On the AP-325 (and variants), the bootloader enforces a particular UBI volume
layout and naming, so unfortunately the kernel's UBI volume and MTD partition
end up with the name, which confuses the current logic.
Therefore, add an option to ignore the MTD partition.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
The current code assumes that the rootfs_data UBI volume is on the same MTD
partition as the rootfs.
Unfortunately, this does not work on the Aruba AP-325 (and variants), since
the bootloader enforces a particular UBI volume layout.
Therefore, this adds a separate variable to set the rootfs_data partition,
and updates all existing devices with a non-default rootfs partition to also
specify the new variable.
Signed-off-by: Lukas Stockner <lukas@lukasstockner.de>
Link: https://github.com/openwrt/openwrt/pull/20738
Signed-off-by: Test Dev <dev@example.org>
This commit fixes "286f377389a button-hotplug: add KEY_SETUP and KEY_VENDOR
handling" which changed the code without bumping the PKG_RELEASE, resulting in
different binaries under the same version.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/23826
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
This commit fixes "a5107ad58c6 mtd: fix buffer leak and fd leak in mtd_dump()"
which changed the code but did not increase the release. This causes two
packages with the same version to have different content and thereby hashes.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/23827
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Add basic support for the TP-Link SG2008P V3 variant. The switch appears
to be identical to the V1 variant, except that it uses the MP3924
instead of the TPS23861 PoE chip.
Specifications:
---------------
* SoC: Realtek RTL8380M
* Flash: 32 MiB SPI flash (Vendor varies)
* RAM: 256 MiB (Vendor varies)
* Ethernet: 8x 10/100/1000 Mbps with PoE on 4 ports
* Buttons: 1x "Reset" button on front panel
* Power: 53.5V DC barrel jack
* UART: 1x serial header, unpopulated
* PoE: 1x MPS MP3924 I2C PoE controller
Works:
------
- (8) RJ-45 ethernet ports
- Switch functions
- System LED
- Basic PoE support (no driver, but a startup script puts the chip
into AUTO mode)
Not yet enabled:
----------------
- PoE, Link/Act, PoE max and System LEDs
Install via web interface:
-------------------------
Not supported at this time.
Install via serial console/tftp:
--------------------------------
The footprints R27 (0201) and R28 (0402) are not populated. To enable
serial console, 50 ohm resistors should be soldered -- any value from
0 ohm to 50 ohm will work. R27 can be replaced by a solder bridge.
The u-boot firmware drops to a TP-Link specific "BOOTUTIL" shell at
38400 baud. There is no known way to exit out of this shell, and no
way to do anything useful.
Ideally, one would trick the bootloader into flashing the sysupgrade
image first. However, if the image exceeds 6MiB in size, it will not
work. The sysupgrade image can also be flashed. To install OpenWRT:
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
Power on device, and stop boot by pressing any key.
Once the shell is active:
1. Ground out the CLK (pin 16) of the ROM (U7)
2. Select option "3. Start"
3. Bootloader notes that "The kernel has been damaged!"
4. Release CLK as sson as bootloader thinks image is corrupted.
5. Bootloader enters automatic recovery -- details printed on console
6. Watch as the bootloader flashes and boots OpenWRT.
Blind install via tftp:
-----------------------
This method works when it's not feasible to install a serial header.
Prepare a tftp server with:
1. server address: 192.168.0.146
2. the image as: "uImage.img"
3. Watch network traffic (tcpdump or wireshark works)
4. Power on the device.
5. Wait 1-2 seconds then ground out the CLK (pin 16) of the ROM (U7)
6. When 192.168.0.30 makes tftp requests, release pin 16
7. Wait 2-3 minutes for device to auto-flash and boot OpenWRT
Signed-off-by: Daniel Tang <tangrs@google.com>
Link: https://github.com/openwrt/openwrt/pull/20616
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
handle_send_a() computed the SRP "A" parameter length as
len = ntohl(msg->len) - sizeof(struct ead_msg_number);
sizeof(struct ead_msg_number) is 1, and the subtraction is evaluated in
unsigned arithmetic. A packet with msg->len == 0 therefore wraps the
result to a huge value which, assigned to the signed int len, becomes -1.
The following bounds check is signed:
if (len > MAXPARAMLEN + 1)
return false;
so -1 passes, and memcpy(A.data, number->data, len) runs with len cast to
size_t (~SIZE_MAX) against the 257-byte abuf, crashing the daemon.
Neither parse_message() nor handle_packet() validate msg->len (only the
captured packet length), so an unauthenticated attacker on the local
segment can reach this path and crash ead with a single crafted packet.
Validate the claimed length in unsigned arithmetic before the subtraction
and bound it on both sides. Doing the upper-bound check unsigned as well
also closes a 32-bit-only variant where sizeof(ead_packet) + msg->len
overflows in handle_packet(), letting a large msg->len reach the same
negative-len path.
Link: https://github.com/openwrt/openwrt/security/advisories/GHSA-9558-77jp-g3fw
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
When growing the segment array in find_entry(), the memset() that zeroes
the newly allocated slots computed the destination with redundant sizeof
scaling:
memset(segments + (num_segments * sizeof(struct tffs_entry_segment)), ...)
segments is a typed pointer, so pointer arithmetic already scales by the
element size. Multiplying the offset by sizeof again advances the
destination by num_segments * sizeof^2 bytes, landing far outside the
realloc()'d buffer and zeroing unrelated heap memory whenever a TFFS
entry spans multiple segments that require array expansion.
Drop the redundant multiplication so the memset targets segments[num_segments].
This is a robustness fix for malformed/corrupt TFFS content; the parser
only reads the on-device nand-tffs MTD partition as root, so it is not
considered security relevant.
Reported-by: @Vasco0x4
Assisted-by: Claude:claude-opus-4-8
Link: https://github.com/openwrt/openwrt/pull/23763
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Backport two upstream commits that replace memset() on coherent DMA
descriptor rings with explicit WRITE_ONCE() status word stores.
On 32-bit PowerPC platforms like apm821xx, coherent DMA memory may be
mapped uncached. The optimized memset() path can use dcbz there, which
triggers alignment warnings and spams the kernel log.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23776
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Update to 2.5.3 and use the official tarball.
Changelog: https://github.com/ppp-project/ppp/releases/tag/v2.5.3
Removed upstreamed:
- 000-pppd-session-fixed-building-with-gcc-15.patch
- 001-pppdump-fixed-building-with-gcc-15.patch
- 501-fix-memcpy-fortify.patch
- 502-remove_mru.patch
Manually rebased:
- 500-add-pptp-plugin.patch
Add a pending patch to relax the check to avoid breaking existing
configurations.
Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23540
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The u-boot build for mediatek ARM SoCs doesn't require pylibfdt. We
can use pre-build kernel DTC to save some build time.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Verify and clean up client ID and global DUID config values before use, in
order to prevent DHCP client malfunction and loss of IPv4 and/or IPv6
connectivity.
- Accept common separators in the string (colon, dash, spaces/tabs, lf)
- Ignore invalid values (non-hex or odd-numbered length)
- Log a warning for invalid settings
The fall back mechanism is as follows:
If a (user-configured) network.<ifname>.clientid setting is found invalid,
ignore and fall back to using network.globals.dhcp_default_duid. In case
that's also invalid (e.g. has been tampered with), don't pass a client
ID to updhc/odhcpc. In that case, udhcpc/odhcpc will use their defaults,
which currently is the i/f MAC address resp. the i/f DUID-LL.
Only error handling is introduced, no behavior change for valid settings.
Signed-off-by: Shine <4c.fce2@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23662
Signed-off-by: Robert Marko <robimarko@gmail.com>
APK compresses it's helptext using LUA and require `zlib`, which isn't
available on the Buildbots. It thens falls back to `gzip`, which embeds the
MTIME, making the binary itself unreproducible.
This commits adds a downstream patch to run `gzip` with `-n`, setting the time
to 0.
Link: https://github.com/openwrt/openwrt/pull/23736
Signed-off-by: Paul Spooren <mail@aparcar.org>
f227ab4f1285 uclient: fix memory leak of url when backend alloc fails
645236607a3d uclient: free proxy_url in uclient_free
53d2d11fb00d uclient-http: fix NULL deref when digest WWW-Authenticate lacks params
0ba1b8718be5 ucode: check calloc return in uc_uclient_new
5cb19466d076 uclient-fetch: reset redirect counter per request
568c447950c1 uclient-fetch: retry short writes and surface errors
4c4a61a69ac3 uclient-fetch: use strtoull to parse Content-Length
440ca260622d uclient-http: validate Content-Length and chunk sizes from the server
8658324bd234 uclient: cast to unsigned char before ctype classifications
bf403fa0f8e5 uclient-fetch: reject CR in --header values
ec47f4176b1e uclient-fetch: always allocate auth_str and free it on exit
391dacd10d31 uclient-http: fail digest auth when the cnonce cannot be randomized
ba1f4311b099 ucode: clamp read length to the size of the static buffer
0ba47f319b09 uclient-fetch: advance to the next URL between requests
9dd0055d527d uclient: initialize *port for unknown address families
f816506651d5 uclient-http: start digest nonce count at 1
9b9b2da40835 uclient-http: fix 2-byte buffer undercount in digest add_field
80fb1e5ee68b ucode: avoid double-free of SSL context on ssl_init error
d44fb561bbcf ucode: don't clear an unrelated registry slot on free
02562403d2a3 uclient-fetch: close the output file before fetching the next URL
4a63561d0012 uclient-http: initialize fd to -1 so a failed connect can't close stdin
428ae8342118 uclient: cancel pending timers in uclient_free()
ffd8db308289 uclient-fetch: guard SSL debug setup against a missing SSL context
9f4db039a263 ucode: release callback argument references
d2af92b0aad9 uclient-http: resolve redirects against the proxy target URL
5dddda023267 uclient-utils: avoid out-of-bounds pointer in get_url_filename
8507588e7ce7 uclient-http: use the proxy target URL for HTTP authentication
322c89c6ca0a uclient-http: retry 401 auth for all body-less request methods
db3bb00ddda7 uclient-http: accept unquoted digest auth parameter values
5ce9983b2a11 uclient-http: follow 303 and 308 redirects
070c868486dc uclient-fetch: finalize request on invalid 206 Content-Range
83659a5a9bc1 uclient-fetch: concatenate multiple URLs into a single -O file
43bed2753998 ucode: don't leak string references in status()/get_headers()
03b17e4fc793 uclient-fetch: attach credentials to the proxy target, not the proxy
74c07b12f7ab uclient-fetch: don't run the progress meter in spider mode
daad21fa2c17 uclient-fetch: handle init_request failure on the 204 resume retry
Link: https://github.com/openwrt/openwrt/pull/23693
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Two leaks in mtd_dump():
- The buffer allocated with malloc(erasesize) is never freed before
returning, leaking erasesize bytes on every call.
- The pre-existing malloc-NULL early return path also leaked the just-
opened fd by returning directly instead of going through cleanup.
Initialize buf to NULL, route the malloc-NULL case through the
existing 'out:' label, and add free(buf) on the cleanup path so both
fd and buf are released consistently on every exit.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23706
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
After malloc(erasesize) in mtd_check(), the result was never checked
for NULL. On allocation failure, the buf pointer remained NULL and
would later be used in image_check() via read(imagefd, buf + buflen,
...), causing a NULL pointer dereference.
Add a NULL check after the allocation and return early. The early
return path also closes the just-opened fd and frees the strdup'd
colon-separated device-list copy to avoid leaks.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23705
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Two ignored return values in mtd_write_buffer() caused silent failures:
- lseek() return value was ignored. A failed seek (e.g. EBADF, ESPIPE)
followed by write() would silently write at the wrong offset.
- write() return value was ignored, silently discarding write errors.
This could lead to data corruption on the MTD device without any
indication.
Check both return values, report errors to stderr and return -1 on
failure.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23552
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Vendor U-Boot stores its environment at offset 0x2000 inside the
"config" partition (size 0x4000). The offset is not erase-block
aligned, so the fw_env tool's alignment check rejects the natural
secsize=0x20000. Declaring secsize=0x2000 passes the check, lets
fw_printenv read the real env (factory_mac, hw_version,
bundle_number, ...), and causes fw_setenv to fail cleanly on erase
rather than corrupting anything (the kernel rejects sub-erase-block
MEMERASE).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Florian Maurer <fmaurer@disroot.org>
Link: https://github.com/openwrt/openwrt/pull/23192
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/master/debian/changelog
* Remove ca-certificates-local example (closes: #988912, #1127101).
* Update Mozilla certificate authority bundle to version 2.86
The following certificate authority was added (+):
+ e-Szigno TLS Root CA 2023
The following certificate authorities were removed (-):
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
- certSIGN ROOT CA
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- TeliaSonera Root CA v1
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- GLOBALTRUST 2020
- GTS Root R2
- FIRMAPROFESIONAL CA ROOT-A WEB
The following certificate authority was renamed (~):
~ "OISTE Server Root RSA G1" (removed leading space)
Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23675
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The mutex file via '/tmp/.config_pending' should prevent the command
'/sbin/wifi config' from being called in the ieee80211 hotplug when loading
the kernel modules [1]. Since the file '/etc/board.json' does not yet exist
and could be incomplete.
The '/etc/board.json' file is modified in the '/sbin/wifi config' script.
This is only generated during the first boot when '/bin/config_generate' is
called.
This whole handling is unclean. Therefore the creation of the default
configuration '/etc/config/network', '/etc/config/system' and
'/etc/board.json' via '/sbin/config_generate' is moved to the preinint
after the rootfile system has been mounted
The advantage now is that on an ieee80211 hotplug event, the
'/etc/board.json' is already present which simplifies the whole thing.
[1] https://github.com/openwrt/openwrt/blob/main/package/network/config/wifi-scripts/files/etc/hotplug.d/ieee80211/10-wifi-detect
Fixes: b993a00b82 ("base-files: fix duplicate wifi radio sections when using phy renaming")
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
LED trigger for network interfaces.
- Aggregated per-family (lan/wan/wlan).
- Family and flags are taken from device tree properties:
- "family" : simple family string "lan" | "wan" | "wlan"
- "mode" : any combination of "link", "tx", "rx" flags
Priority/combination:
* If "mode" present: flags come from "mode" and take precedence.
Family is taken from "family" if present, otherwise from the LED name.
* If only "family" present: use its family and default flags = link+tx+rx.
* If neither present: fall back to LED device name parsing.
- Suffix "-online" is valid ONLY in the LED name (label),
e.g. "green:wlan-online". It indicates the online variant but is applied
only when DT "mode" is absent.
Behaviour:
- wlan (normal): blink/solid driven by throughput table
- lan/wan (normal): one-shot blink on TX/RX packet change
- *-online variants: steady ON while any interface of the family has carrier
Interfaces are auto-tracked by name match (lan0, wan1, wlan2, phy0, wl1,
ath0, ra0...). Up to MAX_IFACES (16) interfaces per family
This trigger is intended for board/device authors and drivers to provide simple
network-activity LED behaviour without per-interface wiring in userspace.
Refresh bcm27xx patches in the same commit to account for line shifts in
drivers/leds/trigger/Kconfig and Makefile, ensuring clean applies for
bisectability.
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/19903
Signed-off-by: Robert Marko <robimarko@gmail.com>
Change-log since version 2026.03.18, retrieved from the wireless-regdb mailing lists:
wireless-regdb: update regulatory database based on preceding changes
wireless-regdb: Update regulatory info for Brunei Darussalam (BN) for 2022
wireless-regdb: allow 320MHz channel width for Russia
wireless-regdb: Update 6 GHz rules for Hong Kong (HK)
wireless-regdb: Update 5/6 GHz power rules for Russia (RU)
wireless-regdb: Fix 60 GHz power unit for Ukraine (UA)
wireless-regdb: Update 6 GHz rules for South Africa (ZA)
wireless-regdb: Update 6 GHz rules for South Korea (KR)
wireless-regdb: Update regulatory rules for Sri Lanka (LK)
wireless-regdb: Add regulatory info for CEPT countries FO, GI, IM, SM and VA listed by WiFi Alliance
Signed-off-by: Hafiz Zafran <hfzz7@duck.com>
Link: https://github.com/openwrt/openwrt/pull/23594
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
08bd058e0246 ra: skip malformed options instead of aborting RA processing
2550a1dd276e dhcpv6: fix inverted Authentication option validation in Reply
496e55d43de6 dhcpv6: use host-order option length in Authentication validation
b6f0c70f5fc2 dhcpv6: fix out-of-bounds end pointer when parsing IA in Advertise
92fd11cd9547 dhcpv6: fix OOB read and 1-byte heap overflow on captive-portal option
0dab8feec55a ra: fix OOB read on captive-portal option comparison
a4d6a3232c24 script: fix string_to_env writing garbage and reading past input
2521bf732b9f script: avoid kill(0) when SIGCHLD races script_call
56cec7a15816 odhcp6c: drop stale hash_ifname() declaration
49d9c0112bb8 odhcp6c: propagate allocation failure from insert_state
4bd976fd60c0 dhcpv6: ensure hostname buffer is NUL-terminated for dn_comp
6d12865fb89c ubus: validate element type when parsing reconfigure_dhcp opt_send
01130f80338a script: handle allocation failures in env helpers
0a19052dc9fb odhcp6c: refuse to follow symlinks when writing pidfile
d6c2fbdc255c odhcp6c: skip malformed /proc/net/if_inet6 entries
b6add6c0e30e dhcpv6: avoid signed-shift undefined behaviour in IAID derivation
ce52fe118b13 ubus: clear cached object type id on disconnect
91f88c694f6f config: stop mutating caller-supplied buffers in send-options parser
c938c168cbef script: handle fork() failure when launching state script
1546a48255b2 ubus: avoid out-of-bounds read when serializing captive-portal URI
3270f081039d all: fix inverted captive-portal URI equality check (RFC 8910 §3)
e9a9e9d45f38 odhcp6c: bound the address length when parsing the -P argument
5ad94c86e864 script: walk entries with odhcp6c_next_entry in entry_to_env
df4f199c02fc ubus: walk entries correctly and don't leak an open table in entry_to_blob
6c1c4c48d4a2 ubus: don't leak an open table on malformed S46 rule/bind in s46_to_blob
1797d2bca3c0 odhcp6c: remove pidfile on exit
86a6665e4bb0 ra: clear captive-portal state when router signals unrestricted URI
0a4e51db30d5 dhcpv6: require known SERVERID when validating Reconfigure
afc3c8534864 dhcpv6: reject Reconfigure with malformed or duplicate Message option
df27a49c98d8 dhcpv6: enforce monotonic replay counter on Reconfigure RKAP
9177f236c2d7 odhcp6c: do not treat DHCPv6 option type 0 as end-of-list
daf4ec3054e7 example: write all DNS servers to resolv.conf
Link: https://github.com/openwrt/openwrt/pull/23652
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
69b62b1990bc rpc-sys: packagelist: increase input buffer size
e655a0d69492 exec: defer async reply teardown to avoid use-after-free
5b078674a592 optimize by reusing timeout member
d005c885dbe4 session: clamp uloop timeout to avoid int overflow
a545f008da91 ucode: add request.defer() for async method handling
ab6549a99c7c file: avoid sending uninitialized stack memory for broken symlinks
7af2dd81cd53 main: prevent integer overflow when parsing -t timeout argument
680705e4b76d plugin: use snprintf in ubus lookup callback to prevent buffer overflow
fb0302dc0e51 session: detect short read of /dev/urandom in rpc_random()
dc091afa5860 rpc-sys: packagelist: check calloc() result for world array
4fbd48515d6a rpc-sys: packagelist: avoid size_t underflow when stripping ABI version
46fce7d5efc9 ucode: fix off-by-one truncation of generated ubus object type name
26dba5206e17 exec: prevent double close() of exec pipe descriptors
af5d6f431186 uci: prevent integer overflow of client supplied apply timeout
d06d2a81dc29 rc: fix memory leak of list request context
0de666811559 rc: copy list "name" filter to avoid use-after-free
75470f4b5124 rc: use a per-request blob_buf for the list reply
3037a0e36856 treat exec failures in forked children with _exit() instead of return
f5ffec54d7c7 rc: reap killed child on list "running" check timeout
fd4fcdeb186b rpc-sys: packagelist: close status file on world parsing error paths
e22aea1a51df rpc-sys: packagelist: read world file instead of mmap to avoid SIGBUS
79c8087c8e8e file: avoid zero-length b64_decode() on empty write data
cd1d9588da63 ucode: bound recursion when converting blob arguments to ucode values
2decaec3ef1b iwinfo: fix error handling and backend leak in survey
28faf6403792 cast char arguments to unsigned char for ctype.h functions
Link: https://github.com/openwrt/openwrt/pull/23650
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This pull request is based on
- the discussions in https://forum.openwrt.org/t/support-for-the-linksys-mr9000
Device Specs:
- Router is similar to EA8300 but with 512MB RAM and changed GPIOs
- IPQ4019
- Quad Core CPU
- 512 MB RAM
- 256 MB FLASH
- 4 LAN ports, 1 WAN port
- 1x2.4GHz (802.11n) and 2x5GHz (802.11c) wifi
- 3 LEDs (Red, blue, green) which are routed to one indicator at the top of the case
- 2 buttons (Reset, WPS)
Disassembling the device:
- There are 4 T10 screws at the bottom of the device which must be removed
- All 4 screws are located under the rubber feet
Serial interface:
- The serial interface is already populated on the device with a 5-pin header
- Pinout from front to back: 1:GND, 2: unknown, 3: RX, 4: TX, 5: VCC
- Settings: 115200, 8N1
MAC address layout:
- Same as on MR8300
- MAC address is stored in the "devinfo" partition (entry "hw_mac_addr")
- The MAC address on the label is identical with the one in the devinfo partition
- The MAC address on the label is the WAN MAC address
- LAN MAC address is the one from the label + 1
- Wifi (2.4GHz) MAC is the one from the label + 2
- Wifi (1st 5GHz) MAC is the one from the label + 3
- Wifi (2nd 5GHz) MAC is the one from the label + 4
Migrating to OpenWrt requires multiple steps:
- Load and boot the initramfs image
- Adapt U-Boot settings to support bigger kernels
- Flash the sysupgrade image
Load and boot initramfs:
- Connect serial interface
- Set up a TFTP server on IP 192.168.1.254
- Copy openwrt-ipq40xx-generic-linksys_mr9000-initramfs-zImage.itb to TFTP server
- Rename file to C0A80101.img
- Boot up the device and stop in U-Boot
- Run the following U-Boot commands after a link has been established:
tftp
bootm
- Initramfs image is started now.
Adapt U-Boot settings to support bigger kernels:
- Run "fw_printenv" in the initramfs image after booting
- There should be an entry kernsize=300000 which indicates the maximum size for the kernel is 3MB
- Execute "fw_setenv kernsize 500000" to increase the max kernel size to 5MB
- Check that the change are applied with "fw_printenv"
Flash the sysupgrade image:
- Default sysupgrade routine either with a initramfs image containing LuCI or via command line.
Revert back to OEM firmware:
- Flash the OEM firmware via sysupgrade
- Forced update is required
Signed-off-by: Karsten Rehn <rekados@posteo.de>
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22744
Signed-off-by: Robert Marko <robimarko@gmail.com>
Move the $(eval $(call Download,ath11k-legacy-firmware)) from inside
Build/Prepare to the top level, right after the Download definition.
When the eval is inside Build/Prepare, it only runs at recipe execution
time (during compilation). This makes the legacy firmware source
invisible to 'make download', which only evaluates Download definitions
at Makefile parse time. As a result, offline builds fail because the
source was never fetched during the download phase.
This is consistent with how ath10k-ct-firmware handles multiple
Download definitions (all at top level).
Signed-off-by: Michael Pfeifroth <michael.pfeifroth@westermo.com>
Link: https://github.com/openwrt/openwrt/pull/23628
Signed-off-by: Robert Marko <robimarko@gmail.com>
c3bf07a66f7e make: honor SOURCE_DATE_EPOCH in BUILD_DATE
bb4f3f0b947e Revert "MP: fix uniphy reset in phy to phy link scenario"
Signed-off-by: Robert Marko <robimarko@gmail.com>
Lukas Stockner
Paul Spooren
Ryan Leung
Daniel Tang
Hauke Mehrtens
Rosen Penev
David Bauer
Qingfang Deng
Seo Suchan
Shiji Yang
John Audia
Shine
Thomas Richard
Anna Kiri
Tim Small
Andre Heider
Florian Maurer
Fengyu Wu
Florian Eckert
Mieczyslaw Nalewaj
Hafiz Zafran
Roland Reinl
Michael Pfeifroth
Robert Marko