When rebuilding the package, iucode_tool fails with a "File exists"
error if the directory already contained firmware from the previous
build (incl. in the successful build case).
Fix this by removing the directory before invoking iucode_tool.
Fixes the following build error:
iucode_tool: 06-0f-02: cannot write to, or create file: File exists
make[2]: *** [Makefile:57: .../.built] Error 2
Signed-off-by: Rany Hany <rany_hany@riseup.net>
Link: https://github.com/openwrt/openwrt/pull/24077
Signed-off-by: Robert Marko <robimarko@gmail.com>
Cherry pick the patches recommended in the hostapd security advisory
2026-1:
https://w1.fi/security/2026-1/missing-ml-parsing-validation.txt
Vulnerability
Vulnerabilities in parsing and use of received multi-link (MLO/EHT/IEEE
802.11be/Wi-Fi 7) information has been identified in hostapd and
wpa_supplicant. These issues show up in various cases where frames
including information on affiliated links are parsed and processed in
both AP and STA modes. The issues can result in process termination due
to buffer read overflow checks and memory corruption.
The issues for AP mode (hostapd or wpa_supplicant) can result in
denial-of-service attacks due to process termination and small memory
corruption that could theoretically cause other issues, but it does not
seem likely that those could be exploiting in practice. Affected areas
can be reached by sending invalid Management frames without needing
authentication or user action on the target device.
CVE-2026-58374
Link: https://github.com/openwrt/openwrt/pull/24043
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
USB VBUS on the BT-R320 is controlled by GPIO14.
Add a fixed regulator and hook it up to the xHCI controller.
GPIO_ACTIVE_HIGH was tested on the device: the dummy regulator warning is gone and a USB device enumerates.
Signed-off-by: solodecode <zikwarface134@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24063
Signed-off-by: Robert Marko <robimarko@gmail.com>
The initramfs image name already contains "-initramfs". Using "-initramfs-recovery.itb" as the suffix makes the BT-R320 recovery artifact contain it twice.
Use "-recovery.itb" instead.
Fixes: a3105d3f95 ("mediatek: filogic: add support for Globitel BT-R320")
Signed-off-by: solodecode <zikwarface134@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24059
Signed-off-by: Robert Marko <robimarko@gmail.com>
Commit 6f30f08d0e ("dnsmasq: add fallback for default dhcpv4/dhcpv6
values") changed dnsmasq.init to default the 'dhcpv4'/'dhcpv6' UCI
options to 'disabled' when a 'config dhcp' section leaves them unset:
- config_get dhcpv4 "$cfg" dhcpv4
- config_get dhcpv6 "$cfg" dhcpv6
+ config_get dhcpv4 "$cfg" dhcpv4 disabled
+ config_get dhcpv6 "$cfg" dhcpv6 disabled
The intent was to match odhcpd, which already treats an unset value
as disabled, so both backends behave the same way for newly created
configs. Its companion commit 85767ac8fe added explicit
'option dhcpv4/dhcpv6 server' lines to the stock 'lan' section in the
packaged dhcp.conf template, which covers fresh installs.
Neither commit accounts for configs that predate the change. Before
it, an unset dhcpv4/dhcpv6 option was implicitly treated as enabled,
so it was common (and still is, on any router upgraded from before
this landed) to have 'config dhcp' sections for additional
interfaces/VLANs with no explicit dhcpv4/dhcpv6 option at all. After
the change, dnsmasq.init silently skips '--dhcp-range' for every one
of those sections:
if [ "$dhcpv4" != "disabled" ]; then
...
fi
The result: any interface whose dhcp section never needed the option
before stops handing out leases entirely, with nothing logged beyond
a normal dnsmasq startup, while sections that happen to already carry
an explicit 'server' value keep working. On a router with several
VLANs this looks exactly like "DHCP only works on one interface."
Fix by shipping a one-time /etc/uci-defaults migration, matching the
existing 50-dnsmasq-migrate-resolv-conf-auto.sh /
50-dnsmasq-migrate-ipset.sh pattern in this package: for every
'config dhcp' section, if dhcpv4/dhcpv6 is unset, explicitly set it
to 'server', preserving the pre-6f30f08d0e behavior for existing
configs. Sections that already set the option (or set 'disabled'
deliberately) are left untouched, and sections that never reach the
check (e.g. 'wan' with 'option ignore 1') are unaffected.
Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/24068
Signed-off-by: Robert Marko <robimarko@gmail.com>
For the most part, factory: remains as a hold over from nvmem-layout
conversion and no longer serves any purpose.
In the case of &factory sections, reduce identation slightly by
referencing the nvmem-layout node instead.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24008
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 257aee0cc0 ("scripts: dhcpv6: don't report custom ip6class if default")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Indicate that there are some changes. This should make sure that the
package gets updated.
Fixes: 63c0767f3d ("ead: fix integer underflow in handle_send_a()")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
On the TSN and RED variants of SparX-5 and LAN969x TAS (Time-Aware Shaper)
is present in the silicon.
Currently, the driver does not use configure it at all, which means that
the TAS_PROFILE_CONFIG.LINK_SPEED[1] value is left at the default of 3
which means that its configured for 1 Gbps.
So, running iperf between two 10G switch ports will result in only 940-ish
Mbps while we should be getting around 9.3 Gbps.
Correctly populating the TAS_PROFILE_CONFIG.LINK_SPEED[1] with the current
port speed fixes this issue and we achieve around 9.4 Gbps between two 10G
switch ports.
So, port the TAS port link speed setting from the vendor BSP 6.18 kernel[2]
[1] https://microchip-ung.github.io/lan969x-industrial_reginfo/reginfo_LAN969x-Industrial.html?select=hsch,tas_profile_cfg,tas_profile_config,link_speed
[2] https://github.com/microchip-ung/linux/tree/bsp-6.18-2026
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Enable device packages required for camera support and add relevant device
tree nodes.
The drivers probe and connect properly, but it currently only supports
uncompressed UYVY in 2592x1944, 1920x1080 and 1280x960 resolutions, so I
had to use ustreamer to get the stream over network:
ustreamer -r 1920x1080 -m UYVY -d /dev/video0 -s 0.0.0.0
To get the camera working, the following extra packages are needed:
kmod-mux-mmio kmod-video-imx7-csi kmod-video-imx-mipi-csis kmod-video-mux \
kmod-video-ov5645
To set up the capture, you need to set up the links and formats across
the pipeline, for example:
media-ctl -d /dev/media0 -l "'ov5645 3-003c':0 -> 'csis-30750000.mipi-csi':0[1]"
media-ctl -d /dev/media0 -l "'csis-30750000.mipi-csi':1 -> 'csi-mux':1[1]"
media-ctl -d /dev/media0 -l "'csi-mux':2 -> 'csi':0[1]"
media-ctl -d /dev/media0 -l "'csi':1 -> 'csi capture':0[1]"
media-ctl -d /dev/media0 -V "'ov5645 3-003c':0 [fmt:UYVY8_1X16/1920x1080 field:none]"
media-ctl -d /dev/media0 -V "'csis-30750000.mipi-csi':0 [fmt:UYVY8_1X16/1920x1080 field:none]"
media-ctl -d /dev/media0 -V "'csis-30750000.mipi-csi':1 [fmt:UYVY8_1X16/1920x1080 field:none]"
media-ctl -d /dev/media0 -V "'csi-mux':1 [fmt:UYVY8_1X16/1920x1080 field:none]"
media-ctl -d /dev/media0 -V "'csi-mux':2 [fmt:UYVY8_1X16/1920x1080 field:none]"
media-ctl -d /dev/media0 -V "'csi':0 [fmt:UYVY8_1X16/1920x1080 field:none]"
media-ctl -d /dev/media0 -V "'csi':1 [fmt:UYVY8_1X16/1920x1080 field:none]"
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17606
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Create a package for ov5645 kernel module, required to support camera on
PICO-PI-IMX7D board.
Currently limit the visibility to imx_cortexa7 subtarget, but this can
be enabled on other platforms if needed.
Signed-off-by: Lech Perczak <lech.perczak@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17606
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Some EHT options like beamformer/beamformee
are disabled by default in hostapd.conf
Read the EHT Phy Cap structure and enable/disable
switches within the hostapd.conf for capable hardware.
Without this EHT SU beamformer/beamformee and MU
beamformer capabilities are omitted from AP beacons,
even if the driver reports the hardware as capable.
Signed-off-by: Richard Huynh <voxlympha@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/22956
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
This commit adds support for the NanoStation Loco M2/M5 XW devices
on the ath79 target with test date (label on the packaging, not the
device) later than October 2017.
To discover whether you have the new version, open a console on the
stock web interface and run `dmesg | grep AR803`. New versions print
AR8035, v1 shows AR8032.
Specifications:
- AR9342 (rev 3) SoC @ 535 MHz
- 64 MB RAM
- 8 MB SPI flash
- 1x 10/100 Mbps Ethernet, 24 Vdc PoE-in
- AR8035 switch
- 2T2R 5 GHz radio, 22 dBm
- 13 dBi built-in directional antenna
- POWER/LAN green LEDs
- 4x RSSI LEDs (red, orange, green, green)
- UART (115200 8N1) on PCB
Flashing via TFTP:
- Use a pointy tool (e.g., pen cap, paper clip) and keep the reset
button on the device pressed
- Power on the device via PoE (keep reset button pressed)
- Keep pressing until LEDs flash alternatively LED1+LED3 =>
LED2+LED4 => LED1+LED3, etc.
- Release reset button
- The device starts a TFTP server at 192.168.1.20
- Set a static IP on the computer (e.g., 192.168.1.21/24)
- Upload via tftp the factory image:
$ tftp 192.168.1.20
tftp> bin
tftp> put openwrt-ath79-generic-xxxxx-ubnt_nanostation-loco-m-xw-v2-squashfs-factory.bin
MAC addresses: stored on Flash, in the "art" partition.
Signed-off-by: Matthias Urlichs <matthias@urlichs.de>
Link: https://github.com/openwrt/openwrt/pull/23912
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
Globitel BT-R320 boots the sysupgrade FIT from the eMMC production
partition with root=/dev/fit0.
The device tree did not describe the production GPT partition and
/chosen/rootdisk did not point at the FIT container. fitblk then had no
rootdisk match and the board stopped at:
Waiting for root device /dev/fit0...
Describe the eMMC GPT partitions, set /chosen/rootdisk to production,
and use the FIT sysupgrade path.
Fixes: a3105d3f95 ("mediatek: filogic: add support for Globitel BT-R320")
Signed-off-by: solodecode <zikwarface134@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23895
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
On the ZoneFlex 7025 the uplink port (eth0) is connected to PHY 4 of
the AR7240 built-in switch. This PHY erroneously advertises
1000baseT/Full capability, even though the AR7240 built-in switch only
supports 10/100 Mbps.
Because of the bogus gigabit capability, phylib performs 1000BASE-T
master/slave resolution against the PHY's non-functional gigabit
registers, which never completes. Auto-negotiation then fails: the
link flaps between speeds or never comes up at all, while a manually
forced fixed speed works fine.
Cap the PHY at 100 Mbps so the gigabit capability is removed and the
master/slave resolution path is skipped. eth0 then auto-negotiates
reliably to 100 Mbps full-duplex.
Signed-off-by: Dhimant Thanki <dhimant.thanki@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/24022
Signed-off-by: Robert Marko <robert.marko@sartura.hr>
The MikroTik RB5009UPr+S+IN is a multigig router based on the Marvell
Armada 7040 SoC, sharing the same hardware base as the RB5009UG+S+IN
with added PoE-out support on all ethernet ports.
Specification:
- SoC : Marvell Armada 7040 (88F7040), 4x Cortex-A72
- CPU frequency : 350-1400 MHz
- RAM : 1 GB
- Flash : 16 MB SPI NOR + 1 GB NAND
- Switch : Marvell MV88E6393X
- Ethernet : 1x 2.5G (p1, QCA8081), 7x 1G (p2-p8), 1x SFP+ 10G
- PoE-in : 802.3af/at on p1, 24-57V
- PoE-out : 802.3af/at on p1-p8, 130 W total
- Power : DC jack / 2-pin terminal / PoE-in, 24-57V
- USB : 1x USB 3.0 type A, max 1.5 A
- LEDs/Keys (GPIO): 4x/1x
- UART : MikroTik SPI/UART combo header (10-pin, 2.0mm pitch)
- assignment : GND Vcc Rx ? GND / CLK DO /CS Tx DI (top view)
- settings : 115200n8
Flash instruction using initramfs image:
RouterBOOT cannot boot the OpenWrt kernel directly. A U-Boot loader
(u-boot.elf) is installed as an intermediary: RouterBOOT loads
u-boot.elf, which then loads the OpenWrt initramfs image.
1. Rename the downloaded initramfs image, removing the version number,
to: openwrt-mvebu-cortexa72-mikrotik_rb5009-initramfs-uImage.itb
2. Set up a BOOTP/TFTP server serving u-boot.elf, with the renamed
initramfs image in the same directory
3. Power off the router, hold the reset button (front panel), power on
and keep holding until the initramfs image has been served, then
release
4. The router boots the initramfs image, reachable at 192.168.1.1
5. Log in via SSH, install U-Boot, wipe NAND and flash OpenWrt:
. /lib/functions.sh
yafut -d /dev/mtd$(find_mtd_index "YAFFS") -w -i /tmp/u-boot.elf -o kernel -T
ubiformat /dev/mtd$(find_mtd_index "ubi") -y
sysupgrade /tmp/openwrt-mvebu-cortexa72-mikrotik_rb5009upr-squashfs-sysupgrade.bin
Recovery:
Hold the reset button while U-Boot is booting to load the initramfs
image again. To return to RouterOS, use MikroTik Netinstall.
MAC Addresses:
MAC addresses are read from the RouterBOOT hard_config in NOR via the
macaddr_hard nvmem cell:
offset +0 p1 (2.5G, label-mac-device)
offset +1 p2
offset +2 p3
offset +3 p4
offset +4 p5
offset +5 p6
offset +6 p7
offset +7 p8
offset +8 sfp
Tested-by: Sm00shed <sm00shed@posteo.de> (RB5009UPr+S+IN, OpenWrt v25.12.4,
kernel 6.12.87, mtpoe fw 65.21)
Signed-off-by: Przemek Rudy <prudy@protonmail.com>
[carlo@common-net.org: refactor RB5009UPr+S+IN support and fix sysupgrade path]
Signed-off-by: Carlo Filippi <carlo@common-net.org>
[sm00shed@posteo.de: fix compatible indentation, remove mikrotik,rb5009, expand commit message]
Signed-off-by: Sm00shed <sm00shed@posteo.de>
Link: https://github.com/openwrt/openwrt/pull/23698
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Specialize RB5009UG model from generic RB5009.
Signed-off-by: Przemek Rudy <prudy@protonmail.com>
[carlo@common-net.org: fixed model name and backward compatibility ]
Signed-off-by: Carlo Filippi <carlo@common-net.org>
Signed-off-by: Sm00shed <sm00shed@posteo.de>
Link: https://github.com/openwrt/openwrt/pull/23698
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Delete the KERNEL_LOADADDR assignment from the airoha_an7583-evb device definition.
The kernel load address is now centrally managed in image Makefile with, just using default load address:
loadaddr-$(CONFIG_TARGET_airoha_an7583) := 0x80200000
This ensures the load address configuration is maintained in a single location.
Removing the duplicate assignment prevents confusion and potential misconfiguration.
Signed-off-by: YaleiZang <yalei.zang@airoha.com>
Link: https://github.com/openwrt/openwrt/pull/24000
Signed-off-by: Robert Marko <robimarko@gmail.com>
Only the devices that actually have these PHYs and DSA switches
should carry the kernel modules, instead of baking them into the
kernel for all nand boards.
These devices have no space constraints, so any size increase is
meaningless.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23985
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
RAM: ESMT M15T2G16128A-DEB DDR3 1866 MT/s
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdinfo" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_m3000-v2-yt8821-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
RAM: ESMT M15T2G16128A-DEB DDR3 1866 MT/s
This allows us to use the full size of nand,
which extends ubi size from 64Mb to 122.25Mb.
1. Log in to the device and backup all the partitions,
especially unique "Factory" and "bdinfo" partitions
from System -> Backup / Flash Firmware -> Save mtdblock contents.
2. Install kmod-mtd-rw to unlock mtd partitions for writing
apk update && apk add kmod-mtd-rw && insmod mtd-rw i_want_a_brick=1
3. Write new OpenWrt (U-Boot Layout) "BL2" and "FIP":
mtd -e BL2 write openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-preloader.bin BL2
mtd -e FIP write openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-bl31-uboot.fip FIP
4. Set static IP on your PC: "192.168.1.254", gateway "192.168.1.1"
5. Serve openwrt-mediatek-filogic-cudy_m3000-v1-ubootmod-initramfs-recovery.itb
using TFTP server.
6. Connect Router LAN with PC LAN.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After OpenWrt initramfs recovery has booted,
clean "/dev/mtd5" ubi partition to utilize maximum of free space:
ubidetach -p /dev/mtd5; ubiformat /dev/mtd5 -y; ubiattach -p /dev/mtd5
ubimkvol /dev/ubi0 -n 0 -N ubootenv -s 128KiB
ubimkvol /dev/ubi0 -n 1 -N ubootenv2 -s 128KiB
9. Perform sysupgrade.
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Add DDR3_FREQ_1866 for DDR3 Cudy devices
to reduce RAM speed to 1866 MT/s
All known Cudy devices with DDR3 256/512 MB RAM use
ESMT M15T2G16128A-DEB DDR3 1866 MT/s or
ESMT M15T2G16256A-DEB DDR3 1866 MT/s
Signed-off-by: Dmitry Mostovoy <stavultras@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23274
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Tianling Shen