Vendor U-Boot stores its environment at offset 0x2000 inside the
"config" partition (size 0x4000). The offset is not erase-block
aligned, so the fw_env tool's alignment check rejects the natural
secsize=0x20000. Declaring secsize=0x2000 passes the check, lets
fw_printenv read the real env (factory_mac, hw_version,
bundle_number, ...), and causes fw_setenv to fail cleanly on erase
rather than corrupting anything (the kernel rejects sub-erase-block
MEMERASE).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Florian Maurer <fmaurer@disroot.org>
Link: https://github.com/openwrt/openwrt/pull/23192
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/master/debian/changelog
* Remove ca-certificates-local example (closes: #988912, #1127101).
* Update Mozilla certificate authority bundle to version 2.86
The following certificate authority was added (+):
+ e-Szigno TLS Root CA 2023
The following certificate authorities were removed (-):
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
- certSIGN ROOT CA
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- TeliaSonera Root CA v1
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- GLOBALTRUST 2020
- GTS Root R2
- FIRMAPROFESIONAL CA ROOT-A WEB
The following certificate authority was renamed (~):
~ "OISTE Server Root RSA G1" (removed leading space)
Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23675
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The mutex file via '/tmp/.config_pending' should prevent the command
'/sbin/wifi config' from being called in the ieee80211 hotplug when loading
the kernel modules [1]. Since the file '/etc/board.json' does not yet exist
and could be incomplete.
The '/etc/board.json' file is modified in the '/sbin/wifi config' script.
This is only generated during the first boot when '/bin/config_generate' is
called.
This whole handling is unclean. Therefore the creation of the default
configuration '/etc/config/network', '/etc/config/system' and
'/etc/board.json' via '/sbin/config_generate' is moved to the preinint
after the rootfile system has been mounted
The advantage now is that on an ieee80211 hotplug event, the
'/etc/board.json' is already present which simplifies the whole thing.
[1] https://github.com/openwrt/openwrt/blob/main/package/network/config/wifi-scripts/files/etc/hotplug.d/ieee80211/10-wifi-detect
Fixes: b993a00b82 ("base-files: fix duplicate wifi radio sections when using phy renaming")
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
LED trigger for network interfaces.
- Aggregated per-family (lan/wan/wlan).
- Family and flags are taken from device tree properties:
- "family" : simple family string "lan" | "wan" | "wlan"
- "mode" : any combination of "link", "tx", "rx" flags
Priority/combination:
* If "mode" present: flags come from "mode" and take precedence.
Family is taken from "family" if present, otherwise from the LED name.
* If only "family" present: use its family and default flags = link+tx+rx.
* If neither present: fall back to LED device name parsing.
- Suffix "-online" is valid ONLY in the LED name (label),
e.g. "green:wlan-online". It indicates the online variant but is applied
only when DT "mode" is absent.
Behaviour:
- wlan (normal): blink/solid driven by throughput table
- lan/wan (normal): one-shot blink on TX/RX packet change
- *-online variants: steady ON while any interface of the family has carrier
Interfaces are auto-tracked by name match (lan0, wan1, wlan2, phy0, wl1,
ath0, ra0...). Up to MAX_IFACES (16) interfaces per family
This trigger is intended for board/device authors and drivers to provide simple
network-activity LED behaviour without per-interface wiring in userspace.
Refresh bcm27xx patches in the same commit to account for line shifts in
drivers/leds/trigger/Kconfig and Makefile, ensuring clean applies for
bisectability.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/19903
Signed-off-by: Robert Marko <robimarko@gmail.com>
Change-log since version 2026.03.18, retrieved from the wireless-regdb mailing lists:
wireless-regdb: update regulatory database based on preceding changes
wireless-regdb: Update regulatory info for Brunei Darussalam (BN) for 2022
wireless-regdb: allow 320MHz channel width for Russia
wireless-regdb: Update 6 GHz rules for Hong Kong (HK)
wireless-regdb: Update 5/6 GHz power rules for Russia (RU)
wireless-regdb: Fix 60 GHz power unit for Ukraine (UA)
wireless-regdb: Update 6 GHz rules for South Africa (ZA)
wireless-regdb: Update 6 GHz rules for South Korea (KR)
wireless-regdb: Update regulatory rules for Sri Lanka (LK)
wireless-regdb: Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by WiFi Alliance
Signed-off-by: Hafiz Zafran <hfzz7@duck.com>
Link: https://github.com/openwrt/openwrt/pull/23594
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
08bd058e0246 ra: skip malformed options instead of aborting RA processing
2550a1dd276e dhcpv6: fix inverted Authentication option validation in Reply
496e55d43de6 dhcpv6: use host-order option length in Authentication validation
b6f0c70f5fc2 dhcpv6: fix out-of-bounds end pointer when parsing IA in Advertise
92fd11cd9547 dhcpv6: fix OOB read and 1-byte heap overflow on captive-portal option
0dab8feec55a ra: fix OOB read on captive-portal option comparison
a4d6a3232c24 script: fix string_to_env writing garbage and reading past input
2521bf732b9f script: avoid kill(0) when SIGCHLD races script_call
56cec7a15816 odhcp6c: drop stale hash_ifname() declaration
49d9c0112bb8 odhcp6c: propagate allocation failure from insert_state
4bd976fd60c0 dhcpv6: ensure hostname buffer is NUL-terminated for dn_comp
6d12865fb89c ubus: validate element type when parsing reconfigure_dhcp opt_send
01130f80338a script: handle allocation failures in env helpers
0a19052dc9fb odhcp6c: refuse to follow symlinks when writing pidfile
d6c2fbdc255c odhcp6c: skip malformed /proc/net/if_inet6 entries
b6add6c0e30e dhcpv6: avoid signed-shift undefined behaviour in IAID derivation
ce52fe118b13 ubus: clear cached object type id on disconnect
91f88c694f6f config: stop mutating caller-supplied buffers in send-options parser
c938c168cbef script: handle fork() failure when launching state script
1546a48255b2 ubus: avoid out-of-bounds read when serializing captive-portal URI
3270f081039d all: fix inverted captive-portal URI equality check (RFC 8910 §3)
e9a9e9d45f38 odhcp6c: bound the address length when parsing the -P argument
5ad94c86e864 script: walk entries with odhcp6c_next_entry in entry_to_env
df4f199c02fc ubus: walk entries correctly and don't leak an open table in entry_to_blob
6c1c4c48d4a2 ubus: don't leak an open table on malformed S46 rule/bind in s46_to_blob
1797d2bca3c0 odhcp6c: remove pidfile on exit
86a6665e4bb0 ra: clear captive-portal state when router signals unrestricted URI
0a4e51db30d5 dhcpv6: require known SERVERID when validating Reconfigure
afc3c8534864 dhcpv6: reject Reconfigure with malformed or duplicate Message option
df27a49c98d8 dhcpv6: enforce monotonic replay counter on Reconfigure RKAP
9177f236c2d7 odhcp6c: do not treat DHCPv6 option type 0 as end-of-list
daf4ec3054e7 example: write all DNS servers to resolv.conf
Link: https://github.com/openwrt/openwrt/pull/23652
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
69b62b1990bc rpc-sys: packagelist: increase input buffer size
e655a0d69492 exec: defer async reply teardown to avoid use-after-free
5b078674a592 optimize by reusing timeout member
d005c885dbe4 session: clamp uloop timeout to avoid int overflow
a545f008da91 ucode: add request.defer() for async method handling
ab6549a99c7c file: avoid sending uninitialized stack memory for broken symlinks
7af2dd81cd53 main: prevent integer overflow when parsing -t timeout argument
680705e4b76d plugin: use snprintf in ubus lookup callback to prevent buffer overflow
fb0302dc0e51 session: detect short read of /dev/urandom in rpc_random()
dc091afa5860 rpc-sys: packagelist: check calloc() result for world array
4fbd48515d6a rpc-sys: packagelist: avoid size_t underflow when stripping ABI version
46fce7d5efc9 ucode: fix off-by-one truncation of generated ubus object type name
26dba5206e17 exec: prevent double close() of exec pipe descriptors
af5d6f431186 uci: prevent integer overflow of client supplied apply timeout
d06d2a81dc29 rc: fix memory leak of list request context
0de666811559 rc: copy list "name" filter to avoid use-after-free
75470f4b5124 rc: use a per-request blob_buf for the list reply
3037a0e36856 treat exec failures in forked children with _exit() instead of return
f5ffec54d7c7 rc: reap killed child on list "running" check timeout
fd4fcdeb186b rpc-sys: packagelist: close status file on world parsing error paths
e22aea1a51df rpc-sys: packagelist: read world file instead of mmap to avoid SIGBUS
79c8087c8e8e file: avoid zero-length b64_decode() on empty write data
cd1d9588da63 ucode: bound recursion when converting blob arguments to ucode values
2decaec3ef1b iwinfo: fix error handling and backend leak in survey
28faf6403792 cast char arguments to unsigned char for ctype.h functions
Link: https://github.com/openwrt/openwrt/pull/23650
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This pull request is based on
- the discussions in https://forum.openwrt.org/t/support-for-the-linksys-mr9000
Device Specs:
- Router is similar to EA8300 but with 512MB RAM and changed GPIOs
- IPQ4019
- Quad Core CPU
- 512 MB RAM
- 256 MB FLASH
- 4 LAN ports, 1 WAN port
- 1x2.4GHz (802.11n) and 2x5GHz (802.11c) wifi
- 3 LEDs (Red, blue, green) which are routed to one indicator at the top of the case
- 2 buttons (Reset, WPS)
Disassembling the device:
- There are 4 T10 screws at the bottom of the device which must be removed
- All 4 screws are located under the rubber feet
Serial interface:
- The serial interface is already populated on the device with a 5-pin header
- Pinout from front to back: 1:GND, 2: unknown, 3: RX, 4: TX, 5: VCC
- Settings: 115200, 8N1
MAC address layout:
- Same as on MR8300
- MAC address is stored in the "devinfo" partition (entry "hw_mac_addr")
- The MAC address on the label is identical with the one in the devinfo partition
- The MAC address on the label is the WAN MAC address
- LAN MAC address is the one from the label + 1
- Wifi (2.4GHz) MAC is the one from the label + 2
- Wifi (1st 5GHz) MAC is the one from the label + 3
- Wifi (2nd 5GHz) MAC is the one from the label + 4
Migrating to OpenWrt requires multiple steps:
- Load and boot the initramfs image
- Adapt U-Boot settings to support bigger kernels
- Flash the sysupgrade image
Load and boot initramfs:
- Connect serial interface
- Set up a TFTP server on IP 192.168.1.254
- Copy openwrt-ipq40xx-generic-linksys_mr9000-initramfs-zImage.itb to TFTP server
- Rename file to C0A80101.img
- Boot up the device and stop in U-Boot
- Run the following U-Boot commands after a link has been established:
tftp
bootm
- Initramfs image is started now.
Adapt U-Boot settings to support bigger kernels:
- Run "fw_printenv" in the initramfs image after booting
- There should be an entry kernsize=300000 which indicates the maximum size for the kernel is 3MB
- Execute "fw_setenv kernsize 500000" to increase the max kernel size to 5MB
- Check that the change are applied with "fw_printenv"
Flash the sysupgrade image:
- Default sysupgrade routine either with a initramfs image containing LuCI or via command line.
Revert back to OEM firmware:
- Flash the OEM firmware via sysupgrade
- Forced update is required
Signed-off-by: Karsten Rehn <rekados@posteo.de>
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22744
Signed-off-by: Robert Marko <robimarko@gmail.com>
Move the $(eval $(call Download,ath11k-legacy-firmware)) from inside
Build/Prepare to the top level, right after the Download definition.
When the eval is inside Build/Prepare, it only runs at recipe execution
time (during compilation). This makes the legacy firmware source
invisible to 'make download', which only evaluates Download definitions
at Makefile parse time. As a result, offline builds fail because the
source was never fetched during the download phase.
This is consistent with how ath10k-ct-firmware handles multiple
Download definitions (all at top level).
Signed-off-by: Michael Pfeifroth <michael.pfeifroth@westermo.com>
Link: https://github.com/openwrt/openwrt/pull/23628
Signed-off-by: Robert Marko <robimarko@gmail.com>
c3bf07a66f7e make: honor SOURCE_DATE_EPOCH in BUILD_DATE
bb4f3f0b947e Revert "MP: fix uniphy reset in phy to phy link scenario"
Signed-off-by: Robert Marko <robimarko@gmail.com>
This tool requires gnutls. In fact, we do not have to build it.
Fix build error:
tools/mkeficapsule.c:20:10: fatal error: gnutls/gnutls.h: No such file or directory
20 | #include <gnutls/gnutls.h>
| ^~~~~~~~~~~~~~~~~
Fixes: 158651a6d7 ("uboot-imx: bump to 2026.04 release")
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/23635
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The unet CLI's join handler used the joiner's --network value as the
local network name, so an unspecified --network fell back to the
literal 'unet'. The inviter typically uses a different name (e.g.
ucoord_<venue>), so the two sides ended up keyed differently and any
upper layer subscribing to the network-named unetmsg channel never
saw each other.
The inviter now passes enroll_info={ network } to enroll_start so
the inviter's network name rides along in enroll_meta. The joiner
prefers data.enroll_meta?.network when present, falling back to its
own --network value for backwards compatibility with older inviters.
Signed-off-by: John Crispin <john@phrozen.org>
ac5cc72f6cfa jail: mount ucode related bits into netifd jail
81119d3f249d instance: disable console logging
8013c0cd2755 jail: mount tools used by dhcp.sh in the netifd jail
876981d0516d jail: fix reading the oci device gid value
c92dbcd460d7 jail: make /dev/tty accessible by others
74bfbee8adb8 service: fix calloc_a argument
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The imagestart variable was assigned sizeof(tag) (which incorrectly
computed the pointer size rather than the struct size), but was never
actually read after the assignment in either trx_fixup() or
mtd_fixtrx(). The CRC calculations that follow use
offsetof(struct bcm_tag, header_crc) directly.
Remove the dead variable and its assignments entirely rather than fixing
the sizeof expression. No functional change.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23546
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
changelog:
https://busybox.net/news.html
remove upstreamed patches:
001-fix-non-x86-build.patch
002-upstream-fix.hexdump.patch
003-hexdump-fix-regression-for-unit16-on-big-endian-systems.patch
see https://github.com/openwrt/openwrt/pull/17107 for updating config
Config refresh:
Refresh commands, run after busybox is first built once, slash or lack of slash at end of path matters!:
cd package/utils/busybox/config/
../convert_menuconfig.pl ../../../../build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/busybox-default/busybox-1.38.0
cd ..
./convert_defaults.pl ../../../build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/busybox-default/busybox-1.38.0/.config > Config-defaults.in
Manual edits needed after config refresh:
* Config-defaults.in: OpenWrt config symbol IPV6 logic applied to
BUSYBOX_DEFAULT_FEATURE_IPV6
* Config-defaults.in: OpenWrt config TARGET_bcm53xx logic applied to
BUSYBOX_DEFAULT_TRUNCATE (commit 547f1ec)
* Config-defaults.in: OpenWrt logic applied to
BUSYBOX_DEFAULT_LOGIN_SESSION_AS_CHILD (commit dc92917)
* Config-defaults.in: correct the default ports that get reset
BUSYBOX_DEFAULT_FEATURE_HTTPD_PORT_DEFAULT 80
BUSYBOX_DEFAULT_FEATURE_TELNETD_PORT_DEFAULT 23
* config/editors/Config.in: Add USE_GLIBC dependency to
BUSYBOX_CONFIG_FEATURE_VI_REGEX_SEARCH (commit f141090)
* config/shell/Config.in: change at "Options common to all shells" the conditional symbol
SHELL_ASH --> BUSYBOX_CONFIG_SHELL_ASH
(discussion in http://lists.openwrt.org/pipermail/openwrt-devel/2021-January/033140.html
Apparently our script does not see the hidden option while
prepending config options with "BUSYBOX_CONFIG_" which leads to a
missed dependency when the options are later evaluated.)
* Edit a few Config.in files by adding quotes to sourced items in
config/Config.in, config/networking/Config.in and config/util-linux/Config.in (commit 1da014f)
Signed-off-by: Seo Suchan <tjtncks@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23609
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add support for the Micro Crystal RV3028 I2C real-time clock chip.
Tested on a Kontron OSM-S/BL i.MX8MP eval board.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Build ATF images for i.MX8MP. Tested on Kontron OSM-S/BL i.MX8MP.
The default IMX_BOOT_UART_BASE for imx8mp platforms is 0x30890000, which
would be UART2. The Kontron board however uses UART3 as serial debug
console. As a result, after loading BL31 the system hangs.
Setting IMX_BOOT_UART_BASE=auto will fix it.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
In mtd_replace_jffs2(), the return value of malloc(erasesize) is never
checked. If the allocation fails, buf remains NULL and the subsequent
memcpy(buf + ofs, ...) in add_data() will dereference NULL, causing a
segfault.
Add a NULL check and return -1 on allocation failure. Match the
diagnostic message used by the sibling mtd_write_jffs2() so the
out-of-memory cause is visible at the call site.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23553
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Version 7.0 - Apr 28, 2026
* Feature: support MSE display (--show-mse)
* Feature: add 2 new link_ext_state names
* Fix: fix index calculation in ixgbe register dump (-d)
* Fix: cmis wavelength tolerance output (-m)
* Fix: duplicate sfpid Active Cu compliance output (-m)
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23574
Signed-off-by: Robert Marko <robimarko@gmail.com>
Since upstream commit 60e3f1e9b7a5 ("lib/crypto: arm64/sha512:
Migrate optimized SHA-512 code to library"), the kernel module is no
longer available, and its fucntionality os provided by the kernel
core. Thus do not try to package this for linux 6.18 and later.
Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21506
Signed-off-by: Robert Marko <robimarko@gmail.com>
- try to detect supported (hostkey) algorithms; otherwise fallback to predefined list;
- remove size constraint for ECDSA: custom build may include only 384 or 521 bit curves;
- remove size constraint for RSA: default RSA key size is 2048 bits which is sufficient for SSH security recommendations, and previous value of 1024 bits is considered insecure.
Signed-off-by: Konstantin Demin <rockdrilla@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23217
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
f5d17dd60a89 mstp: add default Hello Time constant
17c36bebada1 mstp: use default Hello Time in recordTimes
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
Add a function to allow drivers to query the pending AQL airtime
for a given txq, for both unicast and broadcast.
This will be used for mt76 to limit buffering in AP mode for power-save
stations.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
ELECOM WRC-X3000GST2 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router based on
IPQ5018. The only hardware difference from the WRC-X3000GS2 is the RAM
capacity; all other peripherals are identical. This port therefore
reuses the GS2 board-2.bin (ipq-wifi-elecom_wrc-x3000gs2) and ath11k
calibration variant.
Specification:
- SoC : Qualcomm IPQ5018
- RAM : DDR3 512 MiB (Kingston Technology D2516ECMDXGJD)
- Flash : SPI-NAND 128 MiB (Macronix MX35UF1G24AD-Z4I)
- WLAN : 2.4/5 GHz 2T2R
- 2.4 GHz : Qualcomm IPQ5018 (SoC)
- 5 GHz : Qualcomm QCN6122
- Ethernet : 5x 10/100/1000 Mbps
- wan (phy) : Qualcomm IPQ5018 (SoC)
- lan (switch) : Qualcomm Atheros QCA8337
- LEDs/Keys (GPIO): 8x / 3x (reset, WPS, router/AP slide switch)
- UART : through-hole on PCB, 4pins near the barcode
- assignment : 3.3V, TX, RX, NC, GND from the barcode side
- settings : 115200n8
- Power : 12 VDC, 1 A (Max. 11.5W)
Flash instruction using factory.bin image:
1. Boot WRC-X3000GST2 normally in router mode
2. Access the WebUI ("http://192.168.2.1/") and open the firmware
update page ("ファームウェア更新")
3. Select the OpenWrt factory.bin image and click apply ("適用")
4. After the device reboots automatically, wait until the green power LED
stops blinking and stays solid
5. When the green power LED is solid, hold the reset button until the red
LED starts blinking to clear remaining stock firmware settings
Switching to the stock firmware:
1. Load the elecom.sh script
. /lib/upgrade/elecom.sh
2. Check the current index of rootfs
bootconfig_rw_index 0:bootconfig rootfs
3. Set the index to inverted value
bootconfig_rw_index 0:bootconfig rootfs <value>
bootconfig_rw_index 0:bootconfig1 rootfs <value>
example:
- step2 returned "0":
bootconfig_rw_index 0:bootconfig rootfs 1
bootconfig_rw_index 0:bootconfig1 rootfs 1
- step2 returned "1":
bootconfig_rw_index 0:bootconfig rootfs 0
bootconfig_rw_index 0:bootconfig1 rootfs 0
4. Reboot
Partition Layout (Stock FW):
0x000000000000-0x000000080000 : "0:SBL1"
0x000000080000-0x000000100000 : "0:MIBIB"
0x000000100000-0x000000140000 : "0:BOOTCONFIG"
0x000000140000-0x000000180000 : "0:BOOTCONFIG1"
0x000000180000-0x000000280000 : "0:QSEE"
0x000000280000-0x000000380000 : "0:QSEE_1"
0x000000380000-0x0000003c0000 : "0:DEVCFG"
0x0000003c0000-0x000000400000 : "0:DEVCFG_1"
0x000000400000-0x000000440000 : "0:CDT"
0x000000440000-0x000000480000 : "0:CDT_1"
0x000000480000-0x000000500000 : "0:APPSBLENV"
0x000000500000-0x000000640000 : "0:APPSBL"
0x000000640000-0x000000780000 : "0:APPSBL_1"
0x000000780000-0x000000880000 : "0:ART"
0x000000880000-0x000000900000 : "0:TRAINING"
0x000000900000-0x000003c40000 : "rootfs"
0x000003c40000-0x000003fc0000 : "Config"
0x000003fc0000-0x000007300000 : "rootfs_1"
0x000007300000-0x000007680000 : "Config_2"
0x000007680000-0x000007b80000 : "Reserved"
0x000007b80000-0x000007c00000 : "FWHEADER"
0x000007c00000-0x000007c80000 : "Factory"
Notes:
- This device has dual-boot feature and it's managed by the index in the
0:bootconfig and 0:bootconfig1 partitions.
- Wi-Fi BDF is shared with WRC-X3000GS2 (ipq-wifi-elecom_wrc-x3000gs2)
as the hardware (SoC, QCN6122, antennas) is identical between the two
models.
- GST2 stock firmware keeps its configuration even when sysupgrade is
called with -n. When installing from the OEM WebUI, those stock
settings can be restored into OpenWrt overlay, so settings must be
initialized after the first OpenWrt boot.
MAC Addresses:
LAN : 38:97:A4:xx:xx:40 (0:APPSBLENV, "eth1addr"/"ethaddr" (text))
WAN : 38:97:A4:xx:xx:43 (0:APPSBLENV, "eth0addr" (text))
2.4 GHz: 38:97:A4:xx:xx:41 (0:APPSBLENV, "wifi0" (text))
5 GHz : 38:97:A4:xx:xx:42 (0:APPSBLENV, "wifi1" (text))
Signed-off-by: Taiga Ogawa <zectaiga@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23471
Signed-off-by: Robert Marko <robimarko@gmail.com>
Turris Mox stores the U-Boot environment in SPI NOR flash. Add the
fw_env.config entry pointing to MTD partition 2 at offset 0x0 with
64 KiB env size and sector size, so userspace tools fw_printenv and
fw_setenv work correctly on this board.
Signed-off-by: Štěpán Dalecký <daleckystepan@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23421
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for netis EAP930 V1 ceiling access point.
Specification
-------------
- SoC : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz
- RAM : 256 MiB DDR3 (ESMT M15T2G16128A-EFB)
- Flash : SPI-NAND 128 MiB (ESMT F50L1G41LB-104)
- WLAN : MediaTek MT7976CN dual-band WiFi 6
- 2.4 GHz : b/g/n/ax, MIMO 2x2
- 5 GHz : a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x1 (SoC internal phy)
- USB : No
- Buttons : Reset
- LEDs : 1x Status (red), gpio-controlled
1x Status (blue), gpio-controlled
- Power : 48 VDC (PoE) or 12 VDC, 1.5 A
Installation
------------
1. Connect to the access point using ssh (user: admin, pass: web interface
password)
2. Make mtd backup:
cat /dev/mtd0 | gzip -1 -c > /tmp/mtd0_spi0.0.bin.gz
cat /dev/mtd1 | gzip -1 -c > /tmp/mtd1_BL2.bin.gz
cat /dev/mtd2 | gzip -1 -c > /tmp/mtd2_u-boot-env.bin.gz
cat /dev/mtd3 | gzip -1 -c > /tmp/mtd3_Factory.bin.gz
cat /dev/mtd4 | gzip -1 -c > /tmp/mtd4_FIP.bin.gz
cat /dev/mtd5 | gzip -1 -c > /tmp/mtd5_ubi.bin.gz
3. Download mtd backup from the /tmp dir of the router to your PC using
scp protocol
4. Upload OpenWrt 'bl31-uboot.fip', 'preloader.bin' images to the /tmp
dir of the router using scp protocol
5. Write FIP and BL2 (replace bootloader):
mtd write /tmp/bl31-uboot.fip FIP
mtd write /tmp/preloader.bin spi0.0
6. Place OpenWrt
'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
on the tftp server (IP: 192.168.1.254)
7. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
8. U-Boot automatically boot OpenWrt recovery image from tftp server to
the RAM (1 Gbps link is required)
9. Upload OpenWrt 'sysupgrade.itb' image to the /tmp dir of the router
(IP: 192.168.1.1) using scp protocol
10. Connect to the router using ssh and run:
sysupgrade -n squashfs-sysupgrade.itb
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
on the tftp server (IP: 192.168.1.254)
2. Press Reset button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
Return to stock
---------------
1. Upload stock BL2, FIP, ubi partitions backup archives to the /tmp dir
of the router using scp protocol
2. Connect to the router using ssh and run:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd unlock FIP
4. Restore backups:
zcat /tmp/mtd1_BL2.bin.gz | mtd write - BL2
zcat /tmp/mtd4_FIP.bin.gz | mtd write - FIP
zcat /tmp/mtd5_ubi.bin.gz | mtd write - ubi
3. Reboot the router:
reboot
UART
----
Connection parameters: 115200, 8N1, 3.3V
UART pins are silkscreened on the PCB.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 88:xx:xx:88:xx:d3 | label |
| WLAN 2g | 88:xx:xx:18:xx:d4 | |
| WLAN 5g | 88:xx:xx:78:xx:d4 | |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'Factory', 0x1fef20
The WLAN 2g/5g MAC prototype (hex) was found in 'Factory', 0x4
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23133
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
U-Boot v2026.01 introduced drivers/mtd/nand/spi/otp.c which adds `spinand_user_otp_size()` and
`spinand_fact_otp_size()`. These functions are called unconditionally from `spinand_init()` in
drivers/mtd/nand/spi/core.c to determine whether to set up OTP methods:
if (spinand_user_otp_size(spinand) || spinand_fact_otp_size(spinand)) {
ret = spinand_set_mtd_otp_ops(spinand); /* drivers/mtd/nand/spi/core.c:2369 */
...
}
Both OTP size functions pass `&spinand->user_otp->layout` or `&spinand->fact_otp->layout` to
`spinand_otp_size()` without first checking whether the pointer is NULL. In the standard probing
path, these pointers are assigned by `spinand_match_and_init()` from the per-chip `spinand_info`
table. `100-21-mtd-spi-nand-add-CASN-page-support.patch` adds CASN detection to `spinand_detect()`
so that when a CASN page is found, `spinand_init_via_casn()` is called instead of
`spinand_id_detect()`. As `spinand_match_and_init()` is only called via `spinand_id_detect()`, it
is never invoked for CASN-probed devices.
As a result, `spinand->user_otp` and `spinand->fact_otp` remain NULL from the zero-initialised DM
priv allocation. Both `spinand_user_otp_size()` and `spinand_fact_otp_size()` spuriously return
non-zero by reading `layout->npages` from a small mapped address computed from their respective
NULL pointer, causing `spinand_init()` to call `spinand_set_mtd_otp_ops()` which reads
`spinand->user_otp->ops` and thereby silently assigns a garbage value to `user_ops` that is then
dereferenced at `if (user_ops->info)`.
int spinand_set_mtd_otp_ops(struct spinand_device *spinand)
{
struct mtd_info *mtd = spinand_to_mtd(spinand);
const struct spinand_fact_otp_ops *fact_ops = spinand->fact_otp->ops;
const struct spinand_user_otp_ops *user_ops = spinand->user_otp->ops;
...
if (user_ops) {
if (user_ops->info) /* drivers/mtd/nand/spi/otp.c:343 */
...
...
}
...
}
On COMFAST CF-WR632AX (MT7981, Winbond W25N01GV) this results in a "Synchronous Abort" during boot.
The crash was confirmed via `addr2line` on the U-Boot ELF:
"Synchronous Abort" handler, esr 0x96000004, far 0xeafffffeeafffffe
elr: 0000000041e2ff44 (drivers/mtd/nand/spi/otp.c:343)
lr : 0000000041e2f2f8 (drivers/mtd/nand/spi/core.c:2369)
The same was observed on Acer Predator Connect W6x (MT7986, Winbond W25N02KV):
"Synchronous Abort" handler, esr 0x96000004, far 0xeafffffeeafffffe
elr: 0000000041e2c868 (drivers/mtd/nand/spi/otp.c:343)
lr : 0000000041e2bc1c (drivers/mtd/nand/spi/core.c:2369)
Fix this by adding NULL guards to both OTP size functions so that they return 0 when the pointer is
NULL. With both functions returning 0, the condition in `spinand_init()` evaluates to false and
`spinand_set_mtd_otp_ops()` is never called, skipping setup of OTP methods entirely for CASN-probed
SPI NAND chips.
This change has no effect on SPI NAND chips that do have OTP data but not CASN. For those chips,
`spinand_match_and_init()` sets `spinand->user_otp` and `spinand->fact_otp` to non-NULL values from
the per-chip table, the NULL guard does not activate, and the existing behaviour is unchanged.
Fixes: https://github.com/openwrt/openwrt/issues/23430
Fixes: b94de14baf ("uboot-mediatek: update to v2026.01")
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/23447
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Andre Heider
Florian Maurer
Fengyu Wu
Florian Eckert
Mieczyslaw Nalewaj
Hafiz Zafran
Hauke Mehrtens
Roland Reinl
Michael Pfeifroth
Robert Marko
Seo Suchan
Shiji Yang
Pavlo Samko
John Crispin
Felix Fietkau
Anna Kiri
Marek Behún
Martin Schiller
Rosen Penev
Daniel Golle
Paul Donald
Chukun Pan
John Audia
Alexandru Gagniuc
Konstantin Demin
Stijn Tintel
Taiga Ogawa
Štěpán Dalecký
Mikhail Zhilkin
Ryan Leung