A station MLD is configured across every radio it may use, which marks all
of those radios as channel following. Only the radios the station actually
holds a link on have a channel to follow; the rest waited for one that never
arrived, so they ignored their configured channel and kept whatever ACS had
picked at start up. Later channel changes were dropped as well, because the
pending follow was treated as authoritative.
Track the frequency reported through apsta_state per radio and let a radio
without one apply its own configuration. The supplicant marks the radios
holding no link when the station completes an association, and repeats the
notification on link reconfiguration, so radios are handed back and forth as
the station adds or drops links rather than staying stuck on the first
association.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
wpad decides whether to keep or tear down an MLD interface by comparing the
whole configuration object, which embedded the full device configuration of
every participating radio. Any radio level change, such as a channel or
txpower update, therefore destroyed and recreated the station MLD and
dropped the backhaul link. Neither hostapd nor wpa_supplicant reads
radio_config; it is only used locally to resolve the phy.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The EN7528 integrates an MT7530 Gigabit switch, memory-mapped in the SoC
register space like the built-in switches of the MediaTek MT7988 and
Airoha EN7581/AN7583 SoCs. Its chip revision register reads 0x7530, so
unlike those three it is a genuine MT7530 core rather than an MT7531
derivative.
Until now the out-of-tree econet-eth driver programmed it as a flat
"dumb switch" that simply bridged the four LAN ports together and
exposed them as a single eth0. Hand it to the upstream mt7530 DSA
driver instead, so the ports come up as managed user ports lan1-lan4.
- Add an ID_EN7528 variant to the mt7530 driver, bound through the MMIO
glue with the "econet,en7528-switch" compatible. It reuses
mt7988_setup() and the indirect PHY accessors, but selects the CPU
port through the MT7530-style MFC register rather than the MT7531 CFC
one, and describes the CPU port as a fixed 1000FDX link to the SoC
MAC. The LAN GPHYs advertise EEE, but negotiating it drops frames
with some link partners, so the LPI capabilities are left empty and
phylink keeps EEE off.
- The frame engine and the switch are adjacent but separate blocks. The
ethernet node used to describe a single 64K window covering both,
which overlaps the switch node and makes the two drivers fight over
the region. Size it to the frame engine alone (0x8000) and give the
switch its own node, so both keep an exclusive claim:
1fb50000-1fb57fff : 1fb50000.ethernet
1fb58000-1fb5ffff : 1fb58000.switch
The GSW reset moves to the switch node with it.
- econet-eth acts as the DSA conduit. It derives from the size of its
own register resource whether the window still covers the switch, and
when it does not, skips the dumb-switch setup and the switch
source-MAC write. The econet-eth driver now carries this support, so
bump PKG_SOURCE_VERSION to pull it in. EN751221 and EN751627 keep
the full window and are unaffected.
- Enable the switch on the DASAN H660GM-A. The two variants share a
board, but their sockets are not numbered the same way: LAN1 is
switch port 1 on the Airtel unit and port 4 on the generic one, so
the port labels are assigned per board .dts.
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24199
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit introduces OpenWrt U-Boot UBI layout support
for the COMFAST CF-WR632AX, enabling:
- Prolonged device lifetime by allocating most of the flash
to UBI (which takes care of wear-leveling)
- Maximum available storage space for OpenWrt
- Fully-featured U-Boot
- Effective recovery mechanisms
OpenWrt U-Boot UBI flash instructions
-------------------------------------
A device running stock firmware should be upgraded to the
latest standard OpenWrt firmware
(https://firmware-selector.openwrt.org/?target=mediatek%2Ffilogic&id=comfast_cf-wr632ax).
Back up critical data
---------------------
Console:
1. While the device is running OpenWrt with stock MTD partitions:
mtd dump BL2 > /tmp/BL2.bin
mtd dump u-boot-env > /tmp/u-boot-env.bin
mtd dump Factory > /tmp/Factory.bin
mtd dump FIP > /tmp/FIP.bin
2. Copy the backup files to your PC via SCP.
LuCI Web-UI:
"System" -> "Backup / Flash Firmware" -> "Save mtdblock contents"
Save mtdblock:
BL2
u-boot-env
Factory
FIP
Make sure the files were successfully downloaded to your downloads directory,
especially the Factory file.
Using the installer image
-------------------------
To simplify the installation process, this method uses a fork
of Daniel Golle's (@dangowrt) UBI Installer
https://github.com/dangowrt/owrt-ubi-installer
1. Ensure your router is running the latest generic OpenWrt firmware.
Upgrade it if necessary.
2. Obtain the installer image:
Build the installer from source
https://github.com/andros-ua/owrt-ubi-installer/tree/cf-wr632ax
or download a prebuilt image from the
https://github.com/andros-ua/owrt-ubi-installer/releases
3. Flash the openwrt*-ubi-initramfs-recovery-installer.itb
image using sysupgrade.
4. Wait for installation: the green status LED will blink rapidly,
indicating that the all-in-UBI installer is running.
5. Once the installation finishes,
the status LED will turn solid amber for 5 seconds.
6. After the device reboots, perform a final sysupgrade using the
openwrt*-ubi-squashfs-sysupgrade.itb image.
Return to stock MTD
-------------------
1. Flash openwrt*comfast_cf-wr632ax-initramfs-kernel.bin
via sysupgrade
2. Copy files to /tmp on the device via SCP:
BL2.bin
u-boot-env.bin
Factory.bin
FIP.bin
openwrt*-squashfs-sysupgrade.bin
3. Restore stock MTD partitions:
apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd write /tmp/BL2.bin BL2
mtd write /tmp/u-boot-env.bin u-boot-env
mtd write /tmp/Factory.bin Factory
mtd write /tmp/FIP.bin FIP
4. Install the system:
sysupgrade /tmp/*sysupgrade.bin
BL2 and FIP Recovery
--------------------
Use mtk_uartboot to recover corrupted BL2 or FIP via UART:
https://github.com/981213/mtk_uartboot
Stock layout
----------------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "BL2" |
| mtd1: 00080000 00020000 "u-boot-env" |
| mtd2: 00200000 00020000 "Factory" |
| mtd3: 00200000 00020000 "FIP" |
| mtd4: 07000000 00020000 "ubi" |
----------------------------------------
OpenWrt U-Boot UBI layout
----------------------------------
| dev: size erasesize name |
| mtd0: 00100000 00020000 "bl2" |
| mtd1: 07f00000 00020000 "ubi" |
----------------------------------
Signed-off-by: Andrii Kuiukoff <andros.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23981
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add an OpenWrt U-Boot ("UBI") layout variant for the TP-Link Archer
BE450. It replaces the vendor bootloader and the stock dual-image
layout with a single large UBI partition, extending the usable flash
to around 95 MiB, and ships a current U-Boot with TFTP recovery.
Hardware
--------
SoC: MediaTek MT7988D (Filogic 880)
Wi-Fi: MediaTek MT7992AV (BE7200, 2.4/5 GHz)
Flash: 128 MiB SPI-NAND
RAM: 512 MiB DDR4
Serial: 115200 8N1, header located next to the heatsink:
heatsink
| |
| |
| | +----+-----+------+-------+ +-----------------+
| | | TX | RX | GND | +3.3V | | power connector |
+---+ +----+-----+------+-------+ +-----------------+
|
Don't connect ----+
MAC addresses
-------------
The label MAC (base) is stored in tp_data/default-mac and is written
into the factory partition at offset 0x4 during installation:
eth0 (LAN): base (factory 0x4)
eth1 (WAN): base + 1
eth2 (LAN): base + 2
Wi-Fi: derived by mt76 from the factory EEPROM (2.4 GHz = base,
5 GHz = base with bit 0x10 set), matching the stock
layout behaviour.
Installation
------------
Requires a serial connection and a TFTP server. The device must be
running the stock-layout OpenWrt (tplink_be450) build.
1. From the running stock-layout OpenWrt, back up the vendor
bootloader and the calibration/MAC data. These cannot be
recovered otherwise:
cat /dev/mtd0 > /tmp/boot.bin
cat /dev/mtd5 > /tmp/tp_data.bin
scp /tmp/boot.bin /tmp/tp_data.bin user@pc:backup/
scp -r /tmp/tp_data user@pc:backup/
Store boot.bin, tp_data.bin and the tp_data file contents
(MT7992_EEPROM.bin, default-mac) somewhere safe.
2. Boot the UBI-layout initramfs. Connect the PC to one of the LAN ports
(LAN1-3) and serve the recovery image from a TFTP server on the PC at
192.168.1.2. Interrupt the vendor U-Boot on the serial console
(Ctrl+C), then:
setenv serverip 192.168.1.2
tftpboot 0x50000000 openwrt-mediatek-filogic-tplink_be450-ubi-initramfs-recovery.itb
bootm 0x50000000
3. Copy the required files to the booted initramfs (192.168.1.1):
scp -O MT7992_EEPROM.bin default-mac \
openwrt-mediatek-filogic-tplink_be450-ubi-bl31-uboot.fip \
openwrt-mediatek-filogic-tplink_be450-ubi-preloader.bin \
openwrt-mediatek-filogic-tplink_be450-ubi-squashfs-sysupgrade.itb \
root@192.168.1.1:/tmp
4. Build the factory image from the EEPROM and MAC data:
cd /tmp
dd if=/dev/zero bs=$((0x100000)) count=1 | tr '\000' '\377' > factory.bin
dd if=MT7992_EEPROM.bin of=factory.bin bs=1 count=$((0x1e00)) conv=notrunc
dd if=default-mac of=factory.bin bs=1 seek=4 conv=notrunc
5. Create the UBI volumes. Warning: this permanently erases the
remaining vendor data, including tp_data - only proceed with the
backups from step 1 stored safely:
ubidetach -p /dev/mtd2
ubiformat /dev/mtd2 -y
ubiattach -p /dev/mtd2
ubimkvol /dev/ubi0 -N fip -t static -s 2MiB
ubiupdatevol /dev/ubi0_0 /tmp/openwrt-mediatek-filogic-tplink_be450-ubi-bl31-uboot.fip
ubimkvol /dev/ubi0 -N ubootenv -s 0x1f000
ubimkvol /dev/ubi0 -N ubootenv2 -s 0x1f000
6. Write the factory data and the BL2 preloader. kmod-mtd-rw is
required to lift the read-only protection of the bl2 partition;
set up internet access first or upload the package manually:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd erase factory
mtd write /tmp/factory.bin factory
mtd erase bl2
mtd write /tmp/openwrt-mediatek-filogic-tplink_be450-ubi-preloader.bin bl2
7. Flash the system:
sysupgrade -n /tmp/openwrt-mediatek-filogic-tplink_be450-ubi-squashfs-sysupgrade.itb
Revert to stock firmware
------------------------
1. From the UBI-layout OpenWrt, force-flash the stock-layout OpenWrt
(tplink_be450) initramfs image; the board name differs, so
sysupgrade must be forced:
sysupgrade -F -n openwrt-mediatek-filogic-tplink_be450-initramfs-kernel.bin
2. After booting into that initramfs, set up network access, copy
boot.bin and tp_data.bin from the backup to /tmp and restore the
vendor bootloader and data:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd erase boot
mtd write /tmp/boot.bin boot
mtd erase ubi0
mtd erase ubi1
mtd erase userconfig
mtd erase tp_data
mtd write /tmp/tp_data.bin tp_data
3. Verify the tp_data restore before rebooting - without it the
device has no ethernet:
md5sum /tmp/tp_data.bin
md5sum /dev/mtd5
If the checksums match, reboot. The vendor U-Boot web recovery
comes up on 192.168.1.1; flash the TP-Link stock firmware from
there.
Signed-off-by: Emre Yavuzalp <emreyavuzalp2@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23211
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add a U-Boot replacement loader for the TP-Link Archer BE450
(MT7988D, 128 MiB SPI-NAND). BL2 boots from spim-nand-ubi with DDR4;
the FIP and the redundant environment are stored in UBI volumes.
This replaces the vendor bootloader and the stock dual-image layout
with a single large UBI partition, freeing around 95 MiB of flash for
OpenWrt. The vendor layout keeps BL2 at flash offset 0x0, which is
where snand_write_bl2 places the first of its four redundant copies.
Signed-off-by: Emre Yavuzalp <emreyavuzalp2@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23211
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Specifications
--------------
- SoC : Qualcomm IPQ4019 (4x ARMv7 Cortex-A7 @ 716 MHz, NEON/VFPv4)
- RAM : 256 MiB DDR3
- SPI-NOR : Macronix MX25L1606E (2 MiB) - bootloader + ART calibration
- SPI-NAND : Winbond W25M02GV (256 MiB, dual-die) - kernel + rootfs (UBI)
- WLAN : IPQ4019 on-chip, 2 radios
- 2.4 GHz : 2x2 802.11b/g/n (wifi0)
- 5 GHz : 2x2 802.11n/ac (wifi1)
- Ethernet : 1x RJ45 via QCA8075 PHY, jack wired to switch port 5
- TPM : Atmel AT97SC3204T on i2c @ 0x29
- Buttons : 1x Reset (gpio2, active low)
- LEDs : green (gpio3, power), red (gpio4, status / panic)
- UART : 115200 8N1 3.3V (gpio60 TX / gpio61 RX)
- Power : DC 12V
MAC addresses
-------------
Read from the ART partition on SPI-NOR flash at offset 0x0,
encoded as a nvmem cell in the DTS.
Flash layout
------------
SPI-NOR (2 MiB) carries the QCA bootloader chain and ART:
SBL1 0x000000 256 KiB (bootloader stage 1)
MIBIB 0x040000 128 KiB (flash partition table)
QSEE 0x060000 384 KiB (TrustZone / secure env)
CDT 0x0c0000 64 KiB (configuration data tbl)
DDRPARAMS 0x0d0000 64 KiB (DDR training parameters)
APPSBLENV 0x0e0000 64 KiB (U-Boot environment)
APPSBL 0x0f0000 512 KiB (U-Boot)
ART 0x170000 64 KiB (WiFi calibration + MAC)
The W25M02GV SPI-NAND is split at the die boundary
(die 0 = rootfs, die 1 = data) to work around a stock U-Boot bug:
the die-select is broken, causing reads from die 1 to return
0xFF. If UBI wear-leveling relocated the layout volume to
die 1, U-Boot would fail to attach UBI, bricking boot.
Splitting the chip keeps all UBI metadata U-Boot reads from
die 0.
Stock U-Boot hardcodes the UBI attach window to 64 MiB;
the bootcmd replacement expands it to 128 MiB to use the
full die 0.
rootfs 0x00000000 128 MiB
data 0x08000000 128 MiB
Installation
------------
1. Build image for sophos_apx120 target
2. Start TFTP server in folder with
openwrt-ipq40xx-generic-sophos_apx120-initramfs-
uImage.itb
3. Plug in Serial TTL Adapter (115200 baud):
| APX 120 | VCC | RX | GND | TX |
|--------|------|-----|-----|-----|
| USB | X | TX | GND | RX |
|--------|------|-----|-----|-----|
3. Short U26 pin 8 (first pin on left, top row on NAND
Chip, with ethernet port facing you) to ground for a
fraction of a second during power-on. Expected output shows
NAND detection and CRC warning, then U-Boot prompt.
4. In U-Boot run:
$ setenv bootdelay 5
$ setenv verify no
$ saveenv
$ tftpboot 0x84000000
openwrt-ipq40xx-generic-sophos_apx120-initramfs-uImage.itb
$ bootm 0x84000000
5. Setup Networking Transfer the sysupgrade image using a
HTTP server or scp
6. In OpenWrt run:
$ fw_setenv bootcmd 'set fdt_high 0x87000000 && \
set bootargs ubi.mtd=rootfs root=mtd:ubi_rootfs \
rootfstype=squashfs rootwait && nand device 1 && \
set mtdids nand1=nand1 && set mtdparts \
mtdparts=nand1:0x8000000@0x0(fs) && \
ubi part fs && ubi read 0x84000000 kernel && \
bootm 0x84000000#config@ap.dk01.1-c2'
$ ubiformat /dev/mtd9 -y
$ sysupgrade -n
openwrt-ipq40xx-generic-sophos_apx120-squashfs-sysupgrade.bin
7. Device should reboot into OpenWrt
Notes
-----
- With firmware version 1.0.019, the image drops directly
into a shell, so NAND glitching may be skipped.
- The platform sysupgrade script reflashes the entire
die-0 UBI partition via `ubiformat` — live volume
manipulation would leave the UBI layout in a state the
stock U-Boot rejects, which bricks the device.
Known Issues
------------
- Some device revisions have an TPM chip that
is not detected/supported or is broken
Signed-off-by: Morice Olbert <synapse7062@spnkr.de>
Link: https://github.com/openwrt/openwrt/pull/24328
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Update to a newer bugfix release of gettext.
This version includes a commit to make adjustments
according to changes in gnulib in early 2025.
Add DEPENDS variable to package definition
in order to enforce the correct build order,
which should have been done when libunistring
and libxml2 packages were moved to openwrt core.
No patch requires refresh.
Signed-off-by: Michael Pratt <mcpratt@pm.me>
Link: https://github.com/openwrt/openwrt/pull/24247
Signed-off-by: Robert Marko <robimarko@gmail.com>
hostapd changed the configuration of basic and supported rates to a
per-bss setting. This left the current phy global settings unapplied.
Apply the rate settings in uci on each VAP of a PHY.
In the future, this setting can theoretically also be set per-bss
in uci. However it is not part of this patch.
Link: https://git.w1.fi/cgit/hostap/commit/?id=f7be1b53852a069f0d15eb471a6f9158467ab117
Signed-off-by: David Bauer <mail@david-bauer.net>
Replace deprecated one-element arrays with flexible array members.
CONFIG_FORTIFY_SOURCE reports the following warning when
one-element arrays are used as variable-length buffers:
sta_cmd.c:1033 mwifiex_sta_prepare_cmd
memcpy: detected field-spanning write (size 84) of single field
"domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
Convert affected structs to use flexible array members.
- Preserve existing wire layouts.
- Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
This fix has been accepted upstream:
1cb5845a58
Tested-on: WRT3200ACM
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24451
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Fix regression in rgpower table loading, caused by using
request_firmware(): when the requested firmware does not exist, e.g.
nxp/rgpower_WW.bin does not exist on OpenWrt builds for WRT3200ACM,
request_firmware() falls back to firmware_fallback_sysfs(), which expects
the firmware to be provided by user space using SYSFS. No such utility is
provided in this configuration, so the entire system locks up for 60
seconds, until the request times out. During this time, no other log
messages are observed, and the device does not respond to commands over
UART.
The request_firmware() call is performed in the following context:
current->comm kworker/1:2 in_task 1 irqs_disabled 0 in_atomic 0
Fixed by using request_firmware_direct(). This prevents fallback to SYSFS,
and avoids delay. The rgpower table is optional. The driver falls back
to the device tree power table if the firmware is not present.
The error code is printed for debugging and returned to the caller,
which only cares for success or failure, so there are no side effects.
Link: #24205Fixes: #24434
Fixes: https://forum.openwrt.org/t/25-12-0-slow-boot-on-linksys-wrt3200acm/247751
Fixes: 7b6f16a258
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24205
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The board enables gdm1 in its DTS, but U-Boot v2026.07 ships
arch/arm/dts/an7581-u-boot.dtsi, which is appended to the end of the
board DTS and declares gdm1 with status = "disabled". The board setting
is overridden and U-Boot ends up without a network device.
Add a board specific an7581-w1700k-ubi-u-boot.dtsi re-enabling gdm1.
U-Boot only pulls in the first matching *-u-boot.dtsi (firstword in
scripts/Makefile.lib), so the board file must include the SoC one
explicitly, otherwise the entire an7581 U-Boot glue is dropped along
with it: uart1 bootph-all, the eth/pcs/snfi/mmc nodes and the ATF
reserved memory.
This is the same fix that was confirmed to restore networking on the
Nokia XG-040G-MD. It is compile tested only and verified by inspecting
the generated DTB - I have no W1700K hardware, so it is unverified on
the actual device and needs testing by someone who has one.
Fixes: baeacca598 ("uboot-airoha: update to v2026.07")
Signed-off-by: Vitaliy Sochnev <sochnev.v.74@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24410
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
U-Boot v2026.07 ships arch/arm/dts/an7581-u-boot.dtsi, which declares
gdm1 with status = "disabled". That file is appended to the end of the
board DTS, so it overrides the MAC enabled by the board and U-Boot ends
up without a network device:
No ethernet found.
Add a board specific an7581-nokia-xg-040g-md-u-boot.dtsi re-enabling
gdm1. U-Boot only pulls in the first matching *-u-boot.dtsi (firstword
in scripts/Makefile.lib), so the board file must include the SoC one
explicitly, otherwise the entire an7581 U-Boot glue is dropped along
with it: uart1 bootph-all, the eth/pcs/snfi/mmc nodes and the ATF
reserved memory. Same approach as en7581-evb and Nokia Valyrian.
Tested on Nokia XG-040G-MD: TFTP recovery boot works again.
Fixes: baeacca598 ("uboot-airoha: update to v2026.07")
Closes: https://github.com/openwrt/openwrt/issues/24385
Signed-off-by: Vitaliy Sochnev <sochnev.v.74@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24410
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Drop upstreamed patches.
Delete device trees in `106-board-rockchip-add-HINLINK-H66K-H68K.patch` that have been added to
U-Boot from upstream Linux.
Rebase `108-07-WIP-rockchip-mkimage-Add-rk3576-align-and-sd-card-wo.patch`
Refresh all other patches.
Signed-off-by: Ryan Leung <untilscour@protonmail.com>
Link: https://github.com/openwrt/openwrt/pull/24118
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The ZyXEL GS1900-8HP B2 is an 8-port gigabit switch with PoE+ support. It's a new
hardware revision that uses the `realtek,pse-mcu-gen2` PSE dialect with 115200 baud
like the GS1900-10HP B1. Other hardware changes are unknown, but the switch works
fine using the pre-PSE `zyxel,gs1900-8hp-b1` image with the `realtek-poe` user-space
PoE implementation.
The installation instructions from the initial support for the A1 and B1 revisions
still apply (c4bfe68c83):
* Configure your client with a static 192.168.1.x IP (e.g. 192.168.1.2).
* Set up a TFTP server on your client and make it serve the initramfs
image.
* Connect serial, power up the switch, interrupt U-boot by hitting the
space bar, and enable the network:
> rtk network on
* Since the GS1900-10HP is a dual-partition device, you want to keep the
OEM firmware on the backup partition for the time being. OpenWrt can
only boot off the first partition anyway (hardcoded in the DTS). To
make sure we are manipulating the first partition, issue the following
commands:
> setsys bootpartition 0
> savesys
* Download the image onto the device and boot from it:
> tftpboot 0x84f00000 192.168.1.2:openwrt-realtek-generic-zyxel_gs1900-8hp-b2-initramfs-kernel.bin
> bootm
* Once OpenWrt has booted, scp the sysupgrade image to /tmp and flash it:
> sysupgrade /tmp//tmp/openwrt-realtek-generic-zyxel_gs1900-8hp-b2-squashfs-sysupgrade.bin
Alternatively, after factory-resetting the switch, you can:
* Log in to OEM management web interface. It should be at http://192.168.1.1
* Navigate to `Maintenance > Firmware > Management`
* If "Active Image" has the first option selected, OpenWrt will need to be
flashed to the "Active" partition. If the second option is selected, OpenWrt
will need to be flashed to the "Backup" partition.
* Navigate to `Maintenance > Firmware > Upload`
* Upload the initramfs-kernel.bin file by your preferred method to the previously
determined partition. When prompted, select to boot from the newly flashed image,
and reboot the switch.
* Once OpenWrt has booted, scp the sysupgrade.bin image to /tmp and flash it thought SSH.
- OpenWrt does not include openssh-sftp-server by default. If your SCP client fails due
to lacking an SFTP server on the device, consider using the legacy SCP protocol
instead. With OpenSSH's scp this can be done by adding the -O option on the command
line.
- `sysupgrade -n /tmp/<sysupgrade file name>`
* It may be necessary to restart the network (/etc/init.d/network restart) on the running
initramfs image.
See the GS199-8HP A1 wiki page for more information (https://openwrt.org/toh/zyxel/gs1900-8hp_v1).
Signed-off-by: Peter Putzer <openwrt@mundschenk.at>
Link: https://github.com/openwrt/openwrt/pull/24418
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The patch reverted ath10k/ath11k to iommu_domain_alloc(), which kernel
6.18 removed; iommu_paging_domain_alloc() exists on every kernel this
tree builds. Unnoticed upstream because no 6.18 target builds
ath11k-ahb.
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
Link: https://github.com/openwrt/openwrt/pull/24031
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Tabs were missing from the default button behavior modification blocks,
breaking the build if they were activated.
Signed-off-by: David Bauer <mail@david-bauer.net>
This is required to add available dns servers in ifstatus output,
required by downstream tools to receive information of the configured
DNS server on the wwan interface.
This has no effect on the dns server selection, as peerdns has the
desired effect within netifd.
Signed-off-by: Florian Maurer <f.maurer@outlook.de>
This is required to add available dns servers in ifstatus output,
required by downstream tools to receive information of the configured
DNS server on the wwan interface.
This has no effect on the dns server selection, as peerdns has the
desired effect within netifd.
Signed-off-by: Florian Maurer <f.maurer@outlook.de>
Reset PKG_RELEASE to 1 since the package has been updated to a newer
upstream version. This reset was missed during update.
Fixes: 345404476a ("hostapd: update to 2026-07-09")
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
From datasheet: "The INA3221 is a three-channel, high-side current and
bus voltage monitor with an I2C- and SMBUS-compatible interface."
Signed-off-by: Steffen Loley <slo-src@web.de>
Link: https://github.com/openwrt/openwrt/pull/24361
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The CPU port between the MT7981 and MT7531 runs at 2.5 Gbps, but the U-Boot
device tree configures it as SGMII at 1 Gbps. This leaves Ethernet unable
to exchange packets despite an active physical link.
Use 2500base-x and a 2500 Mbps fixed link, matching the Linux device tree.
Fixes: a3105d3f95 ("mediatek: filogic: add support for Globitel BT-R320")
Signed-off-by: Bogdan K <zikwarface134@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24372
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Upstream prefers fwnode helpers instead of OF ones (already done). This is
important for software nodes, which upstream is migrating to for its non
OF devices.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24348
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2aa1640 block: preen a registered volume before mount on request
d43ffba block: use preen mode for the f2fs filesystem check
a71e97d blockd: do not let a slow startup helper hold back readiness
1c17d24 blockd: expose storage readiness via a queryable status method
f60b3a3 blockd: pass registrant mount options down to block on autofs mount
998f6ab blockd: notify when an idle autofs mount is unmounted
0008996 block: mount ubus-registered devices without an fstab entry
4fd1502 blockd: coldplug block devices
89a6f52 blockd: retry interrupted waitpid() in synchronous block() helper
37cf94d blockd: fix bounds of the ubus event name buffer
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The GS1900-24E B1 is a different hardware revision, not merely a
front-panel relabel as suggested by Zyxel's user guide. Verified
differences vs. A1 (sources: TechInfoDepot for A1 spec data,
https://techinfodepot.shoutwiki.com/wiki/ZyXEL_GS1900-24E):
* PCB: 37ZY-GM2430+212 V1.2 (A1: 37ZY-G724DO+412 V.12)
- different board part number, not a stepping of the same one
* RAM: 128 MiB DDR3, A1: 128 MiB DDR2
* Flash: mx25l12805d, 16 MiB (A1: 16 MiB SPI-NOR)
* External PHYs: RTL8218D (A1: unknown)
* Rear power switch: absent on this B1 unit (inlet only). A1 is
described as having one in the *title* of openwrt/openwrt#18620,
but that issue does not explicitly identify the affected hardware
as "A1" specifically, nor is it confirmed by a spec sheet or photo
* ZYXEL_VERS firmware family unchanged (AAHK)
The existing MDIO bus addressing and switch-port SerDes layout
from -a1.dts work unmodified on B1, since the PHY driver
identifies the external chip by ID registers at runtime rather
than from DT compatible string, regardless of what chip A1
actually uses.
Deliberately omits the gpio0 mdio-reset gpio-hog present in
-a1.dts (ba57225066, #18620) pending confirmation it's needed on
B1's differing reset-line topology. Tagged 802.1Q VLAN traffic
tested clean across software reboot and full AC power-cycle, on
both kernel 6.6/24.10.5 and current master (6.18), with no sign
of the #18620 stuck-RX regression.
Encapsulates the two external RTL8218D PHY packages per the tree-wide
ethernet-phy-package conversion for RTL8218x chips; ports 8-15 use the
SoC-integrated PHY block and aren't part of an external package.
Signed-off-by: Joshua Covington <joshuacov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24377
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Do not pull iptables core for kmod-sched-ctinfo, only nf-conntrack,
reflecting kernel config dependencies.
There is no use of this module in openwrt repos, but it is used by
@hudra0 qosmate
and some less popular qos scripts.
Signed-off-by: Andris PE <neandris@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24104
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The path field of a board.json wlan entry may now be an array of
device paths. ucidef_add_wlan accepts several leading path arguments
and stores them as a JSON array; a single path is still stored as a
plain string for backwards compatibility. A phy is matched if it
corresponds to any of the listed paths, so a radio that enumerates on
a non-deterministic PCI path still resolves to the correct named phy.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Direct-I2C driver for the HS104 PSE chip (unlike the MCU-fronted
realtek-pse-mcu family). Packaged as kmod-pse-hasivo-hs104.
This driver will be submitted upstream once the pending PSE-core
patches it builds on (above) have landed.
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Link: https://github.com/openwrt/openwrt/pull/22245
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add kmod packages to support accessing the fTPM (in-firmware TPM) which
can be implemented in the boot firmware of most modern platforms.
- kmod-optee: Open Portable Trusted Execution Environment
- kmod-optee-rng: OP-TEE random number generator client
- kmod-rtc-optee: OP-TEE real-time clock client
- kmod-scmi-transport-optee: SCMI OP-TEE transport
- kmod-tee: Generic Trusted Execution Environment
- kmod-tee-stmm-efi: EFI variable service Trusted Application
- kmod-tpm-ftpm-tee: Microsoft fTPM Trusted Application
Using the TPM 2.0 can be useful for various security applications,
such as encrypting on-disk credentials. OP-TEE itself alone is also
useful as it can provide a PKCS#11 token for authentication (eg. to
connect to a VPN) and significantly lower the risk of leaking secrets
used for authentication. Also, on some platforms RNG and RTC can only be
accessed via OP-TEE, and some ARM SystemReady platforms require EFI
variables to be access via a TA.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The two packages rtl826x-firmware and rtl826x-lp-firmware are built
from the same source, yet have 'VERSION=xxx' overrides that modify
the package name and metadata. This causes issues with apk, as
it always selects the package with the higher version number (the
'-lp-' one), irrespective of which package is desired.
Remove the VERSION overrides and use the actual package version so
that apk can install the correct package. The binary contents of
the packages remain unaffect, this only changes the package file
name and metadata related to versioning.
Before
rtl826x-firmware-20221115.apk
rtl826x-lp-firmware-20240729.apk
After
rtl826x-firmware-2026.01.24~0cd4abe2-r4.apk
rtl826x-lp-firmware-2026.01.24~0cd4abe2-r4.apk
Fixes: https://github.com/openwrt/openwrt/issues/24145
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24201
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Scripts need the map type to know how to interact with a map, e.g.
per-CPU value handling or keyless queue/stack semantics. Add an
info() map method returning type, key/value size and max_entries,
along with BPF_MAP_TYPE constants for comparison.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Add consumer support for BPF_MAP_TYPE_RINGBUF and
BPF_MAP_TYPE_PERF_EVENT_ARRAY maps. ringbuf(callback) and
perf_buffer(callback, pages, lost_callback) map methods return a
buffer resource with fileno, poll and consume methods. The fileno
method exposes the epoll fd and matches the interface uloop.handle()
expects, so a buffer can be passed directly to uloop for event loop
integration.
The ring buffer callback receives the sample data and may return a
negative integer to stop consumption; the perf callbacks additionally
receive the CPU number.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Updates on array/hash-of-maps and prog array maps take the fd of the
inner object as a 4-byte value. Accept bpf.map and bpf.program
resources as map values and convert them to their fd.
Lookups on map-in-map types return the inner map id; add open_map_id
and open_program_id to obtain a usable object from such an id.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Queue and stack maps have zero-sized keys and require a NULL key
pointer; the kernel rejects any non-NULL key with EINVAL, making
these maps unusable. Accept a null key argument on maps without a
key, mapping get() to peek, set() to push and delete() with return
to pop.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lookup, update and lookup-and-delete on per-CPU maps use buffers of
roundup(value_size, 8) * num_possible_cpus bytes. The previous code
sized buffers for a single value, so get() on a per-CPU map made the
kernel overflow the stack buffer and set() passed undersized data.
Track the map type and size the buffers accordingly. get() and
delete() with return now yield an array with one value per CPU, set()
accepts either such an array or a single value replicated to all
CPUs.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Failures in the detach path returned NULL without recording any error
state, so error() reported a stale or empty error. Attach failures
reported a hardcoded ENOENT regardless of the actual cause. Record
errno for all failures; if_nametoindex, bpf_tc_attach and
bpf_tc_detach all set it.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
bpf_object__next_map does not set errno when it runs out of maps, so
the reported error code was whatever errno happened to hold. With
errno 0 the failure was invisible to error(). Report ENOENT instead.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The iterator key buffer is a flexible array member placed directly
after a bool, leaving it without natural alignment for the u32/u64
loads in next_int. Copy the key via memcpy instead of dereferencing
a misaligned pointer, which traps on strict-alignment targets.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
uc_bpf_map_arg converted integer arguments through a single static
buffer. When map set was called with both an integer key and an integer
value, the second conversion overwrote the first, so the element was
written at the wrong key. Convert into a caller-provided buffer
instead.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
uc_fn_thisval can return NULL when a method is called with a foreign or
missing this context. pin, foreach and the iterator next functions
dereferenced the result without checking it, crashing the VM.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Add support for the Comfast CF-EW84 based on the MediaTek MT7621
SoC.
Hardware:
CPU/SoC: MediaTek MT7621DA
RAM: 128 MB DDR3
Flash: Macronix MX25L12805D 16 MB
Switch: MediaTek MT7530
WiFi 2.4 GHz: MediaTek MT7603E
WiFi 5 GHz: MediaTek MT7613B
Ports: 1x WAN, 2x LAN (10/100/1000 Mbps)
LEDs: Power, WAN, LAN1, LAN2, WLAN
Buttons: Reset
UART: through-hole on PCB
pinout: RX, TX, GND, 3.3V
settings: 115200n8
Flash instructions:
1. Connect the bundled PoE injector to power.
2. Connect the PC to the LAN1 or LAN2 port of the device.
3. Configure a static IP on the computer's Ethernet adapter:
IP: 192.168.1.x (x = 2 to 254)
Mask: 255.255.255.0
Gateway: empty
DNS: empty
4. Connect a second Ethernet cable to the PoE port of the
bundled injector.
5. Press and hold the reset button on the device.
6. While holding the reset button, plug the other end of the
second Ethernet cable into the WAN port.
7. Wait at least 3 seconds, then release the reset button.
8. Browse to http://192.168.1.1: the MediaTek U-Boot System
Recovery page should appear.
9. Click Upload and select the *-sysupgrade.bin firmware file.
10. After flashing completes, browse to http://192.168.1.1
again: the LuCI login page should appear.
Factory data:
2.4 GHz EEPROM: factory offset 0x0000
5 GHz EEPROM: factory offset 0x8000
LAN MAC address: factory offset 0xe000
WAN MAC address: factory offset 0xe000 (+1)
LED layout:
The Comfast CF-EW84 has five physical LEDs, but only the WLAN
LED is software-controllable through the Linux GPIO-LEDs
subsystem.
Signed-off-by: Vincenzo Suraci <vincenzo.suraci@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24112
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The GS1900-10HP B1 keeps the RTL8380M SoC and port layout but replaces the
A1's Broadcom PoE (Gen1) with a Realtek RTL8238 PSE fronted by a Nuvoton
MCU speaking the Gen2 protocol at 115200 baud. It reuses the shared
rtl8380_zyxel_gs1900-10hp.dtsi and only overrides the PSE compatible and
UART speed.
Specifications:
- SoC: Realtek RTL8380M
- Ports: 8x 10/100/1000 (PoE+), 2x SFP
- PoE: Realtek RTL8238 via Nuvoton MCU (Gen2, UART 115200)
Tested on hardware: driver probes RTL8238B (8 ports), per-port control via
ethtool, verified across a cold power-cycle.
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Link: https://github.com/openwrt/openwrt/pull/24283
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit adds initial support for Nokia XG-040G-MF XG-PON ONU.
Specification
-------------
- SoC : Airoha AN7583DT (dual-core ARM Cortex-A53 1.2 GHz)
- RAM : 512 MiB DDR4 (Winbond W664GG6RB-06)
- Flash : SPI-NAND 256 MiB (GigaDevice GD5F2GM7UEYIG)
- WLAN : -
- Ethernet : 1x 2500 Mbps (LAN1, Airoha EN8811HN)
3x 10/100/1000 Mbps (LAN2-LAN4, Airoha AN7583 SoC switch)
- XG-PON : ECONET EN7572, SLIC: MaxLinear PEF32001VSV12
- USB : 1x USB2 (with power control via gpio)
1x USB3 (with power control via gpio)
- Buttons : Reset
- LEDs : 1x Power (green)
1x WAN (green)
1x WAN (red)
4x LAN (green)
2x USB (green)
- Power : 12 VDC, 1 A
Unsupported functions, limitations and known issues
---------------------------------------------------
1. XG-PON won't be available after installing OpenWrt.
2. USB ports: AN7583 SoC in OpenWrt doesn't support USB at this time.
Installation (UART)
-------------------
1. Attach UART and run picocom:
picocom -b 115200 --send-cmd "sb -vv" /dev/ttyUSB0
2. Interrupt boot process by pressing Enter key to enter u-boot
Username: telecomadmin
Password: nE7jA%5m
3. Start download firmware via ymodem protocol (via UART):
loady 0x85000000
4. Press Ctrl + A then Ctrl + S in the picocom terminal (if you are using
a different terminal, please refer to the documentation) to start
upload OpenWrt initramfs image using ymodem protocol. Enter local path
to the OpenWrt initramfs image and press Enter.
5. Load OpenWrt initramfs image from the memory:
bootm 0x85000000
5. Sysupgrade with OpenWrt sysupgrade image
Alternative for the p.3-4. Load and boot OpenWrt initramfs from tftp IP
192.168.1.254:
tftpboot 0x85000000 192.168.1.254:openwrt-initramfs-uImage.itb
bootm 0x85000000
Backup and installation (without UART)
--------------------------------------
1. Unplug Fiber
2. Make ONU Reset
3. Navigate: http://192.168.1.1
Username: CMCCAdmin
Password: aDm8H%MdA
4. Go to Apps -> Home Storage -> FTP and check Enable FTP
5. Go to Apps -> Home Storage -> SAMBA Sharing and check Enable Samba
6. Visit the following URL to open Telnet:
http://192.168.1.1/system.cgi?telnet
7. Telnet account login:
Username: user
Password: <see ONU label>
8. Get root privileges:
su user_ftp
Password: <see ONU label>
9. Copy 'squashfs-factory-kernel.bin', 'squashfs-factory-rootfs.bin' and
'OpenWrt.mtd2.u-boot-env.bin' (backup of 'u-boot-env' partition from
the another Nokia XG-040G-MF with OpenWrt installed)
9. Attach USB flash drive and check the new dir in /mnt:
ls /mnt
10. Change current dir to the flash drive (change D to your flash drive
label):
cd /mnt/D
11. Make backup:
for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16; \
do cat /dev/mtd$i | gzip -9 > mtd$i.bin.gz; done
12. Check image sizes:
ls -l | awk '{if(NR>1) {$5=sprintf("0x%x", $5); print}}'
13. Write images:
mtd_debug erase /dev/mtd0 0x60000 0x20000
mtd_debug write /dev/mtd0 0x60000 0x20000 OpenWrt.mtd2.u-boot-env.bin
mtd_debug erase /dev/mtd14 0x0 0x2880000
mtd_debug write /dev/mtd14 0x0 0x3e6cfc squashfs-factory-kernel.bin
mtd_debug erase /dev/mtd11 0x0 0x80e0000
mtd_debug write /dev/mtd11 0x0 0x440000 squashfs-factory-rootfs.bin
0x3e6cfc - size of your 'squashfs-factory-kernel.bin'
0x440000 - size of your 'squashfs-factory-rootfs.bin'
14. Reboot:
reboot
Recovery
--------
The same as described in Installation (UART).
Return to stock
---------------
1. Follow the steps 1-5 of the Installation (UART)
2. Once in OpenWrt upload you backup to the /tmp dir of the router:
scp -O mtd16.bin.gz root@192.168.1.1:/tmp
5. Connect to the router using ssh and install kmod-mtd-rw:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
6. Unlock bootloader:
mtd unlock bootloader
7. Restore stock:
zcat /tmp/mtd16.bin.gz | mtd write - all_flash
8. Reboot:
reboot
Stock layout
------------
+-------+------------+---------+---------+
| mtd | label | start | size |
+-------+------------+---------+---------+
| mtd0 | bootloader | 0 | 80000 |
| mtd1 | romfile | 80000 | 40000 |
| mtd14 | nsb_master | c0000 | 2880000 |
| mtd15 | nsb_slave | 2940000 | 2880000 |
| mtd6 | bosa | 51c0000 | 40000 |
| mtd7 | ri | 5200000 | 40000 |
| mtd8 | flag | 5240000 | 40000 |
| mtd9 | flagback | 5280000 | 40000 |
| mtd10 | config | 52c0000 | a00000 |
| mtd11 | data | 5cc0000 | 80e0000 |
| mtd12 | oopsfs | dda0000 | 400000 |
| mtd13 | log | e1a0000 | a00000 |
+-------+------------+---------+---------+
UART
----
A view from the back side of the PCB:
------------------------
| GND RX TX
| X X X
Connection parameters:
115200, 8N1, 3.3V
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | e0:xx:xx:xx:xx:a0 | label |
| WAN | e0:xx:xx:xx:xx:a1 | label + 1 |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'ri', 0x3e
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23809
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
