocol where the source port would be. The flowtable never offloads NATed GRE, so these entries only route. fw4 offers only tcp and udp, so a stock config needs a flow add rule that names gre. On IPQ8074 IPv4 and IPv6 GRE packets go through one hardware entry. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +010046e3391b905f696d4d932c62effceaa78275595fqualcommax: qca_ppe: offload GRE flowtable flowsedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.cdbdb7aa6d76574c2c3a7c0f129d52ee88e152e641793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: prioritise sparse flows on a shaped port On a shaped port a low-rate flow shares the bulk FIFO, takes its loss rate and recovers by RTO, so the latency probe of a speed test stalls. Use each user port's four unused unicast queues as a list one strict priority above the download band, inside its shaper, reached from flow priority profile 12. A work every 100 ms re-adds a flow with that profile after ten periods under eight packets, and back to its own profile once it exceeds eight in a period; the same pass credits counter deltas to the upper interfaces. The sparse_flows module parameter turns it off. Measured on IPQ8074 with a PPPoE uplink shaped to 305/165 Mbit/s, wired: LibreQoS +1/+1/+1 ms, against +1 ms in nine of fourteen runs before. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +0100dbdb7aa6d76574c2c3a7c0f129d52ee88e152e64qualcommax: qca_ppe: prioritise sparse flows on a shaped portedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/airoha/patches-6.18/161-01-v7.2-net-airoha-Introduce-airoha_gdm_dev-struct.patchtarget/linux/airoha/patches-6.18/915-01-net-netfilter-flowtable-Add-the-capability-to-offloa.patchtarget/linux/generic/pending-6.18/708-netfilter-flowtable-tear-down-direct-xmit-flows-when.patchtarget/linux/airoha/patches-6.18/099-08-v6.19-net-airoha-ppe-Flush-PPE-SRAM-table-during-PPE-setup.patchtarget/linux/generic/pending-6.18/708-00-net-mlx5e-ignore-FLOW_ACTION_PRIORITY-on-flowtable-offload.patchtarget/linux/generic/pending-6.18/736-04-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patchtarget/linux/airoha/patches-6.18/165-01-v7.2-net-airoha-Remove-private-net_device-pointer-in-airo.patchtarget/linux/airoha/patches-6.18/191-v7.2-net-airoha-add-preliminary-support-to-configure-tx-h.patchtarget/linux/generic/pending-6.18/708-netfilter-flowtable-carry-a-priority-into-the-offload.patchtarget/linux/airoha/patches-6.18/134-v7.1-net-airoha-Delay-offloading-until-all-net_devices-ar.patchtarget/linux/airoha/patches-6.18/165-05-v7.2-net-airoha-Support-multiple-LAN-WAN-interfaces-for-h.patchtarget/linux/generic/hack-6.18/650-netfilter-add-xt_FLOWOFFLOAD-target.patchtarget/linux/airoha/patches-6.18/161-02-v7.2-net-airoha-Move-airoha_qdma-pointer-in-airoha_gdm_de.patchtarget/linux/generic/pending-6.18/795-01-net-ethernet-mtk_ppe_offload-use-rhashtable_lookup_f.patchtarget/linux/generic/pending-6.18/795-03-net-ethernet-mtk_ppe_offload-set-output-device-befor.patchtarget/linux/airoha/patches-6.18/185-v7.2-net-airoha-Fix-error-handling-in-airoha_ppe_flush_sr.patchtarget/linux/airoha/patches-6.18/915-02-net-airoha-Set-hw-QoS-parameter-according-to-the-pac.patch9e692c0e7b52334245a65e2009464238a3b112ab1793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comgeneric: add FLOW_ACTION_PRIORITY to the flowtable offload Add 708, the netfilter-devel posting prepared for nf-next: the flowtable stores the priority a rule set before "flow add", applies it in the software fast path and passes it to drivers as FLOW_ACTION_PRIORITY. An IPv4 priority that ip_forward() derived from the TOS is not stored, since it belongs to each packet; the fast path derives it per packet instead. 708-00 makes mlx5 ignore the action on flowtable flows so they stay offloaded. qca_ppe uses it in the next patch. The airoha, mediatek and xt_FLOWOFFLOAD patches are refreshed. Link: https://lore.kernel.org/netfilter-devel/20261004171636.3545085-1-julius@bairaktaris.de/ Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +01009e692c0e7b52334245a65e2009464238a3b112abgeneric: add FLOW_ACTION_PRIORITY to the flowtable offloadedittarget/linux/airoha/patches-6.18/191-v7.2-net-airoha-add-preliminary-support-to-configure-tx-h.patchaddtarget/linux/generic/pending-6.18/708-netfilter-flowtable-carry-a-priority-into-the-offload.patchedittarget/linux/airoha/patches-6.18/165-01-v7.2-net-airoha-Remove-private-net_device-pointer-in-airo.patchaddtarget/linux/generic/pending-6.18/708-00-net-mlx5e-ignore-FLOW_ACTION_PRIORITY-on-flowtable-offload.patchedittarget/linux/airoha/patches-6.18/161-01-v7.2-net-airoha-Introduce-airoha_gdm_dev-struct.patchedittarget/linux/airoha/patches-6.18/915-01-net-netfilter-flowtable-Add-the-capability-to-offloa.patchedittarget/linux/generic/pending-6.18/795-01-net-ethernet-mtk_ppe_offload-use-rhashtable_lookup_f.patchedittarget/linux/generic/hack-6.18/650-netfilter-add-xt_FLOWOFFLOAD-target.patchedittarget/linux/airoha/patches-6.18/134-v7.1-net-airoha-Delay-offloading-until-all-net_devices-ar.patchedittarget/linux/airoha/patches-6.18/161-02-v7.2-net-airoha-Move-airoha_qdma-pointer-in-airoha_gdm_de.patchedittarget/linux/generic/pending-6.18/708-netfilter-flowtable-tear-down-direct-xmit-flows-when.patchedittarget/linux/airoha/patches-6.18/915-02-net-airoha-Set-hw-QoS-parameter-according-to-the-pac.patchedittarget/linux/generic/pending-6.18/795-03-net-ethernet-mtk_ppe_offload-set-output-device-befor.patchedittarget/linux/airoha/patches-6.18/165-05-v7.2-net-airoha-Support-multiple-LAN-WAN-interfaces-for-h.patchedittarget/linux/airoha/patches-6.18/185-v7.2-net-airoha-Fix-error-handling-in-airoha_ppe_flush_sr.patchedittarget/linux/generic/pending-6.18/736-04-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patchedittarget/linux/airoha/patches-6.18/099-08-v6.19-net-airoha-ppe-Flush-PPE-SRAM-table-during-PPE-setup.patchtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.c3a26e63cc6fd5db4285b55e7e813b329894a02501793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: offload FLOW_ACTION_PRIORITY to the flow entry An offloaded flow never returns to the CPU, so its queue cannot follow the ruleset's classification. Write the flowtable's FLOW_ACTION_PRIORITY into the entry's priority profile, which outranks DSCP and whose table maps each profile to the same priority; profile 0 leaves DSCP to decide. A priority above PPE_QOS_MAX_PRI, such as the 802.1d tags of 256 and up that Wi-Fi stamps take, is ignored and leaves the queue to DSCP, rather than keeping the whole flow in software. On IPQ8074 with meta priority set 0:5, IPv6 and IPv4 NAT packets of the flow leave on queue 5, and an unmarked flow is still classified by DSCP. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +01003a26e63cc6fd5db4285b55e7e813b329894a0250qualcommax: qca_ppe: offload FLOW_ACTION_PRIORITY to the flow entryedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.ctarget/linux/airoha/patches-6.18/915-01-net-netfilter-flowtable-Add-the-capability-to-offloa.patchtarget/linux/generic/pending-6.18/709-netfilter-flowtable-advertise-the-vlan-match-in-used_keys.patch1b90dab6216e8b8d254bf6edd80d04b6673cfad11793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comgeneric: advertise the flowtable vlan match nf_flow_rule_match() builds a vlan match but does not set it in used_keys, so drivers never see the tag. 709 sets the bits; it is v3 as sent to netfilter-devel. The airoha 915-01 patch is refreshed. Link: https://lore.kernel.org/netfilter-devel/20260913104251.648421-1-julius@bairaktaris.de/ Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +01001b90dab6216e8b8d254bf6edd80d04b6673cfad1generic: advertise the flowtable vlan matchedittarget/linux/airoha/patches-6.18/915-01-net-netfilter-flowtable-Add-the-capability-to-offloa.patchaddtarget/linux/generic/pending-6.18/709-netfilter-flowtable-advertise-the-vlan-match-in-used_keys.patchtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.c59c1ffad8b370bd334478d37753b19f5210f8b5e1793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: map the flowtable's ingress VLAN to a VSI A rule whose ingress frame keeps an 802.1Q tag now carries the tag as a match key, but a flow entry has no tag field, only the VSI. Map the tag to the uplink's VSI on a PPPoE port or the VLAN's VSI on a bridge member; a tag with no such classification, or a second tag, stays in software. Before the previous patch the key never arrived and a tagged ingress was matched on the PVID's VSI. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +010059c1ffad8b370bd334478d37753b19f5210f8b5equalcommax: qca_ppe: map the flowtable's ingress VLAN to a VSIedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.c114c4091f14dba9e2aca1a299e1d819d25cb29d71793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: send slow-path packets of offloaded flows to the CPU The flowtable matches every TCP flow with FIN and RST clear, but the driver ignored FLOW_DISSECTOR_KEY_TCP and the hardware forwarded the teardown, so an offloaded connection only ended on the idle timeout. The software fast path also leaves IPv4 options, IPv6 extension headers and short TCP or UDP headers to the stack, and a SYN on a closing flow tears it down. Program TCP flag exceptions for FIN, SYN and RST and enable them for routed flow hits with the header exceptions the software fast path leaves to the stack, as qca-nss-ppe does: IPv4 options, IPv6 extension headers, a TTL or hop limit about to expire, fragments, and truncated or malformed L2, PPPoE, IP and L4 headers. Each redirects the packet to the CPU and leaves the flow entry in place, and every other exception is cleared. Accept the TCP key only when every flag it excludes is one of the trapped ones. On IPQ8074, over IPv4 and IPv6, a flow leaves hardware as the connection closes, and without the trap it stays offloaded until the idle timeout. Packets with IPv4 options, an IPv6 hop-by-hop header or a short TCP or UDP header on an offloaded flow reach the CPU, 3 of 3 each, and the flow entry stays (one run). 200 SYNs on an offloaded flow reach the CPU (two runs). Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +0100114c4091f14dba9e2aca1a299e1d819d25cb29d7qualcommax: qca_ppe: send slow-path packets of offloaded flows to the CPUedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.caaa6875d7361b319242bb7769dc39cc84593f5921793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: use all sixteen PPPoE session entries The uplink state was one per port and the PPPoE session table was indexed by port, so a port carried one session on one VLAN and a re-dial overwrote the session that older flows still matched on. Keep uplinks per port and VLAN, each with its own VSI and L3 interface, and give every session its own refcounted entry pointing at its uplink. Like the kernel's session lookup, an entry matches the server's address too, so a frame with the session id from another source on the uplink stays in software. The same id from one server on two VLANs of one port is refused, as the hardware cannot tell them apart. On IPQ8074, with two sessions from a PPPoE server on one port, each session holds its own entry and the connections over both are offloaded. On a Telekom PPPoE uplink the entry reads back the server's address, and downloads stay offloaded at 260-284 Mbit/s behind a 305 Mbit/s shaper with the CPU idle (two servers, 2 runs each). Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +0100aaa6875d7361b319242bb7769dc39cc84593f592qualcommax: qca_ppe: use all sixteen PPPoE session entriesedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.c3945d5a8ed3b4f2140c42c0e7ca9a4f029fa811d1793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: route a VLAN that no bridge VLAN classifies A VLAN device on a port outside any bridge, such as a DHCP WAN on wan.<vid> or lan1.20, or on a port of a bridge that does not filter VLANs, has no VSI its tagged frames are classified into, so a flow arriving on it was refused as ingress_vlan_domain. Give such a port and VLAN the uplink a tagged PPPoE WAN uses, without a session, whichever direction of the flow is installed first. The L3 interface terminates PPPoE only once a session is attached to it. The offload debugfs file lists the uplinks in use with the number of flows on each. On IPQ8074, TCP routed both ways between VLANs 20 and 30 on one port of a bridge that does not filter VLANs runs at 933-936 Mbit/s combined with the softirq share of the CPU at 0% and no flow refused (3 runs), against 907 Mbit/s at 21% with 53 flows refused before (1 run). Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +01003945d5a8ed3b4f2140c42c0e7ca9a4f029fa811dqualcommax: qca_ppe: route a VLAN that no bridge VLAN classifiesedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.cf7abd7bcaa5191804fc44e96f5a6a28ffb276c771793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: add devlink resources for flow, PPPoE and meters The flow table, the PPPoE session table and the ACL meters are the tables the offload runs out of first, but devlink only reports the L2 tables. Register them as devlink resources with occupancy, so that "devlink resource show" says how full each one is. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +0100f7abd7bcaa5191804fc44e96f5a6a28ffb276c77qualcommax: qca_ppe: add devlink resources for flow, PPPoE and metersedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_acl.c713941a1ba8a60ca881aacd2b2ad0eb807200a6f1793004286000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: default small_pkt_len to the qca-ppe-qos value qca-ppe-qos sets small_pkt_len to 1000, while the driver defaults to 256. A module loaded without the package then leaves latency probes, larger DNS answers and game state in the bulk queue. Use 1000 as the driver default, which stays below a full-size segment on any path whose MSS is above 1000. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:46 +0100713941a1ba8a60ca881aacd2b2ad0eb807200a6fqualcommax: qca_ppe: default small_pkt_len to the qca-ppe-qos valueedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_acl.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.c80884df9a23f024a574421e260868deee403a1541793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: keep the ring indices the driver owns in software The data path read every ring index back from the engine through the register map, including the producer index of the transmit and fill rings and the consumer index of the completion and receive rings, which only the driver moves. Each frame sent cost two register reads and a doorbell write, and each poll about a dozen reads. Keep those indices in the queue, read the engine only for the indices it moves, and read the transmit consumer index only when the cached one reports too little room. Write the transmit doorbell once per batch when the stack sets xmit_more, and always before the queue stops or a frame is dropped. Access the index registers with readl() and writel(), which order against the descriptor memory like the register map did. Routed Wi-Fi upload through a 1x1 station takes 4% fewer cycles per packet and 64-byte UDP upload 5% fewer (2 runs each). Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +010080884df9a23f024a574421e260868deee403a154qualcommax: qca_edma: keep the ring indices the driver owns in softwareedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/ipq807x/base-files/etc/init.d/smp_affinitytarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.c62e4e6ac5d2b2066c523dea20fed4c1a19b4531d1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: poll in softirq context Threaded NAPI costs a context switch per poll, and the driver already binds each queue's interrupts to its own CPU, so softirq polling spreads the load the same way. Routed TCP from a wired host to a 2x2 HE160 station takes 11% fewer CPU cycles per packet upstream and 3% fewer downstream with one flow, 20% and 7% fewer with four flows (2 runs each). Threaded NAPI stays available through /sys/class/net/<dev>/threaded. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +010062e4e6ac5d2b2066c523dea20fed4c1a19b4531dqualcommax: qca_edma: poll in softirq contextedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.cedittarget/linux/qualcommax/ipq807x/base-files/etc/init.d/smp_affinityedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.c8d4ec787822d48b749b4957aa799b147a2821c331793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: sync only the longest frame for the device The page pool synced the whole receive buffer for the device each time a page was recycled, although no frame is longer than the MTU allows. Size the sync to the longest frame the ports admit and drop a longer one that the PPE still passes to the CPU, counting it as a length error. Cache maintenance on a routed 900 Mbit/s Wi-Fi downlink falls from 4.6% to 3.6% of the CPU time (3 runs). Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +01008d4ec787822d48b749b4957aa799b147a2821c33qualcommax: qca_edma: sync only the longest frame for the deviceedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.c3ce1d9eb181f9f2a851d84f9d6a6a9efdcbc02191793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: read the next frame's headers ahead Every received frame stalled on its first read of the preheader and the headers behind it, which the receive sync had just evicted from the cache. Read the next descriptor while the current frame is processed, sync its frame for the CPU and prefetch its first two cache lines. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +01003ce1d9eb181f9f2a851d84f9d6a6a9efdcbc0219qualcommax: qca_edma: read the next frame's headers aheadedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.c6d5c2446833e24b6e8dd1883b9b46805b18c99e21793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: mark frames the switch forwarded itself The out-of-band tagger never sets offload_fwd_mark, so the bridge floods every broadcast, multicast and unknown unicast frame from a switch port again in software, after the PPE has flooded it in hardware. Frames the switch forwarded or flooded to the CPU carry CPU code 0 in the receive preheader; hand those up with a METADATA_HW_PORT_MUX dst naming their port, as mtk_eth does, so DSA marks them and the tagger's skb extension is not allocated. A frame the switch trapped keeps its CPU code, goes through the tagger and stays unmarked, so the bridge still forwards it. On an AX3600, 1000 broadcasts sent on lan2 left lan1 and lan3 2000 times each before and 1000 times after (3 runs), and 256 IGMP reports, which the switch traps, left each of them 256 times (3 runs). Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +01006d5c2446833e24b6e8dd1883b9b46805b18c99e2qualcommax: qca_edma: mark frames the switch forwarded itselfedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.c6914ff44db97010e5ae0d5da497f1b3f752f93121793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: copy a transmitted head only when it is shared Transmit reallocated the head of every cloned skb before writing the preheader into its headroom, although a clone whose header was released, as TCP's are, may have its headroom written. Use skb_cow_head(), which copies the head only when the header is shared or the headroom is short. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +01006914ff44db97010e5ae0d5da497f1b3f752f9312qualcommax: qca_edma: copy a transmitted head only when it is sharededittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/patches-6.18/0953-net-ethernet-qca-add-EDMA.patchtarget/linux/qualcommax/patches-6.18/0952-net-ethernet-qca-add-ppe.patchf3aac46ea7bc193dd06685f8294754abb6a1834e1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: declare what the PPE and EDMA drivers build on QCOM_80211AX_PPE registers a DSA switch on the out-of-band tag, takes its PCS from the UNIPHY driver and its registers through regmap, and QCOM_EDMA uses the out-of-band tag's skb extension and page_pool, but neither says so: they only build because the target config enables all of it. Add the dependencies and selects. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100f3aac46ea7bc193dd06685f8294754abb6a1834equalcommax: declare what the PPE and EDMA drivers build onedittarget/linux/qualcommax/patches-6.18/0953-net-ethernet-qca-add-EDMA.patchedittarget/linux/qualcommax/patches-6.18/0952-net-ethernet-qca-add-ppe.patchtarget/linux/qualcommax/files/drivers/net/pcs/pcs-qca-uniphy.ctarget/linux/qualcommax/files/include/linux/pcs/pcs-qca-uniphy.h62792fff96994a03981098b80d62c6c6cdeec06f1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: pcs-qca-uniphy: fix macro and clock callback slips to_qca_uniphy_pcs() ignored its argument and ended in a semicolon, the port clock index macros lacked outer parentheses, the reference clock's init fields were chained with commas, and recalc_rate returned -EINVAL as a rate for an unknown UNIPHY. Use the argument, parenthesise the macros, end the statements and report a rate of 0. Drop the unused rst_ahb. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +010062792fff96994a03981098b80d62c6c6cdeec06fqualcommax: pcs-qca-uniphy: fix macro and clock callback slipsedittarget/linux/qualcommax/files/include/linux/pcs/pcs-qca-uniphy.hedittarget/linux/qualcommax/files/drivers/net/pcs/pcs-qca-uniphy.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.cc6a86d76b99c560f227c6886624bd237185f362d1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: correct two comments The transmit completion walk carried two comments saying the same thing, and the checksum comment read as if the driver accepted a padded frame's sum, where it leaves the frame to software. Merge the first pair and restate the second. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100c6a86d76b99c560f227c6886624bd237185f362dqualcommax: qca_edma: correct two commentsedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.cbbb0d915e054c5482f23a06741b7494d565e9ace1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: keep a group's members when its lookup times out port_mdb_add starts a group from the CPU port alone on any lookup error, so an operation that timed out rewrote an existing group with only the CPU and the new port, dropping every other member. Start afresh only when the group does not exist and pass any other error up. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100bbb0d915e054c5482f23a06741b7494d565e9acequalcommax: qca_ppe: keep a group's members when its lookup times outedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.c91ccd0713d44f687979f65305266c4881a704fdc1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: fold the CPU port's queue counters periodically The fold work visits user ports only, so the CPU port's queue counters, 32 bits of packets and 40 of bytes, were folded only when ethtool read them. At 1 Gbit/s the byte counter wraps in about 2.4 hours, and two wraps between reads lose a whole period. Fold every available port. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +010091ccd0713d44f687979f65305266c4881a704fdcqualcommax: qca_ppe: fold the CPU port's queue counters periodicallyedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.c2ebcefb7526b24da2cd70221a6dbbb42b11a00f01793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: share the FDB operation code The unicast and multicast FDB writes repeated the op engine sequence, the MAC packing was written out three times, and the LAG FDB ops copied the port ones apart from the destination. The LAG copies also took flow_lock, which guards none of the FDB state; fdb_lock already serialises the op engine. Share the op engine write, the MAC packing and one FDB set helper that the port and LAG ops call. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +01002ebcefb7526b24da2cd70221a6dbbb42b11a00f0qualcommax: qca_ppe: share the FDB operation codeedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.cfd5484ac4924d7dd21bc0df7329e5d149ac6c3171793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: drop dead checks and accept an ethernet-ports node ppe_vlan_find() was declared twice, and four ethtool callbacks checked the port against num_ports, which DSA never exceeds. Probe and the IPQ6018 mux setup looked for a "ports" node only, while the binding and the DSA core also accept "ethernet-ports". Drop the duplicate and the dead checks, and look for both names. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100fd5484ac4924d7dd21bc0df7329e5d149ac6c317qualcommax: qca_ppe: drop dead checks and accept an ethernet-ports nodeedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.c680b2858345d19bcea96d211fe482a4ad349956d1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: count only switched traffic in offloaded qdisc stats The root tbf, ets and prio stats add the MAC's transmit counters to the qdisc's, but the MAC also sends every frame the host put through that qdisc, which the qdisc has counted itself, so host traffic was reported twice. Subtract what the host sent on the port over the same interval. On a WAN port with an offloaded tbf, the qdisc reported the MAC's bytes plus its fq_codel child's before, and reports 177955309 bytes against the MAC's 177957143 after. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100680b2858345d19bcea96d211fe482a4ad349956dqualcommax: qca_ppe: count only switched traffic in offloaded qdisc statsedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.cfcd37e330bed77dcb73c9d717852aaab589883221793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: refuse an mqprio class that splits a hashed band A priority selects a band of four queues and the flow hash picks the queue in it, but mqprio's map was checked against priority i leaving on queue i, a layout from before the hash spread. A class of one queue then passed the check and shaped a quarter of its priority's flows, chosen by hash. Require each class to own the whole band its priorities select. hw_ppe's map, 8@0 4@8, still passes. Fixes: 3881df344eb ("qualcommax: qca_ppe: spread flows across queues by RSS hash") Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100fcd37e330bed77dcb73c9d717852aaab58988322qualcommax: qca_ppe: refuse an mqprio class that splits a hashed bandedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.h8948da32427e35357867e61a0dd530e5350bccbb1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: keep a replacing mqprio's offload tc qdisc replace of an offloaded mqprio installs the new qdisc first and then destroys the old one, whose offload removal carries no qdisc and cleared the shapers and the transmit queue mapping the new qdisc had just set. Count the port's offloaded mqprio qdiscs and ignore a removal while another one is installed. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +01008948da32427e35357867e61a0dd530e5350bccbbqualcommax: qca_ppe: keep a replacing mqprio's offloadedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.c6b9c6c5b6cb03d2cccd7fe42b446008e14414e0b1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: look a port's scheduler layout up in one place Ten functions searched port_l0[] for the port with the same loop. Give the search a helper. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +01006b9c6c5b6cb03d2cccd7fe42b446008e14414e0bqualcommax: qca_ppe: look a port's scheduler layout up in one placeedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.c94b80939378466333f918750b8fc40157038d85d1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: refuse mqprio frame preemption mqprio's preemptible traffic classes were accepted and ignored. The MACs have no frame preemption, so refuse them. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +010094b80939378466333f918750b8fc40157038d85dqualcommax: qca_ppe: refuse mqprio frame preemptionedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_acl.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_debugfs.cfee126ace8a35af26aff3d965253a902a6836f3d1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: correct stale and wrong comments Several comments no longer matched the code: the qdisc band map claimed nothing is programmed, the highest classifier priority was explained by a node sharing that was removed, the shaper state was described as tbf only, the root tbf comment sat above the gred code, the CPU port's admission comment said its scheduler is not built, and the ACL comment had ethtool inserting without rtnl, which it holds. Others narrated history or said FIXME. Correct or trim them. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100fee126ace8a35af26aff3d965253a902a6836f3dqualcommax: qca_ppe: correct stale and wrong commentsedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_acl.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_debugfs.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.cdd1227705a03ba479753267362823bbfca39b55a1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: read a descriptor in one access The descriptor rings are uncached, and the receive peek and the transmit completion walk read a descriptor's address and status as separate 32-bit loads, the completion walk its status up to three times. Read both words with one 64-bit load. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100dd1227705a03ba479753267362823bbfca39b55aqualcommax: qca_edma: read a descriptor in one accessedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.c2ca23dee6693fe78d5432d8e9fc3aa390d33d4451793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: prefetch the next segment of a frag_list frame Counting the descriptors of a frag_list frame walks its segments, and each one misses on the skb and then on its shared info. Prefetch the next segment while the current one is counted. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +01002ca23dee6693fe78d5432d8e9fc3aa390d33d445qualcommax: qca_edma: prefetch the next segment of a frag_list frameedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_vlan.c33f270e580676520e2d8b4b0a4c9cf8b5a67c9891793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: give a PVID-classified frame the VLAN's VID On a VLAN-aware bridge, a frame that arrives untagged on a port and is classified into its PVID VLAN carries no VID, so a port that egresses the VLAN tagged sends it with VID 0. Unicast between an untagged and a tagged port of the same VLAN therefore never arrives. Let the PVID rule add the VLAN's VID to the frame. On an AX3600 with lan1 untagged in VLAN 1 and lan2 carrying VLAN 1 tagged, the PC's frames left lan2 tagged with VID 0 and its ping to a host behind lan2 failed; with the VID added, ping and TCP pass both ways. Fixes: 142104bb90b ("qualcommax: add PPE driver") Link: https://github.com/openwrt/openwrt/issues/25904 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +010033f270e580676520e2d8b4b0a4c9cf8b5a67c989qualcommax: qca_ppe: give a PVID-classified frame the VLAN's VIDedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_vlan.ctarget/linux/qualcommax/patches-6.18/0966-net-dsa-tag_oob-let-the-switch-send-frames-it-routed-to-the-CPU.patchtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.h00ad5b53846b3a0ee386804a75f797c6671672891793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: route flows to Wi-Fi through the CPU port A flow out of a device the switch cannot reach, such as a Wi-Fi interface, was left to the software flowtable. Offload it with the CPU port as the egress port: the PPE routes and translates it and rewrites the Ethernet header, and the frame reaches the CPU finished, with the index of the flow it matched in the receive preheader. qca_edma hands such frames to the switch driver ahead of GRO, which queues them on the flow's egress device, so its qdisc, AQL and airtime fairness see them as before. Routed TCP to a 2x2 HE160 station costs 27% fewer CPU cycles per packet over IPv4 (2 runs) and 23% fewer over IPv6 (1 run). The cpu_xmit module parameter turns it off. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +010000ad5b53846b3a0ee386804a75f797c667167289qualcommax: qca_ppe: route flows to Wi-Fi through the CPU portedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.caddtarget/linux/qualcommax/patches-6.18/0966-net-dsa-tag_oob-let-the-switch-send-frames-it-routed-to-the-CPU.patchtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.cd6c75fb80965aa1b68d5333549ada9efc6cf151e1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: read an FDB lookup's entry before retiring its result The FDB read results queue up: the data registers show the oldest, and reading the result register retires it. The driver polled the result register and then read the data, which by then was zero, so every lookup missed. A port_mdb_add therefore always started the group from the CPU port alone and added another entry for the same group, and a group with members on two ports was split over entries that each named one of them. Read the data before the result register in each poll, so the data read just before the result that names the operation is its entry. On an AX3600 with IGMP snooping, a group joined from lan1 and lan2 had six hardware entries, naming CPU and lan1 or CPU and lan2, and lan1 received none of the group's traffic; a lookup by hand returns the entry when its data is read first. Fixes: 0f9baab7f64 ("qualcommax: qca_ppe: finish an FDB operation before reading its result") Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100d6c75fb80965aa1b68d5333549ada9efc6cf151equalcommax: qca_ppe: read an FDB lookup's entry before retiring its resultedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_acl.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.c68e25f82b10811cdbb99572bb9c4c35ecf54cbb01793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: keep PSH segments out of the small-packet priority A short TCP segment that carries PSH ends a write of a flow whose other segments are full size. Promoted by the small-packet rule, it overtakes them and reorders the flow on every write: a 16 Mbit/s download through the switch saw 35-42 reordered segments per 30 s, and none once the rule matches only frames with PSH clear (2-3 runs each). Acks, handshakes and every protocol other than TCP, whose frames carry no TCP flags, still match. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +010068e25f82b10811cdbb99572bb9c4c35ecf54cbb0qualcommax: qca_ppe: keep PSH segments out of the small-packet priorityedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_acl.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.cpackage/network/config/qca-ppe-qos/files/qca-ppe-qos.initfadbcb65d5699317d938a1ed46e23345c359e5441793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqca-ppe-qos: keep PSH segments out of the Wi-Fi small-packet stamp The u32 stamp moves short frames into a higher access category, so a short TCP segment with PSH, which ends a write of a bulk flow, overtakes the flow's full-size segments. A download over Wi-Fi saw 240-460 reordered segments per 25 s, and none with two pass filters ahead of the stamp for TCP segments with PSH set (3 runs each). The filters use fixed offsets, so they cover IPv4 without options and IPv6 without extension headers. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100fadbcb65d5699317d938a1ed46e23345c359e544qca-ppe-qos: keep PSH segments out of the Wi-Fi small-packet stampeditpackage/network/config/qca-ppe-qos/files/qca-ppe-qos.initpackage/network/config/qca-ppe-qos/files/qca-ppe-qos.initbe48899f48a6c92ec9b2bd0551f674164ec09e331793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqca-ppe-qos: let 'enabled' switch only the marking rules With enabled set to 0 the script tore everything down, the DSCP maps and the small-packet priority included, and skipped the Wi-Fi stamp, while the LuCI page offers the option as the switch for the marking rules. Keep the maps and the small-packet priority, and only flush the marking filters. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100be48899f48a6c92ec9b2bd0551f674164ec09e33qca-ppe-qos: let 'enabled' switch only the marking ruleseditpackage/network/config/qca-ppe-qos/files/qca-ppe-qos.initpackage/network/config/qca-ppe-qos/files/qca-ppe-qos.initbddefbe965f978b22e6dc26cbb2e95a43e53ea7f1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqca-ppe-qos: end the rule range at preference 509 The driver ranks a lower preference higher, so a filter at 511, where hw_ppe.qos marks its download band, ranks below every rule of this script, not above as the comment said. Stop the range at 509, below the small-packet rule's rank, and still flush up to 510, which earlier versions installed rules at. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100bddefbe965f978b22e6dc26cbb2e95a43e53ea7fqca-ppe-qos: end the rule range at preference 509editpackage/network/config/qca-ppe-qos/files/qca-ppe-qos.inittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/patches-6.18/0952-net-ethernet-qca-add-ppe.patchtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.c8099efef1880f379fde94f90f51c058ddfef4b0a1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: hand shaped flows to a qdisc after the hardware routed them The PPE has no queue that can run CAKE or mark ECN. A flow that crosses the shaped WAN link now keeps its lookup, NAT and encapsulation in hardware, and its finished frames reach the CPU only to pass a qdisc on a shaper device, one per direction, which the driver creates when the devlink parameter dl_shaper or ul_shaper names a device that does not exist yet. The PPE builds an upload frame whole, PPPoE and VLAN headers included. Once the qdisc releases a frame for a switch port, the shaper device sends it straight into the conduit's ring; a download to Wi-Fi goes on to that interface. What the host forwards itself reaches the same devices through act_mirred, as it would reach an ifb: from the uplink's egress, where the upload device builds the uplink's PPPoE and VLAN headers itself and sends the frame to the conduit too, and from the WAN port's ingress, from where the download device returns it to the receive path. Upload frames carry the conntrack the hardware path would otherwise lose, so CAKE's nat mode still tells the LAN hosts apart; a download to a tagged LAN VLAN gets its tag after the shaper. An ifb named instead works as well, at a higher cost. The devlink parameters dl_shaper, ul_shaper, uplink and ct_dscp configure it, and sqm-scripts' ppe_cake.qos sets them. Flent from a wired client over a 300/150 Mbit/s PPPoE line shaped to 330/168, 8 TCP streams each way: through the shaper devices the download carries 307.4 Mbit/s and the upload 157.2, as through IFBs, and the router spends 13.4k CPU cycles per forwarded download packet instead of 15.8k and 18.2k per upload packet instead of 22.4k; the four cores' load taken from idle-priority spinners falls from 26.5 to 21.6 % on the download and from 19.4 to 15.8 % on the upload. Latency under load stays at idle at the median through both; its 99th percentile rose by 0.05-0.07 ms in six of seven runs and by 4.3 ms in one (3 runs each arm). Link: https://github.com/tohojo/sqm-scripts/pull/196 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +01008099efef1880f379fde94f90f51c058ddfef4b0aqualcommax: qca_ppe: hand shaped flows to a qdisc after the hardware routed themedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.hedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow.cedittarget/linux/qualcommax/patches-6.18/0952-net-ethernet-qca-add-ppe.patchedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.cpackage/network/config/qca-ppe-qos/Makefilebe8b18e401fed78948828e66dcc281edf49da1221793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqca-ppe-qos: name ppe_cake.qos in the package description The classifiers pair with sqm-scripts' ppe_cake.qos as they do with hw_ppe.qos. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100be8b18e401fed78948828e66dcc281edf49da122qca-ppe-qos: name ppe_cake.qos in the package descriptioneditpackage/network/config/qca-ppe-qos/Makefiletarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.cc31a509a4d0d787278b65b74e9a7be0333bb488d1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: pick a multiqueue shaper's queue by the receive ring edma_rx_flow() hands a frame of an offloaded flow to its egress before the receive queue was recorded, so with cake_mq on the IFBs every such frame took the same queue. Record the ring first, so that each ring's CPU feeds a CAKE instance of its own. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100c31a509a4d0d787278b65b74e9a7be0333bb488dqualcommax: qca_edma: pick a multiqueue shaper's queue by the receive ringedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_debugfs.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.h6cadbf46d30ae9294eb2ca9046497ba47edb20001793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_ppe: run CoDel's control law on the shaped queues The queue manager drops a frame only on arrival, against a limit in buffers, so it bounds a queue but cannot tell a standing queue from a burst. A kthread reads the depth of every hashed queue of a shaped port and of the CPU port's download band, takes each bottleneck's delay from its backlog and rate, and when CoDel's law calls for a drop lowers the limit of each busy queue of that bottleneck to one frame under its depth for one tick. It ticks every 2 ms while a queue holds a full frame and every 20 ms otherwise; aqm_tick_us=0 turns it off, and debugfs aqm shows its state. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +01006cadbf46d30ae9294eb2ca9046497ba47edb2000qualcommax: qca_ppe: run CoDel's control law on the shaped queuesedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_scheduler.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_debugfs.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe.htarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.h698653058fe52a70d543a056a97e4a97eb0479711793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: qca_edma: moderate receive interrupts over 100 us At a shaped 330 Mbit/s download each receive interrupt found 2.4 frames, the 25 us moderation timer expiring long before the 16-frame threshold. With 100 us it finds 6.7 (3.5 for the upload), and the router spends 4.4 % fewer CPU cycles per forwarded packet on the download, with the same throughput and latency under load (Flent tcp_ndown 8 through CAKE, 3 runs each; the upload's 1.8 % is within the 3 % that two identical configurations differ by). ethtool -C still sets it. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100698653058fe52a70d543a056a97e4a97eb047971qualcommax: qca_edma: moderate receive interrupts over 100 usedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.htarget/linux/qualcommax/patches-6.18/0966-net-dsa-tag_oob-let-the-switch-send-frames-it-routed-to-the-CPU.patchtarget/linux/qualcommax/files/include/linux/qca_edma.htarget/linux/qualcommax/patches-6.18/0953-net-ethernet-qca-add-EDMA.patchtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.htarget/linux/qualcommax/patches-6.18/0955-net-dsa-tag_qca-add-a-variant-behind-an-ethertype.patchtarget/linux/qualcommax/config-6.18target/linux/qualcommax/patches-6.18/0952-net-ethernet-qca-add-ppe.patchtarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.ctarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.ctarget/linux/qualcommax/patches-6.18/0950-net-dsa-add-out-of-band-tagging-protocol.patchb50530932b5a8dc7b086476ac930190ea6dc2d3b1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: tag with the QCA header instead of out of band The out-of-band tagger was never merged upstream: it carries the port in an skb extension that DSA allocates for every frame sent, and that qca_edma allocated for every frame the switch trapped to the CPU. Use the QCA tagger instead, as airoha and mtk_eth_soc use their switch's in-band tagger. On transmit, qca_edma reads the port out of the two-byte tag and removes it once the frame is sure to go out, then names the port in the preheader as before. On receive, a forwarded frame keeps the metadata dst that DSA resolves without a tagger, and only a trapped frame, which the bridge has to forward itself, gets the header the tagger reads its port from. The switch's frames for a flow reach qca_ppe through a hook it registers with qca_edma, and its shaper devices pass the port to qca_edma_port_xmit() directly, so the shaped path allocates nothing per packet. The tagger's needed headroom raises the conduit's MTU by 2. Wired LAN, a VLAN-aware bridge, IGMP snooping with offloaded MDB entries, PPPoE over a VLAN uplink and Wi-Fi through the CPU port work unchanged on a Xiaomi AX3600. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100b50530932b5a8dc7b086476ac930190ea6dc2d3bqualcommax: tag with the QCA header instead of out of bandedittarget/linux/qualcommax/config-6.18edittarget/linux/qualcommax/patches-6.18/0952-net-ethernet-qca-add-ppe.patchedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_main.cedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.cdeletetarget/linux/qualcommax/patches-6.18/0966-net-dsa-tag_oob-let-the-switch-send-frames-it-routed-to-the-CPU.patchedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_edma.haddtarget/linux/qualcommax/files/include/linux/qca_edma.hedittarget/linux/qualcommax/patches-6.18/0953-net-ethernet-qca-add-EDMA.patchedittarget/linux/qualcommax/patches-6.18/0955-net-dsa-tag_qca-add-a-variant-behind-an-ethertype.patchedittarget/linux/qualcommax/files/drivers/net/ethernet/qualcomm/qca_ppe_flow_offload.cdeletetarget/linux/qualcommax/patches-6.18/0950-net-dsa-add-out-of-band-tagging-protocol.patchtarget/linux/generic/backport-6.18/706-04-v7.3-netfilter-flowtable-use-the-vlan-id-not-the-full-tci.patchbe75fbfa9b26eba3b60c291cff766c5fca8e929d1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comkernel: backport the flowtable VLAN ID fix Backport c203ecf90574, which keys the flowtable tuple on the 12-bit VLAN ID instead of the whole TCI, so that frames whose tag carries a PCP still match their flow. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +0100be75fbfa9b26eba3b60c291cff766c5fca8e929dkernel: backport the flowtable VLAN ID fixaddtarget/linux/generic/backport-6.18/706-04-v7.3-netfilter-flowtable-use-the-vlan-id-not-the-full-tci.patchtarget/linux/generic/pending-6.18/708-netfilter-flowtable-tear-down-direct-xmit-flows-when.patch09fe0f814008b287734a0582d985a9f99c6b3cdc1793004287000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comgeneric: flowtable: check the bridge a roaming flow transmits on Update the imported fdb roaming teardown to v9. With a vlan device of one bridge enslaved to another bridge, v8 counted the vlans below both bridges, looked the bridge port up from the wrong device and read past encap[]; v9 resets the count at each bridge, so the gc checks the bridge the flow transmits on. v9 also carries Pablo's authorship and sign-off from his posting with a note of the changes, instead of Co-developed-by. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:47 +010009fe0f814008b287734a0582d985a9f99c6b3cdcgeneric: flowtable: check the bridge a roaming flow transmits onedittarget/linux/generic/pending-6.18/708-netfilter-flowtable-tear-down-direct-xmit-flows-when.patchtarget/linux/generic/pending-6.18/643-net-dsa-fix-host-fdb-refcount-when-a-bridge-fdb-entry-roams.patchtarget/linux/generic/pending-6.18/642-net-bridge-switchdev-add-br_switchdev_fdb_find_port.patchc7924dcd74a6bd30abd5f935209528c071ddd2871793004288000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comgeneric: dsa: track host fdb entries per port When a bridge fdb entry roams between ports, br_fdb_update() notifies switchdev of the deletion and the addition without a lock, and DSA's host address count on the CPU port goes wrong when two CPUs learn one address on different ports: "qca-ppe 3a000000.ppe: port 5 failed to delete ... from fdb: -2", and an address left on the CPU port. Backport the series prepared for net-next that makes each DSA user port record the host addresses it holds and look up where the bridge has the entry when it handles each event, without a lock in the bridge's learning path. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/24806 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:44:48 +0100c7924dcd74a6bd30abd5f935209528c071ddd287generic: dsa: track host fdb entries per portaddtarget/linux/generic/pending-6.18/642-net-bridge-switchdev-add-br_switchdev_fdb_find_port.patchaddtarget/linux/generic/pending-6.18/643-net-dsa-fix-host-fdb-refcount-when-a-bridge-fdb-entry-roams.patchpackage/network/config/firewall4/Makefilee2e50c9dc4b2dd57f4815ea9ff66c1c094bd21d81793004695000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comfirewall4: update to Git HEAD (2026-10-26) df0c9021bbe7 ruleset: fix for missing counters handling code for ipsets bac1d656e09b Do not emit helper jump without helper modules Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:51:35 +0100e2e50c9dc4b2dd57f4815ea9ff66c1c094bd21d8firewall4: update to Git HEAD (2026-10-26)editpackage/network/config/firewall4/Makefiletarget/linux/qualcommax/patches-6.18/0953-net-ethernet-qca-add-EDMA.patch189012aed9ace46ca0f16650ce9b7136a631f05d1793005059000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: refresh patches CI told us we need to do so, so lets do it. Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 09:57:39 +0100189012aed9ace46ca0f16650ce9b7136a631f05dqualcommax: refresh patchesedittarget/linux/qualcommax/patches-6.18/0953-net-ethernet-qca-add-EDMA.patchtarget/linux/octeon/patches-6.18/900-cn70xx-fix-pem-bar-register-map.patch76d6b7fdbf0bc84bc4c89158faed8fe33beaf1e31793005782000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comocteon: fix PEM BAR register map on CN70XX On CN70XX, the PEM register map differs from the other Octoen III models. PEM_BAR_CTL is at block offset 0xa0 and the BAR1 index table at 0x100, while the in-tree code uses the CN68XX offsets (BAR_CTL at 0x128, BAR1 index at 0xa8) for all Octeon III parts. The Cavium OCTEON-SDK cvmx-permx-defs.h special cases CN70XX for both registers. With the generic offsets, __cvmx_pcie_rc_initialize_gen2() programs the wrong registers on CN70XX. The intended BAR_CTL value lands on a BAR1 index entry, and the BAR1 index writes land on the real BAR_CTL (0xa8) and BAR2_MASK (0xb0). BAR2_MASK is ANDed with inbound (device DMA) addresses, so a bogus value there silently corrups all PCIe DMA to host memory. Observed on a CN7030 board while debugging a failing b43 firmware intialization followed by DMA errors. Add model awareness helpers and use them for the three affected addresses. Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26198 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 10:09:42 +010076d6b7fdbf0bc84bc4c89158faed8fe33beaf1e3octeon: fix PEM BAR register map on CN70XXaddtarget/linux/octeon/patches-6.18/900-cn70xx-fix-pem-bar-register-map.patchtarget/linux/ath79/dts/ar9344_wd_mynet-nxxx.dtsic5e88157e9d33dca599a2e2f752b7b7bd4ee18d11793010935000https://taiha.net/jenkins/user/ansuelsmthansuelsmthansuelsmth@gmail.comath79: use old SPI driver on WD MyNet to avoid filesystem errors complaints about JFFS2 corruption on WD Mynet N750 devices started at 21.02. https://forum.openwrt.org/t/upgrade-from-barrier-breaker-14-07-to-latest-21-02-wd-my-net-n750/119833/ it's still happening on 25.12, from my device: jffs2: notice: (594) jffs2_get_inode_nodes: Node header CRC failed at 0x006e9c. jffs2: notice: (723) jffs2_get_inode_nodes: Node header CRC failed at 0x006e58. jffs2: warning: (723) jffs2_do_read_inode_internal: no data nodes found for ino #37 ffs2: notice: (723) jffs2_do_read_inode_internal: but it has children so we fake some modes for it commit ebf0d8dade (between 19.07 and 21.02) started using the new spi-ar934x driver for the ath79 target instead of spi-ath79. i don't know exactly what's wrong with the new driver with this device. but putting it back to the old one seems to fix it. I've been using my N750 successfully now for a week, changing configs, installing/removing packages, rebooting, yanking power. I don't get any more JFFS2 complaints, the device stays responsive and LUCI is usable as expected Signed-off-by: Ronald Ouyang <repaxan@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26154 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> 2026-10-26 11:35:35 +0100c5e88157e9d33dca599a2e2f752b7b7bd4ee18d1ath79: use old SPI driver on WD MyNet to avoid filesystem errorsedittarget/linux/ath79/dts/ar9344_wd_mynet-nxxx.dtsitarget/linux/qualcommax/files/include/dt-bindings/net/pcs/qualcomm,ipq-uniphy.yamltarget/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6018-ess.dtsitarget/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-ess.dtsia41558d2d3654938cbc22c1b3a9c6e68a18330891793015431000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: list UNIPHY clock output names RX first qca_uniphy_register_clks() registers each clock under the clock-output-names entry at its UNIPHY_CLK_* index, and the binding header defines UNIPHY_CLK_RX as 0. The ipq6018 and ipq8074 nodes list the TX name first, so the RX clock carries the TX name and vice versa. Since GCC takes these clocks by phandle, debugfs reports every port TX RCG on uniphyN_gcc_rx_clk while the hardware selects uniphyN TX, and a parent lookup by name picks the wrong one. List the names RX first, as ipq5018 already does, and make the binding match. Tested on a Xiaomi AX3600 (ipq8074): nss_port1..5_tx_clk_src now report uniphy0_gcc_tx_clk and the RX sources uniphy0_gcc_rx_clk, matching CFG src 1 in their parent maps. The CFG registers and all rates are unchanged, and lan1 to lan2 iperf3 runs at 941 Mbit/s in each direction (one 5 s run each). Fixes: 5df1a6ab80a ("qualcommax: ipq60xx: pass UNIPHY clocks directly to GCC") Fixes: 49193000bf4 ("qualcommax: ipq807x: pass UNIPHY clocks directly to GCC") Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/26205 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 12:50:31 +0100a41558d2d3654938cbc22c1b3a9c6e68a1833089qualcommax: list UNIPHY clock output names RX firstedittarget/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq6018-ess.dtsiedittarget/linux/qualcommax/files/include/dt-bindings/net/pcs/qualcomm,ipq-uniphy.yamledittarget/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-ess.dtsipackage/kernel/mac80211/patches/rtl/003-wifi-rtw88-usb-Download-the-reserved-page-synchronously.patchpackage/kernel/mac80211/Makefilea40fd94a3fa9bb787e631349032cf7878e3e6aad1793018263000https://taiha.net/jenkins/user/ansuelsmthansuelsmthansuelsmth@gmail.commac80211: realtek: download rsvd page synchronously on USB In AP mode, rtw88 downloads the reserved page, which holds the beacon, and then polls BCN_VALID. Over USB the download only queues the URB, so the poll can run while the beacon is still on the bus and time out, in bursts when the beacon changes often, such as when stations associate and disassociate (lwfinger/rtw88#451): rtw_8822bu: error beacon valid rtw_8822bu: failed to download drv rsvd page Add v5 of the rtw88 patch. It waits for that URB in a new rtw_usb_write_port_sync() and kills it if it does not complete within 5 s, as usb_bulk_msg() does, but keeps URB_ZERO_PACKET. This fixes the use-after-free that Ping-Ke Shih found in v3, where the completion handler could run after the waiter had freed its context on timeout. Only the line numbers and one context line differ from rtw-next. v4 was tested with backports 7.2 on a Turris 1.x with a TP-Link Archer T4U v3 (RTL8812BU, handled by rtw_8822bu) as a 2.4 GHz AP over USB 2 and USB 3 and as a 5 GHz AP over USB 3. The AP came up after each of 15 restarts, and no "error beacon valid", "failed to download drv rsvd page" or USB write error was logged during them or 7 beacon changes. No station was associated, and the builds without the patch did not log these errors either, so this shows no regression; lwfinger/rtw88#451 itself was not reproduced. v5 only reorders declarations, drops an initializer and rewords a comment. Pending upstream, submitted to rtw-next and acked by Ping-Ke Shih: https://lore.kernel.org/linux-wireless/20261013033737.6761-1-pepe.schlehofer@gmail.com/ Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> Link: https://github.com/openwrt/openwrt/pull/25837 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> 2026-10-26 13:37:43 +0100a40fd94a3fa9bb787e631349032cf7878e3e6aadmac80211: realtek: download rsvd page synchronously on USBeditpackage/kernel/mac80211/Makefileaddpackage/kernel/mac80211/patches/rtl/003-wifi-rtw88-usb-Download-the-reserved-page-synchronously.patchpackage/kernel/mac80211/patches/rtl/002-wifi-rtw88-8822b-Relax-ETSI-EDCCA-threshold-on-2.4-GHz.patch2462519a7f3811fe0535be440273e978cf66d0801793018327000https://taiha.net/jenkins/user/ansuelsmthansuelsmthansuelsmth@gmail.commac80211: realtek: relax 8822B 2.4 GHz ETSI EDCCA threshold Under ETSI, rtw88 sets the RTL8822B EDCCA threshold to min(IGI, 36), at most about -74 dBm. On a Turris 1.x with a TP-Link Archer T4U v3 (RTL8812BU) in USB 3 mode as a 2.4 GHz AP under CZ, in-band energy, mostly from the adapter's own USB 3 link, kept IGI at 0x2a and the threshold at 36. The AP was not seen in any of 5 scans, and the driver reported "failed to get tx report from firmware". Add the pending upstream patch that uses the normal threshold, max(IGI + 8, 48), on 2.4 GHz under ETSI, capped at 50 (nominally -60 dBm), and keeps the existing rule on 5 GHz and in JP. With it, the AP was seen in 4 of 5 scans on the same port and boot (16 of 19 across repeated runs), with no TX report failures. Only the line numbers are adapted to backports 7.2. Pending upstream, submitted to rtw-next and acked by Ping-Ke Shih: https://lore.kernel.org/linux-wireless/20261011204509.46062-1-pepe.schlehofer@gmail.com/ Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> Link: https://github.com/openwrt/openwrt/pull/25836 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> 2026-10-26 13:38:47 +01002462519a7f3811fe0535be440273e978cf66d080mac80211: realtek: relax 8822B 2.4 GHz ETSI EDCCA thresholdaddpackage/kernel/mac80211/patches/rtl/002-wifi-rtw88-8822b-Relax-ETSI-EDCCA-threshold-on-2.4-GHz.patchtarget/linux/ramips/dts/mt7621_mqmaker_witi.dtsb5ff052caf4b7e90eb4b84941dec77bb5e4b5e081793022258000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comramips: mt7621: fix SATA detection on MQMaker WiTi The WiTi's SATA controller worked under OpenWrt 19.07, but stopped being detected in the 21.02 release series following changes to the MT7621 PCIe driver. PCIe port 2 fails to initialise, leaving the onboard ASMedia ASM1062 inaccessible. This adds the missing board-specific reset GPIOs (19, 8 and 7). The mapping was originally suggested by Sergio Paracuellos and tested by Florian Hofmann in the earlier issue discussion. I've tested the fix on a WiTi v2.0 (256 MB) with both OpenWrt main (Linux 6.18.55) and the 25.12 branch (Linux 6.12.112). Both SATA ports negotiated 6 Gbps links, and I was able to read from two connected SSDs without errors. Hope this helps anyone who is still using one of these boards for anything. Link: https://github.com/openwrt/openwrt/issues/9156 Link: https://github.com/openwrt/openwrt/issues/9869 Signed-off-by: Alex Sunekants <asunekants@pm.me> Link: https://github.com/openwrt/openwrt/pull/26196 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 14:44:18 +0100b5ff052caf4b7e90eb4b84941dec77bb5e4b5e08ramips: mt7621: fix SATA detection on MQMaker WiTiedittarget/linux/ramips/dts/mt7621_mqmaker_witi.dtspackage/firmware/intel-microcode/Makefile6079d00acde51dc5a01cfd282d6647667e031f9e1793022729000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comintel-microcode: switch source to Intel upstream, update to 20260925 Debian tarball lags/currently 5 commits and 9 months old relative to upstream. Worse is that upstream is asleep at the switch with 3 outstanding bug reports since Feb/2026 showing them this fact[1-3]. Therefore use intel/Intel-Linux-Processor-Microcode-Data-Files directly and drop the Debian-supplied make step. 1. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149038 2. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1136460 3. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144154 Signed-off-by: John Audia <therealgraysky@proton.me> Link: https://github.com/openwrt/openwrt/pull/26184 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 14:52:09 +01006079d00acde51dc5a01cfd282d6647667e031f9eintel-microcode: switch source to Intel upstream, update to 20260925editpackage/firmware/intel-microcode/Makefiletarget/linux/kirkwood/base-files/etc/init.d/hwmon_fancontrol3c3a4150694ca9ea4b8a44c12273bd4780bbf7d01793024040000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comkirkwood: fix ReadyNAS Duo v2 fan controller detection The hwmon index is not stable across boots. On the ReadyNAS Duo v2, hwmon0 is the kirkwood_thermal sensor while the g762 fan controller is registered as hwmon1. Find the fan controller by its hwmon name instead of assuming a fixed index. Signed-off-by: Jakub Skoczen <skoczko@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26206 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 15:14:00 +01003c3a4150694ca9ea4b8a44c12273bd4780bbf7d0kirkwood: fix ReadyNAS Duo v2 fan controller detectionedittarget/linux/kirkwood/base-files/etc/init.d/hwmon_fancontroltarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/rtl-otto.h0074cd9b1d617bdb77a38f70d16653f5e31902ab1793043963000https://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenmarkus.stockhausen@gmx.derealtek: pie: preserve two-bit L2 frame type fields The PIE L2 frame type and its mask occupy two bits in hardware, but their pie_rule members are bool. Assigning LLC_Other (2) or a full mask (3) therefore truncates the value to 1 before the encoders can pack it. Use u8 for frame_type_l2 and frame_type_l2_m so all four switch families preserve the complete match and mask values during encoding and readback. Signed-off-by: João Silva <jgc3silva@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26225 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> 2026-10-26 20:46:03 +01000074cd9b1d617bdb77a38f70d16653f5e31902abrealtek: pie: preserve two-bit L2 frame type fieldsedittarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/rtl-otto.htarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.c6ca8a7f1d5b7051e365ade017d4fe481a5a622a71793044139000https://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenmarkus.stockhausen@gmx.derealtek: pie: rtl930x: fix template 4 source port fields The software description of RTL930x fixed template 4 lists SPM1 twice, but the hardware template contains SPM0 followed by SPM1. This encodes the upper source-port bitmap word into both fields, losing the lower 16 source-port match bits and their mask. Describe the two fields as SPM0, SPM1 so IPv6 source-address rules using this template match the intended ingress ports. Signed-off-by: João Silva <jgc3silva@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26226 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> 2026-10-26 20:48:59 +01006ca8a7f1d5b7051e365ade017d4fe481a5a622a7realtek: pie: rtl930x: fix template 4 source port fieldsedittarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.ctarget/linux/generic/config-6.185df2651e6a7002eec305fd1bef0c7f06050a949c1793045293000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comgeneric: 6.18: add CONFIG_DETECT_HUNG_TASK_BLOCKER Linux 6.15 added DETECT_HUNG_TASK_BLOCKER, which depends on DETECT_HUNG_TASK. The generic config leaves DETECT_HUNG_TASK unset, so the symbol stays hidden by default, but selecting KERNEL_DETECT_HUNG_TASK makes it visible and the kernel build stops at the syncconfig prompt for it. Add it to the generic config. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/26012 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 21:08:13 +01005df2651e6a7002eec305fd1bef0c7f06050a949cgeneric: 6.18: add CONFIG_DETECT_HUNG_TASK_BLOCKERedittarget/linux/generic/config-6.18target/linux/mediatek/filogic/config-6.18target/linux/mediatek/mt7622/config-6.183d0cafad1cc516d3ed1e5db058a2686d23c5a8b21793045430000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.commediatek: disable perf events by default The perf utility is not shipped by default. To use perf on a custom build, enable KERNEL_PERF_EVENTS. Signed-off-by: Qingfang Deng <dqfext@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26200 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 21:10:30 +01003d0cafad1cc516d3ed1e5db058a2686d23c5a8b2mediatek: disable perf events by defaultedittarget/linux/mediatek/mt7622/config-6.18edittarget/linux/mediatek/filogic/config-6.18target/linux/mediatek/filogic/config-6.18target/linux/mediatek/mt7622/config-6.184d3ed016a2d710ac5719863e7870fa91e39fc27e1793045430000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.commediatek: disable unrelated errata MT7622 and MT798x (except MT7988) have a Cortex-A53 r0p4, as indicated by /proc/cpuinfo. Disable errata that only apply to earlier revisions. Signed-off-by: Qingfang Deng <dqfext@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26200 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 21:10:30 +01004d3ed016a2d710ac5719863e7870fa91e39fc27emediatek: disable unrelated errataedittarget/linux/mediatek/filogic/config-6.18edittarget/linux/mediatek/mt7622/config-6.18target/linux/mediatek/filogic/config-6.18target/linux/mediatek/mt7622/config-6.187d0bf92beefbb62e306f2318dfe5b47538bd85a61793045430000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.commediatek: disable unsupported arch features Both A53 and A73 are baseline-ARMv8.0 and do not support those features. Signed-off-by: Qingfang Deng <dqfext@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26200 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-26 21:10:30 +01007d0bf92beefbb62e306f2318dfe5b47538bd85a6mediatek: disable unsupported arch featuresedittarget/linux/mediatek/filogic/config-6.18edittarget/linux/mediatek/mt7622/config-6.18scripts/mkits-qsdk-ipq-image.sh9ec7903e371233ef913f1dee4e2aeb8872efff851793081966000https://taiha.net/jenkins/user/danieldanieldaniel@makrotopia.orgscripts: mkits-qsdk-ipq-image: strip path from description The FIT description of the boot script image is derived from the file name given on the command line. Take only the basename so that the script can be passed by path while the description stays the same. Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2026-10-27 06:19:26 +00009ec7903e371233ef913f1dee4e2aeb8872efff85scripts: mkits-qsdk-ipq-image: strip path from descriptioneditscripts/mkits-qsdk-ipq-image.shtarget/linux/qualcommax/image/ipq807x.mk454e516148eed22217dc878d486e28dd5cac58901793081967000https://taiha.net/jenkins/user/danieldanieldaniel@makrotopia.orgqualcommax: ipq807x: fix Netgear factory image race RBR750, RBS750, RBR850 and RBS850 share one bootscript, and the factory image recipe copies it into the common kernel tmp directory with cp -f. When several images are built in parallel, one cp can create the destination between the unlink and the create of another and fail with "File exists", aborting the target install. The copy only serves to let dtc find the script next to the .its file. Pass the script by its absolute path instead, so that no shared file is written at all. Fixes: d0bd7ad1a2 ("qualcommax: ipq807x: add Netgear RBx750 support") Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2026-10-27 06:19:27 +0000454e516148eed22217dc878d486e28dd5cac5890qualcommax: ipq807x: fix Netgear factory image raceedittarget/linux/qualcommax/image/ipq807x.mktarget/linux/qualcommax/image/ipq60xx.mk936801c4489b02ad39eadd1a9b26d38dd3a40e0f1793081967000https://taiha.net/jenkins/user/danieldanieldaniel@makrotopia.orgqualcommax: ipq60xx: fix Netgear factory image race RBR350 and RBS350 share one bootscript, and the factory image recipe copies it into the common kernel tmp directory with cp -f. When both images are built in parallel, one cp can create the destination between the unlink and the create of the other and fail with "File exists", aborting the target install. The copy only serves to let dtc find the script next to the .its file. Pass the script by its absolute path instead, so that no shared file is written at all. Fixes: 67e6baf05e ("qualcommax: ipq60xx: add Netgear RBx350 support") Signed-off-by: Daniel Golle <daniel@makrotopia.org> 2026-10-27 06:19:27 +0000936801c4489b02ad39eadd1a9b26d38dd3a40e0fqualcommax: ipq60xx: fix Netgear factory image raceedittarget/linux/qualcommax/image/ipq60xx.mktarget/linux/realtek/patches-6.18/705-v7.1-net-sfp-initialize-i2c_block_size-at-adapter-configu.patchtarget/linux/realtek/patches-6.18/706-01-v7.2-net-sfp-apply-I2C-adapter-quirks-to-limit-block-size.patchtarget/linux/realtek/patches-6.18/706-02-v7.2-net-sfp-extend-SMBus-support.patchtarget/linux/realtek/patches-6.18/714-net-phy-sfp-add-support-for-SMBus.patchtarget/linux/generic/pending-6.18/753-net-sfp-add-quirk-for-ZYXEL-PMG3000-D20B.patch8ef3195f377420401969d31ecfd87c5e4179d1661793091151000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comgeneric: 6.18: add SFP quirk for ZYXEL PMG3000-D20B The ZYXEL PMG3000-D20B GPON SFP module reports LOS and TX_FAULT in a way that prevents the SFP state machine from initialising it. Its EEPROM also advertises autonegotiation, which the module does not support, and it needs a long startup delay before it comes up reliably. Add a quirk which reuses the existing fixups to ignore LOS and TX_FAULT, drops the bogus autoneg capability and sets module_t_wait to T_START_UP_BAD_GPON (60s). Signed-off-by: Martin Ostertag <martin.ostertag@gmx.de> Link: https://github.com/openwrt/openwrt/pull/26187 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-27 09:52:31 +01008ef3195f377420401969d31ecfd87c5e4179d166generic: 6.18: add SFP quirk for ZYXEL PMG3000-D20Bedittarget/linux/realtek/patches-6.18/705-v7.1-net-sfp-initialize-i2c_block_size-at-adapter-configu.patchedittarget/linux/realtek/patches-6.18/706-01-v7.2-net-sfp-apply-I2C-adapter-quirks-to-limit-block-size.patchedittarget/linux/realtek/patches-6.18/706-02-v7.2-net-sfp-extend-SMBus-support.patchedittarget/linux/realtek/patches-6.18/714-net-phy-sfp-add-support-for-SMBus.patchaddtarget/linux/generic/pending-6.18/753-net-sfp-add-quirk-for-ZYXEL-PMG3000-D20B.patchtarget/linux/realtek/patches-6.18/824-net-dsa-pass-bridge-VLAN-protocol-changes-to-drivers.patchf3aa65fff90f2be10efedff798f8ba6bf6b90f0f1793092466000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comrealtek: refresh patches CI told us to refresh, so lets do it. Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-27 10:14:26 +0100f3aa65fff90f2be10efedff798f8ba6bf6b90f0frealtek: refresh patchesedittarget/linux/realtek/patches-6.18/824-net-dsa-pass-bridge-VLAN-protocol-changes-to-drivers.patchpackage/firmware/ipq-wifi/Makefilef5a8129af3b8be8c9e629cefe603a7873ead21b81793093707000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comipq-wifi: update to Git HEAD (2026-10-25) a4bb9873649c ipq9574/qcn9274: add Linksys LN6001 board files 49ce14c099b1 ipq6018: add BDF for Wallys DR6018S Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-27 10:35:07 +0100f5a8129af3b8be8c9e629cefe603a7873ead21b8ipq-wifi: update to Git HEAD (2026-10-25)editpackage/firmware/ipq-wifi/Makefiletarget/linux/qualcommax/ipq60xx/base-files/lib/upgrade/platform.shtarget/linux/qualcommax/image/ipq60xx.mktarget/linux/qualcommax/dts/ipq6010-dr6018s.dtstarget/linux/qualcommax/ipq60xx/base-files/etc/board.d/02_networkpackage/firmware/ipq-wifi/Makefile01573cdc37e86b5e5308fffc81244b805bfb97f11793093783000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: ipq60xx: add support for Wallys DR6018S The Wallys DR6018S is a dual-band Wi-Fi 6 board based on the Qualcomm-Atheros IPQ6010 platform. Product specification: https://www.wallystech.com/upload/DR6018S.pdf Hardware: - Qualcomm-Atheros IPQ6010 quad-core ARM 64-bit A53 processor at 1.8 GHz - 1 GB DDR3L memory (2 x 512 MB) - 8 MB NOR flash and 256 MB NAND flash - Two 1 Gbps Ethernet ports with a QCA8075 PHY package - One Ethernet port supports passive or active PoE - Integrated 2x2 2.4 GHz 802.11ax radio, up to 573 Mbps - Integrated 2x2 5 GHz 802.11ax radio, up to 1201 Mbps - M.2 NGFF E-key socket with PCIe 3.0 support for an optional QCN9074 Wi-Fi module - Optional SD card slot - Optional USB 3.0 port - Four-pin serial connector using GPIO44/GPIO45 at 115200 8N1 - Four status LEDs and one reset button - Four MMCX antenna connectors - 24-48 V DC input with passive and active PoE support This adds the device tree, FIT/UBI image definitions, network defaults, NVMEM-backed ART calibration and MAC address extraction, NAND sysupgrade support and optional QCN9074 PCIe Wi-Fi support. The SD card slot and USB 3.0 port are listed as board capabilities from the vendor specification. They are not required for the tested onboard Wi-Fi configuration. MAC address layout: - WAN: MAC stored in 0:ART at offset 0x0000 - LAN: MAC stored in 0:ART at offset 0x0006 - 2.4 GHz and 5 GHz Wi-Fi: calibration and radio MACs stored in the calibration block at 0:ART offset 0x1000 The MAC addresses are unit-specific and are not hard-coded. Board data is submitted separately through firmware_qca-wireless. Installation: 1. Boot the initramfs image through the vendor U-Boot: setenv serverip 192.168.1.4 setenv ipaddr 192.168.1.1 tftpboot 0x44000000 openwrt-qualcommax-ipq60xx-wallys_dr6018s-initramfs-uImage.itb bootm 0x44000000 2. Transfer the sysupgrade image to /tmp and install it: sysupgrade -n /tmp/openwrt-qualcommax-ipq60xx-wallys_dr6018s-squashfs-sysupgrade.bin Tested on a Wallys DR6018S: - Booting the initramfs image from the vendor U-Boot - Installing OpenWrt to SPI NAND - Rebooting and cold-booting from the installed system - 2.4 GHz and 5 GHz AP operation - QCN9074 PCIe module enumeration and Wi-Fi operation - Ethernet connectivity - Correct Ethernet and Wi-Fi MAC addresses Signed-off-by: Alan Gao <1226010136@qq.com> Link: https://github.com/openwrt/openwrt/pull/25955 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-27 10:36:23 +010001573cdc37e86b5e5308fffc81244b805bfb97f1qualcommax: ipq60xx: add support for Wallys DR6018Sedittarget/linux/qualcommax/image/ipq60xx.mkaddtarget/linux/qualcommax/dts/ipq6010-dr6018s.dtsedittarget/linux/qualcommax/ipq60xx/base-files/lib/upgrade/platform.shedittarget/linux/qualcommax/ipq60xx/base-files/etc/board.d/02_networkeditpackage/firmware/ipq-wifi/Makefilepackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.jsonc9ea07732f7561a346d5d95e525c53fe0b00cf141793094200000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: ignore sae_pwe 0 on an AP MLD with a 6 GHz link hostapd_config_check_bss_6g() turns sae_pwe 0 into 2 on 6 GHz only. With an explicit sae_pwe 0 on an AP MLD, the 6 GHz link advertises SAE H2E in its RSNXE and the other links advertise no RSNXE. IEEE 802.11be-2024 12.6.2 requires the same RSNXE on all links. For sae and sae-mixed, use the band defaults in place of 0: 1 on 6 GHz, where WPA3 v3.5 does not allow hunting-and-pecking, and 2 elsewhere. Both values set the same RSNXE. psk2 and sae-compat keep the value, since their RSNE has no SAE AKM outside 6 GHz. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-27 10:43:20 +0100c9ea07732f7561a346d5d95e525c53fe0b00cf14wifi-scripts: ignore sae_pwe 0 on an AP MLD with a 6 GHz linkeditpackage/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.jsoneditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.json035a94fdb5fe5cc23cb369d0ce220601d2727ea41793094200000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: default sae_pwe also with ppsk With ppsk, iface_auth_type() leaves sae_pwe unset and hostapd uses 0. On an AP MLD with a 6 GHz link, the 6 GHz link then advertises SAE H2E in its RSNXE and the other links advertise no RSNXE, as with an explicit sae_pwe 0. ppsk skipped the defaults because sae_get_password() derived no PT for a per-station password, so H2E commits failed. Commit 8db58e80ab30 ("hostapd: derive the SAE PT of a per-station password") added that, so use the defaults with ppsk too: 1 on 6 GHz and 2 on other bands. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-27 10:43:20 +0100035a94fdb5fe5cc23cb369d0ce220601d2727ea4wifi-scripts: default sae_pwe also with ppskeditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uceditpackage/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.jsonpackage/network/services/bridger/Makefilefbbcf2f78ba001471016f8b5ab0c265b532b22ea1793094221000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namebridger: update to Git HEAD (2026-09-18) 5084b9c68b0d flow: free flow struct on delete and skip idle path after free b2b73e247c3b device: prevent member_list double-add on repeated update 4b008863ec30 device: clean up fdb entries on master change and device free c38234ea982b nl: guard bridger_nl_udebug_cb behind NL_UDEBUG 7328c75e0683 nl: fix bridge vlan state notification handling 335bb7a93793 nl: dump vlan state after link info during resync 3855a8d2fe55 nl: fix vlan table leak and state loss on rebuild 72293c5adf2e nl: clear offloaded flows when a vlan stops forwarding 8a282a294061 nl: keep port state across link messages without protinfo 385d82f1024b device: clean up references to freed devices and bridges effe9fb0f351 flow: fix offload ifindex truncation a429ae138b17 nl: dump all offload filters when updating flow stats 056524b9f39c flow: evict the least active flow when the offload map is full e8d03f033c5d ubus: apply bridge_local_tx regardless of blacklist contents 04b40c1234c4 flow: skip offload for blacklisted or detached devices 582e26c56fc8 nl: fix message leak in bridger_refresh_linkinfo bb2b1f40ba4f nl: remove stale devices and fdb entries during resync cefdf80bcf81 flow: reset the fdb refresh flag on all entries e0dbb73fa96c bridger-bpf: count packets for flows without a target port 43c44960b8ea bridger-bpf: fix off-by-one in skb_ptr bounds check 871ee2e5fd10 bridger-bpf: preserve vlan priority when retagging flows 6b5071cf63a2 device: drop remaining kernel and config state on free 240ce3e86f1b flow: remove the offload filter when a re-added flow stops qualifying 6ef1f9d9c6dd nl: process fdb removal for aged out entries c355096362a2 nl: fix handling of bridge vlan change notifications 1bb2be83ea48 main: fix link failure with ubus support disabled 8b29b5d03c4b flow: fix pending flow handling for existing flows 0bcfb0043645 flow: only evict flows when the offload map is full 7a0d64fcab83 nl: report netlink errors back to the caller 2a2d1261d12e nl: offload on the outermost device of the chain first Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-27 10:43:41 +0100fbbcf2f78ba001471016f8b5ab0c265b532b22eabridger: update to Git HEAD (2026-09-18)editpackage/network/services/bridger/Makefilepackage/network/utils/ethtool/Makefileeeea495767bd378f65093294f7ddb492b3cab3781793094272000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comethtool: update to 7.2 Version 7.2 - Oct 19, 2026 * Feature: support for KSZ87xx PHY tunables (--{get,set}-phy-tunable) * Fix: cmis: fix printing of Tx bias current (-m) * Fix: cmis: fix printing of channel-level flags (-m) * Fix: cmis: fix printing of CDB EPL pages (-m) * Fix: printing of transmitter technology for CMIS transceivers (-m) * Fix: avoid undefined behavior with CMIS transceivers (-m) * Fix: add missing CMIS transmitter technologies (-m) * Fix: printing of attenuation and wavelength (-m) * Fix: printing of link length (-m) * Fix: sfpid: print all implemented options (-m) * Fix: sfpid: print all compliance codes (-m) * Fix: qsfp: print all compliance codes (-m) * Fix: module-eeprom: clamp data length to attribute payload size (-m) * Fix: validate module EEPROM offset and length (-m) * Fix: rss: bound hash function masks in text and JSON output (-x) * Fix: fbnic: fix off-by-one shift in reg dump parser (-d) * Fix: fbnic: Fix various TX and RX CSR fields decoding (-d) * Fix: fbnic: Fix register dump names and bit labels (-d) Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26216 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-27 10:44:32 +0100eeea495767bd378f65093294f7ddb492b3cab378ethtool: update to 7.2editpackage/network/utils/ethtool/Makefilepackage/network/utils/iw/Makefile0104d9e500aebd0344c0a6a24801d80dde1ce4411793094420000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comiw: fix the documentation URL The old wireless.kernel.org URL is redirected to a malformed address on wireless.docs.kernel.org, which returns 404. Point it to the current documentation page. Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26218 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-27 10:47:00 +01000104d9e500aebd0344c0a6a24801d80dde1ce441iw: fix the documentation URLeditpackage/network/utils/iw/Makefilepackage/network/utils/iproute2/patches/200-drop_libbsd_dependency.patchpackage/network/utils/iproute2/patches/150-keep_libcap_optional.patchpackage/network/utils/iproute2/patches/001-1-tc-cake-add-cake_mq-support.patchpackage/network/utils/iproute2/patches/301-fix-UINT_MAX-undeclared-with-build-with-musl-libc.patchpackage/network/utils/iproute2/patches/140-keep_libmnl_optional.patchpackage/network/utils/iproute2/patches/130-no_netem_tipc_man_vdpa.patchpackage/network/utils/iproute2/Makefilepackage/network/utils/iproute2/patches/001-0-Update-kernel-headers.patch6b7ea6896a3a83c9ae80d31e8d35d911e032268f1793094610000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comiproute2: update to 7.3.0 Drop the patches that are included upstream: the kernel headers update, the cake_mq support and the musl UINT_MAX fix. Do not build the new dpll tool, like the other tools that are not packaged, and refresh the remaining patches. Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26217 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-27 10:50:10 +01006b7ea6896a3a83c9ae80d31e8d35d911e032268fiproute2: update to 7.3.0editpackage/network/utils/iproute2/Makefileeditpackage/network/utils/iproute2/patches/130-no_netem_tipc_man_vdpa.patcheditpackage/network/utils/iproute2/patches/150-keep_libcap_optional.patcheditpackage/network/utils/iproute2/patches/200-drop_libbsd_dependency.patchdeletepackage/network/utils/iproute2/patches/001-0-Update-kernel-headers.patchdeletepackage/network/utils/iproute2/patches/001-1-tc-cake-add-cake_mq-support.patchdeletepackage/network/utils/iproute2/patches/301-fix-UINT_MAX-undeclared-with-build-with-musl-libc.patcheditpackage/network/utils/iproute2/patches/140-keep_libmnl_optional.patchtarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/common.ctarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/rtl-otto.h86f43bcb32558f0f33cac03ae9c5b7851ba793341793106513000https://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenmarkus.stockhausen@gmx.derealtek: dsa: unregister the switch during remove and probe unwind The Realtek platform driver calls dsa_switch_shutdown() on removal and when L3 setup fails after DSA registration. Shutdown only disconnects ports for system shutdown; it does not undo dsa_register_switch(). The link-state interrupt requested with request_irq() is also left installed. Track successful IRQ registration and release the interrupt before unregistering the switch, while its port devices still exist. Cancel counter polling on the L3 probe failure path as well as on removal, then use dsa_unregister_switch() before releasing TC state and the workqueue. Signed-off-by: João Silva <jgc3silva@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26228 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> 2026-10-27 14:08:33 +010086f43bcb32558f0f33cac03ae9c5b7851ba79334realtek: dsa: unregister the switch during remove and probe unwindedittarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/rtl-otto.hedittarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/common.cinclude/kernel-build.mkinclude/image.mkinclude/subdir.mktarget/linux/Makefile7cd9ef1f2223541943c1ebb9808a7a637b1738641793119521000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.combuild: add optional DTB schema check target Add target/linux/dtbs_check for manually checking selected OpenWrt DTBs against the patched kernel binding schemas. It runs only when explicitly requested; normal builds do not invoke it. DT_SCHEMA_FILES can limit validation to specific bindings. Link: https://github.com/openwrt/openwrt/pull/26240 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-27 17:45:21 +01007cd9ef1f2223541943c1ebb9808a7a637b173864build: add optional DTB schema check targeteditinclude/subdir.mkeditinclude/kernel-build.mkeditinclude/image.mkedittarget/linux/Makefiletarget/linux/realtek/rtl960x/target.mkdc9ce90354a2733489663c9479084477070f747d1793169716000https://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenmarkus.stockhausen@gmx.derealtek: rtl960x: change to router device type The SoCs in rtl960x subtarget are of router variety so override the device type from basic to router. Signed-off-by: Rustam Adilov <adilov@tutamail.com> Link: https://github.com/openwrt/openwrt/pull/26137 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> 2026-10-28 07:41:56 +0100dc9ce90354a2733489663c9479084477070f747drealtek: rtl960x: change to router device typeedittarget/linux/realtek/rtl960x/target.mktarget/linux/realtek/dts/rtl9607c-vb.dtsitarget/linux/realtek/dts/rtl9607c-va.dtsitarget/linux/realtek/dts/rtl9607_bt-pon_bt-g711ax.dts92b3ad7722ea7c2fe16173b3543eec0f50d2df071793169716000https://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenmarkus.stockhausen@gmx.derealtek: add rtl9607c-vb and rtl9607c-va dtsi files Some devices have the an older revision of RTL9607C/RTL8198D SoC which would require board file to override some compatibles from rtl960x dtsi file, like pcie phy and potentially more in the future. Add the separate rtl9607c-vb and rtl9607c-va dtsi files to handle it instead. Change the bt-g711ax dts file to now include the new rtl9607c-vb dtsi file. Signed-off-by: Rustam Adilov <adilov@tutamail.com> Link: https://github.com/openwrt/openwrt/pull/26137 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> 2026-10-28 07:41:56 +010092b3ad7722ea7c2fe16173b3543eec0f50d2df07realtek: add rtl9607c-vb and rtl9607c-va dtsi filesaddtarget/linux/realtek/dts/rtl9607c-vb.dtsiaddtarget/linux/realtek/dts/rtl9607c-va.dtsiedittarget/linux/realtek/dts/rtl9607_bt-pon_bt-g711ax.dtstarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.c3947b4d959f93478a1e792afae76d55d840189451793172942000https://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenmarkus.stockhausen@gmx.derealtek: pie: rtl930x: validate rules and propagate programming errors The RTL930x PIE writer indexes the template array using unchecked rule and template IDs and reports success even when the table write fails. Rule addition also ignores template-register read errors and the writer's return value. TC can therefore report an offloaded rule that was not installed. Validate rule indices and template selectors before accessing registers, bitmaps or template descriptions. Propagate register, table-acquisition and table-write errors, including writes that clear a rule. Only enable block lookup after successfully writing the rule and return lookup programming errors to the caller. Mark failed software rules invalid but keep their IDs reserved: a failed hardware operation may still have committed and reusing the ID could overwrite an active rule. Signed-off-by: João Silva <jgc3silva@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26227 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> 2026-10-28 08:35:42 +01003947b4d959f93478a1e792afae76d55d84018945realtek: pie: rtl930x: validate rules and propagate programming errorsedittarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.ctarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/rtl-otto.htarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.c1943e280ca7f1426061cb06b3eb5cd6557d3974c1793172942000https://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenmarkus.stockhausen@gmx.derealtek: pie: rtl930x: roll back failed TC rule additions A failed table write may already have installed an active hardware rule. TC discards the failed flow without calling rule removal, so clearing the software valid flag and reserving the ID leaves that rule orphaned. Invalidate the hardware row before returning the original programming error. Allow invalidation without reading the template selector, keeping rollback independent of selector-read failures. If rollback fails, disable and quarantine the entire PIE block until reprobe. Prevent subsequent additions from re-enabling it, including after existing rules release their IDs. Report when block disabling cannot be verified and a reset is required. Validated with partial and delayed write failures, TC failure cleanup, sanitizer checks, MIPS compilation and checkpatch. Signed-off-by: João Silva <jgc3silva@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26227 Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> 2026-10-28 08:35:42 +01001943e280ca7f1426061cb06b3eb5cd6557d3974crealtek: pie: rtl930x: roll back failed TC rule additionsedittarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/pie.cedittarget/linux/realtek/files-6.18/drivers/net/dsa/rtl83xx/rtl-otto.hpackage/network/config/netifd/files/usr/libexec/network/packet-steering.ucpackage/network/config/netifd/Makefilee1dd9894042a7250d96d7fae1f6d6a98060f2d781793178094000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comnetifd: leave receive steering off on hardware RSS devices A device with at least as many receive queues as CPUs and no NAPI threads is steered like a single queue device: the default mode points the RPS mask of every queue at one CPU. qca_edma on qualcommax spreads its flows over four rings by RSS and pins the interrupts of each ring to its own CPU, so this funnels everything the hardware spread back onto CPU0. On a Xiaomi AX3600 with flow offload off, a routed 8-flow TCP download reached 737-790 Mbit/s with CPU0 at 100% softirq and the other CPUs below 10% (6 runs). With RPS off the same download reached 933-941 Mbit/s (3 runs). Leave RPS off on such a device in the default mode when its receive interrupts, the MSI vectors of a PCI device or the GIC interrupts of its device tree node, are pinned to every CPU between them. Interrupts named for transmit completions only are not counted. A device whose receive interrupts land on fewer CPUs is steered as before, as are mode 2 and devices with NAPI threads. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/26222 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 10:01:34 +0100e1dd9894042a7250d96d7fae1f6d6a98060f2d78netifd: leave receive steering off on hardware RSS deviceseditpackage/network/config/netifd/files/usr/libexec/network/packet-steering.uceditpackage/network/config/netifd/Makefilepackage/network/config/netifd/files/usr/libexec/network/packet-steering.uccd6b08f2b5b99c8ac76adc58b77f75fad3bd9d781793178094000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comnetifd: leave receive steering off on RSS Wi-Fi devices mac80211 gives a Wi-Fi netdev one receive queue, also when the driver spreads received frames over several rings by RSS and says so with IEEE80211_HW_USES_RSS. ath11k hashes received frames over four REO rings, and on ipq807x the interrupts of those rings are pinned to separate CPUs, but the default steering mode points the RPS mask of the AP netdev at one CPU, moving the stack work of every received frame back onto it. On a Xiaomi AX3600, a 4-stream TCP upload from a Wi-Fi client to a wired host ran CPU0 at 80-91% with RPS on CPU0 and the other CPUs below 21%. With RPS off no CPU went above 44%, at the same total CPU time and 908-938 Mbit/s against 858-937 Mbit/s (3 runs each). Read the flag from mac80211's hwflags in debugfs and treat such a device like a multi-queue RSS device: RPS stays off when its receive interrupts are spread over every CPU. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/26222 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 10:01:34 +0100cd6b08f2b5b99c8ac76adc58b77f75fad3bd9d78netifd: leave receive steering off on RSS Wi-Fi deviceseditpackage/network/config/netifd/files/usr/libexec/network/packet-steering.ucpackage/network/config/netifd/files/usr/libexec/network/packet-steering.uc8a97b52c3a90266769c63c8efbbf1666f249e5231793178094000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comnetifd: steer receive work away from the interrupt CPUs The default mode picks the RPS CPU of a softirq NAPI device by load alone, without knowing where its interrupts are taken. On a system with one such device the pick is CPU0, which is where its interrupts usually land, so RPS hands the stack work to the CPU that already polls the device. A multi-queue device with every interrupt on one CPU (igb without spread vectors, bcmgenet, ath11k over PCI on qualcommax) and a single queue device on CPU0 run all of their receive work there. On a Xiaomi AX3600 with every qca_edma interrupt moved to CPU0 and flow offload off, a routed 8-flow TCP download reached 625-649 Mbit/s with RPS on CPU0 and CPU0 at 100%. RPS on one other CPU reached 922-940 Mbit/s with that CPU at 97-99%. RPS over the three CPUs without interrupts reached 929-941 Mbit/s with no CPU above 60%, and RPS over all four ran CPU0 at 93-96% (2 runs each). When the receive interrupts of a softirq NAPI device are pinned to some but not all CPUs, point its RPS mask in the default mode at the other CPUs and account the load on both. Devices whose interrupts cannot be read are steered as before. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/26222 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 10:01:34 +01008a97b52c3a90266769c63c8efbbf1666f249e523netifd: steer receive work away from the interrupt CPUseditpackage/network/config/netifd/files/usr/libexec/network/packet-steering.uctarget/linux/qualcommax/ipq807x/base-files/etc/init.d/smp_affinitye54d48c11e6e45bb662339233389c94dabc871431793178094000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: ipq807x: re-run packet steering after pinning the IRQs The packet steering script decides from where the receive interrupts of a device are pinned. smp_affinity pins the ath11k rings at START=93, after packet steering ran at START=25, so steering only sees the spread if an interface event happens to reload it afterwards. Reload packet steering once the interrupts are pinned. Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/26222 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 10:01:34 +0100e54d48c11e6e45bb662339233389c94dabc87143qualcommax: ipq807x: re-run packet steering after pinning the IRQsedittarget/linux/qualcommax/ipq807x/base-files/etc/init.d/smp_affinitypackage/network/services/ustp/Makefilee80838fb2a84cc9537c8540382d7af0e8826c35d1793185014000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.nameustp: update to Git HEAD (2026-10-28) 22cb867fd37e netif_utils: size sysfs path buffers for the longest interface name d13acc7252ab netif_utils: close the port file on a read error dbf456dfe9ad ubus: take the bridge priority from add_bridge 1be05eb1239f config: free the config of removed bridges Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 11:56:54 +0100e80838fb2a84cc9537c8540382d7af0e8826c35dustp: update to Git HEAD (2026-10-28)editpackage/network/services/ustp/Makefilepackage/network/config/netifd/Makefile0747c5b48890e32876eb44659a76473ebc4ae4f51793185019000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namenetifd: update to Git HEAD (2026-10-28) f898a7321f80 system-linux: refuse netns move of an unresolved device b81713f8cac8 interface: defer jailed device move until the device exists c34c90f38db9 interface: drop a pending jail move when the jail config changes e9414e7f8482 bridge: take bridge-vlan configuration as part of the bridge config 05574f61fff5 device: replace config devices that were removed from the config 8cfc2c03959d bridge: apply member vlans from one place ffe88f2ce0f1 system-linux: do not leak the callback in system_bridge_vlan_check() 6d4cac2b6e2f bridge: handle a failed member allocation in bridge_hotplug_add() cdf3e8d097d4 vlandev: keep the old config if copying the new one fails 2ac163481042 vlandev: restart the device when its vid alias changes b1d52c59304e bridge: tie the vlan handling to vlan filtering and configured vlans cfaf6dd3d489 bridge: keep hotplug vlans when the config drops their vlan bba15bc16284 bridge: release hotplug vlans that no member uses any more 967189471692 bridge: create bridge vlans only for tracked hotplug entries 569ff4f7e374 bridge: make a hotplug add set the member's hotplug vlans 4a8597e9adc1 interface: keep the member when the master of a link stays the same 230521b6253d bridge: handle a failed vlan allocation in bridge_hotplug_get_vlan() 9a63cdaf0a0d bridge: keep range vlans when a tracked vlan of the port goes away 70355bfebe6d bridge: accept range vlans of a port in the vlan check 2a4c065b043a bridge: write the bridge's own extra vlans only with vlan filtering 79a5da4bfce5 vlan, vlandev: forward hotplug links only to a bridge that filters vlans f39e5958edb1 vlandev: check hotplug operations on vlan updates 9d3dac944a60 bridge: accept auth vlans of a port in the vlan check 09af141e97f3 bridge: remove all hotplug vlans of a member on hotplug del 9988b0bd897e bridge: group the vlans of a member by source 423123d7135b bridge: track config and hotplug ownership of members 0d37020faeee device: keep the hotplug link on device replacement, iterate all devices 07518dc5ad9c interface: keep an external hotplug device a hotplug main device on reload ed7603dc842a interface: replace a hotplug main device with a newly linked one 976eb74f9fbf extdev: do not announce a topology change for an existing member ab357c2f237e interface: apply stored hotplug links again after config and device changes 13002e858a70 device, bridge: add the bridge and bridge_vlan device options 5f7a462bcbcb bridge: keep the default vlan 1 without bridge-vlan sections b85814b0ee17 bridge: keep auth vlans when ranges or vlans of a port are removed 58768be7bf62 system-linux: check the allocations in system_bridge_vlan_check() c9041c7fa7b4 system-linux: apply the state of system_if_check() after the exchange 3443837ab8cd system-linux: read the link state again on a link event 721103dbeafb system-dummy: log the bridge operations f077e15544ca bridge: add the bridge-vlan option local_pvid 7ed52d1e649f bridge: make a kept dynamic vlan a tagged vlan of the bridge 866dffb41cac ubus: walk a copy of procd's data in netifd_ubus_data_cb() 8da363f546f5 main: end a helper with the netifd that started it b359355f3349 proto-ext: remove the host route when the interface goes down 80e17d8b74aa build: generate ethtool-modes.h in an out-of-tree build edfe9877ee7d main: end the helpers with SIGTERM when netifd exits 48e4f695773c bridge: move the vlan setup of the bridge and of a port into helpers d7d270a5a9a1 bridge: apply a change of vlan_filtering to the running bridge 86d56ad76c67 config: add a procd network-device entry in the pass of its type 2fec6e82409b config: add a procd network-device entry without its uci section first 06fc90458560 device: add a board.json default for the pse option 1816971a93c3 main: only use prctl() on linux 13c7e63045ef device: add IPv6 NDP tunable device options 19d2392ff5bb bridge: add per-VLAN multicast snooping add2e9e7a29e device: add ARP and per-family neighbour options 8a268294c8eb system-linux: empty the event queue before the link dump e4b847c71b50 main: wait for the helpers before exiting bf7f2afae02a vlandev, macvlan: delete a stale device before creating it 2922ee823259 main: start no helper while netifd waits for its exit 7d1555e10a6a vrf: delete a stale device before creating it 20be6d5c7908 bridge: pass the bridge priority to the userspace STP daemon ade072a34c93 bridge: use a valid bridge priority as default a1e39a458f96 bridge: ignore a bridge priority above 65535 Fixes: https://github.com/openwrt/openwrt/issues/22905 Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 11:56:59 +01000747c5b48890e32876eb44659a76473ebc4ae4f5netifd: update to Git HEAD (2026-10-28)editpackage/network/config/netifd/Makefiletarget/linux/bcm53xx/patches-6.18/348-v7.4-PCI-Expose-devm_pci_alloc_host_bridge_release.patchtarget/linux/bcm53xx/patches-6.18/351-v7.4-PCI-iproc-Use-the-EROM-outbound-window-on-BCMA.patchtarget/linux/bcm53xx/patches-6.18/351-PCI-iproc-Use-the-EROM-outbound-window-on-BCMA.patch79aba5e09246e52081935700b003167e9540ba631793189795000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.combcm53xx: backport the mainline PCIe EROM window fix The fix carried as 351 since a36ed219f2 was reworked upstream and merged for Linux v7.4. Replace it with the two mainline commits: 39d1c645bb99 ("PCI: Expose devm_pci_alloc_host_bridge_release()") 9850907ee1dd ("PCI: iproc: Use the EROM outbound window on BCMA") The first one adds a helper the second one uses, so it goes in as 348. Like the old 351, the upstream version requests only the memory window the enumeration ROM reports. When the DT window differs from it, the driver now prints a warning, where the old 351 dropped it silently. The dts (349) carries the addresses of PCIe core revision 0x07, so boards with revision 0x01 now log "does not match EROM window" for controllers 1 and 2. The window in use is the same as before. Tested on an ASUS RT-N18U (BCM47081, core revision 0x01): the BCM4360 on bcma0:7 is found and its link comes up, and /proc/iomem and the PCI device list match the old 351. Signed-off-by: Semih Baskan <strst.gs@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26237 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 13:16:35 +010079aba5e09246e52081935700b003167e9540ba63bcm53xx: backport the mainline PCIe EROM window fixaddtarget/linux/bcm53xx/patches-6.18/351-v7.4-PCI-iproc-Use-the-EROM-outbound-window-on-BCMA.patchdeletetarget/linux/bcm53xx/patches-6.18/351-PCI-iproc-Use-the-EROM-outbound-window-on-BCMA.patchaddtarget/linux/bcm53xx/patches-6.18/348-v7.4-PCI-Expose-devm_pci_alloc_host_bridge_release.patchtarget/linux/generic/pending-6.18/835-03-leds-trigger-netdev-fix-sysfs-update-group-races.patchtarget/linux/generic/pending-6.18/835-05-leds-trigger-netdev-serialize-mode-interval-stores-with-trigger-lock.patchtarget/linux/generic/pending-6.18/835-01-leds-trigger-netdev-put-netdev-on-activate-error-path.patchtarget/linux/generic/pending-6.18/835-04-leds-trigger-netdev-report-invalid-interval-to-user-space.patchtarget/linux/generic/pending-6.18/835-02-leds-trigger-netdev-access-net-dev-under-trigger-data-lock-in-the-worker.patche9c8d91f6dd1db454af504412fc6050cedbc454b1793191895000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comgeneric: 6.18: add pending netdev LED trigger race fixes Import pending Alexander Sverdlin's v6 series [1] to fix races between netdev trigger activation and link-speed sysfs updates. The race can cause duplicate link_10 entries during boot and leave orphaned sysfs files. Adapt the link-speed and mode-store hunks to the attributes and bit operations present in 6.18.55. [1] https://lore.kernel.org/linux-leds/20261027113349.383147-1-alexander.sverdlin@siemens.com/ Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 13:51:35 +0100e9c8d91f6dd1db454af504412fc6050cedbc454bgeneric: 6.18: add pending netdev LED trigger race fixesaddtarget/linux/generic/pending-6.18/835-05-leds-trigger-netdev-serialize-mode-interval-stores-with-trigger-lock.patchaddtarget/linux/generic/pending-6.18/835-04-leds-trigger-netdev-report-invalid-interval-to-user-space.patchaddtarget/linux/generic/pending-6.18/835-01-leds-trigger-netdev-put-netdev-on-activate-error-path.patchaddtarget/linux/generic/pending-6.18/835-02-leds-trigger-netdev-access-net-dev-under-trigger-data-lock-in-the-worker.patchaddtarget/linux/generic/pending-6.18/835-03-leds-trigger-netdev-fix-sysfs-update-group-races.patchpackage/network/services/ppp/files/50-ppp-radius-servers-mode.shpackage/network/services/ppp/files/pppd.capabilitiespackage/network/services/ppp/files/ppp.shpackage/network/services/ppp/files/50-ppp-secrets-mode.shpackage/network/services/ppp/Makefilepackage/network/services/ppp/files/pppd_acl.jsonb855f33ea91674c5858dd5c12ed108dac4d386011793192222000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comppp: run pppd in ujail as an unprivileged user pppd drops to user ppp (uid 454, created via USERID) with CAP_NET_ADMIN (/dev/ppp, PPPIOCNEWUNIT, SIOCSIF*) and CAP_NET_RAW (pppoe PF_PACKET), both ambient so ip-up/ip-down scripts keep them, with PR_SET_NO_NEW_PRIVS. The wrapper covers every proto that routes through ppp_generic_setup() and is skipped when /sbin/ujail, the capabilities file or the ppp user is missing. ujail exits EXIT_FAILURE on a -U name it cannot resolve, and a sysupgrade can preserve an /etc/passwd that predates the uid. pppd's euid != 0 gate (EXIT_NOT_ROOT) would stop the drop. ppp 2.5.4 lets pppd run without root when it holds CAP_NET_ADMIN (ppp-project/ppp#608) and grants the privileged option flag on the capability, which proto_pppoe_setup() needs for its OPT_PRIV "plugin pppoe.so", unless the exec itself raised the privileges (AT_SECURE). The wrapper also hands /dev/ppp to the ppp user. The node is opened at link setup (generic_establish_ppp), not only in the (stubbed) kernel support check, and ships 0600 root:root. chown keeps it reachable for uid 454 alone; the kernel's ppp_open() gates on ns_capable(CAP_NET_ADMIN) either way. pppd mkdir_recursive()s PPP_PATH_VARRUN and writes its <ifname>.pid and pppd2.tdb there, which is /var/run/pppd with OpenWrt's --localstatedir=/var; nothing in this package creates that directory today, and uid 454 cannot do it in a root-owned /var/run, so the wrapper pre-creates and chowns it. A failure to write the pid file is a logged error and a failed tdb open a warning (multilink drops), neither fatal. usepeerdns makes pppd rewrite /etc/ppp/resolv.conf, the package's symlink to /tmp/resolv.conf.ppp, at every connect; a copy left by a root-run instance across an in-place upgrade refuses uid 454, so the wrapper removes it first. Nothing in OpenWrt reads that file, the DNS servers reach netifd through the DNS1/DNS2 environment. The ip-up/ip-down scripts run inside the jail and report back to netifd over ubus; ubusd's ACL default is deny for every non-root uid, so the jailed notify_proto call failed silently and the interface never completed setup while the PPP session sat connected. Ship /usr/share/acl.d/pppd.json granting uid 454 access to network.interface notify_proto and network add_dynamic (ppp6-up's dynamic-interface registry call). The postinst reloads the ubusd ACLs, so an upgrade on a running router does not leave the interface down. User hooks in /etc/ppp/ip-up.d and ip-down.d run the same way, as uid 454 with CAP_NET_ADMIN and CAP_NET_RAW only; a hook that needs root no longer gets it. Two things the unprivileged uid cannot reach on its own. A serial link is handed its TTY as a pppd argument - first by proto_ppp_setup, last by comgt's proto_3g_setup - and a TTY is root:dialout 0660, which CAP_NET_ADMIN does not override, so the wrapper grants whichever argument is a character device, the same way it already grants /dev/ppp. And the secrets pppd authenticates from ship 0600 root:root - chap-secrets here, the RADIUS server list in ppp-mod-radius - so a uci-defaults script regrades them to 0640 root:ppp. That has to run on the device: a postinst runs on the build host with IPKG_INSTROOT set, where chgrp resolves the group name through the host's /etc/group and not the target's, so the image would ship them root:root regardless. Assisted-by: Claude:claude-opus-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Link: https://github.com/openwrt/openwrt/pull/25537 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 13:57:02 +0100b855f33ea91674c5858dd5c12ed108dac4d38601ppp: run pppd in ujail as an unprivileged useraddpackage/network/services/ppp/files/50-ppp-radius-servers-mode.shaddpackage/network/services/ppp/files/pppd.capabilitieseditpackage/network/services/ppp/Makefileaddpackage/network/services/ppp/files/50-ppp-secrets-mode.sheditpackage/network/services/ppp/files/ppp.shaddpackage/network/services/ppp/files/pppd_acl.jsonpackage/system/rpcd/Makefile8ac5e0118cfab77d0978a1ce523ec420629c8a1f1793192606000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comrpcd: update to Git HEAD (2026-10-28) 469d7852316e session: enforce session ACLs for non-root ubus callers Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 14:03:26 +01008ac5e0118cfab77d0978a1ce523ec420629c8a1frpcd: update to Git HEAD (2026-10-28)editpackage/system/rpcd/Makefilepackage/system/ubus/Makefilef79894ab5720ed505ef40e3d99fab1c87baa00361793192606000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comubus: update to Git HEAD (2026-10-28) db20eff5535f libubus: add a pre-invoke callback for resolved object methods Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 14:03:26 +0100f79894ab5720ed505ef40e3d99fab1c87baa0036ubus: update to Git HEAD (2026-10-28)editpackage/system/ubus/Makefiletarget/linux/qualcommax/patches-6.18/0084-03-Align-CMN-PLL-inputs-with-binding.patchtarget/linux/qualcommax/patches-6.18/0123-arm64-dts-ipq8074-add-cooling-cells-to-CPU-nodes.patchtarget/linux/qualcommax/patches-6.18/0130-arm64-dts-qcom-ipq8074-add-CPU-OPP-table.patchtarget/linux/qualcommax/patches-6.18/0121-arm64-dts-ipq8074-Add-WLAN-node.patchtarget/linux/qualcommax/patches-6.18/0120-arm64-dts-qcom-ipq8074-add-secure-WCSS-remoteproc.patchtarget/linux/qualcommax/patches-6.18/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patchtarget/linux/qualcommax/patches-6.18/0902-arm64-dts-ipq8074-add-label-to-clocks.patchtarget/linux/qualcommax/patches-6.18/0084-02-Allow-CMN-PLL-bias-clocks.patchtarget/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-ess.dtsitarget/linux/qualcommax/patches-6.18/0147-arm64-dts-qcom-ipq8074-add-uniphy-clocks-to-gcc.patchtarget/linux/qualcommax/patches-6.18/0145-arm64-dts-qcom-ipq8074-move-DR-mode-to-board-DTS.patchtarget/linux/qualcommax/patches-6.18/0122-arm64-dts-ipq8074-add-CPU-clock.patchtarget/linux/qualcommax/patches-6.18/0084-04-Add-IPQ8074-CMN-PLL.patchtarget/linux/qualcommax/patches-6.18/0084-01-Correct-IPQ8074-NSS-NoC-rate.patchtarget/linux/qualcommax/patches-6.18/0129-arm64-dts-qcom-ipq8074-add-QFPROM-fuses.patchtarget/linux/qualcommax/patches-6.18/0146-arm64-dts-qcom-ipq8074-Flatten-usb-controller-nodes.patch4835f60a6d7e28db3e87b17857e1a394f86627451793194038000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqualcommax: ipq8074: add pending CMN PLL clock updates Import the pending v2 CMN PLL series [1]. its been reviewed and is pending merge upstream. It corrects the NSS NoC output rate, describes the two GCC inputs, resolves them through device tree references, and adds the CMN PLL to the SoC DTSI. Remove the duplicate ESS overlay node. Refresh the later IPQ8074 DTS patches for the new node and GCC clock list, and extend the GCC binding for the target's UNIPHY clock inputs.s [1] https://patchwork.kernel.org/series/1193706/ Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 14:27:18 +01004835f60a6d7e28db3e87b17857e1a394f8662745qualcommax: ipq8074: add pending CMN PLL clock updatesedittarget/linux/qualcommax/patches-6.18/0129-arm64-dts-qcom-ipq8074-add-QFPROM-fuses.patchedittarget/linux/qualcommax/patches-6.18/0146-arm64-dts-qcom-ipq8074-Flatten-usb-controller-nodes.patchedittarget/linux/qualcommax/patches-6.18/0147-arm64-dts-qcom-ipq8074-add-uniphy-clocks-to-gcc.patchaddtarget/linux/qualcommax/patches-6.18/0084-02-Allow-CMN-PLL-bias-clocks.patchedittarget/linux/qualcommax/patches-6.18/0120-arm64-dts-qcom-ipq8074-add-secure-WCSS-remoteproc.patchedittarget/linux/qualcommax/patches-6.18/0121-arm64-dts-ipq8074-Add-WLAN-node.patchedittarget/linux/qualcommax/patches-6.18/0122-arm64-dts-ipq8074-add-CPU-clock.patchedittarget/linux/qualcommax/patches-6.18/0123-arm64-dts-ipq8074-add-cooling-cells-to-CPU-nodes.patchaddtarget/linux/qualcommax/patches-6.18/0084-04-Add-IPQ8074-CMN-PLL.patchedittarget/linux/qualcommax/patches-6.18/0102-arm64-dts-ipq8074-add-reserved-memory-nodes.patchedittarget/linux/qualcommax/patches-6.18/0145-arm64-dts-qcom-ipq8074-move-DR-mode-to-board-DTS.patchaddtarget/linux/qualcommax/patches-6.18/0084-03-Align-CMN-PLL-inputs-with-binding.patchedittarget/linux/qualcommax/patches-6.18/0130-arm64-dts-qcom-ipq8074-add-CPU-OPP-table.patchaddtarget/linux/qualcommax/patches-6.18/0084-01-Correct-IPQ8074-NSS-NoC-rate.patchedittarget/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8074-ess.dtsiedittarget/linux/qualcommax/patches-6.18/0902-arm64-dts-ipq8074-add-label-to-clocks.patchtarget/linux/mediatek/mt7622/base-files/lib/preinit/04_set_netdev_labeltarget/linux/microchipsw/lan969x/base-files/lib/preinit/04_set_netdev_labeltarget/linux/airoha/base-files/lib/preinit/04_set_netdev_labeltarget/linux/qualcommax/ipq50xx/base-files/lib/preinit/04_set_netdev_labeltarget/linux/ramips/mt7621/base-files/lib/preinit/04_set_netdev_labelde3a3f7132b801b845e03ef533fe546b3c7a853c1793194457000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comtreewide: handle name collisions in set_netdev_labels The 04_set_netdev_label preinit scripts (airoha, mediatek/mt7622, microchipsw/lan969x, qualcommax/ipq50xx, ramips/mt7621) rename interfaces with a plain "ip link set <netdev> name <label>". The kernel refuses to rename an interface to a name that is already in use (-EEXIST), and the scripts neither check the result nor log a failure, so the rename silently does not happen. This breaks whenever the requested name is currently held by another interface, most notably when two interfaces have to swap names, e.g. because their probe order is not deterministic. Swapping them needs an intermediate name, as each rename asks for the name the other interface still holds. Rename in two phases instead: 1. park: move every interface that needs a new name to a temporary name ("tmp%d"), which the kernel expands to the lowest free "tmpN" 2. rename: give each parked interface its final name After the first phase none of the affected interfaces holds its old name any more, so the target names are free in the second phase and the result no longer depends on the order in which /sys/class/net is walked. Interfaces that already have the requested name are left alone, so nothing changes (and nothing shows up in the boot log) when the names are already correct. An interface that has to be renamed now takes two renames instead of one. The label is read again in the second phase, which works because the of_node of an interface follows it across renames. Letting the kernel pick the temporary name means it cannot collide with an existing interface and always fits in IFNAMSIZ, regardless of the label length. This does not help if the requested name is held by an interface that has no label of its own, as there is nobody to move it out of the way. Where a script handles both "label" and "openwrt,netdev-name", the latter takes precedence, as before, but both are now evaluated in a single pass over /sys/class/net. The filogic target is not changed here. Its set_netdev_labels loop calls netdev_name_set from /lib/functions/netdev-name.sh, which is shared with the preinit_netdev event handler that renames one interface at a time. Making it two-phase needs a change to that shared helper and is left for a separate patch. Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com> Link: https://github.com/openwrt/openwrt/pull/25460 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 14:34:17 +0100de3a3f7132b801b845e03ef533fe546b3c7a853ctreewide: handle name collisions in set_netdev_labelsedittarget/linux/microchipsw/lan969x/base-files/lib/preinit/04_set_netdev_labeledittarget/linux/airoha/base-files/lib/preinit/04_set_netdev_labeledittarget/linux/qualcommax/ipq50xx/base-files/lib/preinit/04_set_netdev_labeledittarget/linux/mediatek/mt7622/base-files/lib/preinit/04_set_netdev_labeledittarget/linux/ramips/mt7621/base-files/lib/preinit/04_set_netdev_labelpackage/network/services/odhcpd/Makefile36af490dc8356bfc91d9c9b970952ce86ba856331793194634000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comodhcpd: update to Git HEAD (2026-10-28) 5f5f900a7177 main: allow running as a non-root user Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 14:37:14 +010036af490dc8356bfc91d9c9b970952ce86ba85633odhcpd: update to Git HEAD (2026-10-28)editpackage/network/services/odhcpd/Makefiletarget/linux/ath79/dts/qca9561_tplink_eap225-wall-v2.dts017459e6ff24ea1cedcb642d4583e125c9b756071793196204000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comath79: tplink_eap225-wall-v2: use generic calibration variant The qcom,ath10k-calibration-variant property has been deprecated in favor of the generic qcom,calibration-variant property, which is common to all Qualcomm Atheros WiFi bindings. Switch to the undeprecated property. Signed-off-by: Hernán Lorenzo <lorenzofh@gmail.com> 2026-10-28 15:03:24 +0100017459e6ff24ea1cedcb642d4583e125c9b75607ath79: tplink_eap225-wall-v2: use generic calibration variantedittarget/linux/ath79/dts/qca9561_tplink_eap225-wall-v2.dtspackage/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patchpackage/kernel/mac80211/patches/subsys/011-wifi-mac80211-drop-encap-offload-frames-with-a-taint.patchpackage/kernel/mac80211/patches/subsys/009-wifi-mac80211-fix-key-selection-for-encap-offload-fr.patchpackage/kernel/mac80211/patches/subsys/012-mac80211-tx-Use-info-flags-in-ieee80211_tx_h_select_.patchpackage/kernel/mac80211/patches/subsys/321-wifi-mac80211-add-ieee80211_txq_aql_pending.patchpackage/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patchpackage/kernel/mac80211/patches/subsys/396-wifi-mac80211-use-link-address-as-TA-for-non-MLO-4-a.patchpackage/kernel/mac80211/patches/subsys/008-wifi-mac80211-fix-unauthorised-port-check-for-encap-.patchpackage/kernel/mac80211/patches/subsys/397-wifi-mac80211-use-the-AP-address-as-RA-for-a-4-addr-.patchpackage/kernel/mac80211/patches/subsys/392-wifi-mac80211-fix-station-lookup-for-management-fram.patchpackage/kernel/mac80211/patches/subsys/010-wifi-mac80211-don-t-send-encap-offload-frames-unencr.patch87ba6ac8984f7421a8b8a331e767f1b288d759c91793198779000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: backport the encap offload TX fixes For an 802.3 encap offload frame, ieee80211_tx_dequeue() and ieee80211_tx_h_select_key() read the Ethernet header as an 802.11 header. The unauthorised port check then depends on bits of the destination address, so frames that a station's TXQ holds when the station loses its AUTHORIZED flag still go out, also after its Disassociation. Key selection does not drop a frame of a station that uses encryption but has no key, and does not drop a frame with a tainted key. Backport the upstream series that fixes this: - d59b9bf7df49 ("wifi: mac80211: fix unauthorised port check for encap offload") - 0e80db08668b ("wifi: mac80211: fix key selection for encap offload frames") - a48daf145fed ("wifi: mac80211: don't send encap offload frames unencrypted") - c8ddbe1e8c43 ("wifi: mac80211: drop encap offload frames with a tainted key") - 5f2530a4df8e ("mac80211: tx: Use info->flags in ieee80211_tx_h_select_key()") 5f2530a4df8e corrects the flag field that 0e80db08668b tests; without it, encap offload frames take the 802.11 key selection path. Refresh the patches whose hunks moved. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:19 +000087ba6ac8984f7421a8b8a331e767f1b288d759c9mac80211: backport the encap offload TX fixeseditpackage/kernel/mac80211/patches/subsys/396-wifi-mac80211-use-link-address-as-TA-for-non-MLO-4-a.patcheditpackage/kernel/mac80211/patches/subsys/392-wifi-mac80211-fix-station-lookup-for-management-fram.patchaddpackage/kernel/mac80211/patches/subsys/009-wifi-mac80211-fix-key-selection-for-encap-offload-fr.patchaddpackage/kernel/mac80211/patches/subsys/012-mac80211-tx-Use-info-flags-in-ieee80211_tx_h_select_.patchaddpackage/kernel/mac80211/patches/subsys/010-wifi-mac80211-don-t-send-encap-offload-frames-unencr.patcheditpackage/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patchaddpackage/kernel/mac80211/patches/subsys/008-wifi-mac80211-fix-unauthorised-port-check-for-encap-.patcheditpackage/kernel/mac80211/patches/subsys/397-wifi-mac80211-use-the-AP-address-as-RA-for-a-4-addr-.patcheditpackage/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patchaddpackage/kernel/mac80211/patches/subsys/011-wifi-mac80211-drop-encap-offload-frames-with-a-taint.patcheditpackage/kernel/mac80211/patches/subsys/321-wifi-mac80211-add-ieee80211_txq_aql_pending.patchpackage/kernel/mac80211/patches/subsys/013-wifi-add-the-nl80211-and-hwsim-UAPI-numbers-of-wirel.patchpackage/network/services/hostapd/patches/014-nl80211-Add-the-command-and-attribute-numbers-of-wir.patch257c0f6bd5683b9b272c89bc25ad39ba15425cc81793198779000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211, hostapd: add the nl80211 UAPI numbers of wireless-next Later patches of both packages add nl80211 commands, attributes and extended features, and mac80211_hwsim attributes. Upstream added entries at the same places since the 7.2 release, for example NL80211_CMD_UPDATE_BEACON and HWSIM_ATTR_NO_MONITOR. Add the commands, attributes and extended features of wireless-next commit 2c50cd5d10e8 to the nl80211 header of both packages, and HWSIM_ATTR_NO_MONITOR to the hwsim header, so that the local additions take the numbers after the upstream ones. Other changes of the upstream header are left out, since the 7.2 code depends on them, for example on the number of station flags. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:19 +0000257c0f6bd5683b9b272c89bc25ad39ba15425cc8mac80211, hostapd: add the nl80211 UAPI numbers of wireless-nextaddpackage/network/services/hostapd/patches/014-nl80211-Add-the-command-and-attribute-numbers-of-wir.patchaddpackage/kernel/mac80211/patches/subsys/013-wifi-add-the-nl80211-and-hwsim-UAPI-numbers-of-wirel.patchpackage/kernel/mac80211/patches/subsys/423-wifi-mac80211-count-the-DTIM-of-each-AP-link.patchdafcf8122bfa807908fbba18bbee04d25a5d96491793198779000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: count the DTIM of each AP link All links of an AP MLD counted the DTIM in one counter, so with ieee80211_beacon_get() the DTIM Count in the Beacon frames of a link did not follow the TBTTs of that link. Add patch 423, which keeps the count per link. The debugfs file dtim_count moves to the link directory of an AP MLD and stays in the netdev directory of an AP without links. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:19 +0000dafcf8122bfa807908fbba18bbee04d25a5d9649mac80211: count the DTIM of each AP linkaddpackage/kernel/mac80211/patches/subsys/423-wifi-mac80211-count-the-DTIM-of-each-AP-link.patchpackage/kernel/mac80211/patches/subsys/425-wifi-mac80211-clear-the-Critical-Update-flag-after-t.patchpackage/kernel/mac80211/patches/subsys/424-wifi-nl80211-report-the-end-of-a-critical-update-on-.patch6b4c37295afca87bf59c7ec5423f69b2745633aa1793198779000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: end the Critical Update flag after the DTIM Beacon IEEE 802.11be-2024 35.3.10 sets the Critical Update flag until and including the next DTIM Beacon on the link. hostapd does not see the DTIM Count, so it cannot end the flag there. Patch 424 adds NL80211_EXT_FEATURE_BEACON_CRIT_UPDATE, the attribute NL80211_ATTR_CRIT_UPDATE_ID and the per-link event NL80211_CMD_CRIT_UPDATE_DONE. User space gives each critical update an ID in the beacon of START_AP and SET_BEACON, and the event carries the ID of the update it ends, so that the event of an earlier update cannot end a later one. A new ID starts an update also after the previous one has ended. Patch 425 ends the flag after the DTIM Beacon: mac80211 does it for Beacon frames from ieee80211_beacon_get(), and a driver with a beacon template reports it with ieee80211_crit_update_done(), which takes the ID that ieee80211_beacon_get_template() returns in ieee80211_mutable_offsets. Each beacon holds the ID of its critical update, so that a Beacon frame from a beacon that an update replaces meanwhile neither ends nor clears the flag of the new update. mac80211 does not track the flag of a nontransmitted BSSID. cfg80211_beacon_dup() copies the ID, so that the beacon after a channel switch or a colour change keeps the ID that user space gave for it. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:19 +00006b4c37295afca87bf59c7ec5423f69b2745633aamac80211: end the Critical Update flag after the DTIM Beaconaddpackage/kernel/mac80211/patches/subsys/425-wifi-mac80211-clear-the-Critical-Update-flag-after-t.patchaddpackage/kernel/mac80211/patches/subsys/424-wifi-nl80211-report-the-end-of-a-critical-update-on-.patchpackage/network/services/hostapd/patches/815-ap-learn-the-obss-colors-from-received-beacons.patchpackage/network/services/hostapd/patches/781-hostapd-clear-the-qos-map-with-an-empty-SET_QOS_MAP_SET.patchpackage/network/services/hostapd/patches/761-shared_das_port.patchpackage/network/services/hostapd/patches/814-ap-mld-keep-the-nl80211-bss-of-a-restarted-first-link.patchpackage/network/services/hostapd/patches/809-AP-process-OBSS-Beacon-frames-on-the-link-and-radio-of-their-channel.patchpackage/network/services/hostapd/patches/810-ap-mld-move-the-shared-authenticator-to-the-new-first-link.patchpackage/network/services/hostapd/patches/812-ap-mld-run-eap-of-a-non-mlo-station-on-its-own-link.patchpackage/network/services/hostapd/patches/813-ap-mld-initialise-the-shared-authenticator-of-the-first-link-once.patchpackage/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patchpackage/network/services/hostapd/patches/740-snoop_iface.patchpackage/network/services/hostapd/patches/608-AP-MLD-end-the-Critical-Update-flag-at-the-DTIM-Beac.patchpackage/network/services/hostapd/patches/720-iface_max_num_sta.patchpackage/network/services/hostapd/patches/701-reload_config_inline.patch38aad4a0d8b99aa49261b737e19834980c3a42ad1793198779000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: end the Critical Update flag of a link removal at the DTIM Beacon Patch 602 sets the Critical Update flag of a link removal for DTIM period plus one counts of the AP Removal Timer, since hostapd does not see the TBTT at which the DTIM Beacon goes out. Add patch 608, which keeps the flag on each link until NL80211_CMD_CRIT_UPDATE_DONE where the driver declares NL80211_EXT_FEATURE_BEACON_CRIT_UPDATE. Each critical update gets a new NL80211_ATTR_CRIT_UPDATE_ID, the AP Removal Timer updates continue it with the same ID, and an event with another ID is ignored. A nontransmitted BSSID keeps the count of patch 602. The patches after 608 are refreshed for the new line numbers. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:19 +000038aad4a0d8b99aa49261b737e19834980c3a42adhostapd: end the Critical Update flag of a link removal at the DTIM Beaconeditpackage/network/services/hostapd/patches/810-ap-mld-move-the-shared-authenticator-to-the-new-first-link.patchaddpackage/network/services/hostapd/patches/608-AP-MLD-end-the-Critical-Update-flag-at-the-DTIM-Beac.patcheditpackage/network/services/hostapd/patches/720-iface_max_num_sta.patcheditpackage/network/services/hostapd/patches/814-ap-mld-keep-the-nl80211-bss-of-a-restarted-first-link.patcheditpackage/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patcheditpackage/network/services/hostapd/patches/812-ap-mld-run-eap-of-a-non-mlo-station-on-its-own-link.patcheditpackage/network/services/hostapd/patches/701-reload_config_inline.patcheditpackage/network/services/hostapd/patches/740-snoop_iface.patcheditpackage/network/services/hostapd/patches/781-hostapd-clear-the-qos-map-with-an-empty-SET_QOS_MAP_SET.patcheditpackage/network/services/hostapd/patches/809-AP-process-OBSS-Beacon-frames-on-the-link-and-radio-of-their-channel.patcheditpackage/network/services/hostapd/patches/813-ap-mld-initialise-the-shared-authenticator-of-the-first-link-once.patcheditpackage/network/services/hostapd/patches/761-shared_das_port.patcheditpackage/network/services/hostapd/patches/815-ap-learn-the-obss-colors-from-received-beacons.patchpackage/kernel/mac80211/patches/subsys/426-wifi-nl80211-add-the-advertised-TID-to-link-mapping-.patchpackage/kernel/mac80211/patches/subsys/427-wifi-mac80211-pass-the-advertised-TID-to-link-mappin.patchc8f1f84c063647fafa7160926415becf514942931793198779000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: add the advertised TID-to-link mapping of an AP MLD An AP MLD disables a link for all associated non-AP MLDs with an advertised TID-to-link mapping (IEEE 802.11be-2024 35.3.7.2.4). cfg80211 handles the negotiated mapping of a station only. Patch 426 adds NL80211_CMD_ADV_TTLM_REQUEST, with which user space requests a mapping of all TIDs to a set of links for a duration, the events of its steps and NL80211_EXT_FEATURE_AP_ADV_TTLM, which needs NL80211_EXT_FEATURE_BEACON_CRIT_UPDATE as well. cfg80211 keeps one mapping per AP MLD: the reply and every event carry the cookie of the request, a request while a mapping is active fails with -EBUSY, and the stop of any link of the AP MLD cancels the mapping in the driver and sends ADV_TTLM_ENDED, after which no event of the mapping follows. Each link of the mapping must beacon, the default mapping is refused, and the switch time is 1 to 65535 TUs. STARTED and ESTABLISHED carry the CLOCK_BOOTTIME of the TBTT of each step, so that user space can count the Expected Duration from the TBTT. The driver keeps the Expected Duration field of the element in its beacon template current. Patch 427 passes the request and the cancel to the driver, and its events with their cookie to user space. A driver whose device cannot stop a mapping refuses new requests with -EBUSY until the mapping of the device ends. A driver that gets its Beacon frames from mac80211 sets the Expected Duration with ieee80211_adv_ttlm_duration_set(), and mac80211 writes the field before it protects the frame. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:19 +0000c8f1f84c063647fafa7160926415becf51494293mac80211: add the advertised TID-to-link mapping of an AP MLDaddpackage/kernel/mac80211/patches/subsys/426-wifi-nl80211-add-the-advertised-TID-to-link-mapping-.patchaddpackage/kernel/mac80211/patches/subsys/427-wifi-mac80211-pass-the-advertised-TID-to-link-mappin.patchpackage/network/services/hostapd/src/src/ap/ubus.hpackage/network/services/hostapd/src/src/ap/ubus.cpackage/network/services/hostapd/patches/815-ap-learn-the-obss-colors-from-received-beacons.patchpackage/network/services/hostapd/patches/781-hostapd-clear-the-qos-map-with-an-empty-SET_QOS_MAP_SET.patchpackage/network/services/hostapd/patches/761-shared_das_port.patchpackage/network/services/hostapd/patches/814-ap-mld-keep-the-nl80211-bss-of-a-restarted-first-link.patchpackage/network/services/hostapd/patches/809-AP-process-OBSS-Beacon-frames-on-the-link-and-radio-of-their-channel.patchpackage/network/services/hostapd/patches/819-ap-mld-refuse-an-association-while-a-link-is-not-started.patchpackage/network/services/hostapd/patches/810-ap-mld-move-the-shared-authenticator-to-the-new-first-link.patchpackage/network/services/hostapd/patches/762-AP-don-t-ignore-probe-requests-with-invalid-DSSS-par.patchpackage/network/services/hostapd/patches/813-ap-mld-initialise-the-shared-authenticator-of-the-first-link-once.patchpackage/network/services/hostapd/patches/812-ap-mld-run-eap-of-a-non-mlo-station-on-its-own-link.patchpackage/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patchpackage/network/services/hostapd/patches/609-AP-MLD-advertise-a-TID-to-link-mapping.patchpackage/network/services/hostapd/patches/740-snoop_iface.patchpackage/network/services/hostapd/patches/720-iface_max_num_sta.patchpackage/network/services/hostapd/patches/701-reload_config_inline.patche1ef289cfbacb79b2844cf28b470a22a578b0b911793198779000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: advertise a TID-to-link mapping of an AP MLD hostapd adds a TID-To-Link Mapping element only with CONFIG_TESTING_OPTIONS, without the Mapping Switch Time and Expected Duration fields of an advertised mapping (IEEE 802.11be-2024 35.3.7.2.4). Add patch 609, which requests the mapping from a driver with NL80211_EXT_FEATURE_AP_ADV_TTLM and NL80211_EXT_FEATURE_BEACON_CRIT_UPDATE and builds the element of each step: - the Mapping Switch Time of each link until the mapping is established, in Beacon and Probe Response frames only; - the remaining Expected Duration after it, counted from the TBTT of the frame (9.4.2.324) with the TBTT times of the driver events; - the Disabled Link Indication of the Reduced Neighbor Report. A link that becomes disabled or enabled through the mapping sets the Critical Update flag (35.3.10). The BSS Parameters Change Count stays, as 9.4.2.169.2 increments it only for the critical updates of 11.2.3.14. Without a given switch time, the mapping is established two DTIM intervals after the request. A switch time is at most 65535 TUs. Events are matched by the cookie of the request. The stop of a link ends the mapping, a link removal is refused while a mapping is active, and a request is refused while a link removal runs. The ubus method ttlm_advertise of hostapd.<ifname> takes the links, the duration in TUs and an optional switch time. get_status reports the state of the mapping and the Mapping Switch Time of each link. The ubus notification adv-ttlm reports the establishment and the end, so that a caller can request the next mapping. The length of the element covers the largest element while a mapping is advertised, since its presence depends on the frame subtype and on the time of the write. The patches after 609 are refreshed for the new line numbers. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:19 +0000e1ef289cfbacb79b2844cf28b470a22a578b0b91hostapd: advertise a TID-to-link mapping of an AP MLDeditpackage/network/services/hostapd/patches/813-ap-mld-initialise-the-shared-authenticator-of-the-first-link-once.patcheditpackage/network/services/hostapd/patches/810-ap-mld-move-the-shared-authenticator-to-the-new-first-link.patcheditpackage/network/services/hostapd/patches/762-AP-don-t-ignore-probe-requests-with-invalid-DSSS-par.patcheditpackage/network/services/hostapd/patches/740-snoop_iface.patcheditpackage/network/services/hostapd/patches/720-iface_max_num_sta.patcheditpackage/network/services/hostapd/patches/814-ap-mld-keep-the-nl80211-bss-of-a-restarted-first-link.patcheditpackage/network/services/hostapd/patches/812-ap-mld-run-eap-of-a-non-mlo-station-on-its-own-link.patcheditpackage/network/services/hostapd/patches/781-hostapd-clear-the-qos-map-with-an-empty-SET_QOS_MAP_SET.patcheditpackage/network/services/hostapd/src/src/ap/ubus.ceditpackage/network/services/hostapd/src/src/ap/ubus.heditpackage/network/services/hostapd/patches/809-AP-process-OBSS-Beacon-frames-on-the-link-and-radio-of-their-channel.patcheditpackage/network/services/hostapd/patches/761-shared_das_port.patcheditpackage/network/services/hostapd/patches/819-ap-mld-refuse-an-association-while-a-link-is-not-started.patcheditpackage/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patchaddpackage/network/services/hostapd/patches/609-AP-MLD-advertise-a-TID-to-link-mapping.patcheditpackage/network/services/hostapd/patches/815-ap-learn-the-obss-colors-from-received-beacons.patcheditpackage/network/services/hostapd/patches/701-reload_config_inline.patchpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.jsoncdfb8b584d766b182d27a601e703bfd6d50d391f1793198779000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: keep the RSNO2 element of an AP MLD with sae_ext_key 0 With sae_ext_key 0, a psk2 or sae-compat AP MLD with a 6 GHz link has PSK in the 2.4 and 5 GHz RSNE, SAE in the 6 GHz RSNE and no override element with a shared AKM. The links have no common AKM, against IEEE 802.11be-2024 12.6.2, and no AKM 24, against WPA3 v3.5 2.5. A station finds no AKM for a multi-link association and uses one link. On an AP MLD, keep the RSNE Override 2 element with SAE-EXT-KEY also with sae_ext_key 0, which then only keeps SAE-EXT-KEY out of the RSNE. Do this only where an SAE password exists, so that an AP MLD with a raw PSK starts as before. Outside an AP MLD nothing changes. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:19 +0000cdfb8b584d766b182d27a601e703bfd6d50d391fwifi-scripts: keep the RSNO2 element of an AP MLD with sae_ext_key 0editpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uceditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/iface.uceditpackage/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-iface.jsonpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uccf592af0024f3a78df446324e1454c40919775e71793198779000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: refuse sae-mixed and sae-compat with a raw PSK sae-mixed offers SAE in the RSNE. Outside 6 GHz, sae-compat offers SAE in the RSNE Override element, and both offer SAE-EXT-KEY in the RSNE Override 2 element with EHT. A 64-hex-digit key is a raw PSK and no SAE password, so no station can use SAE there. bss_refusal() refuses this with SAE_NO_PASSWORD only for sae, and for sae-compat on 6 GHz. Refuse sae-mixed and sae-compat with a raw PSK on every band. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:19 +0000cf592af0024f3a78df446324e1454c40919775e7wifi-scripts: refuse sae-mixed and sae-compat with a raw PSKeditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.ucpackage/kernel/mac80211/patches/subsys/446-wifi-cfg80211-report-an-undecided-SCS-evaluation.patchpackage/kernel/mac80211/patches/subsys/465-wifi-nl80211-add-a-client-to-SCS-and-MSCS-descriptor.patchpackage/kernel/mac80211/patches/subsys/447-wifi-cfg80211-split-the-DSCP-mapping-out-of-cfg80211.patchpackage/kernel/mac80211/patches/subsys/436-wifi-cfg80211-add-set_scs-and-set_mscs-driver-ops.patchpackage/kernel/mac80211/patches/subsys/466-wifi-cfg80211-match-SCS-descriptors-on-their-client-.patchpackage/kernel/mac80211/patches/subsys/449-wifi-mac80211-add-the-flow-offload-flush-op.patchpackage/kernel/mac80211/patches/subsys/444-wifi-mac80211-add-SCS-and-MSCS-debugfs-files.patchpackage/kernel/mac80211/patches/subsys/450-wifi-mac80211-keep-learned-MSCS-entries-of-offloaded.patchpackage/kernel/mac80211/patches/subsys/448-wifi-mac80211-add-a-flow-priority-query.patchpackage/kernel/mac80211/patches/subsys/442-wifi-mac80211-apply-MSCS-on-transmit.patchpackage/kernel/mac80211/patches/subsys/433-wifi-cfg80211-add-the-SCS-evaluator.patchpackage/kernel/mac80211/patches/subsys/445-wifi-mac80211_hwsim-support-SCS-and-MSCS.patchpackage/kernel/mac80211/patches/subsys/441-wifi-mac80211-learn-MSCS-flows-on-receive.patchpackage/kernel/mac80211/patches/subsys/467-wifi-mac80211-keep-an-MSCS-per-client-and-configured.patchpackage/kernel/mac80211/patches/subsys/434-wifi-ieee80211-add-the-QoS-Characteristics-element.patchpackage/kernel/mac80211/patches/subsys/440-wifi-mac80211-classify-transmitted-MSDUs-with-SCS.patchpackage/kernel/mac80211/patches/subsys/435-wifi-cfg80211-add-SCS-and-MSCS-request-validation.patchpackage/kernel/mac80211/patches/subsys/439-wifi-mac80211-add-SCS-and-MSCS-rule-storage.patchpackage/kernel/mac80211/patches/subsys/431-wifi-cfg80211-add-the-TCLAS-element-parsers.patchpackage/kernel/mac80211/patches/subsys/437-wifi-cfg80211-add-SCS-and-MSCS-configuration-command.patchpackage/kernel/mac80211/patches/subsys/432-wifi-cfg80211-add-the-flow-parser-and-the-MSCS-key.patchpackage/kernel/mac80211/patches/subsys/443-wifi-mac80211-add-the-sta_set_scs-driver-op.patch9665b69513a678968a94c7bcb6d68cdb9e5f60e21793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: add SCS and MSCS support Add the SCS and MSCS series: the TCLAS and flow parsers, the SCS evaluator, the QoS Characteristics element, the nl80211 commands, the rule storage and the classification of transmitted MSDUs in mac80211, the MSCS learning on receive, the sta_set_scs driver op, the debugfs files and the hwsim implementation. mac80211 marks a frame whose priority an SCS or MSCS rule set with IEEE80211_TX_CTRL_STREAM_CLASSIFIED, so that a driver can hand that priority to a device that classifies 802.3 frames itself. hwsim advertises the SCS Traffic Description Support of EHT for its AP interfaces, so that a non-AP EHT STA sends it a QoS Characteristics element. For hardware that forwards flows on behalf of mac80211, add the undecided SCS verdict, the DSCP to user priority helper, the flow priority query, the per flow flush op and the idle query. A driver uses them to apply the SCS and MSCS rules of a station to those flows and to keep a learned MSCS entry alive while the hardware forwards its flow. The flow priority query refuses a flow with an undecided verdict, also when a rule matched. While the hardware forwards the uplink of an MSCS flow, its frames do not reach the learn path. When the hardware keeps a learned entry alive, mac80211 therefore also drops the flow from the hardware, so that its next uplink frames reach mac80211 and a priority that the station changes is learned within one stream timeout. For a 4-address peer, such as a backhaul station, a rule that names only the peer applies to every host behind it. Patches 465 to 467 add an optional client address to both descriptors, apply an SCS descriptor with a client only to MSDUs with that destination address, and keep a list of up to 16 MSCS per station. An MSCS is identified by its client and by a flag for an MSCS that the AP configures on behalf of the network, and the MSCS that the station requested comes first. The client does not scope the SCSID: the SCSIDs of a peer stay one space, which the layer that configures the descriptors assigns. Requests without a client or the flag keep their meaning. The new nl80211 commands and attributes follow the local advertised TID-to-link mapping additions, so their numbers differ from the wireless tree. User space must take them from this copy of nl80211.h. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00009665b69513a678968a94c7bcb6d68cdb9e5f60e2mac80211: add SCS and MSCS supportaddpackage/kernel/mac80211/patches/subsys/433-wifi-cfg80211-add-the-SCS-evaluator.patchaddpackage/kernel/mac80211/patches/subsys/443-wifi-mac80211-add-the-sta_set_scs-driver-op.patchaddpackage/kernel/mac80211/patches/subsys/436-wifi-cfg80211-add-set_scs-and-set_mscs-driver-ops.patchaddpackage/kernel/mac80211/patches/subsys/441-wifi-mac80211-learn-MSCS-flows-on-receive.patchaddpackage/kernel/mac80211/patches/subsys/448-wifi-mac80211-add-a-flow-priority-query.patchaddpackage/kernel/mac80211/patches/subsys/432-wifi-cfg80211-add-the-flow-parser-and-the-MSCS-key.patchaddpackage/kernel/mac80211/patches/subsys/445-wifi-mac80211_hwsim-support-SCS-and-MSCS.patchaddpackage/kernel/mac80211/patches/subsys/447-wifi-cfg80211-split-the-DSCP-mapping-out-of-cfg80211.patchaddpackage/kernel/mac80211/patches/subsys/466-wifi-cfg80211-match-SCS-descriptors-on-their-client-.patchaddpackage/kernel/mac80211/patches/subsys/442-wifi-mac80211-apply-MSCS-on-transmit.patchaddpackage/kernel/mac80211/patches/subsys/449-wifi-mac80211-add-the-flow-offload-flush-op.patchaddpackage/kernel/mac80211/patches/subsys/435-wifi-cfg80211-add-SCS-and-MSCS-request-validation.patchaddpackage/kernel/mac80211/patches/subsys/434-wifi-ieee80211-add-the-QoS-Characteristics-element.patchaddpackage/kernel/mac80211/patches/subsys/444-wifi-mac80211-add-SCS-and-MSCS-debugfs-files.patchaddpackage/kernel/mac80211/patches/subsys/465-wifi-nl80211-add-a-client-to-SCS-and-MSCS-descriptor.patchaddpackage/kernel/mac80211/patches/subsys/439-wifi-mac80211-add-SCS-and-MSCS-rule-storage.patchaddpackage/kernel/mac80211/patches/subsys/431-wifi-cfg80211-add-the-TCLAS-element-parsers.patchaddpackage/kernel/mac80211/patches/subsys/467-wifi-mac80211-keep-an-MSCS-per-client-and-configured.patchaddpackage/kernel/mac80211/patches/subsys/446-wifi-cfg80211-report-an-undecided-SCS-evaluation.patchaddpackage/kernel/mac80211/patches/subsys/437-wifi-cfg80211-add-SCS-and-MSCS-configuration-command.patchaddpackage/kernel/mac80211/patches/subsys/440-wifi-mac80211-classify-transmitted-MSDUs-with-SCS.patchaddpackage/kernel/mac80211/patches/subsys/450-wifi-mac80211-keep-learned-MSCS-entries-of-offloaded.patchtarget/linux/generic/pending-6.18/797-01-net-ethernet-mtk_eth_soc-query-the-wireless-driver-f.patchtarget/linux/mediatek/patches-6.18/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patchpackage/kernel/mac80211/patches/subsys/483-wifi-cfg80211-check-the-layout-of-the-flow-types.patchpackage/kernel/mt76/patches/003-wifi-mt76-mt7996-implement-the-flow-offload-idle-op.patchpackage/kernel/mt76/patches/001-wifi-mt76-answer-the-flow-priority-query.patchtarget/linux/generic/pending-6.18/797-02-net-ethernet-mtk_eth_soc-report-the-idle-time-of-off.patchpackage/kernel/mt76/patches/002-wifi-mt76-mt7996-implement-the-flow-offload-flush-op.patchtarget/linux/generic/pending-6.18/797-00-wifi-cfg80211-add-the-flow-key-and-flow-description-.patch0547b912e981df32731e8bd6f583a79c1021e1811793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namekernel: mtk_eth_soc: query the wireless driver for the TID of flows Query the wireless driver for the user priority of a flow as the PPE entry binds and store the answer in the WINFO TID field, unbind the entries of a station that the wireless driver flushes, and report how long ago the PPE last hit the entries that match a flow. An AP learns the priority of an MSCS flow from its uplink frames, and once the PPE forwards the uplink of a flow, those frames no longer reach mac80211. Record the station of an entry that the WED receive path binds, and unbind those entries as well at a flush, so that the next uplink frame passes mac80211 again. The ppe_check op of WED takes the station index for this. The flow key of the wireless driver describes the frames to the station, so the match callback learns whether an entry carries the frames of the station. Such an entry is described by its tuple before NAT, without the MAC addresses of a routed entry, and mt7996 compares it in the mirrored direction. mt7996 also asks the WED device of the receive path for the idle time. Add the flow key and flow description types of the SCS series to the kernel cfg80211 header, since the PPE driver builds against it while the wireless driver reads the copy in the mac80211 package. The two copies are separate definitions, so assert the value of each flow field, the offset of each field and the size of each structure in both of them (797-00 and mac80211 subsys patch 483). The PPE code of this tree keeps L2 subflows in l2_list and clears them with a set_state flag. mt76: backport the WED users of the new ops from the mt76 tree. They implement the flow_prio, flow_flush and flow_idle ops, and pass the station index to ppe_check, which the WED change requires for mt7915 and mt7996 to build. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00000547b912e981df32731e8bd6f583a79c1021e181kernel: mtk_eth_soc: query the wireless driver for the TID of flowsaddpackage/kernel/mt76/patches/003-wifi-mt76-mt7996-implement-the-flow-offload-idle-op.patchaddtarget/linux/generic/pending-6.18/797-00-wifi-cfg80211-add-the-flow-key-and-flow-description-.patchaddpackage/kernel/mt76/patches/001-wifi-mt76-answer-the-flow-priority-query.patchaddtarget/linux/generic/pending-6.18/797-02-net-ethernet-mtk_eth_soc-report-the-idle-time-of-off.patchaddpackage/kernel/mt76/patches/002-wifi-mt76-mt7996-implement-the-flow-offload-flush-op.patchaddpackage/kernel/mac80211/patches/subsys/483-wifi-cfg80211-check-the-layout-of-the-flow-types.patchaddtarget/linux/generic/pending-6.18/797-01-net-ethernet-mtk_eth_soc-query-the-wireless-driver-f.patchedittarget/linux/mediatek/patches-6.18/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patchpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-device.json6f2eb2f677733c3078f443aaf4c1d69f1b05b35c1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: pass the EHT punct_bitmap of a wifi-device to hostapd hostapd takes the EHT disabled subchannel bitmap as punct_bitmap, a 16-bit value, but the wifi-device schema had no such option. validate() logged "punct_bitmap is not present in the schema", kept the value as text, and hostapd.uc wrote no line for it, so a bitmap that a service publishes for a radio never reached hostapd. Add the option to the schema, 0 to 65535 with no default, and write it with the other EHT options of the radio. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00006f2eb2f677733c3078f443aaf4c1d69f1b05b35cwifi-scripts: pass the EHT punct_bitmap of a wifi-device to hostapdeditpackage/network/config/wifi-scripts/files-ucode/usr/share/schema/wireless.wifi-device.jsoneditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/validate.ucdca7a472b4c604049e743fc149206362524106551793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: check a schema minimum or maximum of 0 validate_value() tested `schema.minimum && value < schema.minimum`, so a minimum of 0 never applied: a negative value of any option whose schema starts at 0 (punct_bitmap, airtime_mode, mbssid, log_level and 14 others) passed unchecked. The same held for a maximum of 0. Compare where the bound is present, whatever its value. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000dca7a472b4c604049e743fc14920636252410655wifi-scripts: check a schema minimum or maximum of 0editpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/validate.ucpackage/kernel/mac80211/patches/subsys/451-wifi-mac80211-do-not-check-the-Beacon-of-another-BSS.patchb80e388b056000a5ad788cf7a68f6efee5fad0f11793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: do not check the Beacon of another BSS with an AP's BIGTK An AP checked a protected OBSS Beacon with its own BIGTK, the MIC failed, and the Beacon was dropped before it could be reported to the beacon registration. hostapd learned no neighbour that runs beacon protection, and its BSS Color never entered the colours in use. Let such a Beacon go on without a key, so that mac80211 reports it. Beacons of the AP's own links and Beacons on other interface types are checked as before. The software BSS Color collision check runs on the same path, so a protected neighbour with the AP's own colour now raises a collision, as an unprotected one does. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000b80e388b056000a5ad788cf7a68f6efee5fad0f1mac80211: do not check the Beacon of another BSS with an AP's BIGTKaddpackage/kernel/mac80211/patches/subsys/451-wifi-mac80211-do-not-check-the-Beacon-of-another-BSS.patchpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.uc94119141d68c936270fde2bc0355884591cd8d5e1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: leave a WPS credential to the reader of its event The ucode generator wrote a WPS station without wps_cred_processing, so wpa_supplicant added the credential of the M8 as a network of its own and joined with it: for a WPA2-PSK credential with key_mgmt PSK and no PMF, before the reader of the wps_credentials event (50-wps_sta, or another daemon) applied its own configuration. The shell generator hostapd.sh writes wps_cred_processing=1 for the same station. Write wps_cred_processing=1 for encryption 'wps' as well. The ucode hook sends the wps_credentials event before wpa_supplicant tests the value, so the readers of the event see no change. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000094119141d68c936270fde2bc0355884591cd8d5ewifi-scripts: leave a WPS credential to the reader of its eventeditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/supplicant.ucpackage/kernel/mac80211/patches/subsys/427-wifi-mac80211-pass-the-advertised-TID-to-link-mappin.patchpackage/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patchpackage/kernel/mac80211/patches/subsys/411-wifi-mac80211-keep-the-carrier-while-another-AP-link-beacons.patchpackage/kernel/mac80211/patches/subsys/446-wifi-cfg80211-report-an-undecided-SCS-evaluation.patchpackage/kernel/mac80211/patches/subsys/412-wifi-mac80211-stop-only-the-MBSSID-set-of-the-stopped-AP-link.patchpackage/kernel/mac80211/patches/subsys/415-wifi-cfg80211-report-the-MLD-address-and-link-of-a-dumped-station.patchpackage/kernel/mac80211/patches/subsys/447-wifi-cfg80211-split-the-DSCP-mapping-out-of-cfg80211.patchpackage/kernel/mac80211/patches/subsys/436-wifi-cfg80211-add-set_scs-and-set_mscs-driver-ops.patchpackage/kernel/mac80211/patches/subsys/425-wifi-mac80211-clear-the-Critical-Update-flag-after-t.patchpackage/kernel/mac80211/patches/subsys/424-wifi-nl80211-report-the-end-of-a-critical-update-on-.patchpackage/kernel/mac80211/patches/subsys/210-ap_scan.patchpackage/kernel/mac80211/patches/subsys/433-wifi-cfg80211-add-the-SCS-evaluator.patchpackage/kernel/mac80211/patches/subsys/310-cfg80211-allow-grace-period-for-DFS-available-after-.patchpackage/kernel/mac80211/patches/subsys/014-wifi-cfg80211-mac80211-apply-HE-OBSS-PD-settings-on-.patchpackage/kernel/mac80211/patches/subsys/435-wifi-cfg80211-add-SCS-and-MSCS-request-validation.patchpackage/kernel/mac80211/patches/subsys/414-wifi-cfg80211-take-the-MLO-station-rates-from-the-links-that-report-them.patchpackage/kernel/mac80211/patches/subsys/439-wifi-mac80211-add-SCS-and-MSCS-rule-storage.patchpackage/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patchpackage/kernel/mac80211/patches/subsys/421-wifi-mac80211-report-the-totals-of-an-MLO-station-when-it-is-removed.patchpackage/kernel/mac80211/patches/subsys/426-wifi-nl80211-add-the-advertised-TID-to-link-mapping-.patchpackage/kernel/mac80211/patches/subsys/431-wifi-cfg80211-add-the-TCLAS-element-parsers.patchpackage/kernel/mac80211/patches/subsys/437-wifi-cfg80211-add-SCS-and-MSCS-configuration-command.patchpackage/kernel/mac80211/patches/subsys/390-wifi-mac80211-notify-driver-on-airtime-weight-change.patchpackage/kernel/mac80211/patches/subsys/432-wifi-cfg80211-add-the-flow-parser-and-the-MSCS-key.patcha2c41530117dac320789b30f8bf57bc1c227314d1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: apply the HE OBSS PD settings of a running AP's beacon update nl80211 parsed NL80211_ATTR_HE_OBSS_PD at the start of an AP alone, and mac80211 signalled BSS_CHANGED_HE_OBSS_PD there alone, so new Spatial Reuse settings reached the driver only through a restart of the AP, which drops its stations. hostapd already sends the attribute with a beacon update, and mt7996 applies BSS_CHANGED_HE_OBSS_PD at any time. Parse the attribute in nl80211_set_beacon(), and apply settings that differ in ieee80211_change_beacon(). Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000a2c41530117dac320789b30f8bf57bc1c227314dmac80211: apply the HE OBSS PD settings of a running AP's beacon updateeditpackage/kernel/mac80211/patches/subsys/411-wifi-mac80211-keep-the-carrier-while-another-AP-link-beacons.patcheditpackage/kernel/mac80211/patches/subsys/412-wifi-mac80211-stop-only-the-MBSSID-set-of-the-stopped-AP-link.patcheditpackage/kernel/mac80211/patches/subsys/210-ap_scan.patcheditpackage/kernel/mac80211/patches/subsys/415-wifi-cfg80211-report-the-MLD-address-and-link-of-a-dumped-station.patcheditpackage/kernel/mac80211/patches/subsys/421-wifi-mac80211-report-the-totals-of-an-MLO-station-when-it-is-removed.patcheditpackage/kernel/mac80211/patches/subsys/446-wifi-cfg80211-report-an-undecided-SCS-evaluation.patcheditpackage/kernel/mac80211/patches/subsys/424-wifi-nl80211-report-the-end-of-a-critical-update-on-.patcheditpackage/kernel/mac80211/patches/subsys/414-wifi-cfg80211-take-the-MLO-station-rates-from-the-links-that-report-them.patcheditpackage/kernel/mac80211/patches/subsys/439-wifi-mac80211-add-SCS-and-MSCS-rule-storage.patcheditpackage/kernel/mac80211/patches/subsys/427-wifi-mac80211-pass-the-advertised-TID-to-link-mappin.patcheditpackage/kernel/mac80211/patches/subsys/433-wifi-cfg80211-add-the-SCS-evaluator.patcheditpackage/kernel/mac80211/patches/subsys/110-mac80211_keep_keys_on_stop_ap.patcheditpackage/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patcheditpackage/kernel/mac80211/patches/subsys/435-wifi-cfg80211-add-SCS-and-MSCS-request-validation.patcheditpackage/kernel/mac80211/patches/subsys/425-wifi-mac80211-clear-the-Critical-Update-flag-after-t.patchaddpackage/kernel/mac80211/patches/subsys/014-wifi-cfg80211-mac80211-apply-HE-OBSS-PD-settings-on-.patcheditpackage/kernel/mac80211/patches/subsys/436-wifi-cfg80211-add-set_scs-and-set_mscs-driver-ops.patcheditpackage/kernel/mac80211/patches/subsys/310-cfg80211-allow-grace-period-for-DFS-available-after-.patcheditpackage/kernel/mac80211/patches/subsys/431-wifi-cfg80211-add-the-TCLAS-element-parsers.patcheditpackage/kernel/mac80211/patches/subsys/437-wifi-cfg80211-add-SCS-and-MSCS-configuration-command.patcheditpackage/kernel/mac80211/patches/subsys/390-wifi-mac80211-notify-driver-on-airtime-weight-change.patcheditpackage/kernel/mac80211/patches/subsys/432-wifi-cfg80211-add-the-flow-parser-and-the-MSCS-key.patcheditpackage/kernel/mac80211/patches/subsys/426-wifi-nl80211-add-the-advertised-TID-to-link-mapping-.patcheditpackage/kernel/mac80211/patches/subsys/447-wifi-cfg80211-split-the-DSCP-mapping-out-of-cfg80211.patchpackage/network/services/hostapd/files/hostapd.uc5f0d5c1945ee05dca93e0760b021f14b3fd95ea21793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: change the BSS color and spatial reuse of a running AP A change of the BSS color or of a he_spr_* field restarted the interface. The restart drops the stations and the OBSS colors the interface learned, so a report of the neighbour colors right after a spatial reuse change named none. Where only the BSS color and the he_spr_* lines of the radio differ, on the same channel, with the color enabled before and after, set the changed fields with SET, update the beacon of every BSS, and start a color change announcement with COLOR_CHANGE. The beacon update goes first, because mac80211 refuses one while a color change runs. Where a step fails, the interface restarts as before. A requested color above 63, the default 128 included, asks hostapd for a random color, which the running color already is. Start a color change only where the requested color differs from the color that runs and is 1 to 63, since COLOR_CHANGE refuses a value above 63. The color that runs comes from STATUS, because after a color collision hostapd_switch_color_timeout_handler() moves the radio to another color by itself, while the old configuration still names the configured one. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00005f0d5c1945ee05dca93e0760b021f14b3fd95ea2hostapd: change the BSS color and spatial reuse of a running APeditpackage/network/services/hostapd/files/hostapd.ucpackage/network/services/hostapd/patches/820-AP-Drop-a-Re-Association-Request-frame-while-a-respo.patch044c3e0d9b8bbe6bf0cd700e6ad6a4cf060df9c71793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: drop an association request while a response is pending handle_assoc() drops a repeated (Re)Association Request frame only when the Retry bit is set and the sequence number repeats. mac80211 sends the next try as a new frame 100 ms after the earlier try was acknowledged. When the AP needs longer to answer, hostapd processes the second request before the TX status of the first response. For a station MLD, ieee80211_ml_process_link() then finds the link station of the first request and rejects the partner link, and the driver station keeps the association link only. The station uses the first response with all links, so it misses the GTK of the partner link in message 3, or it is deauthenticated when it transmits on that link. Add patch 820, which drops a new (Re)Association Request frame while a successful response to the station waits for its TX status, for at most one second. An Authentication frame with transaction sequence number 1 ends the wait, since the station then starts over and a lost or late TX status must not delay its next request. PASN does not start the association over, so a PASN frame does not end the wait. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000044c3e0d9b8bbe6bf0cd700e6ad6a4cf060df9c7hostapd: drop an association request while a response is pendingaddpackage/network/services/hostapd/patches/820-AP-Drop-a-Re-Association-Request-frame-while-a-respo.patchpackage/network/services/hostapd/patches/821-AP-Drop-a-later-try-of-an-acknowledged-Re-Associatio.patch711475e83a680473410782b69cd62632115509531793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: drop a later try of an acknowledged association request If the AP answers a (Re)Association Request slowly, hostapd can read mac80211's next try of the request after the TX status of the response. It then processes the try as a new association of an associated station: it removes and re-adds the driver station, restarts the 4-way handshake and, for a non-AP MLD, rejects the partner links, while the station keeps the first response. Drop a request with the same subtype and body as the acknowledged one for one second after the TX status, while the station is associated. The window ends early when the station becomes authorized, disassociates, authenticates again or a response is not acknowledged or rejected. A station that is authorized already keeps the window, so a late try of its re-association is dropped too. A station that becomes authorized at the TX status, with no 4-way handshake (open, FT, FILS, or an AP without WPA and IEEE 802.1X), has no window. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000711475e83a680473410782b69cd6263211550953hostapd: drop a later try of an acknowledged association requestaddpackage/network/services/hostapd/patches/821-AP-Drop-a-later-try-of-an-acknowledged-Re-Associatio.patchpackage/network/services/hostapd/files/wpa_supplicant.uc982f09cd3f0d5e6174af05c81acbf16a735380be1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewpa_supplicant: wait for radios hostapd holds before starting an MLD netifd calls mld_start once its wifi-scripts setups have returned. A hostapd restart of a radio runs after that, in __iface_pending_next(), and holds the radio with phy_set_state {stop: true} until the new interface is added. mld_start() then brings a station MLD up on the other radios. When the restart gives the radio back, mld_add_links() removes the MLD and adds it again, so the station associates twice. Do not start or extend an MLD while one of its configured radios is held. The phy_set_state {stop: false} that ends the restart starts it on all radios. A radio that netifd configures again, after a hostapd crash or a reload, is no longer held. A radio whose config netifd removes no longer counts. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000982f09cd3f0d5e6174af05c81acbf16a735380bewpa_supplicant: wait for radios hostapd holds before starting an MLDeditpackage/network/services/hostapd/files/wpa_supplicant.ucpackage/network/services/hostapd/files/hostapd.uc71bfd4920829529e9dbac4a9f42998bdbddf23291793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: give a radio back to wpa_supplicant when its setup ends early A pending setup can have sent phy_set_state {stop: true} to wpa_supplicant. iface_config_remove() aborts such a setup when the config of the phy goes away (config_reset, shutdown, a config with no BSS left, the removal of the last MLD link), and an exception ends iface_pending_next() early. Neither sent the matching start, so the stations of the radio stayed down, and a station MLD waits for that radio. Send phy_set_state {stop: false} in both cases, as iface_restart() does for an aborted setup. A start for a radio that was never stopped starts only the station interfaces of that radio that are not running, and adds no link to an MLD that is up. The exception also ended iface_pending_next() without the "done" step, so hostapd.data.pending_config[phy] kept the dead setup. iface_reload_config() treats a pending setup as up to date, so a later config with the same BSSes reloaded in place, and the phy stayed without its AP interface until a BSS changed. The status method also reported the BSSes as pending, and a later removal of the config aborted the dead setup and sent a second phy_set_state start. End the setup with the "done" step after the exception, as a setup that returns no next state does. The next config then restarts the phy. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000071bfd4920829529e9dbac4a9f42998bdbddf2329hostapd: give a radio back to wpa_supplicant when its setup ends earlyeditpackage/network/services/hostapd/files/hostapd.ucpackage/network/services/hostapd/files/wpa_supplicant.uc18dcdffc9843394d7de40f4623da9963395e77f01793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewpa_supplicant: give a radio back to an MLD only with its config phy_set_state {stop: false} sets the present bit of the radio in every MLD whose radio_mask holds it. A radio of radio_mask can lack a phy config, for example a disabled device whose radio stays in the radios of the MLD. A start for it after a stop or an abort can make it the first present radio, mld_add() then adds a null config, and the MLD stays down until netifd configures that radio again. Skip an MLD that has no config for the radio. Its other radios then start it as before. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000018dcdffc9843394d7de40f4623da9963395e77f0wpa_supplicant: give a radio back to an MLD only with its configeditpackage/network/services/hostapd/files/wpa_supplicant.ucpackage/network/services/hostapd/files/wpa_supplicant.uc5a621d3f3fc30ebaed6e33bacbf8ebdaac37f9e61793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewpa_supplicant: keep an MLD without links while hostapd holds a radio hostapd stops the stations of a radio before it restarts the AP on it, unless the station reports COMPLETED and the AP starts with the station status. For a station MLD that scans or is disconnected, phy_set_state stop then reaches mld_update_iface(), which removes the whole MLD netdev, and the start adds it again. The netdev already spans every radio of the MLD, so this changes nothing but drops the PMKSA cache, the BSSID ignore list and the bridge port. Where the MLD is DISCONNECTED, INACTIVE or SCANNING and another radio of it stays present, keep the netdev and leave the held radio out of the scan frequency list. A station without a link holds no channel on the radio. In any other state the MLD goes down as before. phy_status no longer reports the MLD for a kept radio. hostapd aborts a setup without a start when it restarts the radio again, and relies on the stop and start of the next setup. If the kept MLD associated in the meantime, that setup would start the AP on its own channel and send neither, and the radio would stay held. The frequency list of an MLD now leaves out every radio hostapd holds, since bss_allowed() filters the association and the partner links with it. So an associated MLD also refuses the BSSes of a held radio that carries no link of it. The start gives the full list back, also after hostapd aborts the setup of the radio. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00005a621d3f3fc30ebaed6e33bacbf8ebdaac37f9e6wpa_supplicant: keep an MLD without links while hostapd holds a radioeditpackage/network/services/hostapd/files/wpa_supplicant.ucpackage/kernel/mac80211/patches/subsys/454-wifi-mac80211-remove-AP-VLAN-frames-from-station-TXQ.patchb48d95153551a669c575511ebdcbc2673f6e5b7c1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: remove the frames of a stopped AP VLAN from station TXQs hostapd moves a 4-address station back to the BSS interface before it deletes the station's AP VLAN. The frames queued through the VLAN stay in the station's TXQs, and their dequeue after the VLAN stop dereferences the NULL sdata->bss in ieee80211_tx_dequeue(). On mt7996 this oopses in the mt76 TX worker. Remove the frames of the stopping VLAN from every queue of the BSS, and wait for an RCU grace period before sdata->bss is cleared. Remove them again after the grace period, for the fragments that a dequeue in progress queued. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000b48d95153551a669c575511ebdcbc2673f6e5b7cmac80211: remove the frames of a stopped AP VLAN from station TXQsaddpackage/kernel/mac80211/patches/subsys/454-wifi-mac80211-remove-AP-VLAN-frames-from-station-TXQ.patchpackage/kernel/mac80211/patches/subsys/456-wifi-mac80211-let-a-driver-report-the-expiry-of-an-A.patchpackage/kernel/mac80211/patches/subsys/455-wifi-nl80211-report-the-expiry-of-an-offloaded-AP-Re.patch9abf356d31c14fec2acf8a4033bca0c868e9d75e1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: let a driver count the AP Removal Timer of a link removal An AP MLD announces the removal of an affiliated AP with the AP Removal Timer of a Reconfiguration Multi-Link element in the Beacon frames of all its links. hostapd counts the timer with a beacon update of every link at each beacon interval, and on mt7996 each such update keeps the Critical Update flag set past the DTIM Beacon. Patch 455 adds NL80211_EXT_FEATURE_AP_REMOVAL_TIMER_OFFLOAD, with which the driver counts the timer in the Beacon frames itself, and reports the expiry with NL80211_CMD_LINKS_REMOVED on the AP interface. The links stay until user space removes them. Patch 456 adds ieee80211_links_removed(), with which a driver reports the expiry from any context. The teardown of the interface cancels the work that sends the report. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00009abf356d31c14fec2acf8a4033bca0c868e9d75emac80211: let a driver count the AP Removal Timer of a link removaladdpackage/kernel/mac80211/patches/subsys/456-wifi-mac80211-let-a-driver-report-the-expiry-of-an-A.patchaddpackage/kernel/mac80211/patches/subsys/455-wifi-nl80211-report-the-expiry-of-an-offloaded-AP-Re.patchpackage/network/services/hostapd/patches/822-AP-MLD-let-the-driver-count-the-AP-Removal-Timer.patch8b165eb6567973baf77188d271d54528af1a37141793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: let the driver count the AP Removal Timer hostapd counts the AP Removal Timer of a link removal with a beacon update of every link of the AP MLD at each beacon interval. On mt7996 each update keeps the Critical Update flag set past the DTIM Beacon. Where the driver declares NL80211_EXT_FEATURE_AP_REMOVAL_TIMER_OFFLOAD, patch 822 sets the beacons once at the start and lets the driver count the timer. No beacon of the AP MLD is set during the countdown, as the MediaTek SDK does. The driver's NL80211_CMD_LINKS_REMOVED ends the removal: the other links drop the Reconfiguration element at once, and the stations get their frames and the link stops after the removal TBTT, which comes less than count + 1 beacon intervals after the return of the first update. The host count keeps the Probe Response frames at or below the count of the Beacon frames and stays at 1 until the event. Without the event, hostapd ends the removal itself count + 2 intervals after that return. A removal fails if the driver takes no beacon with the element at the start. A removal of a count that is not a whole number of seconds, and a second removal on the AP MLD while one runs, are refused. A non-AP MLD whose only setup link is the removed one counts itself disassociated at the removal TBTT (IEEE 802.11be-2024 35.3.6.3). Clear its authorized flag at NL80211_CMD_LINKS_REMOVED, which comes before that TBTT, as 603 does at the host expiry. The Deauthentication after the TBTT stays. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00008b165eb6567973baf77188d271d54528af1a3714hostapd: let the driver count the AP Removal Timeraddpackage/network/services/hostapd/patches/822-AP-MLD-let-the-driver-count-the-AP-Removal-Timer.patchpackage/network/services/hostapd/patches/822-AP-MLD-let-the-driver-count-the-AP-Removal-Timer.patchpackage/network/services/hostapd/patches/815-ap-learn-the-obss-colors-from-received-beacons.patchpackage/network/services/hostapd/patches/810-ap-mld-move-the-shared-authenticator-to-the-new-first-link.patchpackage/network/services/hostapd/patches/606-ap-notify-ubus-of-a-bss-color-change.patchpackage/network/services/hostapd/patches/813-ap-mld-initialise-the-shared-authenticator-of-the-first-link-once.patchpackage/network/services/hostapd/patches/812-ap-mld-run-eap-of-a-non-mlo-station-on-its-own-link.patchpackage/network/services/hostapd/patches/603-ap-mld-remove-an-affiliated-ap-at-the-expiry.patchpackage/network/services/hostapd/patches/609-AP-MLD-advertise-a-TID-to-link-mapping.patchpackage/network/services/hostapd/patches/761-shared_das_port.patchpackage/network/services/hostapd/patches/814-ap-mld-keep-the-nl80211-bss-of-a-restarted-first-link.patchpackage/network/services/hostapd/patches/701-reload_config_inline.patchpackage/network/services/hostapd/patches/608-AP-MLD-end-the-Critical-Update-flag-at-the-DTIM-Beac.patch3e04eccebb01aabd46d70fdcfd70b962739666d21793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: deauthorize the stations of a link removal before their frames At the end of a link removal, patch 603 sends each station of the link a Disassociation or a Deauthentication, but it leaves the station authorized in hostapd and in the driver until the link stops. New data for the station then still reaches the driver after that frame. On mt7996, data frames to a non-MLD station went out up to 8.7 ms after an acknowledged Disassociation, while IEEE 802.11-2024 11.3.3 allows no Class 3 frame in State 2. Clear the authorized flag of each such station in hostapd and in the driver before its frame, with the calls of ap_sta_disconnect_common(). Upstream's inactivity timer and control interface send the frame first and clear the flag after it; this order is stricter. mac80211 then drops new data for the station. Data frames already queued in mac80211 (with 802.3 encap offload, as on mt7996) and in the driver can still go out. The other patches that change src/ap/hostapd.c are refreshed for the new line numbers. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00003e04eccebb01aabd46d70fdcfd70b962739666d2hostapd: deauthorize the stations of a link removal before their frameseditpackage/network/services/hostapd/patches/815-ap-learn-the-obss-colors-from-received-beacons.patcheditpackage/network/services/hostapd/patches/813-ap-mld-initialise-the-shared-authenticator-of-the-first-link-once.patcheditpackage/network/services/hostapd/patches/606-ap-notify-ubus-of-a-bss-color-change.patcheditpackage/network/services/hostapd/patches/814-ap-mld-keep-the-nl80211-bss-of-a-restarted-first-link.patcheditpackage/network/services/hostapd/patches/822-AP-MLD-let-the-driver-count-the-AP-Removal-Timer.patcheditpackage/network/services/hostapd/patches/701-reload_config_inline.patcheditpackage/network/services/hostapd/patches/812-ap-mld-run-eap-of-a-non-mlo-station-on-its-own-link.patcheditpackage/network/services/hostapd/patches/761-shared_das_port.patcheditpackage/network/services/hostapd/patches/608-AP-MLD-end-the-Critical-Update-flag-at-the-DTIM-Beac.patcheditpackage/network/services/hostapd/patches/810-ap-mld-move-the-shared-authenticator-to-the-new-first-link.patcheditpackage/network/services/hostapd/patches/603-ap-mld-remove-an-affiliated-ap-at-the-expiry.patcheditpackage/network/services/hostapd/patches/609-AP-MLD-advertise-a-TID-to-link-mapping.patchpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/iwinfo.uc19ad663d2fa4fe0abd9251d89b5491034edf44c71793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: iwinfo: bound the bss_info calls to 2 s update() runs when iwinfo.uc loads and asks hostapd, then wpa_supplicant, for the bss_info of each nl80211 interface on a ubus connection with the default timeout of 30 s. A hostapd that stops answering on ubus therefore holds every importer for 30 s per interface, at the load and at each update(). Make the bss_info calls on a connection of their own with a timeout of 2 s. A healthy hostapd answers bss_info in less than 10 ms, and the timeout of a ucode ubus connection is a whole number of seconds (0 means no timeout). 1 s is the only shorter value; 2 s leaves a margin for a hostapd that is busy for a moment. After the first timeout of a daemon, the same update() does not call that daemon again, so a wedged daemon costs 2 s per update() and not per interface. The network.wireless status call keeps the connection with the default timeout, so that a netifd busy with a wifi reload does not leave the interface list without its configuration. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000019ad663d2fa4fe0abd9251d89b5491034edf44c7wifi-scripts: iwinfo: bound the bss_info calls to 2 seditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/iwinfo.ucpackage/network/services/hostapd/patches/823-nl80211-End-the-wait-for-a-reply-on-a-positive-error.patch1330b91bad82e70154d339f19800ae146c953b611793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: end the wait for a netlink reply on a positive error send_and_recv_glb() reads replies while the error is positive, and error_handler() copies the error of an NLMSG_ERROR message unchanged. An answer with a positive error therefore leaves hostapd in recvmsg() for ever: the answer was read and no other message follows. The event loop stops, and every ubus and control interface stops with it. This is a defect of hostapd, an endless wait on an answer that arrived, independent of the kernel bug that produced the value. With mt7996, the station request of add_associated_sta() for a non-AP MLD got the error 65539, and hostapd answered no ubus call until a restart. Take a positive error as -EPROTO and log the raw value with the message type and command, so that the request fails, the association is rejected and the event loop goes on. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00001330b91bad82e70154d339f19800ae146c953b61hostapd: end the wait for a netlink reply on a positive erroraddpackage/network/services/hostapd/patches/823-nl80211-End-the-wait-for-a-reply-on-a-positive-error.patchpackage/network/services/hostapd/patches/825-AP-MLD-Refuse-a-link-addition-while-the-link-is-not-.patch24bdd0906bc8220dd5e4523dc1e7a9825e1311a61793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: refuse a link addition while the link is not started A Link Reconfiguration Request can add a link of the AP MLD that waits for an HT scan, ACS or a DFS CAC. The link has no authenticator yet, so the response accepts the link without the group key KDEs that IEEE Std 802.11be-2024, 35.3.6.4 requires for each added link, or a refused link station reports a disconnection of a station that stays associated. Refuse such a link as a link that the AP MLD does not have. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000024bdd0906bc8220dd5e4523dc1e7a9825e1311a6hostapd: refuse a link addition while the link is not startedaddpackage/network/services/hostapd/patches/825-AP-MLD-Refuse-a-link-addition-while-the-link-is-not-.patchpackage/network/services/hostapd/patches/826-AP-MLD-Keep-the-ML-information-of-a-station-whose-as.patch7844ec9e473139a7aff84f5d9f117b7dc22d96601793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: keep the ML information of a refused association after SA Query After a timed out SA Query, a failed (Re)Association Request of a non-AP MLD cleared the ML information of its still associated station entry, or left the links of the refused request in it. The entry then was no MLD station any more, and a later request without a new authentication failed with an MLD address mismatch. Keep a copy with the earlier state machine and put it back after the response. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00007844ec9e473139a7aff84f5d9f117b7dc22d9660hostapd: keep the ML information of a refused association after SA Queryaddpackage/network/services/hostapd/patches/826-AP-MLD-Keep-the-ML-information-of-a-station-whose-as.patchpackage/network/services/hostapd/patches/827-AP-MLD-refuse-a-link-whose-removal-runs.patchfb443d05c662bff86970671bc478ebda019d119a1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: refuse a link whose removal runs During the countdown of an affiliated AP removal (patches 602, 603 and 822), hostapd accepts that link in a multi-link association and in a Link Reconfiguration Request that adds it. IEEE 802.11be-2024 35.3.6.3 removes the affiliated AP at the TBTT the AP Removal Timer names, so such a link exists only until that TBTT. mt7996 moves the TX of a station off the link at the start of the removal, and a new link station then gets the link again. Refuse that link with UNSPECIFIED_FAILURE in the per-STA status, as the other refused links; the association or reconfiguration goes on over the other links. Refuse a multi-link association received on that link, since it would be the association link, and 603 ends the whole association at the removal anyway. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000fb443d05c662bff86970671bc478ebda019d119ahostapd: refuse a link whose removal runsaddpackage/network/services/hostapd/patches/827-AP-MLD-refuse-a-link-whose-removal-runs.patchpackage/network/services/hostapd/patches/828-AP-MLD-Report-no-disconnection-for-a-refused-link.patch64ebbd770c046f02dbb7f786b04feabfac2ef3bd1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: report no disconnection for a refused MLD link ieee80211_ml_process_link() gives a new link station the flags of the origin station, the authorized flag included. Where the link is then refused (element check, no AID, or the driver refuses the link station), ap_free_sta() of the link station reports AP-STA-DISCONNECTED and the ubus disassoc notification, although the non-AP MLD stays associated. A Link Reconfiguration Request that adds a link always reaches this. Upstream hostap has the same code (main 741d70dd8e32). Clear the flag without the event before the free, as ap_free_link_sta() does for the other link stations (patch 828). Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000064ebbd770c046f02dbb7f786b04feabfac2ef3bdhostapd: report no disconnection for a refused MLD linkaddpackage/network/services/hostapd/patches/828-AP-MLD-Report-no-disconnection-for-a-refused-link.patchpackage/network/services/hostapd/src/src/ap/ubus.cpackage/network/services/hostapd/README.md2817b942b7260173ae808c380b4b3fcb44be4bc51793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: ubus bss_transition_request sets Link Removal Imminent The ubus method bss_transition_request has no attribute for the Link Removal Imminent bit of the BSS Transition Management Request, and hostapd_bss_tr_send() never sets it. blobmsg_parse() drops the link_removal_imminent attribute that a caller passes, so no request sent over ubus can carry the bit. Add the boolean attribute link_removal_imminent and set WNM_BSS_TM_REQ_LINK_REMOVAL_IMMINENT from it, like the ctrl_iface BSS_TM_REQ parameter of the same name. IEEE 802.11be-2024 9.6.13.9 reserves the field unless the sending AP is affiliated with an AP MLD of more than one affiliated AP, so send the request with the bit cleared in that case and log it at debug level. With the bit set, wnm_send_bss_tm_req() starts no disassociation timer for a non-AP MLD with more than one valid link (upstream commit 3e8fa9551a81 ("WNM: Disassociate STA only when Link Removal Imminent is 0 in BTM Request frame")): such a station stays associated at the end of disassociation_timer. Without the bit, the timer works as before. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00002817b942b7260173ae808c380b4b3fcb44be4bc5hostapd: ubus bss_transition_request sets Link Removal Imminenteditpackage/network/services/hostapd/src/src/ap/ubus.ceditpackage/network/services/hostapd/README.mdpackage/network/services/hostapd/patches/829-AP-MLD-Keep-the-shared-wpa_sm-of-the-partner-links-f.patch28714dc524f3b7274b17809a712cb8984fa37e7f1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: keep the shared wpa_sm of an MLD station for a refused link For a new link station of a non-AP MLD, the failure path of __check_assoc_ies() clears the wpa_sm of every partner link entry of the MLD address, the association link station included. Those entries hold the shared state machine, not the temporary per-link one that is freed. After that, the station stays associated with no wpa_sm. This has two effects: - A Link Reconfiguration add that the element check refuses, followed by a valid add, crashes hostapd in wpa_auth_set_ml_info() called from hostapd_ml_process_reconf_link(). - An association with a partner link that __check_assoc_ies() refuses never starts the 4-way handshake, and the station times out. Upstream commit 0435c06fc270 ("AP MLD: Update partner link wpa_sm pointers more consistently") and commit 3c98f62ac942 ("AP MLD: Clear wpa_sm entries for all STAs more thoroughly") added these clears to remove pointers to a freed wpa_sm. That only applies where the station owns the shared wpa_sm. Upstream main 741d70dd8e32 has the same code. Clear the partner links only for the station that owns the shared wpa_sm. A link station frees only its own temporary wpa_sm, and on success it still sets the shared wpa_sm on its partner links. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000028714dc524f3b7274b17809a712cb8984fa37e7fhostapd: keep the shared wpa_sm of an MLD station for a refused linkaddpackage/network/services/hostapd/patches/829-AP-MLD-Keep-the-shared-wpa_sm-of-the-partner-links-f.patchpackage/network/services/hostapd/patches/830-WDS-Interface-removal-in-MLO-cases.patch7e74099f9fb91559042787037d080c68efca5ecb1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: keep the WDS interface of an MLD while it has a link Backport the removal part of hostap 7561cfa1ea9a. Freeing one link station of a non-AP MLD removed the AP_VLAN (ap-mldN.staM) that all its links share, while the MLD stayed associated over its other links. mac80211 reports the unexpected 4-address frame that could create it again once per station at most, so a second link removal in the same association left the backhaul without its AP_VLAN. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00007e74099f9fb91559042787037d080c68efca5ecbhostapd: keep the WDS interface of an MLD while it has a linkaddpackage/network/services/hostapd/patches/830-WDS-Interface-removal-in-MLO-cases.patchpackage/kernel/mac80211/patches/subsys/457-wifi-mac80211-use-the-AP-interface-for-link-changes-.patchb521b6040ea38d1157a703dd0d59789d100a8b571793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: use the AP interface for link changes of a VLAN station drv_change_sta_links() checked the AP VLAN of a 4-address station in place of its AP, so adding or removing a link of such a non-AP MLD warned once, returned -EIO and left the driver unaware of the change. hostapd keeps the station on its VLAN while it removes one of its links since the WDS interface fix (patch 830). Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000b521b6040ea38d1157a703dd0d59789d100a8b57mac80211: use the AP interface for link changes of a VLAN stationaddpackage/kernel/mac80211/patches/subsys/457-wifi-mac80211-use-the-AP-interface-for-link-changes-.patchpackage/network/services/hostapd/src/src/ap/ubus.ccb66fb9495a5258a31af388e62923956305549121793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: cancel the ubus reconnect timer when the context goes hostapd_ubus_connection_lost() arms ubus_reconnect_timeout(), which reconnects the global ctx. When the last ubus object is removed before the reconnect succeeds, hostapd_ubus_ref_dec() frees ctx and sets it to NULL, but the timer stays armed. One second later it calls ubus_reconnect() with a NULL context and hostapd crashes: WPA_TRACE: eloop SIGSEGV - START ubus_reconnect+0xc ubus_reconnect_timeout() ../src/ap/ubus.c eloop_run() ../src/utils/eloop.c Reachable when ubusd stops and every BSS of hostapd goes within that window, or while ubusd stays down. Cancel the reconnect timer together with the context it serves, as hostapd_bss_flush_bans() does with its timers. The next BSS connects anew through hostapd_ubus_init(). The problem dates from commit 9df75e7f34d4 ("hostapd: fix ubus reconnect handling"), which added the timer while hostapd_ubus_ref_dec() already freed the context. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000cb66fb9495a5258a31af388e6292395630554912hostapd: cancel the ubus reconnect timer when the context goeseditpackage/network/services/hostapd/src/src/ap/ubus.cpackage/network/services/hostapd/patches/831-MLD-STA-Send-the-Multi-AP-element-in-the-profile-of-.patch8a1d63b00cabb6c993e87c05bc1ea66eb60b835f1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: send the Multi-AP element in the profile of an added MLD link A Link Reconfiguration Request that adds a link carries the complete profile of that link's STA. IEEE Std 802.11be-2024, 35.3.6.4 applies no inheritance there. wpa_supplicant sent no elements for an added link. So the profile of a Multi-AP backhaul STA had no Multi-AP element. hostapd refuses that link on a backhaul-only BSS with status 12. On a BSS that is fronthaul and backhaul, it clears WLAN_STA_MULTI_AP of the new link station, and the AP_VLAN of the MLD then leaks when that link station is the last one freed. Send the Multi-AP element of the association request in the profile of each added link of a backhaul STA. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00008a1d63b00cabb6c993e87c05bc1ea66eb60b835fhostapd: send the Multi-AP element in the profile of an added MLD linkaddpackage/network/services/hostapd/patches/831-MLD-STA-Send-the-Multi-AP-element-in-the-profile-of-.patchpackage/network/services/hostapd/patches/832-AP-MLD-Keep-the-Multi-AP-state-of-an-MLD-for-an-adde.patch1605835b36ba10355f8f11a1ce1b629deaa36d281793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: keep the Multi-AP state of an MLD for an added link hostapd checks the profile of a link that a Link Reconfiguration Request adds on its own, with no inheritance (IEEE Std 802.11be-2024, 35.3.6.4). A backhaul STA MLD that omits the Multi-AP element there is refused with status 12 on a backhaul-only BSS. On a BSS that is fronthaul and backhaul, the new link station loses WLAN_STA_MULTI_AP, and the AP_VLAN of the MLD leaks when that link station is the last one freed. Where the profile has no Multi-AP element and the MLD associated as a Multi-AP backhaul STA, keep its Multi-AP state. This accepts a profile that 35.3.6.4 calls incomplete, for interoperability with stations that omit the element. A profile with the element is checked as before, and an MLD that is no backhaul STA stays refused on a backhaul-only BSS. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00001605835b36ba10355f8f11a1ce1b629deaa36d28hostapd: keep the Multi-AP state of an MLD for an added linkaddpackage/network/services/hostapd/patches/832-AP-MLD-Keep-the-Multi-AP-state-of-an-MLD-for-an-adde.patchpackage/network/services/hostapd/src/src/ap/ubus.hpackage/network/services/hostapd/src/src/ap/ubus.c58286e3c0e71a2b4de3c8bee656b882528e590ea1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: add a BSS ubus object once the ubus connection is back A BSS added while hostapd has no working ubus connection never got its ubus object: - With the connection lost and the context kept (other objects still registered), ubus_add_object() fails and takes no reference. The reconnect registers again only the objects in the context, so the new object stays absent until hostapd restarts. - With no context (ubusd down at the add, for example after the last object went while ubusd was down), hostapd_ubus_add_bss() returned when the connect failed, and nothing tried again. Keep such objects on a pending list. Each holds a reference, so the context and its reconnect timer stay. The reconnect timer adds them after a successful reconnect. Without a context, a connect timer of 1 s tries to connect, and the first connect adds them. Removing a BSS takes its object off the list, and the last reference cancels the connect timer. An add that a live ubusd refuses keeps the current behaviour: no object, no reference. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000058286e3c0e71a2b4de3c8bee656b882528e590eahostapd: add a BSS ubus object once the ubus connection is backeditpackage/network/services/hostapd/src/src/ap/ubus.heditpackage/network/services/hostapd/src/src/ap/ubus.cpackage/kernel/mac80211/patches/subsys/458-wifi-mac80211-send-MLO-group-frames-only-on-links-wi.patch0ac9421585380e50e119f9fe9892db55b957fa481793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: send MLO group frames only on links with a running AP A stopped link of an AP MLD stays in active_links until hostapd removes it, and mac80211 sent a copy of each group addressed frame there. On hwsim this warns "TX w/o channel"; mt7996 queues the copy with the TXD of the stopped link. Patch 458 skips links without a beacon, and drops a copy that waits in the TXQ while the AP of its link stops. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00000ac9421585380e50e119f9fe9892db55b957fa48mac80211: send MLO group frames only on links with a running APaddpackage/kernel/mac80211/patches/subsys/458-wifi-mac80211-send-MLO-group-frames-only-on-links-wi.patchpackage/kernel/mac80211/patches/subsys/459-wifi-mac80211-free-the-link-data-of-a-refused-link-r.patch12094c0280e3f0f346e7650b3e49e6b957976d6a1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: free the link data of a refused link reconfiguration A Multi-Link Reconfiguration whose every added link the AP refuses left reconf.add_links_data allocated in the station, because ieee80211_ml_reconf_reset() returns early once added_links and removed_links are 0. Each later authentication took its link addresses from it, so a link outside the refused request authenticated from 00:00:00:00:00:00, which hostapd drops ("Invalid SA"). Add subsys/459, which also resets the reconfiguration state while add_links_data is set. Upstream wireless has the same code. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000012094c0280e3f0f346e7650b3e49e6b957976d6amac80211: free the link data of a refused link reconfigurationaddpackage/kernel/mac80211/patches/subsys/459-wifi-mac80211-free-the-link-data-of-a-refused-link-r.patchpackage/network/services/hostapd/patches/839-AP-take-the-authenticator-of-a-station-timer-from-it.patchpackage/network/services/hostapd/patches/882-AP-MLD-keep-the-pending-RADIUS-messages-of-a-non-AP-.patchpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patchpackage/network/services/hostapd/patches/836-AP-MLD-keep-the-association-of-a-non-AP-MLD-at-a-lin.patchpackage/network/services/hostapd/patches/868-AP-MLD-keep-the-session-timers-of-a-moved-associatio.patchbeeab8d64764c47f88f70c30569c5a6945ca09121793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: keep the association of a non-AP MLD at a link removal At the expiry of an AP link removal, patch 603 deauthenticated each non-AP MLD whose association link was the removed link, also where it had other setup links. IEEE Std 802.11be-2024, 35.3.6.3 ends only the association of a non-AP MLD whose only setup link is removed, so a backhaul MLD with other links lost its backhaul for some seconds. Add patch 836: move the association of such a non-AP MLD to its lowest other setup link whose AP runs, as hostapd already does for a Link Reconfiguration that deletes the association link, and free the STA of the removed link as a link STA. The move takes the group of the new link for the state machine, since the group of the removed link is freed with its AP. The move must keep the state that the old association STA holds: - 839: wpa_rekey_ptk() and wpa_send_eapol_timeout() take the authenticator from the state machine when they fire, so that a pending timer does not use the authenticator of the freed link; - 868: the session timer, the session warning timer and the session deadline move to the new association STA; - 875: the accounting session and the EAPOL state machine move to the new association STA, so that the RADIUS server sees no end of the session and reauthentication goes on; - 882: the free of a link STA keeps the pending RADIUS messages of the MLD address, which the association STA still waits for. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000beeab8d64764c47f88f70c30569c5a6945ca0912hostapd: keep the association of a non-AP MLD at a link removaladdpackage/network/services/hostapd/patches/836-AP-MLD-keep-the-association-of-a-non-AP-MLD-at-a-lin.patchaddpackage/network/services/hostapd/patches/882-AP-MLD-keep-the-pending-RADIUS-messages-of-a-non-AP-.patchaddpackage/network/services/hostapd/patches/868-AP-MLD-keep-the-session-timers-of-a-moved-associatio.patchaddpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patchaddpackage/network/services/hostapd/patches/839-AP-take-the-authenticator-of-a-station-timer-from-it.patchpackage/network/services/hostapd/patches/839-AP-take-the-authenticator-of-a-station-timer-from-it.patchpackage/network/services/hostapd/patches/837-AP-MLD-accept-the-association-link-in-M2-of-a-rekeyi.patchf37e174443d07aadf143df1878882bcffceb125b1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: accept the association link in M2 of a PTK rekey After hostapd moved the association of a non-AP MLD to another link (a Link Reconfiguration that deletes the association link, or patch 836 at an AP removal), the first PTK rekey ended the association: wpa_auth_validate_ml_kdes_m2() refused the MLO Link KDE of the new association link, which wpa_supplicant still lists. IEEE Std 802.11be-2024, 12.7.6.3 has message 2 of a rekeying name each setup link. Add patch 837: in message 2 of a rekeying, accept the KDE of the association link where its address matches. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000f37e174443d07aadf143df1878882bcffceb125bhostapd: accept the association link in M2 of a PTK rekeyaddpackage/network/services/hostapd/patches/837-AP-MLD-accept-the-association-link-in-M2-of-a-rekeyi.patcheditpackage/network/services/hostapd/patches/839-AP-take-the-authenticator-of-a-station-timer-from-it.patchpackage/kernel/mac80211/patches/subsys/460-wifi-mac80211-compute-the-links-of-each-AP-VLAN-on-i.patchd179d224cecd0f331c759b0f076e8b69779ebc201793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: compute the links of each AP VLAN on its own At an AP link change, ieee80211_update_apvlan_links() carried the link mask of one 4-address AP VLAN over to the next. With two Multi-AP backhaul MLDs on different link sets, the second VLAN lost links that its station holds, and mac80211 removed them from the station. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000d179d224cecd0f331c759b0f076e8b69779ebc20mac80211: compute the links of each AP VLAN on its ownaddpackage/kernel/mac80211/patches/subsys/460-wifi-mac80211-compute-the-links-of-each-AP-VLAN-on-i.patchpackage/kernel/mac80211/patches/subsys/461-wifi-mac80211-follow-the-station-links-on-its-4-addr.patchae11dd33909887bd5e728387142d10253c645b7e1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: follow the station links on its 4-address AP VLAN The 4-address AP VLAN of a Multi-AP backhaul MLD held only the links that the station had when it moved to the VLAN. A Link Reconfiguration add of another link then failed in ieee80211_add_link_station() with -EINVAL, so hostapd answered status 17. Add the link to the VLAN at the add and remove it at the delete. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000ae11dd33909887bd5e728387142d10253c645b7emac80211: follow the station links on its 4-address AP VLANaddpackage/kernel/mac80211/patches/subsys/461-wifi-mac80211-follow-the-station-links-on-its-4-addr.patchpackage/network/services/hostapd/src/src/ap/ucode.cpackage/network/services/hostapd/patches/882-AP-MLD-keep-the-pending-RADIUS-messages-of-a-non-AP-.patchpackage/network/services/hostapd/patches/835-AP-Remove-the-AP_VLAN-of-a-WDS-station-from-the-entr.patchpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patchpackage/network/services/hostapd/patches/868-AP-MLD-keep-the-session-timers-of-a-moved-associatio.patch69e29aef383951d0da0fbbd932ffae455c2abbf11793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: remove the AP_VLAN of a WDS station from the entry that made it ap_free_sta() decides the removal of a station's AP_VLAN from flags of the freed entry, and with patch 830 from the entries that the other link BSSes of an AP MLD hold for the address. The AP_VLAN outlives both. A new authentication whose association is refused clears WLAN_STA_MULTI_AP, so the AP_VLAN leaks, also for a station that is no MLD. On an AP MLD a plain WDS AP_VLAN leaks when the link station that received the 4-address frame is not the last one freed. The removal of the association link removes the AP_VLAN twice, because the station of the removed link BSS sees no partner and the remaining one does not see it. Add patch 835: remove the AP_VLAN only from the entry on which hostapd created or enabled it again. The entry gets the mark also where hostapd_set_wds_sta() fails, since i802_set_wds_sta() can create the interface and then fail at the bridge add or at the VLAN move of the station. When the marked link station of a non-AP MLD is freed while another link station stays, the mark passes to it. uc_hostapd_bss_rename() renames the AP_VLANs of the entries with WLAN_STA_WDS. A Multi-AP backhaul AP_VLAN and a WDS AP_VLAN whose mark passed to a link station without the flag kept the old name, so the free missed them and netifd matched them to no vif or to the wrong one. Rename the AP_VLAN of each entry that holds the mark. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000069e29aef383951d0da0fbbd932ffae455c2abbf1hostapd: remove the AP_VLAN of a WDS station from the entry that made iteditpackage/network/services/hostapd/patches/882-AP-MLD-keep-the-pending-RADIUS-messages-of-a-non-AP-.patcheditpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patcheditpackage/network/services/hostapd/patches/868-AP-MLD-keep-the-session-timers-of-a-moved-associatio.patcheditpackage/network/services/hostapd/src/src/ap/ucode.caddpackage/network/services/hostapd/patches/835-AP-Remove-the-AP_VLAN-of-a-WDS-station-from-the-entr.patchpackage/network/ipv6/odhcp6c/Makefilepackage/network/ipv6/odhcp6c/patches/100-ubus-keep-reconnecting-after-a-ubusd-restart.patch64badc4891538bc7902db560beb84d8d892727ab1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.nameodhcp6c: keep reconnecting to ubus after a ubusd restart On a lost ubus connection, odhcp6c tries one reconnect, then frees the context while main() still polls its socket and holds its pointer. After a ubusd restart odhcp6c spins at full CPU, the odhcp6c.<ifname> object never comes back, and the exit frees the context a second time. Add a patch that keeps the context and retries the connection from the main loop once per second. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000064badc4891538bc7902db560beb84d8d892727abodhcp6c: keep reconnecting to ubus after a ubusd restartaddpackage/network/ipv6/odhcp6c/patches/100-ubus-keep-reconnecting-after-a-ubusd-restart.patcheditpackage/network/ipv6/odhcp6c/Makefilepackage/network/services/dnsmasq/Makefilepackage/network/services/dnsmasq/patches/200-ubus_dns.patchb76d1aa387dd2ce7f8881d498bb471b884b73fcd1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namednsmasq: register the dnsmasq.dns type again after a lost ubus connection ubus_destroy() clears the ids of the dnsmasq object and its type, but not those of dnsmasq.dns. When dnsmasq connects again after a ubusd restart, it adds dnsmasq.dns with the type id of the old ubusd. A ubusd that does not know the id creates the object without a type, which no lookup finds, so subscribers of dnsmasq.dns cannot come back. Clear both ids in ubus_destroy(), so that the add registers the type again. A stale type id can also name a type of another client of the new ubusd, so the object can get the wrong type. Also allocate the dnsmasq.dns name once, instead of at every connection attempt, which leaked the name of each attempt. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000b76d1aa387dd2ce7f8881d498bb471b884b73fcddnsmasq: register the dnsmasq.dns type again after a lost ubus connectioneditpackage/network/services/dnsmasq/Makefileeditpackage/network/services/dnsmasq/patches/200-ubus_dns.patchpackage/network/services/dnsmasq/Makefilepackage/network/services/dnsmasq/patches/210-ubus-free-a-lost-connection-only-from-check_ubus_lis.patchceb8710238aca1850d0eef877696ed03ab86d19e1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namednsmasq: free a lost ubus connection only from the main loop When ubusd goes away, the ubus connection_lost callback of dnsmasq frees the context while libubus still uses it: check_ubus_listeners() reads the freed context right after ubus_handle_event(), and a wait in ubus_complete_request() reads it after the callback returns. Add a patch that leaves the context alone in the callback and frees it in check_ubus_listeners(), after which the main loop connects again through ubus_init(). Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000ceb8710238aca1850d0eef877696ed03ab86d19ednsmasq: free a lost ubus connection only from the main loopeditpackage/network/services/dnsmasq/Makefileaddpackage/network/services/dnsmasq/patches/210-ubus-free-a-lost-connection-only-from-check_ubus_lis.patchpackage/network/services/dnsmasq/Makefilepackage/network/services/dnsmasq/patches/220-ubus-wake-the-main-loop-while-waiting-to-connect-aga.patch7e4c82ba69e256d4e1cfe83bffbd4d6c41a0fa0b1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namednsmasq: retry the ubus connection without traffic After a lost ubus connection, dnsmasq calls ubus_init() again only when poll() returns. Without DNS or DHCP traffic nothing wakes poll(), so the dnsmasq objects stay absent after a ubusd restart. Add a patch that wakes the main loop every second while the ubus connection is missing, as dnsmasq already does for DBus. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00007e4c82ba69e256d4e1cfe83bffbd4d6c41a0fa0bdnsmasq: retry the ubus connection without trafficeditpackage/network/services/dnsmasq/Makefileaddpackage/network/services/dnsmasq/patches/220-ubus-wake-the-main-loop-while-waiting-to-connect-aga.patchpackage/kernel/mac80211/patches/subsys/361-mac80211-estimate-expected-throughput-if-not-provide.patche4d08564634d847b1d2f3312c529685d13c5cb021793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: fix suspicious RCU usage in expected throughput estimation sta_estimate_expected_throughput() reads the channel context with rcu_dereference(), but its caller sta_set_sinfo() runs under the wiphy mutex without the RCU read lock. With PROVE_RCU, a station dump or a station removal of a station without an expected throughput from rate control warns: WARNING: suspicious RCU usage net/mac80211/sta_info.c:3120 suspicious rcu_dereference_check() usage! sta_set_sinfo+0xb5f/0xb70 __sta_info_destroy_part2+0x10f/0x250 __sta_info_flush+0x198/0x250 ieee80211_set_disassoc+0x701/0x960 Use sdata_dereference(), since every caller of sta_set_sinfo() holds the wiphy mutex, like the other per-station reads in sta_set_sinfo(). Fixes: f10732fb5632 ("mac80211: estimate expected throughput if not provided by driver/rc") Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000e4d08564634d847b1d2f3312c529685d13c5cb02mac80211: fix suspicious RCU usage in expected throughput estimationeditpackage/kernel/mac80211/patches/subsys/361-mac80211-estimate-expected-throughput-if-not-provide.patchpackage/kernel/mac80211/patches/subsys/462-wifi-mac80211-remove-the-stations-of-an-AP-VLAN-befo.patch9983e8caab65e71d27ff44ab3329381d398445d41793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: remove the stations of an AP VLAN before its links An AP VLAN of an AP MLD that went down with its station on it, by ifdown or by removing the radio, made ieee80211_vif_update_links() warn at its station flush, because ieee80211_do_stop() cleared the links of the VLAN before it flushed its stations. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00009983e8caab65e71d27ff44ab3329381d398445d4mac80211: remove the stations of an AP VLAN before its linksaddpackage/kernel/mac80211/patches/subsys/462-wifi-mac80211-remove-the-stations-of-an-AP-VLAN-befo.patchpackage/network/services/hostapd/patches/843-DSCP-hostapd-control-interface-for-configuring-DSCP-.patchpackage/network/services/hostapd/files/hostapd-full.configpackage/network/services/hostapd/patches/845-DSCP-Building-and-sending-Unsolicited-DSCP-policy-re.patchpackage/network/services/hostapd/patches/842-DSCP-Advertise-Wi-Fi-Alliance-Capabilities-element-i.patchpackage/network/services/hostapd/patches/841-DSCP-Policy-capability-configuration-in-AP-mode.patchpackage/network/services/hostapd/patches/846-DSCP-Parse-policy-queries-and-send-solicitied-reques.patchpackage/network/services/hostapd/patches/844-DSCP-Allow-DSCP-policy-to-be-attached-to-an-associat.patchpackage/network/services/hostapd/patches/868-AP-MLD-keep-the-session-timers-of-a-moved-associatio.patchpackage/network/services/hostapd/patches/882-AP-MLD-keep-the-pending-RADIUS-messages-of-a-non-AP-.patchpackage/network/services/hostapd/patches/884-AP-MLD-move-the-DSCP-Policy-state-of-a-moved-associa.patchpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patchpackage/network/services/hostapd/patches/847-DSCP-Handle-DSCP-Policy-Response-frames-from-STA.patchpackage/network/services/hostapd/patches/840-DSCP-Check-STA-capability-for-DSCP-policy.patch3797d138c3211f771b0601e2d920cc18c9bd1fb91793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: backport the AP side of QoS Management DSCP Policy hostap main holds the AP side of DSCP Policy (Wi-Fi QoS Management Specification v4.0, section 3.4) since 220bb242f6d4 to d4638304acf8, after the 2.12 branch point that the package pins. Backport the eight commits that change hostapd as patches 840 to 847, with the upstream authorship. Each patch header names the context it was adapted to. d4638304acf8 adds hwsim tests only, which the package does not build, so it is left out. Enable CONFIG_ROBUST_AV in the full variant, so that hostapd takes enable_dscp_policy_capa, advertises the Wi-Fi Alliance Capabilities element and answers DSCP Policy Query frames. hostapd_ml_move_assoc_sta() of patch 836 moves the association of a non-AP MLD to another link STA, and the old STA is then freed with its DSCP policies. Add patch 884, which moves the policies, the DSCP Policy state and the dialog token to the new association STA. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00003797d138c3211f771b0601e2d920cc18c9bd1fb9hostapd: backport the AP side of QoS Management DSCP Policyaddpackage/network/services/hostapd/patches/843-DSCP-hostapd-control-interface-for-configuring-DSCP-.patchaddpackage/network/services/hostapd/patches/840-DSCP-Check-STA-capability-for-DSCP-policy.patcheditpackage/network/services/hostapd/patches/882-AP-MLD-keep-the-pending-RADIUS-messages-of-a-non-AP-.patchaddpackage/network/services/hostapd/patches/847-DSCP-Handle-DSCP-Policy-Response-frames-from-STA.patchaddpackage/network/services/hostapd/patches/842-DSCP-Advertise-Wi-Fi-Alliance-Capabilities-element-i.patcheditpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patchaddpackage/network/services/hostapd/patches/841-DSCP-Policy-capability-configuration-in-AP-mode.patchaddpackage/network/services/hostapd/patches/844-DSCP-Allow-DSCP-policy-to-be-attached-to-an-associat.patchaddpackage/network/services/hostapd/patches/845-DSCP-Building-and-sending-Unsolicited-DSCP-policy-re.patcheditpackage/network/services/hostapd/files/hostapd-full.configeditpackage/network/services/hostapd/patches/868-AP-MLD-keep-the-session-timers-of-a-moved-associatio.patchaddpackage/network/services/hostapd/patches/846-DSCP-Parse-policy-queries-and-send-solicitied-reques.patchaddpackage/network/services/hostapd/patches/884-AP-MLD-move-the-DSCP-Policy-state-of-a-moved-associa.patchpackage/network/services/hostapd/patches/849-DSCP-remove-an-invalidated-policy-from-the-list-of-t.patch11fd9aa2463dacf5626caf1683fdf5b9021c59431793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: DSCP: remove an invalidated policy from the station's list invalidate_policy_by_id() of the backported DSCP Policy code left a NULL entry in the policy list of the station, which the response handler and the query match then dereference, and leaked the policy. Patch 849 removes the entry and frees it. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000011fd9aa2463dacf5626caf1683fdf5b9021c5943hostapd: DSCP: remove an invalidated policy from the station's listaddpackage/network/services/hostapd/patches/849-DSCP-remove-an-invalidated-policy-from-the-list-of-t.patchpackage/network/services/hostapd/patches/850-hostapd-report-DSCP-Policy-Query-and-Response-frames.patchpackage/network/services/hostapd/patches/851-hostapd-DSCP-send-a-DSCP-Policy-Request-with-given-e.patchpackage/network/services/hostapd/src/src/ap/ubus.cpackage/network/services/hostapd/patches/852-build_features-indicate-CONFIG_ROBUST_AV.patch1247a1642323b3784f8d70e7b8143da7b34e850d1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: report DSCP Policy frames on ubus, send raw DSCP Policy Requests Let user space see every DSCP Policy Query and Response body, and send QoS Management elements that it builds to a station in an unsolicited DSCP Policy Request, without DSCP Policy state in hostapd: - patch 850: report both frames as the action-frame notification, types dscp-query and dscp-response, with the body from the Category octet; - patch 851 and the ubus method dscp_policy_request {addr, elements, reset}: send the given QoS Management elements unchanged with the station's next Dialog Token, and reply with that token. NOT_SUPPORTED where the BSS has no enable_dscp_policy_capa or the station did not set the DSCP Policy bit of its Wi-Fi Alliance Capabilities element, NOT_FOUND for an unknown station, INVALID_ARGUMENT for elements that are not whole QoS Management elements or do not fit in one frame; The method finds the station on the link of an AP MLD that holds it, as the other station methods do; - patch 852: `hostapd -vrobust-av` answers whether the build holds CONFIG_ROBUST_AV. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00001247a1642323b3784f8d70e7b8143da7b34e850dhostapd: report DSCP Policy frames on ubus, send raw DSCP Policy Requestsaddpackage/network/services/hostapd/patches/850-hostapd-report-DSCP-Policy-Query-and-Response-frames.patchaddpackage/network/services/hostapd/patches/852-build_features-indicate-CONFIG_ROBUST_AV.patchaddpackage/network/services/hostapd/patches/851-hostapd-DSCP-send-a-DSCP-Policy-Request-with-given-e.patcheditpackage/network/services/hostapd/src/src/ap/ubus.cpackage/network/services/hostapd/src/src/ap/ubus.hpackage/network/services/hostapd/patches/885-hostapd-advertise-the-QoS-Management-SCS-Traffic-Des.patchpackage/network/services/hostapd/patches/857-hostapd-add-the-configuration-option-robust_av_scs_d.patchpackage/network/services/hostapd/patches/860-build_features-indicate-the-SCS-and-MSCS-handling.patchpackage/network/services/hostapd/src/src/ap/ubus.cpackage/network/services/hostapd/patches/869-hostapd-keep-the-SCSIDs-of-a-station-one-space.patchpackage/network/services/hostapd/patches/862-hostapd-install-SCS-and-MSCS-rules-that-the-AP-confi.patchpackage/network/services/hostapd/patches/853-nl80211-install-SCS-and-MSCS-through-NL80211_CMD_SET.patchpackage/network/services/hostapd/patches/855-hostapd-handle-MSCS-requests-in-AP-mode.patchpackage/network/services/hostapd/patches/854-hostapd-handle-SCS-Requests-in-AP-mode.patchpackage/network/services/hostapd/patches/856-hostapd-add-the-control-command-DEL_MSCS.patchpackage/network/services/hostapd/patches/868-AP-MLD-keep-the-session-timers-of-a-moved-associatio.patchpackage/network/services/hostapd/patches/859-hostapd-report-SCS-and-MSCS-requests-on-ubus-and-app.patchpackage/network/services/hostapd/patches/861-nl80211-pass-a-client-with-SCS-and-MSCS-descriptors.patchpackage/network/services/hostapd/patches/858-hostapd-advertise-SCS-and-MSCS-where-the-driver-inst.patchpackage/network/services/hostapd/patches/884-AP-MLD-move-the-DSCP-Policy-state-of-a-moved-associa.patchpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patcha554261872ad44da8386434db4ce2f15ac75210f1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: handle SCS and MSCS requests in AP mode The kernel (mac80211 subsys patches 431 to 450 and 465 to 467) classifies the streams that a station requests with SCS and MSCS, and takes them through NL80211_CMD_SET_SCS and NL80211_CMD_SET_MSCS. hostapd answers no such request in AP mode, so a station gets no response. Port the AP side of the MediaTek feed (Howard Hsu), with the vendor driver calls replaced by the nl80211 commands, under CONFIG_ROBUST_AV: - patch 853: the nl80211 commands and attributes, the driver flags WPA_DRIVER_FLAGS2_SCS/_MSCS and the driver operations set_scs() and set_mscs(); - patch 854: SCS Request frames, downlink and uplink descriptors and any number of descriptors per frame, with the TCLAS, TCLAS Processing and QoS Characteristics elements as received; an Add of an active SCSID and a Change or Remove of one that is not active are declined; - patch 855: MSCS Request frames and the MSCS Descriptor element of a (Re)Association Request, with every TCLAS Mask element as received; - patch 856: the control command DEL_MSCS, which fails for a station without an MSCS; - patch 857: the BSS option robust_av_scs_disabled; - patch 858: the SCS and Mirrored SCS bits of the Extended Capabilities element where the driver installs the services, and no SCS Traffic Description Support without SCS. Report the requests and let user space configure rules: - patch 859 and the robust-av ubus notification: each request that hostapd accepted with Request Type Add or Change, each request with Request Type Remove and each rule that hostapd removed itself (the driver entry of the station was removed, or DEL_MSCS), with the descriptor element as received, its status, and a Remove descriptor that hostapd builds for a rule it removed; the requests of a station of the disallow lists are declined with REQUEST_DECLINED; - the ubus method robust_av_disallow {mscs, scs}, which replaces the disallow lists of the BSS, of every link on the object of an AP MLD; a link that joins the object later takes a copy of the lists; - patch 860: `hostapd -vrobust-av-scs` answers whether the build handles SCS and MSCS; - patch 861: nl80211_copy.h gets NL80211_SCS_DESC_ATTR_CLIENT, NL80211_MSCS_DESC_ATTR_CLIENT and NL80211_MSCS_DESC_ATTR_CONFIGURED, and the driver ops send them; - patch 862: hostapd_robust_av_configure() installs, changes or removes a rule that the AP configures for a station, also for a host behind the 4-address backhaul station of another AP, from a whole SCS or MSCS Descriptor element; the request paths share its parsers. It and DEL_MSCS find the associated station on every link of an AP MLD and act on the BSS of its association link; - patch 869: the kernel identifies an SCS rule of a peer by its SCSID alone, so hostapd keeps the SCSIDs of the configured rules of a station. A configured rule with the SCSID of a request of the station is refused, and an Add of the station with the SCSID of a configured rule removes that rule first and reports the removal on ubus; - the ubus method robust_av_configure {addr, client, kind, element}, reply { status } or { busy }. It finds the station on the link of an AP MLD that holds it. An AP that enables QoS Management SCS Traffic Description also sets bit 2 of the Capabilities field of its Wi-Fi Alliance Capabilities element (Wi-Fi QoS Management v4.0, 3.3). Without the bit, wpa_supplicant refuses an SCS Request with a QoS Characteristics element on a connection that is not EHT. Patch 885 sets it where hostapd keeps the EHT subfield, for every station and also on a BSS without EHT. A move of the association of a non-AP MLD to another link STA moves its SCS streams, its MSCS and the SCSIDs of its configured rules as well. Felix Fietkau is the author of the ports, with Howard Hsu as co-developer. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000a554261872ad44da8386434db4ce2f15ac75210fhostapd: handle SCS and MSCS requests in AP modeaddpackage/network/services/hostapd/patches/856-hostapd-add-the-control-command-DEL_MSCS.patchaddpackage/network/services/hostapd/patches/862-hostapd-install-SCS-and-MSCS-rules-that-the-AP-confi.patcheditpackage/network/services/hostapd/src/src/ap/ubus.caddpackage/network/services/hostapd/patches/861-nl80211-pass-a-client-with-SCS-and-MSCS-descriptors.patcheditpackage/network/services/hostapd/patches/884-AP-MLD-move-the-DSCP-Policy-state-of-a-moved-associa.patchaddpackage/network/services/hostapd/patches/854-hostapd-handle-SCS-Requests-in-AP-mode.patcheditpackage/network/services/hostapd/patches/868-AP-MLD-keep-the-session-timers-of-a-moved-associatio.patchaddpackage/network/services/hostapd/patches/855-hostapd-handle-MSCS-requests-in-AP-mode.patchaddpackage/network/services/hostapd/patches/859-hostapd-report-SCS-and-MSCS-requests-on-ubus-and-app.patchaddpackage/network/services/hostapd/patches/858-hostapd-advertise-SCS-and-MSCS-where-the-driver-inst.patcheditpackage/network/services/hostapd/src/src/ap/ubus.haddpackage/network/services/hostapd/patches/857-hostapd-add-the-configuration-option-robust_av_scs_d.patchaddpackage/network/services/hostapd/patches/860-build_features-indicate-the-SCS-and-MSCS-handling.patchaddpackage/network/services/hostapd/patches/869-hostapd-keep-the-SCSIDs-of-a-station-one-space.patchaddpackage/network/services/hostapd/patches/853-nl80211-install-SCS-and-MSCS-through-NL80211_CMD_SET.patcheditpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patchaddpackage/network/services/hostapd/patches/885-hostapd-advertise-the-QoS-Management-SCS-Traffic-Des.patchpackage/network/services/hostapd/patches/853-nl80211-install-SCS-and-MSCS-through-NL80211_CMD_SET.patchpackage/network/services/hostapd/patches/838-nl80211-keep-the-netdev-of-a-BSS-that-becomes-the-fi.patchdc56066839acfc4a1712b714c4e034063e521d301793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: keep the netdev of a BSS that becomes the first BSS The ucode BSS deletion and set_bss_order make another BSS the first BSS of an interface with set_first_bss(). Its netdev can be one that hostapd created. A DISABLE of the interface on a shared driver then removed that netdev, and the next ENABLE failed in the driver init, which finds the shared driver through the netdev of the first BSS. New patch 838: set_first_bss() clears added_if of the new first BSS, so its netdev stays at a deinit, and moves drv->ifindex to it, as the removal of a first BSS does. The old first BSS keeps its flag. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000dc56066839acfc4a1712b714c4e034063e521d30hostapd: keep the netdev of a BSS that becomes the first BSSeditpackage/network/services/hostapd/patches/853-nl80211-install-SCS-and-MSCS-through-NL80211_CMD_SET.patchaddpackage/network/services/hostapd/patches/838-nl80211-keep-the-netdev-of-a-BSS-that-becomes-the-fi.patchpackage/network/services/hostapd/src/src/ap/ucode.cpackage/network/services/hostapd/patches/853-nl80211-install-SCS-and-MSCS-through-NL80211_CMD_SET.patchpackage/network/services/hostapd/files/hostapd.ucpackage/network/services/hostapd/patches/834-AP-MLD-free-the-data-of-a-removed-affiliated-AP-at-t.patchpackage/network/services/hostapd/patches/836-AP-MLD-keep-the-association-of-a-non-AP-MLD-at-a-lin.patchpackage/network/services/hostapd/src/src/ap/ucode.h3a50215a24a6c73ea672070faf97d377fbc738c71793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: free the data of a removed MLD link at the expiry At the end of an AP MLD link removal, hostapd_link_remove_finish() takes the BSS out of the AP MLD and leaves its stations and its data for the ucode bss_link_removed hook to delete. Every other path frees the BSS data right after it leaves the AP MLD. Where the BSS outlives the hook (hwsim, or a hook that returns early), it keeps references to the objects the links share. Once the other links are gone, hostapd_mld_is_first_bss() returns true for it, and the removal of its interface frees the shared IEEE 802.1X authenticator a second time ("invalid magic" in eapol_auth_deinit()). Its kept MLD station entry also left a stale wpa_sm pointer, and a new association of that station on another link crashed in wpa_auth_sta_set_vlan(). Free the stations before the BSS leaves the AP MLD and its data after, in a new patch 834. Remove the link from the driver at the expiry too, also for a BSS that is bss[0] of its interface, and clear its drv_priv. A later deletion of the stopped BSS then sends no flush without a link ID, which would remove the stations of the other links. The stopped BSS can stay in the BSS list of its interface, with no drv_priv. hostapd_set_freq() and hostapd_start_dfs_cac() did not test drv_priv, so the ucode start of an enabled interface, which calls hostapd_set_freq() for each BSS, crashed in nl80211_set_channel() where the stopped BSS was bss[0]. Both functions now return without drv_priv, as the driver wrappers around them do. The ucode start also skips a BSS that is not started. The stopped BSS no longer stays bss[0] of its interface, which holds the driver handle and the enabled state of the interface: an ADD of a BSS on that interface crashed in wpa_driver_nl80211_if_add(), and DISABLE answered "already disabled" while another BSS ran. Where the interface has another BSS, the stopped BSS moves behind the others and the next BSS becomes the first, as the ucode BSS deletion does (needs patch 838 for a later DISABLE and ENABLE). Where it was the only BSS, the interface state becomes DISABLED, as upstream leaves it. Patch 836 is refreshed for the new offsets. hostapd now frees the ucode object of the BSS before the hook, so: - hostapd.uc mld_link_bss_remove() takes the BSS from the hook's argument, not from hostapd.bss, which still holds the released object; - hostapd_interface_free() drops the ucode registry entry of each BSS without an event, for the new object that the hook makes when it removes the whole interface. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00003a50215a24a6c73ea672070faf97d377fbc738c7hostapd: free the data of a removed MLD link at the expiryeditpackage/network/services/hostapd/src/src/ap/ucode.ceditpackage/network/services/hostapd/patches/836-AP-MLD-keep-the-association-of-a-non-AP-MLD-at-a-lin.patcheditpackage/network/services/hostapd/patches/853-nl80211-install-SCS-and-MSCS-through-NL80211_CMD_SET.patcheditpackage/network/services/hostapd/src/src/ap/ucode.heditpackage/network/services/hostapd/files/hostapd.ucaddpackage/network/services/hostapd/patches/834-AP-MLD-free-the-data-of-a-removed-affiliated-AP-at-t.patchpackage/kernel/mac80211/patches/subsys/475-wifi-mac80211-mark-frames-whose-priority-does-not-fo.patch9e76276c807558e75f5b723087e0ad6eb7fc0fe11793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: mark frames whose priority does not follow the DSCP A device that encapsulates 802.3 frames in firmware takes the TID from the DSCP with a mapping of its own (mt7996 SDO), so a priority that user space sets from a DSCP mapping of its own, a VLAN PCP or a QoS map does not reach the air. Add patch 475, which marks these frames with IEEE80211_TX_CTRL_EXPLICIT_UP, so that the driver can hand their priority to the device. A frame without a DSCP is expected at priority 0. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00009e76276c807558e75f5b723087e0ad6eb7fc0fe1mac80211: mark frames whose priority does not follow the DSCPaddpackage/kernel/mac80211/patches/subsys/475-wifi-mac80211-mark-frames-whose-priority-does-not-fo.patchpackage/network/services/hostapd/patches/864-AP-MLD-move-the-VLAN-list-also-when-one-link-remains.patch2c2c5c5e2e040d98df2a2e78aad0b20bee2ddd0d1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: move the VLAN list of an AP MLD also when one link remains hostapd_mld_remove_link() moves the VLAN list of an AP MLD to the new first BSS only where that BSS is not the last link, since upstream commit aa7a038e088f ("AP MLD: Move VLAN list when the first link (BSS) is removed"). When the first of two links is removed, the remaining link reads its own list, which holds only the wildcard entry. A GTK rekey of a VLAN group then ends in FATAL_FAILURE, and the AP_VLAN netdev stays after its last station, so the next station of that VLAN fails its VLAN assignment and its association (status 53 after SAE). Add patch 864: move the list to every new first BSS and free the new first BSS's own list, which the AP MLD does not read. The header marks it as an upstream fix. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00002c2c5c5e2e040d98df2a2e78aad0b20bee2ddd0dhostapd: move the VLAN list of an AP MLD also when one link remainsaddpackage/network/services/hostapd/patches/864-AP-MLD-move-the-VLAN-list-also-when-one-link-remains.patchpackage/network/services/hostapd/patches/865-AP-MLD-count-the-AP_VLAN-reference-of-a-link-STA.patch4c68a350cdea3cf498381631eff8e242025d0f9c1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: count the AP_VLAN reference of an MLD link STA ieee80211_ml_process_link() copies the VLAN ID to a link STA without a reference to the dynamic VLAN entry, but ap_free_sta() of that STA drops one for sta->vlan_id and one for sta->vlan_id_bound. Where the VLAN comes from the SAE password, it is assigned before the link STAs exist, so each link STA drops one reference more than it takes. With three links, the AP removal of both partner links removes the AP_VLAN netdev while the station stays associated on its association link. Add patch 865: take the reference where the VLAN ID is copied, as ap_sta_set_vlan() does for an existing entry. The header marks it as an upstream fix. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00004c68a350cdea3cf498381631eff8e242025d0f9chostapd: count the AP_VLAN reference of an MLD link STAaddpackage/network/services/hostapd/patches/865-AP-MLD-count-the-AP_VLAN-reference-of-a-link-STA.patchpackage/network/services/hostapd/patches/866-AP-MLD-bind-the-VLAN-of-a-link-added-by-Link-Reconfi.patchpackage/network/services/hostapd/patches/867-AP-MLD-delete-the-keys-of-a-freed-VLAN-group.patchcf660e88b5c0d3ad854f8af085ca63c1c10e2dc21793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: bind the VLAN of a link added by Link Reconfiguration hostapd_ml_process_reconf_link() sets up a link STA for an added link, but does not bind it to the VLAN of the non-AP MLD, as ap_sta_bind_vlan() does for each partner link at association. The link takes no reference to the VLAN group of its authenticator. Its Link Reconfiguration Response carries the default group's GTK where that authenticator has no group of the VLAN, and a later release of the link frees the VLAN group while another station still uses it. Add patch 866: bind the added link STA alone before the response is built; ap_sta_bind_vlan() would take a second group reference on each partner link. The bind leaves the driver VLAN alone: the driver holds one station for the MLD, which the association put on its AP_VLAN or WDS interface, and a move would take a Multi-AP backhaul STA off its WDS interface. The header marks it as an upstream fix. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000cf660e88b5c0d3ad854f8af085ca63c1c10e2dc2hostapd: bind the VLAN of a link added by Link Reconfigurationaddpackage/network/services/hostapd/patches/866-AP-MLD-bind-the-VLAN-of-a-link-added-by-Link-Reconfi.patchaddpackage/network/services/hostapd/patches/867-AP-MLD-delete-the-keys-of-a-freed-VLAN-group.patchpackage/network/services/hostapd/files/hostapd.uc21b47bd63f6713fc3b38e5ca63479ab6a56e3c8d1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: announce the removal of an MLD link before a radio restart A configuration change that restarts a radio (iface_restart(), for a channel change of a radio with an AP MLD link or a change of a radio line) stops each link of that radio without a frame to the non-AP MLDs that hold it. The link beacons again after the restart with the same BSSID, so a non-AP MLD that is not told keeps sending on it. Where the link's own BSS stays the same, announce an AP removal of the link with a count of 10 first, and restart the radio at its expiry, as IEEE 802.11be-2024 35.3.6.3 describes for the removal of an affiliated AP. A non-AP MLD then drops the link and keeps its association over its other links. The bss_link_removed hook of such a removal restarts the radio and keeps it in the AP MLD; a removal that umapd asks for still takes the link out. A configuration that arrives during the countdown replaces the one the restart applies. The radio restarts at once, as before, where hostapd refuses the removal (the last link that beacons, a channel or colour switch, an MBSSID set) or where the link's own BSS changes, since its stations must associate again. Where hostapd keeps the link at the expiry, the restart follows one second after the latest time the removal names. A teardown, a configuration without a BSS and another restart of the radio end the wait. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000021b47bd63f6713fc3b38e5ca63479ab6a56e3c8dhostapd: announce the removal of an MLD link before a radio restarteditpackage/network/services/hostapd/files/hostapd.ucpackage/kernel/mac80211/patches/subsys/480-wifi-mac80211-keep-the-priority-of-an-802.3-frame-fo.patch8e852c996276df5a485332dad3b2390fc31ad9621793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: keep the priority of an 802.3 frame for the slow path While the aggregation session of a TID is not operational, the encap offload path hands a frame to the slow path, which classifies it a second time. A priority of 256 to 263, which user space can set from a DSCP mapping of its own, is then lost, and the first frames of a new flow go out with the TID of the DSCP. Give the slow path the priority the frame had on entry. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00008e852c996276df5a485332dad3b2390fc31ad962mac80211: keep the priority of an 802.3 frame for the slow pathaddpackage/kernel/mac80211/patches/subsys/480-wifi-mac80211-keep-the-priority-of-an-802.3-frame-fo.patchpackage/kernel/mac80211/patches/subsys/476-wifi-nl80211-set-the-TID-to-link-mapping-of-a-statio.patchpackage/kernel/mac80211/patches/subsys/477-wifi-mac80211-pass-the-TID-to-link-mapping-of-a-stat.patch3101d77a481e5cbfcf983147e2dc48a407401a7c1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: set the negotiated TID-to-link mapping of an AP MLD station An AP MLD that negotiates a TID-to-link mapping with an associated non-AP MLD has no way to pass the mapping to the driver: NL80211_CMD_SET_TID_TO_LINK_MAPPING serves a non-AP MLD interface only. Accept the command on an AP interface with the MLD address of the station, where the driver declares the new extended feature NL80211_EXT_FEATURE_AP_NEG_TTLM, and pass the mapping to the driver with a new driver op. Based on the MediaTek feed patches 0084 and 0085 by Michael-CY Lee, reworked onto the upstream command in place of a private one. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00003101d77a481e5cbfcf983147e2dc48a407401a7cmac80211: set the negotiated TID-to-link mapping of an AP MLD stationaddpackage/kernel/mac80211/patches/subsys/476-wifi-nl80211-set-the-TID-to-link-mapping-of-a-statio.patchaddpackage/kernel/mac80211/patches/subsys/477-wifi-mac80211-pass-the-TID-to-link-mapping-of-a-stat.patchpackage/network/services/hostapd/patches/872-AP-MLD-answer-a-TID-to-link-mapping-in-an-associatio.patchpackage/network/services/hostapd/patches/870-nl80211-set-the-TID-to-link-mapping-of-a-non-AP-MLD.patchpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patchpackage/network/services/hostapd/patches/871-AP-MLD-answer-a-TID-to-link-mapping-negotiation.patch25cde366f66aede5ec6beb132ad3977eae87c72e1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: answer the TID-to-link mapping negotiation of a non-AP MLD An AP MLD ignores the TID-To-Link Mapping Request and Teardown frames of a non-AP MLD and a TID-To-Link Mapping element in its (Re)Association Request frame, so the station gets no answer and the driver never gets the mapping. Answer a request where the driver applies a negotiated mapping: accept a valid mapping and set it in the driver once the Response frame is acknowledged, deny one with status 133 otherwise, and answer a rejected mapping of an association with the default mapping as the preferred one. Ports of the MediaTek feed patch 0129 and its fixes 0274, 0280, 0287, 0288, 0290 and 0291, adapted to the advertised mapping of patch 609. Only the links that the station set up with success count as its links, so that no mapping names a refused link, and a mapping of an association request that names a link the response refuses is rejected with the default mapping as the preferred one. A move of the association of a non-AP MLD to another link STA moves the negotiated mapping as well. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000025cde366f66aede5ec6beb132ad3977eae87c72ehostapd: answer the TID-to-link mapping negotiation of a non-AP MLDaddpackage/network/services/hostapd/patches/872-AP-MLD-answer-a-TID-to-link-mapping-in-an-associatio.patchaddpackage/network/services/hostapd/patches/871-AP-MLD-answer-a-TID-to-link-mapping-negotiation.patcheditpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patchaddpackage/network/services/hostapd/patches/870-nl80211-set-the-TID-to-link-mapping-of-a-non-AP-MLD.patchpackage/network/services/hostapd/patches/873-AP-MLD-advertise-TID-to-link-mapping-negotiation-sup.patchfaed64df44a49a1de7ae7424c4f44b5ebf5dc6681793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: advertise TID-to-link mapping negotiation support hostapd clears the TID-To-Link Mapping Negotiation Support subfield of the driver's MLD capabilities, since the AP MLD answered no negotiation. Advertise the value of the driver where the driver applies a negotiated mapping (NL80211_EXT_FEATURE_AP_NEG_TTLM). Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000faed64df44a49a1de7ae7424c4f44b5ebf5dc668hostapd: advertise TID-to-link mapping negotiation supportaddpackage/network/services/hostapd/patches/873-AP-MLD-advertise-TID-to-link-mapping-negotiation-sup.patchpackage/kernel/mac80211/patches/subsys/479-wifi-mac80211-wait-for-RCU-only-when-a-vif-link-is-r.patch0ef61fcd02284d4b9175c9ea132e4052c3bbc8721793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: wait for RCU only when a vif link is removed Add subsys patch 479. A Link Reconfiguration add of a 4-address station updates the links of its AP VLAN (patch 461), and that update waits for an RCU grace period although it removes no link. The wait comes before hostapd sends the Link Reconfiguration Response, which a mac80211 station expects within 100 ms. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00000ef61fcd02284d4b9175c9ea132e4052c3bbc872mac80211: wait for RCU only when a vif link is removedaddpackage/kernel/mac80211/patches/subsys/479-wifi-mac80211-wait-for-RCU-only-when-a-vif-link-is-r.patchpackage/network/services/hostapd/patches/874-MLD-STA-move-the-association-link-off-a-removed-link.patch1be9a8d1ba4ce221f0055627ca6e2ba8eede23a81793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: move the association link of an MLD station off a removed link After a link removal, wpa_supplicant kept the association link id and assoc_freq of the removed link, so Action frames sent on assoc_freq, the BTM Response and the DPP frames of the ucode API among them, went off-channel to a channel that the AP MLD no longer uses. Take the lowest remaining link and its frequency. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00001be9a8d1ba4ce221f0055627ca6e2ba8eede23a8hostapd: move the association link of an MLD station off a removed linkaddpackage/network/services/hostapd/patches/874-MLD-STA-move-the-association-link-off-a-removed-link.patchpackage/network/services/hostapd/patches/876-AP-MLD-reset-an-associated-non-AP-MLD-at-a-new-assoc.patcha9d651dd95358ba18ae0e1caef4a7b61e0ac8ef31793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: reset an associated non-AP MLD at a new association A non-AP MLD that is associated and sends a new (Re)Association Request without a new Authentication keeps its station entries in handle_assoc(). ieee80211_ml_process_link() then refuses every partner link with "MLD: link: Station already exists", and add_associated_sta() removes the station from the driver with all its links. The response refuses the partner links, while hostapd keeps their entries without a driver station. Reset such a non-AP MLD as patch 181 does after a timed out SA Query, which removes the entries of the other links before they are processed again (IEEE 802.11be-2024 11.3.5.3 l). An authorized non-AP MLD with PMF reaches this point only after its SA Query timed out, because check_sa_query() refuses it before. A request on another link than the association link makes that link the association link, so that the reset adds the non-AP MLD again on it instead of only a link of the station that it removes. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000a9d651dd95358ba18ae0e1caef4a7b61e0ac8ef3hostapd: reset an associated non-AP MLD at a new associationaddpackage/network/services/hostapd/patches/876-AP-MLD-reset-an-associated-non-AP-MLD-at-a-new-assoc.patchpackage/network/services/hostapd/patches/877-AP-MLD-find-a-non-AP-MLD-by-its-link-address-for-a-f.patch9e51ee8e1ad210bcbcfb2036bae74177844e86a71793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: find a non-AP MLD by link address for a frame from an unknown STA mac80211 translates the addresses of a frame of a non-AP MLD to the MLD addresses only where it finds the station. Without a driver station, for example in the short time while hostapd removes and adds the station again for a new association, it reports a Data frame with the link address. ieee802_11_rx_from_unknown() looks that address up with ap_get_sta(), which knows a non-AP MLD only by its MLD address, and sends reason 7 to a station that is associated. Look the station up by its link address where ap_get_sta() finds none on a link of an AP MLD. The rules for the station found stay as they are, and a sender that hostapd does not hold still gets the frame. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00009e51ee8e1ad210bcbcfb2036bae74177844e86a7hostapd: find a non-AP MLD by link address for a frame from an unknown STAaddpackage/network/services/hostapd/patches/877-AP-MLD-find-a-non-AP-MLD-by-its-link-address-for-a-f.patchpackage/kernel/mac80211/patches/subsys/481-wifi-mac80211-do-not-send-an-off-channel-frame-after.patchb4bfe07ab16cb97d8d29180842feee6820f353871793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: do not send an off-channel frame after the ROC expired If the wiphy lock is held for longer than a hardware ROC lasts, the driver reports the expiry before mac80211 handles the start of the ROC, and mac80211 then sends the pending frame on the off-channel queue. mac80211_hwsim warns "TX w/o channel - queue = 4" for it. Report such a frame as not acknowledged instead of sending it. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000b4bfe07ab16cb97d8d29180842feee6820f35387mac80211: do not send an off-channel frame after the ROC expiredaddpackage/kernel/mac80211/patches/subsys/481-wifi-mac80211-do-not-send-an-off-channel-frame-after.patchpackage/network/services/hostapd/src/src/ap/ucode.cpackage/network/services/hostapd/patches/878-AP-add-hostapd_bss_stop_ap-for-a-stop-that-keeps-the.patch282560ecfa379dd83a9906edd616adf1582826041793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: ucode: tell and free the stations at an iface stop uc_hostapd_iface_stop() (hostapd.uc apsta_state with up=false) stops each BSS with hostapd_drv_stop_ap() alone. mac80211 drops every station of the BSS, and of an AP MLD every non-AP MLD that holds the stopped link, without a frame and without an event that hostapd acts on. A later iface.start() beacons again with the same BSSID: the stations were not told and keep sending, and hostapd keeps their entries. Tell and free the stations before the stop with the broadcast Deauthentication and reason 3, as ctrl DISABLE does on a disabled BSS with hostapd_bss_deinit_no_free(). The WEP keys stay, since iface.start() does not set them again. The Deauthentication ends the association of a non-AP MLD on all its links, so a non-AP MLD whose association link is another link of the AP MLD is freed on all its links as well. The new hostapd_bss_stop_ap() of patch 878 does both. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000282560ecfa379dd83a9906edd616adf158282604hostapd: ucode: tell and free the stations at an iface stopeditpackage/network/services/hostapd/src/src/ap/ucode.caddpackage/network/services/hostapd/patches/878-AP-add-hostapd_bss_stop_ap-for-a-stop-that-keeps-the.patchtarget/linux/generic/pending-6.18/798-net-ethernet-mtk_wed-free-the-hw_rro-buffers-once-in.patch63a44aefc71bceeeb9d9b2a12a8789dd8f3aed291793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namekernel: mtk_wed: free the hw_rro buffers once in a rx reset mtk_wed_rx_reset() frees the hw_rro buffers a second time after mtk_wed_free_rx_buffer() freed them. The second walk of the freed page list panics the first reset of an MT7996 with hw_rro under WED on MT7988. Add a pending patch that drops the second call. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000063a44aefc71bceeeb9d9b2a12a8789dd8f3aed29kernel: mtk_wed: free the hw_rro buffers once in a rx resetaddtarget/linux/generic/pending-6.18/798-net-ethernet-mtk_wed-free-the-hw_rro-buffers-once-in.patchpackage/network/services/hostapd/files/wpa_supplicant.ucd0c0650b27845e50ad3d8bbc997d55c0edc8f5ed1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewpa_supplicant: fill a new station MLD from the stored radio configs set_config() gives the MLO interface configs of a radio only to the MLD entries that exist at that time, and mld_set_config() starts a new entry with no radio config. After a wpa_supplicant restart, mac80211.sh sends config_set as soon as the new object appears, and this can reach the process before the mld_set of netifd's object add listener. The config of that radio is then lost: the MLD comes up without its link, or stays down for a one-radio MLD, until the next netifd round sends config_set again. Keep the MLO configs of the last config_set on the phy entry and fill each new MLD entry from them, as the config_set would have done. A radio that a phy_set_state stop took after its config_set is not marked present, so mld_start() waits for its start as for any other held radio. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000d0c0650b27845e50ad3d8bbc997d55c0edc8f5edwpa_supplicant: fill a new station MLD from the stored radio configseditpackage/network/services/hostapd/files/wpa_supplicant.ucpackage/network/config/wifi-scripts/files/lib/netifd/wireless.ucpackage/network/config/wifi-scripts/files/lib/netifd/wireless-device.ucb2958254ac34d40eac6f04956b95a5cf6cc383f21793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: set up a changed radio after netifd adds the interfaces Since netifd commit aaf5b194b15d ("proto-ucode: add ucode protocol handler infrastructure"), config_init_all() runs the ucode config_init before config_init_interfaces(). update() then sets a running radio up from inside config_init, and interface_get_bridge() does not find an interface that the same reload adds. A reload that adds a VLAN bridge and moves an AP to it thus sets the radio up without a bridge for that AP, and hostapd replaces the BSS. When the bridge comes up, check_interfaces() sets the radio up again with the bridge, and hostapd replaces the BSS a second time. Do not set up a radio while netifd runs config_init; apply the change in config_start, which netifd calls after interface_start_pending(). update() only marks the change. check_interfaces() does nothing from config_init to config_start: interface_set_up() calls it inside config_init_interfaces() for an interface that the reload reloads, and in interface_start_pending(), before config_start. config_start starts each radio and then sets up a running radio with a change. This is the order of the C wireless code, where __wireless_device_set_up() returned while config_init was set and wireless_start_pending() ran after interface_start_pending(). A radio that the reload creates starts with a change, so config_start reads its bridges again, also where the network has no ifindex yet. A reconf call still sets the radio up at once. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000b2958254ac34d40eac6f04956b95a5cf6cc383f2wifi-scripts: set up a changed radio after netifd adds the interfaceseditpackage/network/config/wifi-scripts/files/lib/netifd/wireless.uceditpackage/network/config/wifi-scripts/files/lib/netifd/wireless-device.ucpackage/network/config/wifi-scripts/files/lib/netifd/wireless.uc7757608b17c7863bd07d462315a9956a4bc822b81793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: skip an MLD whose first radio cannot be resolved wpad_update_mlo() passes the radio config of the first device of an MLO interface to find_phy() without a check. That config is null where the first device of a UCI wifi-iface is not a known wifi-device, and where no device of a service data wifi-iface is known. find_phy() then raises, so the config load stops before it updates any device. Skip such an MLD and log a warning, as for an MLD whose first radio has no phy. Log that case too, which so far dropped the MLD silently. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00007757608b17c7863bd07d462315a9956a4bc822b8wifi-scripts: skip an MLD whose first radio cannot be resolvededitpackage/network/config/wifi-scripts/files/lib/netifd/wireless.ucpackage/network/config/wifi-scripts/files/usr/share/ucode/wifi/utils.uccafa893bc0dfbe58171dcce86689661128f21d281793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: find no phy without sysfs or board.json instead of raising find_phy() raises where /sys/class/ieee80211 is absent: lsdir() returns null, and the path, macaddr and name lookups index the result. It also raises where /etc/board.json is absent and the path or name lookup reads it, because json() rejects the null from readfile(). Take a missing ieee80211 class as no phys, and a missing board.json as no board data, so that find_phy() returns null or the phy that its path matches. Every caller already handles null and logs it. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000cafa893bc0dfbe58171dcce86689661128f21d28wifi-scripts: find no phy without sysfs or board.json instead of raisingeditpackage/network/config/wifi-scripts/files/usr/share/ucode/wifi/utils.ucpackage/network/config/wifi-scripts/files/lib/netifd/wireless.ucpackage/network/config/wifi-scripts/files/lib/netifd/wireless-device.ucd9577c5b5e0463bc12d6473d90e6ac656aae8aff1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: pair every supplicant mld_set with an mld_start wpa_supplicant marks an MLD start pending at every mld_set, also at one that changes nothing, and mld_start() does nothing while that mark stands. netifd sends mld_start only from wireless_config_done(), at the end of a round that ran a handler. A reload that changes no device sends an mld_set but runs no handler, so the mark stays until the next round. A radio that hostapd gives back in that time does not start the station MLD, and the MLD stays down. Send mld_start after netifd started the wireless devices of a config load, if no handler is queued or running at that time. A round that the same load starts keeps the deferral, because its end sends mld_start as before. Do not send the netifd.wireless.done event there, since no round ended. With the mark cleared after such a load, a later round that sends no mld_set of its own, such as the network.wireless up call of `wifi up`, a check_interfaces() round or the restart after a hostapd process died, would start the MLD radio by radio as hostapd starts each AP. Send the supplicant mld_set when a handler is queued while no other handler runs or waits, so that every round defers the MLD start to its end. That mld_set runs after setup() or teardown() set the device state, so a raise in it would leave the device in setup or teardown with no handler. The two previous commits make wpad_update_mlo() and find_phy() return without a raise for a radio that cannot be resolved. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000d9577c5b5e0463bc12d6473d90e6ac656aae8affwifi-scripts: pair every supplicant mld_set with an mld_starteditpackage/network/config/wifi-scripts/files/lib/netifd/wireless.uceditpackage/network/config/wifi-scripts/files/lib/netifd/wireless-device.ucpackage/network/config/wifi-scripts/files/usr/share/ucode/wifi/utils.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/iwinfo.ucb4058c1ed7a09f25679b69aecba0987f3e7d86211793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: load iwinfo.uc without board.json or its data files iwinfo.uc parses /etc/board.json, /usr/share/wifi_devices.json and /usr/share/iso3166.json with json(readfile()) at load. Where one of them is absent, json() rejects the null from readfile(), and the import of the module fails, so the iwinfo command fails for every interface. Read the three files with a helper that gives no data for a missing or empty file, and take board.json through board_wlan(), as find_phy() does. Without board.json no interface lists HT or hardware modes, without wifi_devices.json every device is a generic one, and without iso3166.json the country list holds no names. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000b4058c1ed7a09f25679b69aecba0987f3e7d8621wifi-scripts: load iwinfo.uc without board.json or its data fileseditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/iwinfo.uceditpackage/network/config/wifi-scripts/files/usr/share/ucode/wifi/utils.ucpackage/network/config/wifi-scripts/files/lib/wifi/mac80211.uc087a182043c2e1adfaf0df714b11bb4cc04b108a1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: detect no radios in mac80211.uc without board.json mac80211.uc parses /etc/board.json with json(readfile()) before it checks for wlan data. Without the file json() rejects the null from readfile(), and the script dies with a type error in "wifi config". Take the wlan data from board_wlan(), which gives none for a missing or empty board.json, so that the script detects no radios and exits 0, as it already does for a board.json without wlan data. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000087a182043c2e1adfaf0df714b11bb4cc04b108awifi-scripts: detect no radios in mac80211.uc without board.jsoneditpackage/network/config/wifi-scripts/files/lib/wifi/mac80211.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/iwinfo.uc8f013fa0d0c601b40208efd6f20f86291675dbb41793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: list no modes in iwinfo.uc for an interface without band htmodelist() reads iface.radio.band, but update() sets iface.radio only for an interface that network.wireless status lists. For any other interface, for example a monitor added by hand, `iwinfo <if> htmodelist` raises "left-hand side expression is null". Both htmodelist() and hwmodelist() also raise where the configured band of the radio has no entry in the board.json data of its phy. Give an interface without a radio, without a band or without board.json modes for that band no HT modes and no hardware modes, as hwmodelist() already does for an interface without a radio. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00008f013fa0d0c601b40208efd6f20f86291675dbb4wifi-scripts: list no modes in iwinfo.uc for an interface without bandeditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/iwinfo.ucpackage/network/config/wifi-scripts/files/usr/share/ucode/wifi/utils.uc7a53329657d0fcaf3b93c8e8ec17b0204d12b1f91793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: read no data from a JSON file that does not parse json_file_read() returns null for a missing or empty file, but json() raises for a truncated file or for invalid JSON. A damaged board.json, wifi_devices.json or iso3166.json thus still fails the import of iwinfo.uc, `wifi config` in lib/wifi/mac80211.uc and find_phy(). Return null for such a file as well, and warn with its path and the parse error, so the damaged file stays visible. A handler that netifd runs passes the warning to the netifd log. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00007a53329657d0fcaf3b93c8e8ec17b0204d12b1f9wifi-scripts: read no data from a JSON file that does not parseeditpackage/network/config/wifi-scripts/files/usr/share/ucode/wifi/utils.ucpackage/network/services/hostapd/src/src/utils/ucode.c6a825983bc00ad46b971a7c651e998a8d899e9b21793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: fix the 2.4 GHz HT40 centre frequency of freq_info() uc_wpa_freq_info() derives center_freq1 from the 5 GHz channel block arithmetic for every band. Below 3000 MHz the u8 channel wraps, so channel 1 HT40+ gives a centre of 3677 MHz instead of 2422 MHz, and the secondary channel offset is ignored. cfg80211 refuses such a chandef, so iface.switch_channel() fails for any 2.4 GHz HT40 AP. Reachable via the apsta_state handler of hostapd.uc: when the station of the same radio follows a channel switch of its uplink, the AP does not switch, and mac80211 cannot finalise the station's channel context reservation and disconnects it. Give a 2.4 GHz 40 MHz channel the centre between the primary and the secondary channel, at the primary +/- 10 MHz (IEEE Std 802.11-2024, 19.3.15.4). center_seg0_idx stays 0 there, as before. Fixes: 847984c773d8 ("hostapd: reimplement AP/STA support via ucode") Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00006a825983bc00ad46b971a7c651e998a8d899e9b2hostapd: fix the 2.4 GHz HT40 centre frequency of freq_info()editpackage/network/services/hostapd/src/src/utils/ucode.cpackage/network/services/hostapd/files/wpa_supplicant.uc569cbf2bf36d1fc6f1dbab004a5f6ba636b1faab1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewpa_supplicant: log a channel switch that hostapd refuses to follow iface_channel_switch() hands the channel switch of a station to the AP side of its radio with the apsta_state call and ignores the result. hostapd logs a channel switch that the driver refuses only at debug level, so a refused follow leaves no trace, and the station later loses its link when the channel context reservation cannot be finalised. Log the error of the apsta_state call with the interface and the target frequency. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000569cbf2bf36d1fc6f1dbab004a5f6ba636b1faabwpa_supplicant: log a channel switch that hostapd refuses to followeditpackage/network/services/hostapd/files/wpa_supplicant.ucpackage/network/services/hostapd/patches/879-AP-free-a-non-AP-MLD-on-all-its-links-at-a-BSS-deini.patchec01246b7036913ae8d811a9d18d3f0ae157ac5a1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: free a non-AP MLD on all its links at a BSS deinit ctrl DISABLE of a link stops it with hostapd_bss_deinit_no_free(): the driver flush of the link and the broadcast Deauthentication. mac80211 then drops every non-AP MLD that holds the link with all its links, and the Deauthentication ends the association of such a non-AP MLD on all its links. hostapd freed only the link STA of a non-AP MLD whose association link is another link of the AP MLD, and kept it associated and authorized on that link, so its next association failed. Share the part of hostapd_bss_stop_ap() (patch 878) that frees such a non-AP MLD on all its links with hostapd_bss_deinit_no_free(). Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000ec01246b7036913ae8d811a9d18d3f0ae157ac5ahostapd: free a non-AP MLD on all its links at a BSS deinitaddpackage/network/services/hostapd/patches/879-AP-free-a-non-AP-MLD-on-all-its-links-at-a-BSS-deini.patchpackage/network/services/hostapd/patches/880-AP-free-a-non-AP-MLD-on-all-its-links-at-a-drop-with.patchfb23b45a7b95f90df52239a9d68f3c8f9ef4be301793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: free a non-AP MLD on all its links at a ctrl drop with tx=0 DEAUTHENTICATE and DISASSOCIATE with tx=0 remove the station from the driver and free its entry on the BSS of the command. The driver removes a non-AP MLD with all its links, but hostapd kept the STA on the other links: the link STA after the command on the association link, and the associated, authorized STA of the association link after the command on another link. A frame on such a link then found the stale entry, and the next association could not set up that link. Free the non-AP MLD on all its links with the new ap_free_sta_all_links(), which hostapd_free_link_sta_mlds() of patch 878 now uses as well. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000fb23b45a7b95f90df52239a9d68f3c8f9ef4be30hostapd: free a non-AP MLD on all its links at a ctrl drop with tx=0addpackage/network/services/hostapd/patches/880-AP-free-a-non-AP-MLD-on-all-its-links-at-a-drop-with.patchpackage/network/services/hostapd/patches/882-AP-MLD-keep-the-pending-RADIUS-messages-of-a-non-AP-.patchpackage/network/services/hostapd/patches/881-AP-MLD-take-the-EAPOL-frames-of-a-non-AP-MLD-on-its-.patch691a91ae9f06329ae2fc420fe706ce37e422bdaa1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: take the EAPOL frames of a non-AP MLD on its association STA A non-AP MLD sends its EAPOL frames on any of its links, and ieee802_1x_receive() handles each on the STA of the receiving link. A link STA has no EAPOL state machine, so the first such frame allocates a second one there. A reauthentication of the MLD then stalls until a retransmission takes the link whose state machine waits for it. Patch 881 hands each EAPOL frame of a non-AP MLD to its association STA, with the helper of the SCS and MSCS handlers. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000691a91ae9f06329ae2fc420fe706ce37e422bdaahostapd: take the EAPOL frames of a non-AP MLD on its association STAeditpackage/network/services/hostapd/patches/882-AP-MLD-keep-the-pending-RADIUS-messages-of-a-non-AP-.patchaddpackage/network/services/hostapd/patches/881-AP-MLD-take-the-EAPOL-frames-of-a-non-AP-MLD-on-its-.patchpackage/network/services/hostapd/files/hostapd.uc90ca1f605a7691009e2b3f57f9c849723a5eddd11793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: keep the AP_VLAN names of a BSS with a temporary name valid iface_reload_config() gives a kept BSS the temporary name "tmp_" plus 8 hex digits when its new name is still held by another kept BSS. For each WDS station, the rename also renames the AP_VLAN "<bss>.sta<aid>", and "tmp_xxxxxxxx.sta1" exceeds IFNAMSIZ. The kernel refuses that name, the rename back from the temporary name finds no interface, and the AP_VLAN keeps the old BSS name while its BSS runs under the new one. hostapd only logs "nl80211: Renaming device ... failed", and the reload reports success. A reload that adds a BSS in front of a backhaul BSS, with another kept BSS after it, reaches this. Use "tmp" plus the BSS index as the temporary name. It is unique within one reload, and "<tmp>.sta<aid>" fits IFNAMSIZ for every AID up to 2007. Fixes: 20c667cc8817 ("hostapd: rework reload support and MAC address handling") Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000090ca1f605a7691009e2b3f57f9c849723a5eddd1hostapd: keep the AP_VLAN names of a BSS with a temporary name valideditpackage/network/services/hostapd/files/hostapd.ucpackage/network/services/hostapd/src/src/ap/ubus.cpackage/network/services/hostapd/patches/883-AP-free-a-non-AP-MLD-on-all-its-links-at-a-group-add.patch484c930cbcab394cf45b9ed1df4cb6f2c02934961793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: free a non-AP MLD on all its links at a group addressed drop DEAUTHENTICATE and DISASSOCIATE of ff:ff:ff:ff:ff:ff on the control interface, and ubus del_client of the broadcast address, send the group addressed frame on one link and then free the stations of that BSS with hostapd_free_stas(). The frame ends the association of a non-AP MLD on all its links, but on a link that is not its association link only its link STA was freed. hostapd kept the associated, authorized STA of the association link, and the driver kept the station. Free such a non-AP MLD on all its links, as the BSS stop and deinit of patches 878 and 879 already do. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000484c930cbcab394cf45b9ed1df4cb6f2c0293496hostapd: free a non-AP MLD on all its links at a group addressed dropaddpackage/network/services/hostapd/patches/883-AP-free-a-non-AP-MLD-on-all-its-links-at-a-group-add.patcheditpackage/network/services/hostapd/src/src/ap/ubus.cpackage/network/services/hostapd/files/wpa_supplicant.uc263dccf12d96bb13e8e8910dc6247f09d56aeaf31793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewpa_supplicant: take a station config into an MLD only on its radios mld_set_iface_config() sets the present bit for every radio with a station config for the MLD, also for a radio outside the radios that mld_set names. The MLD netdev spans only those radios, but such a radio joins the Add, its frequencies enter the scan list and phy_status of that radio names the MLD. A later phy_set_state stop of that radio removes the MLD, and the start skips the radio because it is outside data.radio_mask, so the MLD stays down although another radio has a config. Set the present bit only for a radio of the MLD, as the phy_set_state start and mld_radios_held() already count only those radios. Fixes: 9aca8a97d791 ("wpa_supplicant: add MLO client support") Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000263dccf12d96bb13e8e8910dc6247f09d56aeaf3wpa_supplicant: take a station config into an MLD only on its radioseditpackage/network/services/hostapd/files/wpa_supplicant.ucpackage/base-files/files/lib/functions.sha0318a5106e6c26a1ebfd425b9f1671f63fb1ebe1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namebase-files: start only enabled services on package upgrade Since commit afaa34ccd734 ("base-files: don't modify enabled state of service on upgrade"), default_postinst() starts every init script of the package on an upgrade, and leaves out only the enable. With opkg the prerm stops the service first, so the pair acts as a restart. apk runs no prerm on an upgrade, and its post-upgrade script calls default_postinst() with PKG_UPGRADE=1. A reinstall or an upgrade with apk thus starts a service that the system has disabled and stopped. On an upgrade, start an init script only where it reports itself enabled. A fresh install still enables and starts each service, and an offline root still only enables it. With opkg, a service that the system has disabled but that was started by hand now stays stopped after an upgrade, since the prerm stops it and the postinst no longer starts it. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000a0318a5106e6c26a1ebfd425b9f1671f63fb1ebebase-files: start only enabled services on package upgradeeditpackage/base-files/files/lib/functions.shpackage/network/services/hostapd/src/src/ap/ubus.c4f88e1b6d4fac140aec1027ac89f41e76b7d46531793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: ubus wps_cancel ends the push button of one link on request The ubus object of an AP MLD resolves to one link, the MLD's first BSS or else its first link (hostapd_ubus_mld_hapd()). wps_start arms the link that its link_id names, but wps_cancel takes no link_id and acts on the resolved link. With wps_independent, which is the default, hostapd_wps_cancel() reaches only that BSS, so a push button armed on another link stays active until its walk time ends. wps_cancel takes the optional link_id of wps_start and ends the push button on that link's BSS; NOT_FOUND where the object has no such link. get_features reports wps_link_cancel, so that a caller can tell a hostapd that takes the argument from one that ignores it. Refresh patches 863 and 869, whose ubus.c hunks moved by 11 lines. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00004f88e1b6d4fac140aec1027ac89f41e76b7d4653hostapd: ubus wps_cancel ends the push button of one link on requesteditpackage/network/services/hostapd/src/src/ap/ubus.cpackage/network/services/hostapd/patches/300-noscan.patchpackage/network/services/hostapd/patches/170-hostapd-update-cfs0-and-cfs1-for-160MHz.patch908ed08613f6cff4d38f7dbaf3100d88a0231af21793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: build HT and VHT operation of a BSS without hardware modes Patch 170 reads hapd->iface->current_mode->vht_capab in hostapd_eid_ht_operation() and hostapd_eid_vht_operation() without a check of current_mode. A BSS of driver=none has no hardware modes, so current_mode stays NULL, and hostapd crashes at the start of such a BSS with ieee80211n=1 or ieee80211ac=1: WPA_TRACE: eloop SIGSEGV - START hostapd_eid_ht_operation() ../src/ap/ieee802_11_ht.c:150 ieee802_11_build_ap_params() ../src/ap/beacon.c:2427 hostapd_setup_bss() ../src/ap/hostapd.c:2566 Take the extended NSS BW capability only from a present mode, like hostapd_eid_vht_capabilities() already does. Fixes: adfeda849198 ("hostapd: add fix for dealing with VHT 160 MHz via ext nss bw") Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +0000908ed08613f6cff4d38f7dbaf3100d88a0231af2hostapd: build HT and VHT operation of a BSS without hardware modeseditpackage/network/services/hostapd/patches/170-hostapd-update-cfs0-and-cfs1-for-160MHz.patcheditpackage/network/services/hostapd/patches/300-noscan.patchpackage/network/services/hostapd/patches/865-AP-MLD-count-the-AP_VLAN-reference-of-a-link-STA.patchpackage/network/services/hostapd/patches/803-hostapd-fix-80211be-build.patchpackage/network/services/hostapd/patches/821-AP-Drop-a-later-try-of-an-acknowledged-Re-Associatio.patchpackage/network/services/hostapd/patches/600-ubus_support.patchpackage/network/services/hostapd/patches/866-AP-MLD-bind-the-VLAN-of-a-link-added-by-Link-Reconfi.patchpackage/network/services/hostapd/patches/605-ap-mld-a-removed-affiliated-ap-leaves-the-links-of-its-stations.patchpackage/network/services/hostapd/patches/844-DSCP-Allow-DSCP-policy-to-be-attached-to-an-associat.patchpackage/network/services/hostapd/patches/883-AP-free-a-non-AP-MLD-on-all-its-links-at-a-group-add.patchpackage/network/services/hostapd/patches/868-AP-MLD-keep-the-session-timers-of-a-moved-associatio.patchpackage/network/services/hostapd/patches/880-AP-free-a-non-AP-MLD-on-all-its-links-at-a-drop-with.patchpackage/network/services/hostapd/patches/878-AP-add-hostapd_bss_stop_ap-for-a-stop-that-keeps-the.patchpackage/network/services/hostapd/patches/882-AP-MLD-keep-the-pending-RADIUS-messages-of-a-non-AP-.patchpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patchpackage/network/services/hostapd/patches/826-AP-MLD-Keep-the-ML-information-of-a-station-whose-as.patchpackage/network/services/hostapd/patches/601-ucode_support.patch59787f0ff409306917d01f4e6353b53af37f319e1793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: free the taxonomy copy of the association frame handle_assoc() keeps a copy of each (Re)Association Request frame in sta->assoc_frame_taxonomy for the get_sta_ies ubus method, but ap_free_sta() frees only probe_ie_taxonomy and assoc_ie_taxonomy. Each freed station that sent a (Re)Association Request thus leaks the copy of its last request. A request of a station that is still present frees the previous copy in taxonomy_sta_info_assoc_frame(). Free the copy in ap_free_sta() with the other taxonomy data, and refresh the later patches whose hunks the two lines shift. Fixes: 79cd45ddeeb5 ("hostapd: add association frame to taxonomy data") Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +000059787f0ff409306917d01f4e6353b53af37f319ehostapd: free the taxonomy copy of the association frameeditpackage/network/services/hostapd/patches/868-AP-MLD-keep-the-session-timers-of-a-moved-associatio.patcheditpackage/network/services/hostapd/patches/600-ubus_support.patcheditpackage/network/services/hostapd/patches/605-ap-mld-a-removed-affiliated-ap-leaves-the-links-of-its-stations.patcheditpackage/network/services/hostapd/patches/875-AP-MLD-keep-the-accounting-session-and-EAPOL-state-o.patcheditpackage/network/services/hostapd/patches/803-hostapd-fix-80211be-build.patcheditpackage/network/services/hostapd/patches/844-DSCP-Allow-DSCP-policy-to-be-attached-to-an-associat.patcheditpackage/network/services/hostapd/patches/883-AP-free-a-non-AP-MLD-on-all-its-links-at-a-group-add.patcheditpackage/network/services/hostapd/patches/821-AP-Drop-a-later-try-of-an-acknowledged-Re-Associatio.patcheditpackage/network/services/hostapd/patches/878-AP-add-hostapd_bss_stop_ap-for-a-stop-that-keeps-the.patcheditpackage/network/services/hostapd/patches/826-AP-MLD-Keep-the-ML-information-of-a-station-whose-as.patcheditpackage/network/services/hostapd/patches/880-AP-free-a-non-AP-MLD-on-all-its-links-at-a-drop-with.patcheditpackage/network/services/hostapd/patches/882-AP-MLD-keep-the-pending-RADIUS-messages-of-a-non-AP-.patcheditpackage/network/services/hostapd/patches/865-AP-MLD-count-the-AP_VLAN-reference-of-a-link-STA.patcheditpackage/network/services/hostapd/patches/601-ucode_support.patcheditpackage/network/services/hostapd/patches/866-AP-MLD-bind-the-VLAN-of-a-link-added-by-Link-Reconfi.patchtarget/linux/generic/pending-6.18/799-net-ethernet-mtk_wed-attach-a-PCIe-device-of-domain-.patchtarget/linux/mediatek/patches-6.18/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patch7eff1f94e0efc493dce05eebb7dec22e829115e41793198780000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namekernel: mtk_wed: attach a PCIe device of domain 2 mtk_wed_attach() refuses a PCIe device in a PCI domain above 1. The second PCIe interface of the MT7996 on the ASUS ZenWiFi BT8 is on the controller at 0x11290000, which is domain 2, so it runs without WED while the first interface runs WED with hw_rro. In that mixed setup the first interface reports a "Message 001a0002 timeout" about 87 s after boot, the root port reports a completion timeout (AER CmpltTO), and the driver restarts the hardware about every 54 s. Add pending patch 799, which accepts every domain that indexes the three WED instances of MT7988, like the MediaTek SDK patch "refactor mtk_wed_attach for support wed2". The second interface then attaches WED 2, and the BT8 runs without a timeout or a restart. Refresh 944, whose hunk the patch shifts. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:20 +00007eff1f94e0efc493dce05eebb7dec22e829115e4kernel: mtk_wed: attach a PCIe device of domain 2edittarget/linux/mediatek/patches-6.18/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patchaddtarget/linux/generic/pending-6.18/799-net-ethernet-mtk_wed-attach-a-PCIe-device-of-domain-.patchpackage/network/services/hostapd/patches/196-AP-MLD-Send-a-link-agnostic-Action-frame-to-a-non-ML.patchpackage/network/services/hostapd/patches/853-nl80211-install-SCS-and-MSCS-through-NL80211_CMD_SET.patchpackage/network/services/hostapd/patches/834-AP-MLD-free-the-data-of-a-removed-affiliated-AP-at-t.patch6828f6a6101370875a318004d1aecfd7fffa1d391793198781000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: send a link-agnostic action frame to a non-MLD STA on its link hapd_drv_send_action() sends the action frames that IEEE Std 802.11be-2024, 35.3.14 makes link-agnostic (Robust AV Streaming SCS and MSCS, WNM BSS Transition Management and WNM Sleep Mode) with link ID -1 to every station of an AP MLD. For a station that is not a non-AP MLD, the SA and the BSSID are the link address of the BSS, and cfg80211_mlme_mgmt_tx() refuses the frame with -EINVAL where that address is not the address of the interface. A non-MLO station on such a link gets no SCS Response and no MSCS Response. The rule of 35.3.14 holds between an AP MLD and a non-AP MLD only. Add patch 196, which sends these frames to a non-MLD station of the BSS on the link of the BSS, as hostapd_drv_sta_disassoc() does with patch 187. A destination without an entry in the BSS keeps link ID -1. Patches 834 and 853 are refreshed on top of it. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:21 +00006828f6a6101370875a318004d1aecfd7fffa1d39hostapd: send a link-agnostic action frame to a non-MLD STA on its linkeditpackage/network/services/hostapd/patches/834-AP-MLD-free-the-data-of-a-removed-affiliated-AP-at-t.patchaddpackage/network/services/hostapd/patches/196-AP-MLD-Send-a-link-agnostic-Action-frame-to-a-non-ML.patcheditpackage/network/services/hostapd/patches/853-nl80211-install-SCS-and-MSCS-through-NL80211_CMD_SET.patchtarget/linux/generic/backport-6.18/735-v7.3-net-ethernet-mtk_wed-Fix-dma_unmap_single-size.patch3b6ab640fb1a09311ecd61e47ee97a8a6f67bfa81793198781000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namekernel: backport the mtk_wed dma_unmap_single() size fix mtk_wed_wo_queue_refill() maps a WO receive buffer with q->buf_size, but mtk_wed_wo_dequeue() unmaps it with SKB_WITH_OVERHEAD(q->buf_size). Backport upstream commit ff5a2a7acec1 ("net: ethernet: mtk_wed: Fix dma_unmap_single() size") from net, which unmaps the buffer with the size it was mapped with. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 14:46:21 +00003b6ab640fb1a09311ecd61e47ee97a8a6f67bfa8kernel: backport the mtk_wed dma_unmap_single() size fixaddtarget/linux/generic/backport-6.18/735-v7.3-net-ethernet-mtk_wed-Fix-dma_unmap_single-size.patchtarget/linux/generic/pending-6.18/799-net-ethernet-mtk_wed-attach-a-PCIe-device-of-domain-.patchtarget/linux/generic/pending-6.18/793-02-net-ethernet-mtk_wed-fix-reset-condition-for-rx-wdma.patchtarget/linux/generic/pending-6.18/797-01-net-ethernet-mtk_eth_soc-query-the-wireless-driver-f.patchtarget/linux/mediatek/patches-6.18/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patchtarget/linux/generic/pending-6.18/793-04-net-ethernet-mtk_wed-setup-WDMA_RING_TX-0-for-non-DB.patchtarget/linux/generic/pending-6.18/798-net-ethernet-mtk_wed-free-the-hw_rro-buffers-once-in.patchtarget/linux/generic/pending-6.18/793-03-net-ethernet-mtk_wed-free-up-rings-during-detach.patchtarget/linux/generic/pending-6.18/793-01-net-ethernet-mtk_wed-skip-ring-reset-in-wdma_tx_ring.patchtarget/linux/generic/pending-6.18/797-02-net-ethernet-mtk_eth_soc-report-the-idle-time-of-off.patch7bc917532c7aadf05bed8a9eb7d14a57287951021793199045000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namekernel: mtk_wed: add the pending ring reset and detach fixes Add the four mtk_wed patches that Zhi-Jun You sent to netdev as v6 on 2026-10-26: - skip the generic ring reset of the WDMA TX rings on WED v3, whose descriptors have a different size and initial values; - reset the CPU index of the WDMA RX rings that are set up, instead of the ones that are not; - free the RX rings and the WDMA TX rings on detach; - set up WDMA_RING_TX(0) for WED RX on a non-DBDC MT7986. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 15:50:45 +01007bc917532c7aadf05bed8a9eb7d14a5728795102kernel: mtk_wed: add the pending ring reset and detach fixesedittarget/linux/generic/pending-6.18/797-01-net-ethernet-mtk_eth_soc-query-the-wireless-driver-f.patchedittarget/linux/generic/pending-6.18/797-02-net-ethernet-mtk_eth_soc-report-the-idle-time-of-off.patchaddtarget/linux/generic/pending-6.18/793-03-net-ethernet-mtk_wed-free-up-rings-during-detach.patchaddtarget/linux/generic/pending-6.18/793-04-net-ethernet-mtk_wed-setup-WDMA_RING_TX-0-for-non-DB.patchedittarget/linux/generic/pending-6.18/798-net-ethernet-mtk_wed-free-the-hw_rro-buffers-once-in.patchaddtarget/linux/generic/pending-6.18/793-01-net-ethernet-mtk_wed-skip-ring-reset-in-wdma_tx_ring.patchedittarget/linux/generic/pending-6.18/799-net-ethernet-mtk_wed-attach-a-PCIe-device-of-domain-.patchaddtarget/linux/generic/pending-6.18/793-02-net-ethernet-mtk_wed-fix-reset-condition-for-rx-wdma.patchedittarget/linux/mediatek/patches-6.18/944-net-ethernet-mtk_wed-move-dlm-a-dedicated-dts-node.patchtarget/linux/generic/pending-6.18/799-net-ethernet-mtk_wed-attach-a-PCIe-device-of-domain-.patchtarget/linux/generic/pending-6.18/797-01-net-ethernet-mtk_eth_soc-query-the-wireless-driver-f.patchtarget/linux/generic/pending-6.18/798-net-ethernet-mtk_wed-free-the-hw_rro-buffers-once-in.patchtarget/linux/generic/pending-6.18/797-02-net-ethernet-mtk_eth_soc-report-the-idle-time-of-off.patchtarget/linux/generic/pending-6.18/794-net-ethernet-mtk_wed-bypass-the-RROQM-when-hw_rro-is.patchab2006029b32e241db217393d429e5e25cc938cf1793199050000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namekernel: mtk_wed: bypass the RROQM when hw_rro is used With hw_rro on WED v3, the WLAN chip reorders RX frames, and WED takes them from the RRO rings into the RRO ingress of the route QM. The RROQM, whose MIOD and feedback rings serve the WO firmware, and the legacy ingress of the route QM (IGRS1) are still configured as for WED v2. Add pending patch 794, based on the MediaTek SDK patch "add wedv3 support RROQM bypass WO", which sets the RROQM bypass and forces the destination of IGRS1. Apply it only when hw_rro is used: without hw_rro, for example with mt7915 on WED v3, RX reordering still goes through the WO firmware and the RROQM. Refresh 797-01, 797-02, 798 and 799, whose hunks the patch shifts. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 15:50:50 +0100ab2006029b32e241db217393d429e5e25cc938cfkernel: mtk_wed: bypass the RROQM when hw_rro is usedaddtarget/linux/generic/pending-6.18/794-net-ethernet-mtk_wed-bypass-the-RROQM-when-hw_rro-is.patchedittarget/linux/generic/pending-6.18/799-net-ethernet-mtk_wed-attach-a-PCIe-device-of-domain-.patchedittarget/linux/generic/pending-6.18/797-01-net-ethernet-mtk_eth_soc-query-the-wireless-driver-f.patchedittarget/linux/generic/pending-6.18/798-net-ethernet-mtk_wed-free-the-hw_rro-buffers-once-in.patchedittarget/linux/generic/pending-6.18/797-02-net-ethernet-mtk_eth_soc-report-the-idle-time-of-off.patchpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc7737e0a7f53c9f802aff3df2e3c7ac86d48e29461793199050000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: read the FTM responder and background radar feature bits hostapd.uc tests NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER as bit 33 and NL80211_EXT_FEATURE_RADAR_BACKGROUND as bit 61. In nl80211.h they are 32 and 60; bits 33 and 61 are AIRTIME_FAIRNESS and POWERED_ADDR_CHANGE. The values had no effect until commit 28c6f5e6f7b8 ("wifi-scripts: fix extended-feature bit test"). Since then mt76 radios, which set AIRTIME_FAIRNESS, read as FTM responders, and mac80211_hwsim, which has an FTM responder, does not. Every mac80211 radio sets POWERED_ADDR_CHANGE, so every 5 GHz radio reads as capable of background radar. Use the values of nl80211.h. Fixes: 218f3884d2fb ("wifi-scripts: add ucode based scripts") Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 15:50:50 +01007737e0a7f53c9f802aff3df2e3c7ac86d48e2946wifi-scripts: read the FTM responder and background radar feature bitseditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.uc292104ab33e743ae5f9d6cd8f24b957f4f56063c1793199050000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: write ftm_responder only for a radio with an FTM responder iface_rrm() appends ftm_responder to the BSS config with no feature check, so iface_ftm() only decides about lci and civic. A UCI ftm_responder=1 thus always reaches hostapd, which then sets the FTM responder bit of the Extended Capabilities element from the config alone, also where the driver has no FTM responder. Leave ftm_responder to iface_ftm(), which writes it, lci and civic where the phy sets NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER, as hostapd.sh does. Fixes: 218f3884d2fb ("wifi-scripts: add ucode based scripts") Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 15:50:50 +0100292104ab33e743ae5f9d6cd8f24b957f4f56063cwifi-scripts: write ftm_responder only for a radio with an FTM respondereditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/ap.ucpackage/kernel/mt76/patches/003-wifi-mt76-mt7996-implement-the-flow-offload-idle-op.patchpackage/kernel/mt76/patches/001-wifi-mt76-answer-the-flow-priority-query.patchpackage/kernel/mt76/Makefilepackage/kernel/mt76/patches/002-wifi-mt76-mt7996-implement-the-flow-offload-flush-op.patchd38d376b492ccb046024749fd765ce2d3cf848091793199369000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemt76: update to Git HEAD (2026-10-28) 5e697c3982d7 wifi: mt76: mt7603: validate MCU response length 19901c7f3cc9 wifi: mt76: mt7915: validate MCU response lengths 0720e321afee wifi: mt76: mt7915: validate MURU statistics response bbb18d7844e9 wifi: mt76: mt7915: validate EEPROM response length 7264a8a110c4 wifi: mt76: mt7915: validate free-block response length 8c534f59b4a9 wifi: mt76: mt7915: validate channel MIB response length fa6b2367e281 wifi: mt76: mt7915: validate RX rate response length 07f248fe9830 wifi: mt76: mt7915: validate WED TX statistics response f76151f8d04f wifi: mt76: mt7915: validate RF register response length 0d218afcbddb wifi: mt76: mt76x02: keep A-MSDU subframe buffers at even addresses 558c6aee6891 wifi: mt76: mt76x02: sync the group key PN before a restart db39c8d4d6d9 wifi: mt76: fix NULL dereference reading napi_threaded in debugfs 6dcc00bb44c5 wifi: mt76: mt7925: deduplicate MLD support code in mt7925_mac_link_sta_add 859b54fabce0 wifi: mt76: mt7925: do not reset WPDMA before stopping NAPI on reset 2bb98336d469 wifi: mt76: mt7996: clamp VHT/HE beamforming NSS d2712ce4ed84 wifi: mt76: mt7996: clamp EHT beamforming NSS d973f6ec9a3d wifi: mt76: mt7921: validate MCU response lengths 1618141fbd29 wifi: mt76: mt7921: validate EEPROM response length 1fe8a56213ce wifi: mt76: mt7921: validate TX power response length 759e140bc76a wifi: mt76: mt7921: validate testmode query response e06a746261e0 wifi: mt76: mt7925: validate MCU response lengths ae20af438c32 wifi: mt76: mt7925: validate register query response ad5b05038a34 wifi: mt76: mt7925: validate EEPROM response length d0a80080eed9 wifi: mt76: mt7925: validate temperature response length 06deecb57b96 wifi: mt76: mt7925: validate TX power response length a73af3f06db4 wifi: mt76: mt7925: validate radio status response 487aa470cada wifi: mt76: mt792x: bound firmware release-info parsing a13a2be996e3 wifi: mt76: mt7996: validate MCU response lengths e0670ce95e40 wifi: mt76: mt7996: validate EEPROM response lengths 8f71d66ad74e wifi: mt76: mt7996: validate free-block response length 90e7c0007d7f wifi: mt76: mt7996: validate channel MIB response length e1e90bbe363c wifi: mt76: mt7996: validate temperature response length f99c91725472 wifi: mt76: mt7996: validate RF register response length 8127e3ff88ff wifi: mt76: mt76x02: keep stations registered during watchdog recovery 247c4d987c39 wifi: mt76: honour the more-data flag when releasing buffered frames f75d4f05974d wifi: mt76: mt76x02: serialise wcid drop mask updates 4af6beb07b88 wifi: mt76: mt76x02: clear the wcid drop mask for all powersave responses 304aa9be68dd wifi: mt76: mt7996: stop radios after add failure 1295868b85d3 wifi: mt76: mt7921: validate CLC event length 04bf44cd2cb5 wifi: mt76: mt7921: validate NIC capability TLV payload lengths 3c0806b4dfae wifi: mt76: mt7925: validate NIC capability TLV lengths cb8537008b58 wifi: mt76: mt7925: free the MCU event when linearising fails cd0c5fdf01b3 wifi: mt76: mt7996: validate radar, thermal and WED RRO event lengths ba86572bd0d4 wifi: mt76: connac: validate the RAM firmware region table 3ecd7e69dbc9 wifi: mt76: mt7996: validate the RAM firmware region table 2871dc0e2b72 wifi: mt76: mt7925: validate CLC firmware regions and records 35d9c038be88 wifi: mt76: connac: validate the ROM patch section table 8356461aee79 wifi: mt76: mt7996: validate the ROM patch section table d4c9872bbd9c wifi: mt76: mt792x: use mt76_connac2_fw_check() 8a8c857798f5 wifi: mt76: mt7996: add scan dwell time hw cap 451f47376280 wifi: mt76: mt7996: take the link of an 802.3 frame from its station b4dd3d4f6d27 wifi: mt76: mt7996: do not update beacons while CSA is active d343a85da6fe wifi: mt76: mt7996: only remove a BMC STA_REC that was added 46ed43b905d5 wifi: mt76: mt7996: pass the puncturing bitmap to the firmware 49892ef42067 wifi: mt76: abort a scan when the chanctx changes 1507666f034f wifi: mt76: set the channel again when the chanctx puncturing changes ab907b18ddc9 wifi: mt76: mt7996: advertise preamble puncturing support d55666f37245 wifi: mt76: mt7996: keep scan and ROC links out of the MLD group fde06f678c30 wifi: mt76: mt7996: factor the vif link teardown out of remove_interface 25dbe41cf7c9 wifi: mt76: mt7996: destroy station links before the MLD group is freed fecc93e7f1ed wifi: mt76: mt7996: send MLD link operations for an AP MLD only 78084e732159 wifi: mt76: mt7996: set up a vif link again on another radio 1e1ca91c2b70 wifi: mt76: mt7996: describe an MLD peer with the PEER_MLD command 43008928840b wifi: mt76: mt7915: honour the valid flag in efuse block reads a60235641e8f wifi: mt76: mt7996: skip MLD address translation for encap offload frames 1152058aee06 wifi: mt76: mt7921: honour the valid flag in efuse block reads 2356292ae38f wifi: mt76: mt7915: upload the CSA beacon only once 801f6a53f2f1 wifi: mt76: read the chanctx of a link once 47665de41b5d wifi: mt76: restart the beacon monitor of a link that gets a chanctx again 9c4ada3a37eb wifi: mt76: publish the beacon monitor interval after its timestamp ba30cf5adb2b wifi: mt76: mt7996: keep rx header translation off while a monitor runs 6611f0126ccd wifi: mt76: mt7996: apply monitor mode again after a full reset 59b149d24e27 wifi: mt76: check the RX PN of an MLD peer once per peer d8d24d7cbf5d wifi: mt76: mt7996: send no MLD_SETUP when station links only go away 46b67e5b7c49 wifi: mt76: mt7996: keep a unicast management frame on its MLO link d7e3bee841a5 wifi: mt76: mt7996: pass the default DSCP map to the firmware 6428114db709 wifi: mt76: mt7996: write the TXD of stream classified 802.3 frames 2b926d2d7776 wifi: mt76: mt7996: support SCS and MSCS 7f2f67eebb54 wifi: mt76: mt7996: implement the flow offload flush op eb9e675d4cfc wifi: mt76: mt7996: implement the flow offload idle op 238538d7d1cf wifi: mt76: answer the flow priority query f349872e5149 firmware: update mt7990, mt7992 and mt7996 firmware to 202607 0936617dc529 wifi: mt76: mt7996: write the TXD of 802.3 frames with an explicit UP Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 15:56:09 +0100d38d376b492ccb046024749fd765ce2d3cf84809mt76: update to Git HEAD (2026-10-28)editpackage/kernel/mt76/Makefiledeletepackage/kernel/mt76/patches/002-wifi-mt76-mt7996-implement-the-flow-offload-flush-op.patchdeletepackage/kernel/mt76/patches/003-wifi-mt76-mt7996-implement-the-flow-offload-idle-op.patchdeletepackage/kernel/mt76/patches/001-wifi-mt76-answer-the-flow-priority-query.patchpackage/utils/ucode/Makefile3e6064bbbf6f25f9e61d713a540538c28224c90f1793199442000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.nameucode: update to Git HEAD (2026-10-28) d41981561d7f types: keep tostring exceptions pending during stringification 94562341453a vm: invoke standard library functions internally a357bc0fd001 compiler: add typeof operator and throw statement 0de223bb2e49 vm, debug: show which function I_STCALL invokes 6004c5aad287 lexer: add a raw text skipper to find the end of a bracketed expression e915e50fa79c compiler: add destructuring declarations and assignments a250f159019d rtnl: look up the port attributes by the kind of the master 90b756787ff8 rtnl: decode the slave data of a port with the port attributes f14b11ba2378 rtnl: send the port data of a link without a link kind 961af31de74a tests: ffi: add calls with complex arguments and return values 3f379cd7d5ed ubus: ignore a channel request after the channel was lost Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 15:57:22 +01003e6064bbbf6f25f9e61d713a540538c28224c90fucode: update to Git HEAD (2026-10-28)editpackage/utils/ucode/Makefiletarget/linux/generic/pending-6.18/860-04-media-drxk-stop-accessing-a-disconnected-device.patchtarget/linux/generic/pending-6.18/860-01-media-az6007-fix-CAM-status-polling-after-disconnect.patchtarget/linux/generic/pending-6.18/860-05-media-dvb-core-dmxdev-wake-up-readers-on-release.patchtarget/linux/generic/pending-6.12/860-01-media-az6007-fix-CAM-status-polling-after-disconnect.patchtarget/linux/generic/pending-6.12/860-04-media-drxk-stop-accessing-a-disconnected-device.patchtarget/linux/generic/pending-6.18/860-06-media-dvb-core-wake-up-CA-users-on-release.patchtarget/linux/generic/pending-6.18/860-02-media-az6007-propagate-USB-errors-from-I2C-transfers.patchtarget/linux/generic/pending-6.12/860-06-media-dvb-core-wake-up-CA-users-on-release.patchtarget/linux/generic/pending-6.12/860-05-media-dvb-core-dmxdev-wake-up-readers-on-release.patchtarget/linux/generic/pending-6.12/860-02-media-az6007-propagate-USB-errors-from-I2C-transfers.patchtarget/linux/generic/pending-6.12/860-03-media-drxk-stop-retrying-after-disconnect.patchtarget/linux/generic/pending-6.18/860-03-media-drxk-stop-retrying-after-disconnect.patch785c7f9348a351a4d7cbff77f0ef7ee2e94a0c981793200939000https://taiha.net/jenkins/user/danieldanieldaniel@makrotopia.orggeneric: media: add pending fixes for DVB tuner hot-unplug Unplugging an az6007 based DVB-C tuner, such as the TechniSat CableStar Combo HD CI, while tvheadend uses it floods the log and the USB disconnect does not complete. The CA thread spins on failed CAM status polls, drxk keeps retrying I2C transfers on the gone device, and dmxdev and dvb_ca wait for users that are never woken. Add v2 of the series submitted upstream to pending-6.12 and pending-6.18. With it the disconnect completes in about 150 ms and tvheadend picks the adapter up again when it is plugged back in. v1 was tested on a Turris 1.x (mpc85xx/p2020) with 6.18, v2 on a Turris Omnia (mvebu) with the 6.6 backport in Turris OS 9.1.2 and in QEMU with vidtv on v7.3-rc2. The 6.12 copy, and patch 5 in the 6.18 copy, are compile tested only. Link: https://lore.kernel.org/all/20261004100741.71711-1-pepe.schlehofer@gmail.com/ Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com> 2026-10-28 15:22:19 +0000785c7f9348a351a4d7cbff77f0ef7ee2e94a0c98generic: media: add pending fixes for DVB tuner hot-unplugaddtarget/linux/generic/pending-6.18/860-03-media-drxk-stop-retrying-after-disconnect.patchaddtarget/linux/generic/pending-6.18/860-02-media-az6007-propagate-USB-errors-from-I2C-transfers.patchaddtarget/linux/generic/pending-6.12/860-04-media-drxk-stop-accessing-a-disconnected-device.patchaddtarget/linux/generic/pending-6.12/860-06-media-dvb-core-wake-up-CA-users-on-release.patchaddtarget/linux/generic/pending-6.18/860-04-media-drxk-stop-accessing-a-disconnected-device.patchaddtarget/linux/generic/pending-6.12/860-02-media-az6007-propagate-USB-errors-from-I2C-transfers.patchaddtarget/linux/generic/pending-6.12/860-03-media-drxk-stop-retrying-after-disconnect.patchaddtarget/linux/generic/pending-6.18/860-01-media-az6007-fix-CAM-status-polling-after-disconnect.patchaddtarget/linux/generic/pending-6.12/860-05-media-dvb-core-dmxdev-wake-up-readers-on-release.patchaddtarget/linux/generic/pending-6.12/860-01-media-az6007-fix-CAM-status-polling-after-disconnect.patchaddtarget/linux/generic/pending-6.18/860-05-media-dvb-core-dmxdev-wake-up-readers-on-release.patchaddtarget/linux/generic/pending-6.18/860-06-media-dvb-core-wake-up-CA-users-on-release.patchpackage/network/services/hostapd/files/hostapd.uc9f0bbefb03f2ae4a83cef1eee48f20fff45e63891793201385000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: fix the config channel switch on a multi-radio wiphy mac80211 refuses to bring up an interface while any interface of the wiphy is in a channel switch (ieee80211_check_concurrent_iface()), and cfg80211 runs one scan per wiphy. On a multi-radio wiphy such as the mt7996, the radios share both limits: - A config change that switches the channel of one radio and restarts another radio failed the restart with EBUSY, and the AP stayed down until the next config change. - While ACS ran on one radio, the 20/40 MHz coexistence scan of another radio got EBUSY each second, and after 15 s hostapd starts that AP at 20 MHz. Hold a pending interface setup back in steps of 100 ms while another AP of the same wiphy is in a channel switch, an ACS or a coexistence scan, for 30 s at most. Also fix three cases of the config channel switch: - iface_freq_info() took the oper_chwidth values of hostapd as the width argument of freq_info() and ignored op_class. The EHT320 config of wifi-scripts got 320 MHz only because its he_oper_chwidth=3 (80+80 MHz) equals the freq_info() width of 320 MHz. Take the width from op_class where the config has one, as hostapd does, and map the oper_chwidth values otherwise. Restart for 80+80 MHz, which freq_info() lacks. - A config change of the channel and of a BSS ran the channel switch and then reloaded the BSS, which stops the BSS during the switch. Restart instead. - radio_base() dropped [HT40+] and [HT40-], so a change between HT20 and HT40 on the same channel was not applied. Keep [HT40] without the sign. Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 16:29:45 +01009f0bbefb03f2ae4a83cef1eee48f20fff45e6389hostapd: fix the config channel switch on a multi-radio wiphyeditpackage/network/services/hostapd/files/hostapd.ucpackage/network/services/hostapd/src/src/ap/ucode.cpackage/network/services/hostapd/src/src/utils/ucode.cde796327bc6e2866436ff8351225aed9e30181551793201385000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namehostapd: ucode: fix the width and the result of switch_channel switch_channel() takes the width from oper_chwidth and falls back to the current width of the interface. freq_info() did not return it, so a config change of the width alone made a channel switch with the old width and the new centre frequency, which the kernel refuses, and the radio restarted instead. Return oper_chwidth from freq_info(). start() reads the same field, so a start with a frequency from wpa_supplicant now also takes the width of the config, which matches the centre frequency that freq_info() computes for it. switch_channel() also returned the result of the last BSS only. mac80211 does not finalise a channel switch that only part of the BSSes of a radio take part in, so stop at the first BSS that fails and let the caller restart the radio. Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 16:29:45 +0100de796327bc6e2866436ff8351225aed9e3018155hostapd: ucode: fix the width and the result of switch_channeleditpackage/network/services/hostapd/src/src/ap/ucode.ceditpackage/network/services/hostapd/src/src/utils/ucode.cpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/iwinfo.uc62d9f2d4f22a5d126403304923bb8ac509fec8fd1793201385000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: iwinfo: wait for the results of the scan it triggered scan() took the next NL80211_CMD_NEW_SCAN_RESULTS that nl80211.waitfor() returned. The ucode nl80211 event socket stays subscribed for the life of the process, so in a long running caller the results of an earlier scan, or of a scan on another interface of the wiphy, were already queued. scan() then returned within milliseconds, dumped the cache before its own scan had finished, and left that scan running, so a scan on another radio of a multi-radio wiphy failed with EBUSY. Drop the queued scan events before the trigger, and wait for the event of the interface that was scanned. Signed-off-by: John Crispin <john@phrozen.org> Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 16:29:45 +010062d9f2d4f22a5d126403304923bb8ac509fec8fdwifi-scripts: iwinfo: wait for the results of the scan it triggerededitpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/iwinfo.ucpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.uc19483fa9075686e7a627c777e09c0a24163c83231793201385000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namewifi-scripts: write the hostapd width values for 6 GHz 320 MHz For EHT320, device_htmode_append() writes eht_oper_chwidth=7 and he_oper_chwidth=3. In enum oper_chan_width of hostapd these are 8640 MHz and 80+80 MHz, not 320 MHz and the 160 MHz that the HE comment asks for. hostapd replaces both with the width of op_class 137 in setup_interface2(), so only readers of the config such as hostapd.uc see the wrong values. Write 9 (320 MHz) and 2 (160 MHz), the values hostapd sets for op_class 137 in hostapd_set_oper_chwidth(), like mac80211.sh already does for eht_oper_chwidth. Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 16:29:45 +010019483fa9075686e7a627c777e09c0a24163c8323wifi-scripts: write the hostapd width values for 6 GHz 320 MHzeditpackage/network/config/wifi-scripts/files-ucode/usr/share/ucode/wifi/hostapd.ucpackage/network/config/qca-ppe-qos/Makefilebcbb85d6791e544c6b1ea79bcf6b0334084dbd431793209659000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqca-ppe-qos: remove PKG_VERSION Package is fully local and has no sources, so no sense in setting the PKG_VERSION at all. Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 18:47:39 +0100bcbb85d6791e544c6b1ea79bcf6b0334084dbd43qca-ppe-qos: remove PKG_VERSIONeditpackage/network/config/qca-ppe-qos/Makefilepackage/network/config/qca-ppe-qos/Makefile377206841ab054674ed46705697af867b96d2f1e1793209659000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqca-ppe-qos: remove PKG_LICENSE_FILES PKG_LICENSE_FILES is empty, so remove it. Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 18:47:39 +0100377206841ab054674ed46705697af867b96d2f1eqca-ppe-qos: remove PKG_LICENSE_FILESeditpackage/network/config/qca-ppe-qos/Makefilepackage/network/config/qca-ppe-qos/Makefilec6f6358f8f130e623400523aef696f432cab13681793209659000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqca-ppe-qos: mark package nonshared The package is limited to qualcommax, but has no nonshared flag. Target buildbots select nonshared packages through CONFIG_ALL_NONSHARED, so mark it nonshared. Drop PKGARCH:=all to use the target package architecture. Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 18:47:39 +0100c6f6358f8f130e623400523aef696f432cab1368qca-ppe-qos: mark package nonsharededitpackage/network/config/qca-ppe-qos/Makefilepackage/network/config/qca-ppe-qos/Makefilefc5bd7cc0c2c0ab55e27d85a3edfca80ada120881793209921000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comqca-ppe-qos: make it depend on subtargets qca-ppe-qos is ipq807x and ipq60xx specific, so depend on those subtargets instead of just qualcommax target. Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 18:52:01 +0100fc5bd7cc0c2c0ab55e27d85a3edfca80ada12088qca-ppe-qos: make it depend on subtargetseditpackage/network/config/qca-ppe-qos/Makefilepackage/kernel/mac80211/patches/subsys/461-wifi-mac80211-follow-the-station-links-on-its-4-addr.patchpackage/kernel/mac80211/patches/subsys/412-wifi-mac80211-stop-only-the-MBSSID-set-of-the-stopped-AP-link.patchpackage/kernel/mac80211/patches/subsys/425-wifi-mac80211-clear-the-Critical-Update-flag-after-t.patchpackage/kernel/mac80211/patches/subsys/445-wifi-mac80211_hwsim-support-SCS-and-MSCS.patchpackage/kernel/mac80211/patches/subsys/481-wifi-mac80211-do-not-send-an-off-channel-frame-after.patchpackage/kernel/mac80211/patches/subsys/441-wifi-mac80211-learn-MSCS-flows-on-receive.patchpackage/kernel/mac80211/patches/subsys/440-wifi-mac80211-classify-transmitted-MSDUs-with-SCS.patchpackage/kernel/mac80211/patches/subsys/423-wifi-mac80211-count-the-DTIM-of-each-AP-link.patchpackage/kernel/mac80211/patches/subsys/439-wifi-mac80211-add-SCS-and-MSCS-rule-storage.patchpackage/kernel/mac80211/patches/subsys/360-mac80211-factor-out-part-of-ieee80211_calc_expected_.patchpackage/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patchpackage/kernel/mac80211/patches/subsys/014-wifi-mac80211-fix-swapped-fq_overlimit-fq_overmemory.patchpackage/kernel/mac80211/patches/subsys/015-wifi-mac80211-don-t-reset-the-TXQ-scheduling-round-n.patchpackage/kernel/mac80211/patches/subsys/443-wifi-mac80211-add-the-sta_set_scs-driver-op.patch83384b861ffbafe757c803e654e89b8e0ab2dbd01793216461000https://taiha.net/jenkins/user/nbdnbdnbd@nbd.namemac80211: backport TXQ round and aqm debugfs fixes ieee80211_txq_schedule_start() resets the TXQ scheduling round number when an AC is over its airtime limit. A txq that was served in an earlier round with the same number is then skipped in the next round. The aqm debugfs file also prints fq_overlimit and fq_overmemory swapped. Both fixes are in wireless-next. Patches 320, 360 and 412 are refreshed for the new offsets. Assisted-by: Claude:claude-opus-5-5 Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de> Signed-off-by: Felix Fietkau <nbd@nbd.name> 2026-10-28 20:41:01 +010083384b861ffbafe757c803e654e89b8e0ab2dbd0mac80211: backport TXQ round and aqm debugfs fixesaddpackage/kernel/mac80211/patches/subsys/014-wifi-mac80211-fix-swapped-fq_overlimit-fq_overmemory.patcheditpackage/kernel/mac80211/patches/subsys/481-wifi-mac80211-do-not-send-an-off-channel-frame-after.patcheditpackage/kernel/mac80211/patches/subsys/423-wifi-mac80211-count-the-DTIM-of-each-AP-link.patcheditpackage/kernel/mac80211/patches/subsys/439-wifi-mac80211-add-SCS-and-MSCS-rule-storage.patcheditpackage/kernel/mac80211/patches/subsys/412-wifi-mac80211-stop-only-the-MBSSID-set-of-the-stopped-AP-link.patcheditpackage/kernel/mac80211/patches/subsys/440-wifi-mac80211-classify-transmitted-MSDUs-with-SCS.patcheditpackage/kernel/mac80211/patches/subsys/443-wifi-mac80211-add-the-sta_set_scs-driver-op.patchaddpackage/kernel/mac80211/patches/subsys/015-wifi-mac80211-don-t-reset-the-TXQ-scheduling-round-n.patcheditpackage/kernel/mac80211/patches/subsys/360-mac80211-factor-out-part-of-ieee80211_calc_expected_.patcheditpackage/kernel/mac80211/patches/subsys/445-wifi-mac80211_hwsim-support-SCS-and-MSCS.patcheditpackage/kernel/mac80211/patches/subsys/425-wifi-mac80211-clear-the-Critical-Update-flag-after-t.patcheditpackage/kernel/mac80211/patches/subsys/461-wifi-mac80211-follow-the-station-links-on-its-4-addr.patcheditpackage/kernel/mac80211/patches/subsys/441-wifi-mac80211-learn-MSCS-flows-on-receive.patcheditpackage/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patchtarget/linux/octeon/patches-6.18/901-octeon-fix-pcie-port-reset-on-octeon3.patch65592178ec1105d9794c5807b1a42e4b5667adbf1793220426000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comocteon: fix PCIe port reset on Octeon III arch/mips/pci/pcie-octeon.c was ported from the Cavium SDK cvmx-pcie.c, but the OCTEON_IS_OCTEON3() branches of the port reset sequence were dropped: __cvmx_pcie_rc_initialize_gen2() unconditionally pulses CIU_SOFT_PRST/CIU_SOFT_PRST1 and checks MIO_RST_CTLX. Those are Octeon II blocks; on Octeon III (CN7xxx) they are unclaimed -- reads return garbage and writes are silently dropped. The kernel therefore never resets the PEM port, never drives PERST# to the endpoint, and never clears a SOFT_PRST that the RST block has latched. On Octeon III the per-port reset logic lives in the RST block: RST_SOFT_PRSTX[n] requests a port reset and RST_CTLX[n] configures the reset behavior and reports status. RST_CTLX[PRST_LINK] controls whether a link-down or hot-reset from the endpoint asserts SOFT_PRST, and RST_CTLX[RST_LINK] whether it warm-resets the whole chip. If PRST_LINK is left set (it survives a soft reset, so whatever the bootloader or a previous warm boot left behind persists), an endpoint that resets its own PCIe link kills the PEM: SOFT_PRST latches, every PEM register then reads zero, the link never retrains, and the port stays dead until the next reboot. Observed on a CN7030 board with two QCA9984 wifi chips, whose driver (ath10k qca99x0) issues SOC_GLOBAL_RESET -- "put target, including PCIe, into reset" -- during probe: ath10k_pci 0000:01:00.0: failed to receive initialized event from target: 00000000 ath10k_pci 0000:01:00.0: failed to wait for target after cold reset: -145 Program RST_CTLX for root-complex operation (clear PRST_LINK/RST_LINK, drive PERST#, do not sample it, do not chain to a chip warm reset -- the same values the SDK programs in __setup_pem_reset()) and route the port reset pulse, the host-mode check and the rst_done wait through the RST block on Octeon III, mirroring the SDK. The Octeon II path is unchanged. Since the port reset now actually reaches the endpoint on Octeon III, also add the SDK's post-reset device boot allowance: PCIe endpoints that load firmware from a serial flash (such as the QCA99xx) can take up to 900ms after PERST# before they answer configuration requests, longer than the hardware cfg_rtry window covers. While there, fix the PEMX_BIST_STATUS2 read in gen2 init: the register does not exist on CN73XX/CN78XX, and on CN70XX it lives at block offset 0x440, not 0x420 (0x420 is PEMX_ON on CN70XX). Reading the generic address on CN70XX reports pemon|pemoor as a bogus "BIST2 FAILED (0x3)" on every boot. Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26272 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 21:47:06 +010065592178ec1105d9794c5807b1a42e4b5667adbfocteon: fix PCIe port reset on Octeon IIIaddtarget/linux/octeon/patches-6.18/901-octeon-fix-pcie-port-reset-on-octeon3.patchtarget/linux/octeon/patches-6.18/903-octeon-keep-pcie-bar-allocations-below-4gb.patch795f369b181cd128962fa8f60a03eaf0ac8afac61793220426000https://taiha.net/jenkins/user/robimarkorobimarkorobimarko@gmail.comocteon: keep PCIe BAR allocations below 4GB The root-complex memory windows registered by octeon_pcie_setup() span 64 bits of bus address (mem_resource covers 4GB-256MB up to mem_base + 2^36), so the PCI core places 64-bit BARs above 4GB. On a CN7030 board with two QCA9984 wifi chips each BAR0 landed at bus address 0x100000000 -- low half 0x00000000, high half 0x1. That placement is fatal for endpoints whose inbound memory window is 32-bit internally even though their PCIe config space advertises a 64-bit BAR. The QCA9984 routes inbound memory requests through a 32-bit CORE_CTRL/BAR0-start register (see the "target writes BAR to CORE_CTRL" comment in the ath10k driver), and after the chip's SOC_GLOBAL_RESET -- which ath10k issues unconditionally during probe -- its boot ROM re-establishes that window from the low half of the BAR only. The chip then stops decoding the address the host maps it at, while config space keeps working: setpci shows the full BAR and command register intact, but every MMIO read is a failed completion (devmem of the hardwired chip ID at BAR0+0xec returns 0xffffffff) and ath10k times out waiting for the firmware indicator forever: ath10k_pci 0000:01:00.0: failed to receive initialized event from target: 00000000 ath10k_pci 0000:01:00.0: failed to wait for target after cold reset: -145 The vendor SDK kernel avoids this by keeping the bootloader's 32-bit BAR assignment (0xe0000000). Cap the controller memory windows at the end of 32-bit bus address space so every device BAR is placed where 32-bit-only endpoints can decode it. The window start already sits at 4GB-256MB -- the x86 "big BAR" convention this code emulates -- so each port keeps 256MB of device address space, ample for the wifi and switch cards these SoCs ship with, and matching what x86 BIOSes do by default. Device DMA (inbound) is unaffected: it is translated by the BAR2 window, not by these resources. Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com> Link: https://github.com/openwrt/openwrt/pull/26272 Signed-off-by: Robert Marko <robimarko@gmail.com> 2026-10-28 21:47:06 +0100795f369b181cd128962fa8f60a03eaf0ac8afac6octeon: keep PCIe BAR allocations below 4GBaddtarget/linux/octeon/patches-6.18/903-octeon-keep-pcie-bar-allocations-below-4gb.patchgithttps://taiha.net/jenkins/user/danieldanielhttps://taiha.net/jenkins/user/ansuelsmthansuelsmthhttps://taiha.net/jenkins/user/nbdnbdhttps://taiha.net/jenkins/user/markus.stockhausenmarkus.stockhausenhttps://taiha.net/jenkins/user/robimarkorobimarko