Shiji Yang [Mon, 26 Jan 2026 15:10:10 +0000 (23:10 +0800)]
arm-trusted-firmware-mediatek: update to v2026-01-23
The highlight of this version is that the bl2 size will be reduced
by 60+ KB. The MT7987 SPI interface selection hack was replaced by
upstream implementation with the new symbol SPIM_NAND_PREFER_SPI2.
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
airoha: an7581: generalize eMMC DTS and add Kite variant
Generalize the eMMC DTS to common node and add a variant with the Kite WiFi
chip installed. Also rename the eMMC model name and add the Eagle name to
it.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The bootloader on this device is old and supports no lzma. So use
lzma-loader to work around this and get the size smaller so that an
image can actuallly be created and flashed. Because of these size
problems, the last usable version of OpenWrt was 23.05.
This UIMAGE_MAGIC seems to be used by other Netgear devices. Add to
avoid
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at
0x00000000: 0x2705 instead
Make clear that the driver instructs the hardware via a port and
its number. To be consistent with other refactoring swap variable
addr for pn in this case.
The mdio controller inside the Realtek switches drives multiple busses.
Until now the driver exposed a flattened single bus (aka port view).
Align to the upstream driver and expose up to 4 busses depending on
the dts definition. For this:
1. Adapt rtmdio_probe() so it calls rtmdio_probe_one() for each child
dts child node that represents a single bus.
2. Adapt rtmdio_probe_one() so it registers a single bus in "full-auto"
mode. No more hacks via fwnode_mdiobus_register_phy() needed.
3. Adapt rtmdio_phy_to_port() so it uses a lookup based on the new
topology.
4. Adapt rtmdio_get_phy_info() for multiple busses.
5. In the DSA driver adapt the mdio controller load check to wait
until all busses have been registered.
realtek: mdio: decouple controller setup from bus reset
Some central controller setup is currently realized in the bus reset
functions. As soon as we have multiple busses this coding will be
called multiple times. Rename the reset() functions to setup_ctrl()
and call that only once before the bus probing.
While we are here harmonize the variable for the bus loops and name
it smi_bus.
realtek: mdio: derive polling setup from control structure
All configuration helpers have been converted to look at the
control structure. Do the same for setup_polling(). With
this move the call location out of rtmdio_probe_one() into
the parent rtmdio_probe() where it belongs.
realtek: mdio: derive phy info from control structure
For polling setup the driver looks up the atached phy ids with
function rtmdio_get_phy_info(). This derives the data from a
given bus and a port number. While this works for a single bus
the combination of port and bus makes no sense. One is the global
view the other the bus individual view. Change the signature so
the lookup is done globally via ctrl/port.
realtek: mdio: rename for_each_phy() to for_each_port()
Currently phy and port are basically the same. One bus and each
port has a phy assigned. In the future the driver will make use
of multiple busses. Each of them will have a distinct set of
phys.
To make the iterators clearer use "port" for macros when the
driver must access the hardware independent from the bus. In this
case use "pn" (aka port number) as an iterator variable.
The RTL8224 driver now puts the PHY into the proper mode, but the SerDes
side is still missing. It was deactivated due to a known regression.
Thus, allow USXGMII-QX configuration since both sides should be properly
configured now.
mediatek: filogic: fix EAX17 rootfs hash in FIT node for per-device rootfs builds
When CONFIG_TARGET_PER_DEVICE_ROOTFS is enabled (as in buildbot builds),
the final per-device rootfs is assembled at root.squashfs+pkg=<hash> rather
than root.squashfs. The gen_netgear_rootfs_node.sh script was always hashing
root.squashfs (the base rootfs without device-specific packages), causing the
size and hash in the FIT node to not match the actual rootfs written to the
UBI volume, resulting in boot failure on buildbot-produced images.
Fix by using the per-device rootfs path when TARGET_PER_DEVICE_ROOTFS is set,
consistent with how include/image.mk handles the same distinction elsewhere.
Fixes: 46ab9f3f1c ("filogic: add support for Netgear EAX17") Signed-off-by: Jascha Sundaresan <flizarthanon@gmail.com> Link: https://github.com/openwrt/openwrt/pull/22839 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
build: set max-page-size linker flag to match target page size
ELF binaries embed the maximum page size used during linking in the
PT_LOAD segment alignment. If this value is larger than the actual
system page size, the kernel will still load the binary but wastes
memory due to over-alignment. If it is smaller, the binary may fail
to load or cause incorrect behavior with features like RELRO.
Most architectures use 4KB pages, but loongarch64 uses 16KB pages
(CONFIG_PAGE_SIZE_16KB). Explicitly pass -z max-page-size to the
linker so that binaries are built with the correct page alignment for
the target, avoiding issues with RELRO segment padding and ensuring
correct memory mapping on the target system.
Before binutils 2.39 RELRO sections were padded to common page size
which is 4K on MIPS, with binutils 3.29 the padding was changed to
max page size which is 64K on MIPS. With this change we will pad them to
4K again.
This reduces the size of user space binaries in OpenWrt.
The size of the uncompressed root file system of a mips malta be build
decreased by about 20%.
old file size:
```
$ du -s build_dir/target-mips_24kc_musl/root-malta/
15844 build_dir/target-mips_24kc_musl/root-malta/
```
New file size:
```
$ du -s build_dir/target-mips_24kc_musl/root-malta/
12564 build_dir/target-mips_24kc_musl/root-malta/
```
The size of the image did not decrease much because of the strong
compression used by OpenWrt.
ramips: restore CONFIG_PAGE_BLOCK_MAX_ORDER=10 for 6.18
Restore CONFIG_PAGE_BLOCK_MAX_ORDER=10 in ramips 6.18 config fragments
to fix build failures where PAGE_BLOCK_MAX_ORDER was undefined.
Support for Linux 6.18 on ramips was added after this OpenWrt change:
https://github.com/openwrt/openwrt/commit/ac0cb87a453698efc6c812e4f27cadbeb208f14e.
Before that integration, the kernel option CONFIG_PAGE_BLOCK_MAX_ORDER=10
was provided in target/linux/generic/config-6.18 and applied broadly.
After the ramips 6.18 integration the generic fragment no longer supplied
this option for ramips targets, which caused some backported code paths
and drivers to assume PAGE_BLOCK_MAX_ORDER was defined and led
to compilation failures.
Daniel Pawlik [Mon, 16 Mar 2026 13:26:51 +0000 (14:26 +0100)]
mediatek: device tree overlay for BPI-R4 with BE14 module
Some Banana Pi BPI-R4 BE14 WiFi modules are shipped with zeroed
tx_power fields in EEPROM (2G/5G/6G). This leads to low transmit power
on affected bands.
This overlay provides known-good EEPROM data (including correct tx_power
values for 2G/5G/6G bands) dumped from a working BE14 module.
To enable BE14 overlay, add into u-boot bootconf_extra
parameter: 'mt7988a-bananapi-bpi-r4-wifi-be14'.
You can use example script:
overlay="mt7988a-bananapi-bpi-r4-wifi-be14"
current="$(fw_printenv -n bootconf_extra 2>/dev/null)"
if [ -n "${current}" ]; then
fw_setenv bootconf_extra "${current}#${overlay}"
else
fw_setenv bootconf_extra "${overlay}"
fi
Earlier proposal proposed in [1] was fallback to default values if
invalid EEPROM content is detected.
There is only one check left for that attribute in rtldsa_port_mdb_add().
Split the consumer into device specific implementations and remove the
attribute from the private structure.
The soc_info structure should only be used in the mach setup
functions. Drop its usage in the dsa qos functions. Instead
derive the data from the das private structure.
For a long time the dsa driver has been providing a builtin mdio bus
via dsa default attribute user_mii_bus. This simply uses read/write
commands from the standard realtek otto bus (aka parent). The reason
has always been unclear.
Looking around the kernel 6.18 codebase there is only one case where
this is really needed. The only consumer is dsa_user_phy_setup().
ret = phylink_of_phy_connect(dp->pl, port_dn, phy_flags);
if (ret == -ENODEV && ds->user_mii_bus) {
/* We could not connect to a designated PHY or SFP, so try to
* use the switch internal MDIO bus instead
*/
ret = dsa_user_phy_connect(user_dev, dp->index, phy_flags);
}
Luckily the phylink_of_phy_connect() works fine and the internal bus
access is not needed at all. No need to keep the bus alive. Drop it.
While we are here fix the error handling issue of this code
if (!of_device_is_available(dn))
ret = -ENODEV;
Returncode was set to error but never handed back to the caller.
Enable CONFIG_SERIAL_8250_MID in the generic x86 configuration.
This enables hardware serial console access on Intel Atom C3000
(Denverton) platforms, which rely on the High-Speed UART driver.
It also benefits other Intel MID platforms across the x86
architecture.
Jonas Köppeler [Wed, 11 Mar 2026 17:14:52 +0000 (18:14 +0100)]
kernel: cake_mq: expose sync_time parameter via debugfs
This patch enables for the configuration of the sync_time parameter.
The value of the sync_time needs to be specified in nanoseconds.
The default value is 200us (200 000 ns).
This is especially helpful to get feedback from users about suitable
values. Once a solid solution is found this patch can be removed.
Signed-off-by: Jonas Köppeler <j.koeppeler@tu-berlin.de> Link: https://github.com/openwrt/openwrt/pull/22380
[Add patch to kernel 6.18 too] Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Fil Dunsky [Mon, 30 Mar 2026 14:07:28 +0000 (17:07 +0300)]
mediatek: add Huasifei WH3000 Pro NAND support
This commit adds support for Huasifei WH3000 Pro NAND version.
There is an eMMC already supported in OpenWrt. The only difference is NAND chip.
This commit adds common .dtsi and separate .dts
for eMMC and nand versions.
**Huasifei WH3000 Pro NAND**
Portable Wi-Fi 6 travel router based on MediaTek MT7981A SoC. MT7981B+MT7976CN+RTL8221B Dual Core 1.3GHZ with 5G modems module and PWM Fan.
**Specifications**
SoC: Filogic 820 MT7981A (1.3GHz)
RAM: DDR4 1GB
Flash: 256mb Winbond SPI NAND
WiFi: 2.4GHz and 5GHz with 3 antennas
Ethernet:
1x WAN (10/100/1000M)
1x LAN (10/100/1000/2500M)
USB: 1x USB 3.0 port
Two buttons: reset and mode (BTN_0)
LEDS: blue, red, blue+red=pink
UART: 3.3V, TX, RX, GND / 115200 8N1
M.2 (WWAN) slot
**Installation via U-Boot rescue**
1. Set static IP 192.168.1.2 on your computer and default route as 192.168.1.1
2. Connect to the WAN port and hold the reset button while booting the device.
3. Wait for the LED to blink 5 times, and release the reset button.
4. Open U-boot web page on your browser at http://192.168.1.1
5. Select the OpenWRT sysupgrade image, upload it, and start the upgrade.
6. Wait for the router to flash the new firmware.
7. Wait for the router to reboot itself.
**Installation via sysupgrade**
Just flash sysupgrade file via [LuCI upgrade page](http://192.168.1.1/cgi-bin/luci/admin/system/flash) without saving the settings.
**Installation via SSH**
Upload the file to the router `/tmp` directory, `ssh root@192.168.1.1` and issue a command:
```
sysupgrade -n /tmp/openwrt-mediatek-filogic-huasifei_wh3000-pro-nand-squashfs-sysupgrade.bin
```
This version fixes some security problems:
* Client impersonation while resuming a TLS 1.3 session
(CVE-2026-34873)
* Entropy on Linux can fall back to /dev/urandom (CVE-2026-34871)
* PSA random generator cloning (CVE-2026-25835)
* Compiler-induced constant-time violations (CVE-2025-66442)
* Null pointer dereference when setting a distinguished name
(CVE-2026-34874)
* Buffer overflow in FFDH public key export (CVE-2026-34875)
* FFDH: lack of contributory behaviour due to improper input validation
(CVE-2026-34872)
* Signature Algorithm Injection (CVE-2026-25834)
* CCM multipart finish tag-length validation bypass (CVE-2026-34876)
* Risk of insufficient protection of serialized session or context data
leading to potential memory safety issues (CVE-2026-34877)
* Buffer underflow in x509_inet_pton_ipv6() (CVE-2026-25833)
Nick Hainke [Sat, 4 Apr 2026 15:38:48 +0000 (17:38 +0200)]
ethtool: update to 6.19
Version 6.19 - Feb 14, 2026
* Feature: support HW timestamp configuration (--set-hwtimestamp-cfg)
* Feature: display HW timestamp source (-T)
* Feature: support PLCA notifications (--get/set-plca-cfg)
* Feature: add PSE priority management support (--show/set-pse)
* Feature: support PSE notifications (--show/set-pse)
* Feature: support configuring RSS on IPv6 Flow Label (-n/-N)
* Feature: support FEC bit error histograms (--show-fec)
* Feature: register dump decoding for TI K3 CPSW and its ALE table (-d)
* Fix: fix missing headers in text output
* Fix: fix print_string when the value is NULL (-Werror=format-security)
* Fix: fix JSON output of SFP diagnostics
* Fix: fix duplicated JSON keys in module info
* Misc: clarify that symmetric RSS may be on by default (-x/-X)
* Misc: add AppStream metainfo file to %files section
ramips: mtk_eth_soc: handle frag_cache on Linux >= 6.13
Fix fe_clean_rx to handle the changed frag_cache layout on newer kernels.
For kernels >= 6.13 the fragment cache needs to be converted from its
encoded_page value instead of using the old va field. Add an ifdef
to use frag_cache.encoded_page & PAGE_MASK and virt_to_page for those
kernels, keep the old path for older kernels.
Replace previous bgpio_init usage with a full gpio_chip registration so the driver
integrates cleanly with the kernel GPIO core.
Add drivers/gpio/gpio-ralink.c implementing a gpio_chip with:
- get/set, direction_input/direction_output, get_direction
- get_multiple/set_multiple to support efficient multi-bit ops
- DT handling for determining ngpios (reads "ngpios" or falls back to gpio-ranges)
- MAX_NGPIOS cap and safe defaults
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.
For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html
The Realtek mdio bus operations are based on the port number. As
of now the driver exposes a single bus with a 1:1 mapping between
phy and port. This will change in the future when the driver
exposes multiple busses. This will need a mapping - e.g.
- bus 0, phy 23 -> read/write port 23
- bus 1, phy 0 -> read/write port 24
Provide a rtmdio_phy_to_port() indirection function that will
lookup the port number based on a bus and a phy. For now it
will only run some basic sanity checks and return the given
input address (because of 1:1 mapping).
When the mdio driver gets enhanced for multiple busses it must
snchronize reads/writes to the single controller. Add a lock
to the control structure and guard the critical operations.
The ethernet driver currently uses the legacy sw() macros. Add a
regmap to the driver that is derived from the parent mfd (like in
the mdio drivers). As a first consumer make use of that in the IRQ
functions.
Shiji Yang [Tue, 31 Mar 2026 14:33:44 +0000 (22:33 +0800)]
kernel: modules: fix kmod-iavf dependencies
Add missing dependency kmod-ptp to fix the build error. We also
add symbol CONFIG_PTP_1588_CLOCK_OPTIONAL explicitly for kmod-ptp
because it is selected by CONFIG_PTP_1588_CLOCK. Fix:
Package kmod-iavf is missing dependencies for the following libraries:
ptp.ko
LAN Ports:
- lan1 is the normal white LAN port
- lan2 is labelled "LAN/Backhaul", which can either be LAN or WAN.
- Since this device is intended to be part of a mesh, this will usually
be a LAN port, hence why it's assigned to lan2 here
Notes:
- I've chosen "Halo Base Pro" as the device model, despite the website URL
showing WL-WN535M3, as the label only states "Halo Base Pro".
- Only the 5GHz WiFi address is labelled on the device
Shiji Yang [Thu, 19 Feb 2026 12:06:08 +0000 (20:06 +0800)]
kernel: modules: add new driver package phy-mtk-tphy
MediaTek T-PHY controller supports multiple usb2.0, usb3.0 ports,
PCIe and SATA. ARM mediatek and ramips/mt7621 targets require this
package to make the XHCI work properly.
Shiji Yang [Mon, 19 May 2025 11:03:43 +0000 (19:03 +0800)]
lantiq: dts: rename spi pins node name to spi-pins
The dtc will treat "spi" node as an SPI controller. This resulted
in lots of false warning reports. Workaround it by renaming the
pinctrl node name to "spi-pins". This patch fixes the following
dtc warnings:
vr9.dtsi:326.18-336.6: Warning (spi_bus_bridge): /fpi@10000000/pinmux@e100b10/spi: incorrect #address-cells for SPI bus
vr9.dtsi:326.18-336.6: Warning (spi_bus_bridge): /fpi@10000000/pinmux@e100b10/spi: incorrect #size-cells for SPI bus
ar9.dtsi:286.18-296.6: Warning (spi_bus_bridge): /fpi@10000000/pinmux@e100b10/spi: incorrect #address-cells for SPI bus
ar9.dtsi:286.18-296.6: Warning (spi_bus_bridge): /fpi@10000000/pinmux@e100b10/spi: incorrect #size-cells for SPI bus
amazonse.dtsi:166.18-176.6: Warning (spi_bus_bridge): /fpi@10000000/pinmux@e100b10/spi: incorrect #address-cells for SPI bus
amazonse.dtsi:166.18-176.6: Warning (spi_bus_bridge): /fpi@10000000/pinmux@e100b10/spi: incorrect #size-cells for SPI bus
seuros [Tue, 10 Mar 2026 23:32:04 +0000 (23:32 +0000)]
tools/e2fsprogs: fix build with system libblkid probe API
When building on a host with e2fsprogs >= 1.47.0 installed, configure
detects the system libblkid probe API (blkid_probe_get_partitions etc.)
and sets ac_cv_lib_blkid_blkid_get_cache=yes. This causes plausible.c
to be compiled with HAVE_BLKID_PROBE_GET_PARTITIONS defined, but the
host build links against the internal blkid stub, resulting in:
plausible.c: error: unknown type name 'blkid_probe'
Override the configure cache variables to prevent detection of the
system libblkid probe API, ensuring the internal stub is used
consistently.
The RTL8231 LED driver is using the .brightness_set op, which according
to the documentation should not sleep. Since the RTL8231 is controlled
via an MDIO bus, this is not the case.
When using a non-offloaded LED driver such as netdev, this may currently
trigger kernel warnings:
WARNING: CPU: 0 PID: 14 at kernel/time/timer.c:1754 call_timer_fn.isra.0+0x84/0x8c
timer: led_timer_function+0x0/0x1d8 preempt leak: 00000100 -> 00000000
Switch to the .brightness_set_blocking op to indicate the operation
might sleep.
Fixes: 6ef6014887c3 ("realtek: Add pinctrl support for RTL8231") Signed-off-by: Sander Vanheule <sander@svanheule.net>
These patches stop secondary CPUs before restart and wait for them
to go offline, fixing the mt7621 reboot deadlock without needing to
disable CONFIG_LIST_HARDENED.
rteth_930x_decode_tag() and rteth_931x_decode_tag() are basically
the same. The only difference is the port bitmask. Luckily on the
RTL930x devices the unused fifth bit is always zero and the mask
can be aligned with RTL931x. Take over the RTL931x reason debugging
for both targets.
Jonas Jelonek [Wed, 4 Feb 2026 22:02:00 +0000 (22:02 +0000)]
realtek: pcs: rtl931x: set SerDes to off early
Set the SerDes mode to OFF early in the setup process to have a clear
starting point. This was part of the media handling before as a leftover
from the SDK code import. In the SDK, this function didn't only care
about applying some media settings but was also some kind of mode
setting for fiber modes.
Jonas Jelonek [Sat, 28 Mar 2026 17:24:15 +0000 (18:24 +0100)]
realtek: pcs: condense fiber media types
Right now we operate with distinct media types for fiber using different
speeds. This is more of a leftover from the SDK then it really makes
sense design-wise. The set_media function from the SDK did a lot more
than just setting some media-specific parameters. As part of
deconstructing this, also reduce the fiber types to a single media type
and handle the speed-agnostic parts based on the hw_mode for now.
This also drops the check for 100M speed around a block of writes. This
check has it's origin in SDK code where a switch statement just didn't
handle this case. However, the rest of the SDK doesn't handle this case
either. While the explicit 100M support isn't verified yet, there's no
need to keep that check.
Jonas Jelonek [Fri, 27 Mar 2026 22:32:34 +0000 (23:32 +0100)]
realtek: pcs: collapse DAC media types
So far we had separate media types for different DAC cable lengths,
equal to how the SDK defines them. However, this seems overengineered.
The types '_50CM' and '_100CM' are always treated equally, same for
'_300CM' and '_500CM'. Not only in the RTL931x code, but also the
RTL930x code usually just makes a distinction between short and long.
Thus, make that a bit cleaner by reducing the DAC type set to '_SHORT'
and '_LONG' with DAC cables < 3m being considered short and those with
>= 3m being considered as long.
Jonas Jelonek [Fri, 27 Mar 2026 12:01:06 +0000 (13:01 +0100)]
realtek: pcs: rename port_media to sds_media
The term 'port media' was chosen due to how the code taken from the SDK
was organized. However, the SDK does a pretty good job at intermixing a
lot of things which cause confusion in the end. This also applies to the
media settings. To be correct, we do not really have port awareness in
the PCS driver (and probably shouldn't have) so we do not really deal
with a port's media. Instead, we set settings depending on what is
attached to the SerDes itself.
To fix this confusion, rename the enum, its fields and all usage from
'port_media' to 'sds_media'.
The NanoPi R5S LTS variant has a reset button wired to GPIO4_A0,
but the current OpenWrt rockchip 6.12 patch set lacks the
corresponding gpio-keys definition in rk3568-nanopi-r5s.dts.
As a result, pressing the button generates no reset event.
rockchip already includes kmod-gpio-button-hotplug by default,
so backporting the upstream DTS change restores the expected
behavior.
Rename the patch to
011-v6.17-arm64-dts-rockchip-Add-reset-button-to-NanoPi-R5S.patch
to match the upstream source.
The non-LTS NanoPi R5S leaves this pin unconnected, matching the
upstream rationale for using the shared rk3568-nanopi-r5s.dts.
The dsa probing currently disable multiple spanning tree for RTL93xx
and keeps the bootloader setup for RTL83xx untouched. Additionally it
does this by checking for the family id. Refactor this to a common
"disable msti" setup.
To make it clear: From now on RTL83xx will also run in MSTI disabled
state. Tested on Linksys LGS310C.
xingchi [Tue, 13 Jan 2026 08:01:20 +0000 (16:01 +0800)]
ramips: add support for Z-ROUTER ZR-2662
This commit adds support for Z-ROUTER ZR-2662 (also known as Routerich
AX1800 V2) wireless WiFi 6 router.
Hardware specification
---------------------
- SoC : MediaTek MT7621AT, MIPS, 880 MHz
- RAM : 256 MiB
- Flash : NAND 128 MiB (AMD/Spansion S34ML01G2)
- WLAN :
- 2.4 GHz : MediaTek MT7905D/MT7975 (14c3:7916), b/g/n/ax, MIMO 2x2
- 5 GHz : MediaTek MT7915E (14c3:7915), a/n/ac/ax, MIMO 2x2
- Ethernet : 10/100/1000 Mbps x4 (1x WAN, 3x LAN)
- USB : 1x 2.0
- UART : 3.3V, 115200n8, pins are silkscreened on the pcb
- Buttons : 1x Reset
- LEDs : 1x WiFi 2.4 GHz (green)
1x WiFi 5 GHz (green)
1x LAN (green)
1x WAN (green)
1x WAN no-internet (red)
- Power : 12 VDC, 1 A
Installation
------------
1. Run tftp server on your PC (IP: 192.168.2.2) and put OpenWrt initramfs
image (initramfs.bin) to the tftp root dir
2. Open the following link in the browser to enable telnet:
http://192.168.2.1/cgi-bin/telnet_ssh
3. Connect to the router (default IP: 192.168.2.1) using telnet shell
(credentials - user:admin)
4. Run the following commands in the telnet shell (this will install
OpenWrt initramfs image on nand flash):
cd /tmp
tftp -g -r initramfs.bin 192.168.2.2
mtd write initramfs.bin firmware
mtd erase firmware_backup
reboot
5. Copy OpenWrt sysupgrade image (sysupgrade.bin) to the /tmp dir of the
router
6. Connect to the router (IP: 192.168.1.1) using ssh shell and run
sysupgrade command:
sysupgrade -n /tmp/sysupgrade.bin
Return to stock
---------------
1. Copy stock firmware (stock.bin) to the /tmp dir of the router using scp
2. Run following command in the router shell:
cd /tmp
mtd write stock.bin firmware
reboot
Recovery
--------
Connect uart (pins are silkscreened on the pcb), interrupt boot process by
pressing any key, use u-boot menu to flash stock firmware image or OpenWrt
initramfs image.
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | 24:0f:5e:xx:xx:4c | label |
| WAN | 24:0f:5e:xx:xx:4d | label+1 |
| WLAN 2g | 24:0f:5e:xx:xx:4e | label+2 |
| WLAN 5g | 24:0f:5e:xx:xx:4f | label+3 |
+---------+-------------------+-----------+
The WLAN 2.4 MAC was found in 'factory', 0x4
The LAN MAC was found in 'factory', 0xfff4
The WAN MAC was found in 'factory', 0xfffa
Note: This device is similar to Z-ROUTER ZR-2660, but with minor hardware
revisions. The firmware and configuration are compatible.
projects / thirdparty / openwrt.git / log
