Backport FORESEE NAND chip support from upstream Linux. The newly
introduced FORESEE F35SQA001G was found on the Xiaomi AX3000T.
Signed-off-by: Erik Servili <serverror@serverror.com>
Signed-off-by: Shiji Yang <yangshiji66@qq.com>
(cherry picked from commit 302c717aa3a434676a32a4dde8b10ec2c03798b5)
Hardware specification:
SoC: MediaTek MT7981B 2x A53
Flash: 64GB eMMC or 128 MB SPI-NAND
RAM: 512MB DDR3 or DDR4
Ethernet: 4x 10/100/1000 Mbps
Switch: MediaTek MT7531AE
WiFi: MediaTek MT7976C
Button: Reset, Mesh
Power: DC 12V 1A
Gain SSH access:
1. Login into web interface, and download the configuration.
2. Get the SN of the device from web interface or the label on the back of the device.
3. Calculate configuration decryption password:
Command "eval" is necessary here as the encryption implentation treats '$...' as (empty) variables.
decpwd="$(eval echo $(openssl passwd -1 -salt aV6dW8bD "your_device_sn"))"
4. Decrypt the configuration:
openssl aes-256-cbc -d -pbkdf2 -k "$decpwd" -in cfg_export_config_file.conf -out cfg_export_config_file.conf.dec
5. Enter fakeroot, decompress the configuration:
tar -zxf cfg_export_config_file.conf.dec
6. Edit 'etc/shadow', update (remove) root password: 'root::19179:0:99999:7:::'
7. Edit 'etc/rc.local', insert telnetd command before 'exit 0':
( sleep 3s; telnetd; ) &
8. Repack the configuration:
tar -zc etc/ | openssl aes-256-cbc -pbkdf2 -k "$decpwd" -out cfg_export_config_file.conf
* If you find an error about 'etc/wireless/mediatek/DBDC_card0.dat',
just ignore it.
9. Upload new configuration via web interface, now you can connect to
CMCC RAX3000Me via telnet.
(Big thanks to https://github.com/lyq1996 who reverse engineered the encryption method)
Check flash type:
If '/dev/mmcblk0' exists on the device, it's eMMC version.
If '/dev/mtd0' exists on the device, it's NAND version.
eMMC Flash instructions:
1. Connect to RAX3000Me, and backup everything, especially 'factory' part.
('data' partition can be ignored, it's useless.)
2. Write new GPT table:
dd if=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-gpt.bin of=/dev/mmcblk0 bs=512 seek=0 count=34 conv=fsync
3. Write new BL2:
echo 0 > /sys/block/mmcblk0boot0/force_ro
dd if=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-preloader.bin of=/dev/mmcblk0boot0 bs=512 conv=fsync
4. Write new FIP:
dd if=immortalwrt-mediatek-filogic-cmcc_rax3000me-emmc-bl31-uboot.fip of=/dev/mmcblk0 bs=512 seek=13312 conv=fsync
5. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
6. Serve ImmortalWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After ImmortalWrt has booted, perform sysupgrade.
NAND Flash instructions:
1. Connect to RAX3000Me, and backup everything, especially 'Factory' part.
2. Write new BL2 and FIP:
If your device HAS USB port, run:
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr3-preloader.bin BL2
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr3-bl31-uboot.fip FIP
If your device DOES NOT have USB port, run:
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr4-preloader.bin BL2
mtd write immortalwrt-mediatek-filogic-cmcc_rax3000me-nand-ddr4-bl31-uboot.fip FIP
4. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
5. Serve ImmortalWrt initramfs image using TFTP server.
6. Cut off the power and re-engage, wait for TFTP recovery to complete.
7. After ImmortalWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 57f31cd5b11cb7e590c330845ec74ffa2d6eb13e)
I selected one subtarget after the other and refreshed their
configuration using this command:
make kernel_oldconfig CONFIG_TARGET=subtarget
For MT7629 I had to re-add CONFIG_LEDS_SMARTRG_LED manually.
Otherwise, building MT7629 with ALL_KMODS we get prompted for
LEDS_SMARTRG_LED and this will break CI and in future buildbot
compilation. See commit 6bdea8c7bd85 ("mediatek: mt7629: 6.6: disable
LEDS_SMARTRG_LED by default") for more details.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
Link: https://github.com/openwrt/openwrt/pull/18182
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 5013efc4f907550fadbf15e2fb1bdb2ead3325db)
Prior to commit 8a7d12d674,
cdc-ethernet USB LTE modems (e.g. Quectel EC200A) were consistently named
usb0. After 8a7d12d67, devices began renaming to eth1 due to an assumption
that local MAC addresses originate exclusively from the kernel. Some
devices provide driver-assigned local MACs, causing point-to-point
interfaces with driver-set MACs to adopt eth%d names instead of usb%d.
Restore the naming exception for point-to-point devices: interfaces
without driver MACs or with driver-provided local MACs will retain the
usb%d convention. This addresses issues reported in [1] and fixed in [2].
[1] https://lore.kernel.org/all/Z00udyMgW6XnAw6h@atmark-techno.com/
[2] https://lore.kernel.org/all/20241203130457.904325-1-asmadeus@codewreck.org/
Tested-by: Ahmed Naseef <naseefkm@gmail.com>
Signed-off-by: Ahmed Naseef <naseefkm@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17757
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit ecd609f509f29ed1f75db5c7a623f359c64efb72)
`ucv_array_set` releases the array's reference to the object being cleared.
If this is the last reference to the object, it will be freed, making our
pointer `val` invalid.
To avoid this, we need to obtain our own reference to the object so we
can safely return `val`.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
(cherry picked from commit 6a10da2934441a59283394a84917edf4983e3043)
Since `wpa_ucode_registry_add` collects its own reference to the values added, the
two functions `hostapd_ucode_bss_get_uval` and `hostapd_ucode_iface_get_uval` would
sometimes return a referenced object (from `uc_resource_new`) and sometimes return
an unreferenced object (from `wpa_ucode_registry_get`). Now, both functions always
return a referenced object.
This change also indirectly fixes `hostapd_ucode_bss_get_uval`, ensuring it now
always returns a referenced object.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 7729f960933a03c9eebd2b65a695ea57718ccb77)
Remove extra ucv_get calls when passing a referenced value to an object
without using it further.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 22eaf1864731dd29918357b26565dbd9420fd314)
This fixes a common reference counting bug typically along the lines of:
```
uc_value_push(ucv_get(ucv_string_new(...)));
```
This would leave our new string with a reference count of 2, one from
the construction of the string, the other from `ucv_get`. This would
prevent the strings from being correctly cleaned up when it goes out
of scope.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
(cherry picked from commit f79968ee0f76c41414fb0c08980b9c2a259964d3)
When a feed has submodules, all its submodules are fully cloned whereas
the feed itself is shallowed. Let's be consistent and perform shallow clones
as well for the submodules.
Signed-off-by: Cedric CHEDALEUX <cedric.chedaleux@orange.com>
Link: https://github.com/openwrt/openwrt/pull/18003
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 9ec32cfb2733856a2ab4caee07d9b3297568381d)
When a feed is referenced with a specific commit (i.e. <git_url>^<sha1>),
a full clone was performed and a branch was created from the sha1
and named with the sha1. Other git clones operations are shallowed.
As Git does not support clone at a specific commit, let's first perform
a shallow clone to latest commit, then fetch the relevant commit and
finally checkout it (no more 'pseudo' branch).
It saves bandwith and significantly speeds up the feed update process.
Signed-off-by: Cedric CHEDALEUX <cedric.chedaleux@orange.com>
Link: https://github.com/openwrt/openwrt/pull/18003
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 32d0a57dc10811a24816e51f10e55963f40fe462)
kmod-mmc-mtk does not work well on this board, switch back to deprecated
kmod-sdhci-mt7620 driver for now.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
75a236be122a service: add missing null pointer check
f5341f327539 ubus: add api for generating and validating security tokens
3fab99eab4d5 add udebug support
28d86bd30e97 pex: only respond to update requests when we have network data
8e6f37cc361e pex-msg: ignore no-data responses if version is zero
12e6cf7f63e1 pex: create pex host from update responses
edc8fdae463a ubus: show the local addresses in network status
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit ce68f61cb67a4701a108f838f510e72ca63ed78e)
ethtool since version 6.9 introduced support for getting/setting RSS
input transformation supported in Linux since version 6.8.
The now changed kernel ioctl ABI, however, cannot be detected from
userland, and ethtool since version 6.9 simply assumes that a previously
reserved field is now used to set the input transformation.
Unfortunately the default value RXH_XFRM_NO_CHANGE (0xff) used by ethtool
userland creates an incompatibility with older kernels which cannot be
resolved easily without introducing even more ABI breakage.
Work-around the issue and fix support for --set-rxfh and --set-rxfh-indir
ethtool userland tool commands by making the support for input_xfrm
conditional on compile time, and keep it disabled for Linux 6.6.
Fixes: 8c2dcd1518 ("ethtool: update to 6.10")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Tested-by: Stijn Segers <foss@volatilesystems.org>
(cherry picked from commit 3a7467ffde413677de5465dde78a62dfa8d6774f)
Version 6.11 - October 8, 2024
* Feature: cmis: print active and inactive firmware versions
* Feature: flash transceiver module firmware (--flash-module-firmware)
* Feature: add T1BRR 10Mb/s mode to link mode tables
* Feature: support for disabling netlink from command line
* Fix: fix lanes parameter format specifier
* Fix: add missing clause 33 PSE manual description
* Fix: qsf: Better handling of Page A2h netlink read failure
* Fix: rss: retrieve ring count using ETHTOOL_GRXRINGS ioctl (-x)
* Misc: man page formatting fix
* changelog here: https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/commit/NEWS?id=c0ea4b70c71334ef038f7a3416b228a50dada406
Tested on gl.inet MT6000, retrieve ring count is now working
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17607
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit 9454331b7fc896704a2c60b28767c282eb9ca0bd)
Specification:
* Mediatek MT7981BA
* 256 MB SPI-NAND
* 512 MB DDR4 RAM
* MT7976CN DBDC AX Wi-Fi
* MediaTek MT7531AE (3x LAN Gigabit ports) + Internal Gbe Phy (1x WAN Gigabit port)
* 4x LED (power, internet, fn, wifi)
* 3x buttons (wps, fn, reset)
* 1x USB 3.0 port
Serial Interface:
* 3 Pins GND, RX, TX
* Settings: 115200, 8N1
Notes:
* The device supports dual boot mode
* Fn led reassigned to wlan 2.4
Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-mediatek-filogic-keenetic_kn-3811-squashfs-factory.bin"
to "KN-3811_recovery.bin" and place it in tftp server directory.
3. Connect PC with ethernet port, press the reset button, power up
the device and keep button pressed until status led start blinking.
4. Device will download file from server, write it to flash and reboot.
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17135
(cherry picked from commit d087a79b7b03fe93a221fd6246ce437c5c5325c3)
Link: https://github.com/openwrt/openwrt/pull/18055
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Specification:
- MT7981 CPU using 2.4GHz and 5GHz WiFi (both AX)
- 512MB RAM
- 128MB SPI NAND
- 2 LEDs (green, orange)
- 3 buttons (fn, reset, wps)
- 2 2.5Gbit ethernet ports based on Airoha EN8811H phy
Serial Interface:
- 3 Pins GND, RX, TX
- Settings: 115200, 8N1
Notes:
- The device supports dual boot mode
Flash instruction:
The only way to flash OpenWrt image is to use tftp recovery mode in U-Boot:
1. Configure PC with static IP 192.168.1.2/24 and tftp server.
2. Rename "openwrt-mediatek-filogic-keenetic_kn-3911-squashfs-factory.bin"
to "KN-3911_recovery.bin" and place it in tftp server directory.
3. Connect PC with ethernet port, press the reset button, power up
the device and keep button pressed until status led start blinking.
4. Device will download file from server, write it to flash and reboot.
Signed-off-by: Maxim Anisimov <maxim.anisimov.ua@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16830
(cherry picked from commit 5a4eb56a7bc7d1d8028d103d50b0dba2ff7808c4)
Link: https://github.com/openwrt/openwrt/pull/18055
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
cmcc_a10-ubootmod stands for custom U-Boot layout in ImmortalWrt 23.05,
add compat version to avoid bricking devices. For 24.10+ users you can
just ignore the compat warning.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 4b000293b20b03a45130e6453f3e2a28dc0950ca)
This board is also as known as SuperElectron ZN-M5 and ZN-M8. However,
for ZN-M5 and ZN-M8, there's another version uses ZX279128 as CPU
chip, which is unsupported.
You can check it in "高级设置" > "系统日志" > "内核日志" page from webUI.
Stock layout flash instructions:
Login into webUI and upload sysupgrade firmware in "系统管理" > "升级固件" page.
Remember to unselect "保留配置" ("Keep configurations") first before doing that.
OpenWrt U-Boot layout flash instructions:
1. Flash stock layout firmware first.
2. Connect to the device via SSH, and backup everything,
especially 'Factory' partition.
3. Unlock MTD partitions:
apk update && apk add kmod-mtd-rw
insmod mtd-rw i_want_a_brick=1
4. Write new BL2 and FIP:
mtd write immortalwrt-mediatek-filogic-cmcc_a10-ubootmod-preloader.bin BL2
mtd write immortalwrt-mediatek-filogic-cmcc_a10-ubootmod-bl31-uboot.fip FIP
5. Set static IP on your PC:
IP 192.168.1.254/24, GW 192.168.1.1
6. Serve ImmortalWrt initramfs image using TFTP server.
7. Cut off the power and re-engage, wait for TFTP recovery to complete.
8. After ImmortalWrt has booted, perform sysupgrade.
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
(cherry picked from commit 4e9240e7332f8a00713f284b0b0f4901d6b2b16c)
Changes between 3.0.15 and 3.0.16 [11 Feb 2025]
CVE-2024-13176[1] - Fixed timing side-channel in ECDSA signature
computation.
There is a timing signal of around 300 nanoseconds when the top word of
the inverted ECDSA nonce value is zero. This can happen with significant
probability only for some of the supported elliptic curves. In
particular the NIST P-521 curve is affected. To be able to measure this
leak, the attacker process must either be located in the same physical
computer or must have a very fast network connection with low latency.
CVE-2024-9143[2] - Fixed possible OOB memory access with invalid
low-level GF(2^m) elliptic curve parameters.
Use of the low-level GF(2^m) elliptic curve APIs with untrusted explicit
values for the field polynomial can lead to out-of-bounds memory reads
or writes. Applications working with "exotic" explicit binary (GF(2^m))
curve parameters, that make it possible to represent invalid field
polynomials with a zero constant term, via the above or similar APIs,
may terminate abruptly as a result of reading or writing outside of
array bounds. Remote code execution cannot easily be ruled out.
1. https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
2. https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
Build system: x86/64
Build-tested: bcm27xx/bcm2712
Run-tested: bcm27xx/bcm2712
Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/17947
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit b4e6fd7b76440076eeff3a0789d40acbb5363ecf)
b43aeb5 wireless-regdb: assert and correct maximum bandwidth within frequency difference
68588bf wireless-regdb: Update regulatory info for Syria (SY) for 2020
0dda57e wireless-regdb: Update regulatory info for Moldova (MD) on 6GHz for 2022
b19ab0b wireless-regdb: Update regulatory info for Azerbaijan (AZ) on 6GHz for 2024
f67f40d wireless-regdb: Update regulatory info for Oman (OM)
bd70876 wireless-regdb: Update regulatory rules for Armenia (AM) on 2.4 and 5 GHz
6c7cbcc wireless-regdb: Permit 320 MHz bandwidth in 6 GHz band in ETSI/CEPT
f9f6b30 wireless-regdb: Update regulatory rules for Austria (AT)
39b47ea wireless-regdb: Update regulatory info for Cayman Islands (KY) for 2024
3dd7ceb wireless-regdb: allow NO-INDOOR flag in db.txt
4d754a1 wireless-regdb: Update regulatory rules for Iran (IR) on both 2.4 and 5Ghz for 2021
8c8308a wireless-regdb: Update frequency range with NO-INDOOR for Oman (OM)
c2f11e2 wireless-regdb: update regulatory database based on preceding changes
Signed-off-by: Rudy Andram <rmandrad@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17957
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit da2cc98458f46745de95e88b6066620fbd02b190)
The proposed detection method was based on reading the LAUNCH_FREADY core flag.
However, this method only works before the cores are launched.
For this reason, the core number detection method has been changed to a simpler one.
For mt6721s the 17th revision bit is zero, hence we know that it is this chip,
so the number of cores is 1.
Fixes: https://github.com/openwrt/openwrt/issues/17764
Tested-by: Enrico Mioso <mrkiko.rs@gmail.com>
Tested-by: Simon Etzlstorfer <simon@etzi.at>
Tested-by: Mauri Sandberg <maukka@ext.kapsi.fi>
Co-authored-by: Shiji Yang <yangshiji66@qq.com>
Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
Link: https://github.com/openwrt/openwrt/pull/17834
(cherry picked from commit bb84c256e701a21a97443ffe9dd1d510bd6c1c40)
Link: https://github.com/openwrt/openwrt/pull/18015
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Set the SUPPORTED_DEVICES Device var so that sysupgrade images
are supported without a force.
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Link: https://github.com/openwrt/openwrt/pull/17964
(cherry picked from commit 5a124ff167ed42e28dba2805793b5ddcece0eb50)
Link: https://github.com/openwrt/openwrt/pull/18093
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The upstream device-tree files are now using 'gateworks' instead of 'gw'
for compatible. Add this pattern so that the newer boards support
sysupgrade.
Signed-off-by: Tim Harvey <tharvey@gateworks.com>
Link: https://github.com/openwrt/openwrt/pull/17964
(cherry picked from commit ee73d35fbe0f18bfd0f710008de369236a220510)
Link: https://github.com/openwrt/openwrt/pull/18093
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Both share the same OEM firmware but differ in product_name for safeloader
product_name:MR1800X,product_ver:1.0.0,special_id:45550000
Signed-off-by: Robert Senderek <robert.senderek@10g.pl>
Link: https://github.com/openwrt/openwrt/pull/17965
(cherry picked from commit f93367227e1458fb366304d0f431f12e95d244cd)
Link: https://github.com/openwrt/openwrt/pull/18031
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
