468 Commits
Author SHA1 Message Date
Fil Dunsky d66966e480 uboot-mediatek: wl-wnt100x3: reduce ram speed to 1866 MT/s
The vendor BL2 of the Wavlink WL-WNT100X3 initializes DDR3 at
1866 MT/s:

  NOTICE:  BL2: v2.7(release):292bca1-dirty
  NOTICE:  DDR3 1866MHZ
  NOTICE:  EMI: Using DDR3 settings

while the plain spim-nand-ddr3 BL2 used by the ubootmod variant runs
DDR3 at the default 2133 MT/s, which is above what the vendor
qualified on this board.

Switch the ubootmod BL2 to the existing DDR3 1866 MT/s build, in line
with the vendor firmware.

Tested on WL-WNT100X3: BL2 reports the ddr3-1866 build, the memory
test passes, U-Boot and OpenWrt boot from UBI.

Fixes: d2fabb974c ("mediatek: add support for Wavlink WL-WNT100X3 ubootmod")
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25763
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-10-11 09:06:01 +02:00
Daniel Golle 6b84ce8a51 mediatek: filogic: add Adtran SDG-9000
The Adtran SDG-9000 is a 10G PoE router in a white steel case with
optional 19" rackmount brackets.

Specifications:
 * MediaTek MT7988A (4x Cortex-A73)
 * 32 GB eMMC
 * 4 GiB DDR4 RAM
 * 1x 10000M/5000M/2500M/1000M/100M combo WAN: RJ45 (Marvell
   CUX3410 PHY) or SFP+ cage, selected at boot
 * 1x 10000M/5000M/2500M/1000M/100M LAN port (Marvell CUX3410 PHY)
 * 8x 2500M/1000M/100M/10M LAN ports with PoE+ (MaxLinear MxL86282
   switch with built-in PHYs), 200 W total PoE budget, two Skyworks
   Si3474 PSE controllers
 * 1x 1000M/100M/10M management port (MT7988 built-in PHY)
 * 240x240 TFT touchscreen (ST7789 SPI LCD with CST816S touch)
 * 1 button (Reset)
 * uC-controlled RGB LED via I2C
 * RGBW LED for each PoE LAN port, 2x LED for the management port,
   3x LED for each 10G port, 2x LED for the SFP+ cage
 * 2x PWM fan (mainboard, power supply)
 * USB 3.0 type A port
 * USB-C console port, 115200 baud, Holtek HT42B534 USB-UART bridge
 * 100-240V AC 50-60Hz power input, IEC 60320 C14 inlet

The WAN port is selected by a GPIO-controlled mux that has no runtime
control, so it is chosen by one of two device tree overlays, wan-phy
and wan-sfp, carried as configurations of the FIT image. The mux is
selected by setting boot_default_config in the U-Boot environment:

 config-1                                       no WAN port
 config-1#mt7988a-smartrg-sdg-9000-wan-phy      RJ45 (CUX3410)
 config-1#mt7988a-smartrg-sdg-9000-wan-sfp      SFP+ cage

MAC addresses (base MFG_MAC from the mfginfo partition; the nvmem
cell index in the DTS is added to the base):

 wan        xx:xx:xx:xx:xx:x0  MFG_MAC
 aux        xx:xx:xx:xx:xx:x0  MFG_MAC
 lan1-lan9  xx:xx:xx:xx:xx:x1  MFG_MAC + 0x1
 br-lan     xx:xx:xx:xx:xx:x1  MFG_MAC + 0x1

The label shows MFG_MAC. aux is the only port present when netifd
starts, as lan1-lan9 appear once the mxl862xx driver has loaded, so
br-lan would take the MAC of aux. board.d sets the MAC of br-lan to
that of lan1-lan9.

Installation:

1. Prepare a TFTP server at 192.168.1.254 and serve the OpenWrt
   initramfs image, renamed to "openwrt.500".
2. Connect to the Management/Auxilary port.
3. Connect to the USB-C console port (USB CDC-ACM, 115200 8n1)
4. Power on the device and type "st" to enter the U-Boot command
   line. The window to do that might be very short, so type it as
   soon as the "U-Boot ..." string appears.
5. Run "setenv boot_mode openwrt; saveenv" to boot from OpenWrt
   partition by default.
6. Run "bootmenu" and select option 6 (TFTP openwrt image and
   boot); "run boot5" is a shortcut for the same. This downloads
   openwrt.500 from the TFTP server and boots it.
7. After OpenWrt finishes booting, download the OpenWrt sysupgrade
   image and write it to eMMC using "sysupgrade".
8. After sysupgrade finishes writing, the device reboots into
   OpenWrt. When the System LED is solid white the device is ready
   for configuration.
9. To use the WAN port, set boot_default_config to one of the values
   above, e.g. from OpenWrt with
   "fw_setenv boot_default_config config-1#mt7988a-smartrg-sdg-9000-wan-sfp".

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-10-07 00:03:51 +01:00
Frank WunderlichandWilfried Teiken 7a29a6bf6b mediatek: add support for BananaPi BPi-R4 Pro 4E
The BPi-R4 Pro 4E is a Wi-Fi 7 router board based on the MT7988A SoC.

Difference to 8X is that board has only 4GB RAM and does not contain
the Aeonsemi 10G phys.
Wan port uses MT7988 internal 2.5GBit/s phy with no ethmux chip between
so it need overlays to switch between this wan-phy and SFP-Slot.

Specification
-------------

- SoC:          Mediatek MT7988A (4x Cortex-A73 @1.8GHz)
- RAM:          4GB DDR4
- Flash:        256MB SPI-NAND, 8GB eMMC, microSD Slot
- Switch:       MT7988A built-in switch, MxL86252C
- Ports:        9 ports, 8 usable simultaneously
        * 2x 1G RJ45 LAN
        * 4x 2.5G RJ45 LAN
        * 1x SFP (LAN)
        * 1x 2.5G RJ45/SFP Combo (WAN)
- Buttons:      Reset, WPS
- LEDs:         Power
- USB:          On-board VIA VL822 USB3.2/USB2.0 hub
        * 1x USB-A 2.0 connector
        * 1x USB-A 3.2 connector
        * 3x NGFF-KEYB
- PCIe:
        * 2x mini-PCIe slots with PCIe 3.0 2-lane interface
        * 2x M.2 M-Key slots with PCIe 3.0 1-lane interface (switchable
          PCIe signal with M.2 B-Key)
- Debug:        USB Type-C console port
- Power:        USB Type-C PD 20V or DC barrel connector

Note: This device comes without a MAC address programmed from the
factory. The randomly generated MAC is stored in the U-Boot env on first
boot and used persistently afterwards.

Installation
------------

Uncompress *sdcard.img.gz and write to microSD card, eg. using 'dd'. Use
bootloader menu on the serial console to install SPI-NAND once installed
to SPI-NAND you can used the bootloader menu to install to eMMC. See
instructions for BananaPi R4 for details.

Description is taken from 8X patch and changed to 4E variant.

R4Pro needed a patch for adding aliases to ensure right probe order so add
this here too.

Co-authored-by: Wilfried Teiken <wteiken@teiken.org>
Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
2026-09-28 19:11:17 +01:00
Mikhail Zhilkin 3619b28006 mediatek: add OpenWrt UBI layout for ASUS RT-AX59U
This commit implements the OpenWrt UBI layout for the ASUS RT-AX59U. The
primary goal is get working Kernel Address Space Layout Randomization
(KASLR). Additionally, this layout frees up ~6MB of extra storage space
for package installation.

Preparation
------------
Make a backup (from OpenWrt for stock bootloader):
* Backup partitions:
   apk update && apk add nand-utils
   nanddump /dev/mtd0 | gzip -1 -c > /tmp/mtd0_u-boot.bin.gz
   nanddump /dev/mtd1 | gzip -1 -c > /tmp/mtd1_UBI_DEV.bin.gz

* Backup nvram, Factory and Factory2 volumes:
   cat /dev/ubi0_0 > /tmp/nvram.bin
   cat /dev/ubi0_1 > /tmp/Factory.bin
   cat /dev/ubi0_2 > /tmp/Factory2.bin

* Copy backup from the /tmp dir on your router to a safe place using scp

Installation
------------
* Attach UART (see 'UART' section for details)

* Run mtkuartboot (see 'mtkuartboot recovery' section for details), exit
  the boot menu, and run:
   mtd erase ubi

* Run mtkuartboot again and write ubi bl2 and fip via the network, then
  reboot.

  Default tftp server ip: 192.168.1.254
  Default router ip:      192.168.1.1

* Load the ubi initramfs image via tftpboot and execute sysupgrade to
  write OpenWrt to spi-nand.

* Copy Factory backup to your router:
   scp -O Factory.bin root@192.168.1.1:/tmp

* Check factory volume index:
   ubinfo -a

* Prepare and write new factory ubi volume (substitute X with your
  factory volume index):
   dd if=/tmp/Factory.bin of=/tmp/factory.bin bs=1 count=$((0x65000))
   ubiupdatevol /dev/ubi0_X /tmp/factory.bin

UART
----
UART pins are silkscreened on PCB. Connection parameters:
115200, 8N1, 3.3V

U-Boot tftp recovery
--------------------
* Place OpenWrt ubi-initramfs-recovery.itb image on the tftp server (IP:
  192.168.1.254)

* Press reset button and power on the router. After ~10 sec release the
  button.

* Use OpenWrt initramfs system for recovery (for example, run sysupgrade)

mtkuartboot recovery
--------------------
Use mtk_uartboot and UART connetion for the installation or if BL2 or FIP
in UBI is destroyed:

Link: https://github.com/981213/mtk_uartboot

Start script:
'''
sudo ./mtk_uartboot \
  -p mt7986-ram-ddr4-bl2.bin \
  --aarch64 \
  -f openwrt-mediatek-filogic-asus_rt-ax59u-ubi-preloader.bin \
  -s /dev/ttyUSB0
picocom -b 115200 /dev/ttyUSB0
'''

Notes
-----
1. A simple installation without serial console is also possible using a
   fork of Daniel's UBI Installer (requires adaptation)
Link: https://github.com/dangowrt/owrt-ubi-installer

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25278
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-09-28 14:54:09 +02:00
Aleksei Sviridkin 492a0ff6b1 mediatek: filogic: add support for Netcraze NC-1012
The Netcraze NC-1012 is a rebrand of the Keenetic KN-1012 with identical
hardware. The stock recovery accepts only images signed with the NC-1012
zyimage device id, taken here from the official NC-1012 recovery image.

It shares the KN-1012 device tree through the common dtsi and the copper
and SFP overlays, and the image recipe through the common device define,
following the KN-3411/NC-3411 pattern. The recovery procedure is the
KN-1012 one with the image named NC-1012_recovery.bin.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/24820
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-27 11:12:36 +02:00
Aleksei Sviridkin 87d7b11bd5 mediatek: filogic: add support for Keenetic KN-1012
Keenetic KN-1012 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router with a
combo SFP/copper port, based on MT7981B.

The copper side of the combo port does not come up on this tree yet. It
needs the pending phylink change that defers the PHY attach for PHYs
marked needs-host-firmware until their driver has bound,
https://lore.kernel.org/r/20260914211137.2760618-1-f@lex.la/, and that
property on the PHY node, which goes in together with the change.
Everything else on the board, the SFP side of the same port included,
works without them.

Specification:

- SoC             : MediaTek MT7981B
- RAM             : 512 MiB
- Flash           : SPI-NAND 256 MiB (chip varies by production run,
                    Fudan Micro FM25G02B seen)
- WLAN            : 2.4/5 GHz 2T2R (MediaTek MT7981B (SoC))
- Ethernet        : 4x 10/100/1000 Mbps + 1x combo port
  - switch        : MediaTek MT7531
  - combo port    : SFP cage and an Airoha EN8811H 2.5G copper PHY
                    share one SerDes, selected by a GPIO mux
- USB             : USB 2.0 through a GL850G-OHY60 hub, two switchable
                    power rails
- LEDs/Keys (GPIO): 6x/4x
- UART            : through-hole on PCB (J500), unconfirmed
  - assignment    : 5V, TX, RX, NC, GND
  - settings      : 115200n8
- Power           : 12 VDC, 2.5 A, center positive

The vendor bootloader stays in place, so U-Boot is chainloaded from it
as the payload it accepts as a kernel. It reads the GPIO reporting
whether an SFP module is present and boots the device tree matching the
medium, so one image serves both the copper PHY and the SFP cage. The
chainloader itself is wrapped into a FIT shaped like the vendor kernel
image, kernel@1 / fdt@1 / config@1 with the "Linux 4.9" description,
because the stock loader accepted a payload generated by mkits.sh with
its default node names and descriptions but never ran it. Both vendor
firmware slots (firmware_1, storage_a, firmware_2, storage_b) are
concatenated into one virtual flash, its first 8 MiB the kernel
partition and the rest UBI, so the second slot no longer holds a vendor-
bootable image; u-state stays read-only. The factory image is bounded to
the first firmware slot, where the stock recovery writes it; whether the
recovery writes past that slot is untested.

Flash instruction using the vendor recovery mode:

1. Connect the TFTP host to one of the LAN ports, address 192.168.1.2
2. Rename the factory image to "KN-1012_recovery.bin" and put it in
   the TFTP directory
3. Power off the device, hold the "Reset" button, power it on and keep
   the button held for ~10 seconds
4. The bootloader downloads the image over TFTP and writes it to flash
5. Wait for the device to reboot, it comes up on 192.168.1.1

Reverting to stock image:

1. Download the official recovery package for the model and take the
   .bin image out of it
2. Follow the same steps as above with that image in place of the
   OpenWrt one

MAC addresses:

  use   source
  LAN   rf-eeprom 0x4
  WAN   rf-eeprom 0xa, also the address on the label
  2g    rf-eeprom 0x4, the first MAC slot of the WiFi EEPROM
  5g    rf-eeprom 0x4 with the locally administered bit set and bit 7
        flipped

Left alone, mt76 would read the second EEPROM slot at 0xa for phy1
and collide with the WAN address, so the board joins the Keenetic
family entry in 11_fix_wifi_mac, which derives phy1 from the 0x4 slot
the way mt76 would on its own: LA bit set, bit 7 flipped.

The P and N of the SerDes lane from the switch to the EN8811H are
swapped on this board, like on the BPI-R3 mini, so the copper PHY node
sets rx-polarity to PHY_POL_INVERT, the current form of the
airoha,pnswap-rx property the BPI-R3 mini still carries. Without it the
copper side links up at any speed but transmits nothing, while receive
works.

The copper PHY's INTB is on pio 0 and the PHY node declares it; the
vendor tree hangs the same line on the switch node and calls it level
low. This uses edge falling, as the BPI-R3 mini does for its EN8811H
PHYs. On this tree the line is not used yet: phylib sets phydev->irq to
PHY_POLL when the port attaches the PHY with the generic driver still
bound at switch probe, and nothing restores it when the EN8811H driver
binds later. With the phylink change named at the top and the phylib
change that keeps the interrupt across the driver swap,
https://lore.kernel.org/r/20260919015326.499479-1-f@lex.la/, forced
renegotiations on this board delivered the link-down and link-up events
over INTB and left no interrupt unhandled.

The copper port stays down on this tree because the switch attaches the
PHY at probe, before the EN8811H driver can load its firmware from the
root filesystem, and phylink refuses 2500base-x against the generic
driver, so DSA drops the port. The copper results above were taken with
the phylink change named at the top applied; SFP, lan1 to lan3, WAN and
wifi do not depend on it. The SFP side was booted with a DAC in the
cage: the loader picked the SFP configuration, the module EEPROM read
over I2C, lan4 came up over the cage without the PHY race and the cage's
indicator LED lit; on copper that LED stays off. Link and traffic over
the SFP path stand on the earlier two-tree form of the image, 1 Gbit/s
against a 1 Gbit/s partner, with the module pulled bringing the board
back on copper.

The board support (pin map, SFP node, copper PHY description, image
recipe parameters and LED assignments) is based on the out-of-tree port
by Maxim Anisimov, branch main_keenetic_kn1012 of Linaro1985/openwrt.
The chainloader and the U-Boot side are new relative to that port, as
is the split into a shared dtsi with a device tree overlay per medium,
which the chainloader applies.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/24820
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-27 11:12:36 +02:00
Chukun Pan 7e2bacd43f mediatek: add TP-Link TL-7DR7250 v1 support
Hardware specification:
  SoC: MediaTek MT7988D 3x A73
  Flash: ESMT F50L1G41LB 128MB
  RAM: NT5AD256M16E4 DDR4 512MB
  Ethernet: 2x 2.5G + 2x 1G Lan
  WiFi1: MT7975N 2.4GHz 4T4R
  WiFi2: MT7979N 5GHz 4T5R
  Button: Reset, WPS
  Power: DC 12V 2A

MAC addresses map:
   LAN 4C:xx:xx:xx:xx:57
   WAN 4C:xx:xx:xx:xx:58
   2G  4C:xx:xx:xx:xx:57
   5G  4C:xx:xx:xx:xx:59

Flash instructions:
  1. Connect to your PC via the Gigabit port of the router,
     set a static ip on the ethernet interface of your PC.
     (ip 192.168.1.254, gateway 192.168.1.1)

  2. Execute the following operation to open nc shell:
     https://forum.openwrt.org/t/tp-link-china-routers-rce-vuln

  3. Download the preloader.bin and uboot.fip, host them with
     the HTTP server: python3 -m http.server

  4. Replace the stock bootloader to OpenWrt's:
     ln -sf opt/game_acc/rootfs/bin/busybox wget && cd tmp
     /wget http://192.168.1.254:8000/openwrt-mediatek-filogic-tplink_tl-7dr7250-v1-preloader.bin
     /wget http://192.168.1.254:8000/openwrt-mediatek-filogic-tplink_tl-7dr7250-v1-bl31-uboot.fip
     dd bs=131072 conv=sync of=/dev/mtdblock15 if=openwrt-mediatek-filogic-tplink_tl-7dr7250-v1-preloader.bin
     dd bs=131072 conv=sync of=/dev/mtdblock15 seek=44 if=openwrt-mediatek-filogic-tplink_tl-7dr7250-v1-bl31-uboot.fip

  5. Download the initramfs image, host it with the tftp server,
     and restart the router, waiting for tftp recovery to complete.

  6. After openwrt boots up, upload sysupgrade.bin to upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/24200
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-27 10:32:14 +02:00
Chukun Pan 820662d917 mediatek: add TP-Link TL-7DR7230 v2 support
Hardware specification:
  SoC: MediaTek MT7988D 3x A73
  Flash: Dosilicon DS35Q1GB-IB 128MB
  RAM: Zentel A3T4GF40BBF DDR3 512MB
  Ethernet: 1x 2.5G Wan, 4x 1G Lan
  WiFi1: MT7975N 2.4GHz 4T4R
  WiFi2: MT7979N 5GHz 4T5R
  Button: Reset, WPS
  Power: DC 12V 2A

MAC addresses map:
   LAN 80:xx:xx:xx:19:FE
   WAN 80:xx:xx:xx:19:FF
   2G  80:xx:xx:xx:19:FE
   5G  80:xx:xx:xx:1A:00

Flash instructions:
  1. Connect to your PC via the Gigabit port of the router,
     set a static ip on the ethernet interface of your PC.
     (ip 192.168.1.254, gateway 192.168.1.1)

  2. Execute the following operation to open nc shell:
     https://forum.openwrt.org/t/tp-link-china-routers-rce-vuln

  3. Download the preloader.bin and uboot.fip, host them with
     the HTTP server: python3 -m http.server

  4. Replace the stock bootloader to OpenWrt's:
     ln -sf opt/game_acc/rootfs/bin/busybox wget && cd tmp
     /wget http://192.168.1.254:8000/openwrt-mediatek-filogic-tplink_tl-7dr7230-v2-preloader.bin
     /wget http://192.168.1.254:8000/openwrt-mediatek-filogic-tplink_tl-7dr7230-v2-bl31-uboot.fip
     dd bs=131072 conv=sync of=/dev/mtdblock15 if=openwrt-mediatek-filogic-tplink_tl-7dr7230-v2-preloader.bin
     dd bs=131072 conv=sync of=/dev/mtdblock15 seek=44 if=openwrt-mediatek-filogic-tplink_tl-7dr7230-v2-bl31-uboot.fip

  5. Download the initramfs image, host it with the tftp server,
     and restart the router, waiting for tftp recovery to complete.

  6. After openwrt boots up, upload sysupgrade.bin to upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/24200
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-27 10:32:13 +02:00
Chukun Pan af8ba9b426 mediatek: add TP-Link TL-7DR7230 v1 support
Hardware specification:
  SoC: MediaTek MT7988D 3x A73
  Flash: ESMT F50L1G41LB 128MB
  RAM: GDQ2BFAA-CJ DDR4 512MB
  Ethernet: 1x 2.5G Wan, 4x 1G Lan
  WiFi1: MT7975N 2.4GHz 4T4R
  WiFi2: MT7979N 5GHz 4T5R
  Button: Reset, WPS
  Power: DC 12V 2A

MAC addresses map:
   LAN 4C:xx:xx:xx:xx:A7
   WAN 4C:xx:xx:xx:xx:A8
   2G  4C:xx:xx:xx:xx:A7
   5G  4C:xx:xx:xx:xx:A9

Flash instructions:
  1. Update 7dr7230mv1-middleware.bin in vendor uboot

  2. Update factory.bin in the middleware firmware

  3. After openwrt boots up, install kmod-mtd-rw and
     execute: insmod mtd-rw i_want_a_brick=1

  4. Replace the stock bootloader to OpenWrt's:
     mtd write openwrt-mediatek-filogic-tplink_tl-7dr7230-v1-preloader.bin bl2
     mtd write openwrt-mediatek-filogic-tplink_tl-7dr7230-v1-bl31-uboot.fip fip

  5. Run the following command to remove the OEM UBI volume:
     ubirmvol /dev/ubi0 -N kernel
     ubirmvol /dev/ubi0 -N rootfs
     ubimkvol /dev/ubi0 -N ubootenv -s 1MiB
     ubimkvol /dev/ubi0 -N ubootenv2 -s 1MiB

  6. Upload sysupgrade.bin to perform the upgrade.

Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Link: https://github.com/openwrt/openwrt/pull/24200
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-27 10:32:13 +02:00
Aleksei Sviridkin e1520c0619 mediatek: filogic: add support for Netcraze NC-4410 (Buddy 6 SE)
The Netcraze NC-4410 is a rebrand of the Keenetic KN-4410 (Buddy 6 SE)
with identical hardware, mirroring the existing KN-3411/NC-3411 pair.
Reuse the shared .dtsi and add the per-brand model/compatible and the
NC-4410 zyimage device id (0xC04410).

Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/23727
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-20 11:20:13 +02:00
Aleksei Sviridkin ab933b98aa mediatek: filogic: add support for Keenetic KN-4410 (Buddy 6 SE)
The Keenetic KN-4410 (Buddy 6 SE) is a Wi-Fi 6 range extender built on
the same MT7981B hardware as the KN-3411 (Buddy 6): identical RAM, the
single 1GbE port, internal 2x2 dual-band radio and SPI-NAND. The vendor
device tree differs from the KN-3411 only in the model string, so reuse
the KN-3411 .dtsi and add just the per-model compatible and the firmware
image id (0x804410, the Keenetic zyimage device id for this model).

Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/23727
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-20 11:20:12 +02:00
Aleksei Sviridkin 110adce473 mediatek: filogic: add support for Netcraze NC-3411 (Buddy 6)
The Netcraze NC-3411 is a rebrand of the Keenetic KN-3411 (Buddy 6)
with identical hardware. The stock recovery accepts only images signed
with the NC-3411 zyimage device id, taken here from the signature of
the official NC-3411 firmware.

Split the KN-3411 device tree into a common .dtsi with per-brand
model/compatible files and share one image recipe through a common
device define, following the existing KN-1812/NC-1812 pattern.

Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/23727
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-20 11:20:12 +02:00
Aleksei Sviridkin f06e31004f mediatek: filogic: add support for Keenetic KN-3411 (Buddy 6)
Keenetic Buddy 6 (KN-3411) is a dual-band Wi-Fi 6 mesh extender based on
the MediaTek MT7981B (Filogic 820).

Specifications:
- SoC: MediaTek MT7981B
- RAM: 256 MiB
- Flash: 128 MiB SPI-NAND (Winbond W25N01GV or HeYangTek
  HYF1GQ4UDACAE, varies by unit)
- WiFi: MT7981 2x2, 2.4 GHz + 5 GHz (Wi-Fi 6)
- Ethernet: 1x 1GbE (MT7981 internal GbE PHY)
- LEDs: status (green), WLAN 2.4 GHz (red), WLAN 5 GHz (blue)
- Button: reset
- UART: 115200 8n1 on the on-board header

MAC addresses:
- eth0 (the single 1GbE port): rf-eeprom factory partition at offset 0x4
  (DTS nvmem cell macaddr_factory_4); Keenetic OUI 50:ff:20:xx:xx:xx.

Installation: flash the factory image via the Keenetic recovery / U-Boot
"Upgrade firmware" (zyimage, device id 0x803411). The layout follows the
existing Keenetic MT7981 family: dual firmware slots concatenated into a
single UBI volume.

The board LED/button GPIO map is not published anywhere. The stock
device tree carries no LED or key nodes, and the map is compiled into
the vendor 'phr' kernel module, shipped as a prebuilt per-model blob;
it only reads an optional /phr-pins/<model> node when one is present,
and the device has no such node. The values here were confirmed on
hardware.

Based on the reverse-engineering in #15551 by Maxim Anisimov, rewritten
against current master. The tested unit ships a Winbond W25N01GV
(already supported in-tree); the NAND chip varies by unit without a PCB
revision marker, so the HeYangTek HYF1GQ4UDACAE driver from that PR is
left to a separate change.

Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/23727
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-20 11:20:12 +02:00
Filip Milivojevic 4858ed9dbd mediatek: filogic: add support for Cudy P2 v1
This commit adds support for the Cudy P2 v1, a router with integrated 5G modem.

The device is similar to Cudy WR3000E v1.

SoC: MediaTek MT7981 WiSoC
RAM: 256MB DDR3
Flash: 128MB SPI-NAND
Wireless: Mediatek MT7981 2x2 DBDC 802.11ax (2.4 / 5)
5G Modem: Quectel RG500U-EB
Ethernet: 1 WAN/LAN GbE, 1 LAN GbE

MAC Addresses in OpenWrt:
Interface lan: factory mac address
Interface wan: factory mac address +1
Wifi 2.4GHz: factory mac address
Wifi 5GHz: factory mac address with local bit set

GPIO:
- 1 Button:
  - Reset on GPIO 1
- 5 Software switches:
  - voippwr on GPIO 4 active low
  - voip_volte on GPIO 5 active low
  - 5gpwr on GPIO 6 active low
  - ant on GPIO 7 active high
  - usb5g on GPIO 8 active high
- 8 LEDs:
  - Power: white on GPIO 2 active high
  - Internet: white on GPIO 14 active high
  - Internet: yellow on GPIO 15 active high
  - Internet: red on GPIO 26 active high
  - WLAN: white on GPIO 13 active high
  - Mobile: white on GPIO 30 active low
  - Mobile: yellow on GPIO 28 active high
  - Mobile: red on GPIO 27 active high

Disassembly:
- Remove two screws hidden behind the rubber stand.
- Remove center solid plastic circle with a spudger and remove four screws.
- Slide the interior with the board up.

UART:
- UART pads are accessible on the bottom of the board and labeled
- Solder three pins: GND, RX, TX, do not connect 3V3 pin
- Settings: 115200 8N1 3.3V

5G Modem:

Quectel RG500U-EB is soldered on board and connected via
USB 2.0 High Speed at 480Mb/s and PCIe v2 x1 at 5GT/s.

The modem is usable with upstream drivers only via PPP mode using the ttyUSB2 AT port.

The modem doesn't provide access via USB rndis_host or cdc_ncm - it should work by sending the following commands:
- AT+QCFG="ethernet",0
- AT+QCFG="usbnet",5 (for NCM or 3 for RNDIS or 1 for ECM)
- AT+QCFG="nat",0
- rebooting the modem via AT+CFUN=1,1 and rebooting the device.

It appears that the firmware is locked down and doesn't want to change the configuration and enable usb networking.

It is possible to use vendor sprd_pcie driver and use virtual PCIe network interface by sending the commands:
- AT+QCFG="ethernet",1
- AT+QCFG="nat",0
- rebooting the modem via AT+CFUN=1,1 and rebooting the device.

Connection via USB and PCIe network interface should work (but doesn't work via USB) using:
- AT+QICSGP=1,3,"apnname","username","password",3
- AT+QNETDEVCTL=1,1,1

Migration to OpenWrt using TFTP:
- Connect UART as described above
- Press the reset button while powering on the device
- U-Boot will now try to load a recovery.bin via TFTP, this must be ignored
- After detecting a timeout, the U-Boot console is available via UART
- Set up a TFTP server on IP 192.168.1.88 and connect it to one of the LAN ports
- Provide the initramfs image via TFTP as cudyp2.bin
- Run the following command in U-Boot: tftpboot 0x46000000 cudyp2.bin; bootm 0x46000000
- OpenWrt initramfs image is now booting and accessible via 192.168.1.1
- Flash the sysupgrade image

Revert back to OEM:
- Set up a TFTP server on IP 192.168.1.88 and connect it to one of the LAN ports
- Provide the Cudy firmware via TFTP as recovery.bin
- Press the reset button while powering on the device
- Recovery process will start now
- After recovery is done, the OEM firmware is available at 192.168.10.1 again

Migration to OpenWrt via OEM firmware:
- There should be a migration image available from Cudy as soon as there is official OpenWrt support
- Download the migration image via OEM web interface
- After flashing, OpenWrt is accessible via 192.168.1.1
- Flash the official OpenWrt image

Signed-off-by: Filip Milivojevic <zekica@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23721
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-18 09:17:19 +02:00
Rosen Penev b572e055fc mediatek: use libdeflate for gzip
Shrinks size slightly.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24148
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-16 10:32:10 +02:00
Łukasz Szczur c4dc32021c mediatek: filogic: add support for ZBT Z8105AX-C
Specifications:

SoC: MediaTek MT7981B
RAM: 256 MiB
Flash: Winbond SPI-NAND 128 MiB
Switch: 1 WAN, 3 LAN (Gigabit), MediaTek MT7531
Buttons: Reset, Mesh
Power: DC 12 V / 2.5 A
Wi-Fi: MT7981B 2.4 GHz & 5 GHz
M.2 slot for a WWAN modem
2 full-size SIM slots (user controllable)

The ZBT Z8105AX-C is externally identical to the ZBT Z8103AX-C and
uses the same SoC, RAM and flash configuration.

LED layout (top to bottom):

LAN 1 (green, hardware controlled)
LAN 2 (green, hardware controlled)
LAN 3 (green, hardware controlled)
WAN (green, user controllable)
Mobile (green, user controllable)
Mesh (red, green, blue, used for OpenWrt status)
Power (green, hardware controlled)

There is no Wi-Fi LED on the case and none was defined in the original
firmware.

SIM slots:

Controlled via GPIOs named SIM1 and SIM2.

Installation:

A. Through U-Boot menu:

- Configure the computer with a static IP address in the 192.168.1.0/24
  subnet, for example 192.168.1.10/24.
- Power off the router and hold the Reset button.
- Power on the router while keeping the Reset button pressed.
- Hold the button for 10 seconds and then release it.
- Open 192.168.1.1 in a web browser.
- If a firmware flashing interface is displayed, the router is in the
  U-Boot recovery interface.
- Upload the factory image.

The U-Boot web interface can also be used to recover the router after an
incorrect firmware flash.

B. Through OpenWrt dashboard:

If the router comes with vendor-modified OpenWrt, the firmware can be
upgraded through the dashboard at 192.168.1.1.

Navigate to "System" -> "Backup / Flash Firmware" and flash the OpenWrt
firmware.

Important: Disable the "Keep settings" option when flashing. Vendor
settings are incompatible with OpenWrt 24.10 and 25.12.

MAC addresses:

MAC addresses were found in the factory partition. The layout is
identical to the one used by the ZBT Z8106AX-S:

offset 0x4:  F8:5E:3C:xx:xx:aa --> Router Label -2
offset 0xa:  F8:5E:3C:xx:xx:bb --> Router Label -1
offset 0x24: F8:5E:3C:xx:xx:cc --> Router Label +1
offset 0x2a: F8:5E:3C:xx:xx:yy --> MAC address printed on Router Label

Untested:

- Flashing OpenWrt through the original firmware has not been tested.
  My unit came with vendor-modified OpenWrt running kernel 5.4.

- Hardware watchdog support has not been tested. A hardware watchdog is
  defined in the stock firmware.

Notes:

The ZBT Z8105AX-C can be ordered from the vendor with different WWAN
modem configurations. My unit came without a modem, but versions with
5G/LTE modems were available.

Signed-off-by: Łukasz Szczur <lukasz2317@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24711
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-11 12:28:16 +02:00
Sheikh Faisal 552e617bd0 mediatek: add support for JioRouter AX6000 JIDU6J01
| Component        | Details                                        |
|------------------|------------------------------------------------|
| **SoC**          | MediaTek MT7986A (4× ARM Cortex-A53 @ 2.0 GHz) |
| **RAM**          | 512 MB                                         |
| **Flash**        | 256 MB NAND                                    |
| **Ethernet**     | 5× 10/100/1000 Mbps (1 WAN + 4 LAN)            |
| **WLAN 2.4 GHz** | MediaTek MT7976GN — 802.11b/g/n/ax, 4×4 MIMO   |
| **WLAN 5 GHz**   | MediaTek MT7976AN — 802.11n/ac/ax, 4×4 MIMO    |
| **LEDs**         | 1× RGB LED (GPIO-controlled)                   |
| **Button**       | 1× Reset                                       |
| **USB**          | Yes                                            |

**MAC Addresses:**

| Interface  | Source                                          |
|------------|-------------------------------------------------|
| WAN/Label  | MFG MTD partition (variant-specific fallback)   |
| LAN        | WAN + 1                                         |
| 2.4 GHz    | WAN + 2                                         |
| 5 GHz      | WAN + 3                                         |

Supported variants and MAC source:
- JIDU6J01,JIDU6201: binary at offset 0x00
- JIDU6401: binary at offset 0x20
- JIDU6601: ASCII text at offset 0x1d0
- JIDU6701: ASCII mac= key

---

**1. Extracting U-Boot Credentials**
The U-Boot username and password are stored in the `MFG` partition. To retrieve them:
- With root access on stock OS: Read directly from the MFG partition.
- Without root access: Dump the NAND flash first, then extract the credentials from the dump.

**2. Prepare TFTP server**
- Set a static IP on the ethernet interface of your computer
  (e.g. default: ip `192.168.1.2`, gateway `192.168.1.1`).
- Download the initramfs image and host it with the TFTP server.

**3. Interrupt boot**

Attach UART and power on the router. When the boot menu appears, select **Failsafe Mode**,
then press `Ctrl-C` to interrupt and enter the credentials extracted from `MFG` partition.

**4. Load and run initramfs image**
```sh
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
tftpboot 0x46000000 openwrt-mediatek-filogic-jiorouter_ax6000-jidu6j01-initramfs-kernel.bin
fdt addr $(fdtcontroladdr)
fdt rm /signature
bootm
```

**5. Flash sysupgrade image**

Place the sysupgrade image in `/tmp`, then run:
```sh
sysupgrade /tmp/openwrt-mediatek-filogic-jiorouter_ax6000-jidu6j01-squashfs-sysupgrade.bin
```
Alternatively, use the sysupgrade option in LuCI.

Signed-off-by: Sheikh Faisal <sheikhfaisal713@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23510
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-09 13:40:34 +02:00
Sheikh Faisal 42eab6a9d3 mediatek: filogic: drop kmod-mt7916-firmware from JIDU6101
This device uses MT7976 radios and does not use the MT7916 blob.
Drop the unnecessary firmware package.

Signed-off-by: Sheikh Faisal <sheikhfaisal713@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23510
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-09 13:40:34 +02:00
Andrii Kuiukoff 05e95a3bb5 mediatek: filogic: cmcc rax3000m: label WAN port
The device has a label on the WAN port; add a matching DT openwrt,netdev-name.

Add openwrt,netdev-name = "wan" to gmac1 (mac@1) in mt7981b-cmcc-rax3000m.dts
to identify the WAN port. Move the cmcc,rax3000m entry to the
appropriate case block in
target/linux/mediatek/filogic/base-files/etc/board.d/02_network
so mediatek_setup_interfaces handles the device correctly.

Bump the compat version so sysupgrade shows the warning message.

Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24575
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-09 12:03:34 +02:00
Andrii Kuiukoff a55d09d291 mediatek: filogic: cmcc rax3000m: add all-in-UBI layout
This commit introduces OpenWrt U-Boot all-in-UBI layout support
for the CMCC RAX3000M / RAX3000Me, enabling:
- Prolonged device lifetime by allocating most of the flash
  to UBI (which takes care of wear-leveling)
- Maximum available storage space for OpenWrt

OpenWrt U-Boot UBI flash instructions
-------------------------------------
A device running stock firmware should be upgraded to the
latest OpenWrt firmware
(https://firmware-selector.openwrt.org/?target=mediatek%2Ffilogic&id=cmcc_rax3000m).

Back up critical data
---------------------
LuCI Web-UI:
"System" -> "Backup / Flash Firmware" -> "Save mtdblock contents"
Save mtdblock:
   factory

Make sure the file were successfully downloaded to your downloads directory.

Using the installer image
-------------------------
To simplify the installation process, this method uses a fork
of Daniel Golle's (@dangowrt) UBI Installer
https://github.com/dangowrt/owrt-ubi-installer

1. Ensure your router is running the latest OpenWrt firmware.
   Upgrade it if necessary.
2. Obtain the installer image:
   Build the installer from source according to your device variant
   https://github.com/andros-ua/owrt-ubi-installer/tree/rax3000m-ddr3
   or
   https://github.com/andros-ua/owrt-ubi-installer/tree/rax3000m-ddr4
   or download a prebuilt image from the
   https://github.com/andros-ua/owrt-ubi-installer/releases
3. Flash the openwrt*-initramfs-recovery-installer.itb
   image using sysupgrade.
4. Wait for installation:
   the green status LED will blink rapidly,
   indicating that the all-in-UBI installer is running.
   Once the installation finishes,
   the status LED will turn solid amber for 5 seconds.
5. After the device reboots, perform a final sysupgrade using the
   openwrt*-squashfs-sysupgrade.itb image.

BL2 and FIP Recovery
--------------------
Use mtk_uartboot to recover corrupted BL2 or FIP via UART:
https://github.com/981213/mtk_uartboot

OpenWrt U-Boot layout
----------------------------------------
| dev:    size   erasesize  name       |
| mtd4: 00100000 00020000 "bl2"        |
| mtd3: 00080000 00020000 "u-boot-env" |
| mtd2: 00200000 00020000 "factory"    |
| mtd1: 00200000 00020000 "fip"        |
| mtd0: 07200000 00020000 "ubi"        |
----------------------------------------

OpenWrt U-Boot UBI layout
----------------------------------
| dev:    size   erasesize  name |
| mtd1: 00100000 00020000 "bl2"  |
| mtd0: 07f00000 00020000 "ubi"  |
----------------------------------

Update MAC table after inspecting the factory partition:
----------------------------------------------------------------
| Interface    | MAC               | Source        |           |
|--------------|-------------------|---------------|-----------|
| WAN (label)  | 54:4d:d4:xx:xx:xx | factory, 0x24 | label     |
| LAN          | 54:4d:d4:xx:xx:xx | factory, 0x2a | label + 3 |
| WLAN 2.4 GHz | 54:4d:d4:xx:xx:xx | factory, 0x4  | label + 1 |
| WLAN 5 GHz   | 54:4d:d4:xx:xx:xx | factory, 0xa  | label + 2 |
----------------------------------------------------------------

Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24575
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
2026-09-09 12:03:34 +02:00
Mieczyslaw Nalewaj 7727479e5f mediatek: mt7622: convert devices with RTL8367S switch to DSA
Migrate Buffalo WSR-2533DHP2, ELECOM WRC-2533GENT and TOTOLINK A8000RU
from swconfig to DSA. These devices use an external Realtek RTL8367S
switch handled by the rtl8365mb DSA driver.

Per-device changes:
 - Drop the proprietary mediatek,rtk-gsw node
 - Add realtek,rtl8365mb DSA switch with ports lan1-lan4, wan and CPU
 - Move CPU port to gmac0 at 2500base-x (HSGMII)
 - Remove gmac1 (was 5u@eth1 in swconfig; DSA uses single CPU port)
 - Drop unused rgmii_via_gmac2 pin group
 - Replace swconfig with kmod-dsa-rtl8365mb
 - Bump DEVICE_COMPAT_VERSION (config migration not possible)
 - Remove swconfig board setup from 02_network
 - Disable CONFIG_RTL8367S_GSW in mt7622 kernel config

CPU link / bandwidth notes:
 - Buffalo WSR-2533DHP2 and TOTOLINK A8000RU: already used 2500base-x
   on gmac0 before this change; aggregate bandwidth stays the same.
 - ELECOM WRC-2533GENT: gmac0 moves from SGMII (1G) to 2500base-x
   (HSGMII).  The swconfig setup previously used two 1G CPU links
   (gmac0 + gmac1) for 2 Gbps aggregate; DSA collapses this to a
   single 2.5 Gbps link.

MAC address assignment notes:
 - Buffalo WSR-2533DHP2: WAN uses base MAC + 1, gmac0/LAN uses base MAC
   (previously the WAN MAC existed on the implicit eth1/gmac1 interface)
 - ELECOM WRC-2533GENT: WAN inherits CPU MAC via DSA conduit
   (original gmac1 had no nvmem-cells assignment)
 - TOTOLINK A8000RU: WAN reuses macaddr_factory_24 (previously gmac1)

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/24861
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-09-03 18:52:44 +02:00
Chad Monroe 0808b23b26 mediatek: use lowercase SmartRG dts filenames
Device dts filenames use the lowercase device name across the tree;
the SmartRG boards were the only ones that spell the SDG model
prefix in uppercase. Rename the files and adjust the DEVICE_DTS
values and includes. No functional changes.

Signed-off-by: Chad Monroe <chad@monroe.io>
Link: https://github.com/openwrt/openwrt/pull/24679
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-09-02 22:43:14 +02:00
Chad Monroe a3f1bf0965 mediatek: filogic: add Adtran SmartRG Mount Rainier series
Common specifications:
 * MediaTek MT7987A (4x Cortex-A53)
 * 4 GiB eMMC
 * 1 GiB DDR4 RAM
 * 1x 2500M/1000M/100M/10M WAN port (MaxLinear MXL86211C PHY)
 * 2x 2500M/1000M/100M/10M LAN ports (MaxLinear MXL86211C PHY,
   MT7987 built-in 2.5G PHY)
 * 3x LED (green/amber/white) for each Ethernet port
 * 2 buttons (Reset, Mesh/WPS)
 * uC-controlled RGB LED via I2C
 * USB 2.0 type A port
 * 3.3V-level 115200 baud UART console
 * 12V 3A DC barrel jack power input

SDG-8712: MT7992 dual-band 802.11be Wi-Fi (2.4G 4T4R, 5G 4T5R)
SDG-8732: MT7996 tri-band 802.11be Wi-Fi (2.4G 2T2R, 5G 3T3R, 6G 3T3R)

MAC addresses (base MFG_MAC from the mfginfo partition; the nvmem
cell index in the DTS is added to the base):

 wan   xx:xx:xx:xx:xx:x0  MFG_MAC
 lan1  xx:xx:xx:xx:xx:x1  MFG_MAC + 0x1
 lan2  xx:xx:xx:xx:xx:x1  MFG_MAC + 0x1
 2.4G  xx:xx:xx:xx:xx:x4  MFG_MAC + 0x4
 5G    xx:xx:xx:xx:xx:xa  MFG_MAC + 0xa
 6G    xx:xx:xx:xx:xx:x6  MFG_MAC + 0x6 (SDG-8732 only)

Both models are also available in versions including 1x FXS POTS
interface for analog phones. Those interfaces are not supported by
OpenWrt.

Installation:

1. Prepare a TFTP server at 192.168.1.10 and serve the OpenWrt
   initramfs image, renamed to "openwrt.<engnum>" for the model
   being installed:

    openwrt.440: SDG-8712
    openwrt.442: SDG-8732

2. Connect to LAN2.
3. Connect to the UART port.
4. Power on the device and type "st" to enter the U-Boot command
   line. The window to do that might be very short (below 1s), so
   type it as soon as the "U-Boot ..." string appears.
5. Run "setenv boot_mode openwrt; saveenv" to boot from OpenWrt
   partition by default.
6. Run "bootmenu" and select option 6 (TFTP openwrt image and
   boot); "run boot5" is a shortcut for the same. This downloads
   openwrt.<engnum> from the TFTP server and boots it.
7. After OpenWrt finishes booting, download the OpenWrt sysupgrade
   image and write it to eMMC using "sysupgrade".
8. After sysupgrade finishes writing, the device reboots into
   OpenWrt. When the front LED is solid white the device is ready
   for configuration.

Signed-off-by: Chad Monroe <chad@monroe.io>
Link: https://github.com/openwrt/openwrt/pull/24679
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-09-02 22:43:14 +02:00
Frank Wunderlich 1446eff887 mediatek: filogic: bpi-r4-pro-8x: add aeonsemi phy to bpi-r4-pro-8x
Add the two external Aeonsemi AS21xxx PHYs used by the LAN and WAN
10GBASE-T ports of the BPI-R4 Pro 8x. Configure their firmware, reset
timing and LEDs, and connect them to the MxL switch and GMAC1.

Replace the fixed SFP GPIO hog configuration with LAN and WAN overlays
selecting either the copper PHY or the corresponding SFP cage. Build all
four overlays, include them in the device image and select the SFP
overlays by default through U-Boot `bootconf_extra`.

Make the AS21xxx firmware package pull in the PHY driver on Linux 6.18,
instead of making the driver depend on the firmware. Update existing
Airoha device package lists accordingly so they continue to install both
components through the firmware package.

Breaking change for users using the router with SFP hogs from PR #21083.

After flashing the new image, configure `bootconf_extra` to select
between SFP or PHY overlays:

fw_setenv bootconf_extra \
mt7988a-bananapi-bpi-r4-pro-8x-lan-phy#mt7988a-bananapi-bpi-r4-pro-8x-wan-phy

If bootconf_extra had additional overlays (CN13 or CN14) keep them appended

Signed-off-by: Pietro Ameruoso <p.ameruoso@live.it>
Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
2026-09-01 16:58:57 +01:00
Daniel Golle 25f6620614 mediatek: add support for LTC Velo7 Max
FCC ID 2A5LO-VL7M19K

Aka: Tozed Kangwei ZLT W19B6VM

Hardware
--------
SoC:     MediaTek MT7988A, 4x Cortex-A73 @ 1.8 GHz
RAM:     DDR4, 1 GiB, 4 GiB or 8 GiB depending on the variant sold
         (2x ESMT M16U4G16256A on the 1 GiB one used here), sized by
         U-Boot which fills in the memory node
FLASH:   256 MiB Winbond W25N02KV SPI-NAND, managed by NMBM
WIFI:    MediaTek MT7996 802.11be tri-band (2.4/5/6 GHz), attached to
         both 2-lane PCIe interfaces
ETH:     4x 1GbE from the MT7988A built-in switch
         2x 10GbE via Realtek RTL8261BE PHYs using USXGMII
USB:     2x USB 3.0 Type-A
BUTTONS: Reset, WPS, Reboot
LEDS:    Power, Status (RGB), WLAN 2.4/5/6 GHz, WPS, TEL1 and TEL2
         (each red and green), plus dual LEDs on all six RJ-45 sockets
UART:    115200 8N1, unpopulated 3-pin 2.54mm header on the bottom edge
         of the board, which stands vertically. The pins are RX, GND, TX,
         the middle one carrying no label
POWER:   12 VDC 3 A, barrel connector

Unpopulated on this variant, and hence not described: eMMC, and two
telephony SLICs together with their RJ-12 sockets.

The LEDs of the two 10G RJ-45 sockets are left in the default behaviour
of the RTL8261BE. The PHY driver offers no means of controlling them,
and the part very likely has more LED outputs than the two used per
socket, with neither the selection nor the order of them known, so they
cannot be described in the device tree at this point.

MAC addresses
-------------
+---------+----------------------------+
|         | Source                     |
+---------+----------------------------+
| LAN     | Factory 0x4, minus 2       |
| WAN     | Factory 0x4, minus 1       |
| WLAN    | Factory 0x4, 0xa and 0x2c0 |
+---------+----------------------------+

Only the three WLAN addresses are stored in flash, as part of the MT7996
EEPROM. Both Ethernet addresses are derived from the first of them by
subtraction, which is how the vendor firmware assigns them. Also
matching the vendor firmware, the built-in switch and the 10G LAN port
share the LAN address, so an existing network configuration survives the
switch to OpenWrt.

Bootloader
----------
MediaTek U-Boot using the SDK dual-boot scheme: two sets of UBI volumes,
kernel/rootfs and kernel2/rootfs2, selected by the U-Boot environment
variable dual_boot.current_slot. The environment itself lives in the
u-boot-env UBI volume rather than in a raw MTD partition, which is what
the uboot-envtools entry looks up. U-Boot verifies the kernel FIT and,
separately, a hash over the squashfs which it takes from a top-level
rootfs node of that FIT, falling back to the other slot should either
check fail.

sysupgrade writes both volume sets so that whichever slot the bootloader
selects carries the new firmware, and clears any invalid marker left
behind by an earlier failed boot. The flashing half of that is shared
with netgear,eax17, which uses the same scheme, so it moves into
mtk_dual_boot_flash_both_slots().

Installation
------------
The vendor firmware is itself OpenWrt based and its sysupgrade accepts
the OpenWrt image directly. It is patched to not reboot unless -R is
passed, and it always writes to whichever slot is currently inactive:

  sysupgrade -R openwrt-mediatek-filogic-ltc_vl7m19k-squashfs-sysupgrade.bin

The vendor sysupgrade preserves rootfs_data, so run firstboot once
OpenWrt has come up in order to discard the vendor overlay.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-09-01 08:43:19 +01:00
Andrew LaMarcheandFrank Wunderlich 554b5dcc51 mediatek: add support for BananaPi BPi-R4 Pro 8X
The BPi-R4 Pro 8X is a Wi-Fi 7 router board based on the MT7988A SoC.

Specification
-------------

- SoC:		Mediatek MT7988A (4x Cortex-A73 @1.8GHz)
- RAM:		8GB DDR4
- Flash: 	256MB SPI-NAND, 8GB eMMC, microSD Slot
- Switch:	MT7988A built-in switch, MxL86252C
- PHYs:		2x AS21010P
- Ports:	9 ports, 7 usable simultaneously
	* 1x 1G RJ45 LAN
	* 4x 2.5G RJ45 LAN
	* 1x 10G RJ45/SFP Combo
	* 1x 10G RJ45/SFP Combo
- Buttons:	Reset, WPS
- LEDs:		Power
- USB:		On-board VIA VL822 USB3.2/USB2.0 hub
	* 1x USB-A 2.0 connector
	* 1x USB-A 3.2 connector
	* 3x NGFF-KEYB
- PCIe:
	* 2x mini-PCIe slots with PCIe 3.0 2-lane interface
	* 2x M.2 M-Key slots with PCIe 3.0 1-lane interface (switchable
	  PCIe signal with M.2 B-Key)
- Debug:	USB Type-C console port
- Power:	USB Type-C PD 20V or DC barrel connector

Note: This device comes without a MAC address programmed from the
factory. The randomly generated MAC is stored in the U-Boot env on first
boot and used persistently afterwards.

Installation
------------

Uncompress *sdcard.img.gz and write to microSD card, eg. using 'dd'. Use
bootloader menu on the serial console to install SPI-NAND once installed
to SPI-NAND you can used the bootloader menu to install to eMMC. See
instructions for BananaPi R4 for details.

Co-authored-by: Frank Wunderlich <frank-w@public-files.de>
Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-08-24 13:00:51 +01:00
Mieczyslaw Nalewaj 28f6d3e4fc mediatek: mt7622: remove bogus dsa-migration from Netgear WAX206
The Netgear WAX206 was added to OpenWrt long after the mt7622 target
had already been converted to DSA. Consequently, this device never
shipped with a swconfig-based network setup and there is no DSA
migration to perform.

Remove the spurious $(Device/dsa-migration) reference. Device/dsa-migration
is not defined for the mediatek target, so the reference expands to nothing
and no DEVICE_COMPAT_VERSION was ever set for this device; removing it has
no effect on sysupgrade compatibility.

Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/24844
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-08-23 11:46:41 +02:00
0df582fabf mediatek: convert MERCUSYS MR85X to DSA
Migrate the Mercusys MR85X network switch configuration from the legacy
swconfig architecture to the Distributed Switch Architecture (DSA) driver
framework.

This updates the device tree bindings to utilize the realtek-rtl8365mb
DSA driver for the integrated Realtek RTL8367S switch, enabling proper
native Linux bridging interface management.

Co-authored-by: Schneider Azima <Schneider-Azima12@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/19445
Co-authored-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Co-authored-by: Mikhail Zhilkin <csharper2005@gmail.com>
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24435
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-08-20 23:49:57 +02:00
Mikhail Zhilkin c9bdc4e980 mediatek: add OpenWrt UBI layout for MERCUSYS MR85X
This commit adds OpenWrt U-Boot (UBI) layout support for MERCUSYS MR85X.

Stock bootloader UBI size: 50 MiB
OpenWrt U-Boot UBI size:  127 MiB

Other changes
-------------
- Watchdog is enabled for the both layouts
- Button labels renamed according to the kernel documentation

Preparation
-----------
OpenWrt for stock U-Boot should be installed first. Before formatting or
rewriting any partition structures, you must copy EEPROM data and unique
MAC address. Navigate to the /tmp/tp_data directory on the router. Locate
and copy these files to your PC:
- default-mac (contains your device's unique MAC address mapping)
- MT7981_EEPROM.bin (contains factory wireless calibration data)

Installation
------------
1. Initialize the Hardware Environment
Power off the router. Run the mtk_uartboot utility on your computer. Power
on the router. Wait for the utility to push the initial payload, boot the
device temporarily and format the UBI partition structure.

2. Access the U-Boot Promp
Run mtk_uartboot on your computer a second time. When the utility menu
appears on your terminal screen, choose Exit. This will drop you safely
into the interactive U-Boot command line interface prompt (MT7981>).

3. Flash the BL2 (preloader)
You must write the second-stage bootloader (BL2) directly to the MTD
partition. Prepare the router to receive the BL2 image over serial Ymodem
protocol:
   MT7981> loady
In your terminal application, select File -> Transfer -> Ymodem -> Send
and select the path to:
openwrt-mediatek-filogic-mercusys_mr85x-ubi-preloader.bin
Erase the existing BL2 partition:
   MT7981> mtd erase bl2
Commit the new BL2 binary from RAM to the flash memory:
   MT7981> mtd write bl2 $loadaddr 0x0 ${filesize}

4. Provision the FIP Partition (BL31 & U-Boot)
Ready the router to receive the FIP package:
   MT7981> loady
In your terminal application, send the following file via Ymodem:
openwrt-mediatek-filogic-mercusys_mr85x-ubi-bl31-uboot.fip
Clear the legacy tracking data and configure the UBI block allocation:
   MT7981> ubi write $loadaddr fip ${filesize}

5. Boot into OpenWrt Recovery
With the core partition structures and boot code firmly written, you can
now push and execute the temporary OpenWrt recovery environment to finish
the installation. Prepare for the final serial download:
   MT7981> loady
Send the following recovery image file via Ymodem:
openwrt-mediatek-filogic-mercusys_mr85x-ubi-initramfs-recovery.itb
Boot the OpenWrt kernel image directly out of the memory cache:
   MT7981> bootm

6. Flash OpenWrt permanently
Once the router finishes booting the initramfs image, navigate to
192.168.1.1 in your web browser to access the OpenWrt LuCI recovery
interface. From there, permanently flash the production sysupgrade image.

7. Recovery factory data
Once the router finishes booting into OpenWrt, you must rebuild and flash
the factory volume payload. This process combines your unique wireless
calibration data and MAC address back into a single compliant block.
Use SCP or an SFTP client (like WinSCP) to copy your two backup files from
your PC into the router's /tmp directory:
- default-mac
- MT7981_EEPROM.bin
Connect to the router via SSH and run the following commands:
   dd if=/dev/zero bs=$((0x8000)) count=1 | tr '\000' '\377' > /tmp/factory.bin
   dd if=/tmp/MT7981_EEPROM.bin of=/tmp/factory.bin conv=notrunc
   dd if=/tmp/default-mac >> /tmp/factory.bin
Query the system to confirm the exact logical UBI character device target
for the factory volume:
ubinfo /dev/ubi0 -N factory | grep "Volume ID" | awk '{print $3}'
Commit the newly created factory.bin file directly into the designated
factory UBI block (replace _1 below if your volume ID query returned a
different number):
   ubiupdatevol /dev/ubi0_1 /tmp/factory.bin
Reboot your router to apply the changes.

Recovery
--------
The same as installation.

UART
----
Connection parameters: 115200, 8N1, 3.3V
UART pins are silkscreened on the PCB.

MAC addresses
-------------
+---------+-------------------+-----------+
|         | MAC               | Algorithm |
+---------+-------------------+-----------+
| label   | 08:xx:xx:xx:xx:f5 | label     |
| LAN     | 08:xx:xx:xx:xx:f5 | label     |
| WAN     | 08:xx:xx:xx:xx:f6 | label+1   |
| WLAN 2g | 08:xx:xx:xx:xx:f5 | label     |
| WLAN 5g | 08:xx:xx:xx:xx:f4 | label-1   |
+---------+-------------------+-----------+
label MAC address was found in UBI partition "tp_data", file
"default-mac" (raw binary MAC). Proof:
   hexdump -C default-mac
   00000000  08 xx xx xx xx f5   |....Y.|
   00000006
OEM wireless eeprom is also there (file
"MT7981_EEPROM.bin").

Link: https://github.com/981213/mtk_uartboot
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24435
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-08-20 23:49:57 +02:00
GLiNet Tech 00f7f33d2f mediatek: filogic: add support for GL.iNet BE10000
This patch adds support for GL.iNet BE10000(Slate 7 Pro)
The GL.iNet BE10000 is a portable device with Wi-Fi 7, featuring two
2.5G Ethernet ports, one of which is a LAN port
and the other a WAN port.

Hardware Specification:
 - SoC: MediaTek MT7987A (Quad-core ARM Cortex-A53 2.0 GHz)
 - RAM: 1024 MiB DDR4
 - Flash: 512 MiB SPI-NAND
 - WiFi: MediaTek MT7995AV (WiFi 7)
   - 2.4GHz: b/g/n/ax/be (2x2 MIMO)
   - 5GHz: a/n/ac/ax/be (3x3 MIMO)
   - 6GHz: ax/be (3x3 MIMO)
 - Ethernet:
   - 1x 10/100/1000/2500 Mbps WAN (Realtek RTL8221 PHY)
   - 1x 10/100/1000/2500 Mbps LAN (SoC internal PHY)
 - Buttons: Reset,Switch
 - UART: 115200 8n1 (VCC, RX, TX, GND)

Flash Layout:
 - 0x0~0x100000 : bl2
 - 0x100000~0x180000 : u-boot-env
 - 0x180000~0x580000 : Factory
 - 0x580000~0x880000 : fip
 - 0x880000~0x8c0000 : log
 - 0x8c0000~0x900000 : CFG
 - 0x900000~0x1e000000 : ubi

MAC Addresses:
 - Base MAC located at Factory partition offset 0x4000
 - gmac0 (WAN) : Base - 0 (Label MAC)
 - gmac1 (LAN) : Base - 1

Installation:
 1. You can directly upgrade using the
    openwrt-mediatek-filogic-glinet_gl-be10000-squashfs-sysupgrade.bin
    image on the official GL firmware upgrade page.
 2. Access the device and use the sysupgrade command to upgrade.
    Note: When upgrading from official firmware, use the -n parameter
    to preserve no configuration.

Signed-off-by: GLiNet Tech <glrouter@gl-inet.com>
Link: https://github.com/openwrt/openwrt/pull/22485
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-08-18 02:01:37 +02:00
Fil Dunsky 63bf79af2a mediatek: add support Teralink TL3020
This commit adds support for Teralink TL3020 256mb wireless router.

Specification
-------------
- SoC       : MediaTek MT7981B dual-core ARM Cortex-A53
- RAM       : DDR3 256 MiB (ESMT M15T2G16128A, DDR3-1866)
- Flash     : SPI-NAND 256 MiB (Winbond W25M02GV)
- WLAN      : MediaTek MT7976 2.4/5 GHz Wi-Fi 6
- Ethernet  : MediaTek MT7531 switch, 1x WAN + 3x LAN 10/100/1000 Mbps
              (2.5GbE uplink via gmac0)
- USB       : 1x USB 2.0 Type-A (power enable on GPIO 14)
- Buttons   : WPS, Reset
- LEDs      : 7x blue, 1x red
- UART      : 4-pin header on PCB
  - assignment  : 3.3V, GND, TX, RX
  - settings    : 115200n8
- Power     : 12 VDC, 1.5 A (barrel jack)

MAC addresses
-------------
EEPROM MAC is same for all the devices, but there is a `config2` partition
with unique MAC addresses:

| Interface | MAC source                                 |
|-----------|--------------------------------------------|
| LAN       | config2, offset 0x707 (ASCII, "lanmac")    |
| WAN       | config2, offset 0x787 (ASCII, "wanmac")    |
| WLAN 2.4G | config2, offset 0x68a (ASCII, "wifi2gmac") |
| WLAN 5G   | config2, offset 0x60a (ASCII, "wifi5gmac") |

The LAN MAC (gmac0) is the one printed on the device label.

Installation
------------
Factory bootloader is locked to 64mb partition layout, so OpenWrt U-Boot
has to be flashed first. Steps 1, 2 and 4 are run from a shell on the
stock firmware, where the 'bl2' and 'fip' partitions are writable - in
OpenWrt they are read-only, so the procedure cannot be repeated from
OpenWrt. Back up both partitions before overwriting them:

    mtd read bl2 /tmp/bl2.bin
    mtd read fip /tmp/fip.bin

1. Upload OpenWrt 'bl31-uboot.fip' and 'preloader.bin' images to the /tmp
   dir of the router using scp protocol
2. Write fip and bl2 (replace bootloader):

    mtd write /tmp/openwrt-mediatek-filogic-teralink_tl3020-256mb-bl31-uboot.fip fip
    mtd write /tmp/openwrt-mediatek-filogic-teralink_tl3020-256mb-preloader.bin bl2

3. Place OpenWrt
   'openwrt-mediatek-filogic-teralink_tl3020-256mb-initramfs-recovery.itb'
   image on the tftp server (IP: 192.168.1.254)
4. Erase 'ubi' partition and reboot the router:

    mtd erase ubi
    reboot

5. U-Boot automatically boots the OpenWrt recovery image from the tftp
   server to the RAM
6. Upload OpenWrt
   'openwrt-mediatek-filogic-teralink_tl3020-256mb-squashfs-sysupgrade.itb'
   image to the /tmp dir of the router (IP: 192.168.1.1) using scp
   protocol
7. Connect to the router using ssh and run:

    ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
    ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
    ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
    sysupgrade -n openwrt-mediatek-filogic-teralink_tl3020-256mb-squashfs-sysupgrade.itb

Recovery
--------
1. Place OpenWrt
   'openwrt-mediatek-filogic-teralink_tl3020-256mb-initramfs-recovery.itb'
   image on the tftp server (IP: 192.168.1.254)
2. Press "Reset" button and power on the router. After ~10 sec release
   the button.
3. Use OpenWrt initramfs system for recovery

Reverting to stock firmware requires writing the 'bl2' and 'fip' backups
taken above back with 'mtd write', then flashing the stock image; without
those backups there is no way back, because the stock bootloader cannot
be downloaded from the vendor.

Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24518
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-08-07 09:31:58 +02:00
Guillaume RISCHARD cdc44e906a mediatek: filogic: add support for COMFAST CF-WA933
The Comfast CF-WA933[1] is an outdoor dual-band WiFi 6 access
point/router. They also OEM their routers for other providers. This PR
adds support based on, and substantially updates, the downstream device
definition[2] from Wayru, one such white label client.

It can be powered by a 12V DC barrel jack (standard 5.5x2.5mm, center
positive) or via 802.3af POE.

Hardware summary:
- SoC: MediaTek MT7981A
- RAM: 256 MiB
- Flash: SPI-NAND 128 MiB (Factory uses 64M; see details below to use
  the full 128M!)
- WiFi (MT7976DA): dual-band 802.11ax
- Ethernet (MT7531AE): 3x gigabit: 1x WAN + 2x LAN (labeled lan1/lan2).
- Button: reset
- LEDs: Power (always on), WLAN, WAN, LAN1, LAN2
- Serial: Internal header (Four unpopulated headers, clearly labeled)

MAC addresses on the tested unit:
- Label:   40:a5:ef:f0:5e:0f
- LAN:     40:a5:ef:f0:5e:0f  Factory 0xe000
- WAN:     40:a5:ef:f0:5e:10  Factory 0xe000 + 1
- 2.4 GHz: 40:a5:ef:f0:5e:11  Factory 0x0004
- 5 GHz:   40:a5:ef:f0:5e:13  Factory 0x8000 + 1

The serial number is stored as an ASCII string at Factory 0xe100.

Disassembly:

Unscrew the six 3mm hex bolts on the dome and the six 5mm bolts on the
side of the arm, then lift the dome. For reassembly, make sure the large
O ring is in the groove in the dome.

OpenWrt installation:

1. Connect to Ethernet on the WAN port. Manually set your IP address to
192.168.1.10 (important!)
2. Upload the OpenWrt sysupgrade image at http://192.168.1.1

The default U-Boot partition layout does not expose the full flash
capacity. Change the mtdparts U-Boot environment variable before
rebooting and then installing the image for the 128 MiB variant through
the same bootloader recovery/upgrade page.

Method 1: Using the serial console

1. Disassemble the unit and connect to the serial console (115200 8N1).
   Leave 3.3V disconnected.
2. On the boot loader, go straight to "0. U-Boot console"
3. Then enter:
   setenv mtdparts 'nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),2048k(fip),117248k(ubi)'
   saveenv
   reset

Method 2: From OpenWrt using uboot-envtools

apk add uboot-envtools
fw_setenv mtdparts 'nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),2048k(fip),117248k(ubi)'
reboot

Return to vendor firmware:
1. If you have changed the mtdparts environment variable, undo the
   change by setting:
   mtdparts 'nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),2048k(fip),65536k(ubi)'
2. Re-enter the same bootloader recovery/upgrade page.
3. Upload a stock COMFAST firmware image, e.g. from
   http://www.comfast.com.cn/index.php?m=content&c=index&a=show&catid=85&id=773

[1]: https://comfastgroup.com/product/cf-wa933/
[2]: https://github.com/Wayru-Network/wayru-os/tree/main/profiles/prometheus

Signed-off-by: Guillaume RISCHARD <git@stereo.lu>
Link: https://github.com/openwrt/openwrt/pull/22379
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-08-03 16:25:52 +02:00
Murad Rabadanov 6c303018b3 mediatek: filogic: add support for netis N6 V2
netis N6 V2 is a MT7981B-based router, hardware-compatible with
netis NX32U (confirmed via bootloader cross-flash). GPIO mappings
not covered by the vendor DTS were verified against NX32U and via
live link/carrier testing on switch ports, plus direct LED-toggle
confirmation on the physical device.

Hardware:
  SoC:      MediaTek MT7981B (Filogic 820)
  RAM:      256 MiB DDR3 (ESMT M15T2G16128A-AZR1-EFB, DDR3-1866)
  Flash:    128 MiB SPI-NAND
  Ethernet: 4x 1GbE (mt7531 switch: wan, lan1, lan2, lan3),
            2.5GbE internal CPU-switch link (gmac0, 2500base-x)
  WiFi:     MT7981 integrated 2.4GHz + MT7976C 5GHz radio,
            802.11ax, 2x2 MU-MIMO, HE160 supported (confirmed live;
            vendor firmware ships with HE80 for the AX1800 rating)
  USB:      1x USB 3.0 (vbus GPIO 23, active high)
  Buttons:  mesh/rfkill (GPIO 0), reset (GPIO 1)
  LEDs:     power (GPIO 4), status (GPIO 5), wan (GPIO 9),
            wlan 2.4GHz (GPIO 34, phy0tpt trigger),
            wlan 5GHz (GPIO 35, phy1tpt trigger),
            usb (GPIO 13, usbport trigger)
            all active low
  UART:     115200n8, uart0

MAC addresses:
  Interface   | Source           | Offset   | Address (this unit)
  ------------|------------------|----------|--------------------
  WAN         | Factory mac-base | 0x1fef26 | 30:07:5c:dc:7a:d2
  LAN/CPU     | Factory mac-base | 0x1fef20 | 30:07:5c:dc:7a:d0 (label)
  WiFi 2.4GHz | radio calibration (auto)     | 30:07:5c:dc:7a:d1
  WiFi 5GHz   | radio calibration (auto)     | b2:07:5c:dc:7a:d1

  LAN address matches the label on the device enclosure. WAN uses
  macaddr_factory_1fef26 on switch port@0, LAN/CPU uses
  macaddr_factory_1fef20 on port@6 (mt7531 switch). WiFi MACs are not
  set explicitly in DTS -- mt76 derives them from the radio's own
  calibration data, confirmed live to match the stock firmware value.

The USB LED (GPIO 13) was missed in the initial GPIO mapping pass --
it isn't referenced anywhere in the vendor DTS or any other board
signal, so it went unnoticed until manual GPIO toggling (`gpio clear
13` at the U-Boot prompt) confirmed it live on the physical device.
The USB LED on GPIO 13 uses the usbport trigger with trigger-sources
on both xhci ports, hence kmod-usb-ledtrig-usbport in DEVICE_PACKAGES.

The included U-Boot defenv for this board also avoids a silent
failure in ubi_write_production/ubi_write_recovery: these call
`ubi remove <vol>` without first detaching/reattaching the UBI
device, which fails silently on a busy volume while the boot script
proceeds as if it succeeded. Worked around here by adding
`ubi detach ; ubi part ubi ;` before the remove, a pattern already
used in other boards' defenvs (see issue #18231). Only this board's
defenv is touched -- other boards' defenv files are unchanged.

Known upstream issue (not specific to this port): probing
u-boot-env-layout on the ubootenv/ubootenv2 UBI volumes logs
"Invalid calculated CRC32" on every boot, see mediatek/filogic
issues #21876 and #22383.

Installation:
  Requires network access to stock firmware SSH (enabled by default)
  and a TFTP server on the same subnet.
  1. Set up a TFTP server on your PC at 192.168.1.254, serving the
     files from this release.
  2. SSH into stock firmware: ssh root@192.168.1.1
  3. Copy bl31-uboot.fip to the router and write it to the FIP
     partition: mtd write bl31-uboot.fip FIP
  4. Erase the ubi partition: mtd erase ubi
  5. Reboot. The new bootloader will detect the missing production
     image and automatically fetch initramfs-recovery.itb via TFTP.
  6. Once recovery has booted, SSH in again and sysupgrade to the
     production image: sysupgrade squashfs-sysupgrade.itb

Signed-off-by: Murad Rabadanov <the21.21@mail.ru>
Link: https://github.com/openwrt/openwrt/pull/24089
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-08-02 23:45:58 +02:00
Dmitry Mostovoy b9d7b448c2 mediatek: add support for Cudy WR3000U v1
Hardware:
 - SoC: MediaTek MT7981B
 - CPU: 2x 1.3 GHz Cortex-A53
 - Flash: 256 MiB ESMT F50L2G41XA
 - RAM: DDR3, 512 MiB
 - WLAN: 2.4 GHz, 5 GHz (MediaTek MT7976CN, 802.11ax)
 - 1x WAN MT7531 (JXD 2531Z) 10/100/1000 Mbps
 - 4x LAN 2x MT7530 (JXD 2529S) 10/100/1000 Mbps
 - USB 3.0 port
 - Buttons: Reset, WPS
 - 8x LEDs: 2x Red, 6x Blue
 - Serial console: no need to solder. 115200 8n1
 - Power: 12 VDC, 1.5 A

The DTS inherits WBR3000UAX because WR3000U is almost the same.
The only difference is size of NAND and factory UBI length.

+---------+-------------------+-----------+
|         | MAC               | Algorithm |
+---------+-------------------+-----------+
| WAN     | D4:0D:AB:xx:xx:x1 | label+1   |
| LAN     | D4:0D:AB:xx:xx:x0 | label     |
| WLAN 2g | D4:0D:AB:xx:xx:x0 | label     |
| WLAN 5g | D6:0D:AB:xx:xx:x1 | label+1   |
+---------+-------------------+-----------+

There are 2 ways to install OpenWrt:
- via an intermediate RSA-signed vendor's image or
- via UART && TFTPd

Migration to OpenWrt via OEM firmware:
- Download the migration image from
  https://drive.google.com/drive/folders/1BKVarlwlNxf7uJUtRhuMGUqeCa5KpMnj
  (The folder is Cudy's official "Cudy Intermediary OpenWrt Firmware" resource)
- Upload the migration image via OEM web interface
- After flashing, OpenWrt is accessible via http://192.168.1.1
- Flash the official OpenWrt image

Install using UART & TFTP:
- Connect to UART.
- Connect to LAN and set your IP to 192.168.1.88/24.
- Configure a TFTP server to serve
  openwrt-mediatek-filogic-cudy_wr3000u-v1-initramfs-kernel.bin file
  and run the TFTP server.
- Press reset and power-on the router. Hold the reset button for 5 seconds
- TFTP error: 'File not found' appears and MTK console becomes available
- Enter the following commands in the console:
  setenv bootfile openwrt-mediatek-filogic-cudy_wr3000u-v1-initramfs-kernel.bin
  tftpboot
  bootm
- After booting to initramfs, via http://192.168.1.1 flash
  openwrt-mediatek-filogic-cudy_wr3000u-v1-squashfs-sysupgrade.bin
- After flashing, OpenWrt is accessible via http://192.168.1.1

If you fail to flash the device,
you can use TFTP to flash back to the original firmware:
- Download the original firmware from
  https://www.cudy.com/pages/download-center/wr3000u-256mb-1-0
- Connect to LAN and set your IP to 192.168.1.88/24.
  Configure a TFTP server and an recovery.bin firmware file
- With the router off, press the RESET button.
  While the router is turning on,
  the button should continue to be pressed for at least 5 seconds
- After 1-2 minutes the original firmware is available on http://192.168.10.1

Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24447
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-08-02 14:57:35 +02:00
Andrii Kuiukoff 417ccfed43 mediatek: comfast cf-wr632ax: add all-in-UBI layout
This commit introduces OpenWrt U-Boot UBI layout support
for the COMFAST CF-WR632AX, enabling:
- Prolonged device lifetime by allocating most of the flash
  to UBI (which takes care of wear-leveling)
- Maximum available storage space for OpenWrt
- Fully-featured U-Boot
- Effective recovery mechanisms

OpenWrt U-Boot UBI flash instructions
-------------------------------------

A device running stock firmware should be upgraded to the
latest standard OpenWrt firmware
(https://firmware-selector.openwrt.org/?target=mediatek%2Ffilogic&id=comfast_cf-wr632ax).

Back up critical data
---------------------

Console:
1. While the device is running OpenWrt with stock MTD partitions:
   mtd dump BL2 > /tmp/BL2.bin
   mtd dump u-boot-env > /tmp/u-boot-env.bin
   mtd dump Factory > /tmp/Factory.bin
   mtd dump FIP > /tmp/FIP.bin
2. Copy the backup files to your PC via SCP.

LuCI Web-UI:
"System" -> "Backup / Flash Firmware" -> "Save mtdblock contents"
Save mtdblock:
   BL2
   u-boot-env
   Factory
   FIP
Make sure the files were successfully downloaded to your downloads directory,
especially the Factory file.

Using the installer image
-------------------------
To simplify the installation process, this method uses a fork
of Daniel Golle's (@dangowrt) UBI Installer
https://github.com/dangowrt/owrt-ubi-installer

1. Ensure your router is running the latest generic OpenWrt firmware.
   Upgrade it if necessary.
2. Obtain the installer image:
   Build the installer from source
   https://github.com/andros-ua/owrt-ubi-installer/tree/cf-wr632ax
   or download a prebuilt image from the
   https://github.com/andros-ua/owrt-ubi-installer/releases
3. Flash the openwrt*-ubi-initramfs-recovery-installer.itb
   image using sysupgrade.
4. Wait for installation: the green status LED will blink rapidly,
   indicating that the all-in-UBI installer is running.
5. Once the installation finishes,
   the status LED will turn solid amber for 5 seconds.
6. After the device reboots, perform a final sysupgrade using the
   openwrt*-ubi-squashfs-sysupgrade.itb image.

Return to stock MTD
-------------------
1. Flash openwrt*comfast_cf-wr632ax-initramfs-kernel.bin
   via sysupgrade
2. Copy files to /tmp on the device via SCP:
   BL2.bin
   u-boot-env.bin
   Factory.bin
   FIP.bin
   openwrt*-squashfs-sysupgrade.bin
3. Restore stock MTD partitions:
   apk add kmod-mtd-rw
   insmod mtd-rw i_want_a_brick=1
   mtd write /tmp/BL2.bin BL2
   mtd write /tmp/u-boot-env.bin u-boot-env
   mtd write /tmp/Factory.bin Factory
   mtd write /tmp/FIP.bin FIP
4. Install the system:
   sysupgrade /tmp/*sysupgrade.bin

BL2 and FIP Recovery
--------------------
Use mtk_uartboot to recover corrupted BL2 or FIP via UART:
https://github.com/981213/mtk_uartboot

Stock layout
----------------------------------------
| dev:    size   erasesize  name       |
| mtd0: 00100000 00020000 "BL2"        |
| mtd1: 00080000 00020000 "u-boot-env" |
| mtd2: 00200000 00020000 "Factory"    |
| mtd3: 00200000 00020000 "FIP"        |
| mtd4: 07000000 00020000 "ubi"        |
----------------------------------------

OpenWrt U-Boot UBI layout
----------------------------------
| dev:    size   erasesize  name |
| mtd0: 00100000 00020000 "bl2"  |
| mtd1: 07f00000 00020000 "ubi"  |
----------------------------------

Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23981
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-30 21:42:33 +02:00
Emre Yavuzalp f23af0c828 mediatek: add UBI layout for TP-Link BE450
Add an OpenWrt U-Boot ("UBI") layout variant for the TP-Link Archer
BE450. It replaces the vendor bootloader and the stock dual-image
layout with a single large UBI partition, extending the usable flash
to around 95 MiB, and ships a current U-Boot with TFTP recovery.

Hardware
--------
SoC:    MediaTek MT7988D (Filogic 880)
Wi-Fi:  MediaTek MT7992AV (BE7200, 2.4/5 GHz)
Flash:  128 MiB SPI-NAND
RAM:    512 MiB DDR4
Serial: 115200 8N1, header located next to the heatsink:

heatsink
|   |
|   |
|   |     +----+-----+------+-------+               +-----------------+
|   |     | TX |  RX |  GND | +3.3V |               | power connector |
+---+     +----+-----+------+-------+               +-----------------+
                                  |
                Don't connect ----+

MAC addresses
-------------
The label MAC (base) is stored in tp_data/default-mac and is written
into the factory partition at offset 0x4 during installation:

eth0 (LAN): base (factory 0x4)
eth1 (WAN): base + 1
eth2 (LAN): base + 2
Wi-Fi:      derived by mt76 from the factory EEPROM (2.4 GHz = base,
            5 GHz = base with bit 0x10 set), matching the stock
            layout behaviour.

Installation
------------
Requires a serial connection and a TFTP server. The device must be
running the stock-layout OpenWrt (tplink_be450) build.

1. From the running stock-layout OpenWrt, back up the vendor
   bootloader and the calibration/MAC data. These cannot be
   recovered otherwise:

     cat /dev/mtd0 > /tmp/boot.bin
     cat /dev/mtd5 > /tmp/tp_data.bin
     scp /tmp/boot.bin /tmp/tp_data.bin user@pc:backup/
     scp -r /tmp/tp_data user@pc:backup/

   Store boot.bin, tp_data.bin and the tp_data file contents
   (MT7992_EEPROM.bin, default-mac) somewhere safe.

2. Boot the UBI-layout initramfs. Connect the PC to one of the LAN ports
   (LAN1-3) and serve the recovery image from a TFTP server on the PC at
   192.168.1.2. Interrupt the vendor U-Boot on the serial console
   (Ctrl+C), then:

     setenv serverip 192.168.1.2
     tftpboot 0x50000000 openwrt-mediatek-filogic-tplink_be450-ubi-initramfs-recovery.itb
     bootm 0x50000000

3. Copy the required files to the booted initramfs (192.168.1.1):

     scp -O MT7992_EEPROM.bin default-mac \
       openwrt-mediatek-filogic-tplink_be450-ubi-bl31-uboot.fip \
       openwrt-mediatek-filogic-tplink_be450-ubi-preloader.bin \
       openwrt-mediatek-filogic-tplink_be450-ubi-squashfs-sysupgrade.itb \
       root@192.168.1.1:/tmp

4. Build the factory image from the EEPROM and MAC data:

     cd /tmp
     dd if=/dev/zero bs=$((0x100000)) count=1 | tr '\000' '\377' > factory.bin
     dd if=MT7992_EEPROM.bin of=factory.bin bs=1 count=$((0x1e00)) conv=notrunc
     dd if=default-mac of=factory.bin bs=1 seek=4 conv=notrunc

5. Create the UBI volumes. Warning: this permanently erases the
   remaining vendor data, including tp_data - only proceed with the
   backups from step 1 stored safely:

     ubidetach -p /dev/mtd2
     ubiformat /dev/mtd2 -y
     ubiattach -p /dev/mtd2
     ubimkvol /dev/ubi0 -N fip -t static -s 2MiB
     ubiupdatevol /dev/ubi0_0 /tmp/openwrt-mediatek-filogic-tplink_be450-ubi-bl31-uboot.fip
     ubimkvol /dev/ubi0 -N ubootenv -s 0x1f000
     ubimkvol /dev/ubi0 -N ubootenv2 -s 0x1f000

6. Write the factory data and the BL2 preloader. kmod-mtd-rw is
   required to lift the read-only protection of the bl2 partition;
   set up internet access first or upload the package manually:

     apk update && apk add kmod-mtd-rw
     insmod mtd-rw i_want_a_brick=1
     mtd erase factory
     mtd write /tmp/factory.bin factory
     mtd erase bl2
     mtd write /tmp/openwrt-mediatek-filogic-tplink_be450-ubi-preloader.bin bl2

7. Flash the system:

     sysupgrade -n /tmp/openwrt-mediatek-filogic-tplink_be450-ubi-squashfs-sysupgrade.itb

Revert to stock firmware
------------------------
1. From the UBI-layout OpenWrt, force-flash the stock-layout OpenWrt
   (tplink_be450) initramfs image; the board name differs, so
   sysupgrade must be forced:

     sysupgrade -F -n openwrt-mediatek-filogic-tplink_be450-initramfs-kernel.bin

2. After booting into that initramfs, set up network access, copy
   boot.bin and tp_data.bin from the backup to /tmp and restore the
   vendor bootloader and data:

     apk update && apk add kmod-mtd-rw
     insmod mtd-rw i_want_a_brick=1
     mtd erase boot
     mtd write /tmp/boot.bin boot
     mtd erase ubi0
     mtd erase ubi1
     mtd erase userconfig
     mtd erase tp_data
     mtd write /tmp/tp_data.bin tp_data

3. Verify the tp_data restore before rebooting - without it the
   device has no ethernet:

     md5sum /tmp/tp_data.bin
     md5sum /dev/mtd5

   If the checksums match, reboot. The vendor U-Boot web recovery
   comes up on 192.168.1.1; flash the TP-Link stock firmware from
   there.

Signed-off-by: Emre Yavuzalp <emreyavuzalp2@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23211
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-30 21:24:28 +02:00
Fil Dunsky 7ba90841de mediatek: cleanup Huasifei WH3000 / WH3000 Pro dts
WH3000 / WH3000 Pro button:
- These routers has no switch button, it's a regular button
  `linux,input-type = <EV_SW>;` removed

WH3000 Pro NAND:
- Add spi-nand calibration
- Align image size with vendor U-Boot partition layout:
  `nmbm0:1024k(bl2),512k(u-boot-env),2048k(factory),2048k(fip),231936k(ubi)`
- Remove redundant options from firmware build recipe
- Remove redundant `spi_nand:` label from DTS

Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23227
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-24 09:38:00 +02:00
Ahmed Naseef ee2e25f009 mediatek: add support for Airtel AirFiber AAP4221ZY
The Airtel AirFiber AAP4221ZY is an ISP-provided router that is part
of the ISP's Fixed Wireless Access (FWA) solution. The FWA system
consists of two units: an outdoor 5G unit and this indoor Wi-Fi router
connected via a PoE ethernet link. This commit adds support for the
indoor unit.

The OEM appears to be Zyxel with model number EX3310-T0, although this
is not printed on any label and only found in the vendor firmware DTS,
bootlog, and other internal references.

Hardware
--------
SOC: MediaTek MT7981B
CPU: 2 core Cortex-A53 (1300MHz)
RAM: 512MB DDR3
FLASH: 512MB SPI-NAND (Micron, 4096 page, 256KiB block)
WIFI: MediaTek MT7976 802.11ax 2x2 2.4GHz + 5GHz
ETH: Airoha AN8855 GbE Switch (2x LAN) + MT7981 internal GbE PHY (WAN)
POE: WAN port provides PoE to the outdoor unit (GPIO 10)
UART: 3V3 115200 8N1

Bootloader
----------
The device uses BL2 -> U-Boot -> Zyxel zloader chain. U-Boot has a
hardcoded command to always launch zloader (similar to the Zyxel
EX5601-T0, see commit 1c05388ab0). zloader is the Zyxel secondary
bootloader which handles dual-boot (ubi/ubi2 A/B scheme), firmware
verification, and PoE port enablement.

zloader requires a UBI volume named "zyfwinfo" containing a 256-byte
metadata structure with a "ZYXE" magic header and a valid checksum.
Without this volume, zloader refuses to boot the firmware. The
zyfwinfo structure also contains a sequence number (range 0-9999,
wraps around) used to select which firmware bank to boot - the bank
with the higher sequence number wins. This OpenWrt image sets it to
5555 to always win over stock firmware starting at 0.

During sysupgrade, platform.sh refreshes the zyfwinfo volume before
writing kernel and rootfs to UBI, as rootfs_data is sized to fill the
remaining space.

Note that OpenWrt can only be flashed to ubi (mtd6). The zloader
appends rootubi=ubi or rootubi=ubi2 to the kernel bootargs based on
which partition it selects, but OpenWrt cannot understand this
parameter, so the firmware must always reside on the first bank (ubi).

UART access
-----------
Serial console output is restricted by the U-Boot environment variable
EngDebugFlag which is 0x00 by default. Users need to first obtain root
access on the vendor firmware and run:

  fw_setenv EngDebugFlag 0x01

Then reboot. Connect UART and press Enter to enter the zloader shell
(ZHAL> prompt). Use the ATGU command to switch to the U-Boot shell.
Note: ATGU must be entered twice to get the MT7981> prompt:

  ZHAL> ATGU
  [zloader reloads]
  ZHAL> ATGU
  MT7981>

Installation
------------
1. Enable UART access as described above.
2. Enter U-Boot shell (ATGU twice from ZHAL> prompt).
3. Load the initramfs image via TFTP:

  MT7981> setenv ipaddr 192.168.1.1
  MT7981> setenv serverip 192.168.1.2
  MT7981> tftpboot 0x46000000 openwrt-mediatek-filogic-airtel_aap4221zy-initramfs-kernel.bin
  MT7981> bootm 0x46000000

4. Once OpenWrt boots from initramfs, transfer and flash the
   sysupgrade image:

  sysupgrade -n /tmp/openwrt-mediatek-filogic-airtel_aap4221zy-squashfs-sysupgrade.bin

5. The device will reboot and zloader will boot OpenWrt from flash.

Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22809
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-24 08:58:55 +02:00
Fil Dunsky 6487cc9a1f mediatek: add support for Hiveton H5000M
Hardware specification:
SoC: MediaTek MT7987A
Flash: 8GB eMMC
RAM: 1GB DDR4
Ethernet: 2x 2.5GbE (RTL8221B PHY + Internal PHY)
WiFi: MediaTek MT7992 / 2+3 antenna variant
Interface: M.2 USB for 5G module
LED: Power (hw-controlled), 2.5G WAN (user-definable),
5G Module (hw-controlled), LED-3 (user-definable),
LED-4 (user-definable)
Button: Reset, WPS
Power: USB Type-C PD
Other: PWM Fan control

MAC address assignment is unconventional: the board has no Factory
partition with pre-programmed MACs. Instead, all addresses are
derived from the eMMC CID at runtime:

  LAN : macaddr_generate_from_mmc_cid mmcblk0
  WAN : LAN + 1 (label_mac)
  phy0: LAN + 2
  phy1: LAN + 3

This matches the vendor firmware behaviour and ensures stable,
unique addresses across reboots without a dedicated EEPROM region
for MACs.

Flash instructions:

Factory `mmcblk0p2` partition is empty,
stock ImmortalWrt-798x-mt799x-6.6-mtwifi from PadavanOnly firmware
uses `MT7991_MT7976_EEPROM_BE5040_iPAiLNA.bin`.
Flashing this eeprom before flashing OpenWrt will make OpenWrt read eeprom:
```
dd if=/lib/firmware/MT7991_MT7976_EEPROM_BE5040_iPAiLNA.bin of=/dev/mmcblk0p2 bs=1 count=7680
sync
```
But it will have wifi issues for now. It's better to use OpenWrt fallback eeprom for now.

Power off the device.
Press and hold the Reset button.
Power on the device while keeping the Reset button pressed.
Wait for the device to enter U-Boot recovery mode.
Connect to the device via Ethernet (default IP: 192.168.1.1).
Set your PC's IP to 192.168.1.x (e.g., 192.168.1.100).
Open a web browser and navigate to http://192.168.1.1
Upload and flash the OpenWrt firmware
Wait for the flashing process to complete and the device to reboot.

Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21398
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-09 09:41:47 +02:00
solodecode b16caea407 mediatek: filogic: fix Globitel BT-R320 recovery image name
The initramfs image name already contains "-initramfs". Using "-initramfs-recovery.itb" as the suffix makes the BT-R320 recovery artifact contain it twice.

Use "-recovery.itb" instead.

Fixes: a3105d3f95 ("mediatek: filogic: add support for Globitel BT-R320")
Signed-off-by: solodecode <zikwarface134@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24059
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-07-04 18:02:38 +02:00
Dmitry Mostovoy 395252be08 mediatek: add cudy m3000-v2-yt8821 ubootmod
RAM: ESMT M15T2G16128A-DEB DDR3 1866 MT/s

This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.

1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdinfo" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
  apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1

3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
  mtd -e BL2 write openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-preloader.bin BL2
  mtd -e FIP write openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
  ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
  ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
  ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.

Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-01 09:32:36 +02:00
Dmitry Mostovoy 6a08c65949 mediatek: add cudy m3000-v1 ubootmod
RAM: ESMT M15T2G16128A-DEB DDR3 1866 MT/s

This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.

1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdinfo" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
  apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1

3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
  mtd -e BL2 write openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-preloader.bin BL2
  mtd -e FIP write openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
  ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
  ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
  ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.

Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-01 09:32:36 +02:00
Sven Eckelmann 4abe97b2bc rtl826x-firmware: ship rtl8261n and rtl8264b in single firmware package
The firmware loading does not depend (solely) on the PHY id. The driver
needs to read out the vendor version id of the PHY before it can decide
which firmware file needs to be loaded.

A split in an RTL8261N and an RTL8264B firmware package is therefore
misleading. And it could even be that a product ships an RTL8264B but
switches the revision of the chip in the middle of its product lifetime. In
this case, the first identification based on the chip ID or the actual chip
ID for the OpenWrt porter might fail for another user with a later/earlier
produced device.

Shipping both files in the same package avoids this problem. Only the "low
power" firmware package is slightly misleading because there is only a
RTL8261N firmware binary for low power but no corresponding RTL8264B
version. It will ship simply the non-low power version for RTL8264B.

Suggested-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Link: https://github.com/openwrt/openwrt/pull/23947
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-07-01 00:13:59 +02:00
Fil Dunsky 673df8f6a9 mediatek: add support Livinet Li320
This commit adds support for Livinet Li320 wireless router.

Specification
-------------
- SoC       : MediaTek MT7981B dual-core ARM Cortex-A53
- RAM       : 512MB
- Flash     : SPI-NAND Fudan Micro FM25S01BI3
- WLAN      : MediaTek MT7976 dual-band Wi-Fi 6
- Ethernet  : MediaTek MT7531 switch, 1x WAN + 3x LAN (2.5GbE uplink via gmac0)
- Buttons   : WPS, Reset
- LEDs      : 8xGreen, 1xRed
- Power     : Barrel DC 12v

Installation
------------
The factory firmware is a compatible OpenWrt-based fork, allowing
direct installation via the LuCI upgrade page using the sysupgrade image.

MAC addresses
-------------
| Interface | MAC source               |
|-----------|--------------------------|
| LAN       | Factory 0x4 (mac-base -1)|
| WAN       | Factory 0x4 (mac-base -2)|
| WLAN 2.4G | Factory 0x4 (mac-base)   |
| WLAN 5G   | Factory 0x4 (mac-base +1)|

Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23744
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-29 09:15:18 +02:00
Fil Dunsky e79df8aa03 mediatek: add WD-R3000N-G2A as ALT device for Bazis AX3000WM
The Bazis AX3000WM is an OEM variant of the Shenzhen Jia Yan Technology
WD-R3000N-G2A (per EAEU certificate N RU Д-CN.РА04.В.23104/26). Hardware
is identical. Added for the owners of this device so they can find it
in firmware-selector.

Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23653
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-06-26 00:09:24 +02:00
Andrii Kuiukoff e414ca4fa6 mediatek: creatlentem clt-r30b1: add all-in-UBI layout
This commit introduces OpenWrt U-Boot all-in-ubi layout support
for the CreatLentem CLT-R30B1, enabling:
- Fully-featured U-Boot
- Effective recovery mechanisms
- Prolonged device lifetime by allocating most of the flash
  to UBI (which takes care of wear-leveling)
- Maximum available storage space for OpenWrt
- Unified firmware across different device variants

OpenWrt U-Boot UBI flash instructions
-------------------------------------

Using the installer image
-------------------------
To simplify the installation process, this method uses a fork
of Daniel Golle's (@dangowrt) UBI Installer
https://github.com/dangowrt/owrt-ubi-installer

1. Ensure your router is running the latest generic OpenWrt firmware.
   Upgrade it if necessary.
2. Obtain the installer image:
   Build the installer from source
   https://github.com/andros-ua/owrt-ubi-installer/tree/clt-r30b1
   or download a prebuilt image from the
   https://github.com/andros-ua/owrt-ubi-installer/releases
3. Flash the openwrt*creatlentem_clt-r30b1-ubi-initramfs-recovery-installer.itb
   image using sysupgrade.
4. Wait for installation: the green status LED will blink rapidly,
   indicating that the all-in-UBI installer is running.
5. Once the installation finishes,
   the status LED will turn solid white (lime) for 5 seconds.
6. After the device reboots, perform a final sysupgrade using the
   openwrt*creatlentem_clt-r30b1-ubi-squashfs-sysupgrade.itb image.

Return to stock layout
----------------------
1. Flash openwrt*creatlentem_clt-r30b1(-112m)-initramfs-kernel.bin
   via sysupgrade
2. Copy files to /tmp on the device via SCP:
   BL2.bin
   u-boot-env.bin
   Factory.bin
   FIP.bin
   openwrt*creatlentem_clt-r30b1(-112m)-squashfs-sysupgrade.bin
3. Restore stock MTD partitions:
   apk add kmod-mtd-rw
   insmod mtd-rw i_want_a_brick=1
   mtd write /tmp/BL2.bin BL2
   mtd write /tmp/u-boot-env.bin u-boot-env
   mtd write /tmp/Factory.bin Factory
   mtd write /tmp/FIP.bin FIP
4. Install the system:
   sysupgrade /tmp/*sysupgrade.bin

Recovery
--------
Use mtk_uartboot to recover corrupted BL2 or FIP via UART:
https://github.com/981213/mtk_uartboot

Stock layout
----------------------------------------
| dev:    size   erasesize  name       |
| mtd0: 00100000 00020000 "BL2"        |
| mtd1: 00080000 00020000 "u-boot-env" |
| mtd2: 00200000 00020000 "Factory"    |
| mtd3: 00200000 00020000 "FIP"        |
| mtd4: 07000000 00020000 "ubi"        |
----------------------------------------

OpenWrt U-Boot UBI layout
----------------------------------
| dev:    size   erasesize  name |
| mtd0: 00100000 00020000 "BL2"  |
| mtd1: 07f00000 00020000 "ubi"  |
----------------------------------

Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20666
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-17 09:09:25 +02:00
Andrii Kuiukoff 38aa2fa410 mediatek: creatlentem clt-r30b1: correct alternate model to EP-RT2980
Update DEVICE_ALT0_MODEL for the EDUP entry from "RT2980" to "EP-RT2980"
to correct the alternate device model string.

Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/20666
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-17 09:09:24 +02:00
Ryan Leung adb7ff2792 mediatek: wavlink wl-wn536ax6 rev a: add "network" LED trigger
Currently the "WiFi" LED indicator light is triggered only by activity on the 5 GHz PHY.

Change it to be triggered by WLAN activity on either Wi-Fi PHY, matching stock behaviour, by using
`kmod-ledtrig-network` added in 2aa1185fb0 ('leds: add "network" LED trigger (lan/wan/wlan)').

Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23682
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-14 12:31:36 +02:00
Donghyun Ko 9e697c05df mediatek: fix WLAN LED indication for ipTIME AX3000SE
OpenWrt has recently added the "network" LED trigger to support routers
that have a single WLAN LED for multiple phys.

This patch replaces the temporary workaround used during initial
support, where the LED was triggered only by activity on a single phy.

With this change, the WLAN LED on the ipTIME AX3000SE now correctly
indicates activity on both `phy0` and `phy1`.

Signed-off-by: Donghyun Ko <nyankosoftware@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23723
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-06-14 11:09:46 +02:00
Mikhail Zhilkin 17dc71c08d mediatek: add support for netis EAP930 V1
This commit adds support for netis EAP930 V1 ceiling access point.

Specification
-------------
- SoC       : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz
- RAM       : 256 MiB DDR3 (ESMT M15T2G16128A-EFB)
- Flash     : SPI-NAND 128 MiB (ESMT F50L1G41LB-104)
- WLAN      : MediaTek MT7976CN dual-band WiFi 6
  - 2.4 GHz : b/g/n/ax,  MIMO 2x2
  - 5 GHz   : a/n/ac/ax, MIMO 2x2
- Ethernet  : 10/100/1000 Mbps x1 (SoC internal phy)
- USB       : No
- Buttons   : Reset
- LEDs      : 1x Status (red), gpio-controlled
              1x Status (blue), gpio-controlled
- Power     : 48 VDC (PoE) or 12 VDC, 1.5 A

Installation
------------
1. Connect to the access point using ssh (user: admin, pass: web interface
   password)
2. Make mtd backup:
   cat /dev/mtd0 | gzip -1 -c > /tmp/mtd0_spi0.0.bin.gz
   cat /dev/mtd1 | gzip -1 -c > /tmp/mtd1_BL2.bin.gz
   cat /dev/mtd2 | gzip -1 -c > /tmp/mtd2_u-boot-env.bin.gz
   cat /dev/mtd3 | gzip -1 -c > /tmp/mtd3_Factory.bin.gz
   cat /dev/mtd4 | gzip -1 -c > /tmp/mtd4_FIP.bin.gz
   cat /dev/mtd5 | gzip -1 -c > /tmp/mtd5_ubi.bin.gz
3. Download mtd backup from the /tmp dir of the router to your PC using
   scp protocol
4. Upload OpenWrt 'bl31-uboot.fip', 'preloader.bin' images to the /tmp
   dir of the router using scp protocol
5. Write FIP and BL2 (replace bootloader):
   mtd write /tmp/bl31-uboot.fip FIP
   mtd write /tmp/preloader.bin spi0.0
6. Place OpenWrt
   'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
   on the tftp server (IP: 192.168.1.254)
7. Erase 'ubi' partition and reboot the router:
   mtd erase ubi
   reboot
8. U-Boot automatically boot OpenWrt recovery image from tftp server to
   the RAM (1 Gbps link is required)
9. Upload OpenWrt 'sysupgrade.itb' image to the /tmp dir of the router
   (IP: 192.168.1.1) using scp protocol
10. Connect to the router using ssh and run:
    sysupgrade -n squashfs-sysupgrade.itb

Recovery
--------
1. Place OpenWrt
   'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
   on the tftp server (IP: 192.168.1.254)
2. Press Reset button and power on the router. After ~10 sec release
   the button.
3. Use OpenWrt initramfs system for recovery

Return to stock
---------------
1. Upload stock BL2, FIP, ubi partitions backup archives to the /tmp dir
   of the router using scp protocol
2. Connect to the router using ssh and run:
   apk update && apk add kmod-mtd-rw
   insmod mtd-rw i_want_a_brick=1
   mtd unlock BL2
   mtd unlock FIP
4. Restore backups:
   zcat /tmp/mtd1_BL2.bin.gz | mtd write - BL2
   zcat /tmp/mtd4_FIP.bin.gz | mtd write - FIP
   zcat /tmp/mtd5_ubi.bin.gz | mtd write - ubi
3. Reboot the router:
   reboot

UART
----
Connection parameters: 115200, 8N1, 3.3V
UART pins are silkscreened on the PCB.

MAC addresses
-------------
+---------+-------------------+-----------+
|         | MAC               | Algorithm |
+---------+-------------------+-----------+
| LAN     | 88:xx:xx:88:xx:d3 | label     |
| WLAN 2g | 88:xx:xx:18:xx:d4 |           |
| WLAN 5g | 88:xx:xx:78:xx:d4 |           |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'Factory', 0x1fef20
The WLAN 2g/5g MAC prototype (hex) was found in 'Factory', 0x4

Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23133
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-26 00:50:00 +02:00