The APEX boot loader embeds the time of the build in its version
banner, which makes the Iomega NAS100D factory image differ between
builds:
-compiled for OpenWrt NAS100D/BE on 2026.Sep.23-04:17:21
+compiled for OpenWrt NAS100D/BE on 2026.Sep.23-11:06:03
APEX sets BUILDDATE with $(shell date) in its top level Makefile. Pass
BUILDDATE on the command line, formatted from SOURCE_DATE_EPOCH in UTC
and the C locale, which overrides it for all sub-makes.
Link: https://github.com/openwrt/openwrt/pull/25354
Signed-off-by: Paul Spooren <mail@aparcar.org>
Use mainline U-Boot with pending patches for LAN969x instead of the
old vendor U-Boot.
Both existing boards are supported.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Currently, we depend on building the host Ruby support just for the two
FWU scripts that are written in Ruby.
Use Codex 5.6 to convert the scripts to Python and drop Ruby dependency.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
u-boot 2013.10 builds timestamp_autogenerated.h with a bare date call, so
U_BOOT_DATE and U_BOOT_TIME hold the wall clock and the banner of every
image changes on each build:
U-Boot 2013.10-openwrt4 (Sep 21 2026 - 20:47:50) ARV7506PW11
Add a patch that uses SOURCE_DATE_EPOCH when the environment provides it,
which the build already exports, and keeps the wall clock otherwise. Later
u-boot versions do the same in their own timestamp rule, which is why only
this package needs the change.
Found with two lantiq/xway trees whose directory names differ in length.
Three bytes of u-boot.bin differed, all inside the banner. After the
change the three u-boot images of arv7506pw11 are identical in both trees
and the banner follows the source date.
Signed-off-by: John Crispin <john@phrozen.org>
mtk_image_set_mt7621_header() reads the wall clock and writes it to the
timestamp of the legacy image header, so the MT7621 boot loader image
differs on every build.
Add a patch that uses imagetool_get_source_date(), which the other image
tools already use, and keep the wall clock as the fallback.
Signed-off-by: John Crispin <john@phrozen.org>
mkimage -T mxsimage builds u-boot.sb. sb_get_timestamp() reads the wall
clock and sb_prefill_image_header() writes it to the boot image header.
The header digest covers that field, so the sdcard images of mxs differ on
every build.
Add a patch that uses imagetool_get_source_date(), which the other image
tools already use, and keep the wall clock as the fallback.
Tested with the mxsimage configuration of u-boot. Two images are identical
with the same SOURCE_DATE_EPOCH, differ with different values, and still
differ when the variable is not set.
Signed-off-by: John Crispin <john@phrozen.org>
The variants of arm-trusted-firmware-mediatek and uboot-mediatek only
write to their own build directories and to files in the staging and
bin directories that have the variant in their name.
For the OpenWrt One, a clean build of the 9 TF-A variants takes 2 s
instead of 11 s, and of the 2 U-Boot variants 12 s instead of 21 s.
The images do not change.
Signed-off-by: John Crispin <john@phrozen.org>
With FIP_COMPRESS set, the fip step compresses the BL31 image next to
the original in the staging directory. All U-Boot variants for the same
SoC, boot device and DRAM type write the same file.
Write the compressed BL31 to the build directory of the variant instead.
The fip does not change.
Signed-off-by: John Crispin <john@phrozen.org>
/etc/uci-defaults/30_uboot-envtools runs in preinit, before the board
file is generated. Two of its helpers write to the console:
* uci batch prints the name of every anonymous section that "add"
creates, and nothing redirects stdout.
* grep -q hides a match, but it still reports a file that does not
exist. /etc/fw_env.config is absent until the first append creates it.
On the first boot after a flash this puts three lines on the console:
cfg016cb7
cfg026cb7
grep: /etc/fw_env.config: No such file or directory
Redirect the batch output and add -s to the grep.
Signed-off-by: John Crispin <john@phrozen.org>
The fip contains BL31 from trusted-firmware-a, but the U-Boot build does
not depend on it. After a rebuild of trusted-firmware-a, the fip and the
images that contain it keep the old BL31.
Make the build stamp depend on the BL31 image.
Signed-off-by: John Crispin <john@phrozen.org>
Resolve the production partition through fit.sh so the generated
environment configuration uses the actual MMC block device.
Migrate legacy /dev/p1 device fields in place while preserving custom
geometry, additional entries, and unrelated configurations.
Fixes: de2df0f2c5 ("base-files: remove fitblk_get_bootdev() from /lib/upgrade/common.sh")
Signed-off-by: Stefan Reisinger <dev@stefan-reisinger.at>
Link: https://github.com/openwrt/openwrt/pull/25197
Signed-off-by: Robert Marko <robimarko@gmail.com>
This adds support for an i.MX8-based system-on-module + EVB board.
CPU: NXP i.MX8MP @ 1600MHz (quad-core A53)
Memory: 4Gb
PCI: 1x PCIe M.2 2280 slot
Ethernet: 2x GE with Micrel PHY (no MAC in EEPROM)
USB: 2x 3.0
UART: separate UARTs for the A53 and the M7 cores
Storage: microSD slot, eMMC headers
Misc: 2KByte EEPROM (at24), audio via ES8328 (unsupported), 2x CAN, HDMI
Power: 5VDC
- Patches refreshed as required
- The cortexa53 subtarget selects Micrel PHY from now on
- u-boot added for the board
Installation:
Use the standard installation to an SD-card by writing out the
squashfs image (openwrt-imx-cortexa53-olimex_imx8mp-som-squashfs-img.gz)
to it.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
Compile-tested: all mxs boards
Runtime-tested: Olinuxino Micro, I2SE Duckbill
While at it, rework the Duckbill series to compile on 2026.04.
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
Since the bump to 2026.04, tools/Kconfig defaults TOOLS_MKEFICAPSULE to
y whenever EFI_LOADER is set, which the Zynq configs enable. The host
tool includes <gnutls/gnutls.h>, which the build system does not
provide, so the package fails to compile. Disable the tool, as the
other U-Boot packages carrying an EFI_LOADER config already do.
Fixes: d51c611e71 ("uboot-zynq: bump to 2026.04")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Since the bump to 2026.04, tools/Kconfig defaults TOOLS_MKEFICAPSULE to
y whenever EFI_LOADER is set, which both SiFive configs enable. The host
tool includes <gnutls/gnutls.h>, which the build system does not provide,
so the package fails to compile. Disable the tool, as the other U-Boot
packages carrying an EFI_LOADER config already do.
Fixes: 5b2c9ce8bf ("uboot-sifiveu: bump to 2026.04")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
No test on this hardware, but the same community U-Boot source that
confirms the Livinet Li320 wiring carries this board too, with
support_quad set on the controller and the same typo in its own DTS.
Yuzhii0718/bl-mt798x-dhcpd, uboot-mtk-20250711/arch/arm/dts/mediatek/
openwrt/mt7986b-zyxel_wx5600-t0.dts.
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/24809
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
The node already sets support_quad on the controller; the misspelling
was keeping the bootloader's flash access at 1-bit regardless.
The package had no PKG_RELEASE, so this adds one to rebuild the
bootloader for the boards that carry these patches.
Tested-by: Andrew Sim <andrewsimz@gmail.com>
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://github.com/openwrt/openwrt/pull/24809
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
TP-Link Archer AX55 v1 is an IPQ5018 Wi-Fi 6 router.
Hardware:
SoC: Qualcomm IPQ5018 (dual Cortex-A53)
RAM: 512 MiB
Flash: 128 MiB SPI-NAND (dual firmware slots)
Switch: Realtek RTL8367S (5x GbE), 2.5G HSGMII trunk to gmac1
WiFi: IPQ5018 2.4 GHz + QCN6122 5 GHz (ath11k)
USB: 1x USB 3.0 port, SuperSpeed, using the IPQ5018 SS uni PHY;
the port's 5 V rail is a GPIO-switched regulator wired as the
PHY's vdd-supply, the way the MR5500 does it
Button: Reset, WPS/Wi-Fi
LED: power, LAN, WAN (green/orange), 2.4G, 5G, USB
All five front jacks are RTL8367S ports (DSA): blue "WAN" = wan,
LAN1-4 = lan1..lan4, over the 2.5G HSGMII trunk.
The factory MAC is the "default-mac" file in the tp_data UBIFS volume
(there is no raw nvmem cell for it). The volume is attached and mounted
read-only during preinit, so board.d assigns the wired MACs (label MAC
for lan/eth0, +1 for wan) the usual way and the ath11k caldata hotplug
derives the Wi-Fi MACs (+2/+3) from the same mount - the same scheme
the mt7981 archer-ax80-v1 uses for its tp_data. gmac1 has no nvmem MAC
source, so the DSA conduit is pinned to the label MAC in board.d to
keep it stable across boots.
The board data files live in firmware_qca-wireless, where they were
merged as f2c37a6b9d1d; this commit pins the ipq-wifi package to that
revision and adds the package entry for the board.
Note on revisions: some units labelled "v1" carry an RTL8367D-family
switch (chip id 0x6642) instead of the RTL8367S. rtl8365mb cleanly
declines it ("unrecognized switch"), so such a unit boots with no wired
ports, and with Wi-Fi off by default it is only reachable via the
vendor web recovery (or serial). RTL8367D support in rtl8365mb is being
worked on by others; until it lands the wiki page carries a prominent
warning to identify the switch before flashing. v2/v4 are entirely
different hardware and are not covered by this image.
Installation (serial console on the JP1 header, 115200 8N1, 1.8 V; note
the RX trace is gapped and must be bridged to type): interrupt U-Boot,
TFTP-boot the initramfs image to 0x44000000, "bootm", then "sysupgrade -n".
A serial-free path (a telnet-enabled resigned stock image flashed from the
vendor web UI, then writing the OpenWrt image to the inactive slot) is
documented on the device wiki page; that path consumes the
initramfs-factory.ubi artifact, which is the initramfs kernel wrapped in
a UBI image so it can be written straight into the inactive rootfs
partition with mtd from the running stock firmware.
Recovery to stock: hold Reset while powering on, set the PC to
192.168.0.10, and upload an official signed TP-Link image at
http://192.168.0.1.
Signed-off-by: Stanislaw Pal <kuncy7@gmail.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Link: https://github.com/openwrt/openwrt/pull/24197
Signed-off-by: Robert Marko <robimarko@gmail.com>
| Component | Details |
|------------------|------------------------------------------------|
| **SoC** | MediaTek MT7986A (4× ARM Cortex-A53 @ 2.0 GHz) |
| **RAM** | 512 MB |
| **Flash** | 256 MB NAND |
| **Ethernet** | 5× 10/100/1000 Mbps (1 WAN + 4 LAN) |
| **WLAN 2.4 GHz** | MediaTek MT7976GN — 802.11b/g/n/ax, 4×4 MIMO |
| **WLAN 5 GHz** | MediaTek MT7976AN — 802.11n/ac/ax, 4×4 MIMO |
| **LEDs** | 1× RGB LED (GPIO-controlled) |
| **Button** | 1× Reset |
| **USB** | Yes |
**MAC Addresses:**
| Interface | Source |
|------------|-------------------------------------------------|
| WAN/Label | MFG MTD partition (variant-specific fallback) |
| LAN | WAN + 1 |
| 2.4 GHz | WAN + 2 |
| 5 GHz | WAN + 3 |
Supported variants and MAC source:
- JIDU6J01,JIDU6201: binary at offset 0x00
- JIDU6401: binary at offset 0x20
- JIDU6601: ASCII text at offset 0x1d0
- JIDU6701: ASCII mac= key
---
**1. Extracting U-Boot Credentials**
The U-Boot username and password are stored in the `MFG` partition. To retrieve them:
- With root access on stock OS: Read directly from the MFG partition.
- Without root access: Dump the NAND flash first, then extract the credentials from the dump.
**2. Prepare TFTP server**
- Set a static IP on the ethernet interface of your computer
(e.g. default: ip `192.168.1.2`, gateway `192.168.1.1`).
- Download the initramfs image and host it with the TFTP server.
**3. Interrupt boot**
Attach UART and power on the router. When the boot menu appears, select **Failsafe Mode**,
then press `Ctrl-C` to interrupt and enter the credentials extracted from `MFG` partition.
**4. Load and run initramfs image**
```sh
setenv ipaddr 192.168.1.1
setenv serverip 192.168.1.2
tftpboot 0x46000000 openwrt-mediatek-filogic-jiorouter_ax6000-jidu6j01-initramfs-kernel.bin
fdt addr $(fdtcontroladdr)
fdt rm /signature
bootm
```
**5. Flash sysupgrade image**
Place the sysupgrade image in `/tmp`, then run:
```sh
sysupgrade /tmp/openwrt-mediatek-filogic-jiorouter_ax6000-jidu6j01-squashfs-sysupgrade.bin
```
Alternatively, use the sysupgrade option in LuCI.
Signed-off-by: Sheikh Faisal <sheikhfaisal713@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23510
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
Correct the U-Boot env geometry from "0x80000" "1" to "0x1f000" "5".
The correct LEB size for 128k PEB / 2k page is 0x1f000, and the 0x80000 volume spans 5 LEBs.
This also hardens jiorouter_initial_setup by adding proper error handling
and dynamic UBI device/volume lookups, and generates /etc/fw_env.config to be consistent.
Signed-off-by: Sheikh Faisal <sheikhfaisal713@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23510
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
Add the CMCC RAX3000M(e) UBI-enabled U-Boot target for both DDR3 and DDR4 builds.
Refactor the CMCC RAX3000M(e) device trees.
The board-specific DTS variants for eMMC, NAND, and UBI now
inherit the common setup while overriding the required
flash configuration and partitions.
This keeps the common MT7981 wiring centralized and
makes each RAX3000M variant explicit and maintainable.
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24575
Signed-off-by: Jonas Jelonek <jonas@jonasjelonek.de>
Netgear RBx850 are tri band, 2.4GHz and 2x 5GHz, 12 stream 802.11ax mesh
devices from the Orbi series. The RBR850 is a router with a 2.5GbE WAN and
4 1GbE LAN ports. The RBS850 is a satellite without WAN port and half the
flash. The hardware is otherwise identical. They were sold in kits as
RBK852-RBK855, with one router and 1-4 satellites.
The RBx850 are substantially similar to the RBx750 so this commit factors
out a common DTS, flash script and build definition.
Hardware:
* SoC: Qualcomm IPQ8074
* RAM: 1GiB 2x Samsung 4A4G165WE-BCRC
* Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ
* WLAN 2.4GHz: QCN5024 4x4:4 b/g/n/ax
* WLAN 5GHz Low Band: QCN5054 4x4:4 a/n/ac/ax 5180-5320MHz
* WLAN 5GHz High Band: QCN5054 4x4:4 a/n/ac/ax 5500-5700MHz
* Ethernet: 4x 1GbE LAN, 1x 2.5GbE WAN on RBR850
* Serial Config: 3.3V TTL 115200-8-N-1, internal populated header
* Serial Layout: Bottom <- RX, TX, GND, 3.3V (don't connect) -> Top
* LEDs: green/red power, white/red/green/blue status
* Buttons: 1x Reset, 1x WPS
MAC addresses:
LAN1: Label
LAN2: Label + 1
LAN3: Label + 2
LAN4: Label + 3
WAN: Label + 1
2.4GHz: Label + 2 (RBR) or 1 (RBS)
5GHz-Low: Label + 3 (RBR) or 2 (RBS)
5GHz-High: Label + 4 (RBR) or 3 (RBS)
Flashing Notes:
The stock firmware images are signed. Both the bootloader and the stock
web interface check the signature and will fail to boot/flash.
The bootloader automatically does NMRP when a gigabit LAN connection is
present. The stock and factory images contain a U-Boot script that is
executed when flashing using NMRP. This is used to alter and persist the
U-Boot env with a boot command that works with unsigned firmware.
Install OpenWrt:
* Get the nmrpflash utility [0] and OpenWrt factory image
* Find network interface to use: nmrpflash -L
* Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
* Connect one of the device LAN ports to the same network using gigabit
* Plug the device in and wait for the bootloader to flash
* Unplug and replug the device once the power LED on the back blinks amber
Revert to Stock:
The boot command needs to be reverted before flashing the stock firmware,
otherwise it will fail to boot and get stuck in recovery mode (red power
LED flashing).
* Still in OpenWrt run: fw_setenv bootcmd bootipq
* Restart the device
* Flash the stock firmware RBx850-Va.b.c.d.img using nmrpflash
[0]: https://github.com/jclehner/nmrpflash
Authored by Michael Lotz.
Piotr Szczepanik:
* Cherry-picked the RBx850 support commit from openwrt/openwrt#22159
and adapted it to current main.
* Reworked the DTS networking changes for the current qualcommax
ipq807x device-tree style.
* Verified the RBx750 DTS split preserves the existing RBx750-specific
layout while moving shared RBx750/RBx850 nodes into a common DTSI.
Signed-off-by: Michael Lotz <mmlr@mlotz.ch>
Signed-off-by: Piotr Szczepanik <piter75@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24906
Signed-off-by: Robert Marko <robimarko@gmail.com>
Uboot-Envtools is installed by default on the mpc85xx target.
Add the proper configuration for the Sophos RED 15w, so the fw_*env
commands will actually work.
Fix alphabetic sorting in the case statement while we're at it.
Signed-off-by: Shine- GH <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/24939
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Common specifications:
* MediaTek MT7987A (4x Cortex-A53)
* 4 GiB eMMC
* 1 GiB DDR4 RAM
* 1x 2500M/1000M/100M/10M WAN port (MaxLinear MXL86211C PHY)
* 2x 2500M/1000M/100M/10M LAN ports (MaxLinear MXL86211C PHY,
MT7987 built-in 2.5G PHY)
* 3x LED (green/amber/white) for each Ethernet port
* 2 buttons (Reset, Mesh/WPS)
* uC-controlled RGB LED via I2C
* USB 2.0 type A port
* 3.3V-level 115200 baud UART console
* 12V 3A DC barrel jack power input
SDG-8712: MT7992 dual-band 802.11be Wi-Fi (2.4G 4T4R, 5G 4T5R)
SDG-8732: MT7996 tri-band 802.11be Wi-Fi (2.4G 2T2R, 5G 3T3R, 6G 3T3R)
MAC addresses (base MFG_MAC from the mfginfo partition; the nvmem
cell index in the DTS is added to the base):
wan xx:xx:xx:xx:xx:x0 MFG_MAC
lan1 xx:xx:xx:xx:xx:x1 MFG_MAC + 0x1
lan2 xx:xx:xx:xx:xx:x1 MFG_MAC + 0x1
2.4G xx:xx:xx:xx:xx:x4 MFG_MAC + 0x4
5G xx:xx:xx:xx:xx:xa MFG_MAC + 0xa
6G xx:xx:xx:xx:xx:x6 MFG_MAC + 0x6 (SDG-8732 only)
Both models are also available in versions including 1x FXS POTS
interface for analog phones. Those interfaces are not supported by
OpenWrt.
Installation:
1. Prepare a TFTP server at 192.168.1.10 and serve the OpenWrt
initramfs image, renamed to "openwrt.<engnum>" for the model
being installed:
openwrt.440: SDG-8712
openwrt.442: SDG-8732
2. Connect to LAN2.
3. Connect to the UART port.
4. Power on the device and type "st" to enter the U-Boot command
line. The window to do that might be very short (below 1s), so
type it as soon as the "U-Boot ..." string appears.
5. Run "setenv boot_mode openwrt; saveenv" to boot from OpenWrt
partition by default.
6. Run "bootmenu" and select option 6 (TFTP openwrt image and
boot); "run boot5" is a shortcut for the same. This downloads
openwrt.<engnum> from the TFTP server and boots it.
7. After OpenWrt finishes booting, download the OpenWrt sysupgrade
image and write it to eMMC using "sysupgrade".
8. After sysupgrade finishes writing, the device reboots into
OpenWrt. When the front LED is solid white the device is ready
for configuration.
Signed-off-by: Chad Monroe <chad@monroe.io>
Link: https://github.com/openwrt/openwrt/pull/24679
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add the two external Aeonsemi AS21xxx PHYs used by the LAN and WAN
10GBASE-T ports of the BPI-R4 Pro 8x. Configure their firmware, reset
timing and LEDs, and connect them to the MxL switch and GMAC1.
Replace the fixed SFP GPIO hog configuration with LAN and WAN overlays
selecting either the copper PHY or the corresponding SFP cage. Build all
four overlays, include them in the device image and select the SFP
overlays by default through U-Boot `bootconf_extra`.
Make the AS21xxx firmware package pull in the PHY driver on Linux 6.18,
instead of making the driver depend on the firmware. Update existing
Airoha device package lists accordingly so they continue to install both
components through the firmware package.
Breaking change for users using the router with SFP hogs from PR #21083.
After flashing the new image, configure `bootconf_extra` to select
between SFP or PHY overlays:
fw_setenv bootconf_extra \
mt7988a-bananapi-bpi-r4-pro-8x-lan-phy#mt7988a-bananapi-bpi-r4-pro-8x-wan-phy
If bootconf_extra had additional overlays (CN13 or CN14) keep them appended
Signed-off-by: Pietro Ameruoso <p.ameruoso@live.it>
Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
FCC ID 2A5LO-VL7M19K
Aka: Tozed Kangwei ZLT W19B6VM
Hardware
--------
SoC: MediaTek MT7988A, 4x Cortex-A73 @ 1.8 GHz
RAM: DDR4, 1 GiB, 4 GiB or 8 GiB depending on the variant sold
(2x ESMT M16U4G16256A on the 1 GiB one used here), sized by
U-Boot which fills in the memory node
FLASH: 256 MiB Winbond W25N02KV SPI-NAND, managed by NMBM
WIFI: MediaTek MT7996 802.11be tri-band (2.4/5/6 GHz), attached to
both 2-lane PCIe interfaces
ETH: 4x 1GbE from the MT7988A built-in switch
2x 10GbE via Realtek RTL8261BE PHYs using USXGMII
USB: 2x USB 3.0 Type-A
BUTTONS: Reset, WPS, Reboot
LEDS: Power, Status (RGB), WLAN 2.4/5/6 GHz, WPS, TEL1 and TEL2
(each red and green), plus dual LEDs on all six RJ-45 sockets
UART: 115200 8N1, unpopulated 3-pin 2.54mm header on the bottom edge
of the board, which stands vertically. The pins are RX, GND, TX,
the middle one carrying no label
POWER: 12 VDC 3 A, barrel connector
Unpopulated on this variant, and hence not described: eMMC, and two
telephony SLICs together with their RJ-12 sockets.
The LEDs of the two 10G RJ-45 sockets are left in the default behaviour
of the RTL8261BE. The PHY driver offers no means of controlling them,
and the part very likely has more LED outputs than the two used per
socket, with neither the selection nor the order of them known, so they
cannot be described in the device tree at this point.
MAC addresses
-------------
+---------+----------------------------+
| | Source |
+---------+----------------------------+
| LAN | Factory 0x4, minus 2 |
| WAN | Factory 0x4, minus 1 |
| WLAN | Factory 0x4, 0xa and 0x2c0 |
+---------+----------------------------+
Only the three WLAN addresses are stored in flash, as part of the MT7996
EEPROM. Both Ethernet addresses are derived from the first of them by
subtraction, which is how the vendor firmware assigns them. Also
matching the vendor firmware, the built-in switch and the 10G LAN port
share the LAN address, so an existing network configuration survives the
switch to OpenWrt.
Bootloader
----------
MediaTek U-Boot using the SDK dual-boot scheme: two sets of UBI volumes,
kernel/rootfs and kernel2/rootfs2, selected by the U-Boot environment
variable dual_boot.current_slot. The environment itself lives in the
u-boot-env UBI volume rather than in a raw MTD partition, which is what
the uboot-envtools entry looks up. U-Boot verifies the kernel FIT and,
separately, a hash over the squashfs which it takes from a top-level
rootfs node of that FIT, falling back to the other slot should either
check fail.
sysupgrade writes both volume sets so that whichever slot the bootloader
selects carries the new firmware, and clears any invalid marker left
behind by an earlier failed boot. The flashing half of that is shared
with netgear,eax17, which uses the same scheme, so it moves into
mtk_dual_boot_flash_both_slots().
Installation
------------
The vendor firmware is itself OpenWrt based and its sysupgrade accepts
the OpenWrt image directly. It is patched to not reboot unless -R is
passed, and it always writes to whichever slot is currently inactive:
sysupgrade -R openwrt-mediatek-filogic-ltc_vl7m19k-squashfs-sysupgrade.bin
The vendor sysupgrade preserves rootfs_data, so run firstboot once
OpenWrt has come up in order to discard the vendor overlay.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The BPi-R4 Pro 8X is a Wi-Fi 7 router board based on the MT7988A SoC.
Specification
-------------
- SoC: Mediatek MT7988A (4x Cortex-A73 @1.8GHz)
- RAM: 8GB DDR4
- Flash: 256MB SPI-NAND, 8GB eMMC, microSD Slot
- Switch: MT7988A built-in switch, MxL86252C
- PHYs: 2x AS21010P
- Ports: 9 ports, 7 usable simultaneously
* 1x 1G RJ45 LAN
* 4x 2.5G RJ45 LAN
* 1x 10G RJ45/SFP Combo
* 1x 10G RJ45/SFP Combo
- Buttons: Reset, WPS
- LEDs: Power
- USB: On-board VIA VL822 USB3.2/USB2.0 hub
* 1x USB-A 2.0 connector
* 1x USB-A 3.2 connector
* 3x NGFF-KEYB
- PCIe:
* 2x mini-PCIe slots with PCIe 3.0 2-lane interface
* 2x M.2 M-Key slots with PCIe 3.0 1-lane interface (switchable
PCIe signal with M.2 B-Key)
- Debug: USB Type-C console port
- Power: USB Type-C PD 20V or DC barrel connector
Note: This device comes without a MAC address programmed from the
factory. The randomly generated MAC is stored in the U-Boot env on first
boot and used persistently afterwards.
Installation
------------
Uncompress *sdcard.img.gz and write to microSD card, eg. using 'dd'. Use
bootloader menu on the serial console to install SPI-NAND once installed
to SPI-NAND you can used the bootloader menu to install to eMMC. See
instructions for BananaPi R4 for details.
Co-authored-by: Frank Wunderlich <frank-w@public-files.de>
Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The BPi R4 Pro 8X can boot from microSD, SPI-NAND and eMMC. Add support
for each storage option.
Co-authored-by: Frank Wunderlich <frank-w@public-files.de>
Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com>
This commit adds support for Askey SBE1V1K.
Device specification
--------------------
SoC: Qualcomm IPQ9570
RAM: Micron (2GB)
Flash: 8GB eMMC
Ethernet: 1x 10G RTL8261BE
1x 2.5G QCA8081
2x 1G QCA8075
Wi-Fi: QCN6214 2.4GHz 4x4
QCN6274 5GHz 4x4
QCN6274 6GHz 4x4
LEDs: 1 LED, power/status
Buttons: 1 reset
USB ports: none
Bootloader: U-Boot 1.0.9 [spf12.2_CSU2] (Jun 28 2024 - 17:47:10 +0000)
Installation (serial required):
**NOTE** This procedure requires glitching the eMMC. It is very possible
that you may damage or corrupt your bootloader in doing so. Proceed with
caution, and always make a full eMMC backup!
**NOTE** If the bootloader has trouble accessing eMMC due to glitching it, any
U-Boot env updates are written directly to the start of flash, overwriting
the bootloader. For this reason, it is strongly NOT recommended to make any
persistent U-Boot env changes from U-Boot itself; do this in Linux.
- Open the chasis and connect to the serial port.
- While booting, short eMMC CLK to UART VCC during FIT image load to enter
U-Boot.
- setenv ipaddr 192.168.1.1
- setenv serverip 192.168.1.2
**NOTE** DO NOT SAVE THE ENV
- Set your PC IP address to 192.168.1.2 and host the initramfs on a tftp
server.
- tftpboot 0x44000000 initramfs.itb
- bootm 0x44000000
If you get an error and it reboots, try loading to 0x80000000.
In the initramfs:
- fw_setenv bootargs 'console=ttyMSM0,115200n8 rootwait root=/dev/mmcblk0p27'
- fw_setenv bootcmd 'echo "Hit ctrl+c for shell..."; if sleep 3; then run do_boot; else do_nothing; fi;'
- fw_setenv do_boot 'mmc read 0x44000000 0x00014022 0x3800; bootm 0x44000000'
- Install a sysupgrade
U-Boot hardcodes the bootargs to reset on each boot, which is why it is
necessary for the bootcmd to override them. Thankfully, the vendor did
not bother to secure U-Boot any further. As long as the vendor software
does not boot, the U-Boot env will stay. If a vendor image boots, the
U-Boot env will revert to default. The vendor U-Boot also ignores
bootdelay, which is why we add a dummy sleep to allow the user time to
drop into a shell without needing to glitch any more.
Co-authored-by: Kenneth Kasilag <kenneth@kasilag.me>
Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/21586
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds OpenWrt U-Boot (UBI) layout support for MERCUSYS MR85X.
Stock bootloader UBI size: 50 MiB
OpenWrt U-Boot UBI size: 127 MiB
Other changes
-------------
- Watchdog is enabled for the both layouts
- Button labels renamed according to the kernel documentation
Preparation
-----------
OpenWrt for stock U-Boot should be installed first. Before formatting or
rewriting any partition structures, you must copy EEPROM data and unique
MAC address. Navigate to the /tmp/tp_data directory on the router. Locate
and copy these files to your PC:
- default-mac (contains your device's unique MAC address mapping)
- MT7981_EEPROM.bin (contains factory wireless calibration data)
Installation
------------
1. Initialize the Hardware Environment
Power off the router. Run the mtk_uartboot utility on your computer. Power
on the router. Wait for the utility to push the initial payload, boot the
device temporarily and format the UBI partition structure.
2. Access the U-Boot Promp
Run mtk_uartboot on your computer a second time. When the utility menu
appears on your terminal screen, choose Exit. This will drop you safely
into the interactive U-Boot command line interface prompt (MT7981>).
3. Flash the BL2 (preloader)
You must write the second-stage bootloader (BL2) directly to the MTD
partition. Prepare the router to receive the BL2 image over serial Ymodem
protocol:
MT7981> loady
In your terminal application, select File -> Transfer -> Ymodem -> Send
and select the path to:
openwrt-mediatek-filogic-mercusys_mr85x-ubi-preloader.bin
Erase the existing BL2 partition:
MT7981> mtd erase bl2
Commit the new BL2 binary from RAM to the flash memory:
MT7981> mtd write bl2 $loadaddr 0x0 ${filesize}
4. Provision the FIP Partition (BL31 & U-Boot)
Ready the router to receive the FIP package:
MT7981> loady
In your terminal application, send the following file via Ymodem:
openwrt-mediatek-filogic-mercusys_mr85x-ubi-bl31-uboot.fip
Clear the legacy tracking data and configure the UBI block allocation:
MT7981> ubi write $loadaddr fip ${filesize}
5. Boot into OpenWrt Recovery
With the core partition structures and boot code firmly written, you can
now push and execute the temporary OpenWrt recovery environment to finish
the installation. Prepare for the final serial download:
MT7981> loady
Send the following recovery image file via Ymodem:
openwrt-mediatek-filogic-mercusys_mr85x-ubi-initramfs-recovery.itb
Boot the OpenWrt kernel image directly out of the memory cache:
MT7981> bootm
6. Flash OpenWrt permanently
Once the router finishes booting the initramfs image, navigate to
192.168.1.1 in your web browser to access the OpenWrt LuCI recovery
interface. From there, permanently flash the production sysupgrade image.
7. Recovery factory data
Once the router finishes booting into OpenWrt, you must rebuild and flash
the factory volume payload. This process combines your unique wireless
calibration data and MAC address back into a single compliant block.
Use SCP or an SFTP client (like WinSCP) to copy your two backup files from
your PC into the router's /tmp directory:
- default-mac
- MT7981_EEPROM.bin
Connect to the router via SSH and run the following commands:
dd if=/dev/zero bs=$((0x8000)) count=1 | tr '\000' '\377' > /tmp/factory.bin
dd if=/tmp/MT7981_EEPROM.bin of=/tmp/factory.bin conv=notrunc
dd if=/tmp/default-mac >> /tmp/factory.bin
Query the system to confirm the exact logical UBI character device target
for the factory volume:
ubinfo /dev/ubi0 -N factory | grep "Volume ID" | awk '{print $3}'
Commit the newly created factory.bin file directly into the designated
factory UBI block (replace _1 below if your volume ID query returned a
different number):
ubiupdatevol /dev/ubi0_1 /tmp/factory.bin
Reboot your router to apply the changes.
Recovery
--------
The same as installation.
UART
----
Connection parameters: 115200, 8N1, 3.3V
UART pins are silkscreened on the PCB.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| label | 08:xx:xx:xx:xx:f5 | label |
| LAN | 08:xx:xx:xx:xx:f5 | label |
| WAN | 08:xx:xx:xx:xx:f6 | label+1 |
| WLAN 2g | 08:xx:xx:xx:xx:f5 | label |
| WLAN 5g | 08:xx:xx:xx:xx:f4 | label-1 |
+---------+-------------------+-----------+
label MAC address was found in UBI partition "tp_data", file
"default-mac" (raw binary MAC). Proof:
hexdump -C default-mac
00000000 08 xx xx xx xx f5 |....Y.|
00000006
OEM wireless eeprom is also there (file
"MT7981_EEPROM.bin").
Link: https://github.com/981213/mtk_uartboot
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24435
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Introduce initial board support for the Mercusys MR85X, an AX3000
wireless router powered by the MediaTek MT7981 (Filogic 820) SoC.
Networking Configuration Note
-----------------------------
Ethernet functionality is currently disabled in this stage of U-Boot
due to the specific board configuration:
1. The Realtek RTL8367S switch does not have an available U-Boot driver
2. The Airoha EN8811 PHY is physically routed to GMAC1 rather than the
standard GMAC0 pipeline. This requires further adjustment to bind and
trace MDIO/PHY operations over GMAC1.
ToDo
----
I have successfully integrated the Realtek switch driver (taken from
D-Link DIR-X3260 GPL sources.
Link: https://github.com/hsj79/dir-x3260-gplcode/
Everything is working perfectly and users can operate the device without
any issues. TFTP flashing (FIP, preloader, recovery images) works
flawlessly across both cold and warm boot cycles with stable speeds
around 6.5 MiB/s.
Why it's not ready for upstream OpenWrt yet:
- Patch Size: The included Realtek SDK files are massive (approximately
3 MB), which is way too large for a standard OpenWrt package patch
- Code Optimization: The implementation is currently a functional
workaround and requires significant refactoring, cleanup and optimization
to match official OpenWrt submission standards
Patches and ready-to-use binaries
Link: https://github.com/csharper2005/uboot-mediatek-rtl8367s/
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24435
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
TP-Link EAP620HD V2 is a 802.11ax AP claiming AX1800 support.
Specifications:
CPU: Qualcomm IPQ6018 Quad core Cortex-A53
RAM: 1 GB
Storage: ESMT PSR1GA30DT 128MB NAND
Ethernet:
Gigabit RJ45 port with PoE input
WLAN:
2.4GHz/5GHz
LEDs:
Single-color LED (Blue)
Buttons:
1x Reset
UART: 4-pin unpopulated header
1.8 V level, Pinout 1 - TX, 2 - RX, 3 - GND, 4 - 1.8V
Installation:
Web UI method
Set up the device using the vendor's web UI. After that go to
Management->SSH and enable the "SSH Login" checkbox. Select "Save".
The connect to the machine via SSH:
ssh -o hostkeyalgorithms=ssh-rsa <ip_of_device>
Disable signature verification:
cliclientd stopcs
Rename the "-web-ui-factory" image to something less than 63
characters, maintaining the ".bin" suffix.
Go to System -> Firmware Update.
Under "New Firmware File", click "Browse" and select the image
Select "Update" and confirm by clicking "OK".
If the update fails, the web UI should show an error message.
Otherwise, the device should reboot into OpenWRT.
TFTP method
To flash via tftp, first place the initramfs image on the TFTP server.
setenv serverip <ip of tftp server>
setenv ipaddr <ip in same subnet as tftp server>
tftpboot tplink_eap620-hd-v2-initramfs-uImage.itb
bootm
This should boot OpenWRT. Once booted, flash the sysupgrade.bin image
using either luci or the commandline.
Big thanks to @mrnuke for the groundwork and support.
Signed-off-by: Ryan S <rspierz@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/18227
Signed-off-by: Robert Marko <robimarko@gmail.com>
Support for Ubiquiti UniFi Travel Router
SoC: IPQ4018
DRAM: 256 MB
NAND: Macronix MX35LFxGE4AB 128 MiB
NOR: MX25L3205D 4 MiB
ETH: 2x 10/100/1000 Ethernet (QCA8075 switch chip)
WIFI: 2x IPQ4018 (2.4GHz 802.11n + 5GHz 802.11ac)
BT: Internal USB Bluetooth adapter (Cambridge Silicon Radio, 0a12:0001)
LCD: ST7789V (135x240), GPIO backlight
ACC: ST LIS2DW12 accelerometer (I2C)
BTN: Reset
UART: through-hole pads on PCB / 3.3V / G, TX, RX, V / 115200n8
USB: 1x USB-C (power), 1x USB-C (host)
PWR: 5 VDC, 2 A (USB-C)
MAC address layout (mac-base at EEPROM offset 0x0):
+0: xx:xx:xx:xx:xx:xx Ethernet WAN
+1: xx:xx:xx:xx:xx:xx Ethernet LAN
+2: xx:xx:xx:xx:xx:xx 2.4 GHz Wi-Fi
+3: xx:xx:xx:xx:xx:xx 5 GHz Wi-Fi
The UTR has two slots: kernel0 and kernel1. The built-in TFTP recovery always writes to kernel0, so
we want to write to kernel1 to preserve that recovery mechanism.
From factory firmware:
1. SSH into your UTR.
2. Check if /proc/cmdline contains ubntbootid=1, then you are on the kernel1 slot: Upgrade/change
to a different version of the UTR firmware, this will switch you back to kernel0 slot. Alternatively
use the TFTP recovery procedure. Reboot and start over at Step 1.
3. Copy the firmware.ubi to the UTR (scp -O) into /tmp/factory.ubi.
4. Change the boot slot to kernel1.
printf '\xff\xff\xff\xff\x2b\xe8\x4d\xa3' > /tmp/bs.bin
mtd -e bs write /tmp/bs.bin bs
rm -f /tmp/bs.bin
5. Set up uboot config to remove signature checks on kernel1 slot. You need to keep the signature
checks to run the stock unifi firmware which we are leaving in kernel0.
BOOTCMD_REAL="sf probe; sf read 0x80000000 0x2f0000 0x800; \
mw.b 0x80010000 0xff 0x1; if cmp.b 0x80000000 0x80010000 0x1; \
then echo \"Slot 1 / kernel1\"; run bootopenwrt; \
else echo \"Slot 0 / kernel0\"; bootubnt; fi"
fw_setenv -s - <<-EOF
bootopenwrt fdt addr \${fdtcontroladdr}; fdt rm /signature; bootubnt
bootcmd_real $BOOTCMD_REAL
EOF
6. Flash the firmware.
MTD="$(grep -w '"kernel1"' /proc/mtd | cut -d: -f1)"
ubidetach -p /dev/$MTD 2>/dev/null || true
ubiformat /dev/$MTD -y -f /tmp/factory.ubi
7. Reboot
reboot
----
To restore the vendor image, switch back to slot 0 and restore signed booting to both slots:
printf '\x00\x00\x00\x00\x2b\xe8\x4d\xa3' > /tmp/bs.bin
mtd -e bs write /tmp/bs.bin bs
rm -f /tmp/bs.bin
fw_setenv bootcmd_real 'bootubnt'
reboot
Then erase slot 1 so it can be used for vendor upgrades:
MTD="$(grep -w '"kernel1"' /proc/mtd | cut -d: -f1)"
ubidetach -p /dev/$MTD 2>/dev/null || true
ubiformat /dev/$MTD
Signed-off-by: Matt Eaton <git@divinehawk.com>
Link: https://github.com/openwrt/openwrt/pull/22740
Signed-off-by: Robert Marko <robimarko@gmail.com>
This commit adds support for OpenWrt U-Boot variant of Nokia XG-040G-MF
XG-PON ONU.
Notes
-----
1. A simple installation without serial console is also possible using a
fork of @dangowrt's UBI Installer
Link: https://github.com/dangowrt/owrt-ubi-installer
Installation / recovery
-----------------------
1. Make sure that you have 'bosa' and 'ri' partitions mtd backups before
you start
2. Place OpenWrt images on the tftp server (IP: 192.168.1.254):
openwrt-airoha-an7583-nokia_xg-040g-mf-ubi-bl31-uboot.fip
openwrt-airoha-an7583-nokia_xg-040g-mf-ubi-initramfs-recovery.itb
openwrt-airoha-an7583-nokia_xg-040g-mf-ubi-preloader.bin
3. Attach serial console and start terminal with XMODEM support:
picocom -b 115200 --send-cmd "sx -vvX" /dev/ttyUSB0
4. Push reset button and power on the router
5. Press 'x', then 'Ctrl + A' and 'Ctrl + S'
6. Paste full path to the bl2 image:
'openwrt-airoha-an7583-nokia_xg-040g-mf-ubi-preloader.bin'
7. Wait until the file is downloaded and the following prompt appears:
Press x to load BL31 + U-Boot FIP
8. Press 'x', then 'Ctrl + A' and 'Ctrl + S'
9. Paste full path to the fip image:
'openwrt-airoha-an7583-nokia_xg-040g-mf-ubi-bl31-uboot.fip'
10. Wait until the file is downloaded, u-boot will prepare ubi partition
automatically
11. Wait for U-Boot menu
12. Run 'Load BL31+U-Boot FIP via TFTP then write to NAND'
13. Run 'Load BL2 preloader via TFTP then write to NAND'
14. Run 'Boot system via TFTP'
15. Once in OpenWrt perform standard sysupgrade
16. Once in OpenWrt upload 'bosa' and 'ri' partitions mtd backups to the
/tmp dir using scp protocol
17. Check ID of the UBI volumes:
ubinfo -d 0 -N bosa | grep "Volume ID"
ubinfo -d 0 -N ri | grep "Volume ID"
18. Write backups according to the volume ID:
ubiupdatevol /dev/ubi0_2 /tmp/bosa.bin
ubiupdatevol /dev/ubi0_3 /tmp/ri.bin
19. Reboot:
reboot
UART
----
A view from the back side of the PCB:
------------------------
| GND RX TX
| X X X
Connection parameters:
115200, 8N1, 3.3V
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24654
Signed-off-by: Robert Marko <robimarko@gmail.com>
While at it, replace the SPI MAC address read patch with a rebased
series from the Digilent u-boot repository. It should be noted that
this feature is still not upstreamed. Refresh patches as required.
As most of the zynq boards are merged into xilinx_zynq_virt, add
UBOOT_CONFIG to the respective boards in the Makefile.
Compile-tested: all Zynq boards
Runtime-tested: Antminer S9
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
While at it, move away from using dated builds to release tags.
Compile-tested: sifiveu/*, d1/*
Runtime-tested: sifiveu/unleashed, sifiveu/unmatched, d1/nezha
Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
CONFIG_OF_EMBED is intended for debugging and is not recommended for
production devices. Remove it from the Nokia XG-040G-MD defconfig so
Kconfig selects CONFIG_OF_SEPARATE, consistent with the other Airoha
boards.
The existing default device tree and u-boot.bin build target ensure that
the separate DTB is built and appended to the deployable U-Boot image.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Debian 11 ships coreutils 8.32, whose cksum does not support the
-a crc32b option. This leaves crc empty and causes the subsequent shell
arithmetic expression to fail.
Use Python's built-in binascii.crc32 implementation instead. Python 3 is
already required by the OpenWrt build system and produces the same CRC-32
value before the existing final XOR.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Move FIP handling to target now that we compile ATF. This is to have always
in sync new ATF and new U-Boot if one of the 2 is already compiled.
Also add HIDDEN ops to enable autoselection of the U-Boot for the required
target. This is needed to prevent user to deselect the U-Boot package
causing failure on ARTIFACTS generation.
Drop precompiled BL2 and BL31 as they can be now compiled from source.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24257
Signed-off-by: Robert Marko <robimarko@gmail.com>
Add support for compiling Airoha ATF, based on a modified version of the
TF-A based on 2.10.
The package will clone the base TF-A and apply the modified source and
pre-compiled objects (DDR calibration, eFUSE handling, TX/RX path...) to
correctly compile.
An helper script is added to implement the same format used for special BL2
handling. BL2 is composed of 3 sub-phase with a initial BL21, a BL22 that
loads a LZMA decompressor and BL23 that actually calibrate and loads BL31
ATF.
Also a special flash_table is used to handle SPI-NAND externally to the
BL2, a special Host target is added for that.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24257
Signed-off-by: Robert Marko <robimarko@gmail.com>
Paul Spooren
Robert Marko
John Crispin
Stefan Reisinger
Zoltan HERPAI
Daniel Golle
Aleksei Sviridkin
Stanislaw PalandClaude Opus 5
Sheikh Faisal
Andrii Kuiukoff
Michael Lotz
Tianling Shen
Shine- GH
Chad Monroe
Frank Wunderlich
Andrew LaMarcheandFrank Wunderlich
Mikhail Zhilkin
Ryan S
Matt Eaton
Mikhail Kshevetskiy
xiao bo
Christian Marangi