Jonas Jelonek [Sun, 31 May 2026 20:38:00 +0000 (20:38 +0000)]
realtek: pcs: reject SerDes modes unsupported by the instance
Add a per-SerDes supported_modes bitmap, filled at probe by each
variant from the SerDes id or type, and reject unsupported modes in
determine_hw_mode() via test_bit().
This replaces the rtl838x is_hw_mode_supported() switch and adds the
same gating to rtl839x/rtl93xx, which previously relied only on the
per-variant mode-value table. Unlike that table, the bitmap is per
SerDes instance, so it also rejects modes the table can encode but that
a given SerDes cannot actually use. Rejection uses the uapi -EOPNOTSUPP
instead of the internal -ENOTSUPP.
Jonas Jelonek [Sun, 31 May 2026 19:14:43 +0000 (19:14 +0000)]
realtek: pcs: drop dead SerDes modes
SerDes modes HISGMII and QHSGMII are practically dead but were added/kept
for documentation purposes. However, these modes will likely never be
used and we have other documentation than in the code. Drop them to
reduce the modes to what we actually use.
Han Sol Jin [Fri, 20 Mar 2026 08:42:30 +0000 (01:42 -0700)]
mediatek: mt7622: enable CONFIG_MTD_VIRT_CONCAT
Some devices have a ton of unused space found in other partitions that
can be used to expand rootfs_data.
In particular, the D-Link DIR-X3260 device can squeeze another ~24MiB
from its backup partition, with a few tricks, allowing for ~48MiB of
usable space rather than ~24MiB by itself.
As of v25.12.1, with the official release build config, this gives us
~35MiB of rootfs_data, where without it there would only be ~11MiB.
Anna Kiri [Tue, 26 May 2026 17:25:14 +0000 (19:25 +0200)]
mtd: jffs2: add missing malloc NULL check
In mtd_replace_jffs2(), the return value of malloc(erasesize) is never
checked. If the allocation fails, buf remains NULL and the subsequent
memcpy(buf + ofs, ...) in add_data() will dereference NULL, causing a
segfault.
Add a NULL check and return -1 on allocation failure. Match the
diagnostic message used by the sibling mtd_write_jffs2() so the
out-of-memory cause is visible at the call site.
John Audia [Thu, 21 May 2026 10:06:59 +0000 (06:06 -0400)]
toolchain: glibc: Update to HEAD from release/2.43/master
% git log --oneline f762cc..4070d80 4070d808bea1 sdio-common: Fix buffer overflow in scanf %mc [BZ #34008] 2890b35cd361 libio: Fix ungetwc operating on byte stream [BZ #33998] e9517114acc7 abilist.awk: Handle weak unversioned defined symbols 1634cc11a5a5 Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921) d1d8d27164e9 include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h 8362e8ce10b2 Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046) ce1013a197eb tests: fix tst-rseq with Linux 7.0 60cabd0464c6 riscv: Resolve calls to memcpy using memcpy-generic in early startup 02ffd413cf83 elf: Use dl-symbol-redir-ifunc.h instead _dl_strlen 26953143787b elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso dd9945c0ba40 resolv: Check hostname for validity (CVE-2026-4438) 5c6fca0c62ce resolv: Count records correctly (CVE-2026-4437) 2be6cf2e75d0 posix: Run tst-wordexp-reuse-mem test 305ce0b58809 aarch64: Tests for locking GCS 2ee41ba6ecd3 aarch64: Lock GCS status at startup fa4a40c7d497 tests: aarch64: fix makefile dependencies for dlopen tests for BTI 9898ea58b538 malloc: Avoid accessing /sys/kernel/mm files c3ceb93dc4f6 Add BZ 33904 entry to NEWS 911bd469f80c debug: Fix build with --enable-fortify-source=1 (BZ 33904) 48f5a05a7a1e nss: Missing checks in __nss_configure_lookup, __nss_database_get (bug 28940) d6cb7ce0e98b Linux: In getlogin_r, use utmp fallback only for specific errors 140c760d711d nss: Introduce dedicated struct nss_database_for_fork type 856c426a7534 Don't include <bits/openat2.h> directly (bug 33848) 144ba302089c po: Incorporate translatins (nl updated, ar new) 022abaeacbc8 Fix ldbl-128ibm ceill, floorl, roundl and truncl zero-sign handling 45b58d6bd185 NEWS: add new section 2.43.1 f02515d8a696 Replace advisories directory with file ADVISORIES
Manuel Stocker [Sat, 30 May 2026 18:46:18 +0000 (20:46 +0200)]
realtek: mdio: skip over ethernet-phy-package nodes
When we look up the PHY for each switch port, we traverse to the parent
node to find the corresponding MDIO bus. This approach breaks down
when an explicit ethernet-phy-package is used to bundle multiple
PHYs in the same chip.
Jonas Jelonek [Mon, 25 May 2026 21:58:14 +0000 (21:58 +0000)]
realtek: migrate PCS to fwnode_pcs provider/consumer API
PCS driver registers each SerDes as an fwnode_pcs provider in probe;
the resolver returns the cached or freshly-allocated rtpcs_link for
the requested (sds, link_idx) cell. DSA glue stops calling
rtpcs_create directly, drops .mac_select_pcs, and instead populates
phylink_config.num_available_pcs / fill_available_pcs from each
port's pcs-handle in phylink_get_caps. The rtl838x_port.pcs pointer
becomes a has_pcs bool populated at port probe via fwnode_property_
present, since nothing assigns the actual phylink_pcs anymore but the
"does this port use a PCS?" checks elsewhere still need a presence
flag.
Without .mac_select_pcs, phylink_major_config only searches the
pcs_list when state->interface is set in phylink_config.pcs_interfaces
(drivers/net/phy/phylink.c:1378). Populate it per port whenever the
port has a pcs-handle, listing the SerDes-routable interface modes for
each SoC variant -- without this, pcs_config / pcs_link_up are never
called and the SerDes is left unconfigured.
pcs_get_state still needs the MAC port number to index per-port link
status registers. Recover it at probe via rtpcs_map_links: walk the
sibling switch's ethernet-ports subtree (same backwards topology
lookup the sibling MDIO driver does for phy-handle), and for every
port whose pcs-handle resolves to one of our SerDes, store the port's
reg in sds->link_port[]. The resolver consults link_port[] when
allocating rtpcs_link and fails with -ENODEV if a consumer requested
a link the map step didn't record. Avoids a driver-side port_base
table that would have to encode per-SoC SerDes-to-port wiring (and
would silently break on non-contiguous variants); the DT is the
single source of truth.
Jonas Jelonek [Mon, 25 May 2026 17:06:41 +0000 (17:06 +0000)]
realtek: pcs: add per-link port storage to rtpcs_serdes
Add an s16 link_port[] array to struct rtpcs_serdes, initialised to
-1 in probe. This is preparatory storage for the port number that
each link serves; it will be populated in the follow-up fwnode_pcs
migration commit by scanning consumer DT nodes for their reg, and
consumed by the resolver when allocating rtpcs_link.
Jonas Jelonek [Mon, 25 May 2026 14:00:32 +0000 (14:00 +0000)]
realtek: pcs: index links per SerDes via pcs-handle cell
Move the rtpcs_link pointer array from rtpcs_ctrl (keyed by global
DSA port) into rtpcs_serdes (keyed by the per-SerDes link index).
This matches how the hardware is structured -- a SerDes hosts up to
RTPCS_MAX_LINKS_PER_SDS PCS links -- and aligns the in-driver
addressing with the cell the DTSes just gained on pcs-handle, so the
upcoming fwnode_pcs resolver becomes a direct sds->link[cell] lookup.
rtpcs_create() takes a new link_idx parameter and stores into
sds->link[link_idx] instead of ctrl->link[port]; the DSA glue switches
its phandle lookup to of_parse_phandle_with_args() and forwards the
cell. The port number stays on rtpcs_link for legacy callers that
still need it. Bounds and double-bind checks (-EINVAL, -EBUSY) guard
against malformed DT references that would otherwise OOB or silently
overwrite an existing link.
Drops RTPCS_PORT_CNT, whose only user was the relocated array, and
fixes a pre-existing of_node_put leak on the pcs-handle phandle in
the DSA glue as a side effect of the parse-with-args conversion.
Jonas Jelonek [Mon, 25 May 2026 13:09:28 +0000 (13:09 +0000)]
realtek: dts: add link index cell to pcs-handle phandles
A SerDes can host multiple PCS links: QSGMII binds four ports to one
SerDes, USXGMII variants up to eight. Today pcs-handle references the
SerDes as a whole, with no way to express which link inside the SerDes
a port wants. The driver gets away with this because it carries its own
port->link bookkeeping and the link slot is implicit in DSA's port
iteration order -- functional, but the wiring information lives nowhere
in DT.
The upcoming fwnode_pcs migration moves PCS lookup to the generic
fwnode provider API, which disambiguates multiple instances per fwnode
via phandle cells. To make that landable as small, code-only commits,
the DT needs to carry the link index ahead of time.
Bump #pcs-cells from 0 to 1 on every SerDes node in the four SoC DTSIs
and append the link cell to every pcs-handle reference across boards
and the SWITCH_PORT_* macros. Cell values match the existing wiring:
0 for single-link SerDes (10GBase-R, SGMII, fiber, single-link
USXGMII), 0..3 per SerDes for QSGMII and USXGMII-QX, 0..7 for the
RTL9311 octal USXGMII layout.
No code reads the new cell yet -- of_parse_phandle_with_args() in the
PCS driver already cooperates with cells = 0 or 1, and the DSA glue
uses of_parse_phandle() which ignores cells entirely. The change is
runtime-neutral on its own; it exists so the follow-up code patches
can be a few lines each instead of dragging a bridge counter into the
driver to invent slot numbers DT could have provided directly.
Jonas Jelonek [Mon, 25 May 2026 10:26:49 +0000 (10:26 +0000)]
realtek: pcs: store SerDes fwnode instead of device_node
Switch rtpcs_serdes from struct device_node * to struct fwnode_handle *
in preparation for fwnode_pcs_add_provider, which keys providers by
fwnode. Storing the fwnode directly avoids of_fwnode_handle() wrappers
at every API boundary.
The conversion is mechanical: of_node_get/put become fwnode_handle_get/
put (same refcount on OF-backed fwnodes), polarity helpers drop their
of_fwnode_handle() wrapping, and the link counter compares fwnodes
directly via of_fwnode_handle(arg_np). No behavior change.
Carlo Szelinsky [Mon, 18 May 2026 20:41:21 +0000 (22:41 +0200)]
realtek: add Hasivo MCU watchdog driver
Add a watchdog driver for the external management MCU on Hasivo /
Horaco network switches, reachable over I2C. Without periodic
keepalive the MCU resets the board every ~3 minutes.
The driver arms the MCU at probe and registers a struct
watchdog_device with WDOG_HW_RUNNING so the watchdog core feeds the
chip via a kernel timer until userspace opens the watchdog node.
Timeout is fixed at 15s; the hardware threshold is baked into MCU
firmware and is not software-configurable.
The I2C address is supplied per-board in the device tree via the
`reg` property. The driver does not constrain or probe a specific
address. Known addresses across current Hasivo / Horaco silicon:
The driver, its device-tree binding and the Kconfig/Makefile wiring
are added to the kernel tree as a realtek target patch and exposed as
the kmod-hasivo-mcu-wdt KernelPackage. Keeping the binding in the
kernel tree lets dt_binding_check exercise it during the build and
makes the whole driver easy to drop once it lands upstream.
Tested on Hasivo S1300WP-8XGT-4S+ (RTL9313). Unbinding the driver
causes the MCU to power-cycle the board within ~15s.
Jonas Jelonek [Sat, 30 May 2026 20:54:59 +0000 (20:54 +0000)]
realtek: fix SFP support on Plasma Cloud ESX28/PSX28
Like other RTL931x devices, the Plasma Cloud ESX28 and PSX28 also have
inverted polarity on the SerDes which drive the SFP ports. Commonly,
those always seem to have inverted TX polarity. This was missing from
when the devices were added at which time SFP on RTL931x wasn't working
at all yet. Add the polarity to the DTS now.
Verified on Plasma Cloud PSX28.
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Disable unused crypto algorithms. If needed, install required packages.
Suggested-by: Qingfang Deng <dqfext@gmail.com> Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl> Link: https://github.com/openwrt/openwrt/pull/23536 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Drop the legacy receive handling and convert the driver to make
use of a zero-copy receive path. To save memory use the page
pool fragment feature. This way two SKBs will fit into one 4KB
page. With the parametrization of this patch the driver will
allocate about 600KB of receive buffers (2 rings with 300KB
each. This already includes space for the SKB header.
Although never observed, a transmit timeout might happen.
In that case there is a resource leak inside rteth_tx_timeout().
This happens when rteth_setup_ring_buffer() reinitializes the
transmit buffers and overwrites all transmit slots. Any linked
SKB is lost and leaked at this point.
Be defensive and add a cleanup rteth_free_tx_buffers() function.
Call this alongside rteth_free_rx_buffers() where needed.
The driver does not distinct between the two. Change this and
clean up a SKB that was handed over to the hardware with
dev_consume_skb_any(). This way kernel knows that everything
went well.
realtek: eth: drop device managed netdev registration
The cleanup order of the driver is quite confusing. At least
two issues exist.
- phylink_destroy() is missing
- The implicit unregister_netdev() at the end of rteth_remove() is called
too late. The manually managed resources are removed before. This can
lead to stale data access.
Convert to register_netdev() and bring rteth_remove() into a meaningful
order to avoid such issues when converting to page_pool.
The error handling flow during probing has some shortcomings.
1. In case an error occurs after netif_napi_add() this must be
cleaned up with a call to netif_napi_del().
2. If devm_register_netdev() fails not only NAPI must be cleaned
up but also the phylink.
Add a cleanup section for the probe. Implement it generically
(checking for 0/NULL values) so it can be called any time when
encountering probe failures.
Guoxin Pu [Thu, 28 May 2026 07:46:20 +0000 (15:46 +0800)]
image: fix per device targz rootfs wrong suffix and redundant images
In commit d89cb72c23fea53883c1e6203020d9b555208452 , a new rootfs type "targz" was introduced, to correctly pack the rootfs AFTER `DEVICE_PACKAGES` installation (unlike the old simple `rootfs.tar.gz`) .
The expected release artifact shall be a single corresponding tar gz release accompanying or relacing the old simple `rootfs.tar.gz`.
However, if one take a look at the v25.12 series release download pages, e.g. [25.12.4/x86/64](https://downloads.openwrt.org/releases/25.12.4/targets/x86/64/), one could see that there're now four release artifacts related to rootfs targz:
It's obvious the new `targz` release actually reuses the same `TARGET_ROOTFS_{TYPE}` handler same as `squashfs`, `ext4` and alike. And the three `generic-targz` img.gz contains the same expected tar gz either as their second partition, or as the whole image. This could be verified by the following script:
```bash
URL_PARENT=https://downloads.openwrt.org/releases/25.12.4/targets/x86/64/openwrt-25.12.4-x86-64-
for TYPE in combined-efi combined rootfs; do
curl -L "${URL_PARENT}generic-targz-${TYPE}.img.gz" | gzip -cd > "${TYPE}.img"
done
for TYPE in combined-efi combined; do
INFO=$(sfdisk -d "${TYPE}.img" | sed -n 's/^'"${TYPE}.img"'2 : start= \+\([0-9]\+\), size= \+\([0-9]\+\),.\+.\+$/\1 \2/p')
dd if="${TYPE}.img" of="${TYPE}.tar.gz" bs=512 skip="${INFO%% *}" count="${INFO##* }"
done
cp rootfs.img rootfs.tar.gz
sha256sum combined-efi.tar.gz combined.tar.gz rootfs.tar.gz
file rootfs.tar.gz
```
Output:
```log
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 13.12M 100 13.12M 0 0 194.6M 0 0
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 12.93M 100 12.93M 0 0 190.9M 0 0
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 7.13M 100 7.13M 0 0 257.6M 0 0
GPT PMBR size mismatch (246304 != 246334) will be corrected by write.
The backup GPT table is corrupt, but the primary appears OK, so that will be used.
The backup GPT table is not on the end of the device.
212992+0 records in
212992+0 records out 109051904 bytes (109 MB, 104 MiB) copied, 0.258064 s, 423 MB/s
212992+0 records in
212992+0 records out 109051904 bytes (109 MB, 104 MiB) copied, 0.261621 s, 417 MB/s 18b98d3562dc3067ae095ee44d4ff3158cf84e89063c3df66c0ef6638922ba71 combined-efi.tar.gz 18b98d3562dc3067ae095ee44d4ff3158cf84e89063c3df66c0ef6638922ba71 combined.tar.gz 18b98d3562dc3067ae095ee44d4ff3158cf84e89063c3df66c0ef6638922ba71 rootfs.tar.gz
rootfs.tar.gz: gzip compressed data, max compression, from Unix, original size modulo 2^32 0
```
The checksum of the extracted, actually expected .tar.gz are all same. And if we peek inside its content, it's indeed what we expected:
A disk image with a `tar.gz` as its second partiton doesn't boot anyway and I doubt if there's any mechanic to make it bootable. So `generic-targz-combined-efi.img.gz` and `generic-targz-combined.img.gz` are not needed at all, and `generic-targz-rootfs.img.gz` shall be renamed to have a `tar.gz` suffix instead.
Therefore work around this by skipping creating images for fs `targz` in the general loop, and only create the rootfs.tar.gz later for `targz` "fs"
This affects both the real builder and imagebuilder. I've tested this with multiple imagebuilders.
Tested with `openwrt-imagebuilder-25.12.4-mvebu-cortexa53.Linux-x86_64`:
```sh
rm -rf bin && make image PROFILE=generic
```
Ryan Leung [Wed, 27 May 2026 00:38:50 +0000 (10:38 +1000)]
rockchip: enable maskrom button for NanoPi R5C/R5S
The MASKROM button was added to the device tree for FriendlyELEC NanoPi R5C/R5S in Linux 6.17 in 07e04c071a35 ("arm64: dts: rockchip: Add maskrom button to NanoPi R5S + R5C").
Now that rockchip target has switched to 6.18 in 67740e311b8e ("rockchip: switch to kernel 6.18"),
add `kmod-button-hotplug` and `kmod-input-adc-keys` to the default packages for NanoPi R5C/R5S
1. Boot WMC-C2533GST normally with "Router" mode
2. Access to "http://192.168.2.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt factory image and click apply ("適用") button
4. Wait ~150 seconds to complete flashing
- Fix out-of-bound read access when removing VLAN tag (CVE-2026-46433, issue 787)
- Reject 0-length management address in LLDP
- Fix race condition when creating the control socket
- Fix FDP MAC address
- Fix memory leak in the BSD bridge query path
- Fix duplicate management addresses when merging EDP VLAN frames
Lars Gierth [Thu, 16 Apr 2026 22:33:34 +0000 (00:33 +0200)]
realtek: rtl930x: add support for Hasivo F1100W-4SX-4XGT and variants
This commit adds support for the Hasivo F1100W-4SX-4XGT ethernet 10Gbase and PoE switch.
It also adds support for a whole matrix of variants of this device:
The devices are identical except for presence of the PoE daughter board,
RJ45 console port, and 256 or 512 MB RAM.
The non-512 MB image also works on the older 512 MB board revisions, but not vice versa.
Credit to @mensi @bevanweiss @markc1984
Hardware
--------
| | |
|----------|-----------------------------------------------------------|
| SoC | RTL9303 rev B |
| RAM | 256 MB Samsung K4B2G1646F DDR3L (board revision v1.03), |
| | or 512 MB unknown module (board revision v1.02 and older) |
| Flash | 32 MB Macronix MX25L25645G SPI NOR, |
| | 29 MiB usable by OpenWrt |
| Ethernet | 4x SFP+ via SoC (10G/2.5G/1G), |
| | 4x RJ45 via 4x RTL8261BE PHY (10G/5G/2.5G/1G/100M/10M) |
| PoE | only on WP variants |
| | 1x 802.3bt 90 W (port 5) |
| | 3x 802.3at 30 W (ports 6, 7, 8) |
| | via daughter board with Hasivo HS104PTI controller |
| | PoE works but is unmanaged --> future work |
| LEDs | 1x system orange/green, 8x link green/red, 4x PoE orange |
| Button | Reset |
| Console | RJ45 38400 bps 8n1, or pin holes on SE variants |
Installing OpenWrt
------------------
Note: With vendor firmware 7.1.9, the bootloader's network profile is broken.
We need to select a different profile with port/phy overlap to make the TFTP
transfer work. Then only port 5 works in the OpenWrt initramfs, but all ports
work fine after flashing, when we don't need the profile trick anymore.
1. Attach to RJ45 serial console port using a cisco cable.
2. Attach your computer to Port 5 (the first RJ45 port).
3. Serve initramfs-kernel.bin on TFTP 192.168.1.111.
4. Power on the device.
5. Interrupt U-Boot by pressing `Ctrl+C`, then `Z`, then `H`, during 3 second countdown.
6. Run: `setenv boardmodel 'RTL9303_5x8261BE_2XGE_ZHIHUI' ; rtk network on`
7. Run: `tftpboot 0x84f00000 initramfs-kernel.bin ; bootm 0x84f00000`
8. Use `mtd dump` to make backups of all flash partitions.
9. Use SCP to copy `squashfs-sysupgrade.bin` to the device, then run `sysupgrade`.
OpenWrt uses the `RUNTIME` and `RUNTIME2` partitions as one combined partition.
To restore them from backups, boot from `initramfs-kernel.bin` just like during
the installation, then use `mtd write` to write your backups of the factory
`mtd5` and `mtd6` partitions.
Notes/Quirks
------------
- U-Boot interruption is obfuscated. Press `Ctrl+C`, then `Z`, then `H`,
during the 3 second countdown.
- U-Boot rtk network profile is broken. Use the `RTL9303_5x8261BE_2XGE_ZHIHUI` profile
instead, it makes at least port 5 work.
- MAC address is stored on the `RUNTIME` or `RUNTIME2` partitions, which are used by OpenWrt.
Instead, we generate one random MAC address and store it in the U-Boot environment.
- PoE works but is unmanaged. The HS104 driver is worked on in
https://github.com/openwrt/openwrt/pull/22245 and will work with ethtool and the
kernel's new `pse-pd` subsystem.
The kernel has two helper defines that guide about hardware
characteristics.
MIPS_L1_CACHE_SHIFT defines the cache line sizes (1<<x) of the
target. It defaults to 5 - so it is assumed that the device has
a cache line size of 32 bytes. This is not true for MIPS 4KEc
cores that are driving the RTL838x SOCs. These cores have 16
byte cache line sizes. Adapt the CONFIG properties for this
target to match the hardware.
ARCH_DMA_MINALIGN definies the alignment for memory allocations.
Other than its name suggests on MIPS devices that have non
coherent DMA kmalloc() respects this configuration. This ensures
that no normal memory is corrupted by DMA blocks that share the
same cache line.
The default for this is 128 bytes. And kernel states itself
"Total overkill for most systems but need as a safe default. Set
this one if any device in the system might do non-coherent DMA".
Realtek devices use non coherent DMA so they are affected by the
setting of ARCH_DMA_MINALIGN. Set this to cache line size for
all devices to reduce memory waste.
Lech Perczak [Fri, 24 Jan 2025 23:19:36 +0000 (00:19 +0100)]
ath79: add Cisco Meraki Z1
Specifications:
SOC: Atheros AR9344 @ 560MHz
RAM: 2x Winbond W9751G6KB-25 (128 MiB)
FLASH: Hynix H27U1G8F2BTR (128 MiB)
WIFI1: Atheros AR9340 5.0GHz (SoC)
WIFI2: Atheros AR9280 2.4GHz
SWITCH: Atheros AR8327 (5x Gigabit (1x WAN, 4x LAN)
LED: 1x Power-LED, 1 x RGB Tricolor-LED
INPUT: One Reset Button
USB: One USB 2.0 Port
UART: JP1 on PCB (Labeled UART), 3.3v-Level, 115200n8
(GND, TX, RX, VCC - GND is next to the UART silk screen)
Flashing Instructions:
If your device still has vulnerable firmware, then existing installation
instructions can be used. Devices currently running ar71xx firmware can
be upgraded directly, although ar71xx firmware will complain,
because of changed metadata format. So you'll have to force the upgrade.
If your firmware is too new, there are two options
- temporarily adding a SPI-NOR flash to boot initramfs from
(recommended)
- patching NAND image with initramfs with external programmer
(recommended if and only if you have access to 360-clip, or
similar device, that doesn't require desoldering a TSOP48 chip))
Since this device is brought over from an old AR71xx, there's
already a wiki-page with detailed instructions:
<https://openwrt.org/toh/meraki/z1>
Installing from SPI-NOR:
- Download pre-built image from
<https://github.com/Leo-PL/OpenWrt-Meraki-Z1>
or assemble your own by splicing
router-u-boot <https://github.com/CodeFetch/router-u-boot>
image for TP-Link WDR4300 with Z1 initramfs in uImage format.
To build uImage initramfsf from source, remove the "KERNEL_INITRAMFS"
variable from target/linux/ath79/image/nand.mk for Z1.
Put the U-boot image at offset 0, initramfs at offset 131072.
- Write the image to an 8MB (or greater) SPI flash
- Temporarily bridge - or solder in a 220-ohm resistor between pins 6
and 8 of the SPI-NOR chip to override boot source to SPI
- When the initramfs first boots, write the standard initramfs to NAND,
to both 'kernel' and 'recovery' partitions
Now you can disconnect the resistor and try to boot the system from
NAND. If it works, continue with installation, as described for legacy
method using vulnerable stock firmware.
- When done, you can remove SPI-NOR chip and the resistor altogether,
it can be reused to perform installation on other devices,
or act as a recovery boot source if needed, if the recovery initramfs
fails for any reason.
Installing by patching NAND
- If you'd like to desolder NAND to perform this, I highly advise
against it, use SPI-NOR method above instead.
- If you have external programmer and a NAND clip, read out the whole
chip image, while keeping the device in reset by shorting SRST
(pin 11) to ground in JTAG connector,
and store a backup in a safe place.
- Patch the chip image with initramfs for raw NAND from
<https://github.com/Leo-PL/OpenWrt-Meraki-Z1>, by using a script
there, or manually:
This will write the initramfs to both kernel and recovery partitions,
which is highly recommended, as due to device architecture it is
notoriously hard to unbrick.
- Write the image back to the NAND, again, keeping the CPU in the reset.
- When the unit boots to initramfs, proceed as per existing instructions
for volnerable firmware.
Legacy installation on vulnerable stock firmware:
The gist:
1. Get a root-shell on the device (see wiki). (needs UART access)
2. make a backup (to a PC/safe location) of the existing Meraki
firmware.
3. copy over the OpenWrt initramfs kernel for the Z1.
This gets written into the kernel NAND partition.
(Verify that written image is complete!)
After the following reboot and successfull boot of the staging
OpenWrt initramfs image:
4. Free up space by removing Meraki firmware partitions from UBI volume
to free up space for OpenWrt (example given for the latest wired-14
version):
$ ubirmvol -N storage /dev/ubi0
$ ubirmvol -N rootfs-wired-14-202005181203-G201ba9ed-rel-gazebo-1 /dev/ubi0
$ ubirmvol -N rootfs-wired-14-202005181203-G201ba9ed-rel-gazebo-2 /dev/ubi0
4. copy over the sysupgrade.bin for the router and use sysupgrade
to make the installation permanent.
Notable changes from ar71xx support:
- LED colors are now different, because nu801 userspace driver is used
for the RGB LED.
Acknowledgments:
- Hal Martin, for providing additional devices for research, including
one modded for SPI boot and with removable NAND
- Christian Lamparter for initial device tree and image configuration
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
[Finished support, updated commit message with new installation
methods] Co-authored-by: Christian Lamparter <chunkeey@gmail.com> Co-authored-by: Lech Perczak <lech.perczak@gmail.com> Signed-off-by: Lech Perczak <lech.perczak@gmail.com> Link: https://github.com/openwrt/openwrt/pull/17665 Signed-off-by: Robert Marko <robimarko@gmail.com>
kernel: crypto-sha512-arm64: do not package with kernel 6.18
Since upstream commit 60e3f1e9b7a5 ("lib/crypto: arm64/sha512:
Migrate optimized SHA-512 code to library"), the kernel module is no
longer available, and its fucntionality os provided by the kernel
core. Thus do not try to package this for linux 6.18 and later.
I generate patches form git, so maintaining an old numbering scheme
does not integrate well with my workflow. renumber the pacthes here so
that the commit shows only the changes to the patches.
Create the config and relevant patches for 6.18 from 6.12. The
"standard" openwrt devel process seems to be to move the files and
restore the old ones. I find this process confusing, and I don't see
any git benefits for doing things this way. So just copy the files.
qualcommbe: drop "port_" from PPE port clock and reset names
The lastest ethernet PPE driver, uses "mac", "rx", and "tx", without
the "port_" prefix for the port clocks and resets. The PPE ports are
declared by the device dts. In order to support v6.12 and v6.18
kernels simultaneously, update the kernel patches and kiwi-dvk
devicetree to use the newer naming scheme.
Konstantin Demin [Tue, 19 May 2026 13:38:13 +0000 (16:38 +0300)]
dropbear: adjust failsafe script
- try to detect supported (hostkey) algorithms; otherwise fallback to predefined list;
- remove size constraint for ECDSA: custom build may include only 384 or 521 bit curves;
- remove size constraint for RSA: default RSA key size is 2048 bits which is sufficient for SSH security recommendations, and previous value of 1024 bits is considered insecure.
Alessio Ferri [Mon, 25 May 2026 13:15:03 +0000 (15:15 +0200)]
b43-tools: introduce support for rev22 in b43-fwsquash.py
rev22 has been ignored in fwsquash for the lack of supported binary blobs
containing the required firmware.
Now that fwcutter is able to parse the blob included in the gpl release
of dlink dsl 3580l, fwsquash need to keep the extracted files.
Qingfang Deng [Wed, 27 May 2026 01:29:06 +0000 (09:29 +0800)]
ramips: reduce ARCH_DMA_MINALIGN
Currently, Ralink SoCs use the default ARCH_DMA_MINALIGN value of 128
bytes defined in mach-generic. This is excessive for these platforms
and leads to significant memory waste in kmalloc.
Override ARCH_DMA_MINALIGN to use L1_CACHE_BYTES, which is 16 bytes for
RT288X and 32 bytes for other Ralink SoCs.
Felix Fietkau [Wed, 27 May 2026 10:24:40 +0000 (12:24 +0200)]
mac80211: add ieee80211_txq_aql_pending()
Add a function to allow drivers to query the pending AQL airtime
for a given txq, for both unicast and broadcast.
This will be used for mt76 to limit buffering in AP mode for power-save
stations.
Lorenzo Bianconi [Mon, 25 May 2026 12:17:39 +0000 (14:17 +0200)]
airoha: Improve LRO performances
Add hardware TCP Large Receive Offload (LRO) support to the airoha_eth
driver, leveraging the EN7581/AN7583 SoC's 8 dedicated LRO hardware queues
mapped to RX queues 24–31. LRO hw offloading does not support
Scatter-Gather (SG) so it is required to increase the page_pool allocation
order to 2 for RX queues 24–31 (LRO queues).
Performance comparison between GRO and hw LRO has been carried out using
a 10Gbps NIC:
GRO: ~2.7 Gbps
LRO: ~8.1 Gbps
Tested-by: Madhur Agrawal <madhur.agrawal@airoha.com> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Link: https://github.com/openwrt/openwrt/pull/23530 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Robert Marko [Mon, 25 May 2026 19:26:14 +0000 (21:26 +0200)]
mvebu: cortexa53: uDPU/eDPU: update active bootscript as well
Currently, sysupgrade will only upgrade the unused slot, however since the
whole dual firmware logic is in the bootscript U-boot will just use the
first bootscript it finds.
So, in a case that you are running slot A it will upgrade slot B, however
that means that slot B will be still booted by the old bootscript that came
with the previous firmware version.
This is an issue if you need to change anything, so lets add a custom
function that upgrades the active bootscript as well after flashing the
slot firmware.
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Robert Marko [Mon, 23 Feb 2026 16:41:18 +0000 (17:41 +0100)]
mvebu: cortexa53: uDPU/eDPU convert to dual firmware (A/B)
Methode uDPU and eDPU devices are one of the rare ones with a completely
custom image format being used with custom partition table with F2FS.
Instead of converting the boards to dual firmware (A/B style) and further
expand the already convoluted custom scripts, especially considering that
dual firmware conversion is a breaking change anyway, lets convert to using
the generic eMMC sysupgrade based images.
F2FS ZSTD compression is preserved thanks to fstools now supporting its use
on overlays.
Dual firmware support is implemented via U-Boot scripts so no U-Boot
upgrade is required.
Since there is a partition table layout change, eMMC must be wiped and
reflashed with the generated GPT image from OpenWrt initramfs.
Then on each sysupgrade the firmware slot will be altered.
Instructions:
1. Boot into OpenWrt initramfs
2. Copy openwrt-mvebu-cortexa53-methode_edpu-squashfs-emmc-gpt.img.gz to
the device into /tmp
3. Erase eMMC:
dd if=/dev/zero of=/dev/mmcblk0 bs=1M
4. Extract image
gzip -d /tmp/openwrt-mvebu-cortexa53-methode_edpu-squashfs-emmc-gpt.img.gz
5. Flash image
dd if=/tmp/openwrt-mvebu-cortexa53-methode_edpu-squashfs-emmc-gpt.img of=/dev/mmcblk0
6. Reboot
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Taiga Ogawa [Tue, 19 May 2026 02:11:36 +0000 (02:11 +0000)]
qualcommax: ipq50xx: add support for ELECOM WRC-X3000GST2
ELECOM WRC-X3000GST2 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router based on
IPQ5018. The only hardware difference from the WRC-X3000GS2 is the RAM
capacity; all other peripherals are identical. This port therefore
reuses the GS2 board-2.bin (ipq-wifi-elecom_wrc-x3000gs2) and ath11k
calibration variant.
1. Boot WRC-X3000GST2 normally in router mode
2. Access the WebUI ("http://192.168.2.1/") and open the firmware
update page ("ファームウェア更新")
3. Select the OpenWrt factory.bin image and click apply ("適用")
4. After the device reboots automatically, wait until the green power LED
stops blinking and stays solid
5. When the green power LED is solid, hold the reset button until the red
LED starts blinking to clear remaining stock firmware settings
- This device has dual-boot feature and it's managed by the index in the
0:bootconfig and 0:bootconfig1 partitions.
- Wi-Fi BDF is shared with WRC-X3000GS2 (ipq-wifi-elecom_wrc-x3000gs2)
as the hardware (SoC, QCN6122, antennas) is identical between the two
models.
- GST2 stock firmware keeps its configuration even when sysupgrade is
called with -n. When installing from the OEM WebUI, those stock
settings can be restored into OpenWrt overlay, so settings must be
initialized after the first OpenWrt boot.
Jan-Henrik Bruhn [Tue, 19 May 2026 22:30:36 +0000 (00:30 +0200)]
realtek: add support for Linksys LGS328MPCv2
Hardware specification
----------------------
* RTL9301 SoC, 1 MIPS 34KEc core @ 800MHz
* 512MB DRAM
* 2MB NOR Flash
* 128MB NAND Flash
* 24 x 10/100/1000BASE-T ports with PoE+
* 4 x 10G SFP+ ports
* Power LED, Fault LED, PoE Max LED, LAN Mode LED, PoE Mode LED
* Reset button and LED Mode button on front panel
* LM63 Fan Controller
* UART (115200 8N1) via RJ45
* PSE: Nuvoton M0516LDE via I2C + 3x RTL8238B (not supported yet)
Installation using serial interface
-----------------------------------
1. Press "a" "c" "p" during message "Enter correct key to stop autoboot"
2. Start network "rtk network on"
3. Load image "tftpboot <TFTP IP>:openwrt-realtek-rtl930x_nand-linksys_lgs328mpc-v2-initramfs-kernel.bin"
4. Boot image "bootm"
5. Switch to first bootpartition "fw_setsys bootpartition 0"
6. Download sysupgrade "scp <IP>:openwrt-realtek-rtl930x_nand-linksys_lgs328mpc-v2-squashfs-sysupgrade.bin /tmp/."
7. Install sysupgrade "sysupgrade /tmp/openwrt-realtek-rtl930x_nand-linksys_lgs328mpc-v2-squashfs-sysupgrade.bin"
Installation using OEM webinterface
-----------------------------------
This is not possible because the OpenWrt NAND Flash layout is different
from the vendor layout. To be precise. Vendor uses:
Jonas Jelonek [Wed, 20 May 2026 21:43:33 +0000 (21:43 +0000)]
realtek: pcs: rtl930x: force IP mode OFF in deactivate, unforce for MAC modes
Make deactivate fully restore the SerDes to an inert state at both the
MAC and IP layers. Previously deactivate only zeroed the MAC mode via
set_mode(OFF), which on the default branch only writes the MAC mode
register and leaves the IP mode register untouched. The IP mode register
then retained whatever the previous bring-up left behind (force=1 with
a stale mode value, or force=0 from boot defaults), making "deactivate"
not fully deactivate the SerDes.
Replace the set_mode(OFF) call with explicit set_mac_mode(OFF) plus
set_ip_mode(OFF). The latter writes force=1 with mode=OFF, pinning the
IP block to OFF until a subsequent bring-up takes a defined action.
This forced-OFF state would break MAC-driven modes (USXGMII / QSGMII /
XSGMII), which set only the MAC mode register and rely on the IP block
following along. To compensate, add an explicit unforce of the IP mode
force-bit (page 0x1f reg 0x09 bit 6) at the start of the MAC-mode branch
of rtpcs_930x_sds_set_mode. IP-mode bring-up via apply_ip_mode is
unaffected -- it re-asserts force=1 with the target mode value, which
overrides the deactivate force-OFF.
Net result: deactivate fully and explicitly deactivates the SerDes; each
set_mode path takes its own responsibility for the IP mode register
state. The previous asymmetric behaviour (set_mode default branch silently
not touching the IP register) is now explicit code rather than an
implicit accident-of-dispatch.
Verified on RTL930x hardware: SGMII, 2500BASE-X, 10GBASE-R, USXGMII-QX
and XSGMII all bring up correctly with link, traffic and iperf3 as
expected.
Jonas Jelonek [Wed, 20 May 2026 19:57:32 +0000 (19:57 +0000)]
realtek: pcs: rtl930x: lift SerDes core power-cycle into {de,}activate
Move rtpcs_930x_sds_set_power() and rtpcs_930x_sds_rx_reset() out of
rtpcs_930x_sds_apply_ip_mode() and into rtpcs_930x_sds_{de,}activate().
After this, apply_ip_mode is pure IP-mode/CMU/state-machine programming
and the SerDes-core analog power is owned by the outer phase pair, the
same place that already owns the 1G/10G PHY block and fiber RX power.
Behavioural change: USXGMII / QSGMII / XSGMII modes did not previously
go through apply_ip_mode and therefore never had the SerDes-core power
gated on mode transitions. After this commit, every mode transition
power-cycles the SerDes core via the outer deactivate/activate.
For the SGMII / 1000BASE-X / 2500BASE-X / 10GBASE-R path the set of
register writes is unchanged; only the relative ordering vs. the
fiber/PHY power writes shifts: set_power(false) now precedes those
writes (was after), set_power(true) now follows them (was before).
Verified on RTL930x hardware: SGMII, 2500BASE-X, 10GBASE-R, USXGMII-QX
and XSGMII all come up with link, ping and iperf3 throughput as
expected.
Jonas Jelonek [Wed, 20 May 2026 18:33:40 +0000 (18:33 +0000)]
realtek: pcs: rtl931x: run set_mode before activate
Move rtpcs_931x_sds_set_mode(sds, hw_mode) ahead of
rtpcs_931x_sds_activate() in rtpcs_931x_setup_serdes(). The IP-block
mode registers latch with the SerDes powered down, so the mode can be
committed during the configure phase rather than after power-on.
This matches the phase order already used by 838x and 930x
(deactivate -> configure -> set_mode -> activate) and is a step toward
a unified bring-up sequence across variants.
Verified on RTL931x hardware: USXGMII, SGMII and 10GBASE-R modes all
come up, link is established, L2 forwarding works, and iperf3 reports
expected throughput.
Jonas Jelonek [Wed, 22 Apr 2026 14:35:18 +0000 (14:35 +0000)]
realtek: pcs: rtl930x: fold 1G/10G PHY power into {de,}activate
Move the 1G and 10G PHY block power-up writes (clear BMCR_PDOWN on pages
0x02 and 0x04) out of rtpcs_930x_phy_enable_10g_1g() and into
rtpcs_930x_sds_activate(), and add the mirror writes (set BMCR_PDOWN) to
rtpcs_930x_sds_deactivate(). Same for the fiber RX bit.
With 1G PHY / 10G PHY / fiber RX all now handled symmetrically, drop the
rtpcs_930x_phy_enable_10g_1g() helper. The remaining write it contained
(set medium = fiber on page 0x1f reg 11 bit 1) is unrelated to power
management, unconditionally applied, and to-be-inspected for non-fiber
modes. Move it inline into setup_serdes with a TODO comment; proper
mode-aware handling is out of scope for this commit.
Behavioural note: the 1G/10G PHY blocks and fiber RX are now
power-cycled on every mode transition. Previously they were only
powered up (never explicitly down) and the state persisted across
reconfigure. The new behaviour makes each setup_serdes a standalone
bring-up that does not rely on the prior state of these bits.
Mirror of the previous sds_deactivate commit: add rtpcs_{838x,931x}_sds_activate()
helpers that each wrap the variant-specific "bring the SerDes back to operational"
block-power call at the end of setup_serdes, and replace the inline call.
RTL839x and RTL930x are intentionally not given an activate helper in this
commit:
- RTL839x calls rtpcs_839x_sds_reset() at the end of setup_serdes. That is
a reset pulse whose internals (per-type 10G/5G analog sequences, internal
REG3 0x7146 -> 0x7106 dance) are not yet fully characterized. Aliasing
it as _activate would misrepresent the function.
- RTL930x has no separate activation step: rtpcs_930x_sds_set_mode(sds,
hw_mode) is what commits the new mode and is intended to be surfaced
as its own "set mode" phase in a later commit rather than hidden inside
a variant-specific _activate wrapper.
Both variants will be revisited when their respective phases are clarified.
This commit is a pure refactor, no behavioural change.
Add rtpcs_{838x,930x,931x}_sds_deactivate() helpers that each encapsulate
the variant-specific "make SerDes inert before reconfigure" sequence, and
replace the inline calls at the start of each setup_serdes with a single
call to the new helper:
RTL839x has no deactivate step to factor out and is left unchanged.
This is a pure refactor: same register writes, same order, same return-
value handling at the call site. The helpers give each variant a named
hook for the deactivate phase and prepare for a subsequent commit that
promotes it to an rtpcs_sds_ops entry and hoists the call site into
rtpcs_pcs_config.
Hauke Mehrtens [Mon, 25 May 2026 23:17:13 +0000 (01:17 +0200)]
libiwinfo: update to Git HEAD (2026-05-26)
f35c47d50bf2 devices: add device id for MediaTek MT7921E 6e198d375752 nl80211: fix corrupt scan results from wpa_supplicant cd7db6194a71 devices: add device id for Qualcomm Technologies QCN6224/9224/9274 66bdd1a07189 devices: add device id for Qualcomm Atheros QCA9994
Štěpán Dalecký [Tue, 19 May 2026 06:17:43 +0000 (08:17 +0200)]
mvebu: add mwifiex sdio kernel module for Turris Mox
Turris Mox boards may include an SDIO Wi-Fi module based on the
Marvell 88W8997 chip. Add kmod-mwifiex-sdio to the default package
list so the driver is included in the image out of the box.
Štěpán Dalecký [Tue, 19 May 2026 06:17:43 +0000 (08:17 +0200)]
mvebu: add fw_env.config for Turris Mox
Turris Mox stores the U-Boot environment in SPI NOR flash. Add the
fw_env.config entry pointing to MTD partition 2 at offset 0x0 with
64 KiB env size and sector size, so userspace tools fw_printenv and
fw_setenv work correctly on this board.
Štěpán Dalecký [Tue, 19 May 2026 06:17:43 +0000 (08:17 +0200)]
mvebu: fix squashfs boot for Turris Mox
The bootscript had several issues that prevented squashfs from booting:
- bootpath was set to "/" causing double slashes in load paths (e.g.
"//Image"); changed to "" so "${bootpath}/Image" resolves to "/Image"
- rootflags was set to "commit=5" (a btrfs-specific mount option) for
the ext4/squashfs case; cleared to empty string
- rootfstype was missing in the non-btrfs branch; added "auto" to let
the kernel detect the filesystem; the btrfs branch now sets "btrfs"
explicitly
- bootargs incorrectly referenced ${bootfstype} (the distroboot input
variable) instead of the locally constructed ${rootfstype}
- has_dtb assignment used shell-style "has_dtb=1" but was cleared with
"setenv has_dtb 0"; unified both to use setenv
- DTB load failure message now includes the attempted file path
- Fixed Image.lzma error echo that still used a stale "${subvol}/boot/"
prefix; now consistently uses ${bootpath}
- Removed undefined variable "rootpart" from env delete
xinmu [Thu, 14 May 2026 09:34:17 +0000 (17:34 +0800)]
loongarch64: add upstream dwmac-loongson patches for 2K3000/3B6000M
Add three backported patches from Linux upstream to fix the onboard
Ethernet controller (dwmac-loongson) detection and driver issues on
Loongson 2K3000 and 3B6000M platforms.
These patches are taken from the upstream Linux kernel and retain the
original authorship and commit logs. No other modifications are made
to the loongarch64 target.
The patches address the following symptoms:
- Onboard network interface not recognized
- Driver probe failures on 2K3000/3B6000M boards
Mikhail Zhilkin [Wed, 20 May 2026 20:22:29 +0000 (23:22 +0300)]
mediatek: add support for netis EAP930 V1
This commit adds support for netis EAP930 V1 ceiling access point.
Specification
-------------
- SoC : MediaTek MT7981BA dual-core ARM Cortex-A53 1.3 GHz
- RAM : 256 MiB DDR3 (ESMT M15T2G16128A-EFB)
- Flash : SPI-NAND 128 MiB (ESMT F50L1G41LB-104)
- WLAN : MediaTek MT7976CN dual-band WiFi 6
- 2.4 GHz : b/g/n/ax, MIMO 2x2
- 5 GHz : a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x1 (SoC internal phy)
- USB : No
- Buttons : Reset
- LEDs : 1x Status (red), gpio-controlled
1x Status (blue), gpio-controlled
- Power : 48 VDC (PoE) or 12 VDC, 1.5 A
Installation
------------
1. Connect to the access point using ssh (user: admin, pass: web interface
password)
2. Make mtd backup:
cat /dev/mtd0 | gzip -1 -c > /tmp/mtd0_spi0.0.bin.gz
cat /dev/mtd1 | gzip -1 -c > /tmp/mtd1_BL2.bin.gz
cat /dev/mtd2 | gzip -1 -c > /tmp/mtd2_u-boot-env.bin.gz
cat /dev/mtd3 | gzip -1 -c > /tmp/mtd3_Factory.bin.gz
cat /dev/mtd4 | gzip -1 -c > /tmp/mtd4_FIP.bin.gz
cat /dev/mtd5 | gzip -1 -c > /tmp/mtd5_ubi.bin.gz
3. Download mtd backup from the /tmp dir of the router to your PC using
scp protocol
4. Upload OpenWrt 'bl31-uboot.fip', 'preloader.bin' images to the /tmp
dir of the router using scp protocol
5. Write FIP and BL2 (replace bootloader):
mtd write /tmp/bl31-uboot.fip FIP
mtd write /tmp/preloader.bin spi0.0
6. Place OpenWrt
'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
on the tftp server (IP: 192.168.1.254)
7. Erase 'ubi' partition and reboot the router:
mtd erase ubi
reboot
8. U-Boot automatically boot OpenWrt recovery image from tftp server to
the RAM (1 Gbps link is required)
9. Upload OpenWrt 'sysupgrade.itb' image to the /tmp dir of the router
(IP: 192.168.1.1) using scp protocol
10. Connect to the router using ssh and run:
sysupgrade -n squashfs-sysupgrade.itb
Recovery
--------
1. Place OpenWrt
'openwrt-mediatek-filogic-netis_eap930-v1-initramfs-recovery.itb' image
on the tftp server (IP: 192.168.1.254)
2. Press Reset button and power on the router. After ~10 sec release
the button.
3. Use OpenWrt initramfs system for recovery
Return to stock
---------------
1. Upload stock BL2, FIP, ubi partitions backup archives to the /tmp dir
of the router using scp protocol
2. Connect to the router using ssh and run:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
mtd unlock BL2
mtd unlock FIP
4. Restore backups:
zcat /tmp/mtd1_BL2.bin.gz | mtd write - BL2
zcat /tmp/mtd4_FIP.bin.gz | mtd write - FIP
zcat /tmp/mtd5_ubi.bin.gz | mtd write - ubi
3. Reboot the router:
reboot
UART
----
Connection parameters: 115200, 8N1, 3.3V
UART pins are silkscreened on the PCB.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 88:xx:xx:88:xx:d3 | label |
| WLAN 2g | 88:xx:xx:18:xx:d4 | |
| WLAN 5g | 88:xx:xx:78:xx:d4 | |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'Factory', 0x1fef20
The WLAN 2g/5g MAC prototype (hex) was found in 'Factory', 0x4
U-Boot v2026.01 introduced drivers/mtd/nand/spi/otp.c which adds `spinand_user_otp_size()` and
`spinand_fact_otp_size()`. These functions are called unconditionally from `spinand_init()` in
drivers/mtd/nand/spi/core.c to determine whether to set up OTP methods:
if (spinand_user_otp_size(spinand) || spinand_fact_otp_size(spinand)) {
ret = spinand_set_mtd_otp_ops(spinand); /* drivers/mtd/nand/spi/core.c:2369 */
...
}
Both OTP size functions pass `&spinand->user_otp->layout` or `&spinand->fact_otp->layout` to
`spinand_otp_size()` without first checking whether the pointer is NULL. In the standard probing
path, these pointers are assigned by `spinand_match_and_init()` from the per-chip `spinand_info`
table. `100-21-mtd-spi-nand-add-CASN-page-support.patch` adds CASN detection to `spinand_detect()`
so that when a CASN page is found, `spinand_init_via_casn()` is called instead of
`spinand_id_detect()`. As `spinand_match_and_init()` is only called via `spinand_id_detect()`, it
is never invoked for CASN-probed devices.
As a result, `spinand->user_otp` and `spinand->fact_otp` remain NULL from the zero-initialised DM
priv allocation. Both `spinand_user_otp_size()` and `spinand_fact_otp_size()` spuriously return
non-zero by reading `layout->npages` from a small mapped address computed from their respective
NULL pointer, causing `spinand_init()` to call `spinand_set_mtd_otp_ops()` which reads
`spinand->user_otp->ops` and thereby silently assigns a garbage value to `user_ops` that is then
dereferenced at `if (user_ops->info)`.
On COMFAST CF-WR632AX (MT7981, Winbond W25N01GV) this results in a "Synchronous Abort" during boot.
The crash was confirmed via `addr2line` on the U-Boot ELF:
"Synchronous Abort" handler, esr 0x96000004, far 0xeafffffeeafffffe
elr: 0000000041e2ff44 (drivers/mtd/nand/spi/otp.c:343)
lr : 0000000041e2f2f8 (drivers/mtd/nand/spi/core.c:2369)
The same was observed on Acer Predator Connect W6x (MT7986, Winbond W25N02KV):
"Synchronous Abort" handler, esr 0x96000004, far 0xeafffffeeafffffe
elr: 0000000041e2c868 (drivers/mtd/nand/spi/otp.c:343)
lr : 0000000041e2bc1c (drivers/mtd/nand/spi/core.c:2369)
Fix this by adding NULL guards to both OTP size functions so that they return 0 when the pointer is
NULL. With both functions returning 0, the condition in `spinand_init()` evaluates to false and
`spinand_set_mtd_otp_ops()` is never called, skipping setup of OTP methods entirely for CASN-probed
SPI NAND chips.
This change has no effect on SPI NAND chips that do have OTP data but not CASN. For those chips,
`spinand_match_and_init()` sets `spinand->user_otp` and `spinand->fact_otp` to non-NULL values from
the per-chip table, the NULL guard does not activate, and the existing behaviour is unchanged.
Fixes: https://github.com/openwrt/openwrt/issues/23430 Fixes: b94de14bafd06660536691ed633f364edf5fbe4d ("uboot-mediatek: update to v2026.01") Signed-off-by: Ryan Leung <untilscour@protonmail.com> Link: https://github.com/openwrt/openwrt/pull/23447 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Installation:
Log in via SSH to the unit, default username and password are 'root' and
'dragino', respectively. SSH listens on port 2222.
Just 'sysupgrade -n' from vendor firmware, dropping old configuration.
Restore vendor firmware:
the same as installation, just 'sysupgrade -F -n', dropping configuration.
Lech Perczak [Wed, 20 May 2026 13:46:09 +0000 (15:46 +0200)]
ath79: support Dragino MS14
Dragino MS14 is a small router/development kit with two Fast Ethernet
ports, with single 1x1 2,4GHz Wi-Fi radio and expansion headers.
Specifications:
CPU: Atheros AR9330 SoC @400MHz,
RAM: 64MB DDR,
Flash: 16MB SPI-NOR,
Ethernet: Two 100Mbps ports, LAN on eth0, WAN on eth1,
Wireless: built-in 1x1 802.11 2.4GHz radio,
USB: single USB2.0 High speed host port,
LEDs: 4 status LEDs for system, LAN, WAN and WLAN.
UART: 115200-8-N-1 at the 2x8 header
Label MAC: Wi-Fi interface.
The board support is ported over from old ar71xx target, and only
partially verified using LPS8 board, which will be introduced next.
Installation:
Log in via SSH to the unit, default username and password are 'root' and
'dragino', respectively. SSH listens on port 2222.
Just 'sysupgrade -n' from vendor firmware, dropping old configuration.
Update with configuration from ar71xx builds may be possible, but isn't
guaranteed, as the builds are many releases apart.
Restore vendor firmware:
the same as installation, just 'sysupgrade -F -n', dropping configuration.
* Add a post-release patch for timezone handling in datetime string
matching (affecting at least uhttpd):
bug report: https://www.openwall.com/lists/musl/2026/03/22/3
fix: https://www.openwall.com/lists/musl/2026/03/30/6
new features:
- posix_getdents interface (new in POSIX-2024)
- renameat2 interface (linux extension)
- iconv support for CP858
- vdso clock_gettime for riscv{32,64}, powerpc{,64}, and s390x
- loongarch64 TLSDESC support
- exposed __getauxval for compiler runtime use detecting cpu features
compatibility:
- initgroups no longer artificially limits number of supplementary groups
- getusershell now skips blank lines and comments
- exit is now explicitly thread-safe (possible future requirement)
- atexit now fails rather than deadlocking if called from late dtor
- strerror now has error strings for EUCLEAN and ENAVAIL
- isatty no longer collapses errors to ENOTTY
- sched.h namespace pollution with _GNU_SOURCE is reduced
- hasmntopt now matches only whole options, not arbitrary substrings
- shadow.h no longer declares an unimplemented sgetspent interface
- vdso with missing sysv hash table (only gnu hash) is now supported
conformance:
- pwrite now handles O_APPEND correctly, reports error if it can't
- mbnrtowcs now conforms to new POSIX-2024 requirement for partial character
- iconv GBK now properly includes euro symbol
- strptime now accepts conversion specifiers added in POSIX-2024
- inet_ntop IPv6 "zero compression" now conforms to RFC 5952
bugs fixed:
- iconv euc-kr decoder could do oob writes on invalid inputs (CVE-2025-26519)
- iconv shift_jis decoder could produce wrong outputs for some invalid inputs
- printf did not honor hex float precision correctly in some cases
- lost or delayed wakes in sem_post under race condition
- termios input speed handling was wrong
- strcasestr failed to match zero-length needle
- fma handled corner case with negative zero wrongly
- syslog LOG_MAKEPRI macro was incorrect
- timer_create is no longer affected by known pthread_barrier bugs
- sysconf(_SC_MINSIGSTKSZ) computed min size incorrectly
- statx emulation left some fields uninitialized
- mntent wrongly included final newline in parsed field output
- SIGEV_THREAD timers could abort process if SIGTIMER became unblocked
- bind_textdomain_codeset returned wrong value
arch-specific bugs fixed:
- early dynamic linker handled page size wrong on dynamic pagesize archs
- arm and aarch64 crti/n files had wrong alignment
- m68k POLLWRNORM and POLLWRBAND values were incorrect
- x32 mq ABI was mismatched
bcm47xx: base-files: hack sysinfo to allow ASU sysupgrades
This old platform(no DTS) is using nvram numeric fields (or "unknown"
string) for its board_name [1]. Allow ASU sysupgrades by preserving
that value in /tmp/sysinfo/boardtype for board-detection/configuration
logic, and derive a canonical board_name from /tmp/sysinfo/model in
the form "vendor,device-variant".
Only a few target profile image names are not consistent in the last
suffix, uniform them.
A few images with (NA) and (ROW) variants are only meant to be
compatible with the upgrade process in the OEM firmware using these
NETGEAR_BOARD_ID and NETGEAR_REGION fields but the images are
compatibles(only if the NETGEAR_BOARD_ID is shared,due to platform
check) [2] (i.e. netgear_wnr3500l).
Add SUPPORTED_DEVICES to one of these variant in order to allow ASU
sysupgrade profile identification.
*Since this target has never implemented fwtool's SUPPORTED_DEVICES
metadata check, there is no risk of breaking forceless sysupgrade with
new board_name values.
[1]: bcm47xx board info https://github.com/gregkh/linux/blob/master/arch/mips/bcm47xx/board.c
[2]: sysupgrade platform check https://github.com/openwrt/openwrt/blob/main/target/linux/bcm47xx/base-files/lib/upgrade/platform.sh
Shiji Yang [Sat, 23 May 2026 13:42:19 +0000 (21:42 +0800)]
toolchain/gcc: use configure option to disable TM clone registry
GCC 10 added the new configure option --disable-tm-clone-registry[1].
It is useful for reducing code size in embedded systems. Our local hack
patch is no longer needed.
1. Boot WSR-2533DHP3 with "Router" mode
2. Access to "http://192.168.11.1/" and open firmware update page
("ファームウェア更新")
3. Select the OpenWrt factory.bin image and click update ("更新実行")
button
4. Wait ~120 seconds to complete flashing
Note:
- This device has 2x OS images on flash. The first one will always be
used for booting and the secondary is for backup.
Tested:
- initramfs boot
- factory.bin installation from OEM WebUI
- LAN port assignment
- WAN DHCP
- NAT routing
- 2.4 GHz Wi-Fi
- 5 GHz Wi-Fi
- LEDs
- Buttons
MAC Addresses:
LAN : 58:27:8C:xx:xx:90 (board_data, mac (text))
WAN : 58:27:8C:xx:xx:90 (board_data, mac (text))
2.4 GHz: 58:27:8C:xx:xx:91
5 GHz : 58:27:8C:xx:xx:94
Migration to OpenWrt:
- Download the RSA-signed intermediate firmware from the Cudy website: `openwrt-ramips-mt76x8-cudy_wr300-squashfs-flash.bin`
- Connect the computer to the LAN and flash the intermediate firmware via the OEM web interface
- OpenWrt is now accessible via 192.168.1.1
Revert to OEM firmware:
- Set up a TFTP server on IP 192.168.1.88 and connect to the WAN port (upper port)
- Provide the Cudy firmware as `recovery.bin` in the TFTP server
- Power on the device and hold the reset button immediately after the first LED blink
- The recovery process will start
- When the recovery process is done, OEM firmware is accessible via 192.168.10.1 again
General information:
- No possibility to load an initramfs image via U-Boot because there is no option to interrupt U-Boot
Mathew McBride [Fri, 1 May 2026 02:16:33 +0000 (12:16 +1000)]
kernel: armsr: remove duplicate kconfig between generic and armsr
These were found by running:
comm -12 <(sort target/linux/generic/config-6.18) \
<(sort target/linux/armsr/config-6.18)
A similar process has been run between armsr/config-6.18
and armsr/armv8/config-6.18, though I have not pruned
the armv8 as much. Once the main branch switches armsr
to 6.18 we can do a more aggressive deduplication.
kernel: armsr: move framebuffer and DRM related options to top-level
The armv8 configuration has more features enabled compared to armv7,
as armv8 is intended to run on a selection of real hardware, while
armsr/armv7 almost always runs only in QEMU.
Some kmod dependency issues were appearing on armv7 builds which
did not appear elsewhere. To minimise these issues, we will
move the framebuffer feature set to the top level of the target.
projects / thirdparty / openwrt.git / log
