No test on this hardware, but the same community U-Boot source that
confirms the Livinet Li320 wiring carries this board too, with
support_quad set on the controller and the same typo in its own DTS.
Yuzhii0718/bl-mt798x-dhcpd, uboot-mtk-20250711/arch/arm/dts/mediatek/
openwrt/mt7986b-zyxel_wx5600-t0.dts.
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/24809
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
The node already sets support_quad on the controller; the misspelling
was keeping the bootloader's flash access at 1-bit regardless.
The package had no PKG_RELEASE, so this adds one to rebuild the
bootloader for the boards that carry these patches.
Tested-by: Andrew Sim <andrewsimz@gmail.com>
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/24809
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
49ab6793662a ipq5018: add BDFs for Wallys DR5018S
04dff0ab979f qca9888: add BDF for TP-Link Archer C60 v3
Signed-off-by: Robert Marko <robimarko@gmail.com>
TP-Link Archer AX55 v1 is an IPQ5018 Wi-Fi 6 router.
Hardware:
SoC: Qualcomm IPQ5018 (dual Cortex-A53)
RAM: 512 MiB
Flash: 128 MiB SPI-NAND (dual firmware slots)
Switch: Realtek RTL8367S (5x GbE), 2.5G HSGMII trunk to gmac1
WiFi: IPQ5018 2.4 GHz + QCN6122 5 GHz (ath11k)
USB: 1x USB 3.0 port, SuperSpeed, using the IPQ5018 SS uni PHY;
the port's 5 V rail is a GPIO-switched regulator wired as the
PHY's vdd-supply, the way the MR5500 does it
Button: Reset, WPS/Wi-Fi
LED: power, LAN, WAN (green/orange), 2.4G, 5G, USB
All five front jacks are RTL8367S ports (DSA): blue "WAN" = wan,
LAN1-4 = lan1..lan4, over the 2.5G HSGMII trunk.
The factory MAC is the "default-mac" file in the tp_data UBIFS volume
(there is no raw nvmem cell for it). The volume is attached and mounted
read-only during preinit, so board.d assigns the wired MACs (label MAC
for lan/eth0, +1 for wan) the usual way and the ath11k caldata hotplug
derives the Wi-Fi MACs (+2/+3) from the same mount - the same scheme
the mt7981 archer-ax80-v1 uses for its tp_data. gmac1 has no nvmem MAC
source, so the DSA conduit is pinned to the label MAC in board.d to
keep it stable across boots.
The board data files live in firmware_qca-wireless, where they were
merged as f2c37a6b9d1d; this commit pins the ipq-wifi package to that
revision and adds the package entry for the board.
Note on revisions: some units labelled "v1" carry an RTL8367D-family
switch (chip id 0x6642) instead of the RTL8367S. rtl8365mb cleanly
declines it ("unrecognized switch"), so such a unit boots with no wired
ports, and with Wi-Fi off by default it is only reachable via the
vendor web recovery (or serial). RTL8367D support in rtl8365mb is being
worked on by others; until it lands the wiki page carries a prominent
warning to identify the switch before flashing. v2/v4 are entirely
different hardware and are not covered by this image.
Installation (serial console on the JP1 header, 115200 8N1, 1.8 V; note
the RX trace is gapped and must be bridged to type): interrupt U-Boot,
TFTP-boot the initramfs image to 0x44000000, "bootm", then "sysupgrade -n".
A serial-free path (a telnet-enabled resigned stock image flashed from the
vendor web UI, then writing the OpenWrt image to the inactive slot) is
documented on the device wiki page; that path consumes the
initramfs-factory.ubi artifact, which is the initramfs kernel wrapped in
a UBI image so it can be written straight into the inactive rootfs
partition with mtd from the running stock firmware.
Recovery to stock: hold Reset while powering on, set the PC to
192.168.0.10, and upload an official signed TP-Link image at
http://192.168.0.1.
Signed-off-by: Stanislaw Pal <kuncy7@gmail.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/24197
Signed-off-by: Robert Marko <robimarko@gmail.com>
ADB authentication signs the 20-byte challenge directly as a SHA-1
digest. The mbedTLS port hashes the challenge before signing it,
causing adbd to reject every signature and request user approval
after each server restart.
Pass the challenge directly to mbedtls_pk_sign(), matching the former
RSA_sign() behavior.
Signed-off-by: Vladimir Zadirei <v.zadirei@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24946
Signed-off-by: Robert Marko <robimarko@gmail.com>
| Component | Details |
|------------------|------------------------------------------------|
| **SoC** | MediaTek MT7986A (4× ARM Cortex-A53 @ 2.0 GHz) |
| **RAM** | 512 MB |
| **Flash** | 256 MB NAND |
| **Ethernet** | 5× 10/100/1000 Mbps (1 WAN + 4 LAN) |
| **WLAN 2.4 GHz** | MediaTek MT7976GN — 802.11b/g/n/ax, 4×4 MIMO |
| **WLAN 5 GHz** | MediaTek MT7976AN — 802.11n/ac/ax, 4×4 MIMO |
| **LEDs** | 1× RGB LED (GPIO-controlled) |
| **Button** | 1× Reset |
| **USB** | Yes |
**MAC Addresses:**
| Interface | Source |
|------------|-------------------------------------------------|
| WAN/Label | MFG MTD partition (variant-specific fallback) |
| LAN | WAN + 1 |
| 2.4 GHz | WAN + 2 |
| 5 GHz | WAN + 3 |
Supported variants and MAC source:
- JIDU6J01,JIDU6201: binary at offset 0x00
- JIDU6401: binary at offset 0x20
- JIDU6601: ASCII text at offset 0x1d0
- JIDU6701: ASCII mac= key
---
**1. Extracting U-Boot Credentials**
The U-Boot username and password are stored in the `MFG` partition. To retrieve them:
- With root access on stock OS: Read directly from the MFG partition.
- Without root access: Dump the NAND flash first, then extract the credentials from the dump.
**2. Prepare TFTP server**
- Set a static IP on the ethernet interface of your computer
(e.g. default: ip `192.168.1.2`, gateway `192.168.1.1`).
- Download the initramfs image and host it with the TFTP server.
**3. Interrupt boot**
Attach UART and power on the router. When the boot menu appears, select **Failsafe Mode**,
then press `Ctrl-C` to interrupt and enter the credentials extracted from `MFG` partition.
**4. Load and run initramfs image**
```sh
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
tftpboot 0x46000000 openwrt-mediatek-filogic-jiorouter_ax6000-jidu6j01-initramfs-kernel.bin
fdt addr $(fdtcontroladdr)
fdt rm /signature
bootm
```
**5. Flash sysupgrade image**
Place the sysupgrade image in `/tmp`, then run:
```sh
sysupgrade /tmp/openwrt-mediatek-filogic-jiorouter_ax6000-jidu6j01-squashfs-sysupgrade.bin
```
Alternatively, use the sysupgrade option in LuCI.
Signed-off-by: Sheikh Faisal <sheikhfaisal713@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23510
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
Correct the U-Boot env geometry from "0x80000" "1" to "0x1f000" "5".
The correct LEB size for 128k PEB / 2k page is 0x1f000, and the 0x80000 volume spans 5 LEBs.
This also hardens jiorouter_initial_setup by adding proper error handling
and dynamic UBI device/volume lookups, and generates /etc/fw_env.config to be consistent.
Signed-off-by: Sheikh Faisal <sheikhfaisal713@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23510
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
Add the CMCC RAX3000M(e) UBI-enabled U-Boot target for both DDR3 and DDR4 builds.
Refactor the CMCC RAX3000M(e) device trees.
The board-specific DTS variants for eMMC, NAND, and UBI now
inherit the common setup while overriding the required
flash configuration and partitions.
This keeps the common MT7981 wiring centralized and
makes each RAX3000M variant explicit and maintainable.
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24575
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
Static DHCP entries with dns enabled only had
their FQDN written to the generated hosts file, so
the bare hostname would not resolve unless the host also had
an active DHCP lease:
$ dig +short dockbox-vm
$ dig +short dockbox-vm.lan
10.100.1.20
Signed-off-by: Tucker Kern <tuckkern@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25012
Signed-off-by: Robert Marko <robimarko@gmail.com>
Netgear RBx850 are tri band, 2.4GHz and 2x 5GHz, 12 stream 802.11ax mesh
devices from the Orbi series. The RBR850 is a router with a 2.5GbE WAN and
4 1GbE LAN ports. The RBS850 is a satellite without WAN port and half the
flash. The hardware is otherwise identical. They were sold in kits as
RBK852-RBK855, with one router and 1-4 satellites.
The RBx850 are substantially similar to the RBx750 so this commit factors
out a common DTS, flash script and build definition.
Hardware:
* SoC: Qualcomm IPQ8074
* RAM: 1GiB 2x Samsung 4A4G165WE-BCRC
* Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ
* WLAN 2.4GHz: QCN5024 4x4:4 b/g/n/ax
* WLAN 5GHz Low Band: QCN5054 4x4:4 a/n/ac/ax 5180-5320MHz
* WLAN 5GHz High Band: QCN5054 4x4:4 a/n/ac/ax 5500-5700MHz
* Ethernet: 4x 1GbE LAN, 1x 2.5GbE WAN on RBR850
* Serial Config: 3.3V TTL 115200-8-N-1, internal populated header
* Serial Layout: Bottom <- RX, TX, GND, 3.3V (don't connect) -> Top
* LEDs: green/red power, white/red/green/blue status
* Buttons: 1x Reset, 1x WPS
MAC addresses:
LAN1: Label
LAN2: Label + 1
LAN3: Label + 2
LAN4: Label + 3
WAN: Label + 1
2.4GHz: Label + 2 (RBR) or 1 (RBS)
5GHz-Low: Label + 3 (RBR) or 2 (RBS)
5GHz-High: Label + 4 (RBR) or 3 (RBS)
Flashing Notes:
The stock firmware images are signed. Both the bootloader and the stock
web interface check the signature and will fail to boot/flash.
The bootloader automatically does NMRP when a gigabit LAN connection is
present. The stock and factory images contain a U-Boot script that is
executed when flashing using NMRP. This is used to alter and persist the
U-Boot env with a boot command that works with unsigned firmware.
Install OpenWrt:
* Get the nmrpflash utility [0] and OpenWrt factory image
* Find network interface to use: nmrpflash -L
* Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
* Connect one of the device LAN ports to the same network using gigabit
* Plug the device in and wait for the bootloader to flash
* Unplug and replug the device once the power LED on the back blinks amber
Revert to Stock:
The boot command needs to be reverted before flashing the stock firmware,
otherwise it will fail to boot and get stuck in recovery mode (red power
LED flashing).
* Still in OpenWrt run: fw_setenv bootcmd bootipq
* Restart the device
* Flash the stock firmware RBx850-Va.b.c.d.img using nmrpflash
[0]: https://github.com/jclehner/nmrpflash
Authored by Michael Lotz.
Piotr Szczepanik:
* Cherry-picked the RBx850 support commit from openwrt/openwrt#22159
and adapted it to current main.
* Reworked the DTS networking changes for the current qualcommax
ipq807x device-tree style.
* Verified the RBx750 DTS split preserves the existing RBx750-specific
layout while moving shared RBx750/RBx850 nodes into a common DTSI.
Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Signed-off-by: Piotr Szczepanik <piter75@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24906
Signed-off-by: Robert Marko <robimarko@gmail.com>
Enable ECDSA by default to:
- Support login with existing ECDSA keys.
- Ensure compatibility with legacy YubiKey devices (e.g., firmware 5.4)
and PIV-based SSH keys (RSA/ECDSA only).
- Maintain access until Ed25519 adoption is widespread.
Default 'y' for all builds except those with SMALL_FLASH.
This activates:
- DROPBEAR_ECC_256 (via DROPBEAR_ECDH || DROPBEAR_ECDSA), enabling
NIST-curve code for non-SMALL_FLASH builds.
- DROPBEAR_SK_ECDSA (default y), offering
sk-ecdsa-sha2-nistp256@openssh.com by default.
Note: Increases only binary size for non-SMALL_FLASH targets.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Link: https://github.com/openwrt/openwrt/pull/24685
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The packet steering script treats both threaded NAPI and the mt76 TX
worker as tasks belonging to the same wireless device. assign_dev_cpu()
then assigns all of these tasks to the same CPU.
This unnecessarily restricts the mt76 TX worker to the NAPI CPU even
though its affinity does not otherwise need to be constrained.
On MT7988A with MT7996 this caused the TX worker to share CPU3 with the
NAPI thread. Moving it to another CPU increased measured TX throughput
from 1.45 Gbit/s to 2.09 Gbit/s.
Stop matching the mt76 TX worker in the packet steering script. This
leaves its CPU affinity unrestricted and lets the scheduler place it
more appropriately.
Fixes: https://github.com/openwrt/openwrt/issues/24697
Signed-off-by: Gary Dotzler <geldot@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/25016
Signed-off-by: Robert Marko <robimarko@gmail.com>
mac80211 7.2 changes cfg80211 key and station operations to take a
wireless_dev instead of a net_device. It also updates station notification
helpers and the remain-on-channel callback.
Adapt the driver to the new API and bump the package release.
Signed-off-by: Alexander Zaguzin <st7105@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/25020
Signed-off-by: Robert Marko <robimarko@gmail.com>
Patch 200 reverted the ath12k conversion from tasklets to BH workqueues.
It arrived with 88f4c32060 ("mac80211: update to version 6.14.11") in May
2025, when main still built kernel 6.6 on 26 targets; BH workqueues only
exist from 6.9, so the revert was doing real work then.
Main now builds 6.12 and 6.18. Both provide system_bh_wq and from_work(),
so there is nothing left for the revert to paper over.
It also leaves the driver inconsistent. backports 7.2 uses intr_wq in
ce.h, pci.c and ahb.c alike, and patch 200 converts only the first two
back to tasklets -- ahb.c was added to the driver after the conversion
landed and never got the same treatment. Building with ATH12K_AHB enabled
therefore fails.
Against pristine backports 7.2 the mac80211 patch series applies 151/151
with this patch removed, and no intr_tq reference survives in ath12k. An
ipq53xx build with ATH12K_AHB enabled links ahb.o cleanly, and the driver
probes an on-chip radio on real hardware.
Bump PKG_RELEASE so existing installs pick up the rebuilt module: it feeds
ABI_VERSION for the kmod packages.
Signed-off-by: Hideo Sumi <hideo.sumi@mugops.com>
Link: https://github.com/openwrt/openwrt/pull/24978
Signed-off-by: Robert Marko <robimarko@gmail.com>
kbuild dropped EXTRA_CFLAGS in 6.15 (e966ad0edd00, "kbuild: remove
EXTRA_*FLAGS support"), so on 6.18 the define never reaches the
compiler and the module logs "nat46: module (version unknown) loaded".
CFLAGS_MODULE is read by both 6.12 and 6.18.
Assisted-by: Claude:claude-fable-5-1
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/25057
Signed-off-by: Robert Marko <robimarko@gmail.com>
On IPQ8074 a firmware assert reboots the SoC.
ath11k_core_reconfigure_on_crash() frees the data path and clears the
ring list while the DP NAPI is still polling, so the NAPI services a ring
whose address pointer has just been cleared:
Unable to handle kernel read from unreadable memory at virtual address 0
pc : ath11k_hal_srng_access_begin+0xc/0x60 [ath11k]
Call trace:
ath11k_hal_srng_access_begin+0xc/0x60 [ath11k] (P)
ath11k_dp_rx_process_mon_rings+0xa0/0x5d4 [ath11k]
ath11k_dp_service_srng+0x1f4/0x348 [ath11k]
ath11k_ahb_ext_grp_napi_poll+0x34/0xd4 [ath11k_ahb]
951 disables the interrupts on the crash path again. 950 is its
prerequisite: it wires up the CE interrupt ops that
ath11k_ahb_hif_ops_ipq8074 never set, which leaves the CE half of the
quiesce a no-op on AHB. Both are in ath-next as commit a7ab5c835e42
("wifi: ath11k: implement CE interrupt enable/disable for AHB") and
commit f7a74e131d3f ("wifi: ath11k: disable interrupts during firmware
crash recovery"), and are carried here verbatim.
Tested on a Xiaomi AX3600 (IPQ8074 hw2.0) with the debugfs
simulate_fw_crash assert trigger: one assert panics and reboots the SoC
before, five asserts recover after.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/24578
Signed-off-by: Robert Marko <robimarko@gmail.com>
parse_encryption returns leaves config.auth_type unset in case
encryption is unset. However, the owe_transition_iface config option for
the unencrypted network is currently only set in case encryption is
explicitly set to 'none'.
These two should be identical in their behavior. Set the encryption to
"none" in case it is unset and do not return. This aligns the behavior
of unset encryption with encryption explicitly set to 'none'.
Signed-off-by: David Bauer <mail@david-bauer.net>
Uboot-Envtools is installed by default on the mpc85xx target.
Add the proper configuration for the Sophos RED 15w, so the fw_*env
commands will actually work.
Fix alphabetic sorting in the case statement while we're at it.
Signed-off-by: Shine- GH <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/24939
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
In order for the firmware package to depend on the corresponding kmod it
needs to be built within the same builtbot phase for the dependency to
land in the package metadata. Select 'nonshared' to force the firmware to
also get built as part of phase1.
Fixes: 1446eff887 ("mediatek: filogic: bpi-r4-pro-8x: add aeonsemi phy to bpi-r4-pro-8x")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The shell mac80211.sh ran both of these with >/dev/null 2>&1:
iw phy "$phy" set antenna $txantenna $rxantenna >/dev/null 2>&1
iw phy "$phy" set distance "$distance" >/dev/null 2>&1
The ucode rewrite dropped the redirect, so on any driver without
->set_coverage_class every wifi up now logs
netifd: radio0 (3302): command failed: Not supported (-95)
with no indication of which command failed. Neither return value is
checked, so the message is pure noise -- but it reads like wifi up
failed, and on ath12k/IPQ5332 it cost real debugging time before the
line was traced back to iw.c:616 rather than to the driver.
Restore the redirect. distance defaults to 0 and antenna to 0xffffffff,
so both calls run on every setup for every radio.
Signed-off-by: Hideo Sumi <hideo.sumi@mugops.com>
Common specifications:
* MediaTek MT7987A (4x Cortex-A53)
* 4 GiB eMMC
* 1 GiB DDR4 RAM
* 1x 2500M/1000M/100M/10M WAN port (MaxLinear MXL86211C PHY)
* 2x 2500M/1000M/100M/10M LAN ports (MaxLinear MXL86211C PHY,
MT7987 built-in 2.5G PHY)
* 3x LED (green/amber/white) for each Ethernet port
* 2 buttons (Reset, Mesh/WPS)
* uC-controlled RGB LED via I2C
* USB 2.0 type A port
* 3.3V-level 115200 baud UART console
* 12V 3A DC barrel jack power input
SDG-8712: MT7992 dual-band 802.11be Wi-Fi (2.4G 4T4R, 5G 4T5R)
SDG-8732: MT7996 tri-band 802.11be Wi-Fi (2.4G 2T2R, 5G 3T3R, 6G 3T3R)
MAC addresses (base MFG_MAC from the mfginfo partition; the nvmem
cell index in the DTS is added to the base):
wan xx:xx:xx:xx:xx:x0 MFG_MAC
lan1 xx:xx:xx:xx:xx:x1 MFG_MAC + 0x1
lan2 xx:xx:xx:xx:xx:x1 MFG_MAC + 0x1
2.4G xx:xx:xx:xx:xx:x4 MFG_MAC + 0x4
5G xx:xx:xx:xx:xx:xa MFG_MAC + 0xa
6G xx:xx:xx:xx:xx:x6 MFG_MAC + 0x6 (SDG-8732 only)
Both models are also available in versions including 1x FXS POTS
interface for analog phones. Those interfaces are not supported by
OpenWrt.
Installation:
1. Prepare a TFTP server at 192.168.1.10 and serve the OpenWrt
initramfs image, renamed to "openwrt.<engnum>" for the model
being installed:
openwrt.440: SDG-8712
openwrt.442: SDG-8732
2. Connect to LAN2.
3. Connect to the UART port.
4. Power on the device and type "st" to enter the U-Boot command
line. The window to do that might be very short (below 1s), so
type it as soon as the "U-Boot ..." string appears.
5. Run "setenv boot_mode openwrt; saveenv" to boot from OpenWrt
partition by default.
6. Run "bootmenu" and select option 6 (TFTP openwrt image and
boot); "run boot5" is a shortcut for the same. This downloads
openwrt.<engnum> from the TFTP server and boots it.
7. After OpenWrt finishes booting, download the OpenWrt sysupgrade
image and write it to eMMC using "sysupgrade".
8. After sysupgrade finishes writing, the device reboots into
OpenWrt. When the front LED is solid white the device is ready
for configuration.
Signed-off-by: Chad Monroe <chad@monroe.io>
Link: https://github.com/openwrt/openwrt/pull/24679
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Every link of an AP MLD can hold an entry for a station while only the
association link says where it is listening. Taking the first link that
has an entry sent the frame out on a link the station is not on, so a
BTM Request addressed to a station on the 5 GHz link went out on 2.4 GHz
and the station never saw it.
Prefer the link whose entry names it as the association link, and keep
any other entry only as a fallback for a station no link claims.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
hostapd_bss_transition_request() left mbo_reason, cell_pref and
reassoc_delay uninitialised and assigned them only when the caller named
them, while hostapd_bss_tr_send() built the MBO attributes from all
three unconditionally.
A caller that names none of them, which is every caller that only wants
a plain BTM Request, therefore had whatever the stack held validated and
then written into the frame. Where the leftovers failed validation the
request was refused with an invalid argument and no BTM Request frame
was transmitted at all; where they passed, the frame carried a random
transition reason and cellular preference. Which of the two happened
varied between calls, so client steering failed intermittently with no
diagnostic.
Initialise the three, and build the attributes only when the caller
asked for MBO. Name the cellular preference constants while touching
the validation.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
A station associates over one link of an AP MLD and its sta_info lives
on that link's BSS. A ubus method resolves its hostapd_data from the
object it arrived on, and only the BSS that registered the shared
interface name owns an object, so a method addressed to a station on any
other link looked it up on the wrong BSS.
bss_transition_request returned NOT_FOUND for those stations, so no BTM
Request frame was ever transmitted: hostapd's bss_transition_request_tx
counter stayed put across a whole run of client steering mandates.
del_client likewise failed to deauthenticate them, which left
association control unable to block a client of an AP MLD.
Walk the affiliated links, as hostapd_get_sta_ies_sta() already does for
the association frames, and act on the BSS that holds the station.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The BSSes of an AP MLD share one interface name, so only the first BSS
registers hostapd.<iface> and holds the subscribers. ubus_add_object()
fails for every other link and its return value is discarded, leaving
those links with an object that never has a subscriber.
hostapd_ubus_notify_obj() already resolves this, but only the generic
hostapd_ubus_notify() used it. Every other emitter still tested and
notified hapd->ubus.obj directly, so an event raised on a link other
than the first was dropped without a trace.
sta-authorized is the one that hurts: a station that associates over any
link but the first is never announced. umap-rrmd builds its station
table from that notification, so it never learns the station, and client
steering fails with "rrmd accepted 0 of 1 mandate STAs" for every client
of an AP MLD. bss-transition-response, beacon-report and the association
decision in hostapd_ubus_handle_event() are lost the same way.
Route them all through hostapd_ubus_notify_obj(). A BSS that is not an
MLD link, or one whose own object has subscribers, is unaffected.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Add the two external Aeonsemi AS21xxx PHYs used by the LAN and WAN
10GBASE-T ports of the BPI-R4 Pro 8x. Configure their firmware, reset
timing and LEDs, and connect them to the MxL switch and GMAC1.
Replace the fixed SFP GPIO hog configuration with LAN and WAN overlays
selecting either the copper PHY or the corresponding SFP cage. Build all
four overlays, include them in the device image and select the SFP
overlays by default through U-Boot `bootconf_extra`.
Make the AS21xxx firmware package pull in the PHY driver on Linux 6.18,
instead of making the driver depend on the firmware. Update existing
Airoha device package lists accordingly so they continue to install both
components through the firmware package.
Breaking change for users using the router with SFP hogs from PR #21083.
After flashing the new image, configure `bootconf_extra` to select
between SFP or PHY overlays:
fw_setenv bootconf_extra \
mt7988a-bananapi-bpi-r4-pro-8x-lan-phy#mt7988a-bananapi-bpi-r4-pro-8x-wan-phy
If bootconf_extra had additional overlays (CN13 or CN14) keep them appended
Signed-off-by: Pietro Ameruoso <p.ameruoso@live.it>
Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
Should have been deleted with the update. Fixes build error.
Fixes: a46721f04d ("mt76: update to Git HEAD (2026-09-01)")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
caf2a2b61403 wifi: mt76: connac: add MT7991A (0x7991) to is_mt7996()
4e6adf4f148a wifi: mt76: mt7615: avoid waiting for mac work under the mt76 mutex
403da5477681 wifi: mt76: mt792x: consolidate rx interrupt masks into all_complete_mask
f2157858189f wifi: mt76: connac2: apply new rx all_complete_mask
e246e3b09215 wifi: mt76: mt7925: replace shared rx irq masks with per-chip definitions
5d3681c06935 wifi: mt76: mt7925: add MT7927 per-chip rx irq definitions
610830a7da74 wifi: mt76: mt792x: replace shared PCIe MAC macros with per-chip struct
eacf301a0b69 wifi: mt76: connac2: add per-chip PCIe register definitions
accac9958d98 wifi: mt76: mt7925: add per-chip PCIe register definitions
5f6ca442190d wifi: mt76: mt792x: rename WFDMA DMASHDL enable bit to follow the convention
7c195dd52529 wifi: mt76: mt7925: rename WTBL registers to chip-specific format
60a17dfaa393 wifi: mt76: mt792x: add tx_done ring to common DMA queue allocation
2d5b97f4dbab wifi: mt76: connac3: update basic rate table starting index
59d1e9ecf1c5 wifi: mt76: mt7925: fix MMIO dynamic remap window size
65bfecfbdb81 wifi: mt76: mt7925: add MT7928 FWDL support
cb4df96e1331 wifi: mt76: mt7925: add MT7928 irq_map with chip-specific rx masks
4e0c8caee5a5 wifi: mt76: mt7925: add MT7928 DMA configuration
67bded21fb2a wifi: mt76: mt7925: add MT7928 TXD/TXS/TX_DONE support
933b8c1d7208 wifi: mt76: mt7925: add MMIO register remapping table for MT7928
132991c04ef7 wifi: mt76: mt7925: align scan IE and EFUSE TLV lengths to 4 bytes for MT7928
030c9362b7ce wifi: mt76: mt7925: add MT7928 per-chip PCIe register definitions
2e240e194d5c wifi: mt76: mt7925: add MT7928 PCIe support
b1f962a838c7 wifi: mt76: mt7915: configure noise floor reporting on reset
114c7028109f wifi: mt76: mt76u: use a threaded NAPI for the RX path
49795048d96e wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length
f5dc4270d268 wifi: mt76: mt76x02: report rx FCS errors to mac80211
d88989f8c612 wifi: mt76: mt7925: remove code guarded by nonexistent config option
13561afa1fc4 wifi: mt76: mt7996: remove code guarded by nonexistent config option
36917c4e6378 wifi: mt76: mt7996: fix TX DMA mapping leak for AddBA req frames
099844ec9c31 wifi: mt76: mt7603: free beacon SKB on error
43fa7d4a9e4a wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
d367ee6d72d8 wifi: mt76: mt7921: drop TXRX_NOTIFY on non-mmio buses
900f407746fa wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses
6ae90289d1aa wifi: mt76: mt7615: drop TXRX_NOTIFY on non-mmio buses
332bbe9b2784 wifi: mt76: Disable napi when removing device
3d1ea4928688 wifi: mt76: mt7925: stop init retries on hung bus
bfc39f5a863a wifi: mt76: mt7925: skip reset work on hung bus
91828c69db3e wifi: mt76: mt792x: stop USB register access after bus hang
e1a1abf10036 wifi: mt76: mt792x: drain USB UDMA before WFSYS reset
ece1f4a5a86f wifi: mt76: mt792x: enable USB UDMA TX timeout
837eda0e251e wifi: mt76: mt792x: quiesce USB paths on disconnect
a7160a4b3781 mt76: add fixes to merged patches
ac4d1a16e9f8 wifi: mt76: mt7925: guard link STA in decap offload
6ff6004fdb48 wifi: mt76: mt7921: validate CLC firmware records
3eb3ab6b43f2 wifi: mt76: mt7996: validate default EEPROM firmware size
8b90f61178a3 wifi: mt76: wed: fix kernel panic on non-DBDC MT7986
17114619e55d wifi: mt76: mt7915: fix net_fill_forward_path for non-DBDC mt7986
75268f2eaac8 wifi: mt76: mt7921: fix memory leak when skb_linearize fails in mcu rx event
a1d83aad6ccc wifi: mt76: mt7915: bound the device EEPROM address before the EFUSE copy
76c38706bbab wifi: mt76: mt7996: bound the device EEPROM address before the EFUSE copy
1ee3e2f6c207 wifi: mt76: mt7996: expose per-band MAC addresses to cfg80211
a2c3c698e487 wifi: mt76: mt7915: guard HE capability lookups
96c231171267 wifi: mt76: connac: fix possible NULL-pointer deref in mt76_connac_mcu_uni_bss_he_tlv()
3a95f5d6c826 wifi: mt76: mt7925: fix possible NULL-pointer deref in mt7925_mcu_bss_he_tlv()
89b69012de22 wifi: mt76: mt7996: check pointer returned by mt76_connac_get_he_phy_cap()
763e99aadba0 wifi: mt76: mt7996: fix possible NULL-pointer deref in mt7996_mcu_sta_bfer_eht()
491d786c1b81 wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete
fd2537190151 wifi: mt76: mt7915: add thermal zone device registration
e053e8c780c8 wifi: mt76: mt7603: add 0x7592 EEPROM chip ID
2d9b52d2246e wifi: mt76: restrict NPU/PPE active checks to MMIO devices
f8757dd2bf87 wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
98c13eb564e5 wifi: mt76: mt7925: Fix unregister deadlock
29d3554195a4 wifi: mt76: mt7925: cancel pending mlo_pm_work
c28c7e50b4b3 wifi: mt76: mt7925: cancel mlo_pm_work on stop
bd9cca0a3c39 wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
7274d6cc43bc wifi: mt76: mt7927: set band index for sniffer mode
aa5a2b4fee38 wifi: mt76: mt7927: use real monitor vifs for dual-band monitors
833ad5705dfe wifi: mt76: mt7925: support new WoW pattern TLV
0ef8eb8d7762 wifi: mt76: mt7925: fix crash in reset link replay
2119837464f2 wifi: mt76: mt7925: update clc before setting sar power table
cead9778a957 wifi: mt76: mt7925: fix msg len mismatch between driver and firmware
da8507851e66 wifi: mt76: mt792x: Fix memory leak in SDIO TX path
da1c4a2e0042 wifi: mt76: mt7921: refactor regd update to fix recursive mutex deadlock
fb35160342e3 wifi: mt76: mt7925: add regulatory wiphy self manager support
dd93a16e5f42 wifi: mt76: mt7921: add regulatory wiphy self manager support
968dc6335ad9 wifi: mt76: mt7996: fix capability of EHT-MCS 15 in MRU
8e1889a5ba7e wifi: mt76: fix index accounting in __mt76_wcid_alloc for offset ranges
b05c7c1df24b wifi: mt76: fix RX data queuing of RRO 3.0
4efe882252d4 wifi: mt76: mt7996: fix MLD ID in MAC TXD and HIF TXP
4ac697d5fbe2 wifi: mt76: fix non-AQL packet accounting for MLO stations
620e45de30e9 wifi: mt76: assign link_id when sending probe request during scan
fc74da790f24 wifi: mt76: mt7996: validate RX band_idx before dereferencing phys[]
a3b62f2330fb wifi: mt76: mt7996: set MT76_MCU_RESET before waking MCU waiters on full reset
1920d6dc6807 wifi: mt76: mt7915: clear wcid mask under mutex after RCU pointer clear
f7b7fde7a0b0 wifi: mt76: mt7915: avoid nss underflow in mt7915_mcu_get_sta_nss
8ad57c3ccaf5 wifi: mt76: mt7996: don't report a zero TX bitrate
5230bcf0f67e wifi: mt76: mt7915: write RX header translation bit to the correct register
cdc6c0d07c10 wifi: mt76: fix 4th chain ACK RSSI bitmask in sta_poll
41b98d773fdd wifi: mt76: fix stranded frames in mt76_txq_schedule_pending
f67ffb60cd4f wifi: mt76: allow TX aggregation on the VO queue
220cf481a755 wifi: mt76: fix uninitialised RXDMAD_C descriptor info
58e3e46c2786 wifi: mt76: fix RXDMAD_C buffer recycling race
49ff13fc0aeb wifi: mt76: mt7915: poll the correct SLP CTRL register for the second adie
c73ffc4a2e84 wifi: mt76: check txfree done event on the WED hw path
e59324380042 wifi: mt76: fix HE DCM max-RU capability encoding
48c4d99acd84 wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config
04017929f632 wifi: mt76: fix out-of-bounds access in mmio copy helpers
c52a151151c1 wifi: mt76: mt7915: unwind state on add_interface failure
2a574ac53652 wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
41cecc382be9 wifi: mt76: decode the full VHT Rx STBC capability field
f012f82a8171 wifi: mt76: fix ER-SU 106-tone RU check in RX rate decode
f66cff22fb04 wifi: mt76: mt7996: reserve space for the CSA-abort countdown TLV
d67367ec3260 wifi: mt76: mt7996: don't leak MLD group index on remap alloc failure
3def0335127c wifi: mt76: cancel reset and rc work on device unregister
10a1541fb264 wifi: mt76: report data NSS for STBC frames in RX rate decode
5f3122610346 wifi: mt76: mt7915: use little-endian for bss_info_ra wire fields
1ece37f8a93a wifi: mt76: mt7996: add missing rdd_idx check when enabling background radar
0e1234440585 wifi: mt76: only consume the WO drop bit on WED v2 devices
eeb07a4edc8c wifi: mt76: mt7996: add mcu command to set bssid mapping address
ffabf1e53b63 wifi: mt76: mt7996: leave PS when a 4-address connection is established
8f1dae620e09 wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
e14869fcee4b wifi: mt76: mt7996: skip key upload when adding an offchannel link
be8657a1cdf6 wifi: mt76: mt7996: wake MCU waiters before aborting scan in L1 SER
8d0dcd2bf947 wifi: mt76: fix queue reg access when building WED and NPU together
5ecae46405a1 wifi: mt76: mt7996: select net_setup_tc handler at runtime
130273a947ce wifi: mt76: fix stuck TX queues after SER with no active interfaces
bd41e0fbea0e wifi: mt76: mt7615: fix NULL deref in mt7615_mac_set_rates
af601a725f01 mt76: mt7915: trigger L1 SER on PLE MDP RIOC hang
386fd215577d wifi: mt76: mt7996: free vif links after clearing wcid entries on full reset
31f1fdb7cdbf wifi: mt76: mt7996: clear stale link state on full reset
142daad2c26b wifi: mt76: set MT76_SCANNING when starting a hw scan
498e5ee81537 wifi: mt76: serialize scan-link teardown with dev->mutex
50480826f5a9 wifi: mt76: mt7996: hold dev->mutex in remove_interface teardown
06b69763f2aa wifi: mt76: mt7996: fix infinite loop in PS sync event parsing
da2c90d2167d wifi: mt76: mt7996: send the STA_REC before the per-station VoW setup
7f4a3b710a98 wifi: mt76: mt7915: send the STA_REC before the VoW group setup
9be8ee34e8ca wifi: mt76: mt7925: fix declaration after case label in tx done event
cd26ff664675 wifi: mt76: mt7925: skip DMA re-init selectively
540a8ed5256f wifi: mt76: mt7915: simplify mt7915_sys_recovery_set()
0df35270b7b5 wifi: mt76: mt7925: Fix EHT Beamformee SS subfields to meet 802.11be minimum
cf8a369f5232 wifi: mt76: set the EOSP bit in the QoS header of the last released frame
baac541c0524 wifi: mt76: mt7603: fix U-APSD service period termination
56fe4e0c0aea wifi: mt76: mt7603: tell mac80211 when the PS queue has run empty
276db249c20a wifi: mt76: mt7603: restore hardware PS buffering after a service period
5504bac46a38 wifi: mt76: mt7603: file buffered frames under the TID reported to mac80211
8a03e88fc036 wifi: mt76: reject out-of-range link ids in mt76_vif_link()
b2704cf5a406 wifi: mt76: mt7996: fix out-of-bounds link array access in mt7996_tx()
dec412a05ac4 wifi: mt76: mt7996: program a link again if the driver holds it
26e36bf38f15 wifi: mt76: check the owner of a remain-on-channel request
95cb6eefae12 wifi: mt76: mt7996: take over connection monitoring
90f731f6c90d wifi: mt76: clear offchannel state if a scan has no channel to restore
2c84469c8fc8 wifi: mt76: account non-AQL frames per peer rather than per link
d49721c205c4 wifi: move action code from per-type frame structs
67c5f7ae2511 wifi: mac80211: fetch unsolicited probe response template by link ID
9abd11a8f8b2 wifi: Rename EMLSR delay constants and add EMLMR helpers and definitions
254a3442b3ad wifi: mac80211: fetch FILS discovery template by link ID
c5a3bd91aa73 wifi: mt76: pass LED define via ccflags-y in driver submodules
a221bf6cd6f6 wifi: mt76: mt792x: advertise mgmt frame registration
f9b5f7c0d93e wifi: mt76: mt7925: guard BSS capability lookups
e81b53328c9a wifi: mt76: connac: add NAN connection type
471fb15e87db wifi: mt76: mt7925: add NAN MCU helpers
302d9cb21068 wifi: mt76: mt7925: add NAN MCU handling
342da0fac10a wifi: mt76: add init_wiphy callback
2dc861ccd0ee wifi: mt76: mt7925: wire up NAN operations
3fdca8b53b7d wifi: mt76: mt792x: build iface combinations dynamically
33ef303d089a wifi: mt76: mt792x: advertise NAN data support
d905a7252724 wifi: mt76: mt7925: fix NAN NDP STA record role index
b2081f2a039e wifi: mt76: mt7925: fix NAN start failure
b51cd50b2081 wifi: mt76: mt7925: fix NAN committed CRB timeline layout
984def99436a wifi: mt76: mt7925: report only 2.4 GHz NAN supported band
dca87ee6fd94 wifi: mt76: mt7925: drop unused NAN 2.4/5 GHz support config
1f394b9c4206 wifi: mt76: mt7925: drop deferred NAN local schedule update handling
d19401e5d359 wifi: mt76: mt7925: use OFDM-only PHY mode for NAN STA records
a81f793eaf02 wifi: mt76: mt7925: share TLV setup for NAN enable command
7d3c4f81b1af wifi: mt76: mt7925: replace NAN DW end event with DW start
8573266a2612 wifi: mt76: mt7925: fill all DW intervals in NAN avail_map
26be5a8f793c wifi: mt76: mt7925: clear CRB before deactivating NAN peer record
33a39c2ce26d wifi: mt76: mt7925: add ULW event handling and peer ULW update
c09c19fe7cbf wifi: mt76: mt7925: configure NAN PHY setting on enable
724801b83aed wifi: mt76: mt7925: support deferred NAN schedule update and cluster events
435eb726936f wifi: mt76: mt7925: fix HT/VHT caps and rates for NAN NDP peers
f701fad5c06c wifi: mt76: mt7925: fix infinite loop in UNI event TLV parsing
9de658490af7 wifi: mt76: mt792x: do not advertise active monitor
2d6d69e7162a wifi: mt76: mt7996: do not leave state behind after a failed WED attach
074472e615e9 wifi: mt76: mt7996: reject iTWT setup requests from MLD stations
d1d977d7e82f wifi: mt76: mt7915: fix chainmask handling for non-dbdc phys on band 1
c0af23884432 wifi: mt76: mt7915: report RX chain signal for all RX paths
8baa3813f494 wifi: mt76: mt7915: update SKU power limits after changing antennas
ff7782ac7eac wifi: mt76: mt7915: release hif2 reference on probe IRQ failure
4c9484f83e0c wifi: mt76: mt7915: fix double hif2 init on the non-WED path
755e749c89f6 mt7925: sync with upstream
4d5b3357b934 mt76: remove <6.11 compat code
b9533b83eb21 wifi: mt76: mt7921u: add MT7902 USB support
912c51945059 wifi: mt76: mt7996: fix MIB TX aggregation counter registers for mt7990
69f26dbae7e1 wifi: mt76: mt7996: fix reg addr remap when addr is 0
dabd945ef496 wifi: mt76: mt7915: fix ext PHY use-after-free on register error path
e1f87cf2cf0e wifi: mt76: mt76x2u: Add support for ELECOM WDC-867SU3S
5d68813ec038 wifi: mt76: mt7921: fix lock inversion between dev->mutex and iflist_mtx
699df2cec2e8 wifi: mt76: mt7925: fix lock inversion between dev->mutex and iflist_mtx
8e856ad93d3a wifi: mt76: mt7921: check drv_pmctrl return in the PCIe reset path
4f2aa9910e0c wifi: mt76: mt7925: check drv_pmctrl return in the PCIe reset path
b00b36b602ad wifi: mt76: mt7925: restore the reset state when fw_pmctrl fails
6d1c6a758a4c Revert "wifi: mt76: Disable napi when removing device"
0898393ee0a0 wifi: mt76: use ALTX queue for packets to disassociated stations
62c038aa3e94 wifi: mt76: mt7921: fix the lock inversion in suspend and resume
4d82c9962031 wifi: mt76: mt7925: fix the lock inversion in suspend and resume
0789c43c1a77 wifi: mt76: mt76x02: validate TX-status rate index before mac80211 handoff
bfb044bd24e8 wifi: mt76: mt7925: honour mac80211's FIF_FCSFAIL instead of hardcoding drop_err
a6e5a072ebfd wifi: mt76: mt7921: honour FIF_FCSFAIL instead of hardcoding drop_err
5772439beb0a wifi: mt76: mt7925: restore the legacy BSS after MLO teardown
bd49f06353d7 wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout
d73f61254a79 wifi: mt76: mt7996: unlink TWT flow if the MCU rejects the agreement
a57185c5b64c wifi: mt7915: disable rx napi when removing device
be5ce7910521 wifi: mt76: mt7615: do not tear down BSS/STA state for monitor vifs
Fixes: https://github.com/openwrt/mt76/issues/1109
Signed-off-by: Felix Fietkau <nbd@nbd.name>
FCC ID 2A5LO-VL7M19K
Aka: Tozed Kangwei ZLT W19B6VM
Hardware
--------
SoC: MediaTek MT7988A, 4x Cortex-A73 @ 1.8 GHz
RAM: DDR4, 1 GiB, 4 GiB or 8 GiB depending on the variant sold
(2x ESMT M16U4G16256A on the 1 GiB one used here), sized by
U-Boot which fills in the memory node
FLASH: 256 MiB Winbond W25N02KV SPI-NAND, managed by NMBM
WIFI: MediaTek MT7996 802.11be tri-band (2.4/5/6 GHz), attached to
both 2-lane PCIe interfaces
ETH: 4x 1GbE from the MT7988A built-in switch
2x 10GbE via Realtek RTL8261BE PHYs using USXGMII
USB: 2x USB 3.0 Type-A
BUTTONS: Reset, WPS, Reboot
LEDS: Power, Status (RGB), WLAN 2.4/5/6 GHz, WPS, TEL1 and TEL2
(each red and green), plus dual LEDs on all six RJ-45 sockets
UART: 115200 8N1, unpopulated 3-pin 2.54mm header on the bottom edge
of the board, which stands vertically. The pins are RX, GND, TX,
the middle one carrying no label
POWER: 12 VDC 3 A, barrel connector
Unpopulated on this variant, and hence not described: eMMC, and two
telephony SLICs together with their RJ-12 sockets.
The LEDs of the two 10G RJ-45 sockets are left in the default behaviour
of the RTL8261BE. The PHY driver offers no means of controlling them,
and the part very likely has more LED outputs than the two used per
socket, with neither the selection nor the order of them known, so they
cannot be described in the device tree at this point.
MAC addresses
-------------
+---------+----------------------------+
| | Source |
+---------+----------------------------+
| LAN | Factory 0x4, minus 2 |
| WAN | Factory 0x4, minus 1 |
| WLAN | Factory 0x4, 0xa and 0x2c0 |
+---------+----------------------------+
Only the three WLAN addresses are stored in flash, as part of the MT7996
EEPROM. Both Ethernet addresses are derived from the first of them by
subtraction, which is how the vendor firmware assigns them. Also
matching the vendor firmware, the built-in switch and the 10G LAN port
share the LAN address, so an existing network configuration survives the
switch to OpenWrt.
Bootloader
----------
MediaTek U-Boot using the SDK dual-boot scheme: two sets of UBI volumes,
kernel/rootfs and kernel2/rootfs2, selected by the U-Boot environment
variable dual_boot.current_slot. The environment itself lives in the
u-boot-env UBI volume rather than in a raw MTD partition, which is what
the uboot-envtools entry looks up. U-Boot verifies the kernel FIT and,
separately, a hash over the squashfs which it takes from a top-level
rootfs node of that FIT, falling back to the other slot should either
check fail.
sysupgrade writes both volume sets so that whichever slot the bootloader
selects carries the new firmware, and clears any invalid marker left
behind by an earlier failed boot. The flashing half of that is shared
with netgear,eax17, which uses the same scheme, so it moves into
mtk_dual_boot_flash_both_slots().
Installation
------------
The vendor firmware is itself OpenWrt based and its sysupgrade accepts
the OpenWrt image directly. It is patched to not reboot unless -R is
passed, and it always writes to whichever slot is currently inactive:
sysupgrade -R openwrt-mediatek-filogic-ltc_vl7m19k-squashfs-sysupgrade.bin
The vendor sysupgrade preserves rootfs_data, so run firstboot once
OpenWrt has come up in order to discard the vendor overlay.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The recent update to mac80211 version 7.2 introduced a new module,
ath12k_wifi7.ko, which contains the hardware-specific code (including
the HAL for QCN9274, WCN7850, and QCC2072).
Because this module was not added to the kmod-ath12k package definition,
ath12k failed to probe or initialize PCIe radios since the required
hardware driver was missing.
Add the missing ath12k_wifi7.ko module to the package FILES and ensure
it is loaded alongside ath12k.ko.
Fixes: bf44cb5fb0 ("mac80211: update to version 7.2")
Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://github.com/openwrt/openwrt/pull/24966
Signed-off-by: Robert Marko <robimarko@gmail.com>
Refresh all patches. Drop the ones that are upstream now.
Adapt the ath9k channel bandwidth debugfs patch to the removal of
WIPHY_FLAG_SUPPORTS_5_10_MHZ, and the ath11k QCN6122 hw params to
.max_tx_ring moving into struct ath11k_hw_hal_params as .num_tx_rings.
Add build fixes for mwlwifi and mt76: the action code moved out of the
per-type action frame structs into the common part of struct
ieee80211_mgmt and the union lost its 'u' name,
ieee80211_get_fils_discovery_tmpl() and
ieee80211_get_unsol_bcast_probe_resp_tmpl() take a link id, and the EML
capability defines were renamed.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
In `iw_htmode()`, 40 MHz modes (HE40/EHT40) on the 6 GHz band fell through
to the 5 GHz HT40+/HT40- calculation. Since 802.11n HT modes do not exist
in 6 GHz, `iw` commands like `iw dev <ifname> set freq <freq> HT40+` fail
in cfg80211 with `-EINVAL` (`invalid channel definition`).
Fix this by adding 6 GHz band handling in `iw_htmode()` to calculate and
return the 40 MHz center frequency (`40 <center_freq>`).
Signed-off-by: Alexander Astrovsky <astrouski@google.com>
Link: https://github.com/openwrt/openwrt/pull/24876
Signed-off-by: Robert Marko <robimarko@gmail.com>
The BPi-R4 Pro 8X is a Wi-Fi 7 router board based on the MT7988A SoC.
Specification
-------------
- SoC: Mediatek MT7988A (4x Cortex-A73 @1.8GHz)
- RAM: 8GB DDR4
- Flash: 256MB SPI-NAND, 8GB eMMC, microSD Slot
- Switch: MT7988A built-in switch, MxL86252C
- PHYs: 2x AS21010P
- Ports: 9 ports, 7 usable simultaneously
* 1x 1G RJ45 LAN
* 4x 2.5G RJ45 LAN
* 1x 10G RJ45/SFP Combo
* 1x 10G RJ45/SFP Combo
- Buttons: Reset, WPS
- LEDs: Power
- USB: On-board VIA VL822 USB3.2/USB2.0 hub
* 1x USB-A 2.0 connector
* 1x USB-A 3.2 connector
* 3x NGFF-KEYB
- PCIe:
* 2x mini-PCIe slots with PCIe 3.0 2-lane interface
* 2x M.2 M-Key slots with PCIe 3.0 1-lane interface (switchable
PCIe signal with M.2 B-Key)
- Debug: USB Type-C console port
- Power: USB Type-C PD 20V or DC barrel connector
Note: This device comes without a MAC address programmed from the
factory. The randomly generated MAC is stored in the U-Boot env on first
boot and used persistently afterwards.
Installation
------------
Uncompress *sdcard.img.gz and write to microSD card, eg. using 'dd'. Use
bootloader menu on the serial console to install SPI-NAND once installed
to SPI-NAND you can used the bootloader menu to install to eMMC. See
instructions for BananaPi R4 for details.
Co-authored-by: Frank Wunderlich <frank-w@public-files.de>
Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The BPi R4 Pro 8X can boot from microSD, SPI-NAND and eMMC. Add support
for each storage option.
Co-authored-by: Frank Wunderlich <frank-w@public-files.de>
Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com>
This commit adds support for Askey SBE1V1K.
Device specification
--------------------
SoC: Qualcomm IPQ9570
RAM: Micron (2GB)
Flash: 8GB eMMC
Ethernet: 1x 10G RTL8261BE
1x 2.5G QCA8081
2x 1G QCA8075
Wi-Fi: QCN6214 2.4GHz 4x4
QCN6274 5GHz 4x4
QCN6274 6GHz 4x4
LEDs: 1 LED, power/status
Buttons: 1 reset
USB ports: none
Bootloader: U-Boot 1.0.9 [spf12.2_CSU2] (Jun 28 2024 - 17:47:10 +0000)
Installation (serial required):
**NOTE** This procedure requires glitching the eMMC. It is very possible
that you may damage or corrupt your bootloader in doing so. Proceed with
caution, and always make a full eMMC backup!
**NOTE** If the bootloader has trouble accessing eMMC due to glitching it, any
U-Boot env updates are written directly to the start of flash, overwriting
the bootloader. For this reason, it is strongly NOT recommended to make any
persistent U-Boot env changes from U-Boot itself; do this in Linux.
- Open the chasis and connect to the serial port.
- While booting, short eMMC CLK to UART VCC during FIT image load to enter
U-Boot.
- setenv ipaddr 192.168.1.1
- setenv serverip 192.168.1.2
**NOTE** DO NOT SAVE THE ENV
- Set your PC IP address to 192.168.1.2 and host the initramfs on a tftp
server.
- tftpboot 0x44000000 initramfs.itb
- bootm 0x44000000
If you get an error and it reboots, try loading to 0x80000000.
In the initramfs:
- fw_setenv bootargs 'console=ttyMSM0,115200n8 rootwait root=/dev/mmcblk0p27'
- fw_setenv bootcmd 'echo "Hit ctrl+c for shell..."; if sleep 3; then run do_boot; else do_nothing; fi;'
- fw_setenv do_boot 'mmc read 0x44000000 0x00014022 0x3800; bootm 0x44000000'
- Install a sysupgrade
U-Boot hardcodes the bootargs to reset on each boot, which is why it is
necessary for the bootcmd to override them. Thankfully, the vendor did
not bother to secure U-Boot any further. As long as the vendor software
does not boot, the U-Boot env will stay. If a vendor image boots, the
U-Boot env will revert to default. The vendor U-Boot also ignores
bootdelay, which is why we add a dummy sleep to allow the user time to
drop into a shell without needing to glitch any more.
Co-authored-by: Kenneth Kasilag <kenneth@kasilag.me>
Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21586
Signed-off-by: Robert Marko <robimarko@gmail.com>
In `iw_htmode()`, 40 MHz modes (HE40/EHT40) on the 6 GHz band fell through
to the 5 GHz HT40+/HT40- calculation. Since 802.11n HT modes do not exist
in 6 GHz, `iw` commands like `iw dev <ifname> set freq <freq> HT40+` fail
in cfg80211 with `-EINVAL` (`invalid channel definition`).
Fix this by adding 6 GHz band handling in `iw_htmode()` to calculate and
return the 40 MHz center frequency (`40 <center_freq>`).
Signed-off-by: Alexander Astrovsky <astrouski@google.com>
Link: https://github.com/openwrt/openwrt/pull/24843
Signed-off-by: Robert Marko <robimarko@gmail.com>
CONFIG_LEDS_LP5521 has no corresponding KernelPackage, unlike its
LP55xx siblings (LP5523, LP5562), so the driver could only ever be
built in, never as a module. Add the missing package definition,
mirroring KernelPackage/leds-lp5523.
Signed-off-by: Matt Eaton <git@divinehawk.com>
Link: https://github.com/openwrt/openwrt/pull/24812
Signed-off-by: Robert Marko <robimarko@gmail.com>
A non-AP MLD can pick new affiliated STA addresses for every attempt.
Replies addressed to the MLD MAC address then rely on a stale driver
mapping and never reach the peer.
Add three patches that address Authentication replies to the peer link
address and find MLD stations by link address in the TX status handler.
Refresh the offsets of the following patches.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
phy_dev_open() builds the address pool from the list of hostapd and from a
scan of the wdevs. A configured address appears in neither. macaddr_next()
never returns it, so nothing marks it, and the wdev of its interface exists
only while the interface runs.
start_pending() scans the wdevs once and then starts every interface of the
radio. An interface without a configured address could therefore take the
address of an interface that the same loop configures.
Add the configured addresses of the PHY to the pool. hostapd reserves its
own BSSIDs the same way, in iface_config_macaddr_list().
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The supplicant builds its address pool in phy_dev_open() from the list that
hostapd publishes and from a scan of the wdevs. hostapd published the
addresses of the MLDs and the BSSIDs of one radio.
A link of an AP MLD has no wdev of its own, and the scan of the supplicant
drops a wdev of another radio. The link addresses of the other radios of the
PHY reached the supplicant through neither source. A STA interface could
take one of them, because the sequences of two radios of a PHY overlap.
Publish the list that phy_macaddr_list() builds. hostapd reserves the same
addresses for its own radios, and the supplicant needs them for the same
reason. Both callers run after hostapd assigned the BSSIDs of the
configuration, so the list is complete.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
wdev.uc seeds the address pool of a mesh, adhoc or monitor interface from
config_get_macaddr_list() and from a scan of the wdevs. The call returned
the BSSIDs of one radio, so two kinds of address stayed hidden.
mld_add_bss() assigns the address of an AP MLD when the MLD configuration
arrives. The wdev of the MLD appears later, in bss_check_mld(), during the
first config_set. wdev.uc runs before that call in the setup of a device.
Neither source names the address there, and a new interface could take it.
The BSSIDs of the other radios of the PHY stayed hidden as well. A link of
an MLD has no wdev of its own, so a scan never reports its address.
Return the list that phy_macaddr_list() builds. It holds the addresses of
the MLDs and the BSSIDs of every radio of the PHY. The radio argument loses
its purpose, so drop it.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Aleksei Sviridkin
Shivansh SainiandCursor
Robert Marko
Stanislaw PalandClaude Opus 5
Vladimir Zadirei
Sheikh Faisal
Andrii Kuiukoff
Tucker Kern
Piotr Szczepanik
Michael Lotz
Florian Eckert
Gary Dotzler
Alexander Zaguzin
Tianling Shen
Hideo Sumi
Julius Bairaktaris
David Bauer
Shine- GH
Daniel Golle
Chad Monroe
Felix Fietkau
Frank Wunderlich
Erik Larsson
Til Kaiser
Peter Polonec
Alexander Astrovsky
Andrew LaMarcheandFrank Wunderlich
Fengyu Wu
Matt Eaton