This concatenates the ubi partition (19.9 MiB) with the ecos partition
(96.1 MiB) into a single virtual MTD device for UBI, giving ~116 MiB
of usable flash space.
Rany Hany [Sat, 4 Jul 2026 23:58:34 +0000 (23:58 +0000)]
intel-microcode: fix build error on rebuild
When rebuilding the package, iucode_tool fails with a "File exists"
error if the directory already contained firmware from the previous
build (incl. in the successful build case).
Fix this by removing the directory before invoking iucode_tool.
Fixes the following build error:
iucode_tool: 06-0f-02: cannot write to, or create file: File exists
make[2]: *** [Makefile:57: .../.built] Error 2
Cherry pick the patches recommended in the hostapd security advisory
2026-1:
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
Vulnerability
Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE
802.11be/Wi-Fi 7) information has been identified in hostapd and
wpa_supplicant. These issues show up in various cases where frames
including information on affiliated links are parsed and processed in
both AP and STA modes. The issues can result in process termination due
to buffer read overflow checks and memory corruption.
The issues for AP mode (hostapd or wpa_supplicant) can result in
denial-of-service attacks due to process termination and small memory
corruption that could theoretically cause other issues, but it does not
seem likely that those could be exploiting in practice. Affected areas
can be reached by sending invalid Management frames without needing
authentication or user action on the target device.
mediatek: filogic: add USB VBUS regulator for Globitel BT-R320
USB VBUS on the BT-R320 is controlled by GPIO14.
Add a fixed regulator and hook it up to the xHCI controller.
GPIO_ACTIVE_HIGH was tested on the device: the dummy regulator warning is gone and a USB device enumerates.
mediatek: filogic: fix Globitel BT-R320 recovery image name
The initramfs image name already contains "-initramfs". Using "-initramfs-recovery.itb" as the suffix makes the BT-R320 recovery artifact contain it twice.
Use "-recovery.itb" instead.
Fixes: a3105d3f9573 ("mediatek: filogic: add support for Globitel BT-R320") Signed-off-by: solodecode <zikwarface134@gmail.com> Link: https://github.com/openwrt/openwrt/pull/24059 Signed-off-by: Robert Marko <robimarko@gmail.com>
John Audia [Sat, 4 Jul 2026 10:22:06 +0000 (06:22 -0400)]
dnsmasq: migrate dhcpv4/dhcpv6 default on upgrade
Commit 6f30f08d0e ("dnsmasq: add fallback for default dhcpv4/dhcpv6
values") changed dnsmasq.init to default the 'dhcpv4'/'dhcpv6' UCI
options to 'disabled' when a 'config dhcp' section leaves them unset:
The intent was to match odhcpd, which already treats an unset value
as disabled, so both backends behave the same way for newly created
configs. Its companion commit 85767ac8fe added explicit
'option dhcpv4/dhcpv6 server' lines to the stock 'lan' section in the
packaged dhcp.conf template, which covers fresh installs.
Neither commit accounts for configs that predate the change. Before
it, an unset dhcpv4/dhcpv6 option was implicitly treated as enabled,
so it was common (and still is, on any router upgraded from before
this landed) to have 'config dhcp' sections for additional
interfaces/VLANs with no explicit dhcpv4/dhcpv6 option at all. After
the change, dnsmasq.init silently skips '--dhcp-range' for every one
of those sections:
if [ "$dhcpv4" != "disabled" ]; then
...
fi
The result: any interface whose dhcp section never needed the option
before stops handing out leases entirely, with nothing logged beyond
a normal dnsmasq startup, while sections that happen to already carry
an explicit 'server' value keep working. On a router with several
VLANs this looks exactly like "DHCP only works on one interface."
Fix by shipping a one-time /etc/uci-defaults migration, matching the
existing 50-dnsmasq-migrate-resolv-conf-auto.sh /
50-dnsmasq-migrate-ipset.sh pattern in this package: for every
'config dhcp' section, if dhcpv4/dhcpv6 is unset, explicitly set it
to 'server', preserving the pre-6f30f08d0e behavior for existing
configs. Sections that already set the option (or set 'disabled'
deliberately) are left untouched, and sections that never reach the
check (e.g. 'wan' with 'option ignore 1') are unaffected.
Shiji Yang [Fri, 3 Jul 2026 14:56:39 +0000 (22:56 +0800)]
uboot-at91: fix build failure with GCC 14.4
It seems that GCC 14.4 will generate larger binary compared to the
GCC 14.3 on ARM32 platforms. We have to increase the maximum allowed
SPL size to fix build errors.
Robert Marko [Wed, 1 Jul 2026 18:19:21 +0000 (20:19 +0200)]
microchipsw: configure TAS port link speed
On the TSN and RED variants of SparX-5 and LAN969x TAS (Time-Aware Shaper)
is present in the silicon.
Currently, the driver does not use configure it at all, which means that
the TAS_PROFILE_CONFIG.LINK_SPEED[1] value is left at the default of 3
which means that its configured for 1 Gbps.
So, running iperf between two 10G switch ports will result in only 940-ish
Mbps while we should be getting around 9.3 Gbps.
Correctly populating the TAS_PROFILE_CONFIG.LINK_SPEED[1] with the current
port speed fixes this issue and we achieve around 9.4 Gbps between two 10G
switch ports.
So, port the TAS port link speed setting from the vendor BSP 6.18 kernel[2]
Lech Perczak [Tue, 14 Nov 2023 18:44:43 +0000 (19:44 +0100)]
imx: cortexa7: support camera on TechNexion PICO-PI-IMX7D
Enable device packages required for camera support and add relevant device
tree nodes.
The drivers probe and connect properly, but it currently only supports
uncompressed UYVY in 2592x1944, 1920x1080 and 1280x960 resolutions, so I
had to use ustreamer to get the stream over network:
To get the camera working, the following extra packages are needed:
kmod-mux-mmio kmod-video-imx7-csi kmod-video-imx-mipi-csis kmod-video-mux \
kmod-video-ov5645
To set up the capture, you need to set up the links and formats across
the pipeline, for example:
Richard Huynh [Thu, 16 Apr 2026 11:40:53 +0000 (21:40 +1000)]
wifi-scripts: add EHT beamforming options to hostapd config
Some EHT options like beamformer/beamformee
are disabled by default in hostapd.conf
Read the EHT Phy Cap structure and enable/disable
switches within the hostapd.conf for capable hardware.
Without this EHT SU beamformer/beamformee and MU
beamformer capabilities are omitted from AP beacons,
even if the driver reports the hardware as capable.
Matthias Urlichs [Mon, 22 Jun 2026 09:44:20 +0000 (11:44 +0200)]
ath79: add support for Ubiquiti NanoStation Loco M (XW v2)
This commit adds support for the NanoStation Loco M2/M5 XW devices
on the ath79 target with test date (label on the packaging, not the
device) later than October 2017.
To discover whether you have the new version, open a console on the
stock web interface and run `dmesg | grep AR803`. New versions print
AR8035, v1 shows AR8032.
- Use a pointy tool (e.g., pen cap, paper clip) and keep the reset
button on the device pressed
- Power on the device via PoE (keep reset button pressed)
- Keep pressing until LEDs flash alternatively LED1+LED3 =>
LED2+LED4 => LED1+LED3, etc.
- Release reset button
- The device starts a TFTP server at 192.168.1.20
- Set a static IP on the computer (e.g., 192.168.1.21/24)
- Upload via tftp the factory image:
$ tftp 192.168.1.20
tftp> bin
tftp> put openwrt-ath79-generic-xxxxx-ubnt_nanostation-loco-m-xw-v2-squashfs-factory.bin
MAC addresses: stored on Flash, in the "art" partition.
solodecode [Sat, 20 Jun 2026 16:47:40 +0000 (19:47 +0300)]
mediatek: filogic: fix Globitel BT-R320 FIT rootfs mapping
Globitel BT-R320 boots the sysupgrade FIT from the eMMC production
partition with root=/dev/fit0.
The device tree did not describe the production GPT partition and
/chosen/rootdisk did not point at the FIT container. fitblk then had no
rootdisk match and the board stopped at:
Waiting for root device /dev/fit0...
Describe the eMMC GPT partitions, set /chosen/rootdisk to production,
and use the FIT sysupgrade path.
Fixes: a3105d3f9573 ("mediatek: filogic: add support for Globitel BT-R320") Signed-off-by: solodecode <zikwarface134@gmail.com> Link: https://github.com/openwrt/openwrt/pull/23895 Signed-off-by: Robert Marko <robert.marko@sartura.hr>
ath79: fix Ethernet auto-negotiation on Ruckus ZoneFlex 7025
On the ZoneFlex 7025 the uplink port (eth0) is connected to PHY 4 of
the AR7240 built-in switch. This PHY erroneously advertises
1000baseT/Full capability, even though the AR7240 built-in switch only
supports 10/100 Mbps.
Because of the bogus gigabit capability, phylib performs 1000BASE-T
master/slave resolution against the PHY's non-functional gigabit
registers, which never completes. Auto-negotiation then fails: the
link flaps between speeds or never comes up at all, while a manually
forced fixed speed works fine.
Cap the PHY at 100 Mbps so the gigabit capability is removed and the
master/slave resolution path is skipped. eth0 then auto-negotiates
reliably to 100 Mbps full-duplex.
Przemek Rudy [Mon, 23 Feb 2026 10:44:17 +0000 (11:44 +0100)]
mvebu: MikroTik: add support for RB5009UPr+S+IN
The MikroTik RB5009UPr+S+IN is a multigig router based on the Marvell
Armada 7040 SoC, sharing the same hardware base as the RB5009UG+S+IN
with added PoE-out support on all ethernet ports.
Specification:
- SoC : Marvell Armada 7040 (88F7040), 4x Cortex-A72
- CPU frequency : 350-1400 MHz
- RAM : 1 GB
- Flash : 16 MB SPI NOR + 1 GB NAND
- Switch : Marvell MV88E6393X
- Ethernet : 1x 2.5G (p1, QCA8081), 7x 1G (p2-p8), 1x SFP+ 10G
- PoE-in : 802.3af/at on p1, 24-57V
- PoE-out : 802.3af/at on p1-p8, 130 W total
- Power : DC jack / 2-pin terminal / PoE-in, 24-57V
- USB : 1x USB 3.0 type A, max 1.5 A
- LEDs/Keys (GPIO): 4x/1x
- UART : MikroTik SPI/UART combo header (10-pin, 2.0mm pitch)
- assignment : GND Vcc Rx ? GND / CLK DO /CS Tx DI (top view)
- settings : 115200n8
Flash instruction using initramfs image:
RouterBOOT cannot boot the OpenWrt kernel directly. A U-Boot loader
(u-boot.elf) is installed as an intermediary: RouterBOOT loads
u-boot.elf, which then loads the OpenWrt initramfs image.
1. Rename the downloaded initramfs image, removing the version number,
to: openwrt-mvebu-cortexa72-mikrotik_rb5009-initramfs-uImage.itb
2. Set up a BOOTP/TFTP server serving u-boot.elf, with the renamed
initramfs image in the same directory
3. Power off the router, hold the reset button (front panel), power on
and keep holding until the initramfs image has been served, then
release
4. The router boots the initramfs image, reachable at 192.168.1.1
5. Log in via SSH, install U-Boot, wipe NAND and flash OpenWrt:
Przemek Rudy [Mon, 23 Dec 2024 19:28:12 +0000 (20:28 +0100)]
mvebu: rename generic rb5009 to rb5009ug
Specialize RB5009UG model from generic RB5009.
Signed-off-by: Przemek Rudy <prudy@protonmail.com>
[carlo@common-net.org: fixed model name and backward compatibility ] Signed-off-by: Carlo Filippi <carlo@common-net.org> Signed-off-by: Sm00shed <sm00shed@posteo.de> Link: https://github.com/openwrt/openwrt/pull/23698 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
YaleiZang [Tue, 30 Jun 2026 08:13:01 +0000 (16:13 +0800)]
airoha: remove KERNEL_LOADADDR from airoha_an7583-evb device definition
Delete the KERNEL_LOADADDR assignment from the airoha_an7583-evb device definition.
The kernel load address is now centrally managed in image Makefile with, just using default load address:
This ensures the load address configuration is maintained in a single location.
Removing the duplicate assignment prevents confusion and potential misconfiguration.
Rosen Penev [Sun, 28 Jun 2026 21:09:06 +0000 (14:09 -0700)]
apm821xx: move PHY/DSA drivers to DEVICE_PACKAGES on nand boards
Only the devices that actually have these PHYs and DSA switches
should carry the kernel modules, instead of baking them into the
kernel for all nand boards.
These devices have no space constraints, so any size increase is
meaningless.
Dmitry Mostovoy [Sat, 9 May 2026 18:56:45 +0000 (14:56 -0400)]
mediatek: add cudy m3000-v2-yt8821 ubootmod
RAM: ESMT M15T2G16128A-DEB DDR3 1866 MT/s
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdinfo" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Dmitry Mostovoy [Sat, 9 May 2026 15:56:40 +0000 (11:56 -0400)]
mediatek: add cudy m3000-v1 ubootmod
RAM: ESMT M15T2G16128A-DEB DDR3 1866 MT/s
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdinfo" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Sven Eckelmann [Mon, 22 Jun 2026 13:10:38 +0000 (15:10 +0200)]
rtl826x-firmware: ship rtl8261n and rtl8264b in single firmware package
The firmware loading does not depend (solely) on the PHY id. The driver
needs to read out the vendor version id of the PHY before it can decide
which firmware file needs to be loaded.
A split in an RTL8261N and an RTL8264B firmware package is therefore
misleading. And it could even be that a product ships an RTL8264B but
switches the revision of the chip in the middle of its product lifetime. In
this case, the first identification based on the chip ID or the actual chip
ID for the OpenWrt porter might fail for another user with a later/earlier
produced device.
Shipping both files in the same package avoids this problem. Only the "low
power" firmware package is slightly misleading because there is only a
RTL8261N firmware binary for low power but no corresponding RTL8264B
version. It will ship simply the non-low power version for RTL8264B.
Suggested-by: Jonas Jelonek <jelonek.jonas@gmail.com> Signed-off-by: Sven Eckelmann <sven@narfation.org> Link: https://github.com/openwrt/openwrt/pull/23947 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Carlo Szelinsky [Tue, 9 Jun 2026 19:42:40 +0000 (21:42 +0200)]
generic: net: phy: realtek: select rtl826x phy patch table by chip version
The in-tree realtek 5G/10G driver picks the firmware patch table from the
PHY ID (RTL8264 -> rtl8264b.bin). The vendor driver instead picks it from
VEND1 0x104[2:0] (0 = RTL8264B, else RTL8261N-C), independent of PHY ID.
On the S1300WP the RTL8264 dies read 0x104=0xf802 ([2:0]=2), so they need
the RTL8261N-C table; the RTL8264B table leaves the PCS unlocked (0xA600
stuck 0x1000) and config_init fails with -ETIME. Read 0x104[2:0] and load
rtl8261n.bin when non-zero. Boards with such a die must ship rtl8261n.bin.
Fixes: 6369c9e5c799 ("generic: net: phy: realtek: add 5G and 10G PHY support") Co-authored-by: Sven Eckelmann <sven@narfation.org> Signed-off-by: Carlo Szelinsky <github@szelinsky.de> Link: https://github.com/openwrt/openwrt/pull/23947 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Paul Spooren [Tue, 30 Jun 2026 16:38:58 +0000 (18:38 +0200)]
build: don't store timestamps in APK packages
This commit statically sets SOURCE_DATE_EPOCH to 0, which causes `apk mkpkg` to
drop the date from generated packages. This improves reproducibility while
leaving package specific SOURCE_DATE_EPOCH untouched. The latter can be
interesting for i.e. packages like busybox, which prominently show that date on
the login shell.
Without this commit, packages that live inside feed repositories (openwrt.git,
packages.git etc) like `mtd` or `attendedsysupgrade-common` would have random
timestamps since no "full" git log was available.
Below an example with different source dates (0, 1):
The layer 3 code shares the register access lock with the DSA driver.
It is currently unclear to which extent this is really needed. To
avoid permanent access to the DSA private structure reorganize the
locking as follows:
- create a lock pointer in the layer 3 control structure
- link it to the DSA lock during probing
- use the ctrl->lock pointer whenever needed.
With all the code relocation it is time to clean the headers.
- otto_l3_route_ht_params is internal and can be moved to l3.c
- otto_l3_route is no longer needed in rtl-otto.h
- additionally reorder structures to avoid forward declarations
Relocate set_egress_intf() to layer 3 code. While we are here change
prefix of interface structure to otto_l3_ and move its definition
to the new code too.
Skip swconfig registration and disable MAC learning when the
"mediatek,no-swconfig" property is set. This is needed for MT7620
devices using the internal switch as a transparent bridge to an
external RGMII switch, where ports 0-4 are unused.
The no-swconfig property itself is valid for both DSA and non-DSA
setups. However, disabling MAC learning is only required for DSA,
where multiple CPU-facing interfaces would otherwise cause an
incorrect ARL table to be built. Non-DSA setups work correctly
without disabling MAC learning.
ramips: ethernet: ralink: fix offload with diff dsa tag
DSA copies the driver features to slave device, including offload
capabilites. Once a packet is sent though a DSA slave interface,
according to its features, the kernel does not calculate checksums,
expecting that the HW will fill the gaps. DSA adds the defined DSA
tag and sends the tagged packet through the master device.
Ethertype DSA tags expect the driver to calculate checksum based on the
csum_start/csum_offset. However, mtk_eth_soc does not use that info.
mtk_eth_soc checks the network header and decides if the HW can manage
that packet, unaware that mac layer now contains an extra DSA tag. When
that tag is the Mediatek CPU tag, offload will work as expected.
When it is an incompatible DSA tag (all but Mediatek) or if DSA is
stacking two incompatible DSA tags, the driver will still count on the
HW offload. In this case, packets go to the network with an incorrect
checksum.
This patch adds an extra check and disables offloading when DSA tag is
in use and it is not Mediatek. Offloading is also disabled even when DSA
tag is Mediatek but there is something else increasing the mac layer
region (possibly another stacked tag). Mediatek tag can encode 802.1Q info and
using vlan tags will still use offloading. Other mac layer protocols
that are not supported by Mediatek will disable HW offloading. PPPoE was
not tested but it is expected that it will disable offloading.
This code is heuristically trying to keep HW offload enable with DSA tags.
Anyway, in the worse case, offloading is disabled and there is an increase
in overhead, which is better than packet with wrong checksum.
ramips: ethernet: ralink: mtu change while interface is down
fe_change_mtu didn't update the registers if the interface was down.
DSA increases the CPU port MTU to accommodate the CPU tag. As this
happens while the CPU port was still down, the chip regs didn't get
updated and larger frames were dropped.
Registers in MT7620A_GDMA_OFFSET range were incorrect, except for the
first one GDM_FWD_CFG (which is actually the only one in use).
The next and last register is GDM_SHPR_CFG. All others are not mentioned
in docs.
Shine [Mon, 29 Jun 2026 07:23:45 +0000 (09:23 +0200)]
scripts: dhcpv6: don't report custom ip6class if default
odhcp6c returns delegated prefixes with a "class=<IAID>" tag if a custom
IAID was specified in the -P argument. This tag must then be used for any
prefix filter ("network.<interface>.ip6class") instead of the uplink i/f
name.
OpenWrt by default uses the first eight digits of the uplink i/f name's MD5
hash as IAID. Don't report a custom "class" tag for this default IAID.
Fixes: f08cd5ce5d66d76fa6e282d6e3f29bab9cdf8023 Signed-off-by: Shine <4c.fce2@proton.me> Tested-by: Goetz Goerisch <ggoerisch@gmail.com> Link: https://github.com/openwrt/openwrt/pull/23989 Signed-off-by: Robert Marko <robimarko@gmail.com>
Dimitri Souza [Fri, 26 Jun 2026 22:59:43 +0000 (19:59 -0300)]
mediatek: acer-predator-w6x: add LED boot status support
Define led-boot, led-failsafe, led-running, and led-upgrade in the
Acer Predator W6X DTSI so the system LED reflects the standard OpenWrt
boot and runtime states.
David Yang [Fri, 1 May 2026 17:43:00 +0000 (01:43 +0800)]
ramips: timecloud: fix LED configs
The LED(s) does not have a label for status, ethernet, or whatsoever.
These two LEDs, are used to form one dual-color indicator. On vendor
firmware, the light is turned from orange to white, when external
storage is detected and ready to use. However, if we use white for any
other triggers (USB / SD card / ethernet), it is difficult to see while
the orange is on. Thus, we change led-running to white to indicate a
successful startup.
Also add the missing pinmux config for uart3 since LEDs take GPIO 7 and
8.
Florian Maurer [Sun, 31 May 2026 21:04:41 +0000 (21:04 +0000)]
wifi-scripts: ucode: check wpa_supplicant exists before mesh probe
The mesh capability check unconditionally ran wpa_supplicant -vmesh to
detect driver support. On devices where wpa_supplicant is not installed,
this produces a "/bin/sh: wpa_supplicant: not found" error in the logs
on every wifi reconfiguration even when no mesh interface is configured.
Guard the invocation with fs.access() so the binary is only executed
when it is actually present, and use its absolute path to avoid relying
on $PATH.
Florian Maurer [Sun, 31 May 2026 20:14:38 +0000 (20:14 +0000)]
wifi-scripts: ucode: only set antenna when config changes
mac80211's ieee80211_set_antenna() rejects calls with -EOPNOTSUPP once
the radio is started (local->started == true). The spurious failure
triggers a wpa_supplicant invocation in the error path, producing both
a "command failed: Not supported (-122)" message and (where wpa_supplicant
is not installed) a "/bin/sh: wpa_supplicant: not found" message in the
log on every wifi reconfiguration.
In this code path, reset_config() tears down all interfaces before the
antenna is touched, so local->started is false exactly when the antenna
config has changed. Skip the iw phy set antenna call otherwise, matching
the behaviour of mainline OpenWrt's bash mac80211.sh. The trade-off is
that we no longer re-assert the antenna mask on warm reconf if it was
cleared out-of-band (e.g. by a driver reload); in practice drivers do
not clear it mid-life.
Also split the antenna details out of the generic "Configuring '${phy}'
distance: ..." log line so it isn't claimed when the call was skipped.
Fil Dunsky [Fri, 5 Jun 2026 14:53:45 +0000 (17:53 +0300)]
mediatek: add support Livinet Li320
This commit adds support for Livinet Li320 wireless router.
Specification
-------------
- SoC : MediaTek MT7981B dual-core ARM Cortex-A53
- RAM : 512MB
- Flash : SPI-NAND Fudan Micro FM25S01BI3
- WLAN : MediaTek MT7976 dual-band Wi-Fi 6
- Ethernet : MediaTek MT7531 switch, 1x WAN + 3x LAN (2.5GbE uplink via gmac0)
- Buttons : WPS, Reset
- LEDs : 8xGreen, 1xRed
- Power : Barrel DC 12v
Installation
------------
The factory firmware is a compatible OpenWrt-based fork, allowing
direct installation via the LuCI upgrade page using the sysupgrade image.
MAC addresses
-------------
| Interface | MAC source |
|-----------|--------------------------|
| LAN | Factory 0x4 (mac-base -1)|
| WAN | Factory 0x4 (mac-base -2)|
| WLAN 2.4G | Factory 0x4 (mac-base) |
| WLAN 5G | Factory 0x4 (mac-base +1)|
Grische [Wed, 17 Jun 2026 12:09:18 +0000 (14:09 +0200)]
rockchip: add support for FriendlyARM NanoPi R2S Plus
The NanoPi R2S Plus is a NanoPi R2S with on-board eMMC added. The device
tree (rk3328-nanopi-r2s-plus.dts) is already present in kernel 6.12, and
U-Boot support has been present since v2025.01, so neither a kernel DTS
backport nor a U-Boot patch is required.
Hardware
--------
Rockchip RK3328 (4x Cortex-A53, up to 1.4 GHz)
1GB DDR4 RAM
32GB eMMC 5.1
microSD slot (up to 128GB)
1x 1000 Base-T (native, RTL8211F via GMAC) - WAN
1x 1000 Base-T (USB 3.0, RTL8153B) - LAN
Optional M.2 SDIO Wi-Fi
2x USB 2.0 Type-A host
1x USB-C (5V power input, USB device for Maskrom update)
1x USB-C (onboard USB-to-UART debug console, 1500000 bps)
1x serial debug header / UART0 (3.3V TTL, 3-pin 2.54mm)
2 Buttons (GPIO key, Maskrom)
3 LEDs (SYS red, WAN green, LAN green)
DC 5V/2A power
Operating temperature 0 to 70 C
The MAC addresses are derived from the eMMC CID, so they are stable
regardless of whether the device boots from microSD or eMMC.
Installation
------------
On RK3328 the BootROM boots the eMMC before the microSD slot, so the
Maskrom button must be held to boot from microSD while stock firmware is
still on the eMMC.
How to boot from eMMC:
1. Write the uncompressed sysupgrade image to sdcard
2. Hold the "Mask" button while powering on the device
3. Wait until OpenWrt is fully booted
4. Copy the compressed .gz sysupgrade image to the machine's /tmp folder using scp
5. Run: gunzip -c /tmp/openwrt-...-friendlyarm_nanopi-r2s-plus-squashfs-sysupgrade.img.gz | dd of=/dev/mmcblk1 bs=4M conv=fsync
6. Power the device off, remove the sdcard and power it back on
Tested:
- microSD boot (via Maskrom button) and native eMMC boot
- Both Ethernet ports (RTL8211F WAN, RTL8153B LAN)
- eMMC-derived MAC addresses
Signed-off-by: Grische <github@grische.xyz> Assisted-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Link: https://github.com/openwrt/openwrt/pull/23854 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Mikhail Zhilkin [Sat, 23 May 2026 14:42:33 +0000 (17:42 +0300)]
airoha: add support for Nokia XG-040G-MD
This commit adds support for Nokia XG-040G-MD XG-PON ONU.
Specification
-------------
- SoC : Airoha AN7581DT Quad-core ARM Cortex-A53 1.2 GHz
- RAM : 512 MiB DDR4 (ESMT M16U4G16256A-QLB)
- Flash : SPI-NAND 256 MiB (SkyHigh ML02G300WHI00)
- WLAN : -
- Ethernet : 1x 2500 Mbps (LAN1, Airoha EN8811HN)
3x 10/100/1000 Mbps (LAN2-LAN4, Airoha AN7581 SoC switch)
- XG-PON : ECONET EN7572AN, SLIC: MaxLinear PEF32001VSV12
- USB : 1x USB 3.0 (with power control via gpio)
1x USB 2.0 (with power control via gpio)
- Buttons : Reset
- LEDs : 1x Power (green, gpio-controlled)
1x WAN (green, gpio-controlled)
1x WAN (red, gpio-controlled)
4x LAN (green, gpio-controlled)
2x USB (green)
- Power : 12 VDC, 1 A
Unsupported functions and limitations
-------------------------------------
1. XG-PON won't be available after installing OpenWrt.
Installation (stock layout, UART)
---------------------------------
1. Attach UART and run picocom:
picocom -b 115200 --send-cmd "sb -vv" /dev/ttyUSB0
2. Interrupt boot process by pressing Enter key to enter u-boot
Username: telecomadmin
Password: nE7jA%5m
3. Start download firmware via ymodem protocol (via UART):
loady 0x85000000
4. Press Ctrl + A then Ctrl + S in the picocom terminal (if you are using
a different terminal, please refer to the documentation) to start
upload OpenWrt initramfs image using ymodem protocol. Enter local path
to the OpenWrt initramfs image and press Enter.
5. Load OpenWrt initramfs image from the memory:
bootm 0x85000000
5. Sysupgrade with OpenWrt sysupgrade image
Alternative for the p.3-4. Load and boot OpenWrt initramfs from tftp IP
192.168.1.254:
tftpboot 0x85000000 192.168.1.254:openwrt-initramfs-uImage.itb
bootm 0x85000000
I was unable to download the file without errors, the bootloader network
driver is very unstable. Perhaps you will be more fortunate.
Backup and installation (stock layout, without UART)
----------------------------------------------------
1. Unplug Fiber
2. Make ONU Reset
3. Navigate: http://192.168.1.1
Username: CMCCAdmin
Password: aDm8H%MdA
4. Go to Apps -> Home Storage -> FTP and check Enable FTP
5. Go to Apps -> Home Storage -> SAMBA Sharing and check Enable Samba
6. Visit the following URL to open Telnet:
http://192.168.1.1/system.cgi?telnet
7. Telnet account login:
Username: user
Password: <see ONU label>
8. Get root privileges:
su user_ftp
Password: <see ONU label>
9. Copy 'squashfs-factory-kernel.bin', 'squashfs-factory-rootfs.bin' and
'OpenWrt.mtd2.u-boot-env.bin' (backup of 'u-boot-env' partition from
the another Nokia XG-040G-MD with OpenWrt installed)
9. Attach USB flash drive and check the new dir in /mnt:
ls /mnt
10. Change current dir to the flash drive (change D to your flash drive
label):
cd /mnt/D
11. Make backup:
for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16; \
do cat /dev/mtd$i | gzip -9 > mtd$i.bin.gz; done
12. Check image sizes:
ls -l | awk '{if(NR>1) {$5=sprintf("0x%x", $5); print}}'
13. Write images:
mtd_debug erase /dev/mtd0 0x60000 0x20000
mtd_debug write /dev/mtd0 0x60000 0x20000 OpenWrt.mtd2.u-boot-env.bin
mtd_debug erase /dev/mtd14 0x0 0x2880000
mtd_debug write /dev/mtd14 0x0 0x3e6cfc squashfs-factory-kernel.bin
mtd_debug erase /dev/mtd11 0x0 0x80e0000
mtd_debug write /dev/mtd11 0x0 0x440000 squashfs-factory-rootfs.bin
0x3e6cfc - size of your 'squashfs-factory-kernel.bin'
0x440000 - size of your 'squashfs-factory-rootfs.bin'
14. Reboot:
reboot
Recovery (stock layout)
-----------------------
The same as described in Installation (UART).
Return to stock (stock layout)
------------------------------
1. Follow the steps 1-5 of the Installation (UART)
2. Once in OpenWrt upload you backup to the /tmp dir of the router:
scp -O mtd16.bin.gz root@192.168.1.1:/tmp
5. Connect to the router using ssh and install kmod-mtd-rw:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
6. Unlock bootloader:
mtd unlock bootloader
7. Restore stock:
zcat /tmp/mtd16.bin.gz | mtd write - all_flash
8. Reboot:
reboot
Notes (OpenWrt U-Boot layout)
-----------------------------
1. Only devices with SkyHigh ML02G300WHI00 spi-nand are supported. Driver
for FudanMicro FM25G02B is absent in current U-Boot.
2. A simple installation without serial console is also possible using a
fork of @dangowrt's UBI Installer Link: https://github.com/dangowrt/owrt-ubi-installer
Installation / recovery (OpenWrt U-Boot layout)
-----------------------------------------------
1. Make sure that you have 'bosa' and 'ri' partitions mtd backups before
you start
2. Place OpenWrt images on the tftp server (IP: 192.168.1.254):
openwrt-airoha-an7581-nokia_xg-040g-md-ubi-bl31-uboot.fip
openwrt-airoha-an7581-nokia_xg-040g-md-ubi-initramfs-recovery.itb
openwrt-airoha-an7581-nokia_xg-040g-md-ubi-preloader.bin
3. Attach serial console and start terminal with XMODEM support:
picocom -b 115200 --send-cmd "sx -vvX" /dev/ttyUSB0
4. Push reset button and power on the router
5. Press 'x', then 'Ctrl + A' and 'Ctrl + S'
6. Paste full path to the bl2 image:
'openwrt-airoha-an7581-nokia_xg-040g-md-ubi-preloader.bin'
7. Wait until the file is downloaded and the following prompt appears:
Press x to load BL31 + U-Boot FIP
8. Press 'x', then 'Ctrl + A' and 'Ctrl + S'
9. Paste full path to the fip image:
'openwrt-airoha-an7581-nokia_xg-040g-md-ubi-bl31-uboot.fip'
10. Wait until the file is downloaded, u-boot will prepare ubi partition
automatically
11. Wait for U-Boot menu
12. Run 'Load BL31+U-Boot FIP via TFTP then write to NAND'
13. Run 'Load BL2 preloader via TFTP then write to NAND'
14. Run 'Boot system via TFTP'
15. Once in OpenWrt perform standard sysupgrade
16. Once in OpenWrt upload 'bosa' and 'ri' partitions mtd backups to the
/tmp dir using scp protocol
17. Check ID of the UBI volumes:
ubinfo -d 0 -N bosa | grep "Volume ID"
ubinfo -d 0 -N ri | grep "Volume ID"
18. Write backups according to the volume ID:
ubiupdatevol /dev/ubi0_2 /tmp/bosa.bin
ubiupdatevol /dev/ubi0_3 /tmp/ri.bin
19. Reboot:
reboot
USB power control
-----------------
Disable (both ports):
echo disabled > /sys/devices/platform/usb-power/state
Enable (both ports):
echo enabled > /sys/devices/platform/usb-power/state
UART
----
A view from the back side of the PCB:
------------------------
| GND RX TX
| X X X
Connection parameters:
115200, 8N1, 3.3V
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 04:xx:xx:xx:xx:0d | label |
| WAN | 04:xx:xx:xx:xx:0e | label + 1 |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'ri', 0x3e
Mikhail Zhilkin [Sat, 6 Jun 2026 12:08:36 +0000 (15:08 +0300)]
uboot-airoha: add support for Nokia XG-040G-MD
Add support for Nokia XG-040G-MD.
Known issues
------------
1. Reset button is currently doesn't work and cannot be used to start
tftp recovery:
Button 'reset' not found (err=-19)
LED 'green:power' not found (err=-19)
Reduce repetition in dcvs_manual, dcvs_get, vth_manual and tap_manual
by hoisting the per-channel enable bit write out of per-case branches
and encoding per-channel register/bit mappings as lookup tables where
the pattern is uniform across channels.
This also fixes two bugs in dcvs_get that were hidden in the switch:
- DCVS1 read never populated dcvs_sign_out; it wrote the sign bit read
(0x14[4:4]) into dcvs_coef_bin and then immediately overwrote it with
the coefficient read, leaving the sign always zero for that channel.
- DCVS3 assigned the manual bit read directly to a bool without the !!
normalisation applied to all other cases.
Jonas Jelonek [Sat, 27 Jun 2026 19:23:05 +0000 (19:23 +0000)]
realtek: pcs: rtl930x: fix LEQ calibration to use media type
Replace the mode-based approximation in the LEQ adapt+lock step with
proper media-based logic using the newly stored sds->media field. Those
adjustments are based on SDK code and digging through some basics of
signal conditioning.
PCB connections route through an external PHY (PHY-attached); that PHY
handles its own equalization so the SerDes LEQ is left in free-running
auto-adapt with no correction offset. DAC and fiber SFP connect directly
to the SerDes without an intermediate PHY and require a calibrated lock.
Replace the SDK's dacLongCableOffset/eqHoldEnable variable pair with a
single direct_serdes bool and encode the full per-media LEQ correction
into one switch: fiber +3 (direct SerDes, no cable), DAC short +4
(base 3 + 1), DAC long +6 (base 3 + 3).
Fix the MAXHOLD_EN bit (0x17[7]) and the 0x0c[8] write to be gated on
direct_serdes; both were previously conditioned on PCB which is the
PHY-attached case and thus wrong. Fix the LEQ lock to apply to all
direct SerDes connections (DAC + fiber), not just PCB. Also drop the
spurious dead-code branch that was an artifact of the original
transplanting.
No behavioral change because this particular function of calibration is
not used right now but will be in the future.
Jonas Jelonek [Sat, 27 Jun 2026 17:50:12 +0000 (17:50 +0000)]
realtek: pcs: store active media type in SerDes state
Track the resolved media type in struct rtpcs_serdes alongside hw_mode,
storing it as soon as rtpcs_sds_select_media() resolves it so all
subsequent ops (set_hw_mode, activate, post_config) can access it.
This is unused for now and will be used only in dead code in next
patches. Though, this dead code is going to be used with subsequent
patches.
Jonas Jelonek [Sat, 27 Jun 2026 17:25:02 +0000 (17:25 +0000)]
realtek: pcs: rtl930x: give some calibration functions meaningful names
Adapted from the SDK, the calibration functions are just named after
their sequential logic and with a numbering scheme. This doesn't help
understanding what the code is doing. Instead, give some of them
meaningful names where possible, revealing kind of a logical structure.
The calibration code is deeply nested with multiple function using
numeric nesting. Though it tries to follow the SDK pattern, this makes
it just unnecessarily complex and confusing. Dissolve some of this
unneeded nesting, together with some minor cleanup here and there.
The RTL8367S-VB (Family D) uses a software-emulated VLAN MC table
(emu_vlanmc) since it lacks hardware support for the VLAN MC registers
used by earlier chips.
- Add missing NULL check after kzalloc() in rtl8367b_init_regs() to
prevent NULL pointer dereference on allocation failure.
- Add missing kfree(smi->emu_vlanmc) in rtl8367b_remove() to prevent
memory leak on driver unload.
Patches removed due being upstreamed:
- 007-add-libeu-symbols-to-libelf.patch
- 008-fix-autoconf-ENABLE_IMA_VERIFICATION.patch
- 009-fix-null-dereference-with-lto.patch
- 102-fix-potential-deref-of-null-error.patch
Note that this release is needed in order to build against GCC 16.1
https://github.com/openwrt/openwrt/pull/23194
Release notes from 0.192 to 0.195:
https://inbox.sourceware.org/elfutils-devel/CAJDtP-RjuT13zehLgSvz9TnwQZ1VYPOS=q_kuut5a2g+KLamgw@mail.gmail.com/T/
https://inbox.sourceware.org/elfutils-devel/CAJDtP-S0rYAOZQeDZvMtPkQztgK9RboWtYwpqNLCNGNdaSGn-A@mail.gmail.com/T/
https://inbox.sourceware.org/elfutils-devel/CAJDtP-Qok4ViNzvrr28WgkCCqrFH0iAZStiD8C7nbpDhrPzLWA@mail.gmail.com/T/
projects / thirdparty / openwrt.git / log
