Jakub Vaněk [Tue, 3 Mar 2026 21:41:28 +0000 (22:41 +0100)]
mediatek: filogic: rename Cudy M3000 v1 to v1/v2
The Cudy M3000 v1/v2 seem to have mostly identical hardware.
The M3000 v1 OpenWrt images work on the M3000 v2 (excluding
the v2 parts with a different PHY). Cudy also distributes one
firmware image that supports both routers.
Rename the human-readable device variant to "v1/v2" to match this.
Don't change the compatible property as that hooks into the
attended sysupgrade process.
The recent flash and PHY changes don't seem to be related to the v1/v2
split. There exist M3000 v2 with the Realtek PHY, see e.g.
https://github.com/openwrt/openwrt/pull/21584#issuecomment-3864992555
Jakub Vaněk [Mon, 2 Mar 2026 20:14:28 +0000 (21:14 +0100)]
mediatek: filogic: add support for Cudy M3000 w/ YT8821 PHY
The hardware is very close the the Cudy M3000 v1 (see commit 20e4a18feb3f). However, the Motorcomm YT8821 PHY is tricky
to support because of a MDIO address collision within the router.
Specification:
- MT7981BA CPU: dual-core ARM Cortex-A53 @ 1.3 GHz
- 256 MiB RAM
- 128 MiB SPI NAND
- Ethernet:
- 1x 1GbE LAN port driven by the internal MT7981 PHY
- 1x 2.5GbE WAN port driven by the Motorcomm YT8821
- WiFi:
- MT7981BA 2.4 GHz WiFi with 2x2:2 MIMO
- MT7981BA 5 GHz WiFi with 2x3:2 MIMO
- Buttons: Reset, WPS
- LED: 1x combined red/white
How to know if you have the a router with the YT8821 PHY:
- Boot the router into the vendor's firmware. Go to Diagnostic Tools
-> System Log. Try searching for "rtl8221b".
- If there are some matches, you have the Cudy M3000 router with
the Realtek PHY and you should NOT use the device defined in this
commit. Instead, you should use the device defined in
mt7981b-cudy-m3000-v1.dts.
- If there are no matches, try searching for "yt8821". If that
matches something, you have the Cudy M3000 with the Motorcomm PHY
and you should use this device tree
(mt7981b-cudy-m3000-v2-yt8821.dts).
- If even the yt8821 string did not match anything, then something
is wrong. Rebooting the router might help (the system log would
be refreshed).
Installation via the Cudy web UI:
- Download the signed intermediary firmware from
https://drive.google.com/drive/folders/1BKVarlwlNxf7uJUtRhuMGUqeCa5KpMnj
- Flash the intermediary firmware using the Cudy web UI
- Connect a PC/laptop to the "1Gbps LAN" port
- Open http://192.168.1.1 in your browser, log in
(the password should be empty)
- Flash your desired OpenWrt firmware via LuCI
- The router should reboot into the desired firmware
How to access UART (citing from 20e4a18feb3f):
- remove rubber ring on the bottom
- remove screws
- pull up the cylinder, maybe help by push on an ethernet socket
with a screwdriver
- remove the (3) screws holding the board in the frame
- remove the board from the frame to get to the screws for the
silver, flat heat shield
- remove the (3) screws holding the heat shield
- solder UART pins to the back of the board
- make sure to have the pins point out on side with the black,
finned heat spread
- the markings for the pins are going to be below the silver heat
shield
- Vcc is not needed
- the UART parameters are 115200 baud, 8n1
Installation via UART (citing from 20e4a18feb3f):
- attach an Ethernet cable to the "1Gbps LAN" port on the router
- hold the reset button while powering the router
- press CTRL-C or wait for the timeout to get to the U-Boot prompt
- prepare a TFTP server on the network to supply ..-initramfs-kernel.bin
- use 'tftpboot 0x46000000 ..-initramfs-kernel.bin' in the U-Boot
shell to pull the image (change the file name accordingly)
- boot the image using 'bootm 0x46000000'
- push the ..-sysupgrade to the router using your preferred method
- perform the upgrade with 'sysupgrade -n'
Jakub Vaněk [Mon, 2 Mar 2026 19:36:29 +0000 (20:36 +0100)]
kernel: add patch for YT8821 address collision
This minimalistic patch should ensure that the Cudy M3000 with the
Motorcomm PHY works reliably. The patch is not upstreamable into the
mainline kernel. However, it could be sufficient as a simple stop-gap
measure until some other solution is found.
libubox: set abi version to previous bump for stable release
In order to keep a coherent set of dependencies of the packages in the
target specific packages (nonshared) in the stable 25.12.0 release
repositories and keep ImageBuilders and ASU functional, hard code the
abi-version used in that builbot phase1 run: "20260213".
*abi compatibility has not changed between 20260213 and 20260313 anyway.
Fixes: 8aac058ef0a58f394a920e5c39ac0390363c18f9 ("libubox: update to Git HEAD (2026-03-13)") Suggested-by: Felix Fietkau <nbd@nbd.name> Signed-off-by: Mario Andrés Pérez <mapb_@outlook.com> Link: https://github.com/openwrt/openwrt/pull/22437 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
David Bauer [Sun, 15 Mar 2026 16:47:15 +0000 (17:47 +0100)]
wifi: mt76: mt7915: set mt76 specific PS flag
mt76 tracks the PSM state of a sta internally with a wcid flag. TX to
such clients is skipped based on the presence of this flag.
This flag was not added to the PS state notify handler for MT7915 chips.
Without this flag, mt76 queues pending frames to the hardware,
accounting for airtime when a PSM notification is received while in a TX
iteration.
Set the PS flag for the STA WCID to prevent this from happening. TX gets
skipped in presence of this flag.
Fabrice Fontaine [Fri, 13 Mar 2026 19:57:11 +0000 (20:57 +0100)]
tools/expat: fix PKG_CPE_ID
cpe:/a:libexpat_project:libexpat is the correct CPE ID for expat:
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:libexpat_project:libexpat
- Fix RTL8261N 10GbE PHY `reset-deassert-us` from 100ms to 221ms to meet datasheet minimum SMI-ready timing (t7 >= 150ms), fixing intermittent boot stalls caused by MDIO bus instability
- Add missing WLAN toggle button (GPIO 34) present in stock firmware but absent from OpenWrt DTS
- Fix memory size from 1 GB to the actual 512 MB
Fix 1: The RTL8261N 10GbE PHY's `reset-deassert-us` was set to 100ms (100000us), but the **RTL8261N datasheet (Table 108, parameter t7)** specifies a minimum **SMI-ready time of 150ms** after nRESET release before the MDIO (SMI) bus can be used.
With only 100ms, the kernel attempts MDIO bus access before the RTL8261N's SMI interface is stable. Since the RTL8261N (mdio-bus:00) and the internal MT7988 2.5GbE PHY (mdio-bus:0f) share the same MDIO bus, a not-yet-ready RTL8261N disrupts all MDIO traffic, causing the 2.5GbE PHY firmware loading (`mt798x_2p5ge_phy_config_init`) to stall.
Observed symptoms on warm reboot:
- Sometimes `mt798x_2p5ge_phy_config_init` hangs for 5+ minutes or indefinitely
- RCU CPU stalls (`rcu: INFO: rcu_sched detected stalls on CPUs`)
- mt7996e WiFi chip message timeouts cascading to `chip full reset failed`
- System appears hung with only power LED blinking slowly
UART serial log evidence (warm reboot with 100ms):
```
[ 73.041756] rcu: INFO: rcu_sched self-detected stall on CPU
[ 73.048341] rcu: 2-....: (8 ticks this GP)
[ 73.061641] pc : mt798x_2p5ge_phy_config_init+0x258/0xbb0
[ 73.061653] lr : mt798x_2p5ge_phy_config_init+0x238/0xbb0
...
[ 334.771280] MediaTek MT7988 2.5GbE PHY mdio-bus:0f: Firmware date code: 2024/10/30
```
The 2.5GbE PHY firmware loading, which normally takes ~3 seconds, took **325 seconds** due to MDIO bus instability. In the worst case, the system never recovers.
GPL DTS uses 221ms (`reset-deassert-us = <221000>`), providing 71ms of margin above the 150ms datasheet minimum. All MediaTek MT7988 reference board DTS files in the GPL use this same 221ms value.
Fix 2: Missing WLAN button (GPIO 34)
The BE450 has a physical WLAN toggle button on GPIO 34, defined in the stock TP-Link GPL DTS but missing from the OpenWrt DTS. Without this definition, the button is non-functional under OpenWrt.
The pin name for GPIO 34 in the MT7988 pinctrl is `SPI2_MISO`, confirmed by the kernel pinctrl driver (`pinctrl-mt7988.c`: `MT7988_PIN(34, "SPI2_MISO")`) and the official devicetree binding (`mediatek,mt7988-pinctrl.yaml`).
Note: GPIO 34 is also used by the BE450's First U-Boot as a recovery button (web recovery 192.168.1.1). Registering it in the DTS ensures the kernel claims the pin.
Fix 3: Incorrect memory size in DTS
The OpenWrt DTS declares 1 GB (`0x40000000`) of RAM, but the BE450 has 512 MB (`0x20000000`).
RTL838x devices cannot reboot if the flash controller is driven in
4 byte mode. Unitl fdc3776 ("realtek: pcs: fix PLL_CML_CTRL for
serdes 0/1") this bit was luckily cleared by a coding error. Since
then the device cannot be rebooted anymore.
Looking at the SDK one can see that this bit is reset short before
the reboot happens. But we might need that in critical situations
where there is no chance to do it right in time. As the RTL838x
always ran with the bit disabled restore the old behaviour. This
time implement it as a documented quirk so it does not get lost.
Jonas Gorski [Thu, 12 Mar 2026 19:27:17 +0000 (20:27 +0100)]
umdns: update to Git HEAD (2026-02-06)
a52cdb354d13 dns: validate IPv4 record addresses b798c24205b5 dns: validate IPv6 record addresses a3dcb4adc635 dns: validate reverse dns query name lengths
Hauke Mehrtens [Sun, 1 Mar 2026 18:41:50 +0000 (19:41 +0100)]
wifi-scripts: fix handling spaces in wifi client config
Escape identity anonymous_identity password ca_cert and ca_cert2 in a wifi
client configuration. This fixes the handling of configuration options
containing spaces and other strings which need escaping.
Eric Fahlgren [Sun, 8 Mar 2026 16:57:57 +0000 (09:57 -0700)]
firewall4: prefer over firewall as dependency
When the virtual package "uci-firewall" is installed, the choice
between "firewall" and "firewall4" is arbitrary, sometimes resulting
in one, sometimes the other.
Set the default variant on "firewall4" to make it the preferred
package when installed as a dependency.
Ryan Chen [Wed, 11 Feb 2026 04:25:01 +0000 (22:25 -0600)]
airoha: fix EN7581 PCIe initialization and add x2 link support
Fix two hardware initialization issues in the EN7581 PCIe controller
and add support for x2 (2-lane) link mode.
Fixes:
The upstream EN7581 PCIe initialization writes EQ presets and PIPE
configuration registers before clk_bulk_prepare_enable(). Since the
MAC clocks are not yet running at that point, these register writes
are silently dropped, leaving the hardware with default values. This
can cause link training failures or suboptimal equalization.
Additionally, after link training the MAC may only advertise Gen1-Gen2
capability in the Link Capabilities 2 register despite the PHY being
configured for Gen3. A serdes reset toggle forces the MAC to re-read
PHY capability, recovering Gen3 8GT/s link speed.
Both issues are addressed by separating PERST from the clock callbacks
(patch 911), allowing the PCIe controller driver to properly sequence
PERST, clock enable, and register writes (patch 912).
New feature:
PCIe x2 mode support for EN7581 using the NP_SCU system controller
for serdes mux routing, PERST management, and lane configuration.
Both bonded MACs are configured for x2 operation with proper EQ
presets before link training begins.
Ivan Diaz [Thu, 26 Feb 2026 13:48:52 +0000 (08:48 -0500)]
ath79: add 4k blocksize for RE355/RE450 rootfs alignment
Misaligned rootfs_data caused config loss on sysupgrade. Set BLOCKSIZE
:= 4k for proper JFFS2 alignment. Add DEVICE_COMPAT_MESSAGE for
sysupgrade -F requirement.
Paul Donald [Thu, 5 Mar 2026 21:11:13 +0000 (22:11 +0100)]
ppp: add memmove fortify and remove MRU patch
memcpy() with overlapping src and dest buffers is an undefined behavior
in C. In the current code, a ConfRej response is generated by copying
input data in-place, where the dest address is lower than the src.
This happens to work in practice because memcpy() forward-copies data,
matching the behavior of memmove() in this case.
However, if FORTIFY_SOURCE or Address Sanitizer is enabled, memcpy()
will detect the overlap at run time and abort the program.
Replace the memcpy() with memmove() to ensure a well-defined behavior.
Jonas Gorski [Wed, 14 Jan 2026 19:19:30 +0000 (20:19 +0100)]
build: use STAGING_DIR for special APK package versions
Removing tmp/ after having built base-files or toolchain currently
breaks rootfs generation:
$ rm -rf tmp
$ make V=w
...
make[2] package/install
cat: .../openwrt/tmp/base-files.version: No such file or directory
cat: .../openwrt/openwrt/tmp/libc.version: No such file or directory
ERROR: 'base-files=' is not a valid world dependency, format is name(@tag)([<>~=]version)
make[2]: *** [package/Makefile:100: package/install] Error 99
The only way to recover from here is to clean toolchain and base-files via
$ make package/{base-files,toolchain}/clean
tmp is supposed to be ephemeral, so clearing it is an expected action,
which normally just triggers a regeneration of all files there.
Fix this by moving the version files to $(STAGING_DIR).
Valent Turkovic [Tue, 3 Mar 2026 21:18:52 +0000 (22:18 +0100)]
ipq40xx: re-enable MeshPoint.One target
The MeshPoint.One was disabled during the DSA migration with the
comment "Missing DSA Setup". However, this device inherits its
entire network configuration from 8dev Jalapeno via the
Device/8dev_jalapeno-common template, and shares the same DSA
network setup in 02_network.
The Jalapeno has been working with DSA since the migration. All
MeshPoint.One board support files (DTS, network config, LED config)
are already in place and reference the same QCA8072 switch
configuration as the Jalapeno.
Hardware: Qualcomm IPQ4018, QCA8072 switch, same as 8dev Jalapeno.
Tested: Built firmware from current main branch, boots and network
functions correctly.
Hauke Mehrtens [Wed, 25 Feb 2026 23:02:11 +0000 (00:02 +0100)]
base-files: honoring Dave Täht with the OpenWrt 25.12
Dave Täht sadly passed away on April 1, 2025. With the OpenWrt 25.12
release, we honor his life and his remarkable contributions.
Dave played a key role in reducing bufferbloat and improving network
latency in OpenWrt and across the wider internet. His work made networks
faster, more responsive, and more reliable for millions of users.
This release is dedicated to his memory and lasting impact on the
networking community.
Dave's Wikipedia article: https://en.wikipedia.org/wiki/Dave_T%C3%A4ht
KSZ DSA driver is the only thing in the kernel selecting DCB support
instead of depending on it if required.
So, it will enable DCB support without asking and we do not want the
kernel size increase, as well as current Layerscape ARMv8 build failure.
So, revert this until its fixed upstream or worked around.
realtek: pcs: revive dead ports after RTL8382M start
SerDes attached ports that are connected during switch
boot might not be able to transmit any data after SerDes
setup. Especially ports that passed traffic before (e.g.
for tftp initramfs boot) seem to be affected. Ports that
are connected later do not show this issue.
It turns out that the old SerDes setup never really worked
on RTL8382 and the pcs refactoring (with dynamic SerDes
start and stop) totally changed the order of network bringup
in contrast to Realtek SDK.
Fix this by restaring the switch queue whenever a SerDes
goes up for the first time.
realtek: central unlock for RTL838x write protection
The write protection register (0x1b000058) is opened up in prom init
but closed later in rtl838x_pie_init(). From that moment no more
special register writes are possible.
Only unlock the write protection register once during prom init.
Remove all other references. The error has been active since ages
but was not visible until pcs refactoring. For reference blame the
refactoring commit.
- It clears out bits 4-31 due to a wrong mask
- Setup of bits 0-3 is not generic but depends on the mode of
serdes 0/1
Fix that by relocating the code and adapting the mask. The error
exists for longer but it has survived the pcs refactoring. Thus
blame the corresponding refactoring commit.
Hauke Mehrtens [Thu, 26 Feb 2026 19:49:17 +0000 (20:49 +0100)]
lantiq: dm200: Fix loading PHY firmware
The device has 1 100MBit/s port. By default the PHY firmware is running
in 1GBit/s mode. The driver will try to load the 1GBit/s firmware and
fail if it is not there. Set the GPHY0 also to 100MBit/s mode.
The driver uses all nodes independent of the status attribute.
mt7620: workaround jal imm26 and redundant PAGE_ALIGN
On MT7620-class platforms (CONFIG_NET_RALINK_MT7620) we observe sporadic
wrong-jump-targets, kernel oopses, hanging, corrupted backtraces or even
"half-written" instructions when the compiler emits a direct 'jal imm26'
call.
This is triggered in:
- the small random helpers inside get_random_u32_below(), and
- the blkcg_maybe_throttle_current() call in resume_user_mode_work().
This patch forces those two call sites to use an indirect call via
a volatile function pointer (load into register + jalr) when building
for MT7620, avoiding embedding a 26-bit immediate jump target.
Additionally, on MT7620 builds the exec path in fs/exec.c is modified:
- skip arch_align_stack() + PAGE_ALIGN() in setup_arg_pages()
because the micro-randomization (< PAGE_SIZE) implemented by many
ports (including MT7620) is negated immediately by PAGE_ALIGN().
Skipping the redundant PAGE_ALIGN() reduces exposure to the
problematic code pattern.
These changes are targeted workarounds for MT7620; behavioral logic is unchanged.
Compared to ralink,mtd-eeprom , the nvmewm binding ends up byteswapping
the data on big endian hosts. Meaning on big endian, the nvmwem binding
is equivalent to:
ralink,mtd-eeprom +
ralink,eeprom-wrap
Revert as a result since there's no eeprom-swap here.
Hauke Mehrtens [Wed, 25 Feb 2026 00:26:02 +0000 (01:26 +0100)]
mac80211: activate BRCMFMAC_SDIO on x86
Activate the option BRCMFMAC_SDIO by default on x86 too. x86 already
compiles MMC support into the kernel. This will just compile brcmfmac
with MMC support.
Hauke Mehrtens [Wed, 25 Feb 2026 23:41:11 +0000 (00:41 +0100)]
wifi-scripts: fix handling of 64 character WPA key
The key variable is not defined in the scope when setting wpa_psk. Use
config.key instead.
This fixes configuration the 64 characters wpa_psk directly.
Hauke Mehrtens [Wed, 25 Feb 2026 21:42:56 +0000 (22:42 +0100)]
ramips: mt7621: fix network configuration
The configuration for the dlink,dir-1360-a1 also changed the settings
for the devices defined on top of it. "lan1 lan2 lan3 lan4" "wan" is
the default configuration, no need to add it here.
Daniel Golle [Mon, 9 Feb 2026 11:47:39 +0000 (11:47 +0000)]
procd: update to git HEAD
7e5b324 instance: check length of names when creating cgroups 014f94c procd: jail/cgroups: fix OOB write in cgroups_apply() e08cdc8 hotplug-dispatch: fix filter disallowing setting PATH afa4391 service instance: Improve handling of watchdog config changes 52c64d2 service instance: Fix overwriting of watchdog linked list members 96c827f coldplug: fix missing header include 6b10c71 hotplug-dispatch: fix missing header include 58d7aaa initd/coldplug: create /dev/null before running udevtrigger 64f97ff hotplug-dispatch: redirect output to /dev/null c4e9859 hotplug-dispatch: use stat if d_type is DT_UNKNOWN bafdfff system: fix arguments validation in ubus handler
Chester A. Unal [Mon, 5 Jan 2026 12:54:42 +0000 (14:54 +0200)]
ramips: mt7621: enable kmod-usb3 for Mikrotik RBM33G
Mikrotik RBM33G has got a USB-A port and mPCIe slots with USB 3.0 and USB
2.0 interfaces in use. The MediaTek MT7621 SoC has got an xHCI to provide
these interfaces. Therefore, enable kmod-usb3 to support them.
Fixes: 5684d087418d ("ramips: Add support for Mikrotik RouterBOARD RBM33g") Signed-off-by: Chester A. Unal <chester.a.unal@arinc9.com>
(cherry picked from commit 61c9337d80318a49a5bcee586435b513fbdeacf7)
Daniel Golle [Fri, 20 Feb 2026 14:49:02 +0000 (14:49 +0000)]
Revert "package: kernel: dtc: Add DTO support"
It looks like commit 6d2f3b1b19 ("package: kernel: dtc: Add DTO support")
added this patch file 9 years ago without it ever being applied anywhere.
Back then there wasn't even a 'dtc' package, but we just used 'dtc' from
the Linux kernel sources.
Nowadays there is package/utils/dtc which is used to build dtc to be used
on the target (*not* a host-build!), and it of course already contains
support for device tree overlays since v1.4.3 from 2017...
Sander Vanheule [Sat, 21 Feb 2026 14:00:39 +0000 (15:00 +0100)]
realtek: hog the GS1900-24E external IC reset line
The GPIO line connecting to the reset signals of the GS1900-24E(A1)'s
external ICs (RTL8218B phys and RTL8231 expander) cannot be asserted by
the MDIO subsystem, as the reset is shared between busses.
To prevent users from accidentally asserting the reset line, a GPIO hog
is created to permanently de-assert the signal, reliably keeping the
phys and GPIO expanders on.
Tested-by: Simon Fischer <simi.fischa@gmail.com> Signed-off-by: Sander Vanheule <sander@svanheule.net>
(cherry picked from commit ba57225066243b28d2802ea5c47313c97767150e)
Sander Vanheule [Sat, 21 Feb 2026 13:44:23 +0000 (14:44 +0100)]
realtek: rtl838x: drop GS1900 MDIO reset GPIO
The reset line wired to the RTL8231 on the GS1900 series may also
connect to other external ICs on the board. On the GS1900-24E, the
reset line is wired (via buffers) to the board's RTL8231 expanders and
the RTL8218 phys. As these external devices (phys) are on different
busses, the reset line shouldn't be specified on one bus or the other.
Drop the reset specification from the generic GPIO description, so it
can be added back on a per-device basis after confirming the behavior.
Tim Harvey [Fri, 20 Feb 2026 01:01:48 +0000 (17:01 -0800)]
imx: cortexa53: remove KSZ9477 static driver
The KSZ9477 driver was added to the cortexa53 kernel to support the
Gateworks Venice product family which has a board with this switch. Now
that the kmod-dsa-ksz9477 driver is available as a package remove the
static configuration ad add the package.
This resolves an issue caused by having the switch driver static and the
PHY driver as a module such that the PHY driver was not registered early
enough to be used causing some errata to not be worked around.
Hauke Mehrtens [Sun, 22 Feb 2026 22:11:47 +0000 (23:11 +0100)]
wireless-regdb: update to version 2026.02.04
75bedc5 wireless-regdb: Update regulatory info for Australia (AU) for 2025 a6e5195 wireless-regdb: Update broken link in regulatory.bin(5) manpage 9e8c67f wireless-regdb: Update regulatory info for Malaysia (MY) for 2024 61a4637 wireless-regdb: Update regulatory info for Malaysia (MY) for 2025 5cefe55 wireless-regdb: Update regulatory info for Tunisia (TN) on 6GHz for 2025 1a729ae wireless-regdb: Update regulatory info for Canada (CA) for 2025 ea20dfa wireless-regdb: update regulatory database based on preceding changes
Jonas Lochmann [Mon, 16 Feb 2026 00:00:00 +0000 (01:00 +0100)]
iproute2: include upstream patch for musl libc
Due to a missing include, the constant UINT_MAX is undefined. This
fixes issues when building v25.12.0-rc5. Including a newer version of
iproute2 would include the patch, but causes other building issues.
Add support for the TP-Link EAP683-LR, an AX6000 Ceiling Mount WiFi 6
AP.
Hardware:
* SoC: MediaTek MT7896AV
* RAM: 1GiB DDR4 (Samsung K4A8G165WC-BCTD)
* Flash: 128MiB SPI-NAND (ESMT F50L1G41LB)
* Ethernet: 1x 10/100/1000/2500 Mbps PoE-PD (MaxLinear GPY211C)
* WiFi: MT7976AN/MT7976GN 2.4/5GHz 4T4R
* LEDS: 3x blue connected to a single GPIO line
* Buttons: 1x reset
* BLE/Thread/Zigbee: CC2652
Stock firmware uses a random MAC address for ethernet, label MAC for
2.4 and label MAC + for 5GHz.
Installation via bootloader:
* Solder JST??? connector on J255, alternatively solder wires on the
TP13-TP15 pads. Pinout: TP13: TX, TP14: RX, TP15: GND, TP16: VCC.
The pins for J255 are in the same order.
* Interrupt boot process by repeatedly pressing Ctrl+b during boot
* In the boot menu, select U-Boot console
* Ensure the U-Boot environment variable "tp_boot_idx" is not set:
# setenv tp_boot_idx
# saveenv
* Boot the OpenWrt initramfs:
# tftpboot openwrt-mediatek-filogic-tplink_eap683-lr-initramfs-kernel.bin
# bootm
* copy openwrt-mediatek-filogic-tplink_eap683-lr-squashfs-sysupgrade.bin
to /tmp and install it using sysupgrade
Flashing via OEM firmware is currently not supported. The
tplink-safeloader utility does not recognize the OEM firmware:
DEBUG: can not find fwuphdr
Firmware image partitions:
base size name
Segmentation fault (core dumped)
To revert to the OEM firmware, you can set the U-Boot environment
variable "tp_boot_idx" to 1 via bootloader, or using fw_setenv via
OpenWrt. This should result in booting from the ubi1 partition, which
OpenWrt should not touch. Then use the web interface to upgrade
firmware: System > Firmware Update.
The OEM firmware uses 0x800000 for the runtime_backup partition size.
This causes the following warning:
mtd: partition "runtime_backup" extends beyond the end of device "nmbm_spim_nand" -- size truncated to 0x600000
This is due to the NMBM reserved blocks. Use 0x600000 in our DTS.
Thanks to init Lab's user890104, who soldered jumper wires on the TTL
pads for me so I could have serial console. My soldering skills just
aren't good enough to pull that off without risk damaging things.
The NVMEM codepath does not perform automatic byte conversion. It can be
fixed but the upstream version is quite different from the local
mac80211 patch. Revert until mac80211 gets updated and the whole mess
can get squared away.
ramips: remove obsolete SPI flash nodes after kernel fix
Remove incomplete SPI flash definitions from affected device tree files.
These fragments only defined address-cells and size-cells without any
actual flash configuration (partitions, compatible string, etc.).
After applying openwrt/openwrt#20942 ("kernel: of: fix bad cell count error
for SPI flash node"), the kernel properly handles SPI flash nodes without
requiring these incomplete definitions in device-specific DTS files.
This cleanup eliminates unnecessary code that was likely a workaround for
the previous kernel issue.
Yaroslav Isakov [Sat, 14 Feb 2026 18:35:06 +0000 (19:35 +0100)]
hostapd: fix EAP-PWD in experimental hostapd-radius server
Without initializing pwd_group, it's set to 0, which is reserved value.
When EAP-PWD is used in wpa_supplicant/eapol_test, next error is seen:
EAP-PWD: Server EAP-pwd-ID proposal: group=0 random=1 prf=1 prep=0
EAP-pwd: Unsupported or disabled proposal
Chad Monroe [Fri, 6 Feb 2026 17:21:44 +0000 (09:21 -0800)]
hostapd: initialize first BSS radio_mask during driver init
Secondary BSSes inherit the alloc value which bypasses
NL80211_ATTR_VIF_RADIO_MASK in nl80211_create_iface() and causes the
kernel to default new interfaces to all radios.
The ucode bss_create fallback fails to correct this because
the interface is already UP.. the kernel rejects SET_INTERFACE with
-EBUSY.
projects / thirdparty / openwrt.git / log
