netis N6 V2 is a MT7981B-based router, hardware-compatible with
netis NX32U (confirmed via bootloader cross-flash). GPIO mappings
not covered by the vendor DTS were verified against NX32U and via
live link/carrier testing on switch ports, plus direct LED-toggle
confirmation on the physical device.
Hardware:
SoC: MediaTek MT7981B (Filogic 820)
RAM: 256 MiB DDR3 (ESMT M15T2G16128A-AZR1-EFB, DDR3-1866)
Flash: 128 MiB SPI-NAND
Ethernet: 4x 1GbE (mt7531 switch: wan, lan1, lan2, lan3),
2.5GbE internal CPU-switch link (gmac0, 2500base-x)
WiFi: MT7981 integrated 2.4GHz + MT7976C 5GHz radio,
802.11ax, 2x2 MU-MIMO, HE160 supported (confirmed live;
vendor firmware ships with HE80 for the AX1800 rating)
USB: 1x USB 3.0 (vbus GPIO 23, active high)
Buttons: mesh/rfkill (GPIO 0), reset (GPIO 1)
LEDs: power (GPIO 4), status (GPIO 5), wan (GPIO 9),
wlan 2.4GHz (GPIO 34, phy0tpt trigger),
wlan 5GHz (GPIO 35, phy1tpt trigger),
usb (GPIO 13, usbport trigger)
all active low
UART: 115200n8, uart0
MAC addresses:
Interface | Source | Offset | Address (this unit)
------------|------------------|----------|--------------------
WAN | Factory mac-base | 0x1fef26 | 30:07:5c:dc:7a:d2
LAN/CPU | Factory mac-base | 0x1fef20 | 30:07:5c:dc:7a:d0 (label)
WiFi 2.4GHz | radio calibration (auto) | 30:07:5c:dc:7a:d1
WiFi 5GHz | radio calibration (auto) | b2:07:5c:dc:7a:d1
LAN address matches the label on the device enclosure. WAN uses
macaddr_factory_1fef26 on switch port@0, LAN/CPU uses
macaddr_factory_1fef20 on port@6 (mt7531 switch). WiFi MACs are not
set explicitly in DTS -- mt76 derives them from the radio's own
calibration data, confirmed live to match the stock firmware value.
The USB LED (GPIO 13) was missed in the initial GPIO mapping pass --
it isn't referenced anywhere in the vendor DTS or any other board
signal, so it went unnoticed until manual GPIO toggling (`gpio clear
13` at the U-Boot prompt) confirmed it live on the physical device.
The USB LED on GPIO 13 uses the usbport trigger with trigger-sources
on both xhci ports, hence kmod-usb-ledtrig-usbport in DEVICE_PACKAGES.
The included U-Boot defenv for this board also avoids a silent
failure in ubi_write_production/ubi_write_recovery: these call
`ubi remove <vol>` without first detaching/reattaching the UBI
device, which fails silently on a busy volume while the boot script
proceeds as if it succeeded. Worked around here by adding
`ubi detach ; ubi part ubi ;` before the remove, a pattern already
used in other boards' defenvs (see issue #18231). Only this board's
defenv is touched -- other boards' defenv files are unchanged.
Known upstream issue (not specific to this port): probing
u-boot-env-layout on the ubootenv/ubootenv2 UBI volumes logs
"Invalid calculated CRC32" on every boot, see mediatek/filogic
issues #21876 and #22383.
Installation:
Requires network access to stock firmware SSH (enabled by default)
and a TFTP server on the same subnet.
1. Set up a TFTP server on your PC at 192.168.1.254, serving the
files from this release.
2. SSH into stock firmware: ssh root@192.168.1.1
3. Copy bl31-uboot.fip to the router and write it to the FIP
partition: mtd write bl31-uboot.fip FIP
4. Erase the ubi partition: mtd erase ubi
5. Reboot. The new bootloader will detect the missing production
image and automatically fetch initramfs-recovery.itb via TFTP.
6. Once recovery has booted, SSH in again and sysupgrade to the
production image: sysupgrade squashfs-sysupgrade.itb
Signed-off-by: Murad Rabadanov <the21.21@mail.ru>
Link: https://github.com/openwrt/openwrt/pull/24089
(cherry picked from commit 6c303018b3)
[ drop CONFIG_CMD_RNG/CONFIG_DM_RNG/CONFIG_RNG_MTK_V2: no mtk-rng
driver in the 25.12 uboot-mediatek patch set ]
Signed-off-by: Murad Rabadanov <the21.21@mail.ru>
Link: https://github.com/openwrt/openwrt/pull/24548
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The Netgear WAX206 was added to OpenWrt long after the mt7622 target
had already been converted to DSA. Consequently, this device never
shipped with a swconfig-based network setup and there is no DSA
migration to perform.
Remove the spurious $(Device/dsa-migration) reference. Device/dsa-migration
is not defined for the mediatek target, so the reference expands to nothing
and no DEVICE_COMPAT_VERSION was ever set for this device; removing it has
no effect on sysupgrade compatibility.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/24844
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 28f6d3e4fc)
Add mtd_get_mac_uci_config() for reading a MAC address from a UCI-style
config stored in an MTD partition. This is needed to support the
TP-Link ER605 v1; the existing UBI helper already covers the ER605 v2.
Also refactor common sed logic into a shared helper used by both
variants and drop the redundant cat pipe.
TP-Link ER605 v2 device support is unaffected. The one and only MAC
address on the tddp partition for v1/v2 is the label MAC address.
Signed-off-by: Charles Joynson <ctjoynson@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24331
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
(cherry picked from commit 180fa957e3)
Link: https://github.com/openwrt/openwrt/pull/24681
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for Teralink TL3020 256mb wireless router.
Specification
-------------
- SoC : MediaTek MT7981B dual-core ARM Cortex-A53
- RAM : DDR3 256 MiB (ESMT M15T2G16128A, DDR3-1866)
- Flash : SPI-NAND 256 MiB (Winbond W25M02GV)
- WLAN : MediaTek MT7976 2.4/5 GHz Wi-Fi 6
- Ethernet : MediaTek MT7531 switch, 1x WAN + 3x LAN 10/100/1000 Mbps
(2.5GbE uplink via gmac0)
- USB : 1x USB 2.0 Type-A (power enable on GPIO 14)
- Buttons : WPS, Reset
- LEDs : 7x blue, 1x red
- UART : 4-pin header on PCB
- assignment : 3.3V, GND, TX, RX
- settings : 115200n8
- Power : 12 VDC, 1.5 A (barrel jack)
MAC addresses
-------------
EEPROM MAC is same for all the devices, but there is a `config2` partition
with unique MAC addresses:
| Interface | MAC source |
|-----------|--------------------------------------------|
| LAN | config2, offset 0x707 (ASCII, "lanmac") |
| WAN | config2, offset 0x787 (ASCII, "wanmac") |
| WLAN 2.4G | config2, offset 0x68a (ASCII, "wifi2gmac") |
| WLAN 5G | config2, offset 0x60a (ASCII, "wifi5gmac") |
The LAN MAC (gmac0) is the one printed on the device label.
Installation
------------
Factory bootloader is locked to 64mb partition layout, so OpenWrt U-Boot
has to be flashed first. Steps 1, 2 and 4 are run from a shell on the
stock firmware, where the 'bl2' and 'fip' partitions are writable - in
OpenWrt they are read-only, so the procedure cannot be repeated from
OpenWrt. Back up both partitions before overwriting them:
mtd read bl2 /tmp/bl2.bin
mtd read fip /tmp/fip.bin
1. Upload OpenWrt 'bl31-uboot.fip' and 'preloader.bin' images to the /tmp
dir of the router using scp protocol
2. Write fip and bl2 (replace bootloader):
mtd write /tmp/openwrt-mediatek-filogic-teralink_tl3020-256mb-bl31-uboot.fip fip
mtd write /tmp/openwrt-mediatek-filogic-teralink_tl3020-256mb-preloader.bin bl2
3. Place OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-initramfs-recovery.itb'
image on the tftp server (IP: 192.168.1.254)
4. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
5. U-Boot automatically boots the OpenWrt recovery image from the tftp
server to the RAM
6. Upload OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-squashfs-sysupgrade.itb'
image to the /tmp dir of the router (IP: 192.168.1.1) using scp
protocol
7. Connect to the router using ssh and run:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
sysupgrade -n openwrt-mediatek-filogic-teralink_tl3020-256mb-squashfs-sysupgrade.itb
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-teralink_tl3020-256mb-initramfs-recovery.itb'
image on the tftp server (IP: 192.168.1.254)
2. Press "Reset" button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
Reverting to stock firmware requires writing the 'bl2' and 'fip' backups
taken above back with 'mtd write', then flashing the stock image; without
those backups there is no way back, because the stock bootloader cannot
be downloaded from the vendor.
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24518
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
(cherry picked from commit 63bf79af2a)
[ drop CONFIG_CMD_RNG/CONFIG_DM_RNG/CONFIG_RNG_MTK_V2: no mtk-rng
driver in the 25.12 uboot-mediatek patch set ]
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24600
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This version fixes security issues and bugs.
Security fixes:
* Fix a side channel in RSA PKCS#1 v1.5 decryption. (CVE-2026-50587)
* Fix a bug where transcript-hash computation errors during TLS 1.2 extended master secret calculation could be ignored instead of causing the handshake to fail. (CVE-2026-50581)
* Fix a TLS 1.3 server-side error-handling bug affecting session ticket generation. (CVE-2026-50640)
* Fix renegotiation failing and potentially causing a buffer overflow in DTLS when badmac_limit is enabled. (CVE-2026-50713)
* Reject ChaCha20 operations that would make the 32-bit block counter wrap around, which could otherwise reuse keystream and compromise confidentiality. (CVE-2026-50584)
* Fixed a TLS 1.3 record-boundary validation issue that could allow unauthenticated plaintext data to be processed across a key change.
* Fix a possible buffer overflow in mbedtls_ecdh_calc_secret() (CVE-2026-35336)
* Fix a remote buffer overflow in (D)TLS with ECDHE-PSK cipher suites when CBC is disabled. (CVE-2026-50580)
* Fix a side channel in ECC computations that allows a powerful local attacker (typically, untrusted OS attacking a secure enclave) to fully recover long-term secret keys). (CVE-2026-54435)
* Fix a potential information disclosure in TLS 1.2 servers using session tickets. (CVE-2026-50586)
* Fix timing side channel in RSA key generation, prime generation and primality testing, on platforms where division is not constant-time.
* Fix a 1-byte buffer overread when parsing a malformed ECC public key in the PK module. (CVE-2026-50583)
* Fix an out-of-bounds read when parsing TLS 1.2 ECJPAKE ServerKeyExchange messages. (CVE-2026-50588)
* Fix a use-after-free/double-free risk in mbedtls_pkcs7_free() when reusing an mbedtls_pkcs7 context across parse -> free -> parse -> free cycles. (CVE-2026-50579)
* PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1, SHA-224, SHA3-224) on signature verification.
* Improved documentation of mbedtls_ssl_conf_sig_algs() to emphasize that this function only sets signature algorithms that are enforced during TLS key exchange and not on certificate verification. (CVE-2026-54441)
* Ensure 'dtls_srtp_info' field from 'mbedtls_ssl_context' is properly zeroized when mbedtls_ssl_session_reset() is called. (CVE-2026-50585)
* Fix a bug where mbedtls_ssl_read() and mbedtls_ssl_write() could return 1 instead of an error code if the random generator failed when a server called these functions before the end of a TLS 1.3 handshake.
* Fix TLS 1.3 clients to reject a HelloRetryRequest whose selected group was not advertised in the original ClientHello. (CVE-2026-25832)
* Fix two bugs in the X.509 certificate parser that caused some inputs with a malformed basicConstraints extension to be accepted. (CVE-2026-49300)
Full release notes: https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-3.6.7
Remove backported upstream patches that are included in this release.
Signed-off-by: Magnus Kroken <mkroken@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24131
(cherry picked from commit 5d8a8a33dc)
Link: https://github.com/openwrt/openwrt/pull/24818
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This is a dual-radio 802.11a/b/g/n/ac access point with
dual Gigabit Ethernet.
There are two closely related models: The AP-324, which has external
antenna connectors, and the AP-325, which has internal antennas.
The board appears to be identical, and the same image works on both.
Additionally, the Siemens Scalance W1750D is an OEM variant using
the same board, so the image also works on that.
Unfortunately the factory APBoot bootloader enforces cryptographic
signatures on the firmware before booting, so a modified version
must be flashed via the serial port. See [^1] for details.
Specifications
==============
* Device: Aruba AP-325 / AP-324
* SoC: Qualcomm IPQ8068 2x1.4GHz ARMv7-A
* RAM: 512MiB (2x Winbond W632GU6MB-12)
* SPI flash: 4MiB Macronix MX25U3235F
* NAND flash: 128MiB Winbond W29N01HZBINF
* WiFi: 2x Qualcomm QCA9990 (one 2.4G, one 5G)
* Ethernet: 2x 1000BASE-T (Marvell 88E1514 PHY), both PoE-capable
* Power: PoE 802.3at or 12V DC jack
* LEDs: Red/Amber/Green status LED, Amber/Green WiFi LED
* Buttons: 1x, behind hole next to DC jack
* Console: RJ45 connector, Cisco pinout
* USB: 1x USB 2.0 Type A, 1x internal to BLE, SoC has USB 3.0
host but board is only wired for 2.0
* BLE: TI CC2540 SoC, connected to USB and UART, unpopulated
debug header on PCB
* TPM: Atmel AT97SC3205T
How to install
==============
The stock bootloader APBoot appears to be vendor fork of U-Boot, which
disables much of the usual functionality and comes with its own booting
and firmware upgrade logic.
Unfortunately, this logic enforces RSA signatures on images,
even for the default boot from NAND.
Therefore, a patched bootloader is needed, which is built as a package.
In addition to the signature check removal, this also changes
the serial baudrate to 115200.
Luckily, the stock firmware does not disable the `sf` command
(it just hides it until you run `diag`), so the patched bootloader
can be fetched via TFTP and then flashed via console.
Flashing patched APBoot
-----------------------
* Build OpenWrt, or download `openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn`
* Connect serial cable and wired ethernet
* Access stock APBoot console at Baud 9600
* Flash patched bootloader:
```
setenv serverip <your TFTP server IP>
setenv autostart n
netget 44000000 openwrt-ipq806x-generic-aruba_ap-32x-apboot.mbn
sf probe 0
sf erase 220000 100000
sf write 44000000 220000 100000
reset
```
Booting OpenWrt
---------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Run `setenv serverip <your TFTP server IP>`
* Run `tftpboot openwrt-ipq806x-generic-aruba_ap-32x-initramfs.ari`
Installing OpenWrt
------------------
* Connect serial cable and wired ethernet
* Access patched APBoot console at Baud 115200
* Consider backing up stock firmware(s) (UBI volumes `aos0` and/or `aos1`)
by booting into OpenWrt via initramfs (see above) and dumping them
* Wipe and repartition NAND flash (see below for explanation):
```
nand device 0
nand erase.chip
reset
ubi part ubifs
ubi remove ubifs
ubi create ubifs 1
ubi create rootfs_data
```
* Follow steps above to boot OpenWrt via initramfs
* From OpenWrt, persist installation via sysupgrade
Reverting to stock FW
---------------------
The patched bootloader remains compatible with the original firmware,
so you can just wipe the NAND, let APBoot recreate the partitions,
and flash back the `aos0`/`aos1` backup from above.
Current status
==============
Tested and working
------------------
* Console
* Wired GbE (both ports)
* WiFi (both 2.4G and 5G)
* LEDs
* Restart Button
* USB port
* External watchdog
* TPM
* BLE SoC
Future work
-----------
* GPIOs for:
* power source (8 indicates DC jack, 59 indicates 802.3at)
* reset source (64 for warm reset, 65 for watchdog)
* USB overcurrent (63)
* BLE SoC reflashing
* CC2540 comes with Aruba-specific FW out of the box
* Debug header is exposed on PCB (pinout GND-VCC-Clock-Data-Reset),
but that requires disassembly
* Stock BLE FW appears to support reflashing via UART, but protocol
would need to be reverse-engineered
* ramoops/pstore
* It appears that APBoot clears the RAM on boot, might be something
we can patch out as well
* Porting a modern U-Boot
Flash layout
============
SPI flash
---------
```
0x000000-0x020000 sbl1
0x020000-0x040000 mibib
0x040000-0x080000 sbl2
0x080000-0x100000 sbl3
0x100000-0x110000 ddrconfig
0x110000-0x120000 ssd
0x120000-0x1a0000 tz
0x1a0000-0x220000 rpm
0x220000-0x320000 appsbl
0x320000-0x330000 appsblenv
0x330000-0x370000 art
0x370000-0x380000 panicdump
0x380000-0x390000 certificate
0x390000-0x3a0000 mfginfo
0x3a0000-0x3b0000 flashcache
0x3b0000-0x400000 aosspare
```
Factory NAND flash
------------------
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains kernel+initrd of the primary firmware,
initrd contains the entire root FS
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains kernel+initrd of the secondary firmware,
initrd contains the entire root FS
* 64MiB MTD partition `ubifs`, formatted as UBI
* 64MiB UBI volume `ubifs`
* Contains UBIFS, overlay-mounted on top of the initrd,
shared between firmware slots
APBoot understands UBI, and will read the kernel from the
`aos0` or `aos1` volume (depending on `os_partition`)
with fallback to the other one in case a check fails.
Kernels are expected to have a vendor-specific header, the included
script will add that header with the correct checksum but no signature.
OpenWrt NAND flash
------------------
OpenWrt assumes separate UBI volumes for kernel and rootfs,
as well as a volume that must be named `rootfs_data` for the UBIFS.
Unfortunately, APBoot actively checks the UBI volumes at boot, and will
repartition if it doesn't find the volumes that it expects (listed above).
Luckily, it doesn't check their size, only their existence. Therefore,
we can use the following layout:
* 32MiB MTD partition `aos0`, formatted as UBI
* 32MiB UBI volume `aos0`
* contains OpenWrt kernel+initrd
* 32MiB MTD partition `aos1`, formatted as UBI
* 32MiB UBI volume `aos1`
* contains OpenWrt root squashfs
* 64MiB MTD partition `ubifs`, formatted as UBI
* small (single-LEB) UBI volume `ubifs`
* Dummy volume, only there to satisfy APBoot
* almost 64MiB UBI volume `rootfs_data`
* contains UBIFS, overlay-mounted on top of the rootfs
[^1]: https://github.com/lukasstockner/ap325-apboot-openwrt
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit d2a75029a5)
Signed-off-by: Florian Maurer <f.maurer@outlook.de>
Link: https://github.com/openwrt/openwrt/pull/24437
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The current code assumes that the rootfs_data UBI volume is on the same MTD
partition as the rootfs.
Unfortunately, this does not work on the Aruba AP-325 (and variants), since
the bootloader enforces a particular UBI volume layout.
Therefore, this adds a separate variable to set the rootfs_data partition,
and updates all existing devices with a non-default rootfs partition to also
specify the new variable.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit bf770bc4e3)
Signed-off-by: Florian Maurer <f.maurer@outlook.de>
Link: https://github.com/openwrt/openwrt/pull/24437
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The FM25G01B/FM25G02B datasheets specify a single dummy byte for the
0xEB Quad I/O read-from-cache, but the generic read_cache_variants set
issues two. The extra dummy byte shifts the data phase and returns
corrupted data with no ECC error, breaking boot on NC-1812/KN-1812.
Use a dedicated read-from-cache variant set with ndummy=1 for 0xEB.
Both the FM25G{01,02}B support (d5a5c9eb2ee9) and this fix
(8211f2d74b35) were merged into the mtd tree (nand/next). Backport both
patches to backport-6.12 using the actual upstream commits, so they
apply to the OpenWrt kernel tree and upstream nand/next as is.
FM25G01B datasheet: https://www.fmsh.com/nvm/FM25G01B_ds_eng.pdf
FM25G02B datasheet: https://www.fmsh.com/nvm/FM25G02B_ds_eng.pdf
Signed-off-by: Aleksandr Mineev <sanderrrs@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24007
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
(cherry picked from commit 6b98618527)
[Adapted to the SPI-NAND read-from-cache op API used before the
SPINAND_PAGE_READ_FROM_CACHE_1S_4S_4S_OP-style rename: kernel 6.12
still uses SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP/_X4_OP/_DUALIO_OP/
_X2_OP/_OP instead.]
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24781
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit adds support for FudanMicro FM25G01B and FM25G02B SPI NAND
chips. This is required to:
1. Fix bootloop on new revision of Keenetic KN-1812 and Netcraze NC-1812
(with FudanMicro FM25G02B SPI NAND)
2. Add Nokia XG-040G-MD support (device has either SkyHigh or FudanMicro
SPI NAND).
Fixes: https://github.com/openwrt/openwrt/issues/23855
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23864
(cherry picked from commit 7edb29d241)
[Adapted to the SPI-NAND read-from-cache op API used before the
SPINAND_PAGE_READ_FROM_CACHE_1S_4S_4S_OP-style rename: kernel 6.12
still uses SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP/_X4_OP/_DUALIO_OP/
_X2_OP/_OP instead. Re-imported as the mainline commit d5a5c9eb2ee9
under backport-6.12/436, rather than the mailing-list-form patch
that 7edb29d originally added under pending-6.18/401.]
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24781
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
hw_mode property is only present in device configuration section,
not the interface section, so testing for config.hw_mode in
iface.parse_encryption is wrong. Test for (dev_config.band == 60g)
instead, this will cause GCMP to be properly selected instead of
CCMP unless set explicitly, and while at that will cover both hostapd
and wpa_supplicant cases.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24586
(cherry picked from commit 00045786e6)
Link: https://github.com/openwrt/openwrt/pull/24762
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
setup_sta() called parse_encryption() without the device config, so the
sae-compat branch dereferenced a null dev_config.band and threw, aborting
the whole radio setup. Pass the device config through.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 97e8911c9b)
Link: https://github.com/openwrt/openwrt/pull/24762
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Globitel BT-R320 boots the sysupgrade FIT from the eMMC production
partition with root=/dev/fit0.
The device tree did not describe the production GPT partition and
/chosen/rootdisk did not point at the FIT container. fitblk then had no
rootdisk match and the board stopped at:
Waiting for root device /dev/fit0...
Describe the eMMC GPT partitions, set /chosen/rootdisk to production,
and use the FIT sysupgrade path.
Fixes: a3105d3f95 ("mediatek: filogic: add support for Globitel BT-R320")
Signed-off-by: Bogdan K <zikwarface134@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23895
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
(cherry picked from commit a6e1135d6d)
Link: https://github.com/openwrt/openwrt/pull/24078
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The ipTIME A8004T requires GPIO19 and GPIO8 for PCIe reset control.
GPIO8 is assigned to UART3 by default, so configure the pin state
to make it available as a GPIO and add both GPIOs to the PCIe
reset-gpios property.
This fixes PCIe initialization after warm reboot.
Signed-off-by: Myeongjae SONG <devparlair@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24534
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
(cherry-picked from 8eb204ad81)
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Hardware:
- SoC: MediaTek MT7981B
- CPU: 2x 1.3 GHz Cortex-A53
- Flash: 256 MiB ESMT F50L2G41XA
- RAM: DDR3, 512 MiB
- WLAN: 2.4 GHz, 5 GHz (MediaTek MT7976CN, 802.11ax)
- 1x WAN MT7531 (JXD 2531Z) 10/100/1000 Mbps
- 4x LAN 2x MT7530 (JXD 2529S) 10/100/1000 Mbps
- USB 3.0 port
- Buttons: Reset, WPS
- 8x LEDs: 2x Red, 6x Blue
- Serial console: no need to solder. 115200 8n1
- Power: 12 VDC, 1.5 A
The DTS inherits WBR3000UAX because WR3000U is almost the same.
The only difference is size of NAND and factory UBI length.
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| WAN | D4:0D:AB:xx:xx:x1 | label+1 |
| LAN | D4:0D:AB:xx:xx:x0 | label |
| WLAN 2g | D4:0D:AB:xx:xx:x0 | label |
| WLAN 5g | D6:0D:AB:xx:xx:x1 | label+1 |
+---------+-------------------+-----------+
There are 2 ways to install OpenWrt:
- via an intermediate RSA-signed vendor's image or
- via UART && TFTPd
Migration to OpenWrt via OEM firmware:
- Download the migration image from
https://drive.google.com/drive/folders/1BKVarlwlNxf7uJUtRhuMGUqeCa5KpMnj
(The folder is Cudy's official "Cudy Intermediary OpenWrt Firmware" resource)
- Upload the migration image via OEM web interface
- After flashing, OpenWrt is accessible via http://192.168.1.1
- Flash the official OpenWrt image
Install using UART & TFTP:
- Connect to UART.
- Connect to LAN and set your IP to 192.168.1.88/24.
- Configure a TFTP server to serve
openwrt-mediatek-filogic-cudy_wr3000u-v1-initramfs-kernel.bin file
and run the TFTP server.
- Press reset and power-on the router. Hold the reset button for 5 seconds
- TFTP error: 'File not found' appears and MTK console becomes available
- Enter the following commands in the console:
setenv bootfile openwrt-mediatek-filogic-cudy_wr3000u-v1-initramfs-kernel.bin
tftpboot
bootm
- After booting to initramfs, via http://192.168.1.1 flash
openwrt-mediatek-filogic-cudy_wr3000u-v1-squashfs-sysupgrade.bin
- After flashing, OpenWrt is accessible via http://192.168.1.1
If you fail to flash the device,
you can use TFTP to flash back to the original firmware:
- Download the original firmware from
https://www.cudy.com/pages/download-center/wr3000u-256mb-1-0
- Connect to LAN and set your IP to 192.168.1.88/24.
Configure a TFTP server and an recovery.bin firmware file
- With the router off, press the RESET button.
While the router is turning on,
the button should continue to be pressed for at least 5 seconds
- After 1-2 minutes the original firmware is available on http://192.168.10.1
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24447
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit b9d7b448c2)
Link: https://github.com/openwrt/openwrt/pull/24537
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The stock layout of the WL-WNT100X3 splits the SPI-NAND into
bl2/u-boot-env/factory/fip/ubi/hw and the sysupgrade image is a
sysupgrade-tar that has to be unpacked into the "ubi" partition.
The board was however added to the default_do_upgrade() case, which
writes the image to ${PART_NAME:-image}, i.e. to the "firmware" MTD
partition that does not exist on this device:
find_mtd_index firmware -> []
mtd: Could not open mtd device: firmware
mtd fails, do_stage2 exits before flashing anything and the board
reboots into the old firmware without a visible error, so every
OpenWrt-to-OpenWrt sysupgrade looks like a silent no-op. Only the
initial installation works, since that one is performed by the sysupgrade
of the vendor firmware.
Drop the entry so the board falls through to the generic
nand_do_upgrade() case with CI_UBIPART defaulting to "ubi", like the
identically partitioned WL-WN586X3B.
The WL-WNT100X3 (OpenWrt U-Boot layout) variant uses fit_do_upgrade()
and is not affected.
Fixes: 829d432ecd ("mediatek: add support for Wavlink WL-WNT100X3")
Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24684
(cherry picked from commit 17d131669f)
Link: https://github.com/openwrt/openwrt/pull/24686
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Now that multi serdes patch are accepted upstream, reorder the current
patch in the 1xx numbering and add the kernel version tag.
Also replace the downstream patch with the exact version merged upstream.
Downstream PCS implementation is updated with a new revision for the
ethernet code.
Update any patch affected by these changes.
Link: https://github.com/openwrt/openwrt/pull/23849
(cherry picked from commit 3ed5f08733)
[ fix conflict error ]
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Mikhail Kshevetskiy
Mikhail Kshevetskiy
Murad Rabadanov
Mieczyslaw Nalewaj
Charles Joynson
Fil Dunsky
Donghyun Ko
Magnus Kroken
Maxim Anisimov
Qingfang Deng
Sander van Deijck
Ryan Leung
Lukas Stockner
Lech Perczak
Felix Fietkau
Bogdan K
Kirill Molotov
Shiji Yang
Rosen Penev
Myeongjae SONG
Dmitry Mostovoy
Robert Marko
Christian Marangi