staging/stintel/package/utils, branch master

ucode: rtnl: return true on acknowledged requests without data

2026-10-09T18:46:24Z

Fixes error handling issues on requests Signed-off-by: Felix Fietkau

provision: add a backend for a GPT partition named provisioning

2026-10-08T07:50:37Z

A device without UBI, such as an x86 VM or a device on eMMC, can keep its provisioning data on a block partition named `provisioning`. The data uses the same header as the UBI volume. open() and create() prefer the UBI volume and then look for the partition through the PARTNAME of each block device in sysfs. A commit checks the flush, because close() reports no error. A partition cannot be removed from here, so destroy erases the header and the data. The provision command now exits with an error when a commit or a destroy fails, for both backends. Signed-off-by: Felix Fietkau

nvram: bound the variable parser to the nvram partition

2026-10-07T00:34:33Z

The "name=value\0 ... \0\0" walk over the mmap()ed nvram used strchr() and strlen() without a bound, so an nvram without the terminating double NUL made it run past the end of the mapping. Search with memchr() up to the length from the nvram header, or up to the end of the mapping when that length does not fit, so a broken header is still readable. A variable that is not terminated in this area ends the parsing. Map a regular file, like the /tmp staging file, only as far as it is backed, rounded down to 4 bytes for the padding in nvram_commit(), instead of the partition size which raised SIGBUS. Only search the start of a mapping smaller than NVRAM_MIN_SPACE for the magic instead of underflowing the loop boundary; bcm47xxpart creates such nvram partitions on flashes with 4 KiB erase blocks. "nvram info" clamps the header length before the CRC8, it read beyond the mapping or underflowed into a 4 GB read before. This is reachable with a crafted nvram partition or staging file, on bcm47xx the nvram partition is also parsed while booting. Reported by @tonoyx91 and @0xROI. Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-5m25-qmhm-crr4 Fixes: 400c1a7fbfad ("Add unvram, a nvram manipulation tool suitable for brcm-2.4 and bcm47xx platforms") Assisted-by: Claude:claude-opus-5 Link: https://github.com/openwrt/openwrt/pull/25240 Signed-off-by: Hauke Mehrtens

fbtest: remove the fbdev test tool

2026-10-06T17:35:40Z

The tool opens /dev/fb0 and mmaps it. Legacy fbdev and DRM fbdev emulation are gone from every target except the exempt ones, so the device node it needs is absent there. Nothing depends on the package. Signed-off-by: Daniel Golle

px5g-mbedtls: default to 2048 bit RSA keys

2026-10-06T11:34:56Z

px5g uses a 512 bit RSA key by default, for rsakey without a size and for selfsigned without -newkey. mbedtls 3.6 refuses to generate RSA keys smaller than MBEDTLS_RSA_GEN_KEY_MIN_BITS, which is 1024 bits, so both commands fail with "error: key generation failed". OpenWrt uses mbedtls 3.6 since 24.10. Use 2048 bits as the default RSA key size, like px5g-wolfssl and OpenSSL do. Signed-off-by: Josef Schlehofer Link: https://github.com/openwrt/openwrt/pull/25629 Signed-off-by: Robert Marko

utils: add configurable Bluetooth UART attachment

2026-10-05T11:55:37Z

Use a generic procd service around the foreground BlueZ btattach utility. Configure the UART, protocol and speed through UCI, without router identity checks or GPIO operations in the attachment service. Leave attachment disabled and the device unset by default. Keep board wiring in the device tree and use the existing HCI UART and BlueZ packages. Tested controller startup after cold power-on, LE discovery, connection and service discovery on LN6001. Signed-off-by: Satoshi Ikeuchi Link: https://github.com/openwrt/openwrt/pull/25594 Signed-off-by: Robert Marko

px5g-mbedtls: reject unsupported -addext values

2026-10-05T11:42:42Z

An -addext value is only consumed if it starts with "extendedKeyUsage=" or with "subjectAltName=" and contains a colon. Any other value, for example "subjectAltName=localhost" or the OpenSSL spelling "subjectAltName = DNS:x", stops the option parser, so px5g ignores all options after it, for example -keyout and -out. A comma separated list like "DNS:a,DNS:b", as OpenSSL takes it, ends up as a single bogus name. An empty name like "subjectAltName=DNS:" is written into the certificate, although OpenSSL refuses it. Email addresses are only accepted with the type EMAIL, while OpenSSL calls it email. extendedKeyUsage has similar problems. A value other than serverAuth or any leaves an empty OID in the extension, values are matched by prefix, and only the last of several extendedKeyUsage options is used. Fail with an error on unsupported values, on empty names and on any comma in a subjectAltName, which OpenSSL takes as a separator even in a URI. Accept the type email as well. Compare the usage exactly, also accepting the OpenSSL name anyExtendedKeyUsage, and keep all given usages. Check the result of adding them and fail if mbedtls refuses them, for example 26 serverAuth values, which do not fit its buffer. Signed-off-by: Josef Schlehofer Link: https://github.com/openwrt/openwrt/pull/25604 Signed-off-by: Robert Marko

px5g-mbedtls: fix the subjectAltName extension

2026-10-05T11:42:42Z

The subjectAltName support added in commit efca89daef ("px5g-mbedtls: add subjectAltName and extendedKeyUsage to SSL certs") has these bugs: - Every IP entry is written with a length of 16 bytes. An IPv4 address ends up as a zero padded IPv6 address, so 192.168.1.1 becomes C0A8:101:: and clients reject the certificate for that address. - All IP entries share one buffer, so each of them carries the address given last. - An invalid IP address is not rejected but written as :: or as the address of an earlier IP entry. - The list is linked after every option instead of only after a new entry. If any other option follows the last subjectAltName, that entry points to itself. Adding the extension then loops until the size counter overflows, which never ends on 64-bit targets and drops the whole extension on 32-bit targets. - An unknown entry type only prints a warning. It stays in the list with type 0, which mbedtls cannot write, so the whole extension is dropped while px5g still exits with 0. - Without any subjectAltName, the extension is written with an empty list, which RFC 5280 does not allow. Chrome rejects such a certificate with ERR_CERT_INVALID and, unlike for other self-signed certificates, does not offer to proceed. Use the length returned by mbedtls_x509_crt_parse_cn_inet_pton(), allocate a buffer for each IP entry and link only new entries. Reject invalid IP addresses and unknown entry types with an error. Add the extension only if there are entries and fail with an error if mbedtls refuses it. Signed-off-by: Josef Schlehofer Link: https://github.com/openwrt/openwrt/pull/25604 Signed-off-by: Robert Marko

provision: name the create command in the not-found message

2026-09-29T15:29:25Z

The message told the user to run "provision enable", but no such command exists. The command that makes the partition is "provision create". Signed-off-by: Felix Fietkau

kernel: drop the audio and display feature gates

2026-09-29T14:29:43Z

The sound and DRM modules carry a dependency on audio-support and video-support, which is what decides whether an image handles those devices. The AUDIO_SUPPORT and DISPLAY_SUPPORT tokens beside them add a second, per-SoC-family condition that a board cannot influence, and that DISPLAY_SUPPORT is half derived from whatever kernel configuration was copied into a target's fragment. Drop the tokens from the module dependencies and from fbtest. Signed-off-by: Daniel Golle