FIPS 140-3 recommends that all crypto implementations should be tested
before first use. Testmanager performs initial tests based on existing
test vectors. Not all algorithms have defined test vectors, so to improve
this situation, this commit backports recently added test vectors for
following cipher suites:
* authenc(hmac(md5),cbc(des))
* authenc(hmac(md5),cbc(aes))
* authenc(hmac(sha1),rfc3686(ctr(aes)))
* authenc(hmac(sha224),rfc3686(ctr(aes)))
* authenc(hmac(sha256),rfc3686(ctr(aes)))
* authenc(hmac(sha384),rfc3686(ctr(aes)))
* authenc(hmac(sha512),rfc3686(ctr(aes)))
These vectors were calculated using a software implementation and then
double-checked on Mediatek MT7981/MT7986 (safexcel) and NXP P2020 (talitos).
Both platforms passed self-tests.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/22409
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This patch adds support for the following AEAD ciphersuites:
- authenc(hmac(md5),cbc(aes))
- authenc(hmac(md5),cbc(des)))
- authenc(hmac(md5),cbc(des3_ede))
- authenc(hmac(md5),rfc3686(ctr(aes)))
These algorithms are used mainly for backward compatibility with some
older equipment. This is enhanced version of the patch found in the
mtk-openwrt-feeds repo.
All cipher suites were tested using test vectors on the MediaTek MT7981,
MT7986, and MT7988.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Link: https://github.com/openwrt/openwrt/pull/22410
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Use a patched fork while waiting for
https://github.com/anthropics/claude-code-action/pull/963 to be
merged and released upstream.
Version v1.0.77 contains many improvments over 1.0.49 which was used
before. It uses Sonnet 4.6 instead of Sonnet 4.5.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Until now the driver determines the validity of a phy (or port)
by checking "smi_bus[] < 0". That is somehow confusing. Align
with upstream and add a valid_port bitmask that can be used for
this check with common kernel bit operations.
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/22565
Signed-off-by: Robert Marko <robimarko@gmail.com>
The mdio driver has come a long way. The code is
quite stable now and whenever bugs are analyzed
one can look at the registers with devmem from
command line. Drop unneeded debugging information.
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/22565
Signed-off-by: Robert Marko <robimarko@gmail.com>
a665659dee50 wifi: mt76: fix beacon monitor for MBSSID nontransmitted BSS
1b26f5f63d42 wifi: mt76: mt7996: Decrement sta counter removing the link in mt7996_mac_reset_sta_iter()
0c1dedac48c3 wifi: mt76: mt7996: Switch deflink to seclink only if link lookup does not fail
7fa21be01b97 wifi: mt76: mt7996: Rely on msta_link link_id in mt7996_vif_link_remove()
492a407111c3 wifi: mt76: mt7996: Account active links in valid_links fields
ade83e44eda0 wifi: mt76: mt7996: Move mlink deallocation in mt7996_vif_link_remove()
efebeea5c058 wifi: mt76: mt7996: Destroy vif active links in mt7996_remove_interface()
a4c790aef40d wifi: mt76: mt7996: Add mcu APIs to enable/disable vif links.
018f60316d4d wifi: mt76: mt7996: Destroy active sta links in mt7996_mac_sta_remove()
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Modern gawk rejects C-style /* ... */ comments in AWK code, treating
them as regex patterns where '*' has nothing to quantify. Replace all
such comments with AWK-style '#' comments in lantiq_bdi_conf.awk and
lantiq_ram_init_uart.awk.
Also replace the pattern 'if (x) /* comment */ else action' which used
a C comment as a null statement with the equivalent 'if (!x) action'.
Fixes build error:
awk: error: ? * + or {interval} not preceded by valid subpattern
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22458
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Without a prompt the action auto-detected mode: tag instead of agent
when triggered via issue_comment, resulting in no review being posted.
Remove the prompt so the action can correctly use its built-in agent
mode with full PR context.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
lantiq_gswip and tag_gswip were not loaded during failsafe, leaving the
switch uninitialised. This caused LAN1 port to show no link, making
SSH-based recovery impossible.
Add the autoload flag and include tag_gswip (which was also missing from
the autoload list) so the switch initialises correctly in failsafe mode.
Tested on BT HomeHub 5A (lantiq/xrx200).
Fixes: https://github.com/openwrt/openwrt/issues/22480
Signed-off-by: Benjamin Levine <benjaminmileslevine@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22514
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The claude-code-action uses mcp__github_ci__get_ci_status and related
tools to check workflow run status as part of the review. Without
actions: read the GitHub API calls for CI status are rejected.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The whitelist was too restrictive, causing permission denials when
Claude tried to use basic tools like Read or Grep to analyse the diff.
Remove it and let the action use its default toolset.
Fixes: c0e75c9de6 ("github: add Claude code review workflow triggered by /claude comment")
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add claude-code-review.yml using anthropics/claude-code-action@v1.
The review runs when a PR comment containing "/claude" is posted,
avoiding unnecessary API usage on every push.
Uses issue_comment trigger restricted to PR comments only. Only
triggers for users with write access (OWNER, MEMBER, COLLABORATOR)
and when the comment body contains "/claude", preventing any runner
from being allocated for unrelated comments. A short domain hint
steers the review toward OpenWrt embedded Linux conventions.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/22556
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit backports 2 patches that add gpio controller support
to RTL9607C SoCs. It enables us to make use of anything that
can be controlled by GPIO on RTL9607C, like LEDs, buttons and such.
Signed-off-by: Rustam Adilov <adilov@tutamail.com>
Link: https://github.com/openwrt/openwrt/pull/22358
Signed-off-by: Robert Marko <robimarko@gmail.com>
Certain versions of the VF2 bootloader require the presence of a
vf2_uEnv.txt in the boot partition to properly load a non-SDK kernel.
Add this file during the SD-card generation.
Known VF2 bootloader versions exhibiting this behaviour are:
U-Boot 2021.10 (Mar 31 2025 - 22:49:46 +0800), Build: jenkins-github_visionfive2_6.12-11
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
The VF2 boards store their ubootenv on /dev/mtd1 which is a SPI flash
partition. Add support for reading this partition in uboot-envtools,
and add the package into the VF2 image.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
Upstream 2b81db8a7f4475e141a8ffd7cc745ed9f15962df introduced several new
symbols. This commit adds them and also applies alphabetical order via
./scripts/kconfig.pl target/linux/generic/config-6.12
Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/22276
Signed-off-by: Robert Marko <robimarko@gmail.com>
RTL93xx devices can no longer find the switch node in the DTS.
Commit 4c92254 ("relocate/retype switch node") refactored the
switch node definition to better align with upstream. Sadly
the redefinition for RTL93xx devices failed.
- RTL83xx: use "switch0: ethernet-switch"
- RTL93xx: use "switch0: switch@1b000000"
Follow up commit 8b969f7 ("drop realtek,smi-address property)
changed the dts lookup sequence for mdio initialization. On
RTL93xx devices it cannot find the switchnode via
of_get_child_by_name(dev->of_node->parent, "ethernet-switch")
Fix the switch node type for RTL93xx
Fixes: 8b969f7 ("drop realtek,smi-address property)
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/22557
Signed-off-by: Robert Marko <robimarko@gmail.com>
The order within the FGCAL code is not optimal. Right now, there's
output printed even in successful cases (which doesn't really help) and
a value is read although it isn't used if the run succeeds. To fix both,
move that below the success loop exit so it's just printed in
non-success case where the information might be helpful.
Suggested-by: Bevan Weiss <bevan.weiss@gmail.com>
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22450
Signed-off-by: Robert Marko <robimarko@gmail.com>
Comparing our calibration check with the one in the SDK ([1]), one can
see some discrepancies for which there are no apparent reasons. SGMII
and 1000Base-X are handled equal to XSGMII although they aren't in the
SDK and have different symbol error registers. USXGMII and 10GBase-R are
fine, but other modes are explicitly handled with failure then.
Restructure this by keeping XSGMII alone with its dedicated check (as
the SDK does) and handle all other modes differently. Though the SDK
just skips symbol error check for modes like SGMII, 1000Base-X,
2500Base-X, it was found to be ok to perform a simple check for them
too. Since we have also a default case in the symbol error read
implementation now, we can cover all other modes with default case here
too. As a side-effect, this removes the confusing and probably wrong
failure stating calibration has failed although just the checks were
insufficient.
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22450
Signed-off-by: Robert Marko <robimarko@gmail.com>
Our implementation waiting for RX idle signal of a 10G SerDes deviates
from what the SDK does. While we timeout after 100 reads and thus cannot
really control the real time, the SDK times out after 10ms. Adjust that
accordingly by switching the timeout to ktime_* functions with a 10ms
timeout as per the SDK.
While at it, improve the overall style of the function a bit.
Suggested-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22450
Signed-off-by: Robert Marko <robimarko@gmail.com>
Fix the symbol error read implementation to be usable for other modes
too. While we handle other modes as 'not supported', the SDK has a
generic read used in the 'default' case. Do the same so we can have
proper 2500Base-X support here and avoid confusing error messages.
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22450
Signed-off-by: Robert Marko <robimarko@gmail.com>
Part of the calibration procedure contains some weird and harebrained
piece of code where a specific register write is guarded by a check for
the SerDes mode, otherwise an error is printed. But right after this
if-else block, the exact same write is applied anyway. Remove this
brain-dead piece of code with something meaningful, i.e. reference code
from the SDK [1]. Over there, more writes are applied and a proper check
is in place.
While at it, add some another comment to the code. While it is
honourable to have code developed by someone quite some time ago that
works, it's discouraged to just have code without any explanation
especially if it differs from the SDK.
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22450
Signed-off-by: Robert Marko <robimarko@gmail.com>
Calibration for RTL930x uses multiple iterations for several checks.
While this is fine and needed, it shouldn't be allowed to run forever in
trust that at some point there will always be a "valid" value causing a
loop exit. This has occured a couple of times, causing the driver to
loop forever in case something doesn't run as expected.
To avoid this (and in general as a good practice) limit the affected
loop to a rough estimate of 10 iterations instead of running possibly
forever. The estimate is based on the fact that under normal conditions
it usually takes 1 or 2 to iterations to succeed, more is likely never
to succeed but 10 gives some reasonable headroom.
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22450
Signed-off-by: Robert Marko <robimarko@gmail.com>
Convert the P2020RDB DTS to DSA for the VSC7385 switch, add port
labels and fixed-link. Update board network defaults, preinit iface,
and compat version, and include the DSA switch kmod in the image.
Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22161
Signed-off-by: Robert Marko <robimarko@gmail.com>
A phy node in the dts has two properties:
- reg: the (overall) address of the phy
- realtek,smi-address: the address of the phy on its bus
This notation does not align with upstream. reg should be the address
of the phy on its bus. But where to get the overall address that is
needed for register writes to the hardware?
Luckily the mdio driver and the hardware design sync the ports and
phys (overall) addresses. Thus derive missing data from the dts port
nodes (below ethernet-ports). To realize this
- carve out the port mapping into a separate function to align with
the upstream driver.
- do more sanity checks and catch more inconsistencies
- raise more/better errors via dev_err_probe()
With this commit all dts files must be rewritten as follows:
- if phy has no realtek,smi-address leave it as is
- if phy has realtek,smi-address, write that value into the reg
property and drop realtek,smi-address.
Remark: This commit might bring some confusion about the phyXX and
phy@YY and <reg=YY> naming convention. To be somehow consistent with
the current port/phy identifiers from now on the dts will have:
- phyXX: where XX matches the port number
- phy@YY: where YY is the phy address on the mdio bus
- <reg=YY>: where YY is the phy address on the mdio bus
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/22236
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
The switch node is currently located outside of the switchcore@1b000000
tree. This makes it hard to find when referencing from other nodes in
this tree. Make it a subnode of switchcore and "retype" it to
ethernet-switch like upstream does.
This is not perfectly aligned as upstream just mixes the switchcore and
the ethernet-switch node into one. But this will be future work for
downstream.
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/22236
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
The Zyxel XGS1x10 DTS overzealously tries to avoid redundancies. For
this the phy24/phy25 definitions were split into a common and a device
specific part. Understanding how these phys are defined is therefore
a little bit tricky. Add a little bit of redundancy to make the
definitions easier to read and understand in a single location.
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Link: https://github.com/openwrt/openwrt/pull/22236
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
NN6000v1 Specifications:
SoC: Qualcomm IPQ6000 1.2GHz
RAM: K4B4G1646E-BCMA 512MiB x2 = 1 GiB
Flash: FORESEE 256GB eMMC
ETH: QCA8075 (2x LAN, 1x WAN)
WLAN1: QCN5022 2.4GHz AX 2x2
WLAN2: QCN5052 5GHz AX 2x2
Power: DC 12V
Button: Reset, Wps
USB: 1x 3.0
NN6000v2 Specifications:
SoC: Qualcomm IPQ6000 1.2GHz
RAM: MT41K512M16VRN-107 IT:P 1GiB x2 = 2 GiB
Flash: FORESEE 256GB eMMC
ETH: QCA8075 (4x LAN, 1x WAN)
WLAN1: QCN5022 2.4GHz AX 2x2
WLAN2: QCN5052 5GHz AX 2x2
Power: DC 12V
Button: Reset, Wps
USB: 1x 3.0
Install via UART:
1. Download the initramfs image, rename it to
initramfs.itb, host it with the tftp server.
2. Interrupt U-Boot and run these commands:
tftpboot initramfs.itb
bootm
3. After openwrt boots up, use scp or luci web
to upload sysupgrade.bin to upgrade.
Install via Uboot WebUI:
- Only work when you flash a custom uboot with webui
- Push the reset button for 5 seconds, then use broswer to
access http://192.168.1.1/, then upload factory.bin.
Signed-off-by: Fire Chen <firedevel@icloud.com>
Link: https://github.com/openwrt/openwrt/pull/21787
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
