staging/stintel/package/boot, branch master

qualcommax: add support for TP-Link Archer AX55 v1

2026-09-09T19:16:23Z

TP-Link Archer AX55 v1 is an IPQ5018 Wi-Fi 6 router. Hardware: SoC: Qualcomm IPQ5018 (dual Cortex-A53) RAM: 512 MiB Flash: 128 MiB SPI-NAND (dual firmware slots) Switch: Realtek RTL8367S (5x GbE), 2.5G HSGMII trunk to gmac1 WiFi: IPQ5018 2.4 GHz + QCN6122 5 GHz (ath11k) USB: 1x USB 3.0 port, SuperSpeed, using the IPQ5018 SS uni PHY; the port's 5 V rail is a GPIO-switched regulator wired as the PHY's vdd-supply, the way the MR5500 does it Button: Reset, WPS/Wi-Fi LED: power, LAN, WAN (green/orange), 2.4G, 5G, USB All five front jacks are RTL8367S ports (DSA): blue "WAN" = wan, LAN1-4 = lan1..lan4, over the 2.5G HSGMII trunk. The factory MAC is the "default-mac" file in the tp_data UBIFS volume (there is no raw nvmem cell for it). The volume is attached and mounted read-only during preinit, so board.d assigns the wired MACs (label MAC for lan/eth0, +1 for wan) the usual way and the ath11k caldata hotplug derives the Wi-Fi MACs (+2/+3) from the same mount - the same scheme the mt7981 archer-ax80-v1 uses for its tp_data. gmac1 has no nvmem MAC source, so the DSA conduit is pinned to the label MAC in board.d to keep it stable across boots. The board data files live in firmware_qca-wireless, where they were merged as f2c37a6b9d1d; this commit pins the ipq-wifi package to that revision and adds the package entry for the board. Note on revisions: some units labelled "v1" carry an RTL8367D-family switch (chip id 0x6642) instead of the RTL8367S. rtl8365mb cleanly declines it ("unrecognized switch"), so such a unit boots with no wired ports, and with Wi-Fi off by default it is only reachable via the vendor web recovery (or serial). RTL8367D support in rtl8365mb is being worked on by others; until it lands the wiki page carries a prominent warning to identify the switch before flashing. v2/v4 are entirely different hardware and are not covered by this image. Installation (serial console on the JP1 header, 115200 8N1, 1.8 V; note the RX trace is gapped and must be bridged to type): interrupt U-Boot, TFTP-boot the initramfs image to 0x44000000, "bootm", then "sysupgrade -n". A serial-free path (a telnet-enabled resigned stock image flashed from the vendor web UI, then writing the OpenWrt image to the inactive slot) is documented on the device wiki page; that path consumes the initramfs-factory.ubi artifact, which is the initramfs kernel wrapped in a UBI image so it can be written straight into the inactive rootfs partition with mtd from the running stock firmware. Recovery to stock: hold Reset while powering on, set the PC to 192.168.0.10, and upload an official signed TP-Link image at http://192.168.0.1. Signed-off-by: Stanislaw Pal Co-Authored-By: Claude Opus 5 Link: https://github.com/openwrt/openwrt/pull/24197 Signed-off-by: Robert Marko

mediatek: add support for JioRouter AX6000 JIDU6J01

2026-09-09T11:40:34Z

| Component | Details | |------------------|------------------------------------------------| | **SoC** | MediaTek MT7986A (4× ARM Cortex-A53 @ 2.0 GHz) | | **RAM** | 512 MB | | **Flash** | 256 MB NAND | | **Ethernet** | 5× 10/100/1000 Mbps (1 WAN + 4 LAN) | | **WLAN 2.4 GHz** | MediaTek MT7976GN — 802.11b/g/n/ax, 4×4 MIMO | | **WLAN 5 GHz** | MediaTek MT7976AN — 802.11n/ac/ax, 4×4 MIMO | | **LEDs** | 1× RGB LED (GPIO-controlled) | | **Button** | 1× Reset | | **USB** | Yes | **MAC Addresses:** | Interface | Source | |------------|-------------------------------------------------| | WAN/Label | MFG MTD partition (variant-specific fallback) | | LAN | WAN + 1 | | 2.4 GHz | WAN + 2 | | 5 GHz | WAN + 3 | Supported variants and MAC source: - JIDU6J01,JIDU6201: binary at offset 0x00 - JIDU6401: binary at offset 0x20 - JIDU6601: ASCII text at offset 0x1d0 - JIDU6701: ASCII mac= key --- **1. Extracting U-Boot Credentials** The U-Boot username and password are stored in the `MFG` partition. To retrieve them: - With root access on stock OS: Read directly from the MFG partition. - Without root access: Dump the NAND flash first, then extract the credentials from the dump. **2. Prepare TFTP server** - Set a static IP on the ethernet interface of your computer (e.g. default: ip `192.168.1.2`, gateway `192.168.1.1`). - Download the initramfs image and host it with the TFTP server. **3. Interrupt boot** Attach UART and power on the router. When the boot menu appears, select **Failsafe Mode**, then press `Ctrl-C` to interrupt and enter the credentials extracted from `MFG` partition. **4. Load and run initramfs image** ```sh setenv ipaddr 192.168.1.1 setenv serverip 192.168.1.2 tftpboot 0x46000000 openwrt-mediatek-filogic-jiorouter_ax6000-jidu6j01-initramfs-kernel.bin fdt addr $(fdtcontroladdr) fdt rm /signature bootm ``` **5. Flash sysupgrade image** Place the sysupgrade image in `/tmp`, then run: ```sh sysupgrade /tmp/openwrt-mediatek-filogic-jiorouter_ax6000-jidu6j01-squashfs-sysupgrade.bin ``` Alternatively, use the sysupgrade option in LuCI. Signed-off-by: Sheikh Faisal Link: https://github.com/openwrt/openwrt/pull/23510 Signed-off-by: Jonas Jelonek

mediatek: fix U-Boot env geometry for JioRouter AX6000 JIDU6101

2026-09-09T11:40:34Z

Correct the U-Boot env geometry from "0x80000" "1" to "0x1f000" "5". The correct LEB size for 128k PEB / 2k page is 0x1f000, and the 0x80000 volume spans 5 LEBs. This also hardens jiorouter_initial_setup by adding proper error handling and dynamic UBI device/volume lookups, and generates /etc/fw_env.config to be consistent. Signed-off-by: Sheikh Faisal Link: https://github.com/openwrt/openwrt/pull/23510 Signed-off-by: Jonas Jelonek

uboot-mediatek: cmcc rax3000m: add UBI variant

2026-09-09T10:03:34Z

Add the CMCC RAX3000M(e) UBI-enabled U-Boot target for both DDR3 and DDR4 builds. Refactor the CMCC RAX3000M(e) device trees. The board-specific DTS variants for eMMC, NAND, and UBI now inherit the common setup while overriding the required flash configuration and partitions. This keeps the common MT7981 wiring centralized and makes each RAX3000M variant explicit and maintainable. Signed-off-by: Andrii Kuiukoff Link: https://github.com/openwrt/openwrt/pull/24575 Signed-off-by: Jonas Jelonek

qualcommax: ipq807x: add Netgear RBx850 support

2026-09-07T10:23:38Z

Netgear RBx850 are tri band, 2.4GHz and 2x 5GHz, 12 stream 802.11ax mesh devices from the Orbi series. The RBR850 is a router with a 2.5GbE WAN and 4 1GbE LAN ports. The RBS850 is a satellite without WAN port and half the flash. The hardware is otherwise identical. They were sold in kits as RBK852-RBK855, with one router and 1-4 satellites. The RBx850 are substantially similar to the RBx750 so this commit factors out a common DTS, flash script and build definition. Hardware: * SoC: Qualcomm IPQ8074 * RAM: 1GiB 2x Samsung 4A4G165WE-BCRC * Flash: 512MiB Winbond W29N04GZ or 256MiB Winbond W29N02GZ * WLAN 2.4GHz: QCN5024 4x4:4 b/g/n/ax * WLAN 5GHz Low Band: QCN5054 4x4:4 a/n/ac/ax 5180-5320MHz * WLAN 5GHz High Band: QCN5054 4x4:4 a/n/ac/ax 5500-5700MHz * Ethernet: 4x 1GbE LAN, 1x 2.5GbE WAN on RBR850 * Serial Config: 3.3V TTL 115200-8-N-1, internal populated header * Serial Layout: Bottom <- RX, TX, GND, 3.3V (don't connect) -> Top * LEDs: green/red power, white/red/green/blue status * Buttons: 1x Reset, 1x WPS MAC addresses: LAN1: Label LAN2: Label + 1 LAN3: Label + 2 LAN4: Label + 3 WAN: Label + 1 2.4GHz: Label + 2 (RBR) or 1 (RBS) 5GHz-Low: Label + 3 (RBR) or 2 (RBS) 5GHz-High: Label + 4 (RBR) or 3 (RBS) Flashing Notes: The stock firmware images are signed. Both the bootloader and the stock web interface check the signature and will fail to boot/flash. The bootloader automatically does NMRP when a gigabit LAN connection is present. The stock and factory images contain a U-Boot script that is executed when flashing using NMRP. This is used to alter and persist the U-Boot env with a boot command that works with unsigned firmware. Install OpenWrt: * Get the nmrpflash utility [0] and OpenWrt factory image * Find network interface to use: nmrpflash -L * Start nmrpflash: nmrpflash -i interface -f openwrt-...-factory.img * Connect one of the device LAN ports to the same network using gigabit * Plug the device in and wait for the bootloader to flash * Unplug and replug the device once the power LED on the back blinks amber Revert to Stock: The boot command needs to be reverted before flashing the stock firmware, otherwise it will fail to boot and get stuck in recovery mode (red power LED flashing). * Still in OpenWrt run: fw_setenv bootcmd bootipq * Restart the device * Flash the stock firmware RBx850-Va.b.c.d.img using nmrpflash [0]: https://github.com/jclehner/nmrpflash Authored by Michael Lotz. Piotr Szczepanik: * Cherry-picked the RBx850 support commit from openwrt/openwrt#22159 and adapted it to current main. * Reworked the DTS networking changes for the current qualcommax ipq807x device-tree style. * Verified the RBx750 DTS split preserves the existing RBx750-specific layout while moving shared RBx750/RBx850 nodes into a common DTSI. Signed-off-by: Michael Lotz Signed-off-by: Piotr Szczepanik Link: https://github.com/openwrt/openwrt/pull/24906 Signed-off-by: Robert Marko

uboot-rockchip: switch to dedicated profile for NanoPi R76S

2026-09-06T19:12:57Z

Support for NanoPi R76S has been merged upstream u-boot, so use it instead of the generic profile. Signed-off-by: Tianling Shen Link: https://github.com/openwrt/openwrt/pull/25047 Signed-off-by: Robert Marko

packages: uboot-tools: add env config for Sophos RED 15w

2026-09-04T20:31:15Z

Uboot-Envtools is installed by default on the mpc85xx target. Add the proper configuration for the Sophos RED 15w, so the fw_*env commands will actually work. Fix alphabetic sorting in the case statement while we're at it. Signed-off-by: Shine- GH <4c.fce2@proton.me> Link: https://github.com/openwrt/openwrt/pull/24939 Signed-off-by: Jonas Jelonek

mediatek: filogic: add Adtran SmartRG Mount Rainier series

2026-09-02T20:43:14Z

Common specifications: * MediaTek MT7987A (4x Cortex-A53) * 4 GiB eMMC * 1 GiB DDR4 RAM * 1x 2500M/1000M/100M/10M WAN port (MaxLinear MXL86211C PHY) * 2x 2500M/1000M/100M/10M LAN ports (MaxLinear MXL86211C PHY, MT7987 built-in 2.5G PHY) * 3x LED (green/amber/white) for each Ethernet port * 2 buttons (Reset, Mesh/WPS) * uC-controlled RGB LED via I2C * USB 2.0 type A port * 3.3V-level 115200 baud UART console * 12V 3A DC barrel jack power input SDG-8712: MT7992 dual-band 802.11be Wi-Fi (2.4G 4T4R, 5G 4T5R) SDG-8732: MT7996 tri-band 802.11be Wi-Fi (2.4G 2T2R, 5G 3T3R, 6G 3T3R) MAC addresses (base MFG_MAC from the mfginfo partition; the nvmem cell index in the DTS is added to the base): wan xx:xx:xx:xx:xx:x0 MFG_MAC lan1 xx:xx:xx:xx:xx:x1 MFG_MAC + 0x1 lan2 xx:xx:xx:xx:xx:x1 MFG_MAC + 0x1 2.4G xx:xx:xx:xx:xx:x4 MFG_MAC + 0x4 5G xx:xx:xx:xx:xx:xa MFG_MAC + 0xa 6G xx:xx:xx:xx:xx:x6 MFG_MAC + 0x6 (SDG-8732 only) Both models are also available in versions including 1x FXS POTS interface for analog phones. Those interfaces are not supported by OpenWrt. Installation: 1. Prepare a TFTP server at 192.168.1.10 and serve the OpenWrt initramfs image, renamed to "openwrt." for the model being installed: openwrt.440: SDG-8712 openwrt.442: SDG-8732 2. Connect to LAN2. 3. Connect to the UART port. 4. Power on the device and type "st" to enter the U-Boot command line. The window to do that might be very short (below 1s), so type it as soon as the "U-Boot ..." string appears. 5. Run "setenv boot_mode openwrt; saveenv" to boot from OpenWrt partition by default. 6. Run "bootmenu" and select option 6 (TFTP openwrt image and boot); "run boot5" is a shortcut for the same. This downloads openwrt. from the TFTP server and boots it. 7. After OpenWrt finishes booting, download the OpenWrt sysupgrade image and write it to eMMC using "sysupgrade". 8. After sysupgrade finishes writing, the device reboots into OpenWrt. When the front LED is solid white the device is ready for configuration. Signed-off-by: Chad Monroe Link: https://github.com/openwrt/openwrt/pull/24679 Signed-off-by: Jonas Jelonek

mediatek: filogic: bpi-r4-pro-8x: add aeonsemi phy to bpi-r4-pro-8x

2026-09-01T15:58:57Z

Add the two external Aeonsemi AS21xxx PHYs used by the LAN and WAN 10GBASE-T ports of the BPI-R4 Pro 8x. Configure their firmware, reset timing and LEDs, and connect them to the MxL switch and GMAC1. Replace the fixed SFP GPIO hog configuration with LAN and WAN overlays selecting either the copper PHY or the corresponding SFP cage. Build all four overlays, include them in the device image and select the SFP overlays by default through U-Boot `bootconf_extra`. Make the AS21xxx firmware package pull in the PHY driver on Linux 6.18, instead of making the driver depend on the firmware. Update existing Airoha device package lists accordingly so they continue to install both components through the firmware package. Breaking change for users using the router with SFP hogs from PR #21083. After flashing the new image, configure `bootconf_extra` to select between SFP or PHY overlays: fw_setenv bootconf_extra \ mt7988a-bananapi-bpi-r4-pro-8x-lan-phy#mt7988a-bananapi-bpi-r4-pro-8x-wan-phy If bootconf_extra had additional overlays (CN13 or CN14) keep them appended Signed-off-by: Pietro Ameruoso Signed-off-by: Frank Wunderlich

mediatek: add support for LTC Velo7 Max

2026-09-01T07:43:19Z

FCC ID 2A5LO-VL7M19K Aka: Tozed Kangwei ZLT W19B6VM Hardware -------- SoC: MediaTek MT7988A, 4x Cortex-A73 @ 1.8 GHz RAM: DDR4, 1 GiB, 4 GiB or 8 GiB depending on the variant sold (2x ESMT M16U4G16256A on the 1 GiB one used here), sized by U-Boot which fills in the memory node FLASH: 256 MiB Winbond W25N02KV SPI-NAND, managed by NMBM WIFI: MediaTek MT7996 802.11be tri-band (2.4/5/6 GHz), attached to both 2-lane PCIe interfaces ETH: 4x 1GbE from the MT7988A built-in switch 2x 10GbE via Realtek RTL8261BE PHYs using USXGMII USB: 2x USB 3.0 Type-A BUTTONS: Reset, WPS, Reboot LEDS: Power, Status (RGB), WLAN 2.4/5/6 GHz, WPS, TEL1 and TEL2 (each red and green), plus dual LEDs on all six RJ-45 sockets UART: 115200 8N1, unpopulated 3-pin 2.54mm header on the bottom edge of the board, which stands vertically. The pins are RX, GND, TX, the middle one carrying no label POWER: 12 VDC 3 A, barrel connector Unpopulated on this variant, and hence not described: eMMC, and two telephony SLICs together with their RJ-12 sockets. The LEDs of the two 10G RJ-45 sockets are left in the default behaviour of the RTL8261BE. The PHY driver offers no means of controlling them, and the part very likely has more LED outputs than the two used per socket, with neither the selection nor the order of them known, so they cannot be described in the device tree at this point. MAC addresses ------------- +---------+----------------------------+ | | Source | +---------+----------------------------+ | LAN | Factory 0x4, minus 2 | | WAN | Factory 0x4, minus 1 | | WLAN | Factory 0x4, 0xa and 0x2c0 | +---------+----------------------------+ Only the three WLAN addresses are stored in flash, as part of the MT7996 EEPROM. Both Ethernet addresses are derived from the first of them by subtraction, which is how the vendor firmware assigns them. Also matching the vendor firmware, the built-in switch and the 10G LAN port share the LAN address, so an existing network configuration survives the switch to OpenWrt. Bootloader ---------- MediaTek U-Boot using the SDK dual-boot scheme: two sets of UBI volumes, kernel/rootfs and kernel2/rootfs2, selected by the U-Boot environment variable dual_boot.current_slot. The environment itself lives in the u-boot-env UBI volume rather than in a raw MTD partition, which is what the uboot-envtools entry looks up. U-Boot verifies the kernel FIT and, separately, a hash over the squashfs which it takes from a top-level rootfs node of that FIT, falling back to the other slot should either check fail. sysupgrade writes both volume sets so that whichever slot the bootloader selects carries the new firmware, and clears any invalid marker left behind by an earlier failed boot. The flashing half of that is shared with netgear,eax17, which uses the same scheme, so it moves into mtk_dual_boot_flash_both_slots(). Installation ------------ The vendor firmware is itself OpenWrt based and its sysupgrade accepts the OpenWrt image directly. It is patched to not reboot unless -R is passed, and it always writes to whichever slot is currently inactive: sysupgrade -R openwrt-mediatek-filogic-ltc_vl7m19k-squashfs-sysupgrade.bin The vendor sysupgrade preserves rootfs_data, so run firstboot once OpenWrt has come up in order to discard the vendor overlay. Signed-off-by: Daniel Golle