The Build/haier-sim_wr1800k-factory recipe produced non-reproducible images for two reasons:
* openssl aes-256-cbc -salt generates a random salt on every run, which is embedded in the Salted__
header and feeds key derivation, so identical input yields different ciphertext each build.
* tar -czf embeds the current time in both the gzip header and records member mtimes, uid/gid and
permission bits taken from the build environment (umask-dependent).
Fix by encrypting with a fixed salt instead of a random one, and by creating the archive with
deterministic tar options (sorted member order, zeroed uid/gid, normalized permissions via
--mode=go-w and mtime pinned to SOURCE_DATE_EPOCH when set (guarded by $(if ...)), piped through
`gzip -n`. The salt "4f70656e57727421" was obtained from `echo -n 'OpenWrt!' | xxd -p`.
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/25605
Signed-off-by: Paul Spooren <mail@aparcar.org>
Build/elx-header and Build/znet-header convert a hex string into \xHH
escape sequences using `fold -s2`. This relies on the obsolete -WIDTH
option syntax of GNU fold, which parses "-s2" as "-s -2". uutils
coreutils does not support this syntax and fails with:
error: unexpected argument '-2' found
tip: to pass '-2' as a value, use '-- -2'
Since fold writes nothing to stdout in this case, the command
substitution expands to an empty string. The following
`dd bs=N count=1 conv=sync` then writes zero bytes, because conv=sync
only pads partial input blocks and never pads empty input. The header
field is dropped entirely, and all subsequent fields move to lower
offsets.
The build still succeeds, because the failure happens inside the
subshell which is then handed to echo.
The malformed images are only rejected when a device tries to
boot them.
For example, on the Zyxel WSM20, the missing payload size field in the
znet-header moves the 0x12345678 magic and the payload to unexpected
offsets. The bootloader then rejects the image, even though sysupgrade
accepted it.
This affects all builds on Ubuntu 25.10 and later, because these
releases use uutils coreutils by default.
Replace `fold -s2` with `fold -w2`, which is the documented way to set
the line width and produces identical output with GNU fold.
Affected devices:
- Build/znet-header is used in all images of the Zyxel WSM20 and the
ELECOM WRC-X1800GS
- Build/elx-header is used in the factory images of the ELECOM
WAB-I1750-PS, WAB-S1167-PS, WAB-S600-PS, WRC-2533GHBK-I and
WRC-2533GHBK2-T, the I-O DATA WN-AC1167GR, WN-AC733GR3 and WNPR2600G,
the Edimax RA21S and RG21S, and the D-Link DAP-X1860 A1
Signed-off-by: Grische <github@grische.xyz>
Assisted-by: Claude:claude-opus-5
Link: https://github.com/openwrt/openwrt/pull/25410
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
TP-Link EX220 v1 as distributed by the Russian ISP MTS, labelled
"EX220(RU)MTS) Ver:1.30". It carries the same model name as the already
supported tplink,ex220-v1, but it is a different board: 128 MB of
parallel NAND managed by NMBM instead of 16 MB of SPI-NOR, and an entirely
different flash layout. The bootloader tells the two apart - on this
revision U-Boot prints "NAND: 128 MiB" followed by "NMBM has been
successfully attached".
Hardware specification:
- SoC: MediaTek MT7621AT (MIPS 1004Kc, ver 1 eco 3)
- RAM: 128 MB DDR3 (chip hidden under the shielding can)
- Flash: 128 MB parallel NAND, ESMT F59L1G81MB, NMBM managed
(the driver identifies the chip as "ESMT PSU1GA30DT")
- WiFi: MediaTek MT7915E, DBDC, 2x2 2.4 GHz + 2x2 5 GHz (AX1800)
- Ethernet: MediaTek MT7530, 5x 10/100/1000 Mbps (4x LAN + 1x WAN)
- LEDs: 7x GPIO - power, LAN, WAN green, WAN amber, WLAN 2.4 GHz,
WLAN 5 GHz, WPS
- Buttons: 2x tactile - reset, WPS
- UART: 4 unpopulated through holes on the solder side of the board,
beside the silver factory sticker, with no silkscreen designator.
Counting from the hole furthest from the ethernet ports: pin 1 TX,
pin 2 RX, pin 3 GND, pin 4 unused - leave it unconnected.
115200 8N1, 3.3 V.
- Power: 12 VDC, 1 A
MAC addresses:
LAN f0:a7:31:xx:xx:xx misc_ro @ 0x5c50bc, matches the label
WAN f0:a7:31:xx:xx:xx same as LAN
2.4G label MAC + 2
5G label MAC + 3
The radio calibration lives in the misc_ro partition, which holds a
JFFS2 filesystem with five files named after their original flash
offsets. The largest one carries the MT7915 EEPROM at offset 0x90000,
so 11-mt76-caldata mounts the partition read-only and copies it out.
Reading it needs CONFIG_JFFS2_ZLIB - the vendor compressed those nodes
with zlib, which OpenWrt does not build in by default.
It is worth the kernel option. With the factory calibration the client
reports -44 dBm at half a metre and negotiates HE-MCS 11; with the
generic default EEPROM the very same link reports -82 dBm and settles
at HE-MCS 3, and a local transfer peaks at 541 instead of 692 Mbit/s.
The vendor bootloader loads a FIT image from the fixed address
0xd00000 and does not evaluate partition names, so the vendor firmware
slot is split into a raw kernel partition and a UBI partition holding
rootfs and rootfs_data.
Flash instructions:
The vendor web interface offers no way in, so the first installation is
done over the serial console.
1. Open the case and attach a 3.3 V USB-to-serial adapter to the 4-pin
header described above.
2. Power the board up and interrupt the bootloader by pressing any key
when it prints "Hit any key to stop autoboot".
3. Load the initramfs image into RAM over YMODEM:
loady 0x84000000
Send openwrt-ramips-mt7621-tplink_ex220-v1-nand-initramfs-kernel.bin
using the YMODEM transfer of your terminal program - this takes
about 11 minutes at 115200 baud - and boot it:
bootm 0x84000000
Do not raise the bootloader console speed to shorten the transfer:
with the console set to 921600 baud the kernel hangs while taking
the UART over from the bootloader, leaving nothing after the 16550A
line, and the watchdog resets the board.
4. The running system serves 192.168.1.1/24 on the LAN ports. Transfer
openwrt-ramips-mt7621-tplink_ex220-v1-nand-squashfs-sysupgrade.bin
to /tmp and install it:
sysupgrade -n /tmp/openwrt-*-ex220-v1-nand-squashfs-sysupgrade.bin
The board reboots into OpenWrt on its own; later updates use
sysupgrade as usual.
Reverting to stock:
The second firmware slot ships empty, so there is nothing to fall back
to - take a backup while the initramfs image of step 3 is running, ie
before step 4:
cat /dev/mtd4 /dev/mtd5 > /tmp/stock.bin
and copy it off the device. To restore it, boot the initramfs image
again and write it back:
dd if=stock.bin bs=1M count=4 | mtd write - kernel
dd if=stock.bin bs=1M skip=4 | mtd write - ubi
Signed-off-by: Denis Faizullin <triplexit.help@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24831
Signed-off-by: Robert Marko <robimarko@gmail.com>
The evdev character devices come out 0600 root:root, so a display server
or any other process reading keyboards and pointers runs as root.
Add an input-support package which allocates the input group and puts the
input nodes into it, and make the evdev and joydev modules depend on it.
The one device profile that ships evdev lists the package directly.
kmod-input-core stays ungated: it carries no device node of its own, and
most drivers built on it deliver their events to in-kernel consumers such
as the keyboard and button handlers.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The audio group and the rule that puts the ALSA character devices in it
are part of procd and base-files, so every image carries them whether or
not it has a sound card, and a package wanting the group has nothing to
depend on. Playback, capture and MIDI all land in one group as well, so a
process allowed to play is also allowed to record.
Move the lot into a new audio-support package with three groups, audio,
audio-capture and midi, and a hotplug fragment that sorts the sound nodes
between them. kmod-sound-core depends on the package, and so do the image
profiles that ship a sound driver. The dependency is a plain one, not a
select, so sound support is offered once the feature is chosen; userspace
that needs one of the groups depends on the same package. Images without
it fall back to the generic rule and get /dev/snd/* as 0600 root:root.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Several image recipes call tar without the options that pin the member
order, the owner, the mode and the modification time. The archive then
holds the build time, the umask of the build user and the readdir order of
the build directory, so two builds of the same source produce different
images.
Pass the same options that Image/mkfs/targz and sysupgrade-tar.sh already
use. The recipes define no member order, so sorting the members takes
nothing away. The diffoscope of the published WAX610 archive shows the
order differing between the build machines, which is what a readdir order
produces.
--mode=go-w clears the write bit of the group and of the others. tar keeps
the mode of the file on disk, which follows the umask of the build user,
so without it the archive differs between a host with umask 022 and one
with umask 002.
Covers the Netgear factory archives of ipq40xx, ipq60xx and ipq807x, the
Creality factory archive of mt76x8, the D-Link DWL8610AP archive of
bcm53xx, the Freecom archive of ixp4xx and the Linksys switch archive of
realtek.
Signed-off-by: John Crispin <john@phrozen.org>
Cudy LT700 Outdoor v1 is an outdoor 4G LTE Wi-Fi 5 router (Cudy board
ID R43).
Hardware:
- SoC: MediaTek MT7621AT
- Flash: 16 MiB SPI NOR (XM25QH128C)
- RAM: 128 MiB DDR3
- WLAN: 2.4 GHz (MediaTek MT7603E, 11n), 5 GHz (MediaTek MT7663, 11ac)
- Ethernet: 1x 10/100/1000 Mbps LAN
- Power: 48-57 V passive PoE
- Buttons: 1x Reset button
- LEDs: 8x Green
- LTE: internal USB modem Quectel EG060W (Cat 6)
- Serial console: 3.3V, 115200 8N1, unpopulated 4-pin header left of the
SoC; pinout from top: VCC, GND, TX, RX
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | d4:0d:ab:xx:xx:xx | label |
| WLAN 2g | d4:0d:ab:xx:xx:xx | label |
| WLAN 5g | d4:0d:ab:xx:xx:xx | label +1 |
+---------+-------------------+-----------+
The internal LTE modem is a Quectel EG060W and needs the option driver
IDs added in a separate commit. gpio-export applies the initial output
value raw, ignoring the active-low flag, so output = <0> is what pulls
the modem power enable low and powers it at boot.
Migration to OpenWrt:
- Obtain the RSA signed intermediate firmware from Cudy:
openwrt-ramips-mt7621-cudy_lt700-outdoor-v1-squashfs-flash.bin
- Connect a computer to the LAN port and flash the intermediate firmware
via the OEM web interface
- OpenWrt is now accessible via 192.168.1.1
- Install the regular OpenWrt sysupgrade image from LuCI or over SSH
Revert back to OEM firmware:
- Configure a computer with IP 192.168.1.88 and run a TFTP server that
serves the OEM recovery image as recovery.bin
- Hold the reset button while powering on the device; the bootloader
fetches recovery.bin and restores the OEM firmware
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Tested-by: achim <achim@cloudystars.net>
Link: https://github.com/openwrt/openwrt/pull/24689
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
Provide two hooks in struct mii_bus
- notify_phy_attach(): called in phy_attach_direct() after PHY
hardware has been initialized and just before PHY is resumed.
- notify_phy_detach(): called in phy_detach() right after PHY
has been suspended.
Link: https://github.com/openwrt/openwrt/pull/25009
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Move the existing AS21xxx patch series from the Airoha target to the
generic 6.18 patch set so it is available to all targets.
Promoting the PHY detach patch to the generic patch set changes the patch
application order. Refresh the affected generic, Layerscape, and ramips
patches without functional changes.
Signed-off-by: Pietro Ameruoso <p.ameruoso@live.it>
Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
Add a DSA driver for the seven-port switch integrated in MT7620. Keep
the existing swconfig path for device trees without a DSA ports node.
Use RXD4 source-port and TXD4 forced-port metadata with the Ralink
DSA tagger. The programming guide places TXD4 FP_BMAP at bits 27:20;
use that layout instead of the stale unused bits 26:19 definition.
Implement bridge isolation and STP, VLAN filtering, FDB and
MDB offload, ageing, flood controls, phylink, MTU limits, and
software-extended hardware MIB counters. Poll the 1000BASE-T CPU
port counters every 20 ms and the remaining ports every 200 ms to
leave scheduling margin before their 16-bit packet counters wrap at
minimum-sized line-rate traffic. DSA invokes port_stp_state_set()
before updating its cached state, so pass the pending callback state
as an override when recalculating port matrices instead of leaving
hardware one transition behind.
Correct the shared switch MIB enable register and enable all seven
port counters. The old address was inside port 0 counter space,
so this also fixes legacy swconfig initialization.
Register DSA through a bound child of the frame-engine device. This
gives the managed conduit device link the correct lifetime across
driver unbind and reprobe while the switch registers remain owned by
the existing GSW platform device.
Package the driver and tagger as kmod-dsa-mt7620 for per-device
opt-in. This keeps DSA and switchdev out of swconfig-only MT7620
images and prevents installing the DSA package together with swconfig.
Also make MDIO and frame-engine teardown safe for deferred probes and
runtime reprobes. Replace the legacy MDIO busy loop and -1 return
with readl_poll_timeout_atomic() and its real error, and reset a
still-busy frame engine before freeing DMA rings. Resolve FE and ESW
resets by name so recovery can reset FE alone, and warn if a switch
node provides neither named reset.
The netdev is devm-managed, so leave NAPI deletion to free_netdev
after unregister instead of deleting NAPI from fe_remove while the
netdev is still registered.
Tested on an MT7620N rev 2 eco 6 with 100BASE-T traffic, VLAN-aware
hardware bridging, 2026-byte MTU, FDB/MDB offload, pending STP state,
and driver unbind/rebind. The modular driver, tagger, package contents,
DSA image composition, and swconfig-only kernel configuration were
also verified.
An independent TP-Link Archer C5 v4 test exercised an external RTL8367S
DSA switch using the RTL8_4t tagger as a regression check on the
shared dsa_tag_protocol enum. It found no collision or external-switch
regression; it does not validate the MT7620 integrated-switch path.
Signed-off-by: Gleb Pesin <dormancygrace@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24493
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The MT7620 frame engine selects the egress switch port in TXD4 and
reports the ingress source port in RXD4. Add a DSA tagger which
exchanges the port through METADATA_HW_PORT_MUX instead of modifying
packet data.
This preserves the frame payload and leaves descriptor encoding to the
conduit driver. Keep the kernel patch in the ramips target because the
tagger is specific to the MT7620 frame engine.
Signed-off-by: Gleb Pesin <dormancygrace@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24493
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Frequency scaling lets MT7620 reduce the CPU clock after a MIPS
SI_Sleep signal. The clock framework does not observe that change and
continues reporting the boot frequency. This breaks timekeeping, delay
calibration, and timing-sensitive users such as the Jitter RNG.
Remove the MT7620 autosleep callback and its elevated systick rating
from the local timer patch. Clear SLEEP_EN during early MT7620
initialization so the result does not depend on reset state or on what a
bootloader left behind. Use the generic systick compatible in the
MT7620A and MT7620N DTS files.
With CPU frequency scaling removed, the MIPS Count Register is again a
reliable clock source. Systick drops to rating 200 for both the
clocksource and the clockevent, so cevt-r4k (rating 300) takes the
clockevent and the now-reliable MIPS count register (rating ~229 here)
takes the clocksource.
Hardware testing used OpenWrt 25.12.5 with Linux 6.12.94 on an MT7620A
WE826. Before the change, urngd occupied 92 to 100 percent of otherwise
idle CPU for several minutes after each boot. After the change, urngd
initialized without the prolonged load. Ethernet, WireGuard, warm boot,
mixed-load stability, and 30-minute clock drift tests showed no
regression.
The change was rebased onto main with Linux 6.18.44. The complete ramips
patch stack applies cleanly, checkpatch reports no issues, and the
modified timer-ralink and mt7620 objects compile with the OpenWrt MIPS
toolchain.
This revives Shiji Yang's original 2023 patch with current hardware
results and makes the disabled state independent of the bootloader.
Link: https://lists.openwrt.org/pipermail/openwrt-devel/2023-July/041232.html
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
Tested-by: Gleb Pesin <dormancygrace@gmail.com>
Signed-off-by: Gleb Pesin <dormancygrace@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24734
Signed-off-by: Robert Marko <robimarko@gmail.com>
Commit 224a967ba1 ("ramips: mt7530: compile swconfig code
conditionally") used IS_ENABLED(CONFIG_SWCONFIG) to guard
swconfig-specific code.
When CONFIG_ALL_KMODS=y is selected, kmod-swconfig's KCONFIG
override forces CONFIG_SWCONFIG=m during the kernel config merge.
An explicit CONFIG_SWCONFIG=y is protected from being downgraded by
the kmod override, but an absent/unset symbol is not, so the
override's =m wins instead.
IS_ENABLED() evaluates to 1 both for built-in (=y) and module (=m),
so the swconfig code is still compiled into the built-in mt7530
driver even though register_switch() lives in the external
swconfig.ko module and is not available during vmlinux linking,
resulting in:
drivers/net/ethernet/ralink/mt7530.c: undefined reference to `register_switch'
Switch to IS_REACHABLE(CONFIG_SWCONFIG) which returns true only when
the symbol is actually reachable from the current compilation unit.
This correctly handles the case where mt7530 is built-in and
swconfig is a module, while still allowing both to be built as
modules. Also update the diagnostic message in the fallback branch,
since it is now also reached when swconfig is built as an
unreachable module, not only when support is absent entirely.
Fixes: 224a967ba1 ("ramips: mt7530: compile swconfig code conditionally")
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/24728
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The ipTIME A8004T requires GPIO19 and GPIO8 for PCIe reset control.
GPIO8 is assigned to UART3 by default, so configure the pin state
to make it available as a GPIO and add both GPIOs to the PCIe
reset-gpios property.
This fixes PCIe initialization after warm reboot.
Signed-off-by: Myeongjae SONG <devparlair@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24534
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
ASUS RT-N65U is a 2.4/5 GHz band 11n (Wi-Fi 4) router, based on RT3883.
Specification:
- CPU1: Ralink RT3883 @ 500MHz, WiSoC 5GHz
- CPU2: Ralink RT3352 @ 400MHz, WiSoC 2.4GHz
- RAM1: 128MB
- RAM2: 16MB
- Flash: Macronix MX25L12805D (16MB)
- WLAN: Ralink RT3883 (5GHz 3T3R), Ralink RT3352 (2.4GHz 2T2R)
- Switch: Realtek RTL8367RB
- 4x 10/100/1000 Mbps Ethernet
- 1x 10/100/1000 Mbps WAN
- USB: ASMedia ASM1042 USB 3.0 Controller
- PMU: UTC UZ1086L-ADJ
- 6x LED, 2x button
Installation (TFTP):
1. Power off the router.
2. Press and hold the Reset button.
3. Power on the router.
4. Wait 5 seconds, then release the Reset button.
5. Connect your PC to the router with Ethernet cable.
6. Configure a static IP address in the `192.168.1.0/24` subnet (except `192.168.1.1`).
7. Configure your TFTP client to use binary (octet) transfer mode.
8. Upload the firmware image (OpenWrt, stock, or Padavan) to `192.168.1.1`.
The TFTP server accepts any filename.
9. Wait for the firmware flashing process to complete.
WARNING: Flashing the stock firmware after using Padavan may brick
your router due to configuration partition incompatibility.
MAC address layout:
- Wi-Fi 2.4GHz & WAN: label MAC
- Wi-Fi 5GHz & LAN: label MAC + 4
MTD layout:
```
mtd0: 00030000 00010000 "u-boot"
mtd1: 00010000 00010000 "config"
mtd2: 00010000 00010000 "factory"
mtd3: 00fb0000 00010000 "firmware"
mtd4: 001ee3b3 00010000 "kernel"
mtd5: 00dc1c4d 00010000 "rootfs"
mtd6: 00960000 00010000 "rootfs_data"
```
Known issues:
- The RT3352 2.4 GHz iNIC is unsupported because it requires a
proprietary firmware blob and kernel support
- The Wi-Fi LEDs cannot be disabled independently because they share
the LED power rail controlled by GPIO10
This work is based on the earlier draft support by Andrej Valek.
Tested by 4PDA users
Signed-off-by: Andrej Valek <andy@skyrain.eu>
Signed-off-by: Andrey Trishin <zatrit@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24343
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The U-Boot environment data on the ipTIME T5004 occupies one
128 KiB NAND erase block.
The nvmem layout specified an environment size of 0x1000.
This caused CRC32 validation to fail and prevented the MAC
address cells from being created.
Set env-size to 0x20000 to match the U-Boot environment data
size used for CRC validation.
Fixes: 8dd95cc6b5 ("ramips: iptime,t5004: use nvmem for ubootenv")
Signed-off-by: Myeongjae SONG <devparlair@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/24530
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Wrap all swconfig-specific code in mt7530.c with #if IS_ENABLED(CONFIG_SWCONFIG),
including struct switch_dev, the vlan/port mapping tables and all
switch_dev_ops callbacks. Register access helpers (mt7530_r32/w32), the
PSC/HWTRAP definitions, and the small set of swconfig-only register
macros and MIB tables further up the file remain unconditional - the
latter two are unused-but-harmless when swconfig is disabled and are
left alone to keep the diff focused.
When swconfig is not compiled in, the driver performs only minimal
hardware init (disables MAC learning on all ports, applies the HWTRAP
fixup) and skips switch registration, mirroring the existing behaviour
of the "mediatek,no-swconfig" device tree property. This removes the
need for that property when building DSA-only images. The property is
still honoured whenever CONFIG_SWCONFIG is enabled (built-in or as a module).
A distinct log message is used for the compile-time case, to
distinguish it from the runtime "mediatek,no-swconfig" case in dmesg.
Also switch the existing runtime "swconfig disabled" message from
pr_info() to dev_info(), changing its dmesg prefix from "mt7620: " /
"mt7530: " to the device's own prefix.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/24574
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Read flow-control state of the fast ethernet as well as gig-e ports.
The fast ethernet ports only read a combined state for TX and RX
flow-control, the gigabit / CPU ports read a per-direction FC state.
Signed-off-by: David Bauer <mail@david-bauer.net>
The nvmem cell for the MT7663 (5 GHz) radio was too small. The MT7663 EEPROM at
offset 0x8000 requires the full MT7615_EEPROM_FULL_SIZE (0x4da8), but the cell
only declared 0x200 bytes.
The driver always requests the full buffer, also for the MT7663, so the undersized
cell makes the nvmem read fail with -EINVAL. The driver then falls back to default
values, which limits TX power to 3 dBm.
Fix this by enlarging the cell to 0x4da8. The offset 0x8000 was already correct —
offset 0x0 holds the MT7628 (2.4 GHz) calibration data.
Fixes: #23632
Signed-off-by: Frank Lang <Frank_Lang@outlook.de>
Link: https://github.com/openwrt/openwrt/pull/24284
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
fe_poll_rx() takes the packet length directly from the RX descriptor and
passes it to skb_put() without checking that it fits in the allocated
buffer. A malformed or stale descriptor can therefore extend the skb
beyond its tailroom and corrupt memory.
Reject lengths larger than skb_tailroom(), account the packet in
rx_length_errors and rx_dropped, free the affected skb, and continue by
installing the replacement descriptor.
Signed-off-by: Nickolay Savchenko <n.savchenko@axioma.lv>
Link: https://github.com/openwrt/openwrt/pull/24268
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
fe_txd_unmap() uses dma_len0 and dma_len1 to decide whether each TX
mapping must be passed to dma_unmap_page(). After unmapping, however,
the code passed the dma_addr0 and dma_addr1 field identifiers to
dma_unmap_len_set().
This leaves the actual length fields unchanged. A reused descriptor
slot can therefore retain a non-zero length and attempt to unmap an old
DMA mapping again.
Clear dma_len0 and dma_len1 after the mappings have been released.
Signed-off-by: Nickolay Savchenko <n.savchenko@axioma.lv>
Link: https://github.com/openwrt/openwrt/pull/24268
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add support for the Comfast CF-EW84 based on the MediaTek MT7621
SoC.
Hardware:
CPU/SoC: MediaTek MT7621DA
RAM: 128 MB DDR3
Flash: Macronix MX25L12805D 16 MB
Switch: MediaTek MT7530
WiFi 2.4 GHz: MediaTek MT7603E
WiFi 5 GHz: MediaTek MT7613B
Ports: 1x WAN, 2x LAN (10/100/1000 Mbps)
LEDs: Power, WAN, LAN1, LAN2, WLAN
Buttons: Reset
UART: through-hole on PCB
pinout: RX, TX, GND, 3.3V
settings: 115200n8
Flash instructions:
1. Connect the bundled PoE injector to power.
2. Connect the PC to the LAN1 or LAN2 port of the device.
3. Configure a static IP on the computer's Ethernet adapter:
IP: 192.168.1.x (x = 2 to 254)
Mask: 255.255.255.0
Gateway: empty
DNS: empty
4. Connect a second Ethernet cable to the PoE port of the
bundled injector.
5. Press and hold the reset button on the device.
6. While holding the reset button, plug the other end of the
second Ethernet cable into the WAN port.
7. Wait at least 3 seconds, then release the reset button.
8. Browse to http://192.168.1.1: the MediaTek U-Boot System
Recovery page should appear.
9. Click Upload and select the *-sysupgrade.bin firmware file.
10. After flashing completes, browse to http://192.168.1.1
again: the LuCI login page should appear.
Factory data:
2.4 GHz EEPROM: factory offset 0x0000
5 GHz EEPROM: factory offset 0x8000
LAN MAC address: factory offset 0xe000
WAN MAC address: factory offset 0xe000 (+1)
LED layout:
The Comfast CF-EW84 has five physical LEDs, but only the WLAN
LED is software-controllable through the Linux GPIO-LEDs
subsystem.
Signed-off-by: Vincenzo Suraci <vincenzo.suraci@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24112
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
MAX_RX_PKT_LEN value 2 selects 1552-byte frames, not jumbo mode.
Select value 3 so the configured 2 KiB frames are actually accepted by
the switch.
Tested on a ZBT-WE826 (MT7620). With value 2, 1534-byte IPv4
packets pass while 1535-byte packets are dropped. With value 3,
1792-byte and 1800-byte DF IPv4 packets pass.
Fixes: d083212e11 ("ramips: ethernet: ralink: mt7620 enable jumbo frames")
Signed-off-by: Gleb Pesin <dormancygrace@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24242
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add a backport patch and pending patches needed by upcoming PSE drivers
which are built as modules and probed after the MAC/PHY.
The net effect for module-built PSE controllers: attachment to PHYs
happens via the lifecycle notifier rather than via probe-time
-EPROBE_DEFER coupling, so the MDIO/DSA probe no longer sees any
PSE-originated -EPROBE_DEFER and the probe-retry storm is gone.
Link: https://github.com/openwrt/openwrt/pull/23222
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
DSA copies the driver features to slave device, including offload
capabilities. Once a packet is sent through a DSA slave interface,
according to its features, the kernel does not calculate checksums,
expecting that the HW will fill the gaps. DSA adds the defined DSA
tag and sends the tagged packet through the master device.
Ethertype DSA tags expect the driver to calculate checksum based on the
csum_start/csum_offset. However, mtk_soc_eth does not use that info.
It checks the network header and decides if the HW can manage that
packet, unaware that mac layer now contains an extra DSA tag. When
that tag is the Mediatek CPU tag, offload will work as expected.
When it is an incompatible DSA tag or if DSA is stacking two incompatible
DSA tags, the driver will still count on the HW offload. In this case,
packets go to the network with an incorrect checksum.
Before this change, tag_ops->proto == DSA_TAG_PROTO_MTK was used,
which disabled offload for every non-Mediatek tag, including the
RTL8367S switch's RTL8_4 tag that this fix specifically targets.
Replace the hardcoded whitelist with a blacklist scoped to the
RTL8367S: only disable offload for DSA_TAG_PROTO_RTL8_4. The RTL8_4T
(the trailing-tag variant) is left untouched because its rtl8_4t tagger
already checksums the frame in software before appending the tag.
Tags for other DSA-capable switches are left untouched by this fix
and are not claimed to be offload-safe.
Fixes: 3c0a73b4d2 ("ramips: ethernet: ralink: fix offload with diff dsa tag")
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/24064
Signed-off-by: Robert Marko <robimarko@gmail.com>
Hardware:
- SoC: MediaTek MT7628AN
- Flash: 16 MiB SPI NOR
- RAM: 128 MiB DDR2
- WLAN: 2.4 GHz (MT7628AN, 11n), 5 GHz (MediaTek MT7615E, 11ac)
- Ethernet: 1x10/100 Mbps LAN
- Buttons: 1 Reset button
- LEDs: 8x Green
- LTE: internal USB-connected modem Quectel EC200A
- Serial Console: unpopulated header 115200 8n1
MAC addresses:
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 80:af:ca:xx:xx:x0 | label |
| WLAN 2g | 80:af:ca:xx:xx:x0 | label |
| WLAN 5g | 80:af:ca:xx:xx:x2 | +2 |
+---------+-------------------+-----------+
Migration to OpenWrt:
- Download the RSA signed intermediate firmware:
`openwrt-ramips-mt76x8-cudy_lt500-outdoor-v1-squashfs-flash.bin`
- Connect computer to LAN and flash the intermediate firmware via OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert back to OEM firmware:
- Press the reset button while powering on the device
- Connect the LAN port to the PC
- Open 192.168.1.1 in a browser and use the wizard to upload and flash OEM firmware image
- When recovery process is done, OEM firmware is accessible via 192.168.10.1 again
Signed-off-by: rodriguezst <git@rodriguezst.es>
Link: https://github.com/openwrt/openwrt/pull/23752
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
For the most part, factory: remains as a hold over from nvmem-layout
conversion and no longer serves any purpose.
In the case of &factory sections, reduce identation slightly by
referencing the nvmem-layout node instead.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24008
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Skip swconfig registration and disable MAC learning when the
"mediatek,no-swconfig" property is set. This is needed for MT7620
devices using the internal switch as a transparent bridge to an
external RGMII switch, where ports 0-4 are unused.
The no-swconfig property itself is valid for both DSA and non-DSA
setups. However, disabling MAC learning is only required for DSA,
where multiple CPU-facing interfaces would otherwise cause an
incorrect ARL table to be built. Non-DSA setups work correctly
without disabling MAC learning.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/23933
Signed-off-by: Robert Marko <robimarko@gmail.com>
DSA copies the driver features to slave device, including offload
capabilites. Once a packet is sent though a DSA slave interface,
according to its features, the kernel does not calculate checksums,
expecting that the HW will fill the gaps. DSA adds the defined DSA
tag and sends the tagged packet through the master device.
Ethertype DSA tags expect the driver to calculate checksum based on the
csum_start/csum_offset. However, mtk_eth_soc does not use that info.
mtk_eth_soc checks the network header and decides if the HW can manage
that packet, unaware that mac layer now contains an extra DSA tag. When
that tag is the Mediatek CPU tag, offload will work as expected.
When it is an incompatible DSA tag (all but Mediatek) or if DSA is
stacking two incompatible DSA tags, the driver will still count on the
HW offload. In this case, packets go to the network with an incorrect
checksum.
This patch adds an extra check and disables offloading when DSA tag is
in use and it is not Mediatek. Offloading is also disabled even when DSA
tag is Mediatek but there is something else increasing the mac layer
region (possibly another stacked tag). Mediatek tag can encode 802.1Q info and
using vlan tags will still use offloading. Other mac layer protocols
that are not supported by Mediatek will disable HW offloading. PPPoE was
not tested but it is expected that it will disable offloading.
This code is heuristically trying to keep HW offload enable with DSA tags.
Anyway, in the worse case, offloading is disabled and there is an increase
in overhead, which is better than packet with wrong checksum.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23933
Signed-off-by: Robert Marko <robimarko@gmail.com>
fe_change_mtu didn't update the registers if the interface was down.
DSA increases the CPU port MTU to accommodate the CPU tag. As this
happens while the CPU port was still down, the chip regs didn't get
updated and larger frames were dropped.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23933
Signed-off-by: Robert Marko <robimarko@gmail.com>
Registers in MT7620A_GDMA_OFFSET range were incorrect, except for the
first one GDM_FWD_CFG (which is actually the only one in use).
The next and last register is GDM_SHPR_CFG. All others are not mentioned
in docs.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23933
Signed-off-by: Robert Marko <robimarko@gmail.com>
mt7620 can forward jumbo frames up to 2048. The fe_change_mtu() was
already compatible except for the GDM_FWD_CFG address.
An MTU greater than 1500 is required to use DSA tags with a stacked
switch chip.
This patch enables jumbo frame support by default.
Signed-off-by: Andrey Melnikov <temnota.am@gmail.com>
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23933
Signed-off-by: Robert Marko <robimarko@gmail.com>
The LED(s) does not have a label for status, ethernet, or whatsoever.
These two LEDs, are used to form one dual-color indicator. On vendor
firmware, the light is turned from orange to white, when external
storage is detected and ready to use. However, if we use white for any
other triggers (USB / SD card / ethernet), it is difficult to see while
the orange is on. Thus, we change led-running to white to indicate a
successful startup.
Also add the missing pinmux config for uart3 since LEDs take GPIO 7 and
8.
Signed-off-by: David Yang <mmyangfl@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23182
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Ryan Leung
Grische
Denis Faizullin
Edoardo Pinci
Daniel Golle
Shiji Yang
John Crispin
Carlo Szelinsky
John Audia
Markus Stockhausen
Frank Wunderlich
Gleb Pesin
Shiji Yang
Mieczyslaw Nalewaj
Myeongjae SONG
Charles Joynson
Andrej Valek
David Bauer
Frank Lang
Nickolay Savchenko
Vincenzo Suraci
Rosen Penev
Jonas Jelonek
rodriguezst
Luiz Angelo Daros de Luca
David Yang