The ethernet driver configures the SoC internal network card
on its own. There are no special serdes or other layers in
between. So there is no need for pcs handling in the driver.
Drop that.
These devices contain a single MAC address in the U-Boot environment.
Set it as eth0 and label MAC in device tree. To maintain the current
state, the 02_network script still sets individual port MAC addresses
and the bridge MAC address.
Jakub Vaněk [Tue, 3 Mar 2026 21:41:28 +0000 (22:41 +0100)]
mediatek: filogic: rename Cudy M3000 v1 to v1/v2
The Cudy M3000 v1/v2 seem to have mostly identical hardware.
The M3000 v1 OpenWrt images work on the M3000 v2 (excluding
the v2 parts with a different PHY). Cudy also distributes one
firmware image that supports both routers.
Rename the human-readable device variant to "v1/v2" to match this.
Don't change the compatible property as that hooks into the
attended sysupgrade process.
The recent flash and PHY changes don't seem to be related to the v1/v2
split. There exist M3000 v2 with the Realtek PHY, see e.g.
https://github.com/openwrt/openwrt/pull/21584#issuecomment-3864992555
Jakub Vaněk [Mon, 2 Mar 2026 20:14:28 +0000 (21:14 +0100)]
mediatek: filogic: add support for Cudy M3000 w/ YT8821 PHY
The hardware is very close the the Cudy M3000 v1 (see commit 20e4a18feb3f). However, the Motorcomm YT8821 PHY is tricky
to support because of a MDIO address collision within the router.
Specification:
- MT7981BA CPU: dual-core ARM Cortex-A53 @ 1.3 GHz
- 256 MiB RAM
- 128 MiB SPI NAND
- Ethernet:
- 1x 1GbE LAN port driven by the internal MT7981 PHY
- 1x 2.5GbE WAN port driven by the Motorcomm YT8821
- WiFi:
- MT7981BA 2.4 GHz WiFi with 2x2:2 MIMO
- MT7981BA 5 GHz WiFi with 2x3:2 MIMO
- Buttons: Reset, WPS
- LED: 1x combined red/white
How to know if you have the a router with the YT8821 PHY:
- Boot the router into the vendor's firmware. Go to Diagnostic Tools
-> System Log. Try searching for "rtl8221b".
- If there are some matches, you have the Cudy M3000 router with
the Realtek PHY and you should NOT use the device defined in this
commit. Instead, you should use the device defined in
mt7981b-cudy-m3000-v1.dts.
- If there are no matches, try searching for "yt8821". If that
matches something, you have the Cudy M3000 with the Motorcomm PHY
and you should use this device tree
(mt7981b-cudy-m3000-v2-yt8821.dts).
- If even the yt8821 string did not match anything, then something
is wrong. Rebooting the router might help (the system log would
be refreshed).
Installation via the Cudy web UI:
- Download the signed intermediary firmware from
https://drive.google.com/drive/folders/1BKVarlwlNxf7uJUtRhuMGUqeCa5KpMnj
- Flash the intermediary firmware using the Cudy web UI
- Connect a PC/laptop to the "1Gbps LAN" port
- Open http://192.168.1.1 in your browser, log in
(the password should be empty)
- Flash your desired OpenWrt firmware via LuCI
- The router should reboot into the desired firmware
How to access UART (citing from 20e4a18feb3f):
- remove rubber ring on the bottom
- remove screws
- pull up the cylinder, maybe help by push on an ethernet socket
with a screwdriver
- remove the (3) screws holding the board in the frame
- remove the board from the frame to get to the screws for the
silver, flat heat shield
- remove the (3) screws holding the heat shield
- solder UART pins to the back of the board
- make sure to have the pins point out on side with the black,
finned heat spread
- the markings for the pins are going to be below the silver heat
shield
- Vcc is not needed
- the UART parameters are 115200 baud, 8n1
Installation via UART (citing from 20e4a18feb3f):
- attach an Ethernet cable to the "1Gbps LAN" port on the router
- hold the reset button while powering the router
- press CTRL-C or wait for the timeout to get to the U-Boot prompt
- prepare a TFTP server on the network to supply ..-initramfs-kernel.bin
- use 'tftpboot 0x46000000 ..-initramfs-kernel.bin' in the U-Boot
shell to pull the image (change the file name accordingly)
- boot the image using 'bootm 0x46000000'
- push the ..-sysupgrade to the router using your preferred method
- perform the upgrade with 'sysupgrade -n'
Jakub Vaněk [Mon, 2 Mar 2026 19:36:29 +0000 (20:36 +0100)]
kernel: add patch for YT8821 address collision
This minimalistic patch should ensure that the Cudy M3000 with the
Motorcomm PHY works reliably. The patch is not upstreamable into the
mainline kernel. However, it could be sufficient as a simple stop-gap
measure until some other solution is found.
Tim Harvey [Fri, 20 Feb 2026 01:01:48 +0000 (17:01 -0800)]
imx: cortexa53: remove KSZ9477 static driver
The KSZ9477 driver was added to the cortexa53 kernel to support the
Gateworks Venice product family which has a board with this switch. Now
that the kmod-dsa-ksz9477 driver is available as a package remove the
static configuration ad add the package.
This resolves an issue caused by having the switch driver static and the
PHY driver as a module such that the PHY driver was not registered early
enough to be used causing some errata to not be worked around.
Tim Harvey [Fri, 20 Feb 2026 00:57:29 +0000 (16:57 -0800)]
kernel: netdevices: add KSZ9477 DSA switch support
This adds kernel packages for the Microchip KSZ9477 switch family.
The core package has a target specific dependency as the ksz9477
driver enables DCB which grows the kernel size and can negatively
impact other targets.
Matt Merhar [Fri, 6 Mar 2026 03:05:40 +0000 (22:05 -0500)]
mac80211: ath12k: backport thermal sensor support
This is nearly identical to what landed in ath-next for v7.1, aside from
resolving a couple conflicts. A separate patch has been added to replace
CONFIG_THERMAL with CPTCFG_ATH12K_THERMAL so the setting may be enabled
via menuconfig (as is done with ath10k and ath11k).
Note that at this stage, throttling has not been implemented upstream,
hence the slight change in wording versus existing options.
Jonas Gorski [Thu, 12 Mar 2026 19:27:17 +0000 (20:27 +0100)]
umdns: update to Git HEAD (2026-02-06)
a52cdb354d13 dns: validate IPv4 record addresses b798c24205b5 dns: validate IPv6 record addresses a3dcb4adc635 dns: validate reverse dns query name lengths
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Eric Fahlgren [Wed, 11 Mar 2026 20:16:34 +0000 (13:16 -0700)]
build: reject non-matching artifacts
Check for malformed artifact names before dereferencing them.
Fixes: https://github.com/openwrt/openwrt/commit/5816d883ff3884ae96c3293b316f6d56c099eee0 Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com> Link: https://github.com/openwrt/openwrt/pull/22385 Signed-off-by: Robert Marko <robimarko@gmail.com>
Rosen Penev [Wed, 11 Mar 2026 00:05:16 +0000 (17:05 -0700)]
bcm53xx: mr26: fix nvmem MAC override
I wrongly added the wifi devices to the pcie nodes and not the bridge
nodes as they were not present at the time.
Fixes: 58056df ("bcm53xx: backport nvmem mac for meraki mr26") Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://github.com/openwrt/openwrt/pull/22369 Signed-off-by: Robert Marko <robimarko@gmail.com>
This device is pretty useless with the stock firmware as it requires an
account to completely set it up. Additionally, the vendor bootloader is
signed and uses Airoha/Mediatek's BBT/BMT for bad block management on
the flash. It does not support UBI, thus kernel updates are subject to
BMT/BBT which OpenWrt does not support. In turn, if a kernel update
happens and a block is marked bad in the process, the device will fail
to boot and will need to be recovered via serial.
The workaround is to chainload U-Boot in place of the kernel, as it
should not need frequent updates and thus should not cause BBT/BMT to
misbehave and soft-brick the device. Upstream U-Boot supports loading
a FIT image from UBI, so we create a UBI partition for the new u-boot
env, FIT image and factory data. This way, bad blocks are managed by UBI
instead, which will not soft-brick the device should a block be marked
bad during a normal OpenWrt update. Users wishing to update U-Boot can
do so, but should be prepared to recover if a block goes bad.
Because the device is not useful with stock firmware, this is a one-way
ticket for most users and reverting will not be documented.
The following steps can be used to install OpenWrt on the W1700K.
Connect to serial console. There is a Torx T10 screw underneath the QR
code printed onto the label. Then, pry between the gray and white
plastic, starting by the ports on the back. There are clips arount the
entire device. Starting closest to the screw next to the UART header,
TX - GND - VCC - N/A - RX. The bootloader can be interrupted by
pressing any key.
Configuring Vendor Bootloader and Installing U-Boot Chainloader:
The bootloader's default bootcmd will only run a signed image. However,
we can still bootm our own image from flash.
NOTE: The vendor's ethernet drivers are flaky. You may have to reboot
and try the tftpboot part several times for it to work.
The device will now reboot into the U-Boot chainloader.
Loading the W1700K UBI Installer:
The installer can be downloaded at
https://github.com/hurrian/w1700k-ubi-installer/releases
- Boot the installer via the TFTP option in the U-Boot menu. This
process is automatic, though you may be prompted to answer some
questions.
- Once it is done, you may upgrade to your preferred build.
- For more information: https://github.com/hurrian/w1700k-ubi-installer
For those wishing to explore the stock firmware:
Rooting Stock FW (for making backups, recommended):
- Boot the router and watch serial console until presented with failsafe
mode. Enter it (f + enter).
- mount_root
- Change the root password (passwd).
- Open /etc/config/axon_platform_manager and set sshServerEnable,
localAccessEnable and remoteAccessEnable to 1.
- Search for "SSH". You'll find a long string with 3 matches such as
Enabled%25252c1%25252cSSH%Drop. Change any instances of "Disabled"
preceding SSH to "Enabled" and any instances of "Drop" to "Accept"
that follow SSH. Same for "Local SSH" and "Remote SSH".
- Set /etc/config/dropbear to:
RTL838x devices cannot reboot if the flash controller is driven in
4 byte mode. Unitl fdc3776 ("realtek: pcs: fix PLL_CML_CTRL for
serdes 0/1") this bit was luckily cleared by a coding error. Since
then the device cannot be rebooted anymore.
Looking at the SDK one can see that this bit is reset short before
the reboot happens. But we might need that in critical situations
where there is no chance to do it right in time. As the RTL838x
always ran with the bit disabled restore the old behaviour. This
time implement it as a documented quirk so it does not get lost.
Fixes: fdc3776 ("realtek: pcs: fix PLL_CML_CTRL for serdes 0/1") Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de> Link: https://github.com/openwrt/openwrt/pull/22334 Signed-off-by: Robert Marko <robimarko@gmail.com>
Eric Fahlgren [Sun, 8 Mar 2026 20:45:42 +0000 (13:45 -0700)]
build: segregate build artifacts by host architecture
Add structured data to each of the build artifacts listed in
profiles.json, in order to accomodate future inclusion of different
build host architectures.
Hauke Mehrtens [Sun, 1 Mar 2026 18:41:50 +0000 (19:41 +0100)]
wifi-scripts: fix handling spaces in wifi client config
Escape identity anonymous_identity password ca_cert and ca_cert2 in a wifi
client configuration. This fixes the handling of configuration options
containing spaces and other strings which need escaping.
Eric Fahlgren [Sun, 8 Mar 2026 16:57:57 +0000 (09:57 -0700)]
firewall4: prefer over firewall as dependency
When the virtual package "uci-firewall" is installed, the choice
between "firewall" and "firewall4" is arbitrary, sometimes resulting
in one, sometimes the other.
Set the default variant on "firewall4" to make it the preferred
package when installed as a dependency.
The Realtek DSA driver accesses the DTS at two locations.
- rtldsa_ethernet_loaded(): to check if ethernet driver is active
- rtl83xx_mdio_probe(): to create ports and link to pcs/phy
The first function does not directly search for the ethernet driver
but looks it up through the switch port nodes. Avoid future issues
and simply search all nodes that have a "ethernet" link to the
network driver.
While we are here add a missing put_device() to keep reference
counters clean.
realtek: eth: provide shared tx_header() for RTL93xx
rteth_930x_create_tx_header() and rteth_931x_create_tx_header() do
basically the same. Only exception is, that one function can handle
ports beyond 32 and the other not. Merge them into one.
MAC setting uses hard to read duplicated code. Additionally it
evaluates the unwanted family_id attribute. Provide the list
of MAC address registers in the configuration structure and use
a loop to fill those.
There is a workaround in the transmit path for the RTL838x SoCs. This
is basically an open coded read_poll_timeout() and makes the code hard
to read. Additionally the magic trigger calculation is not easy to
understand.
Simplify things by using kernel standards and a better macro.
Jan Kantert [Sat, 28 Feb 2026 23:14:10 +0000 (00:14 +0100)]
realtek: pending upstream rtl9300 i2c speed patch
Some 10G optics showed random "module transmit fault indicated" due to I2C
read errors on ONTi ONT-S508CL-8S/XikeStor SKS8300-8X switches. The same
modules work with the original firmware and on other Linux based devices.
There seems to be some differences in how we talk to those modules using
I2C in OpenWRT. To fix this this patch adds support for 50kHz I2C speed on
SFPs and enables that for XikeStor/Onti devices. Since SFPs only transmit
very few bytes this should not have any real downsides.
This patch adds support in the i2c driver for 50kHz and 2.5MHz. In a
second PR I will configure 50kHz in the DTS for the affected devices.
Harshal Gohel [Tue, 27 Jan 2026 11:35:16 +0000 (11:35 +0000)]
rtl93xx: dsa: Handle lag_change properly
LACP frequently changes active/backup links. driver must also handle
dp->lag_tx_enabled.
This should only affect egress LAG table, ingress should not be touched.
To test, connect a known working 802.3ad compatible switch (Mikrotik).
Configure bond with 802.3ad on openwrt as well as mikrotik.
Observer active/backup links on openwrt with
```
for iface in <list of bond participants>; do
ip -d link show $iface
done
```
This should show ACTIVE/BACKUP status which must be synchronized with
the partner's ACTIVE/BACKUP status if LACP is working correctly.
Backup interface must not be chosen by the distribution algorithm to
transmit egress packet
At the moment, we have two parties involved in the selection of active LAG TX
ports:
- the bonding/DSA code which informs about activated/deactivated ports using
.port_lag_change
- the HW which is deactivating ports based on the link state see
RTL93XX_TRK_CTRL_LINK_DOWN_AVOID
In our case, the software is supposed to manage everything
Co-developed-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Harshal Gohel <hg@simonwunderlich.de> Link: https://github.com/openwrt/openwrt/pull/21740 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Harshal Gohel [Tue, 27 Jan 2026 11:33:07 +0000 (11:33 +0000)]
realtek: dsa: rtl93xx: Add link aggregation support
With this commit it is possible to create 802.3ad compatible bond
interface that is interoperable with other 802.3ad compatible switches.
Each trunk group can have maximum of 8 ports as members.
Hardware also supports trunking with stacked switches, however it is not
handled here and the driver only configures the local trunk.
rtl930x and rtl931x has minimal differences in trunk/lag
Co-developed-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Harshal Gohel <hg@simonwunderlich.de> Link: https://github.com/openwrt/openwrt/pull/21740 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Harshal Gohel [Tue, 27 Jan 2026 09:41:39 +0000 (09:41 +0000)]
realtek: dsa: rtl93xx: Initialize trunk on probe
rtl93xx has two distribution algorithm slots that are shared among
multiple trunks.
Each of this slot can be configured to handle L2 and/or L3 packets
Hardware can also be configured to support layer3+4 but that is not
802.3ad compliant. With this commmit I want to focus on getting
layer2 and layer2+3 initialized in two slots.
When a new LAG group is created, depending on the xmit_hash_policy
configuration a slot will be configured in LAG table entry
SPA and VLAN bits made the switch to always choose same link for all
connections which completely dismisses point of Link aggregation.
So avoid these and stick to SMAC + DMAC for L2 packets and
SMAC + DMAC + SIP + DIP for L3 packets
Co-developed-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Jan Fuchs <jf@simonwunderlich.de> Signed-off-by: Harshal Gohel <hg@simonwunderlich.de> Link: https://github.com/openwrt/openwrt/pull/21740 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Harshal Gohel [Mon, 2 Mar 2026 09:16:10 +0000 (09:16 +0000)]
realtek: dsa: Reelect primary port for a LAG
rtl93xx hardware supports trunk fdb entries. That requires driver to
translate port-fdb entry to trunk fdb entry if the port is part of a
LAG.
There is no standard way of indicating fdb entries for bond interfaces.
One can use debugfs interface l2_table to dump all the entries stored in
the hardware. Trunk FDB entries are now displayed properly with trunk ID
and participating ports
Co-developed-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Harshal Gohel <hg@simonwunderlich.de> Link: https://github.com/openwrt/openwrt/pull/21740 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Harshal Gohel [Tue, 27 Jan 2026 17:19:46 +0000 (17:19 +0000)]
realtek: dsa: rtl93xx: Deduplicate distribution algo setup
rtl9310 and rtl9300 have two slots for configuration of packet distribution
algorithm that can be assigned to multiple LAG groups. They also have the
same field descriptions
Co-developed-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Harshal Gohel <hg@simonwunderlich.de> Link: https://github.com/openwrt/openwrt/pull/21740 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Harshal Gohel [Mon, 2 Mar 2026 09:13:13 +0000 (09:13 +0000)]
realtek: dsa: Refactor LAG in preparation for rtl93xx
It is not helpful at the moment to expose all the SoC specific details to
the common code when it actually only needed to add ports to a LAG. Just
have a simple interface for now.
Support returning errors while setting distribution algorithm
Move setting algomask to rtl83xx specific routine and out of common lag_add
because algomasks will be handled differently on rtl93xx
Co-developed-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Sven Eckelmann <se@simonwunderlich.de> Signed-off-by: Harshal Gohel <hg@simonwunderlich.de> Link: https://github.com/openwrt/openwrt/pull/21740 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2. Start a TFTP server in the folder with the ramboot.bin.
3. Plug in a USB-RJ45 serial adapter to the CONSOLE port of the device
and start a serial console session with
9600 baud, no parity, 1 stop bit.
4. Plug in either 12V power or PoE to the device.
5. On the prompt `Press f or F to stop Auto-Boot in 3 seconds`,
press `f` to enter the Huawei U-Boot command line
6. Enter a new password for the u-boot command line
7. In the command line, run these commands to ramboot OpenWrt:
setenv serverip <IPv4 address of TFTP server>
setenv ipaddr <IPv4 address for this AP>
setenv rambootfile ramboot.bin
run ramboot
8. In OpenWrt, set up the network and then `scp` the files
`u-boot-huawei_ap4050dn/uImage` and
`openwrt-ipq40xx-generic-huawei_ap4050dn-squashfs-sysupgrade.bin`
into `/tmp/`
9. To backup the original firmware, run the following:
11. The device should now boot OpenWrt! (sometimes the boot process takes a bit
longer due to the watchdog resetting the device before the watchdog driver runs)
Signed-off-by: Marco von Rosenberg <marcovr@selfnet.de>
Paul Donald [Thu, 5 Mar 2026 21:11:13 +0000 (22:11 +0100)]
ppp: add memmove fortify and remove MRU patch
memcpy() with overlapping src and dest buffers is an undefined behavior
in C. In the current code, a ConfRej response is generated by copying
input data in-place, where the dest address is lower than the src.
This happens to work in practice because memcpy() forward-copies data,
matching the behavior of memmove() in this case.
However, if FORTIFY_SOURCE or Address Sanitizer is enabled, memcpy()
will detect the overlap at run time and abort the program.
Replace the memcpy() with memmove() to ensure a well-defined behavior.
airoha: add the capability to read firmware names from dts
Introduce the capability to read the firmware binary names from device-tree
using the firmware-name property if available.
This is a preliminary patch to enable NPU offloading for MT7996 (Eagle)
chipset since it requires a different binary with respect to the one
used for MT7992 on the EN7581 SoC.
Ivan Diaz [Thu, 26 Feb 2026 13:48:52 +0000 (08:48 -0500)]
ath79: add 4k blocksize for RE355/RE450 rootfs alignment
Misaligned rootfs_data caused config loss on sysupgrade. Set BLOCKSIZE
:= 4k for proper JFFS2 alignment. Add DEVICE_COMPAT_MESSAGE for
sysupgrade -F requirement.
Jonas Jelonek [Fri, 27 Feb 2026 20:27:14 +0000 (20:27 +0000)]
ath79: replace gpio-cascade on Buffalo WZR-HP-G300NH
The GPIO cascade driver is a downstream-only driver and the Buffalo
WZR-HP-G300NH is its only user for now. Recently, a similar and
independently developed driver 'gpio-line-mux `which serves the same
purpose was accepted upstream and backported here. Use that instead the
downstream driver.
Jonas Jelonek [Tue, 3 Mar 2026 14:43:19 +0000 (14:43 +0000)]
generic: backport gpio-line-mux driver
Backport the upstream 'gpio-line-mux' driver which allows to provide a
1-to-many mapping between one physical GPIO and multiple virtual GPIOs,
based on a multiplexer.
For this purpose, there's been a dedicated downstream driver
'gpio-cascade' which is mostly the same, but wasn't upstreamed in the
end. Independently developed, the 'gpio-line-mux' driver was upstreamed
to solve the exact same problem occuring on Realtek-based Zyxel XS1930
switches. Support for those is being worked on, but the hardware uses a
similar quirk for SFP signals. The signals 'RX_LOS', 'MOD_ABS' and
'TX_FAULT' do not have dedicated GPIOs each but all use a single GPIO
which is multiplexed. Depending on the multiplexer state the GPIO line is
connected to one of the signals.
Since the SFP driver needs single GPIOs for the single signals, this
adapter drivers fills the gap to make both work together.
Add support for Richtek RTQ6056 Current and Power Monitor ADC.
RTQ6056 is a high accuracy current-sense monitor with I2C and SMBus
compatible interface, and the device provides full information for
system by reading out the load current and power.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Robert Marko [Thu, 5 Mar 2026 12:22:35 +0000 (13:22 +0100)]
firmware-utils: update to Git HEAD (2026-03-05)
46f373b47f69 tplink-safeloader: add support for TP-Link Archer AX21 v4.6 7324b0ba8e05 tplink-safeloader: fix segfault when partition name is NULL 7593018845d8 asusuimage: Cleanup code and fix typo caac8b133aca tplink-safeloader: fix soft_ver for Archer AX21 c0d7de851c9a ptgen: fix bug caused by not completely correct reverts 5b6ef84eaa74 ptgen: allow to specify index of gpt entries to be used 467685270cf0 ptgen: add an option to disable stub partition creation a2c06c39b41b ptgen: add long option support 6a87eaf434cb ptgen: add support for marking multiple partitions as bootable
Fixes: https://github.com/openwrt/firmware-utils/issues/59 Signed-off-by: Robert Marko <robimarko@gmail.com>
Kenneth Kasilag [Sat, 21 Feb 2026 21:49:46 +0000 (21:49 +0000)]
airoha: an7581: add uboot chainloader
Due to issues surrounding the implementation of the vendor BMT/BBT
on Airoha, upstream ATF + uboot has switched to UBI flash partitions.
However, some devices shipped on this platform are bootloader locked,
and thus it is impossible to replace ATF + uboot.
During testing for the Gemtek W1700K (#17869), sysupgrades from Linux
(which is unaware of the underlying BMT/BBT) would occasionally write
data into blocks which were remapped by the vendor uboot when it was
read on the following reboot, causing a soft brick.
An acceptable workaround [1],[2] was discussed where an intermediate
uboot would be written by the vendor uboot (which is aware of Airoha
BMT/BBT). This chainloader would then ignore the regions of flash
used by the vendor uboot, and store all relevant data inside of UBI.
UBI would then be used to handle bad block management. As the vendor
ATF + uboot do not read or interact with the UBI region, we would avoid
unwanted remaps from BMT/BBT.
This commit introduces support for building such a chainloader, by
packaging u-boot and DTS into a FIT image; to be flashed like a kernel.
Configuration for the Gemtek W1700K is provided as an example of how the
chainloader is used.
Signed-off-by: Kenneth Kasilag <kenneth@kasilag.me>
[ move FIP_COMPRESS to Build/Compile, wrap some long lines ] Link: https://github.com/openwrt/openwrt/pull/22151 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Problem summary:
On qualcommax (ipq60xx/ipq807x) with ath11k, monitor-mode captures contain
frames that are consistently longer than expected by 8 bytes.
The symptom is visible in pcap/radiotap captures, and Wireshark parsing
becomes correct after manually cutting these 8 bytes from captured frames.
This patch:
- Remove merge-stage FCS/tail manipulations in ath11k_dp_rx_mon_merg_msdus().
- add length fix in ath11k_dp_rx_mon_deliver(), trim 8 bytes right
before radiotap update and delivery to mac80211.
This targets monitor capture length correctness only and keeps the fix scoped
to the monitor RX delivery path.
Tested-on: ipq8072 yuncore,ax880; ipq6018 yuncore,ax840; yuncore,fap650 Signed-off-by: Ruslan Isaev <legale.legale@gmail.com> Link: https://github.com/openwrt/openwrt/pull/22244 Signed-off-by: Robert Marko <robimarko@gmail.com>
Add a backport patch of realtek ecc driver which has been accepted
upstream. It enables us to make use of devices with NAND that have
OOB size larger than 64 and utilize Realtek ECC engine in OpenWrt.
Daniel Golle [Wed, 4 Mar 2026 01:45:41 +0000 (01:45 +0000)]
uboot-mediatek: port RNG drivers and enable them
Port drivers for the hardware true random number generator found in
MediaTek SoCs and enable them for all boards.
This has the side-effect of U-Boot now providing '/chosen/kaslr-seed'
to Linux which is required to enabled KASLR.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Daniel Golle [Wed, 4 Mar 2026 01:18:08 +0000 (01:18 +0000)]
mediatek: replace downstream TRNGv2 driver
Replace the downstream mtk-rng-v2 driver which was acquires random bytes
from TF-A via SMC. A new approach is needed as TF-A for MT7986 has
changed and now requires to use SMC instead of directly accessing the
TRNG via MMIO. However, we can't know whether we are on old or new TF-A,
many devices (like the BananaPi BPi-R3) allow updating TF-A BL3 in the
field, so it may be of the old or new type, and the RNG driver will have
to figure it out somehow.
This currently means that MT7986 with newer TF-A has broken/non-working
HWRNG in Linux:
root@OpenWrt:~# hexdump -C /dev/hwrng
hexdump: /dev/hwrng: I/O error
Fix this by creating a new combined driver which replaces the previous
mtk-rng-v2 driver, and is able to auto-detect which convention to use
on MT7986.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
projects / thirdparty / openwrt.git / log
