1
1
Commit Graph

69206 Commits

Author SHA1 Message Date
Rosen Penev
c8dcb40229
apm821xx: enable 6.18 testing kernel
Enable the 6.18 testing kernel for APM821XX.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23382
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-25 10:16:49 +02:00
Rosen Penev
d47f54d65a
apm821xx: refresh 6.18 patches
Refresh patches for 6.18.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23382
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-25 10:16:49 +02:00
Rosen Penev
8f74536187
apm821xx: refresh 6.18 config
Add missing symbols for 6.18.

Remove random PPC debug stuff. It looks like a holdover from when
support was being added for it.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23382
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-25 10:16:48 +02:00
Rosen Penev
992cd9a385
kernel/apm821xx: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.

For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23382
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-25 10:16:48 +02:00
Rosen Penev
aa294df1bc
kernel/apm821xx: create files for v6.18 (from v6.12)
This is an automatically generated commit.

When doing `git bisect`, consider `git bisect --skip`.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23382
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-25 10:16:48 +02:00
Tuan Phan
2808857215 mediatek: filogic: add support for ZBT-Z8803BE
Specifications:

SoC: MediaTek MT7988A (4 cores)
RAM: 1024MiB
Flash: Winbond SPI-NAND 128 MiB
Network: 1 WAN (2.5G), 3 LAN (1G), 1 SFP+ (10G)
2 SIM slots
Buttons: Reset, WPS
Power: DC 12V 3A (Recommend 19V to avoid voltage drop)
WiFi: MT7996 2.4Ghz, 5.8Ghz and 6Ghz (BE19000)
    - 2.4Ghz and 5.8Ghz share same dual band antenna (4)
    - 6Ghz uses dedicated 6G antenna (4)
Misc: 1 USB2.0 port, UART header

Installation:

A. Through U-Boot menu:

  - Prepare your connecting computer to use a static IP in
    network 192.168.1.0/24
  - Power down the router and hold in the Reset button.
  - While holding in the button power up the router again.
  - Hold the button in for 10 seconds and then release.
  - Use your browser to go to 192.168.1.1
  - If you see a GUI allowing for flashing firmware then
    you got the right model.
  - Upload the sysupgrade file.

Note 1: Recovery GUI can be used to recover from an incorrect
      firmware flash.
Note 2: There is a GPIO watchdog that expires after 2 minutes
      so flashing sysupgrade via U-boot needs to be done
      quickly within that timer.

B. Through OpenWrt Dashboard:
  If your router comes with OpenWrt preinstalled
  (modified by the seller), you can easily upgrade
  by going to the dashboard (192.168.1.1) and then
  navigate to System -> Backup/Flash firmware,
  then flash the firmware

MAC Addresses:
LAN(printed MAC) : F8:5E:3C:xx:xx:xx (Factory, 0xffff4)
WAN              : F8:5E:3C:xx:xx:xx (Factory, 0xffffa)
SFP+             : F8:5E:3C:xx:xx:xx (Factory, 0xfffee)
2.4GHz           : F8:5E:3C:xx:xx:xx (Factory, 0x4)
5GHz             : F8:5E:3C:xx:xx:xx (Factory, 0x4) + 0x10
6Ghz             : F8:5E:3C:xx:xx:xx (Factory, 0x4) + 0x20

Signed-off-by: Tuan Phan <pttuan@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23053
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-25 03:08:33 +02:00
Fil Dunsky
b2795a7908 mediatek: add Huasifei WH3000R NAND support
**Huasifei WH3000R NAND**
Wi-Fi 6 router based on MediaTek MT7981B SoC.
MT7981B+MT7976CN+MT7531AE

**Specifications**
SoC: Filogic 820 MT7981B (1.3GHz)
RAM: DDR3 512MB
Flash: 256MiB Winbond SPI NAND
WiFi: MT7976C: 2.4GHz 2x2, 5GHz 2x2
Ethernet: MT7531: 3x 1GbE LAN + 1x 1GbE WAN
USB: 1x USB 3.0 port
Two buttons: reset and mesh
LEDs: RGB (red, green, blue together)
UART: 3.3V, TX, RX, GND / 115200 8N1
DC power interface

+---------+-------------------+--------------------------+
|         | MAC               | Algorithm                |
+---------+-------------------+--------------------------+
| LAN     | 58:23:BC:xx:xx:x2 | label+1                  |
| WAN     | 58:23:BC:xx:xx:x1 | label+0 (eeprom)         |
| WLAN 2g | 58:23:BC:xx:xx:x3 | label+2                  |
| WLAN 5g | 58:23:BC:xx:xx:x4 | label+3                  |
+---------+-------------------+--------------------------+
Since it's convenient for the users to check and tell MAC
to their internet providers from the router label, we set
WAN as a base MAC located at 'Factory', 0x4.
Discussed this with the vendor.

**Installation via U-Boot rescue**
1. Set static IP 192.168.1.2 on your computer and default route as 192.168.1.1
2. Connect to the LAN port and hold the reset button while booting the device.
3. Wait for the LED to blink 5 times, and release the reset button.
4. Open U-boot web page on your browser at http://192.168.1.1
5. Select the OpenWrt sysupgrade image, upload it, and start the upgrade.
6. Wait for the router to flash the new firmware.
7. Wait for the router to reboot itself.

**Installation via sysupgrade**
Just flash sysupgrade file via
[LuCI upgrade page](http://192.168.1.1/cgi-bin/luci/admin/system/flash)
without saving the settings.

**Installation via SSH**
Upload the file to the router `/tmp` directory, `ssh root@192.168.1.1`
and issue a command:
```
sysupgrade -n /tmp/openwrt-mediatek-filogic-huasifei_wh3000r-nand-squashfs-sysupgrade.bin
```

Signed-off-by: Fil Dunsky <filipp.dunsky@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23156
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-25 02:46:34 +02:00
Richard Jones
db7d264e47 mediatek: filogic: add support for AlwayLink M01K43
Add support for the AlwayLink M01K43 5G CPE router.

Hardware specifications:
- SoC:       MediaTek MT7981B (Filogic 820), dual-core Cortex-A53
- RAM:       256 MiB DDR3 (0x40000000, size 0x10000000)
- Flash:     128 MiB SPI-NAND (UBI, root) + 4 MiB SPI-NOR (bootloader)
- Ethernet:  4x 1 GbE LAN + 1x 2.5 GbE WAN
             (MT7531 DSA switch; WAN via RTL8221B 2.5GbE PHY on MAC1)
- WiFi:      MT7981 built-in 2x2 802.11ax (2.4 GHz + 5 GHz)
- USB:       1x xHCI (USB 2.0 only; USB 3.0 PHY pins not routed)
- Modem:     M.2 B-Key slot wired for USB (tested: Quectel RM551E-GL,
             Quectel RM520N-GL via QMI)
- LEDs:      10x GPIO LEDs (status, WAN, LAN, WiFi 2.4/5, signal bars)
- Buttons:   WPS, Reset, RFKill
- Power:     12 V DC barrel jack
- UART:      3.3 V TTL header on PCB, 115200 8N1, no flow control

PCB silkscreen: M01K43 v5.0
Manufacturer:   Shenzhen AlwayLink Wireless Technology Co., Ltd.

MAC addresses come from the 'ledeinfo' partition (mtd6) at offset 0x18
(label macaddr_ledeinfo_18); the stored value is the LAN MAC.

  interface            this port    vendor firmware
  -------------------  -----------  --------------------------
  eth0 / LAN bridge    base + 0     base + 0
  eth1 / WAN           base + 1     base + 1
  wifi 2.4 GHz band@0  base + 2     base (driver-derived)
  wifi 5 GHz   band@1  base + 3     base + LAA bit (driver)

The vendor's ethernet scheme (LAN = base, WAN = base + 1) is reproduced
exactly. For WiFi the vendor's proprietary mt_wifi driver ignores the
stored per-radio MAC and derives each BSSID from the base by setting the
locally-administered bit, so the radios are not given clean unicast
offsets. Under mainline mt76 + DSA, reusing the base (LAN) MAC on a radio
collides at L2 with the gmac0 conduit, so this port assigns the 2.4 GHz
and 5 GHz radios base + 2 and base + 3 — unique unicast addresses in the
same OUI block.

Installation
------------

Stock firmware defaults (verified on shipping units):
  LAN IP:   192.168.100.1
  SSH/web:  user 'root', password 'admin'
  Serial:   3.3 V TTL UART header on PCB, 115200 8N1, no flow control

Image artifacts produced by this device definition:
  openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-factory.bin
  openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-sysupgrade.bin

Before flashing, back up the per-unit partitions (cannot be
regenerated):

  ssh root@192.168.100.1
  dd if=/dev/mtd3 of=/tmp/factory.bin bs=1 count=655360
  dd if=/dev/mtd6 of=/tmp/ledeinfo.bin bs=1 count=65536
  exit
  scp root@192.168.100.1:/tmp/factory.bin  .
  scp root@192.168.100.1:/tmp/ledeinfo.bin .

Method 1 - From an existing OpenWrt install (sysupgrade):

  IMG=openwrt-mediatek-filogic-alwaylink_m01k43-squashfs-sysupgrade.bin
  scp "$IMG" root@192.168.1.1:/tmp/sysupgrade.bin
  ssh root@192.168.1.1 sysupgrade -n /tmp/sysupgrade.bin

Method 2 - U-Boot serial recovery via TFTP (requires 3.3 V USB-UART
adapter):

  1. Attach 3.3 V USB-UART (TX, RX, GND) to the PCB header. Open a
     terminal at 115200 8N1, no flow control.
  2. Configure a TFTP server on the host PC at IP 192.168.2.88.
     Place the factory image in the TFTP root, renamed if desired.
  3. Power on the router. The BL2/U-Boot banner prints within ~1
     second; press any key during the autoboot countdown to enter
     the U-Boot menu.
  4. From the menu, select 'Upgrade ubi'. U-Boot's default IP is
     192.168.2.1 and it expects the TFTP server at 192.168.2.88.
     Provide the factory image filename when prompted.
  5. Wait for the write to complete; U-Boot reboots into OpenWrt.

Method 3 - From a NAND programmer (brick-recovery path):

  1. Clip onto or desolder the SPI-NAND chip and dump the full
     128 MiB with a programmer (e.g. RT809H, CH341A with NAND
     adapter). Keep the dump as a recovery image.
  2. Using the same programmer, write the factory.bin image to
     the UBI region of the NAND. The SPI-NOR (BL2/u-boot-env/
     Factory/FIP/woem/ledeinfo/nvram) must NOT be erased - those
     partitions are per-unit and live on the separate 4 MiB NOR.
  3. Reseat the chip and power on. The bootloader on NOR will
     load the new kernel and rootfs from UBI.

Signed-off-by: Richard Jones <richard@netsolution.shop>
Link: https://github.com/openwrt/openwrt/pull/22818
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-25 02:34:03 +02:00
Kirill Molotov
a3105d3f95 mediatek: filogic: add support for Globitel BT-R320
The Globitel BT-R320 (PCB rev V1.2) is an enterprise/ISP Wi-Fi 6 router
based on the MediaTek MT7981B (Filogic 820) platform.

Hardware specifications:
SoC: MediaTek MT7981B (Filogic 820)
RAM: 1GB DDR4 (Nanya NT5AD512M16C4-HR)
Flash: 128GB eMMC (UNIC UNMEN07GC4C31BS)
Switch: MediaTek MT7531AE
Ethernet: 1x 1GbE WAN, 3x 1GbE LAN
Wi-Fi: 2.4 GHz: 2x2 MT7976CN and 5 GHz: 2x2 MT7976CN (integrated FEM)
USB: 1x USB 3.0
LEDs: 2x Green (WLAN 2.4G / 5G)
Buttons: 1x Reset (GPIO 1, ACTIVE_LOW), 1x WPS (GPIO 0, ACTIVE_LOW)
Power: 12V, 1.5A
UART: 115200 8n1

Note on eMMC configuration (Addressing 52MHz limit on 128GB IC):
Debugfs output from the OEM firmware (/sys/kernel/debug/mmc0/ios) confirms
the manufacturer deliberately limits the eMMC to 52MHz High-Speed mode at 3.3V
(actual clock: 52000000 Hz, bus width: 8 bits, timing spec: mmc high-speed).
Therefore, the conservative DTS properties (max-frequency = <52000000> and
lack of HS200/HS400 support) strictly reflect the OEM hardware design.

Installation instructions:
1. SSH into the stock router (192.168.132.1, user: root, pass: password).
2. Back up existing partitions using dd.
3. Upload the OpenWrt-built GPT partition table (*-gpt.bin) and flash it:
   dd if=/tmp/gpt.bin of=/dev/mmcblk0 bs=512 count=34 conv=fsync
   echo -e 'w' | fdisk /dev/mmcblk0
4. Flash the OpenWrt-built U-Boot (*-bl31-uboot.fip) to the FIP partition:
   dd if=/tmp/uboot.fip of=$(blkid -t PARTLABEL=fip -o device) conv=fsync
5. Disconnect power. Connect PC with static IP 192.168.1.2.
6. Hold reset button, power on, and wait 10 seconds to enter U-Boot web UI.
7. Flash the OpenWrt sysupgrade image.

Stock partition layout:
p1: uboot_env
p2: factory
p3: fip
p4: kernel
p5: rootfs
p6: userdata

MAC address layout (factory partition, mmcblk0p2):
WAN: xx:xx:xx:xx:xx:xx (factory offset 0x24)
LAN: xx:xx:xx:xx:xx:xy (factory offset 0x2a)
Label: Matches LAN MAC (0x2a)
2.4G: Base MAC (extracted from factory offset 0x4)
5G: Base MAC with Locally Administered bit set

Signed-off-by: Kirill Molotov <kirill2015molotov@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23188
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-25 01:46:25 +02:00
Rosen Penev
7116f3cd00 lantiq: remove old kernel fixes
No longer needed.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22949
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-25 00:55:12 +02:00
Rosen Penev
9586b75358 ar8216: use devm for mdiobus consistently
devm_mdiobus_alloc is already used. Be consistent and use
devm_of_mdiobus_register.

Also add a missing of_node_put for the mdio node.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22998
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-25 00:36:10 +02:00
Rosen Penev
816bd659c3 ar8327: convert LEDs to a flexible array member
Reduces allocations by 1.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22998
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-25 00:36:10 +02:00
Jonas Jelonek
6db1127e8a
qoriq: drop kernel config for 6.12
The target was recently switched to 6.18. However, it was missed to drop
the kernel config 6.12 and a rebase unintendedly reverted previous
changes. Since the config isn't needed anymore, drop it.

Fixes: d3a7e89569 ("qoriq: switch to 6.18 kernel")
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 23:43:54 +02:00
Pawel Dembicki
d3a7e89569
qoriq: switch to 6.18 kernel
This target is not popular among active developers.
If nobody is using the testing kernel, this phase is pointless.

Switch this niche target to kernel 6.18 for testing.

Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23117
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 23:34:58 +02:00
Pawel Dembicki
39d55c93f8
qoriq: 6.18: refresh kernel config
Done by:
`make kernel_oldconfig`

Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23117
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 23:34:57 +02:00
Pawel Dembicki
c2d5f15611
kernel/qoriq: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.

For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html

Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23117
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 23:34:57 +02:00
Pawel Dembicki
94e16eabd7
kernel/qoriq: create files for v6.18 (from v6.12)
This is an automatically generated commit.

When doing `git bisect`, consider `git bisect --skip`.

Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23117
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 23:34:57 +02:00
Rosen Penev
d51fa9b28e
bcm53xx: enable 6.18 testing kernel
Enable the 6.18 testing kernel for BCM53XX.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23166
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 20:36:09 +02:00
Rosen Penev
9387d10b24
bcm53xx: refresh 6.18 patches
Refresh patches for 6.18.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23166
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 20:36:09 +02:00
Rosen Penev
456716b15f
bcm53xx: refresh 6.18 config
Add missing symbols for 6.18.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23166
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 20:36:09 +02:00
Rosen Penev
36546de92f
kernel/bcm53xx: restore files for v6.12
This is an automatically generated commit which aids following Kernel patch
history, as git will see the move and copy as a rename thus defeating the
purpose.

For the original discussion see:
https://lists.openwrt.org/pipermail/openwrt-devel/2023-October/041673.html

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23166
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 20:36:08 +02:00
Rosen Penev
32dc589c12
kernel/bcm53xx: create files for v6.18 (from v6.12)
This is an automatically generated commit.

When doing `git bisect`, consider `git bisect --skip`.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23166
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 20:36:08 +02:00
Jonas Jelonek
e4ed8e7fe7
realtek: add support for Ubiquiti UniFi USW Aggregation
Add support for the RTL9303-based Ubiquiti UniFi USW Aggregation, an
8-port 10G SFP+ aggregation switch.

Hardware
========

  - RTL9303 SoC
  - 256 MiB DDR
  - 16 MiB SPI-NOR flash
  - 8x 1G/10G SFP+ cages
  - Per-port LEDs: 1x white LED per SFP+ cage
  - Buttons: 1x Reset
  - Console: TTL 3.3V, 115200 8N1, internal unpopulated 4-hole THT
    footprint (the device must be opened to solder a header)
    - pinout (with the front panel facing you, left to right):
      VCC/unused, RX, TX, GND
  - Front touch display (see below)
  - Software chain:
    - U-Boot (Ubiquiti-flavoured)
    - UniFi OS (OpenWrt-based)

MAC address
===========

Single MAC address derived from the eeprom partition. Applied to all
switch ports.

Front touch display
===================

The unit has a touch-capable front display, driven by a dedicated
STM32-based MCU connected to the host via UART. The MCU runs Ubiquiti's
LCM firmware and exposes a high-level JSON protocol (page selection,
button-press events, etc.); arbitrary pixel-level control is not
possible without replacing the MCU firmware. The display is therefore
not supported beyond what the stock LCM firmware offers.

Disclaimer
==========

Stock uses a dual-bank layout (kernel0/kernel1, 7 MiB each). OpenWrt
replaces both banks with a single contiguous firmware partition.
Flashing OpenWrt overwrites both stock kernel slots; U-Boot remains
intact and can be used for recovery.

The stock firmware blob is RSA-signed and cannot be flashed via the
UniFi web UI. Installation has to be done from a root shell on the
running UniFi OS.

Installation
============

1. Enable SSH on the stock UniFi OS and log in as root.

2. Copy the OpenWrt sysupgrade image to /tmp on the switch (e.g. via
   scp).

3. Adjust IMG below to point at the copied file, then run the block as
   a whole. It writes kernel0, splits into kernel1 if the image is
   larger than that slot (otherwise invalidates kernel1 so U-Boot
   cannot pick a stale bank), and reboots:

   IMG=/tmp/openwrt-realtek-rtl930x-ubnt_usw-aggregation-squashfs-sysupgrade.bin
   K0_BLOCKS=$((0x710000 / 0x10000))

   dd if="$IMG" of=/dev/mtdblock2 bs=64k count=$K0_BLOCKS conv=fsync
   if [ "$(wc -c < "$IMG")" -gt $((0x710000)) ]; then
       dd if="$IMG" of=/dev/mtdblock3 bs=64k skip=$K0_BLOCKS conv=fsync
   else
       dd if=/dev/zero of=/dev/mtdblock3 bs=64k count=1 conv=fsync
   fi
   sync
   reboot

   The switch comes up in OpenWrt after reboot.

It does not matter which bank stock booted from when the dd block
runs: both banks are touched in the same pass (kernel0 written, kernel1
either written or invalidated). With kernel1 invalidated, U-Boot's
internal fallback kicks in and permanently switches to kernel0 on the
next boot, so the device stays on OpenWrt as long as kernel0 is
bootable.

Recovery
========

Since the installation procedure invalidates or partially overwrites
the second bank, recovery requires serial console access (see Hardware
above for pinout).

1. Interrupt U-Boot autoboot by spamming a key during early boot to
   drop into the U-Boot prompt.

2. Bring up networking:

   rtk network on

3. Transfer an OpenWrt initramfs image via TFTP and boot it:

   tftpboot 0x82000000 <server>:<initramfs.bin>
   bootm 0x82000000

4. From the running initramfs OpenWrt, re-run the installation
   procedure above (the dd block, with $IMG pointing at the image on
   /tmp).

Return to stock firmware
========================

There is no fully-supported revert path. The stock firmware blob is a
Ubiquiti UBNT archive (header + parts, see firmware-utils' fw.h) that
embeds a u-boot and a kernel0 uImage payload; only the latter is
relevant when writing back to the kernel partitions.

The snippet below extracts the kernel0 uImage from such a blob by
locating the uImage magic and using the size carried in the uImage
header itself, without parsing any UBNT framing. It is provided as a
best-effort starting point; verify the result before flashing,
otherwise you're on your own:

   BLOB=US.rtl930x_X.Y.Z.bin
   OFF=$(grep -aboF $'\x27\x05\x19\x56' "$BLOB" | head -1 | cut -d: -f1)
   SIZE=$(( $(dd if="$BLOB" bs=1 skip=$((OFF + 12)) count=4 2>/dev/null \
               | hexdump -e '1/4 "%u"') + 64 ))
   dd if="$BLOB" of=kernel0.uImage bs=1 skip="$OFF" count="$SIZE"

Once you have a clean uImage, write it to both kernel banks (since
the bootselect mechanism is not yet decoded, this guarantees U-Boot
picks the stock image regardless of bank):

   dd if=kernel0.uImage of=/dev/mtdblock2 bs=64k conv=fsync
   dd if=kernel0.uImage of=/dev/mtdblock3 bs=64k conv=fsync

Link: https://github.com/openwrt/openwrt/pull/23506
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 19:32:31 +02:00
dastarothx
903310097b
wifi-scripts: ucode: fix null dereference for 6GHz-only radios
he_phy_cap and he_mac_cap in phy_capabilities are only populated inside
the iftype_data loop. On 6GHz-only radios (e.g. QCN9074/ath11k_pci),
when capability bytes are unavailable they remain null, causing null
dereferences in device_htmode_append():

  Reference error: left-hand side expression is null
  if (!(he_phy_cap[3] & 0x80))

Initialise both to [] before the loop and guard the consumer side with
?? [] so bitwise checks conservatively disable beamformer/beamformee/twt
features rather than crashing.

Link: https://github.com/openwrt/openwrt/issues/23488
Signed-off-by: dastarothx <darkastalier@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23496
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2026-05-24 13:14:17 +02:00
Jack Sun
67a870c9c6 tools/cmake: update to 4.3.3
Release notes:https://cmake.org/cmake/help/latest/release/4.3.html

No need refresh patches

Signed-off-by: Jack Sun <sunjiazheng321521@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23482
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-24 10:23:41 +02:00
Til Kaiser
d33911c82d
generic: 6.18: add missing NET_SCH_BPF symbol
Add CONFIG_NET_SCH_BPF disabled.

NET_SCH_BPF depends on DEBUG_INFO_BTF.
When CONFIG_KERNEL_DEBUG_INFO_BTF is enabled, the symbol
becomes visible and Kconfig prompts for it because it is
missing from the generic 6.18 kernel config.

Signed-off-by: Til Kaiser <mail@tk154.de>
Link: https://github.com/openwrt/openwrt/pull/23498
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-24 10:12:13 +02:00
Hauke Mehrtens
49b5093679 github: LLM-review: run the digest twice a day
Change the schedule from once a day to twice a day (03:00 and 15:00
UTC) and raise the default max_prs from 16 to 24, so more open PRs
get covered now that the per-PR trigger has been removed.

Link: https://github.com/openwrt/openwrt/pull/23474
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-23 19:33:59 +02:00
Hauke Mehrtens
4871040d5d github: LLM-review: stop reviewing new PRs automatically
Drop the pull_request_target trigger so the LLM review no longer runs
on opened/reopened PRs. We are limited to 15 Claude routine runs per
day, and the automatic per-PR trigger exhausted that budget on
several days, starving the nightly digest.

The nightly schedule and manual workflow_dispatch triggers remain.

Link: https://github.com/openwrt/openwrt/pull/23474
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-23 19:33:59 +02:00
Hauke Mehrtens
b36309575a github: drop the claude-code-review workflow
Delete .github/workflows/claude-code-review.yml. It is superseded by
the LLM review action, which runs automatically and uses the Claude
routine API instead of the much more expensive Claude API.

Link: https://github.com/openwrt/openwrt/pull/23474
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-23 19:33:59 +02:00
Hauke Mehrtens
ffc0a6bc38 libubox: update to Git HEAD (2026-05-23)
19e88cc41288 json_script: use size_t for calloc_a() length argument
9afc71053481 udebug-remote: pass size_t to calloc_a()
73a21977c52a treewide: use size_t for length variables to avoid implicit narrowing
1fe93d2fefb2 blob, udebug-remote: silence -Wconversion warnings in trivial cases

Link: https://github.com/openwrt/openwrt/pull/23485
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-23 19:33:16 +02:00
Hauke Mehrtens
9d8f165c20 ubus: update to Git HEAD (2026-05-23)
4b274055ede3 libubus: fix NULL dereference on OOM in ubus_queue_msg
8b5be570f13e libubus-acl: fix dangling pointers on blob_memdup failure in acl_recv_cb
9105ea2a349a ubusd_acl: fix NULL dereference on OOM in ubusd_acl_alloc_obj
07d7f34ac278 ubusd_acl: handle allocation failures in ubusd_acl_init_client
497321a5ea90 ubusd_acl: fix NULL dereference on OOM in ubusd_acl_init
f66d52ba983f ubusd_event: fix OOM handling in ubusd_send_event_msg
11ea1b3bdbea ubusd_main: fix async-signal-unsafe SIGHUP handler
0c095592ccb7 ubusd_proto: fix resource leaks and ID tree corruption in ubusd_proto_new_client
f61695e6e12a ubusd_proto: fix NULL dereference for user/group in ubusd_handle_add_watch
7ecacfadd9bc ubusd_proto: fix NULL dereference on OOM in ubusd_proto_init_retmsg
3ab9d7759545 lua: fix inverted argument check in ubus_lua_add
43051ca73aec lua: fix unchecked calloc and memory leak in ubus_lua_load_object
4ca0b141e9a7 ubusd_id: use getrandom(2) unconditionally on Linux
7e4356da8abe ubusd_monitor: fix NULL dereference on OOM in ubusd_monitor_message
5849870f2251 libubus-req: fix file descriptor leaks in ubus_process_req_msg
f29767f90af1 libubus: fix file descriptor leaks in ubus_process_msg
b099d050b59d libubus: make ubus_shutdown idempotent
a564b8dcb395 ubusd_main: check strdup return value in mkdir_sockdir
239edcbaaac8 ubusd_id: fix continue in do-while skipping random ID retry
09d2df45bf38 ubusd: fix NULL dereference on OOM in ubus_msg_enqueue
bcc45ca981fd libubus: actually set FD_CLOEXEC on the ubus socket
8188f5ce8564 libubus-io: close recv_fd captured before get_next_msg failure
7a068bac5a9b libubus-io: byte-swap peer in HELLO when storing as local_id
747013f6ea05 libubus-io: reset sock.fd to -1 after close on ubus_reconnect error path
020a64b9b169 ubusd_acl: use size_t for strlen result in ubusd_acl_alloc_obj
f92ffd289dcc ubusd: use size_t for string and blob length variables
795b32bb96b6 ubusd: use fixed-width types for sequence counters

Link: https://github.com/openwrt/openwrt/pull/23487
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-23 19:32:01 +02:00
Andrew LaMarche
185bbf1168
octeon: drop v6.12 and default to v6.18
Switch the Octeon target to kernel v6.18 and drop v6.12.

Signed-off-by: Andrew LaMarche <andrewjlamarche@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23144
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-23 19:13:22 +02:00
Dee HY
9336332964 kernel: add kmod-hwmon-corsair-cpro
This module adds support for the Corsair Commander Pro and Corsair
Commander Pro (1000D) fan and temperature monitoring controllers.

Signed-off-by: Dee HY <dongfengweixiao@hotmail.com>
Link: https://github.com/openwrt/openwrt/pull/23465
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-23 18:45:20 +02:00
Lech Perczak
b9cbc0846a ath79: meraki-mr18: fix MAC address offset after NVMEM switch
The following commit: 27a673916c ("ath79: mr18: use nvmem for MACs")
switched MR18 to use NVMEM subsystem for setting MAC addresses, however
it missed the offset in use. Previously 102 (decimal) was used, but in
device tree 0x102 was used, but the correct value is 0x66.

This was found while reviewing code for Z1 port, which shares the MAC
address source.
Replace the offset with the correct one of 0x66.

Fixes: 27a673916c ("ath79: mr18: use nvmem for MACs")
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23486
Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-23 18:42:22 +02:00
Robert Marko
417df7debf fstools: update to Git HEAD (2026-05-23)
7df188543e26 libfstools: enable f2fs overlay compression formatting
16718b6e3c0f libfstools: mount f2fs overlay with zstd compression

Signed-off-by: Robert Marko <robimarko@gmail.com>
2026-05-23 18:25:00 +02:00
Jan-Henrik Bruhn
7a5eefe108
kernel: hwmon lm63: make pwm1 frequency and LUT temp hysteresis writeable
This adds a patch that makes the pwm1 frequency and LUT temperature
hysteresis of lm63 fan controllers writeable, to be able to replicate
vendor cooling behaviour for fans that need a lower PWM frequency
than the default.

Signed-off-by: Jan-Henrik Bruhn <git@jhbruhn.de>
Link: https://github.com/openwrt/openwrt/pull/23473
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-23 17:38:38 +02:00
Jan Hoffmann
b20068672b
kernel: realtek: replace RTL8226 MDI swap patch by upstream version
A version of this patch has been accepted upstream, so use it here.

Link: https://lore.kernel.org/netdev/177932162564.3801238.2549776951847746974.git-patchwork-notify@kernel.org/
Signed-off-by: Jan Hoffmann <jan@3e8.eu>
Link: https://github.com/openwrt/openwrt/pull/23493
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-23 17:25:59 +02:00
Keno Fischer
9a143bf7ff
x86: onie-installer: wire up sysupgrade via ONIE install mode
This adds support for sysupgrade on ONIE-installed systems.
The install is chained through ONIE (using the ONIE installer image),
rather than attempting to manually upgrade the partition.
The idea is to allow future OpenWRT installs flexibility to use
a different partition table. By putting the installer in charge
of setting up the file system partition, the upgrade process needs
to have no knowledge of the internals of the image.

Config preservation is accomplished by appending the sysupgrade .tar.gz
to the ONIE installer image. Of course this also works for a clean
install using a sysupgrade.tar.gz created via `sysupgrade -b`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Keno Fischer <keno@juliahub.com>
Link: https://github.com/openwrt/openwrt/pull/23062
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-23 17:23:54 +02:00
Keno Fischer
c7e8cffcb2
x86: add onie-installer image type
The current documentation for using OpenWRT on Mellanox Spectrum
switches (https://openwrt.org/toh/mellanox/spectrum) suggests
reflashing the entire harddrive from the recovery USB. This is not
the most friendly way to install a new OS on these switches. From
factory, they come with ONIE (Open Network Install Environment),
which is a linux-based preboot environment for fetching an OS
image from the network and installing it on disk. The installer
is a self-executing bash script that executes inside the ONIE
environment. The installer is expected to preserve the ONIE partition
for use as recovery environement. To be a better citizen on
these platforms, it would be preferrable to provide OpenWRT as
an ONIE-compatible installer.

This PR adds an ONIE_INSTALLER_IMAGES build option that produces
an ONIE compatible .bin. The generated .bin follows the ONIE demo
installer pattern [1]: it creates a new GPT partition
labelled OPENWRT-ROOT on the ONIE install device, formats ext4, extracts
the OpenWrt rootfs and kernel into it, installs GRUB into the existing
UEFI ESP under bootloader-id "OpenWrt", and adds a NVRAM boot entry via
efibootmgr.  ONIE-BOOT is preserved so ONIE rescue remains available.

Tested with the config at [2] on a Mellanox Spectrum SN3800 to produce
a booting OpenWRT install.

[1] https://github.com/opencomputeproject/onie/demo/installer/grub-arch/install.sh
[2] https://gist.github.com/Keno/abc8c5b72645e73fadd1ff0d9616b23d

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: Keno Fischer <keno@juliahub.com>
Link: https://github.com/openwrt/openwrt/pull/23062
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-23 17:23:53 +02:00
Jonas Jelonek
15593de376
realtek: pcs: derive SerDes link count from DT at probe time
Previously, sds->num_of_links was incremented from rtpcs_create() as
each DSA port bound its phylink_pcs. The count therefore relied on a
temporal contract (DSA must finish enumerating before pcs_config runs)
and on rtpcs_create() being the single chokepoint for all consumers.

Replace this with a probe-time scan of pcs-handle references in the
live OF tree: for every available consumer node carrying a pcs-handle
property pointing at one of our SerDes subnodes, bump that SerDes'
num_of_links. After the scan, the count is final regardless of when
or whether DSA later calls in.

To allow of_parse_phandle_with_args() to walk the property correctly,
add #pcs-cells = <0> to every serdes@N node in the 838x/839x/930x/931x
.dtsi files. A future cell-bearing form remains possible without
touching the scan.

Over-references (DT pointing more consumers at one SerDes than the
hardware can carry) are clamped at RTPCS_MAX_LINKS_PER_SDS and warned
about, but do not fail probe — the correctly-wired ports on that
SerDes still come up, and only the surplus reference is dropped.

The bounds check and the bare ++ in rtpcs_create() become redundant
under the scan-driven count and are removed.

This decouples num_of_links from DSA call ordering and is a prereq
for migrating to fwnode_pcs providers, where rtpcs_create() goes away
as the centralised counter.

Link: https://github.com/openwrt/openwrt/pull/23484
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
2026-05-23 11:02:15 +02:00
Hauke Mehrtens
a7bd3b147e uhttpd: update to Git HEAD (2026-05-21)
1b624f8f814e auth: classify $p$ lookups by account state

Link: https://github.com/openwrt/openwrt/pull/23476
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
2026-05-23 01:52:39 +02:00
Daniel Golle
f2aa412733 rtl826x-firmware: depend on kmod-phy-realtek
Follow the established pattern and let the firmware package select
the driver which uses it.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2026-05-22 20:53:04 +01:00
Felix Fietkau
74da669505 umdns: update to Git HEAD (2026-05-22)
bd7599d02157 fix calloc_a size argument type

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-22 14:56:09 +02:00
Felix Fietkau
4136443864 unetd: update to Git HEAD (2026-05-22)
090abf9a5521 host: fix type mismatch on calloc_a calls

Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-22 14:54:34 +02:00
Felix Fietkau
e7530a287a build: fix apk_package_files wildcard for packages without ABI version
The wildcard combined an apk_package_files pattern of $(pkg)-*.apk with a
gen_package_wildcard that ends in [^a-z]*, so the full glob required two
dashes. Files for packages without an ABI version (e.g. ubbf-0~....apk)
only contain one dash and never matched, so ipkg-remove was never called
on them and stale .apk files accumulated in the bin directory.

Drop the explicit dash from apk_package_files. The [^a-z] in
gen_package_wildcard already serves as the dash matcher, and
scripts/ipkg-remove filters precisely by reading apk metadata.

Fixes: 642d568b0f ("build: fix ipkg-remove: add support for removing apk files")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-22 14:54:34 +02:00
John Crispin
0c2fb39c5a wifi-scripts: iwinfo scan() must not abort the interpreter on failure
Replace exit(1) on every failure path with return null so callers that
iterate over multiple radios can collect results from the radios that
did succeed instead of aborting on the first one that refuses an
off-channel scan.

Route diagnostics to stderr via warn() so stdout stays clean for
callers parsing JSON output, and include the device name in each
message to disambiguate per-radio failures.

Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2026-05-22 14:54:34 +02:00
John Crispin
cb7414055c wifi-scripts: iwinfo: guard assoclist against unknown device
Signed-off-by: John Crispin <john@phrozen.org>
2026-05-22 14:54:34 +02:00
Robert Marko
920a382cb6 fstools: update to Git HEAD (2026-03-17)
1bf2d490484e libfstools: make get_var_from_file() reusable
0b6022439cad mount_root: add kernel parameter to specify the overlay storage name
e600d842ce81 mount_root: add kernel parameter to specify the overlay fileystem type

Signed-off-by: Robert Marko <robert.marko@sartura.hr>
2026-05-22 13:10:42 +02:00
Christian Marangi
5b25d4235d
airoha: backport GDM2 loopback fixup for Ethernet driver
Backport GDM2 loopback fixup for Ethernet driver. This should be the last
patch before introduction of Multi-Serdes support series.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
2026-05-22 12:43:00 +02:00
Shiji Yang
de769c6d66 uboot-mediatek: fix malformed patch
The chunk length is not correct.

Fixes: d2fabb974c ("mediatek: add support for Wavlink WL-WNT100X3 ubootmod")
Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
2026-05-22 01:47:47 +01:00