Hal Martin [Wed, 18 Feb 2026 18:11:54 +0000 (19:11 +0100)]
ipq40xx: add support for Cisco Meraki MR70
This commit adds support for the Cisco Meraki MR70/Go GR60.
The Meraki MR70 is a Cisco 802.11ac/WiFi 5 outdoor AP with 1 Ethernet port.
It can be powered by a 12V DC barrel jack (5.5x2.5mm, center positive)
or via 802.3af POE.
The Meraki Go GR60 (codename: Dungbeetle Omni) is identical to the MR70
(codename: Toe Biter Omni), so this document will refer to both devices
as the MR70.
This device ships with secure boot, and cannot be flashed without
external programmers (TSOP48 NAND and I2C EEPROM)!
Disassembly:
Note: This is an outdoor device that is ultrasonically welded and glued
to weather seal it. Disassembly will compromise the weather seal!
Start by removing the product label on the rear metal mounting plate.
There are four Torx T8 screws under the sticker, remove the screws and
the mounting plate. Remove the two Philips screws under the plate.
Using a chisel (or razor blade) and hammer, cut around the circumfrence
of the device. You need to cut through approximately 2mm of
ultrasonically welded plastic.
After cutting through the plastic, heat the device using a hair drier
(or similar) to soften the glue. A heatgun is NOT recommended as
it will damage the plastic. It is only required to heat the device until
warm (~40C-50C).
Using a plastic pry tool, insert it along the cut you made around
the edge and gently separate. Insert a guitar pick into the opening
while gently lifting the front to cut the glue. The device is glued around
the entire circumfrence.
Once you have removed the plastic front, remove the 4 Philips screws
holding down the main PCB. Release the two WiFi antennas by gently
bending the antenna PCBs to the middle of the unit and pulling up.
Lift the top of the PCB gently while pushing the Ethernet port into the
housing to release it. Turn the PCB over and remove the three Philips
screws holding the metal heat spreader.
The TSOP48 NAND flash (U9, S34ML01G200 or W29N01HV) is located
under the metal heat spreader.
To flash, you need to desolder the TSOP48 or use a 360 clip.
You also need to reprogram the I2C EEPROM (U20, Atmel 24c64). It is not
necessary to desolder the I2C EEPROM, a ch341a USB programmer and SOP-8
clip are inexpensive (~$10) and work well.
Installation:
The dumps to flash can be found in this repository:
https://github.com/halmartin/meraki-openwrt-docs/tree/main/mr70_gr60
The device has the following flash layout (offsets with OOB data):
```
0x000000000000-0x000000100000 : "sbl1"
0x000000100000-0x000000200000 : "mibib"
0x000000200000-0x000000300000 : "bootconfig"
0x000000300000-0x000000400000 : "qsee"
0x000000400000-0x000000500000 : "qsee_alt"
0x000000500000-0x000000580000 : "cdt"
0x000000580000-0x000000600000 : "cdt_alt"
0x000000600000-0x000000680000 : "ddrparams"
0x000000700000-0x000000900000 : "u-boot"
0x000000900000-0x000000b00000 : "u-boot-backup"
0x000000b00000-0x000000b80000 : "ART"
0x000000c00000-0x000007c00000 : "ubi"
```
* Dump your original NAND (if using nanddump, include OOB data).
* Decompress `u-boot.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `u-boot` portion of NAND from
`0x738000`-`0x948000` (length `0x210000`). Offsets here include OOB data.
* Decompress `ubi.bin.gz` dump from the GitHub repository above (dump
contains OOB data) and overwrite the `ubi` portion of NAND from
`0xc60000-0x7fe0000` (length `0x7380000`). Offsets here include OOB data.
* Dump your original EEPROM. Change the byte at offset `0x49` to `0x1e`
(originally `0x2d` or `0x26`). Remember to re-write the EEPROM with the
modified data.
* This can be done on Linux via the following command:
`printf "\x1e" | dd of=/tmp/eeprom.bin bs=1 seek=$((0x49)) conv=notrunc`
**Note**: the device will not boot if you modify the board major number and
have not yet overwritten the `ubi` and `u-boot` regions of NAND.
* Resolder the NAND after overwriting the `u-boot` and `ubi` regions.
OpenWrt Installation:
* After flashing NAND and EEPROM with external programmers. Plug in an
Ethernet cable and power up the device.
* The new U-Boot build uses the space character `" "` (without quotes) to
interrupt boot.
* Interrupt U-Boot and `tftpboot` the OpenWrt initramfs image from your
tftp server
```
dhcp
setenv serverip <your_tftp>
tftpboot openwrt-ipq40xx-generic-meraki_mr70-initramfs-uImage.itb
```
* Once booted into the OpenWrt initramfs, created the `ART` ubivol with
the WiFi radio calibration from the mtd partition:
```
cat /dev/mtd10 > /tmp/ART.bin
ubiupdatevol /dev/ubi0_1 /tmp/ART.bin
```
* `scp` the `sysupgrade` image to
the device and run the normal `sysupgrade` procedure:
```
scp -O openwrt-ipq40xx-generic-meraki_mr70-squashfs-sysupgrade.bin root@192.168.1.1:/tmp/
ssh root@192.168.1.1 "sysupgrade -n /tmp/openwrt-ipq40xx-generic-meraki_mr70-squashfs-sysupgrade.bin"
```
Maxim Anisimov [Mon, 16 Feb 2026 09:58:36 +0000 (12:58 +0300)]
mediatek: dts: drop wrong sgmiisys0 node override
The sgmiisys0 override uses
/delete-node/ mediatek,pnswap;
but mediatek,pnswap is a property, not a child node. The correct
directive would be /delete-property/. As a result, this statement never
had any effect and the property was never removed.
Changes:
* update to v2026.01 (this brings up EN7523 SoC support)
* drop upstream patches
* refresh and adapt an7583 support patches (changes based on
https://github.com/Ansuel/openwrt/commits/main-airoha-6.12/)
* add ethernet switch mdio support from upstream U-Boot
Notable changes:
* make an7583 memory initialization similar to an7581 one
* add an7583 scu/chip_scu helpers to access scu/chip_scu regmaps.
* fix misprint in an7583 'system-controller@1fb00000' node name
* always use board dts for nand partitioning
Notes about en7523 support
--------------------------
This set of patches brings up more or less complete support of EN7523 SoC.
Unfortunately, building of en7523 bootloader will require en7523-bl2.bin
and en7523-bl31.bin blobs which is not available at the moment.
This is the only known blocker for adding en7523 bootloader support.
Installation
-----------------
1. Telnet method
a. Enable telnet
Log in to http://192.168.10.1/ with the password on the sticker
Modify URL according to example (keep your unique hash after ";stok=")
and press Enter:
http://192.168.10.1/cgi-bin/luci/;stok=78becad1b1490e45be2776025cde2b7d/api/NPCnetwork/ping?url=$(telnetd)
You should get the following in the browser:
{"link":0}
b. Run tftp server on IP 192.168.10.254 and put factory image
'openwrt-qualcommax-ipq50xx-cmcc_mr3000d-ci-squashfs-factory.ubi'
in the tftp root dir.
c. Login to 192.168.10.1 with telnet (user: root, pass: from the
sticker).
d. Download factory image from the tftp:
tftp -l factory.ubi -r openwrt-qualcommax-ipq50xx-cmcc_mr3000d-ci-squashfs-factory.ubi -g 192.168.10.254
2. U-Boot Method using UBI Image (using UART)
a. Place the factory.ubi file on your TFTP server, enter U-Boot CLI
and exec these commands:
tftpboot <your_tftp_server_ip>:factory.ubi
flash rootfs
reset
3. U-Boot Method using initramfs Image (using UART)
a. Place the openwrt-*-initramfs-fit-uImage.itb file on your TFTP
server and rename it to initramfs.bin
b. Enable serial console, enter to U-Boot CLI and exec these commands:
tftpboot <your_tftp_server_ip>:initramfs.bin
bootm
c. Once boot completed, upload the sysupgrade.bin file to router's
/tmp directory (using scp or wget) and execute the following command
in openwrt shell:
sysupgrade -n /tmp/sysupgrade.bin
MAC Addresses
-------------
+--------------+-------------------+-------------+
| Interface | MAC example | Location |
+--------------+-------------------+-------------+
| LAN | 84:7a:xx:xx:xx:dd | 0:ART, 0x6 |
| WAN (label) | 84:7a:xx:xx:xx:dc | 0:ART, 0x0 |
| WLAN 2.4 GHz | 84:7a:xx:xx:xx:de | 0:ART, 0xc |
| WLAN 5 | 84:7a:xx:xx:xx:df | 0:ART, 0x12 |
+--------------+-------------------+-------------+
Notes
-----
1. U-Boot is protected by a password (pass: netpower).
Linus Walleij [Fri, 13 Feb 2026 23:44:38 +0000 (00:44 +0100)]
gemini: add support for Teltonika RUT104
Add support for Teltonika RUT104 3G HSUPA router.
This has been supported since about 20 years in the upstream Linux
kernel after initial contribution by Paulius Zaleckas from Teltonika.
It has some historical significance because I think it was one of the
first Teltonika Linux-based 3G routers.
Installation from scratch is done using the UART:
- UART soldering instructions with picture are available on the
Link: (see bottom of committ message).
- First *diet down* your OpenWrt build as minimal as you can,
I really mean this, delete everything you don't need. There
is not much RAM to go around.
- Extract the "factory" firmare which is essentially just a tar.gz
archive:
tar xvfz openwrt-gemini-generic-teltonika_rut104-squashfs-factory.bin
From the RedBoot menu:
- Do NOT UNDER ANY CIRCUMSTANCE try to use the "upgrade firmare" (Z)
alternative!
- Extract the three files zImage, rd.gz and hddapp.tgz from the archive.
- Put these three files in the root directory of your TFTP server
(usually /var/lib/tftpboot)
- Hit 6 and set up the IP address for your device (e.g. 169.254.1.2 if
you're using local link).
- Hit Y to "Upgrade Kernel", enter TFTP and your hosts IP number and
type zImage. The kernel should upload and flash.
- Hit R to "Upgrade Ramdisk", enter TFTP and your hosts IP number and
type rd.gz. The "ramdisk" (i.e. the second part of the kernel)
should upload and flash.
- Hit A to "Upgrade Application", enter TFTP and your hosts IP number
and type hddapp.tgz. The "application" (i.e. the root filesystem)
should upload and flash.
This has a 1024KB Kernel partition, just extend the existing Make
functions to handle also this. The initramfs is 0x500000 instead
of 0x600000 for this one so add a parameter explicitly parameterizing
the initramfs size.
Mark non-default due to the small RAM and flash on this device.
I currently have no idea how to actually talk to the modem on this
thing but it is probably using the high-speed "modem UART" of the
Gemini. I'd be willing to help whoever wants to experiment with
it.
Edward Chow [Sat, 14 Feb 2026 13:10:05 +0000 (21:10 +0800)]
bcm53xx: fix target name of meraki_mx64-a0
The target name of meraki_mx64-a0 in
target/linux/bcm53xx/image/Makefile used not to be consistent with the
one defined in target/linux/bcm53xx/base-files/lib/upgrade/platform.sh
and generates warning for "Image check failed" during sysupgrade.
This commit would also make the target name for meraki_mx64-a0 to
conform to the openwrt standard.
Hauke Mehrtens [Sun, 15 Feb 2026 02:06:53 +0000 (03:06 +0100)]
ath79: add env-size for Sitecom WLR-7100 / WLR-8100 u-boot-env
The Linux kernel assumes that the u-boot environment covers the full
partition, but it only covers 0x1000 bytes. Linux checks the CRC and
does this over the full partition. This fails like this:
```
u-boot-env-layout 1f000000.spi:flash@0:partitions:partition@30000:nvmem-layout: Invalid calculated CRC32: 0xfcac8c41 (expected: 0x14e6335a)
u-boot-env-layout 1f000000.spi:flash@0:partitions:partition@30000:nvmem-layout: probe with driver u-boot-env-layout failed with error -22
```
Define the u-boot environment with a length of 0x1000 bytes to calculate
the CRC only over this area.
When replicating the u-boot environment with these parameters it
generates the same CRC:
```
mkenvimage -p 0 -b -s 0x1000 -o output.bin input.txt
```
Hauke Mehrtens [Sun, 15 Feb 2026 23:49:15 +0000 (00:49 +0100)]
build: pass CPPFLAGS to cmake build
The TARGET_CPPFLAGS contain the include paths used by OpenWrt. This also
contains the including of the fortify sources headers. If they are not
provided, the applications will not use fortify sources headers when
compiled against musl. Add them to cmake builds too. cmake does not
support a special CPPFLGS option [0], just add them to CFLAGS and
CXXFLAGS like we also do it for meson and normal make.
This should fix fortify sources support for cmake builds.
I found this explanation for the flags:
* CFLAGS: C flags, passed during compile AND link
* CXXFLAGS: C++ flags, passed during compile AND link
* CPPFLAGS: pre-processor flags, passed ONLY during compile
* LDFLAGS: linker flags, passed ONLY during link
Hauke Mehrtens [Sun, 15 Feb 2026 15:45:38 +0000 (16:45 +0100)]
fortify-headers: fix -Werror=format-nonliteral in fortify/stdio.h
Some applications might activate -Werror=format-nonliteral when building
their application. This breaks fortify headers build. Tell GCC to ignore
such warnings for this code.
This fixes the libubox and ucode build:
```
/include/fortify/stdio.h: In function 'snprintf':
/include/fortify/stdio.h:101:9: error: format not a string literal, argument types not checked [-Werror=format-nonliteral]
101 | return __orig_snprintf(__s, __n, __f, __builtin_va_arg_pack());
| ^~~~~~
/include/fortify/stdio.h: In function 'sprintf':
/include/fortify/stdio.h:110:17: error: format not a string literal, argument types not checked [-Werror=format-nonliteral]
110 | __r = __orig_snprintf(__s, __b, __f, __builtin_va_arg_pack());
| ^~~
/include/fortify/stdio.h:114:17: error: format not a string literal, argument types not checked [-Werror=format-nonliteral]
114 | __r = __orig_sprintf(__s, __f, __builtin_va_arg_pack());
| ^~~
cc1: all warnings being treated as errors
ninja: build stopped: subcommand failed.
```
Device specific constants belong into the config structure.
No need to initialize them manually during probing within a
family_id switch statement. Although there are lots of constants
that need to be converted start with port_ignore as a simple one.
On RTL930x, RTL931x and even RTL838x the smi topology is
configured very similar. There is a bus mapping (RTL930x
and RTL931x) and a port mapping (all three). Define a
common helper that can take care of this setup and call
it before bus registration.
Jonas Jelonek [Wed, 11 Feb 2026 13:15:10 +0000 (13:15 +0000)]
realtek: pcs: rtl931x: don't mess with autoneg
Part of the configuration sequence for 1G operation can be identified as
setting autonegotiation to enabled for that mode. Starting from a previous
commit, this is being handled properly in the set_autoneg implementation.
Thus, remove that part from the sequence which doesn't make sense there
anymore and might just cause problems.
Jonas Jelonek [Wed, 11 Feb 2026 12:23:03 +0000 (12:23 +0000)]
realtek: pcs: adjust autoneg to fix RTL931x issue
The autonegotiation setting might not have been working for RTL931x the
whole time. While there weren't any reports about issues so far, these
issues might just have been hidden behind other circumstances.
While all other variants of the Otto family have the corresponding
settings in [page 0x2 register 0x0] of a SerDes, RTL931x has a special
Front/Background SerDes architecture and actually moved the
autonegotiation settings to a digital Background SerDes. Since we use a
special mapping to have a consistent view on these Background SerDes,
RTL931x needs to write the settings to another page.
To fix this, adjust the autonegotiation setting for all variants. The
generic implementation is kept but uses per-variant register field
definitions. Those are added for all variants here, with the differing
page for RTL931x.
Another static data definition is renamed since it conflicts with a
change introduced here.
Jonas Jelonek [Fri, 13 Feb 2026 22:05:32 +0000 (22:05 +0000)]
realtek: pcs: add SerDes register struct and use it
Slight differences between the variants of the Otto family are handled
so far handled using function indirection by defining per-variant
operations which are called from generic implementations. In several
case, this can still be optimized because the variants only differ in
some register addresses and/or bits while the procedure otherwise is
exactly the same.
To address this, add a new SerDes register struct where register fields
can be described and later used by generic implementations which otherwise
would need to be separate just because of slight differences. Add two
register fields for autonegotiation to that register struct which are
used by a successing patch to address a real issue.
ipq40xx: move Device DTS to dedicated DTS directory
Align the ipq40xx target to the pattern already used on other devices where
the device DTS are placed in a dedicated directory separate from the files
directory.
This, while trying to enforce a common pattern for every target, also permits to
do modification to device DTS without having to trigger a recompilation of the
entire kernel (as the files directory is not touched)
ipq806x: move Device DTS to dedicated DTS directory
Align the ipq806x target to the pattern already used on other devices where
the device DTS are placed in a dedicated directory separate from the files
directory.
This, while trying to enforce a common pattern for every target, also permits to
do modification to device DTS without having to trigger a recompilation of the
entire kernel (as the files directory is not touched)
qualcommbe: move Device DTS to dedicated DTS directory
Align the qualcommbe target to the pattern already used on other devices where
the device DTS are placed in a dedicated directory separate from the files
directory.
This, while trying to enforce a common pattern for every target, also permits to
do modification to device DTS without having to trigger a recompilation of the
entire kernel (as the files directory is not touched)
qualcommax: move Device DTS to dedicated DTS directory
Align the qualcommax target to the pattern already used on other devices where
the device DTS are placed in a dedicated directory separate from the files
directory.
This, while trying to enforce a common pattern for every target, also permits to
do modification to device DTS without having to trigger a recompilation of the
entire kernel (as the files directory is not touched)
ramips: remove obsolete SPI flash nodes after kernel fix
Remove incomplete SPI flash definitions from affected device tree files.
These fragments only defined address-cells and size-cells without any
actual flash configuration (partitions, compatible string, etc.).
After applying openwrt/openwrt#20942 ("kernel: of: fix bad cell count error
for SPI flash node"), the kernel properly handles SPI flash nodes without
requiring these incomplete definitions in device-specific DTS files.
This cleanup eliminates unnecessary code that was likely a workaround for
the previous kernel issue.
Rany Hany [Sun, 15 Feb 2026 16:29:17 +0000 (16:29 +0000)]
wifi-scripts: ucode: fix ieee80211w default
This should not be defaulted to anything in the schema.
What seemed like a minor cleanup actually broke this
as the schema defines a default value already. I did
not notice as I had this explictly set in my config.
Fixes: 70ba7512 ("wifi-scripts: ucode: allow sae_pwe to be modified for AP mode") Signed-off-by: Rany Hany <rany_hany@riseup.net> Link: https://github.com/openwrt/openwrt/pull/22043 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Jonas Jelonek [Sun, 8 Feb 2026 16:17:49 +0000 (16:17 +0000)]
realtek: pcs: rtl930x: drop conditional SerDes setup
We can now setup most of the modes for RTL930x, recently XSGMII, QSGMII
and USXGMII-SX have been added. Thus we don't need a big list of allowed
modes anymore in SerDes setup. Drop this without replacement. Other
modes are still rejected in other places or will be rejected later with
a proper SerDes capability handling.
Add everything that's needed to setup QSGMII mode on the 5G SerDes. This
includes patch sequences, additions to symbol error reset and read, and
allowing this mode during SerDes setup.
Add everything that's needed to setup USXGMII-SX mode (10G single port
USXGMII). This includes patch sequences and adjustments to the symbol
error reset and reading, and allowing it in the SerDes setup.
realtek: mdio: initialize RTL930x mac type control
For each port (or port group) the mdio bus needs to define the
PHY type that is attached to it. There are the following bit
values that need to be set in SMI_MAC_TYPE_CTRL.
SerDes ports are out of scope of the mdio driver and are handled
by the PCS driver. So the corresponding bits are untouched. That
is not good as the register default is 0x3 for ports 0-23. To
make it simple: Without proper setup devices that have SerDes
driven fiber ports at address 0-23 do not poll in the right way.
Link detection is broken.
Fix this by initializing the register to zero. This way all ports
that are not setup by the mdio driver default to "SerDes". That
should be a reasonable assumption.
Fixes: b271735 ("realtek: mdio: Simplify RTL930x phy polling setup") Reported-by: Joe Holden <jwh@zorins.us> Suggested-by: Jonas Jelonek <jelonek.jonas@gmail.com> Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://github.com/openwrt/openwrt/pull/22032 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
A backport commit was missing which was backported upstream with
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.12.71&id=4ce768ac429ec1c2d4ba63a408fed454ed12b248
kernel: backport crypto selftests for some ciphersuites
FIPS 140-3 recommends that all crypto implementations should be tested
before first use. Testmanager performs initial tests based on existing
test vectors. Not all algorithms have defined test vectors, so to improve
this situation, this commit backports recently added test vectors for
three cipher suites:
* authenc(hmac(md5),cbc(des3_ede)),
* authenc(hmac(sha224),cbc(aes)),
* authenc(hmac(sha384),cbc(aes)).
These vectors were calculated using a software implementation and then
double-checked on Mediatek MT7981 (safexcel) and NXP P2020 (talitos).
Both platforms passed self-tests.
Ahmed Naseef [Mon, 9 Feb 2026 13:57:35 +0000 (17:57 +0400)]
econet: en7528: add PCIe and WiFi support
Add PCIe controller and PHY support for EN7528 SoC. This includes
a new PCIe PHY driver, EN7528-specific startup in the MediaTek PCIe
controller, and a fix for bogus prefetch window reads on bridges
that do not implement the registers.
Enable WiFi for the DASAN H660GM-A board with MT7603 (2.4 GHz) and
MT7615/MT7663 (5 GHz).
Ahmed Naseef [Sat, 7 Feb 2026 12:02:25 +0000 (16:02 +0400)]
econet: en7528: add GPIO and LED support for DASAN H660GM-A
Enable the Airoha EN7523 GPIO driver for EN7528 and add GPIO
controller nodes to the EN7528 DTSI. Add LED, button and GPIO
definitions for the DASAN H660GM-A board.
Ahmed Naseef [Sat, 7 Feb 2026 10:51:53 +0000 (14:51 +0400)]
econet: en7528: add basic ethernet support
EN7528 shares the same clock/reset controller as EN7523. Enable
COMMON_CLK_EN7523 and RESET_CONTROLLER for ethernet hardware resets.
Update econet-eth driver and add it as default package.
Install via OEM web UI:
1. Login to the factory web UI with username "superuser"
and password "Dz$!A!r7".
2. Rename the OpenWrt image
openwrt-econet-en7528-dasan_h660gm-a-squashfs-tclinux.trx
to G_ONU_openwrt.bin.
3. Upload the renamed image via the firmware upgrade page
at Maintenance > Firmware Upgrade in the factory web UI.
Ahmed Naseef [Tue, 30 Dec 2025 04:57:29 +0000 (08:57 +0400)]
econet: image: add little endian TRX support for EN7528
The EN7528 SoC uses a little endian MIPS architecture, unlike the big
endian EN751221 family. The tclinux TRX firmware format stores multi-byte
fields in the CPU's native byte order, requiring different header layouts
for each architecture:
- Big endian (EN751221): magic "2RDH", fields in big endian order
- Little endian (EN7528): magic "HDR2", fields in little endian order
Update tclinux-trx.sh to support both endianness variants:
- Add --endian parameter to select byte order (default: be)
- Add --model parameter for optional platform identifier field
- Convert to named parameters for clarity and extensibility
- Use hex32() helper for endian-aware 32-bit field output
Move TRX_ENDIAN configuration to subtarget files, allowing each subtarget
to specify its native byte order:
- en751221.mk: TRX_ENDIAN := be
- en7528.mk: TRX_ENDIAN := le
Ahmed Naseef [Wed, 10 Dec 2025 15:14:45 +0000 (19:14 +0400)]
econet: en75_bmt: add configurable BBT table size
Different vendor firmware versions use different BBT table sizes. The
checksum is calculated over the entire table, so the size must match
what the bootloader expects.
The Genexis Platinum-4410 bootloader was compiled with a BBT table
size of 250 entries (MAX_RAW_BAD_BLOCK_SIZE as found in vendor code).
Without this fix, the BBT checksum validation fails:
[ 0.391948] spi-nand spi0.0: Dosilicon SPI NAND was found.
[ 0.397651] spi-nand spi0.0: 128 MiB, block size: 128 KiB, page size: 2048, OOB size: 64
[ 0.407370] en75_bmt: found BMT in block 1023
[ 0.450160] en75_bmt: BBT not found and econet,can-write-factory-bbt is unset, giving up
Add a new DTS property 'econet,bbt-table-size' to configure the BBT
table size. If not specified, defaults to 1000.
After this patch:
[ 0.407021] en75_bmt: found BMT in block 1023
[ 0.449159] en75_bmt: found BBT in block 943
[ 0.453491] en75_bmt: BBT & BMT found
[ 0.457152] en75_bmt: blocks: total: 1024, user: 943, factory_bad: 0, worn: 0 reserve: 81
[ 0.465390] en75_bmt: 117 MiB usable space
Ahmed Naseef [Mon, 29 Dec 2025 09:12:20 +0000 (13:12 +0400)]
econet: add EN7528 subtarget support
The EN7528 is a little endian dual-core MIPS 1004Kc SoC used in xPON
devices. Unlike the big endian EN751221, EN7528 uses the MIPS GIC
interrupt controller for SMP.
This adds minimal boot support for EN7528:
- New en7528 subtarget with mipsel architecture
- Kernel patches for EN7528 SoC with GIC support
- Timer driver extended to support GIC shared interrupts per CPU
- SPI driver fix for EN7528 chip select handling
- Generic device tree for initial bring-up
Rany Hany [Sat, 14 Feb 2026 09:12:19 +0000 (11:12 +0200)]
6in4: improve HE tunnel update procedure
- uclient-fetch timeout bumped from 5s to 15s. If we do not do this
we get flagged by HE as the update request is expensive and takes
more than 5s to execute. Currently 5s timeout causes uclient-fetch
to be killed prematurely as can be seen by the following log:
Jonas Jelonek [Tue, 10 Feb 2026 13:56:27 +0000 (13:56 +0000)]
realtek: pcs: rtl931x: fix SerDes link status reading
Fix the function for reading the SerDes link status to work correctly
based on the code the SDK uses. This is mostly for the sake of
documentation and quick access to the information. The function isn't
used currently but may be in the future, thus no functional change here.
Jonas Jelonek [Tue, 10 Feb 2026 13:52:20 +0000 (13:52 +0000)]
realtek: pcs: rtl931x: add 2500Base-X mode
Add 2500Base-X handling to mode setting which was rejected with
-ENOTSUPP before. SDK code available to us doesn't have the proper mode
value. Though by brute-forcing different mode values, 0x2d was found to
make a 2500Base-X link work.
This was tested with an otherwise correctly configured RTL8221B PHY
which is automatically switched between 2500Base-X and SGMII in the
upstream driver. Though, since there was a previous U-Boot setup for the
PHY in HISGMII mode, it may not be standalone yet.
Maxim Anisimov [Wed, 21 Jan 2026 15:09:31 +0000 (18:09 +0300)]
mediatek: add support for Keenetic/Netcraze (K/N)AP-630
This commit adds support for Keenetic/Netcraze (K/N)AP-630
Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- 512MB RAM
- 128MB SPI NAND
- 1 led with two colors (green, orange)
- 1 button (reset)
- 1 2.5Gbit POE ethernet port based on Airoha EN8811H phy
Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Copy image to tftp server.
a) Keenetic
Rename "openwrt-mediatek-filogic-keenetic_kap-630-squashfs-factory.bin"
to "KAP-630_recovery.bin" and place it in tftp server directory.
b) Netcraze
Rename "openwrt-mediatek-filogic-netcraze_nap-630-squashfs-factory.bin"
to "NAP-630_recovery.bin" and place it in tftp server directory.
3. Connect PC with ethernet port, press the reset button, power up
the device and keep button pressed until status led start blinking.
4. Device will download file from server, write it to flash and reboot.
Right now the global includes are all named rtl838x. This suggests
that they are only for one of the four SoC types (RTL838x aka Maple)
required. As we are talking about the Otto platform rename that
accordingly. All the drivers have already adapted that some time
ago.
Notable differences to V1 (which require dedicated support):
* "smaller" SoC (RTL8391M)
* more RAM (256MiB vs 128MiB)
* more Flash (32MiB vs 16MiB) + different layout
* RTL8214FC uses different port numbers
* SFP 25 and 26 use shared SCL
* SFP 27 and 28 use different SDA
* different monitoring IC (LM96000 vs ADT7468)
* faster serial console by default
* serial header easier accessible
Note that the port LEDs do not work correctly yet due to missing
LED configuration for RTL839X.
This device uses ZyNOS instead of Linux, this makes installation a bit
more cumbersome. Serial console is required!
1. Set the switch to boot from the first image. This step is crucial,
it will fail to boot if this is not set properly.
2. Connect to the switch using serial and interrupt the boot process
to enter debug/recovery mode.
3. Load the OpenWrt initramfs image via XMODEM. You need to obtain an
unlock code, based on your MAC address, first. See the excellent write
up at https://www.ixo.de/info/zyxel_uclinux/ for details. Replace
unlock_code in the commands below by the code obtained.
The file length in bytes needs to be given instead of file_length below.
You also need an XMODEM upload utility like "lrzsz-sx -X" to transfer
the file. Start the XMODEM upload after running the ATUPxxxx command:
NB: You do not need to touch the loader binary unless it's recommended.
The loader is not part of a regular sysupgrade file and will be left
untouched. The boot loader only checks if the loader is valid to be
able to boot.
Recovery/ Return to stock:
--------------------------
Just spam the "u" key during (or "z" for 9600 baud) during memory testing
to trigger a recovery XMODEM upload at 115200 baud. A standard OEM upgrade
image works properly.
Jonas Jelonek [Wed, 29 Oct 2025 20:36:20 +0000 (20:36 +0000)]
realtek: move common GS1920-24HP parts to common definitions
Move common parts shared with GS1920-24HPv2 from v1's DTS and image
definition into a common DTSI and device definition to prepare adding
support for GS1920-24HPv2.
Global interrupt enabling/disabling is scattered around the code. Provide
two helpers to handle this code centrally. Make use of them where needed.
This refactoring brings multiple enhancements:
1. Only activate the rx interrupts and ignore the run out (aka rx overflow)
interrupts. Overflow was used to spit out log messages to identify driver
issues. Nowadays it is stable enough and these messages are not needed
any longer.
2. With generic register setting some family checks can be dropped.
3. Last but not least this commit fixes a bug in the probing of the ethernet
driver. In rare case (especially during TFTP boot) U-Boot loader leaves a
pending rx interrupt that instantly fires when the driver registers its
interrupt via devm_request_irq(). To mitigate this, reorder the interrupt
disabling from ndo_open() to driver probing.
Regardless of the number of receive queues (8 or 32) the interrupt
status and mask registers are built up bitwise in the same way:
- 8/32 rx run out interrupts
- 8/32 rx done interrupts
- 2 tx tone interrupts
- 2 tx all done interrupts
- 3 L2 notify interrupts (only RTL839x)
So one can always derive the bit position of those fields by using
the device specific rx_rings configuration setting. To simplify the
code these registers will be handled by central helpers in the future.
In a first step provide a interrupt base register definition that
points to the first interrupt type - aka the rx run out interrupts.
To not overcomplicate things simply reuse the existing DMA_IF_INTR_MSK
and DMA_IF_INTR_STS naming convention. Until all gets fixed the
runout registers on RTL93xx will be accessible by that name.
qualcommbe: ipq95xx: require image metadata for sysupgrade checks
Add the flag required to enforce the fwtool's image metadata checks.
All sysupgrade image recipes on this platform already append the metadata.
Fixes: 93173aee96e7496f3ff158046d3d19cd42c2e031 ("qualcommbe: ipq95xx: Add initial support for new target") Signed-off-by: Mario Andrés Pérez <mapb_@outlook.com> Link: https://github.com/openwrt/openwrt/pull/22010 Signed-off-by: Robert Marko <robimarko@gmail.com>
Michael Lotz [Mon, 2 Feb 2026 10:27:39 +0000 (11:27 +0100)]
qualcommax: ipq807x: add Zyxel NWA110AX support
The Zyxel NWA110AX is a dual band 2x2:2 802.11ax wireless access point
with PoE.
The device is very similar to the NWA210AX except for being 2x2 instead
of 4x4 in the 5GHz band and not having the 2.5GbE ethernet port. This
commit factors out a common DTS and device definition and reuses it for
both devices.
MAC addresses:
* Uplink: base address on label
* 2.4GHz WLAN: base + 1
* 5GHZ WLAN: base + 2
Flashing Notes:
The device uses a dual-image setup and OpenWrt can only be installed as
image 0. When the currently running stock firmware is image 0, OpenWrt
will be installed as image 1, fail to boot and the device returns to stock
firmware. If this happens, install any version of stock firmware so that
it runs as image 1, before installing OpenWrt. Alternatively, if there
already is a valid stock firmware in image 1, the "debug dual-image show"
and "debug dual-image set boot-image image1" commands can be used in the
stock CLI via serial/SSH/telnet to switch to image 1.
Flashing with Stock Web Interface:
* Get the OpenWrt factory image and rename it to a shorter name, for
example "openwrt.bin" (the stock firmware has a character limit)
* In the web interface, go to "Maintenance" -> "File Manager" ->
"Firmware Package" (or click the link next to "Firmware Version" under
"Device Information" on the dashboard)
* Under "Upload File" browse to the renamed OpenWrt factory image and
click on "Upload"
Switch Boot Image:
* OpenWrt to stock: "zyxel-bootconfig-ipq807x set image1"
* Stock to OpenWrt: "debug dual-image set boot-image image0"
Unbrick / Revert to Stock with the Boot Module:
* Disconnect the device from power
* Configure your machine to 192.168.1.103/24 and start a TFTP server
* Put the stock firmware image into the TFTP server root and rename it to
"ZLD-current"
* Establish a serial connection to the device through the console port
* Connect the device to power
* When prompted, press a key to abort automatic boot and enter debug mode
* Use the "atnz" command to flash the firmware image
* Use the "atgo" command to boot from the newly flashed image
Michael Lotz [Fri, 23 Jan 2026 14:38:50 +0000 (15:38 +0100)]
qualcommax: ipq60xx: add Netgear RBx350 support
Netgear RBx350 are dual band 4 stream 802.11ax mesh devices from the Orbi
series. The RBR350 is a router with a WAN and 3 LAN ports. The RBS350 is a
satellite without WAN port, only 2 LAN ports and half the flash. The
hardware is otherwise identical. They were sold in kits as RBK352, RBK353,
RBK354 or RBK355, with one router and 1-4 satellites.
Hardware:
* SoC: Qualcomm IPQ6018
* RAM: 512MiB 1x Nanya NT5CC256M16ER-EK
* Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ
* WLAN 2.4GHz: QCN5022 2x2:2 b/g/n/ax
* WLAN 5GHz: QCN5052 2x2:2 a/n/ac/ax
* Ethernet: QCA8075 switch with 1 WAN and 3 LAN ports or 2 LAN ports
* Serial Config: 3.3V TTL 115200-8-N-1, internal populated header
* Serial Layout: 3.3V (don't connect, marked with dot) RX TX GND
* LEDs: green/red power, white/red/green/blue status
* Buttons: 1x Reset, 1x WPS
MAC addresses:
* LAN1: base address on label, stored in boarddata partition at 0x8
* LAN2: base + 1
* LAN3: base + 2
* WAN: base + 3
* 2.4GHz WLAN: base + 1
* 5GHz WLAN: base + 2
Flashing Notes:
The stock firmware images are signed. Both the bootloader and the stock
web interface check the signature and will fail to boot/flash.
The bootloader automatically does NMRP when a gigabit LAN connection is
present. The stock and factory images contain a U-Boot script that is
executed when flashing using NMRP. This is used to alter and persist the
U-Boot env with a boot command that works with unsigned firmware.
Install OpenWrt:
* Get the nmrpflash utility [0] and OpenWrt factory image
* Find network interface to use: nmrpflash -L
* Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
* Connect the device LAN port closest to the power jack to the same
network using gigabit
* Plug the device in and wait for the bootloader to flash
* Unplug and replug the device once the power LED blinks amber
Revert to Stock:
The boot command needs to be reverted before flashing the stock firmware,
otherwise it will fail to boot and get stuck in recovery mode (red power
LED flashing).
* Run: fw_setenv bootcmd bootipq
* Restart the device
* Flash the stock firmware RBx350-Va.b.c.d.img using nmrpflash
Michael Lotz [Thu, 5 Feb 2026 22:02:55 +0000 (23:02 +0100)]
qualcommax: ipq807x: add Netgear RBx750 support
Netgear RBx750 are tri band, 2.4GHz and 2x 5GHz, 8 stream 802.11ax mesh
devices from the Orbi series. The RBR750 is a router with a WAN and 3 LAN
ports. The RBS750 is a satellite without WAN port, only 2 LAN ports and
half the flash. The hardware is otherwise identical. They were sold in
kits as RBK752-RBK757, with one router and 1-6 satellites.
Hardware:
* SoC: Qualcomm IPQ8074
* RAM: 1GiB 1x Samsung
* Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ
* WLAN 2.4GHz: QCN5024 2x2:2 b/g/n/ax
* WLAN 5GHz Low Band: QCN5054 2x2:2 a/n/ac/ax 5180-5320MHz
* WLAN 5GHz High Band: QCN5054 4x4:4 a/n/ac/ax 5500-5700MHz
* Ethernet: QCA8075 switch with 1 WAN and 3 LAN ports or 2 LAN ports
* Serial Config: 3.3V TTL 115200-8-N-1, internal populated header
* Serial Layout: Bottom <- RX, TX, GND, 3.3V (don't connect) -> Top
* LEDs: green/red power, white/red/green/blue status
* Buttons: 1x Reset, 1x WPS
MAC addresses:
LAN1: base address on label
LAN2: base + 1
LAN3: base + 2
WAN: base + 1
2.4GHz: base + 2
5GHz-Low: base + 3
5GHz-High: base + 4
Flashing Notes:
The stock firmware images are signed. Both the bootloader and the stock
web interface check the signature and will fail to boot/flash.
The bootloader automatically does NMRP when a gigabit LAN connection is
present. The stock and factory images contain a U-Boot script that is
executed when flashing using NMRP. This is used to alter and persist the
U-Boot env with a boot command that works with unsigned firmware.
Install OpenWrt:
* Get the nmrpflash utility [0] and OpenWrt factory image
* Find network interface to use: nmrpflash -L
* Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img
* Connect the device LAN port closest to the power jack to the same
network using gigabit
* Plug the device in and wait for the bootloader to flash
* Unplug and replug the device once the power LED blinks amber
Revert to Stock:
The boot command needs to be reverted before flashing the stock firmware,
otherwise it will fail to boot and get stuck in recovery mode (red power
LED flashing).
* Run: fw_setenv bootcmd bootipq
* Restart the device
* Flash the stock firmware RBx750-Va.b.c.d.img using nmrpflash
Matt Merhar [Wed, 11 Feb 2026 19:33:15 +0000 (14:33 -0500)]
build: propagate errors when generating apk indexes
The build would continue even if the some of the intermediate commands
failed, as long as the last command in the final iteration of the loop
was successful.
Add 'set -e' to the subshell so that we immediately exit. Previously,
only the exit status of the final make-index-json.py mattered.
Fixes: https://github.com/openwrt/openwrt/issues/21981 Signed-off-by: Matt Merhar <mattmerhar@protonmail.com> Link: https://github.com/openwrt/openwrt/pull/21993 Signed-off-by: Robert Marko <robimarko@gmail.com>
Bevan Weiss [Thu, 12 Feb 2026 06:05:12 +0000 (17:05 +1100)]
kernel: pse-pd: Fix missing regulator backport
Fixes: 528c9259a70f Backport the PSE-PD...
When the original backport bring-in was done, the regulator power budget
portion was missed. This results in kernel build errors when trying to
bring in PSE_CONTROLLER or PSE_REGULATOR configs. Which are required to
bring in further PSE drivers.
Bring in the backport to fix that up. Patch series naming is a bit wrong
here, but keeps patches together in ordering, whilst reducing files
touched in this commit.
Without this patch, when adding config of
CONFIG_PSE_CONTROLLER=y
CONFIG_PSE_REGULATOR=y
CONFIG_PSE_TPS23881=y
CONFIG_REGULATOR=y
The following errors occur:
drivers/net/pse-pd/pse_core.c:446:9:
error: implicit declaration of function 'regulator_free_power_budget'
drivers/net/pse-pd/pse_core.c:559:16:
error: implicit declaration of function 'regulator_request_power_budget'
This update fixes a build error on my system:
./string.h:777:20: error: expected identifier or '(' before '_Generic'
777 | _GL_EXTERN_C void *memchr (const void *__s, int __c, size_t __n)
| ^~~~~~
Do better error checks during bus probing. Give meaningful return codes
in case of invalid DTS data (EINVAL instead of ENODEV). Decrease node
reference in case of errors.
The mdio bus no longer mixes reset and polling setup. There is now
a clear distinction between both parts and polling setup can rely
on an initialized bus. With that in place skip the open coded phy
detection and use standard kernel functions instead.
Let the mdio bus autodetect the attached phys by providing a proper
scan mask. Although this breaks the linkage to the DTS it is better
than adding phys manually.
realtek: mdio: prevent WARN_ONCE() during bus scan
The mdio bus detection will be changed from DTS based detection to
autoscan. To avoid spurious WARN_ONCE() messages return -EIO for
reads to register 2 during C22 scan when phy is on a c45 based bus.
The C45 rescan afterwards will detect the phy normally.
Now that reset() and setup_polling() functions are split, clarify the
documentation about the C22/C45 register setup. It is important for
all phy accesses and must be configured during reset. Of course a side
effect is, that the SoC adapts its polling.
realtek: mdio: split rtl838x reset and polling setup
The reset function of the RTL838x mdio bus does not only reset
things but sets up polling parameters too. Split this function.
While we are here give an anonymous bit a meaningful name.
realtek: rt-loader: fix RTL839x/RTL93xx version detection
There is a misunderstanding of the chip version detection in the
rt-loader. For all SoCs the data is gathered from the registers
MODEL_NAME_INFO and CHIP_INFO. Sadly the bits are shuffled around
with each hardware. Currently the loader gathers the wrong bits
for RTL839x and RTL93xx. Fix that.
While we are here write the if statements vice versa for better
readability and give some variables better names. Align the
ouput with that from the kernel.
Fixes: ccbff8b ("realtek: add rt-loader (runtime loader)" Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://github.com/openwrt/openwrt/pull/21994 Signed-off-by: Robert Marko <robimarko@gmail.com>
Ryan Chen [Wed, 11 Feb 2026 04:25:01 +0000 (22:25 -0600)]
airoha: fix EN7581 PCIe initialization and add x2 link support
Fix two hardware initialization issues in the EN7581 PCIe controller
and add support for x2 (2-lane) link mode.
Fixes:
The upstream EN7581 PCIe initialization writes EQ presets and PIPE
configuration registers before clk_bulk_prepare_enable(). Since the
MAC clocks are not yet running at that point, these register writes
are silently dropped, leaving the hardware with default values. This
can cause link training failures or suboptimal equalization.
Additionally, after link training the MAC may only advertise Gen1-Gen2
capability in the Link Capabilities 2 register despite the PHY being
configured for Gen3. A serdes reset toggle forces the MAC to re-read
PHY capability, recovering Gen3 8GT/s link speed.
Both issues are addressed by separating PERST from the clock callbacks
(patch 911), allowing the PCIe controller driver to properly sequence
PERST, clock enable, and register writes (patch 912).
New feature:
PCIe x2 mode support for EN7581 using the NP_SCU system controller
for serdes mux routing, PERST management, and lane configuration.
Both bonded MACs are configured for x2 operation with proper EQ
presets before link training begins.
Wei-Ting Yang [Fri, 13 Feb 2026 04:37:51 +0000 (12:37 +0800)]
elfutils: fix license
Remove OR between GPL-2.0-or-later and LGPL-3.0-or-later to avoid
incorrect parsing of OR as a separate license in the SBOM.
Fixes: 9a157b5d83d28043ea35501a19702beee5f8a107 Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com> Link: https://github.com/openwrt/openwrt/pull/22003 Signed-off-by: Robert Marko <robimarko@gmail.com>
Jan Hoffmann [Tue, 10 Feb 2026 20:18:47 +0000 (21:18 +0100)]
realtek: switch HPE 1920 series to NVMEM
The MAC addresses for eth0 and the individual LAN ports are now
configured via device tree. The assignment itself stays the same as
before, matching factory firmware.
The 02_network script still sets the bridge MAC address, as it is
different from the lowest port MAC address.
Linus Walleij [Thu, 12 Feb 2026 08:47:21 +0000 (09:47 +0100)]
gemini: add support for Raidsonic IB-4210-B
There has been some modified device trees floating on forums to
make this device work, collect the work and integrate it into
OpenWrt so it hopefully works for users.
Felix Fietkau [Fri, 13 Feb 2026 09:09:09 +0000 (09:09 +0000)]
uclient: update to Git HEAD (2026-02-13)
63413daa8760 uclient-http: fix HTTP authentication after deferred header processing 4fa6fae02f74 uclient-fetch: Extract opt_post variable 8df3120639a4 uclient-fetch: Use HEAD for --spider 0392dfc8e8c4 uclient-fetch: Support of --method, --body-data and --body-file 115c92824b6d uclient-fetch: add OPTIONS request type a1531e89f6c2 uclient-fetch: support for WebDAV methods
Fixes: https://github.com/openwrt/uclient/issues/14 Signed-off-by: Felix Fietkau <nbd@nbd.name>
Felix Fietkau [Fri, 13 Feb 2026 09:09:06 +0000 (09:09 +0000)]
libubox: update to Git HEAD (2026-02-13)
d324c0503040 libubox: send warnings to stderr 5a65cb5a79b7 libubox: document positional arguments 8c7b489daa02 libubox: add anonymous strings, ints, et al in arrays 5ec7ff2effb3 uloop: use volatile sig_atomic_t for do_sigchld flag 0efa2cd3b74c usock: check SO_ERROR after poll in usock_inet_timeout() 1a73ded9f738 usock: fix timeout handling in usock_inet_timeout() 1aa36ee774c8 usock: implement RFC 8305 Happy Eyeballs for usock_inet_timeout()
Fixes: https://github.com/openwrt/uclient/issues/8 Signed-off-by: Felix Fietkau <nbd@nbd.name>
Raylynn Knight [Sun, 8 Feb 2026 09:23:08 +0000 (04:23 -0500)]
x86: base-files add support for Sophos 210r3 and 230r2
This fixes a previous commit for Sophos XG 210r3 which was missing
board_name mapping and adds support for the SG related version and the
XG/SG 230r2 which is the same hardware with a faster processor.
Sophos board_name mapping was modified to support all Sophos
SG/XG devices.
Sophos SG/XG 210r3 and SG/XG 230r2 are rackmounted x86 based firewall
with 6 RJ-45 gigabit ethernet ports (eth0-5) and 2 SFP gigabit ethernet
ports (eth6, eth7) all running Intel NICs supported by igb driver. The 210r3
and 230r2 only differ in the processor used. This board update maps
eth1 (marked as WAN) as wan and eth0 and eth2-5 as lan. Leaving the
two SFP ports unmapped.
Installation
------------
1. Connect to the router using ssh (user: admin, pass: web interface
password)
2. Backup:
```
cat /dev/mtd0 | gzip -1 -c > /tmp/mtd0_spi0.0.bin.gz
cat /dev/mtd1 | gzip -1 -c > /tmp/mtd1_BL2.bin.gz
cat /dev/mtd2 | gzip -1 -c > /tmp/mtd2_u-boot-env.bin.gz
cat /dev/mtd3 | gzip -1 -c > /tmp/mtd3_Factory.bin.gz
cat /dev/mtd4 | gzip -1 -c > /tmp/mtd4_FIP.bin.gz
cat /dev/mtd5 | gzip -1 -c > /tmp/mtd5_ubi.bin.gz
```
3. Download mtd backup from the /tmp dir of the router to your PC using
scp protocol
4. Upload OpenWrt 'bl31-uboot.fip', 'preloader.bin' images to the /tmp
dir of the router using scp protocol
5. Write FIP and BL2 (replace bootloader):
```
mtd write /tmp/openwrt-mediatek-filogic-netis_nx32u-bl31-uboot.fip FIP
mtd write /tmp/openwrt-mediatek-filogic-netis_nx32u-preloader.bin BL2
```
6. Place OpenWrt
'openwrt-mediatek-filogic-netis_nx32u-initramfs-recovery.itb' image on
the tftp server (IP: 192.168.1.254)
7. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
8. U-Boot automatically boot OpenWrt recovery image from tftp server to
the RAM
9. Upload OpenWrt 'sysupgrade.itb' image to the /tmp dir of the router
(IP: 192.168.1.1) using scp protocol
10. Connect to the router using ssh and run:
```
ubidetach -p /dev/mtd4; ubiformat /dev/mtd4 -y; ubiattach -p /dev/mtd4
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
sysupgrade -n openwrt-mediatek-filogic-netis_nx32u-squashfs-sysupgrade.itb
```
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-netis_nx32u-initramfs-recovery.itb' image on
the tftp server (IP: 192.168.1.254)
2. Press “Reset” button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | dc:xx:xx:d1:xx:18 | label |
| WAN | dc:xx:xx:d1:xx:1a | label+2 |
| WLAN 2g | de:xx:xx:11:xx:19 | |
| WLAN 5g | de:xx:xx:71:xx:19 | |
+---------+-------------------+-----------+
The LAN MAC was found in 'Factory', 0x1fef20
The WAN MAC was found in 'Factory', 0x1fef26
The WLAN 2g/5g MAC prototype was found in 'Factory', 0x4
projects / thirdparty / openwrt.git / log
