Testing shows that the existing performance boost by aligning the data
to 2 bytes (NET_IP_ALIGN) breaks fragment handling on RTL838x devices. The
SoC silently drops 2 bytes between each fragment. Use this tricky alignment
only when it is supported. This will bring down performance on RTL838x SoCs
by 30%. All other SoCs are unaffected. This is a legitimate tradeoff for
allowing multiple fragments. While we are here make clearer what the
definies are about and rename them to a SKB_ prefix.
Link: https://github.com/openwrt/openwrt/pull/24245
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Add a helper to simplify SKB freeing and rx counter handling. If SKB
is given, it is freed and the pointer is set to zero. The return value
is the number of freed SKBs (0/1). With this the existing cleanup and
error handling can be simplified like
dev->stats.tx_errors += rteth_free_skb(&packet->skb);
Link: https://github.com/openwrt/openwrt/pull/24245
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Free the per-port segment strings on unregister to avoid leaking them
across device rebind. Drop the dead (phys < 0) check and guard the
kstrdup allocation against failure.
Move swconfig_create_led_trigger() before list_add_tail() in
register_switch so a failing registration never publishes the device on
the global swdevs list with dangling portmap/portbuf pointers (a
use-after-free for any swdevs iterator). Route both the LED trigger
failure and the -ENFILE (swdev id exhaustion) failure paths through a
shared cleanup that frees portbuf, portmap, and the per-port segment
strings instead of leaking them.
Reorder the frees in unregister_switch to run after list_del so the
buffers are not freed while the device is still reachable from swdevs.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24246
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Upstream has marked it as BROKEN. Quote:
This driver is harmful:
- It is much slower than the CPU.
- It Has a history of bugs.
- It does not have exclusive access to the hardware, causing races
with the secure world.
- It register its implementations with too low a cra_priority for them
to be actually used.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24326
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The nvmem cell for the MT7663 (5 GHz) radio was too small. The MT7663 EEPROM at
offset 0x8000 requires the full MT7615_EEPROM_FULL_SIZE (0x4da8), but the cell
only declared 0x200 bytes.
The driver always requests the full buffer, also for the MT7663, so the undersized
cell makes the nvmem read fail with -EINVAL. The driver then falls back to default
values, which limits TX power to 3 dBm.
Fix this by enlarging the cell to 0x4da8. The offset 0x8000 was already correct —
offset 0x0 holds the MT7628 (2.4 GHz) calibration data.
Fixes: #23632
Signed-off-by: Frank Lang <Frank_Lang@outlook.de>
Link: https://github.com/openwrt/openwrt/pull/24284
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The eth0 assignment never takes effect. 05_set_preinit_iface brings eth0
up in its default case before 10_fix_eth_mac.sh runs, and the kernel
refuses a MAC change on a running interface, so ip link fails with EBUSY.
This script cannot run any earlier either, since it needs /tmp/tp_data
mounted by 09_mount_cfg_part.
Nothing is lost by dropping it: the DSA user ports carry their own
addresses, which the lan1-3 assignments below already take care of, and
br-lan takes its address from them.
Verified on a BE450 running an image built from main: eth0 comes up with
a different random address on every boot regardless of this line, while
lan1-3 and br-lan keep the label MAC across reboots even with no macaddr
in /etc/config/network.
Fixes: 1513da34bb ("mediatek: filogic: set eth0 and LAN port MACs on TP-Link BE450")
Signed-off-by: Semih Baskan <strst.gs@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24325
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The label-mac-device alias cannot work on this device: it is resolved
by reading the mac-address property of the aliased DT node, but gmac0
never has one. The MAC is stored in a file inside the tp_data UBIFS
volume, so there is no fixed flash offset an nvmem-layout could point
at, and the vendor bootloader does not fix up the FDT either. Drop the
dead alias.
Record the label MAC in board.d instead and assign it to the lan
interface, as is already done for the other devices reading
/tmp/tp_data/default-mac (Mercusys MR90X v1, Archer AX80 v1,
RE6000XD). The explicit lan MAC also makes the br-lan address
independent of the order of the bridge ports.
Suggested-by: Felix Baumann <felix.bau@gmx.de>
Signed-off-by: Semih Baskan <strst.gs@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24180
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
eth0 (gmac0) is declared label-mac-device, but nothing assigns its MAC,
so it and the DSA lan ports come up with a random locally administered
address that changes every boot. Assign the base MAC from tp_data
default-mac to eth0 and the lan ports, as is already done for eth1 and
eth2.
Each lan port needs its own assignment: a DSA user port copies the
conduit's MAC once when it is created, at driver probe before preinit
runs, and ignores later changes to eth0.
Run-tested on a BE450 on 25.12.5, where the case is identical.
Two boots without the fix each came up with a different
random address; with the fix applied, eth0 and the lan ports get the
label MAC and keep it across reboots.
Signed-off-by: Semih Baskan <strst.gs@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24180
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
For LEDs that have no network trigger configuration in Device Tree
(no mode or family properties), net_activate() infers the family
from the LED name or function string. If that inference fails,
the trigger previously returned -EINVAL and refused to activate.
This is too strict for manual activation via sysfs (e.g.
echo "network" > /sys/class/leds/<led>/trigger) on LEDs that
were not declared for the network trigger in DT. In that case
the user expects the trigger to load with sensible defaults.
Change the non-DT activation path to fall back to NET_TRIG_WLAN
instead of failing, while keeping the condition visible via pr_warn().
Device Tree paths with dt_mode or dt_family are left unchanged
and continue to fail on invalid parameters
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/24235
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
fe_poll_rx() takes the packet length directly from the RX descriptor and
passes it to skb_put() without checking that it fits in the allocated
buffer. A malformed or stale descriptor can therefore extend the skb
beyond its tailroom and corrupt memory.
Reject lengths larger than skb_tailroom(), account the packet in
rx_length_errors and rx_dropped, free the affected skb, and continue by
installing the replacement descriptor.
Signed-off-by: Nickolay Savchenko <n.savchenko@axioma.lv>
Link: https://github.com/openwrt/openwrt/pull/24268
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
fe_txd_unmap() uses dma_len0 and dma_len1 to decide whether each TX
mapping must be passed to dma_unmap_page(). After unmapping, however,
the code passed the dma_addr0 and dma_addr1 field identifiers to
dma_unmap_len_set().
This leaves the actual length fields unchanged. A reused descriptor
slot can therefore retain a non-zero length and attempt to unmap an old
DMA mapping again.
Clear dma_len0 and dma_len1 after the mappings have been released.
Signed-off-by: Nickolay Savchenko <n.savchenko@axioma.lv>
Link: https://github.com/openwrt/openwrt/pull/24268
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The return value of device_get_match_data was still explicitly casted to
the driver-internal type. However, since this function returns 'const
void *' and in C void pointers are automatically casted, this isn't
needed. Thus, drop it.
Link: https://github.com/openwrt/openwrt/pull/24310
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
For 10GBase-R and 2500Base-X, the patching sequences for the slower
modes are also applied. This mirrors the SDK which uses some automatic
detection and only does a one-time initialization. However, Linux works
different. The PCS is configured to a specific mode on demand. Thus,
there is no need to apply the other patching when it isn't really
needed.
Those patching sequences seem to initialize AFE blocks within the
SerDes, thus a 1G AFE shouldn't be needed for 10GBase-R. Testing
confirms this so far, no difference in any link characteristics when
e.g. 1G and 2.5G sequences aren't applied for a 10GBase-R link.
Link: https://github.com/openwrt/openwrt/pull/24310
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
So far, the 10GBase-R configuration mirrored the SDK which in addition
also sets up 1000Base-X and lets it run in a special mode having
autodetection of 10G/1G. This doesn't make that much sense given that
Linux will trigger PCS reconfiguration once the interface mode has
changed. Thus, we should only provide that for each mode standalone, not
for some proprietary and special mixed auto mode.
Link: https://github.com/openwrt/openwrt/pull/24310
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The mode configuration calls LEQ/DFE reset and RX reset before doing
USXGMII configuration. Though the SDK does that similar, these calls are
actually unneeded because essentially the same is executed later again
in the attachment configuration. This is also the place where it
rather belongs. Thus, drop those calls in mode configuration.
Link: https://github.com/openwrt/openwrt/pull/24310
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Drop the unused helper rtpcs_931x_sds_reset because it is unused and -
if it was used - would actively mess with the defined SerDes
deactivation/activation in pcs_config.
Link: https://github.com/openwrt/openwrt/pull/24310
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Commit 7899dfa6ef ("realtek: pcs: rtl931x: separate and reuse
1000base-x config") introduced an issue by accident, using the register
value 0x12 instead of 0x13. A regression hasn't been noticed before, for
yet unknown reasons the 1000Base-X still worked here and there. Probably
due to some external setup.
However, this currently breaks 1000Base-X functionality on at least one
switch. Correcting the register value instantly restores 1000Base-X,
allowing the link to come up. It is unclear yet what this field means,
according to the SerDes register defines from related RTL8295 this might
be TX mode configuration field.
Also add another write which is present in several SDK versions.
Referring from related RTL8295, this might be a field called
EN_LINK_FIB1G, enabling 1000Base-X operation.
Fixes: 7899dfa6ef ("realtek: pcs: rtl931x: separate and reuse 1000base-x config")
Link: https://github.com/openwrt/openwrt/pull/24310
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The two packages rtl826x-firmware and rtl826x-lp-firmware are built
from the same source, yet have 'VERSION=xxx' overrides that modify
the package name and metadata. This causes issues with apk, as
it always selects the package with the higher version number (the
'-lp-' one), irrespective of which package is desired.
Remove the VERSION overrides and use the actual package version so
that apk can install the correct package. The binary contents of
the packages remain unaffect, this only changes the package file
name and metadata related to versioning.
Before
rtl826x-firmware-20221115.apk
rtl826x-lp-firmware-20240729.apk
After
rtl826x-firmware-2026.01.24~0cd4abe2-r4.apk
rtl826x-lp-firmware-2026.01.24~0cd4abe2-r4.apk
Fixes: https://github.com/openwrt/openwrt/issues/24145
Signed-off-by: Eric Fahlgren <ericfahlgren@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24201
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Scripts need the map type to know how to interact with a map, e.g.
per-CPU value handling or keyless queue/stack semantics. Add an
info() map method returning type, key/value size and max_entries,
along with BPF_MAP_TYPE constants for comparison.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Add consumer support for BPF_MAP_TYPE_RINGBUF and
BPF_MAP_TYPE_PERF_EVENT_ARRAY maps. ringbuf(callback) and
perf_buffer(callback, pages, lost_callback) map methods return a
buffer resource with fileno, poll and consume methods. The fileno
method exposes the epoll fd and matches the interface uloop.handle()
expects, so a buffer can be passed directly to uloop for event loop
integration.
The ring buffer callback receives the sample data and may return a
negative integer to stop consumption; the perf callbacks additionally
receive the CPU number.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Updates on array/hash-of-maps and prog array maps take the fd of the
inner object as a 4-byte value. Accept bpf.map and bpf.program
resources as map values and convert them to their fd.
Lookups on map-in-map types return the inner map id; add open_map_id
and open_program_id to obtain a usable object from such an id.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Queue and stack maps have zero-sized keys and require a NULL key
pointer; the kernel rejects any non-NULL key with EINVAL, making
these maps unusable. Accept a null key argument on maps without a
key, mapping get() to peek, set() to push and delete() with return
to pop.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Lookup, update and lookup-and-delete on per-CPU maps use buffers of
roundup(value_size, 8) * num_possible_cpus bytes. The previous code
sized buffers for a single value, so get() on a per-CPU map made the
kernel overflow the stack buffer and set() passed undersized data.
Track the map type and size the buffers accordingly. get() and
delete() with return now yield an array with one value per CPU, set()
accepts either such an array or a single value replicated to all
CPUs.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Failures in the detach path returned NULL without recording any error
state, so error() reported a stale or empty error. Attach failures
reported a hardcoded ENOENT regardless of the actual cause. Record
errno for all failures; if_nametoindex, bpf_tc_attach and
bpf_tc_detach all set it.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
bpf_object__next_map does not set errno when it runs out of maps, so
the reported error code was whatever errno happened to hold. With
errno 0 the failure was invisible to error(). Report ENOENT instead.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
The iterator key buffer is a flexible array member placed directly
after a bool, leaving it without natural alignment for the u32/u64
loads in next_int. Copy the key via memcpy instead of dereferencing
a misaligned pointer, which traps on strict-alignment targets.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
uc_bpf_map_arg converted integer arguments through a single static
buffer. When map set was called with both an integer key and an integer
value, the second conversion overwrote the first, so the element was
written at the wrong key. Convert into a caller-provided buffer
instead.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
uc_fn_thisval can return NULL when a method is called with a foreign or
missing this context. pin, foreach and the iterator next functions
dereferenced the result without checking it, crashing the VM.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Firmware image signing in append-metadata/append-gl-metadata was conditional
only by the presence of the build key. Add an explicit SIGN_FIRMWARE option
(default enabled except with BUILDBOT) so appending the fwtool signature can be
toggled on its own.
It's disable on buildbot since we use a decentralized building with no
individual keys on builders. Instead, a fake key is currently used, which adds
an insecure signature.
The future of signing firmware and key distribution across the build
infrastructure should be discussed separately.
Link: https://github.com/openwrt/openwrt/pull/24291
Signed-off-by: Paul Spooren <mail@aparcar.org>
Add support for the Comfast CF-EW84 based on the MediaTek MT7621
SoC.
Hardware:
CPU/SoC: MediaTek MT7621DA
RAM: 128 MB DDR3
Flash: Macronix MX25L12805D 16 MB
Switch: MediaTek MT7530
WiFi 2.4 GHz: MediaTek MT7603E
WiFi 5 GHz: MediaTek MT7613B
Ports: 1x WAN, 2x LAN (10/100/1000 Mbps)
LEDs: Power, WAN, LAN1, LAN2, WLAN
Buttons: Reset
UART: through-hole on PCB
pinout: RX, TX, GND, 3.3V
settings: 115200n8
Flash instructions:
1. Connect the bundled PoE injector to power.
2. Connect the PC to the LAN1 or LAN2 port of the device.
3. Configure a static IP on the computer's Ethernet adapter:
IP: 192.168.1.x (x = 2 to 254)
Mask: 255.255.255.0
Gateway: empty
DNS: empty
4. Connect a second Ethernet cable to the PoE port of the
bundled injector.
5. Press and hold the reset button on the device.
6. While holding the reset button, plug the other end of the
second Ethernet cable into the WAN port.
7. Wait at least 3 seconds, then release the reset button.
8. Browse to http://192.168.1.1: the MediaTek U-Boot System
Recovery page should appear.
9. Click Upload and select the *-sysupgrade.bin firmware file.
10. After flashing completes, browse to http://192.168.1.1
again: the LuCI login page should appear.
Factory data:
2.4 GHz EEPROM: factory offset 0x0000
5 GHz EEPROM: factory offset 0x8000
LAN MAC address: factory offset 0xe000
WAN MAC address: factory offset 0xe000 (+1)
LED layout:
The Comfast CF-EW84 has five physical LEDs, but only the WLAN
LED is software-controllable through the Linux GPIO-LEDs
subsystem.
Signed-off-by: Vincenzo Suraci <vincenzo.suraci@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24112
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The GS1900-10HP B1 keeps the RTL8380M SoC and port layout but replaces the
A1's Broadcom PoE (Gen1) with a Realtek RTL8238 PSE fronted by a Nuvoton
MCU speaking the Gen2 protocol at 115200 baud. It reuses the shared
rtl8380_zyxel_gs1900-10hp.dtsi and only overrides the PSE compatible and
UART speed.
Specifications:
- SoC: Realtek RTL8380M
- Ports: 8x 10/100/1000 (PoE+), 2x SFP
- PoE: Realtek RTL8238 via Nuvoton MCU (Gen2, UART 115200)
Tested on hardware: driver probes RTL8238B (8 ports), per-port control via
ethtool, verified across a cold power-cycle.
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Link: https://github.com/openwrt/openwrt/pull/24283
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The GS1900-10HP A1 (Broadcom BCM59121 behind a Gen1 MCU on UART) was
driven by the userspace realtek-poe daemon. Move it to the in-kernel
realtek-pse-mcu (Gen1) driver so PoE is managed through the standard
PSE-PD / ethtool interface, and factor the board description shared with
the upcoming B1 variant into rtl8380_zyxel_gs1900-10hp.dtsi.
Signed-off-by: Carlo Szelinsky <github@szelinsky.de>
Link: https://github.com/openwrt/openwrt/pull/24283
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
The RTL839x has the following hard-coded bus topology:
- Bus 0: Port 0-23
- Bus 1: Port 24-51
So the bus number and the PHY address in the dts are mostly
ignored. Nevertheless fix the assignment for the Zyxel GS1920.
This does not change the functionality it just describes the
hardware correctly. While we are here add the PHY package
description too.
Link: https://github.com/openwrt/openwrt/pull/24281
Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
Remove the .github/workflows/labeler.yml workflow and enable the "enable_labeler_yml" option in .github/formalities.json to let the webhook bot handle pull request labeling. This avoids running on GitHub Actions, so it is faster and uses fewer resources.
It uses the existing .github/labeler.yml for labels.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24256
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
This commit migrates the repository validation to a webhook-based bot instead of the GitHub Actions workflow (.github/workflows/formal.yml).
Since the bot handles stable branch labeling automatically (via the "branch_labeling: true" configuration option), the redundant branch check and labeling steps are removed from .github/workflows/labeler.yml.
The following configuration choices are applied in formalities.json:
- check_space_after_assignment: false (Disabled temporarily to catch any issues since it is a newly implemented check)
- check_makefile_indentation: false (Disabled temporarily to catch any issues since it is a new feature)
- check_patch_headers: 'warning' (Changed to warning instead of hard error since many legacy patches lack headers)
- enable_stale_bot: false (Disabled for now)
Other configurations can be adjusted in formalities.json based on the openwrt-bot-worker repository [1].
[1] https://github.com/openwrt/openwrt-bot-worker
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24256
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
This commit adds initial support for Nokia XG-040G-MF XG-PON ONU.
Specification
-------------
- SoC : Airoha AN7583DT (dual-core ARM Cortex-A53 1.2 GHz)
- RAM : 512 MiB DDR4 (Winbond W664GG6RB-06)
- Flash : SPI-NAND 256 MiB (GigaDevice GD5F2GM7UEYIG)
- WLAN : -
- Ethernet : 1x 2500 Mbps (LAN1, Airoha EN8811HN)
3x 10/100/1000 Mbps (LAN2-LAN4, Airoha AN7583 SoC switch)
- XG-PON : ECONET EN7572, SLIC: MaxLinear PEF32001VSV12
- USB : 1x USB2 (with power control via gpio)
1x USB3 (with power control via gpio)
- Buttons : Reset
- LEDs : 1x Power (green)
1x WAN (green)
1x WAN (red)
4x LAN (green)
2x USB (green)
- Power : 12 VDC, 1 A
Unsupported functions, limitations and known issues
---------------------------------------------------
1. XG-PON won't be available after installing OpenWrt.
2. USB ports: AN7583 SoC in OpenWrt doesn't support USB at this time.
Installation (UART)
-------------------
1. Attach UART and run picocom:
picocom -b 115200 --send-cmd "sb -vv" /dev/ttyUSB0
2. Interrupt boot process by pressing Enter key to enter u-boot
Username: telecomadmin
Password: nE7jA%5m
3. Start download firmware via ymodem protocol (via UART):
loady 0x85000000
4. Press Ctrl + A then Ctrl + S in the picocom terminal (if you are using
a different terminal, please refer to the documentation) to start
upload OpenWrt initramfs image using ymodem protocol. Enter local path
to the OpenWrt initramfs image and press Enter.
5. Load OpenWrt initramfs image from the memory:
bootm 0x85000000
5. Sysupgrade with OpenWrt sysupgrade image
Alternative for the p.3-4. Load and boot OpenWrt initramfs from tftp IP
192.168.1.254:
tftpboot 0x85000000 192.168.1.254:openwrt-initramfs-uImage.itb
bootm 0x85000000
Backup and installation (without UART)
--------------------------------------
1. Unplug Fiber
2. Make ONU Reset
3. Navigate: http://192.168.1.1
Username: CMCCAdmin
Password: aDm8H%MdA
4. Go to Apps -> Home Storage -> FTP and check Enable FTP
5. Go to Apps -> Home Storage -> SAMBA Sharing and check Enable Samba
6. Visit the following URL to open Telnet:
http://192.168.1.1/system.cgi?telnet
7. Telnet account login:
Username: user
Password: <see ONU label>
8. Get root privileges:
su user_ftp
Password: <see ONU label>
9. Copy 'squashfs-factory-kernel.bin', 'squashfs-factory-rootfs.bin' and
'OpenWrt.mtd2.u-boot-env.bin' (backup of 'u-boot-env' partition from
the another Nokia XG-040G-MF with OpenWrt installed)
9. Attach USB flash drive and check the new dir in /mnt:
ls /mnt
10. Change current dir to the flash drive (change D to your flash drive
label):
cd /mnt/D
11. Make backup:
for i in 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16; \
do cat /dev/mtd$i | gzip -9 > mtd$i.bin.gz; done
12. Check image sizes:
ls -l | awk '{if(NR>1) {$5=sprintf("0x%x", $5); print}}'
13. Write images:
mtd_debug erase /dev/mtd0 0x60000 0x20000
mtd_debug write /dev/mtd0 0x60000 0x20000 OpenWrt.mtd2.u-boot-env.bin
mtd_debug erase /dev/mtd14 0x0 0x2880000
mtd_debug write /dev/mtd14 0x0 0x3e6cfc squashfs-factory-kernel.bin
mtd_debug erase /dev/mtd11 0x0 0x80e0000
mtd_debug write /dev/mtd11 0x0 0x440000 squashfs-factory-rootfs.bin
0x3e6cfc - size of your 'squashfs-factory-kernel.bin'
0x440000 - size of your 'squashfs-factory-rootfs.bin'
14. Reboot:
reboot
Recovery
--------
The same as described in Installation (UART).
Return to stock
---------------
1. Follow the steps 1-5 of the Installation (UART)
2. Once in OpenWrt upload you backup to the /tmp dir of the router:
scp -O mtd16.bin.gz root@192.168.1.1:/tmp
5. Connect to the router using ssh and install kmod-mtd-rw:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
6. Unlock bootloader:
mtd unlock bootloader
7. Restore stock:
zcat /tmp/mtd16.bin.gz | mtd write - all_flash
8. Reboot:
reboot
Stock layout
------------
+-------+------------+---------+---------+
| mtd | label | start | size |
+-------+------------+---------+---------+
| mtd0 | bootloader | 0 | 80000 |
| mtd1 | romfile | 80000 | 40000 |
| mtd14 | nsb_master | c0000 | 2880000 |
| mtd15 | nsb_slave | 2940000 | 2880000 |
| mtd6 | bosa | 51c0000 | 40000 |
| mtd7 | ri | 5200000 | 40000 |
| mtd8 | flag | 5240000 | 40000 |
| mtd9 | flagback | 5280000 | 40000 |
| mtd10 | config | 52c0000 | a00000 |
| mtd11 | data | 5cc0000 | 80e0000 |
| mtd12 | oopsfs | dda0000 | 400000 |
| mtd13 | log | e1a0000 | a00000 |
+-------+------------+---------+---------+
UART
----
A view from the back side of the PCB:
------------------------
| GND RX TX
| X X X
Connection parameters:
115200, 8N1, 3.3V
MAC addresses
-------------
+---------+-------------------+-----------+
| | MAC | Algorithm |
+---------+-------------------+-----------+
| LAN | e0:xx:xx:xx:xx:a0 | label |
| WAN | e0:xx:xx:xx:xx:a1 | label + 1 |
+---------+-------------------+-----------+
The LAN MAC (hex) was found in 'ri', 0x3e
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23809
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Move shared DTS properties for Nokia XG-040G-MD and XG-040G-MF into
common DTSI files to reduce duplication:
- an758x-nokia_xg-040g-common.dtsi
- an758x-nokia_xg-040g-stock-parts.dtsi
- an758x-nokia_xg-040g-ubi-parts.dtsi
Signed-off-by: Mikhail Zhilkin <csharper2005@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23809
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Markus Stockhausen