Add support for Widelantech WAP430X (mt7981)

[raenye]

This AX3000 flying saucer shaped device is sold under a few names:

• Widelantech WAP430X
• Felicomm (changing language to English on Widelantech's website gets you here)
• UeeVii UAP200 (on Amazon)

True name, as marked on the PCB, is WAP430X.

tl;dr

I have ported OpenWrt to this device, and will soon post a PR, but some details are missing:

1. How to install OpenWrt without opening the device and connecting to UART;
2. After installation, I tried to sysupgrade another OpenWrt build, which for some reason converted the rootfs mtd partition to ubi, soft-bricking the device.
   I recovered by reflashing sysupgrade from UART, and it's probably a stupid configuration mistake on my part which needs fixing before submitting the PR.

Hardware

• SoC: Mediatek MT7981B
• RAM: 256MiB DDR3
• ROM: 16MiB NOR flash (Winbond 25Q128JVSQ)
• Wired: one GbE RJ45 port
• Wireless: Mediatek MT7976CN DBDC
• Antennas: Internal (two 2.4 GHz 4.5 dBi, three 5 GHz 6 dBi)
• GPIO: two blue LEDs, one reset button
• Power: DC5521 (12V) or 802.3af PoE (48V 0.3A)
• UART: J500 on PCB [3v3] (Rx) (Tx) (Gnd), 115200n

MTD partitions

(from UART log)

[    0.459902] spi-nor spi0.0: w25q128 (16384 Kbytes)
[    0.464946] 6 fixed-partitions partitions found on MTD device spi0.0
[    0.471314] Creating 6 MTD partitions on "spi0.0":
[    0.476102] 0x000000000000-0x000000040000 : "BL2"
[    0.481238] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.486937] 0x000000050000-0x000000100000 : "Factory"
[    0.492358] 0x000000100000-0x000000180000 : "FIP"
[    0.497442] 0x000000180000-0x000000f00000 : "firmware"
[    0.503034] 2 fit-fw partitions found on MTD device firmware
[    0.508709] 0x000000180000-0x000000400000 : "kernel"
[    0.514064] 0x000000400000-0x000000f00000 : "rootfs"
[    0.519390] mtd: device 6 (rootfs) set to be root filesystem
[    0.525099] 1 squashfs-split partitions found on MTD device rootfs
[    0.531289] 0x000000a50000-0x000000f00000 : "rootfs_data"
[    0.537087] 0x000000ff0000-0x000001000000 : "opt"

FIP contains BL3.1 and U-boot;
kernel is a 5.4.246 linux kernel with embedded DTB;
rootfs is a non-standard SquashFS;
opt contains some strings.

U-Boot

Friendly bootloader allows us basically anything.

U-Boot 2022.04 (Jul 20 2022 - 08:58:25 +0000)

CPU:   MediaTek MT7981
Model: mt7981-rfb
DRAM:  256 MiB
Core:  32 devices, 13 uclasses, devicetree: embed
Loading Environment from nowhere... OK
In:    serial@11002000
Out:   serial@11002000
Err:   serial@11002000
Net:
Warning: ethernet@15100000 (eth0) using random MAC address - a2:fb:d9:1a:50:84
eth0: ethernet@15100000

  *** U-Boot Boot Menu ***

     1. Startup system (Default)
     2. Upgrade firmware
     3. Upgrade ATF BL2
     4. Upgrade ATF FIP
     5. Upgrade single image
     6. Load image
     0. U-Boot console


  Press UP/DOWN to move, ENTER to select, ESC/CTRL+C to quit

Loading initramfs (option 6) via TFTP and via Xmodem works.
Flashing sysupgrade (option 2) works too.

Contents of rootfs

Firmware (both flash dump and downloaded binaries) uses a modified Squashfs format, not identified by existing tools.

$ dd if=wap430x.flashdump of=rootfs bs=64k skip=64 count=101
$ hexdump -C rootfs | head -n20
00000000  68 73 71 73 00 00 04 00  04 00 00 00 01 00 c0 04  |hsqs............|
00000010  ee 17 42 14 00 00 00 00  12 00 4f 3e 04 00 31 5c  |..B.......O>..1\|
00000020  01 16 e5 23 35 f8 a9 bd  3f bd 97 1a ee 9b 94 43  |...#5...?......C|
00000030  a8 4b 64 00 fc 21 87 7b  58 8c e1 0e ed 51 64 03  |.Kd..!.{X....Qd.|
00000040  1b 82 a9 53 71 29 54 4b  63 1b c3 28 98 52 3b 28  |...Sq)TKc..(.R;(|
00000050  0c 80 00 00 04 00 14 00  09 00 90 00 40 00 fd 37  |............@..7|
00000060  7a 58 5a 00 00 01 69 22  de 36 03 c0 ae aa 07 80  |zXZ...i".6......|
00000070  80 10 21 01 0c 00 2e 87  83 22 e2 2c 65 ef ff 6c  |..!......".,e..l|
00000080  00 3f 91 45 84 60 10 82  f6 2d ff 8e e8 af 20 6c  |.?.E.`...-.... l|
00000090  a7 7c 4c e1 6b 11 55 98  b9 bb 0e 55 20 56 27 75  |.|L.k.U....U V'u|
000000a0  6c 81 a7 38 89 2f 67 fd  9a 68 c8 c5 c0 65 0a 79  |l..8./g..h...e.y|
000000b0  c7 ae ba 0f 16 81 79 da  2c 74 16 a3 23 b6 b3 ee  |......y.,t..#...|
000000c0  56 65 cf 5e c9 e4 24 de  b6 19 1e f1 4b b7 c1 92  |Ve.^..$.....K...|
000000d0  f2 82 a5 d4 17 5f 1d 80  88 3d d4 e3 97 ad 7e d2  |....._...=....~.|
000000e0  a2 88 1c ed 28 8c 25 57  44 93 50 4d 5a 41 8f 58  |....(.%WD.PMZA.X|
000000f0  b8 fe a1 82 6d 86 fd fd  33 b8 0a 28 c0 53 6b 5a  |....m...3..(.SkZ|
00000100  df 7c 82 a7 6f 6a 8a d8  8e 3c 71 0d 51 ef cb e8  |.|..oj...<q.Q...|
00000110  f7 6f 66 c5 40 51 50 af  cd 36 8c 35 8f d3 e7 8d  |.of.@QP..6.5....|
00000120  d1 fc 45 fb ab 28 7a c6  fa 0b 01 7c 72 ad 5e 67  |..E..(z....|r.^g|
00000130  74 0a 5a b7 c6 c4 bd 85  eb 05 6c 73 e8 7d c8 2d  |t.Z.......ls.}.-|
$ binwalk rootfs

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
94            0x5E            xz compressed data
120262        0x1D5C6         xz compressed data
205970        0x32492         xz compressed data
300150        0x49476         xz compressed data
358534        0x57886         xz compressed data
458866        0x70072         xz compressed data
570890        0x8B60A         xz compressed data
643334        0x9D106         xz compressed data
694350        0xA984E         xz compressed data
797290        0xC2A6A         xz compressed data
897206        0xDB0B6         xz compressed data
992038        0xF2326         xz compressed data
1083946       0x108A2A        xz compressed data
1180114       0x1201D2        xz compressed data
1261210       0x133E9A        xz compressed data
1359958       0x14C056        xz compressed data
1459986       0x164712        xz compressed data
1541998       0x17876E        xz compressed data
1605718       0x188056        xz compressed data
1661994       0x195C2A        xz compressed data
1708910       0x1A136E        xz compressed data
1710642       0x1A1A32        xz compressed data
1711390       0x1A1D1E        xz compressed data
1712150       0x1A2016        xz compressed data
1715070       0x1A2B7E        xz compressed data
1730634       0x1A684A        xz compressed data
1731430       0x1A6B66        xz compressed data
1732242       0x1A6E92        xz compressed data
1733034       0x1A71AA        xz compressed data
1762926       0x1AE66E        xz compressed data
1818878       0x1BC0FE        xz compressed data
1935854       0x1D89EE        xz compressed data
1974954       0x1E22AA        xz compressed data
2106862       0x2025EE        xz compressed data
2210826       0x21BC0A        xz compressed data
2236142       0x221EEE        xz compressed data
2262430       0x22859E        xz compressed data
2300374       0x2319D6        xz compressed data
2369786       0x2428FA        xz compressed data
2446434       0x255462        xz compressed data
2474158       0x25C0AE        xz compressed data
2501434       0x262B3A        xz compressed data
2528790       0x269616        xz compressed data
2553618       0x26F712        xz compressed data
2580666       0x2760BA        xz compressed data
2605382       0x27C146        xz compressed data
2634770       0x283412        xz compressed data
2643682       0x2856E2        xz compressed data
2694150       0x291C06        xz compressed data
2754202       0x2A069A        xz compressed data
2837178       0x2B4ABA        xz compressed data
2903478       0x2C4DB6        xz compressed data
2981790       0x2D7F9E        xz compressed data
3073158       0x2EE486        xz compressed data
3101478       0x2F5326        xz compressed data
3166238       0x30501E        xz compressed data
3243382       0x317D76        xz compressed data
3272942       0x31F0EE        xz compressed data
3363690       0x33536A        xz compressed data
3476066       0x350A62        xz compressed data
3646410       0x37A3CA        xz compressed data
3741126       0x3915C6        xz compressed data
3846310       0x3AB0A6        xz compressed data
3954250       0x3C564A        xz compressed data
4005242       0x3D1D7A        xz compressed data
4022230       0x3D5FD6        xz compressed data
4057482       0x3DE98A        xz compressed data
4138462       0x3F25DE        xz compressed data
4173630       0x3FAF3E        xz compressed data
4283626       0x415CEA        xz compressed data
4351514       0x42661A        xz compressed data
4426286       0x438A2E        xz compressed data
4508886       0x44CCD6        xz compressed data
4510014       0x44D13E        xz compressed data
4591594       0x460FEA        xz compressed data
4670582       0x474476        xz compressed data
4717902       0x47FD4E        xz compressed data
4749458       0x487892        xz compressed data
4779850       0x48EF4A        xz compressed data
4829514       0x49B14A        xz compressed data
4894450       0x4AAEF2        xz compressed data
4988882       0x4C1FD2        xz compressed data
5091902       0x4DB23E        xz compressed data
5201802       0x4F5F8A        xz compressed data
5288970       0x50B40A        xz compressed data
5325038       0x5140EE        xz compressed data
5396822       0x525956        xz compressed data
6488522       0x6301CA        xz compressed data
6543550       0x63D8BE        xz compressed data
6556384       0x640AE0        xz compressed data
6558154       0x6411CA        xz compressed data
6559928       0x6418B8        xz compressed data
6561570       0x641F22        xz compressed data
6562852       0x642424        xz compressed data
6567394       0x6435E2        xz compressed data
6570440       0x6441C8        xz compressed data
6571586       0x644642        xz compressed data
6571832       0x644738        xz compressed data

$ dd if=JIKEAP_AX3000AM_MT7981_K5_WIFI6_3000M_8.1_2025090700.bin of=rootfs bs=64k skip=40
$ hexdump -C rootfs | head -n20
00000000  68 73 71 73 00 00 04 00  04 00 00 00 01 00 c0 04  |hsqs............|
00000010  32 18 82 14 00 00 00 00  12 00 ea 20 04 00 5d 48  |2.......... ..]H|
00000020  4b 3e 33 58 c6 31 57 43  29 0b d2 24 61 e1 db a2  |K>3X.1WC)..$a...|
00000030  e4 98 65 00 9e c1 58 11  a0 5f 6a 08 70 aa e5 b1  |..e...X.._j.p...|
00000040  36 67 a0 4d e5 07 71 00  a4 5d 5a 1e 0e c2 b5 0f  |6g.M..q..]Z.....|
00000050  0c 80 00 00 04 00 14 00  09 00 90 00 40 00 fd 37  |............@..7|
00000060  7a 58 5a 00 00 01 69 22  de 36 03 c0 f3 a9 07 80  |zXZ...i".6......|
00000070  80 10 21 01 0c 00 13 b6  e4 57 e2 2c 5b ef fe 6c  |..!......W.,[..l|
00000080  00 3f 91 45 84 60 10 82  f6 2d ff 8e e8 af 20 6c  |.?.E.`...-.... l|
00000090  a7 7c 4c e1 6b 11 55 98  b9 bb 0e 55 20 56 27 75  |.|L.k.U....U V'u|
000000a0  6c 81 a7 38 89 2f 67 fd  9a 68 c8 c5 c0 65 0a 79  |l..8./g..h...e.y|
000000b0  c7 ae ba 0f 16 81 79 da  2c 74 16 a3 23 b6 b3 ee  |......y.,t..#...|
000000c0  67 64 cd 6f 4d 89 93 a5  81 54 69 3d 6d 8e 56 8d  |gd.oM....Ti=m.V.|
000000d0  d1 68 be bd a9 14 5b 4e  58 c6 19 e8 bf b2 1e 01  |.h....[NX.......|
000000e0  ec 60 d3 df f1 7a 27 0d  9f 9c db d4 23 b0 59 83  |.`...z'.....#.Y.|
000000f0  d9 b2 12 3f 30 22 b1 e1  3f a7 96 aa 46 02 88 d1  |...?0"..?...F...|
00000100  cb 49 e3 08 d9 22 7d 73  76 86 4e cf 10 51 69 53  |.I..."}sv.N..QiS|
00000110  9c 71 6a c6 6a 85 55 42  39 49 40 fa 20 da e0 0b  |.qj.j.UB9I@. ...|
00000120  02 f1 e2 35 6c 51 93 1d  88 a4 99 29 bb da 37 eb  |...5lQ.....)..7.|
00000130  38 76 c2 83 48 73 12 88  3f 19 6f d3 41 98 d4 4d  |8v..Hs..?.o.A..M|
$ binwalk rootfs

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
94            0x5E            xz compressed data
120202        0x1D58A         xz compressed data
205910        0x32456         xz compressed data
300058        0x4941A         xz compressed data
361610        0x5848A         xz compressed data
461942        0x70C76         xz compressed data
573966        0x8C20E         xz compressed data
647970        0x9E322         xz compressed data
698986        0xAAA6A         xz compressed data
802906        0xC405A         xz compressed data
903294        0xDC87E         xz compressed data
996806        0xF35C6         xz compressed data
1090842       0x10A51A        xz compressed data
1186542       0x121AEE        xz compressed data
1268046       0x13594E        xz compressed data
1368146       0x14E052        xz compressed data
1468802       0x166982        xz compressed data
1550222       0x17A78E        xz compressed data
1613414       0x189E66        xz compressed data
1670094       0x197BCE        xz compressed data
1714382       0x1A28CE        xz compressed data
1715594       0x1A2D8A        xz compressed data
1716382       0x1A309E        xz compressed data
1717146       0x1A339A        xz compressed data
1723150       0x1A4B0E        xz compressed data
1738794       0x1A882A        xz compressed data
1739558       0x1A8B26        xz compressed data
1740326       0x1A8E26        xz compressed data
1741150       0x1A915E        xz compressed data
1779946       0x1B28EA        xz compressed data
1834194       0x1BFCD2        xz compressed data
1952526       0x1DCB0E        xz compressed data
1984310       0x1E4736        xz compressed data
2124394       0x206A6A        xz compressed data
2221258       0x21E4CA        xz compressed data
2247978       0x224D2A        xz compressed data
2280762       0x22CD3A        xz compressed data
2311694       0x23460E        xz compressed data
2384450       0x246242        xz compressed data
2459782       0x258886        xz compressed data
2487122       0x25F352        xz compressed data
2514350       0x265DAE        xz compressed data
2541586       0x26C812        xz compressed data
2566254       0x27286E        xz compressed data
2593606       0x279346        xz compressed data
2618882       0x27F602        xz compressed data
2648410       0x28695A        xz compressed data
2656286       0x28881E        xz compressed data
2706754       0x294D42        xz compressed data
2766838       0x2A37F6        xz compressed data
2849814       0x2B7C16        xz compressed data
2915454       0x2C7C7E        xz compressed data
2993766       0x2DAE66        xz compressed data
3085134       0x2F134E        xz compressed data
3113454       0x2F81EE        xz compressed data
3180930       0x308982        xz compressed data
3258074       0x31B6DA        xz compressed data
3287634       0x322A52        xz compressed data
3378382       0x338CCE        xz compressed data
3490758       0x3543C6        xz compressed data
3661102       0x37DD2E        xz compressed data
3755818       0x394F2A        xz compressed data
3861002       0x3AEA0A        xz compressed data
3968802       0x3C8F22        xz compressed data
4019794       0x3D5652        xz compressed data
4036782       0x3D98AE        xz compressed data
4076150       0x3E3276        xz compressed data
4157130       0x3F6ECA        xz compressed data
4192298       0x3FF82A        xz compressed data
4302294       0x41A5D6        xz compressed data
4370182       0x42AF06        xz compressed data
4444954       0x43D31A        xz compressed data
4527554       0x4515C2        xz compressed data
4528682       0x451A2A        xz compressed data
4610198       0x465896        xz compressed data
4689226       0x478D4A        xz compressed data
4736546       0x484622        xz compressed data
4768102       0x48C166        xz compressed data
4798494       0x49381E        xz compressed data
4848030       0x49F99E        xz compressed data
4889906       0x4A9D32        xz compressed data
4933294       0x4B46AE        xz compressed data
5027726       0x4CB78E        xz compressed data
5130734       0x4E49EE        xz compressed data
5240594       0x4FF712        xz compressed data
5327730       0x514B72        xz compressed data
5364114       0x51D992        xz compressed data
5435898       0x52F1FA        xz compressed data
6573730       0x644EA2        xz compressed data
6628758       0x652596        xz compressed data
6641592       0x6557B8        xz compressed data
6643394       0x655EC2        xz compressed data
6645192       0x6565C8        xz compressed data
6646842       0x656C3A        xz compressed data
6648140       0x65714C        xz compressed data
6652674       0x658302        xz compressed data
6655688       0x658EC8        xz compressed data
6656866       0x659362        xz compressed data
6657120       0x659460        xz compressed data

Contents of opt

$ tail -c 61440 wap430x.rom | strings
699010842e23c766
<pac>127.0.0.1</pac>
<en>no</en><id>HelloWorld</id><ro>RE</ro><dv>mt7981e2</dv>>>
config_str>eJzNUrFOwzAU/BfPATWhhZatsHRCDEgMCCHXfkms2n6RbdpEVf6d91JLRIgZkcl3vjv7nXMWGo5eOhD3QhTC1FLR8u3MtFHwYbyGXtwvCpGMgyB9k5VOqg6tUQNBrGtiPNYYTjJoYhaETwAHLYeYkyNamSDv5fR88KqZAnsZIyrCyzXho5X+Yq2tbLIvRsPxNdDJ6Nz2+Wpzc/fAgSbKvYXDMWQl3c+amC4JrdEafN45AN95nT8iwKswdMkgKzx6EGPxtwVU18t/V8F7IQJKl4JpGuDIq3LBXujT8uP7ZgRvZnBanEUXMCExulUdtSnkZ8IAe8SUb0C2amZzg+zY90M3TsKZrnEQWxaC51mJHCCyn2iqlLBLd5t1CVUmp652YC2+YrBa8FCT73H7zPGXd+DE6Q34z099hyeeuKwKoVrpPVgylBzZJoea7buXisdQ+OlT4DIfn6bKVj8yponEPCcTs6Ty9peocfwCg8caBQ==</config_str>

config_str is a Base64 encoded, zlib compressed JSON:

$ tail -c 61440 wap430x.rom | strings -n100 | cut -b 12-503 | base64 -d | pigz -dz | jq
{
  "devname": "",
  "iface": [
    {
      "device_index": 0,
      "timerange": "",
      "macpolicy": "off",
      "noforward": "0",
      "weekdays": "",
      "isolate": "0",
      "device_name": "5g",
      "maxassoc": "48",
      "vlan": "",
      "flag": "0",
      "ssid": "felicommAP-xxx7",  # redacted
      "disablekvr": "0",
      "maclist": "",
      "hidden": "0",
      "key": "zzzzzzzz", # redacted
      "encryption": "none"
    },
    {
      "device_index": 0,
      "timerange": "",
      "macpolicy": "off",
      "noforward": "0",
      "weekdays": "",
      "isolate": "0",
      "device_name": "2.4g",
      "maxassoc": "48",
      "vlan": "",
      "flag": "0",
      "ssid": "felicommAP-xxx7", # redacted
      "disablekvr": "0",
      "maclist": "",
      "hidden": "0",
      "key": "zzzzzzzz", # redacted
      "encryption": "none"
    }
  ],
  "roamtrigger": "-100",
  "ext4_vlan": "",
  "ext3_vlan": "",
  "lan": {
    "proto": "dhcp"
  },
  "autoreboot": "0",
  "ext2_vlan": "",
  "myap": {
    "autoreboot": "0"
  },
  "ext_vlan": "",
  "gmesh": {
    "enable": "yes",
    "meshdev": "mt7981e2",
    "meshid": "HelloWorld",
    "role": "CAP"
  },
  "device": {
    "2.4g": [
      {
        "txpower": 12,
        "channel": "12",
        "htmode": "HT20",
        "country": "CN"
      }
    ],
    "5g": [
      {
        "txpower": "auto",
        "channel": "auto",
        "htmode": "HT160",
        "country": "CN"
      }
    ]
  }
}

Original firmware

GECOOS 8.0_2024081000, a fork of OpenWrt created by Widelantech.

NAME="GECOOSAP"
VERSION="21.02-SNAPSHOT"
ID="gecoosap"
ID_LIKE="lede openwrt"
PRETTY_NAME="GECOOSAP 21.02-SNAPSHOT"
VERSION_ID="21.02-snapshot"
HOME_URL="https://openwrt.org/"
BUG_URL="https://bugs.openwrt.org/"
SUPPORT_URL="https://forum.openwrt.org/"
BUILD_ID="r0-16f7f8f"
OPENWRT_BOARD="mediatek/mt7981"
OPENWRT_ARCH="aarch64_cortex-a53"
OPENWRT_TAINTS="no-all busybox"
OPENWRT_DEVICE_MANUFACTURER="GECOOSAP"
OPENWRT_DEVICE_MANUFACTURER_URL="https://openwrt.org/"
OPENWRT_DEVICE_PRODUCT="Generic"
OPENWRT_DEVICE_REVISION="v0"
OPENWRT_RELEASE="GECOOSAP 21.02-SNAPSHOT r0-16f7f8f"

The only accessible ports are 80 (redirecting to 443) and 443 (web management). In particular, Telnet and SSH are disabled.

UART console displays some information (in Chinese) and allows few basic options (no root access sadly).

UART console

  欢迎使用集客无线AP系统 [已注册] (已运行3小时3分6秒)
  =========================================================================

    设备型号 : UAP200               版本号   : 8.1_2025090700      

    IP/掩码  : 0.0.0.0/24           AC控制器 : 127.0.0.1           
    网关     : 0.0.0.0              MAC地址  : D8:2D:9B:xx:xx:x7   
    DNS地址  : 

    射频1    : 5G - 157频道 - DA:2D:9B:xx:xx:x9
               [ WiFi6AP-xxx7 ]   [ zzzzzzzz ]   [ 无VLAN ]   [ 不隐藏 ]
    射频2    : 2.4G - 9频道 - D8:2D:9B:xx:xx:x9
  =========================================================================

    1) 重启本设备
    2) 重置WEB管理密码
    3) 恢复出厂设置
    4) 固件在线升级

Translation (via Google Lens):

  Welcome to use the Jike Wireless AP System [Registered] (Running for 3 hours 3 minutes 6 seconds)
  =========================================================================

    Equipment model : UAP200               Version number   : 8.0_2024102100

    IP/netmask  : 0.0.0.0/24           AC controller : 127.0.0.1           
    Gateway      : 0.0.0.0              MAC address  : D8:2D:9B:xx:xx:x7   
    DNS address  : 

    RF1    : 5G - channel 157 - DA:2D:9B:xx:xx:x9
               [ WiFi6AP-xxx7 ]   [ zzzzzzzz ]   [ no VLAN ]   [ not hidden ]
    RF2    : 2.4G - channel 9 - D8:2D:9B:xx:xx:x9
  =========================================================================

    1) Restart the device
    2) Reset the web management password
    3) Restore factory settings
    4) Firmware online upgrade

Firmware upgrade via UART

Selecting option 4 from the menu makes it display the message:

===============================
    升级后系统将自动重启
    请输入升级包地址:

which translates to

The system will automatically restart after the upgrade.
Please enter the upgrade package address: 

After not responding for a minute, it displays

升级失败, 请输入http://开头的地址

which translates to

Upgrade failed, please enter the address starting with http://

Firmware upgrade via Web

GECOOS management webpage is accessible at https://6.6.6.6/ (WTF).
It is very polished IMHO, and there's an option to upload a firmware update file at https://6.6.6.6/#/system/sysupgrade.

Installing AX3000AM firmware from here works fine; I couldn't locate an official WAP430X firmware.

Firmware binary resembles an OpenWrt sysupgrade with a 70-byte footer:

<GMFOOTER><finger>5a44ed017f2969074322161aa58af87d</finger></GMFOOTER>

Most likely an MD5 digest, but not sure of what exactly (it's not a digest of the rest of the binary file). Trying to flash the firmware binary without the footer results in the following error:

The upgrade is not a valid UAP200 upgrade file![Failed to read firmware FOOTER]

Trying to flash an OpenWrt sysupgrade (with or without a footer) results in the following error:

The upgrade is not a valid UAP200 upgrade file![Failed to read firmware image file]

Maybe it's the non-compatible SquashFS? any help is appreciated here.

Conclusion

Web interface cannot be used to flash OpenWrt, unless either modified SquashFS is understood, or some web exploit allows SSH access.
The web interface itself seems solid, but perhaps there's some exploit of uhttpd 2015-11-08pac (maybe CVE-2019-19945?)

[brada4]

Set up netcat listening on port 80 and check the “online” things activity on th€ wire.

What does nmap -A say?

If you press 0 or 5 for 4 do you get uboot console?

Try squash tools from opemwrt build tree or squashfs-tools-ng (debian has them)

[raenye]

Thanks for the suggestions, but I believe I answered most of these in the (long...) text above.

@brada4

If you press 0 or 5 for 4 do you get uboot console?

After GECOOS has booted, it seems impossible to get to shell via UART console, but U-boot console (before FW boot) is accessible via menu option 5, and you can do everything there, including writing firmware (OpenWrt or GECOOS).

That way I managed to install OpenWrt on my device, but the current goal is to find a UART-less installation method.

@brada4

Set up netcat listening on port 80 and check the “online” things activity on th€ wire.

Not sure I understand your suggestion here.
Is this about the firmware upgrade from GECOOS UART console asking for an HTTP URL?
I have never connected this AP to the internet (and I prefer not to do so), but I guess I can* connect it to an air-gapped network, set up an HTTP server, and tcpdump the communication;
I suspect it simply requests the file from the webserver via curl/wget, which gets us nowhere unless there's some mistake in the code processing the URL.
*EDIT: I tested it; the HTTP request contains User-Agent: uclient-fetch.

Anyway, this is not going to get us a UART-less installation method, since Web UI upgrade only accepts a local file. Moreover, given UART access, U-boot is the way to go and there's no need for GECOOS console.

@brada4

Try squash tools from opemwrt build tree or squashfs-tools-ng (debian has them)

Alas, this is a non-standard SquashFS variant:

$ sqfscat wap430x_rootfs /etc/banner
FATAL ERROR: Can't find a valid SQUASHFS superblock on wap430x_rootfs

cf.

$ sqfscat openwrt_root.squashfs /etc/banner
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt SNAPSHOT, r0+31355-46d19f5253
 -----------------------------------------------------

@brada4

What does nmap -A say?

Only TCP ports 80 and 443 are open.

Initiating SYN Stealth Scan at 17:14
Scanning 6.6.6.6 [65535 ports]
Discovered open port 443/tcp on 6.6.6.6
Discovered open port 80/tcp on 6.6.6.6
Completed SYN Stealth Scan at 17:14, 3.93s elapsed (65535 total ports)

Port 80 redirects to HTTPS:

HTTP/1.1 302 Moved Temporarily
Server: uhttpd 2015-11-08pac
Date: Sun, 07 Sep 2025 20:43:44 GMT
Content-Type: text/html
Content-Length: 153
Connection: close
Location: https://127.0.0.1
<html>
<head><title>302 Found</title></head>
<body>
<center><h1>302 Found</h1></center>
<hr><center>uhttpd 2015-11-08pac</center>
</body>
</html>

whereas port 443 serves the web management UI:

HTTP/1.1 200 OK
Server: uhttpd 2015-11-08pac
Date: Sun, 07 Sep 2025 20:43:50 GMT
Content-Type: text/html
Content-Length: 546
Last-Modified: Wed, 03 Sep 2025 16:29:38 GMT
Connection: close
Vary: Accept-Encoding
ETag: "68b86cf2-222"
Accept-Ranges: bytes
<!DOCTYPE html>
<html lang="en">
<head>
<!--GECOOS-2025931627-->
<meta charset="UTF-8">
<link rel="icon" href="./b023142399bd6f8caae78afa673eb3d6.ico">
<meta name="google" content="notranslate">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title></title>
<script type="module" crossorigin src="./assets/index-abec4a21.js"></script>
<link rel="stylesheet" href="./assets/index-4a17d5e7.css">
</head>
<body>
<div id="app" style="overflow: hidden;"></div>
</body>
</html>

(nitpicking: dates don't match since I tested this with a newer GECOOS firmware)

[raenye]

Some more info about problem #2.

EDIT: solved this by updating base-files/lib/upgrade/platform.sh.
The generic_shutdown_super crash remains, but sysupgrade now works too and I can create the PR.

I performed a sysupgrade with serial attached, and got this:

- watchdog -
Watchdog does not have CARDRESET support
Sat Oct 11 22:54:53 UTC 2025 upgrade: Sending TERM to remaining processes ...
Sat Oct 11 22:54:57 UTC 2025 upgrade: Sending KILL to remaining processes ...
[  296.879827] stage2 (5070): drop_caches: 3
Sat Oct 11 22:55:03 UTC 2025 upgrade: Switching to ramdisk...
mount: mounting /dev/mtdblock7 on /overlay failed: Resource busy
[  298.097822] ------------[ cut here ]------------
[  298.102443] VFS: Busy inodes after unmount of jffs2 (jffs2)
[  298.102461] WARNING: CPU: 0 PID: 5070 at generic_shutdown_super+0xf0/0x160
[  298.114890] Modules linked in: nft_fib_inet nf_flow_table_inet nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack_netlink nf_conntrack mt7915e(O) mt76_connac_lib(O) mt76(O) mac80211(O) cfg80211(O) nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c compat(O) crypto_safexcel sha512_arm64 sha1_ce sha1_generic seqiv md5 geniv des_generic libdes authencesn authenc leds_gpio gpio_button_hotplug(O)
[  298.170643] CPU: 0 UID: 0 PID: 5070 Comm: busybox Tainted: G           O       6.12.50 #0
[  298.178809] Tainted: [O]=OOT_MODULE
[  298.182285] Hardware name: Widelantech WAP430X (DT)
[  298.187150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[  298.194099] pc : generic_shutdown_super+0xf0/0x160
[  298.198883] lr : generic_shutdown_super+0xf0/0x160
[  298.203665] sp : ffffffc085cc3d20
[  298.206967] x29: ffffffc085cc3d20 x28: ffffff80015ff000 x27: 0000000000000000
[  298.214095] x26: 0000000000000000 x25: 0000000000000000 x24: ffffffc080d19410
[  298.221223] x23: 0000000000000000 x22: 0000000000000001 x21: ffffff80015ff734
[  298.228350] x20: ffffff800421c548 x19: ffffff800421c000 x18: ffffffc080c3ebd8
[  298.235479] x17: 0000000000000000 x16: 0000000000000001 x15: 00000000000000cc
[  298.242606] x14: 00000000000000cc x13: 00000000ffffffea x12: ffffffc080c96b80
[  298.249734] x11: ffffffc080c3ebd8 x10: ffffffc080c96bd8 x9 : 0000000000000001
[  298.256862] x8 : 0000000000000001 x7 : 0000000000017fe8 x6 : c0000000ffffefff
[  298.263989] x5 : 0000000000057fa8 x4 : 0000000000000000 x3 : ffffffc085cc3b00
[  298.271116] x2 : ffffffc080c3eb00 x1 : ffffffc080c3eb00 x0 : 000000000000002f
[  298.278244] Call trace:
[  298.280680]  generic_shutdown_super+0xf0/0x160
[  298.285116]  kill_mtd_super+0x14/0x2c
[  298.288773]  jffs2_kill_sb+0x4c/0x60
[  298.292342]  deactivate_locked_super+0x4c/0xf8
[  298.296777]  deactivate_super+0x68/0x7c
[  298.300606]  cleanup_mnt+0x98/0x128
[  298.304087]  __cleanup_mnt+0x10/0x18
[  298.307653]  task_work_run+0x9c/0xe0
[  298.311221]  do_notify_resume+0xf4/0x100
[  298.315134]  el0_svc+0x44/0x60
[  298.318182]  el0t_64_sync_handler+0x118/0x124
[  298.322531]  el0t_64_sync+0x150/0x154
[  298.326182] ---[ end trace 0000000000000000 ]---
Sat Oct 11 22:55:05 UTC 2025 upgrade: Performing system upgrade...
[  298.796007] ubi0: default fastmap pool size: 8
[  298.800453] ubi0: default fastmap WL pool size: 4
[  298.805146] ubi0: attaching mtd6
[  298.850503] ubi0: scanning is finished
[  298.854268] ubi0 error: ubi_read_volume_table: the layout volume was not found
[  298.861525] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd6, error -22
ubiattach: error!: cannot attach mtd6
           error 22 (Invalid argument)
ubiformat: mtd6 (nor), size 10682368 bytes (10.1 MiB), 163 eraseblocks of 65536 bytes (64.0 KiB), min. I/O size 1 bytes
ubiformat: formatting eraseblock 162 -- 100 % complete
[  337.223214] ubi0: default fastmap pool size: 8
[  337.227684] ubi0: default fastmap WL pool size: 4
[  337.232378] ubi0: attaching mtd6
[  337.280474] ubi0: scanning is finished
[  337.286663] ubi0: attached mtd6 (name "rootfs", size 10 MiB)
[  337.292326] ubi0: PEB size: 65536 bytes (64 KiB), LEB size: 65408 bytes
[  337.298941] ubi0: min./max. I/O unit sizes: 1/256, sub-page size 1
[  337.305108] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[  337.311628] ubi0: good PEBs: 163, bad PEBs: 0, corrupted PEBs: 0
[  337.317627] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 128
[  337.324836] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2051940086
[  337.333957] ubi0: available PEBs: 157, total reserved PEBs: 6, PEBs reserved for bad PEB handling: 0
[  337.343087] ubi0: background thread "ubi_bgt0d" started, PID 5781
UBI device number 0, total 163 LEBs (10661504 bytes, 10.1 MiB), available 157 LEBs (10269056 bytes, 9.7 MiB), LEB size 65408 bytes (63.8 KiB)
Volume ID 0, size 17 LEBs (1111936 bytes, 1.0 MiB), LEB size 65408 bytes (63.8 KiB), dynamic, name "ubootenv", alignment 1
Volume ID 1, size 17 LEBs (1111936 bytes, 1.0 MiB), LEB size 65408 bytes (63.8 KiB), dynamic, name "ubootenv2", alignment 1
[  338.458723] ubi0 error: ubi_create_volume: not enough PEBs, only 123 available
[  338.466000] ubi0 error: ubi_create_volume: cannot create volume 2, error -28
ubimkvol: error!: cannot UBI create volume
          error 28 (No space left on device)
cannot create kernel volume
sysupgrade failed
umount: can't unmount [  338.485570] reboot: Restarting system

Why sysupgrade tries to go ubi? it's a NOR device...

EDIT: see solution above

OpenWrt MTD partitions (before the upgrade) were:

# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00040000 00010000 "BL2"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00010000 00010000 "Factory"
mtd3: 00080000 00010000 "FIP"
mtd4: 00e70000 00010000 "firmware"
mtd5: 00440000 00010000 "kernel"
mtd6: 00a30000 00010000 "rootfs"
mtd7: 00170000 00010000 "rootfs_data"
mtd8: 00010000 00010000 "opt"

Device definitions in filogic.mk say nothing about UBI:

define Device/widelantech_wap430x
  DEVICE_VENDOR := Widelantech
  DEVICE_MODEL := WAP430X
  DEVICE_DTS := mt7981b-widelantech-wap430x
  DEVICE_DTS_DIR := ../dts
  DEVICE_DTS_LOADADDR := 0x47000000
  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
  IMAGES := sysupgrade.bin
  IMAGE_SIZE := 14336k
  KERNEL := kernel-bin | lzma | \
        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
  KERNEL_INITRAMFS := kernel-bin | lzma | \
        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
  IMAGE/sysupgrade.bin := append-kernel | pad-to 128k | append-rootfs | pad-rootfs | check-size | append-metadata
endef
TARGET_DEVICES += widelantech_wap430x

---

I also did some investigation of the modified SquashFS.
Out of 6 pointers to tables that the standard superblock contains, there is only one in the GECOOS superblock (seems to point to the NFS export table).
XZ-compressed data and metadata blocks decompress fine to 256KiB and 8KiB blocks, and probably the directory structure and inode structure is recoverable.

Nevertheless, there is a big chunk (~1MiB) between data blocks and metadata blocks that is not XZ-compressed, and I don't understand what it is. The first few bytes of it are:

0053d9c0                    22 f2  15 5d 83 6d 85 59 69 b8        |"..].m.Yi.|
0053d9d0  50 60 4d 5d b9 37 1c 66  14 47 4a ff 9c df 67 8c  |P`M].7.f.GJ...g.|
0053d9e0  18 a3 91 28 a7 2d 54 07  55 51 2b 49 fa b1 1e c0  |...(.-T.UQ+I....|
0053d9f0  d8 e2 84 0c 5b 8b 43 6d  a6 30 27 40 cf c8 d3 57  |....[.Cm.0'@...W|
0053da00  65 e9 cf 77 69 df 8c 73  04 a1 80 a2 18 1e 35 89  |e..wi..s......5.|
0053da10  b7 9d 3c 71 d5 01 58 c7  64 b9 51 d3 9d da f7 64  |..<q..X.d.Q....d|
0053da20  6f a7 59 84 6c d0 ac 38  5a 2d 41 ba 58 74 9c 85  |o.Y.l..8Z-A.Xt..|
0053da30  c4 6e 5f 10 e3 ab 87 dc  c4 ea 9b 18 d1 3f f3 0e  |.n_..........?..|
0053da40  0a 67 98 64 85 4d 1f 63  86 2e 98 a2 7e fc 4c fb  |.g.d.M.c....~.L.|
0053da50  ee 30 7f 7d 84 68 c3 94  1c d1 f7 cd 39 6f 2f 4e  |.0.}.h......9o/N|
0053da60  06 74 33 09 a8 9e 77 5c  48 b7 14 25 d1 6a 07 b2  |.t3...w\H..%.j..|

EDIT: by hardcoding a superblock in list-files example from squashfs-tools-ng, I was able to extract the rootfs contents. Sadly, dropbear binary is not present (although its configuration files are there) but maybe it'd be possible to inject one using configuration backup/restore.

/
├─ bin
│  ├─ ash ⭢ BB
│  ├─ board_detect
│  ├─ busybox
│  ├─ cat ⭢ BB
│  ├─ chgrp ⭢ BB
│  ├─ chmod ⭢ BB
│  ├─ chown ⭢ BB
│  ├─ config_generate
│  ├─ cp ⭢ BB
│  ├─ date ⭢ BB
│  ├─ dd ⭢ BB
│  ├─ df ⭢ BB
│  ├─ dmesg ⭢ BB
│  ├─ echo ⭢ BB
│  ├─ egrep ⭢ BB
│  ├─ false ⭢ BB
│  ├─ fgrep ⭢ BB
│  ├─ fsync ⭢ BB
│  ├─ grep ⭢ BB
│  ├─ gunzip ⭢ BB
│  ├─ gzip ⭢ BB
│  ├─ ipcalc.sh
│  ├─ kill ⭢ BB
│  ├─ ln ⭢ BB
│  ├─ lock ⭢ BB
│  ├─ login ⭢ BB
│  ├─ ls ⭢ BB
│  ├─ mkdir ⭢ BB
│  ├─ mknod ⭢ BB
│  ├─ mktemp ⭢ BB
│  ├─ mount ⭢ BB
│  ├─ mpstat ⭢ BB
│  ├─ mv ⭢ BB
│  ├─ netmsg ⭢ BB
│  ├─ netstat ⭢ BB
│  ├─ nice ⭢ BB
│  ├─ oem.lua
│  ├─ passwd ⭢ BB
│  ├─ pidof ⭢ BB
│  ├─ ping ⭢ BB
│  ├─ ping6 ⭢ BB
│  ├─ ps ⭢ BB
│  ├─ pwd ⭢ BB
│  ├─ rm ⭢ BB
│  ├─ rmdir ⭢ BB
│  ├─ sed ⭢ BB
│  ├─ sh ⭢ BB
│  ├─ sleep ⭢ BB
│  ├─ sync ⭢ BB
│  ├─ tar ⭢ BB
│  ├─ touch ⭢ BB
│  ├─ traceroute ⭢ BB
│  ├─ traceroute6 ⭢ BB
│  ├─ true ⭢ BB
│  ├─ trun
│  ├─ ubus
│  ├─ uclient-fetch
│  ├─ umount ⭢ BB
│  ├─ uname ⭢ BB
│  ├─ vi ⭢ BB
│  └─ zcat ⭢ BB
├─ dev
│  └─ console
├─ etc
│  ├─ ARM
│  ├─ TZ ⭢ /tmp/TZ
│  ├─ banner
│  ├─ board.d
│  │  ├─ 01_led
│  │  └─ 02_network
│  ├─ cert
│  ├─ config
│  │  ├─ gmesh
│  │  ├─ luci
│  │  └─ system
│  ├─ crontabs
│  ├─ daemon
│  ├─ device_info
│  ├─ diag.sh
│  ├─ dnsmasq.conf
│  ├─ dropbear
│  │  └─ dropbear_rsa_host_key
│  ├─ ethers
│  ├─ fstab
│  ├─ gecoos
│  ├─ group
│  ├─ hosts
│  ├─ hotplug-preinit.json
│  ├─ hotplug.d
│  │  ├─ block
│  │  │  ├─ 00-media-change
│  │  │  └─ 10-mount
│  │  ├─ bridge
│  │  │  └─ 00-dhcp.sh
│  │  ├─ iface
│  │  │  └─ 00-netstate
│  │  └─ net
│  │     ├─ 00-sysctl
│  │     ├─ 01-addvlanPID
│  │     ├─ 02-dhcpallow
│  │     └─ 20-smp-packet-steering
│  ├─ hotplug.json
│  ├─ init.d
│  │  ├─ apreport
│  │  ├─ boot
│  │  ├─ cron
│  │  ├─ dnsmasq
│  │  ├─ done
│  │  ├─ fstab
│  │  ├─ gpio_switch
│  │  ├─ led
│  │  ├─ log
│  │  ├─ network
│  │  ├─ nginx
│  │  ├─ sfp
│  │  ├─ sysctl
│  │  ├─ sysfixtime
│  │  ├─ system
│  │  └─ umount
│  ├─ inittab
│  ├─ iproute2
│  │  ├─ ematch_map
│  │  ├─ rt_protos
│  │  └─ rt_tables
│  ├─ jikeap_release
│  ├─ localtime ⭢ /tmp/localtime
│  ├─ macfilter
│  ├─ modules-boot.d
│  │  ├─ 02-crypto-hash ⭢ ../modules.d/02-crypto-hash
│  │  ├─ 09-crypto-aead ⭢ ../modules.d/09-crypto-aead
│  │  ├─ 09-crypto-manager ⭢ ../modules.d/09-crypto-manager
│  │  ├─ 10-conninfra ⭢ ../modules.d/10-conninfra
│  │  ├─ 30-gpio-button-hotplug ⭢ ../modules.d/30-gpio-button-hotplug
│  │  └─ 60-leds-gpio ⭢ ../modules.d/60-leds-gpio
│  ├─ modules.d
│  │  ├─ 02-crypto-hash
│  │  ├─ 09-crypto-aead
│  │  ├─ 09-crypto-arc4
│  │  ├─ 09-crypto-ecb
│  │  ├─ 09-crypto-manager
│  │  ├─ 09-crypto-null
│  │  ├─ 09-crypto-sha1
│  │  ├─ 10-conninfra
│  │  ├─ 30-gpio-button-hotplug
│  │  ├─ 60-leds-gpio
│  │  ├─ lib-crc-ccitt
│  │  └─ mt7981e
│  ├─ mtab ⭢ /proc/mounts
│  ├─ nginx
│  │  ├─ conf.d
│  │  ├─ koi-utf
│  │  ├─ koi-win
│  │  ├─ mime.types
│  │  ├─ nginx.conf
│  │  └─ win-utf
│  ├─ opkg
│  │  └─ distfeeds.conf
│  ├─ os-release ⭢ ../usr/lib/os-release
│  ├─ passwd
│  ├─ preinit
│  ├─ profile
│  ├─ protocols
│  ├─ rc.button
│  │  ├─ power
│  │  ├─ reset
│  │  └─ rfkill
│  ├─ rc.common
│  ├─ rc.d
│  │  ├─ K10gpio_switch ⭢ ../init.d/gpio_switch
│  │  ├─ K89log ⭢ ../init.d/log
│  │  ├─ K90boot ⭢ ../init.d/boot
│  │  ├─ K90network ⭢ ../init.d/network
│  │  ├─ K90sysfixtime ⭢ ../init.d/sysfixtime
│  │  ├─ K90umount ⭢ ../init.d/umount
│  │  ├─ S00sysfixtime ⭢ ../init.d/sysfixtime
│  │  ├─ S10boot ⭢ ../init.d/boot
│  │  ├─ S10system ⭢ ../init.d/system
│  │  ├─ S11sysctl ⭢ ../init.d/sysctl
│  │  ├─ S12log ⭢ ../init.d/log
│  │  ├─ S20network ⭢ ../init.d/network
│  │  ├─ S40fstab ⭢ ../init.d/fstab
│  │  ├─ S50cron ⭢ ../init.d/cron
│  │  ├─ S83sfp ⭢ ../init.d/sfp
│  │  ├─ S94gpio_switch ⭢ ../init.d/gpio_switch
│  │  ├─ S95done ⭢ ../init.d/done
│  │  ├─ S96led ⭢ ../init.d/led
│  │  ├─ S98dnsmasq ⭢ ../init.d/dnsmasq
│  │  ├─ S99apreport ⭢ ../init.d/apreport
│  │  └─ S99nginx ⭢ ../init.d/nginx
│  ├─ rc.local
│  ├─ resolv.conf ⭢ /tmp/resolv.conf
│  ├─ services
│  ├─ shadow
│  ├─ shells
│  ├─ shinit
│  ├─ ssl
│  │  ├─ certs
│  │  ├─ openssl.cnf
│  │  └─ private
│  ├─ sysctl.conf
│  ├─ sysctl.d
│  │  ├─ 10-default.conf
│  │  └─ 99-min-free-kbytes.conf
│  ├─ sysupgrade.conf
│  ├─ uci-defaults
│  │  ├─ 10-fstab
│  │  ├─ 10_migrate-shadow
│  │  ├─ 12_network-generate-ula
│  │  ├─ 13_fix-group-user
│  │  └─ 14_migrate-dhcp-release
│  ├─ udhcpc.user
│  ├─ udhcpc.user.d
│  └─ wireless
│     └─ mt7981e
│        ├─ l1profile.dat
│        ├─ l1profile.dat.dbdc
│        ├─ l1profile.dat.single
│        ├─ mt7981-sku-bf.dat
│        ├─ mt7981-sku.dat
│        ├─ mt7981.1.dat
│        ├─ mt7981.2.dat
│        ├─ mt7981.dbdc.b0.dat
│        ├─ mt7981.dbdc.b1.dat
│        └─ test-mode-switch.sh
├─ lib
│  ├─ config
│  │  └─ uci.sh
│  ├─ firmware
│  │  ├─ EthMD32.DSP.bin
│  │  ├─ EthMD32.dm.bin
│  │  ├─ MT7981_ePAeLNA_EEPROM.bin
│  │  ├─ MT7981_iPAiLNA_EEPROM.bin
│  │  └─ e2p ⭢ /tmp/e2p
│  ├─ functions
│  │  ├─ apspec.sh
│  │  ├─ caldata.sh
│  │  ├─ leds.sh
│  │  ├─ migrations.sh
│  │  ├─ network.sh
│  │  ├─ preinit.sh
│  │  ├─ procd.sh
│  │  ├─ service.sh
│  │  ├─ system.sh
│  │  └─ uci-defaults.sh
│  ├─ functions.sh
│  ├─ ld-musl-aarch64.so.1 ⭢ libc.so
│  ├─ libblkid-tiny.so
│  ├─ libblobmsg_json.so.20210516
│  ├─ libc.so
│  ├─ libfstools-bootparam.so
│  ├─ libfstools.so
│  ├─ libgcc_s.so.1
│  ├─ libjson_script.so.20210516
│  ├─ libkvcutil.so ⭢ libkvcutil.so.1
│  ├─ libkvcutil.so.1 ⭢ libkvcutil.so.1.0.0.0
│  ├─ libkvcutil.so.1.0.0.0
│  ├─ libsetlbf.so
│  ├─ libubox.so.20210516
│  ├─ libubus.so.20210630
│  ├─ libuci.so
│  ├─ libustream-ssl.so
│  ├─ libvalidate.so
│  ├─ modules
│  │  └─ 5.4.246
│  │     ├─ arc4.ko
│  │     ├─ conninfra.ko
│  │     ├─ crc-ccitt.ko
│  │     ├─ gpio-button-hotplug.ko
│  │     ├─ leds-gpio.ko
│  │     ├─ mt7981e.ko
│  │     ├─ mtd_nandecctest.ko
│  │     ├─ mtd_oobtest.ko
│  │     ├─ mtd_pagetest.ko
│  │     ├─ mtd_readtest.ko
│  │     ├─ mtd_speedtest.ko
│  │     ├─ mtd_stresstest.ko
│  │     ├─ mtd_subpagetest.ko
│  │     ├─ mtd_torturetest.ko
│  │     └─ sha1_generic.ko
│  ├─ netifd
│  │  ├─ default_script.lua
│  │  ├─ dhcp.script
│  │  ├─ dhcpv6.script
│  │  ├─ netifd-proto.sh
│  │  ├─ netifd-wireless.sh
│  │  ├─ proto
│  │  │  ├─ dhcp.sh
│  │  │  └─ dhcpv6.sh
│  │  └─ utils.sh
│  ├─ network
│  │  ├─ config.sh
│  │  └─ switch.sh
│  ├─ preinit
│  │  ├─ 00_dhcpallow
│  │  ├─ 00_preinit.conf
│  │  ├─ 01_nic_reset
│  │  ├─ 02_default_set_state
│  │  ├─ 06_set_rps_sock_flow
│  │  ├─ 50_indicate_regular_preinit
│  │  ├─ 80_mount_root
│  │  └─ 82_mtk-wifi-e2p
│  └─ upgrade
│     ├─ common.sh
│     ├─ do_stage2
│     ├─ fwtool.sh
│     ├─ gkeep
│     │  └─ nginx
│     ├─ keep.d
│     │  ├─ base-files-essential
│     │  ├─ busybox
│     │  ├─ dnsmasq
│     │  ├─ dropbear
│     │  ├─ libopenssl-conf
│     │  └─ netifd
│     ├─ mmc.sh
│     ├─ nand.sh
│     ├─ platform.sh
│     └─ stage2
├─ lib64 ⭢ lib
├─ mnt
├─ overlay
├─ proc
├─ rom
│  └─ note
├─ root
├─ sbin
│  ├─ askfirst
│  ├─ block
│  ├─ devstatus
│  ├─ firstboot
│  ├─ halt ⭢ ../bin/BB
│  ├─ hotplug-call
│  ├─ hwclock ⭢ ../bin/BB
│  ├─ ifconfig ⭢ ../bin/BB
│  ├─ ifdown ⭢ ifup
│  ├─ ifstatus
│  ├─ ifup
│  ├─ ifuponly ⭢ ifup
│  ├─ init
│  ├─ insmod ⭢ /sbin/kmodloader
│  ├─ ip ⭢ ../bin/BB
│  ├─ jffs2mark ⭢ jffs2reset
│  ├─ jffs2reset
│  ├─ kmodloader
│  ├─ led.sh
│  ├─ logd
│  ├─ logread
│  ├─ lsmod ⭢ /sbin/kmodloader
│  ├─ mkswap ⭢ ../bin/BB
│  ├─ modinfo ⭢ /sbin/kmodloader
│  ├─ modprobe ⭢ /sbin/kmodloader
│  ├─ mount_root
│  ├─ mtd
│  ├─ netifd
│  ├─ pivot_root ⭢ ../bin/BB
│  ├─ poweroff ⭢ ../bin/BB
│  ├─ procd
│  ├─ reboot ⭢ ../bin/BB
│  ├─ reload_config
│  ├─ rmmod ⭢ /sbin/kmodloader
│  ├─ route ⭢ ../bin/BB
│  ├─ scp ⭢ /tmp/scp
│  ├─ setup_ax3000.sh
│  ├─ setup_ax6000.sh
│  ├─ setup_ax7800.sh
│  ├─ setup_ax8400.sh
│  ├─ setup_be19000.sh
│  ├─ smp-mt76.sh
│  ├─ smp.sh
│  ├─ start-stop-daemon ⭢ ../bin/BB
│  ├─ swapoff ⭢ ../bin/BB
│  ├─ swapon ⭢ ../bin/BB
│  ├─ swconfig
│  ├─ switch_root ⭢ ../bin/BB
│  ├─ sysctl ⭢ ../bin/BB
│  ├─ sysupgrade
│  ├─ ubusd
│  ├─ uci
│  ├─ udevtrigger
│  ├─ udhcpc ⭢ ../bin/BB
│  ├─ upgraded
│  ├─ validate_data
│  ├─ vconfig ⭢ ../bin/BB
│  └─ wifi
├─ sys
├─ tmp
├─ usr
│  ├─ bin
│  │  ├─ [ ⭢ ../../bin/BB
│  │  ├─ [[ ⭢ ../../bin/BB
│  │  ├─ awk ⭢ ../../bin/BB
│  │  ├─ basename ⭢ ../../bin/BB
│  │  ├─ bunzip2 ⭢ ../../bin/BB
│  │  ├─ bzcat ⭢ ../../bin/BB
│  │  ├─ ccat ⭢ ccrypt
│  │  ├─ ccdecrypt ⭢ ccrypt
│  │  ├─ ccencrypt ⭢ ccrypt
│  │  ├─ ccrypt
│  │  ├─ clear ⭢ ../../bin/BB
│  │  ├─ cmp ⭢ ../../bin/BB
│  │  ├─ crontab ⭢ ../../bin/BB
│  │  ├─ cut ⭢ ../../bin/BB
│  │  ├─ datconf
│  │  ├─ dhcp_renew.lua
│  │  ├─ dirname ⭢ ../../bin/BB
│  │  ├─ du ⭢ ../../bin/BB
│  │  ├─ env ⭢ ../../bin/BB
│  │  ├─ expr ⭢ ../../bin/BB
│  │  ├─ find ⭢ ../../bin/BB
│  │  ├─ flock ⭢ ../../bin/BB
│  │  ├─ free ⭢ ../../bin/BB
│  │  ├─ fwtool
│  │  ├─ getrandom
│  │  ├─ gsplit
│  │  ├─ head ⭢ ../../bin/BB
│  │  ├─ hello.lua
│  │  ├─ hexdump ⭢ ../../bin/BB
│  │  ├─ id ⭢ ../../bin/BB
│  │  ├─ jike_encrypt
│  │  ├─ jshn
│  │  ├─ jsonfilter
│  │  ├─ killall ⭢ ../../bin/BB
│  │  ├─ kvcedit
│  │  ├─ ldd ⭢ ../../lib/libc.so
│  │  ├─ less ⭢ ../../bin/BB
│  │  ├─ logger ⭢ ../../bin/BB
│  │  ├─ lspci ⭢ ../../bin/BB
│  │  ├─ lsusb ⭢ ../../bin/BB
│  │  ├─ lua
│  │  ├─ luax
│  │  ├─ luci-bwc
│  │  ├─ md5sum ⭢ ../../bin/BB
│  │  ├─ mkfifo ⭢ ../../bin/BB
│  │  ├─ nc ⭢ ../../bin/BB
│  │  ├─ nslookup ⭢ ../../bin/BB
│  │  ├─ nvram_get
│  │  ├─ nvram_set ⭢ /usr/bin/nvram_get
│  │  ├─ openssl
│  │  ├─ pgrep ⭢ ../../bin/BB
│  │  ├─ printf ⭢ ../../bin/BB
│  │  ├─ readlink ⭢ ../../bin/BB
│  │  ├─ regcheck.lua
│  │  ├─ regs
│  │  ├─ reset ⭢ ../../bin/BB
│  │  ├─ scp ⭢ /usr/sbin/dropbear
│  │  ├─ seq ⭢ ../../bin/BB
│  │  ├─ sha256sum ⭢ ../../bin/BB
│  │  ├─ sort ⭢ ../../bin/BB
│  │  ├─ ssh ⭢ /usr/sbin/dropbear
│  │  ├─ strings ⭢ ../../bin/BB
│  │  ├─ syncwebtime.lua
│  │  ├─ tail ⭢ ../../bin/BB
│  │  ├─ tee ⭢ ../../bin/BB
│  │  ├─ telnet ⭢ ../../bin/BB
│  │  ├─ test ⭢ ../../bin/BB
│  │  ├─ time ⭢ ../../bin/BB
│  │  ├─ timeout ⭢ ../../bin/BB
│  │  ├─ top ⭢ ../../bin/BB
│  │  ├─ tr ⭢ ../../bin/BB
│  │  ├─ tty ⭢ ../../bin/BB
│  │  ├─ uniq ⭢ ../../bin/BB
│  │  ├─ uptime ⭢ ../../bin/BB
│  │  ├─ wc ⭢ ../../bin/BB
│  │  ├─ wget ⭢ /bin/uclient-fetch
│  │  ├─ which ⭢ ../../bin/BB
│  │  ├─ wificonf
│  │  ├─ xargs ⭢ ../../bin/BB
│  │  ├─ xfrpc
│  │  └─ yes ⭢ ../../bin/BB
│  ├─ jike
│  │  ├─ dhcp.test
│  │  ├─ favicon.ico
│  │  ├─ favicon.ico.jike
│  │  ├─ flash.sh
│  │  ├─ login_logo.b64
│  │  ├─ logo.b64
│  │  └─ menu.lua
│  ├─ lib
│  │  ├─ engines-1.1
│  │  ├─ libcrypto.so.1.1
│  │  ├─ libevent-2.1.so.7 ⭢ libevent-2.1.so.7.0.1
│  │  ├─ libevent-2.1.so.7.0.1
│  │  ├─ libiwinfo.so
│  │  ├─ libjson-c.so.5 ⭢ libjson-c.so.5.1.0
│  │  ├─ libjson-c.so.5.1.0
│  │  ├─ liblua.so.5.1.5
│  │  ├─ libluajit-5.1.so ⭢ libluajit-5.1.so.2.1.0
│  │  ├─ libluajit-5.1.so.2 ⭢ libluajit-5.1.so.2.1.0
│  │  ├─ libluajit-5.1.so.2.1.0
│  │  ├─ libnl-tiny.so
│  │  ├─ libssl.so.1.1
│  │  ├─ libuclient.so
│  │  ├─ libz.so ⭢ libz.so.1
│  │  ├─ libz.so.1 ⭢ libz.so.1.2.11
│  │  ├─ libz.so.1.2.11
│  │  ├─ lua
│  │  │  ├─ api ⭢ /tmp/lua_api
│  │  │  ├─ apspec.lua
│  │  │  ├─ bit.so
│  │  │  ├─ bit32.so
│  │  │  ├─ cjson
│  │  │  │  └─ util.lua
│  │  │  ├─ cjson.so
│  │  │  ├─ datconf.so
│  │  │  ├─ gb.lua
│  │  │  ├─ gzip.lua
│  │  │  ├─ i2c
│  │  │  │  └─ eeprom.lua
│  │  │  ├─ i2c.so
│  │  │  ├─ iwinfo.so
│  │  │  ├─ ltn12.lua
│  │  │  ├─ lua-greadio.so
│  │  │  ├─ lua-gsplit.so
│  │  │  ├─ md5
│  │  │  │  └─ core.so
│  │  │  ├─ md5.lua
│  │  │  ├─ mime
│  │  │  │  └─ core.so ⭢ ../mime-1.0.3.so
│  │  │  ├─ mime-1.0.3.so
│  │  │  ├─ mime.lua
│  │  │  ├─ nixio
│  │  │  │  ├─ fs.lua
│  │  │  │  └─ util.lua
│  │  │  ├─ nixio.so
│  │  │  ├─ posix
│  │  │  │  ├─ _base.lua
│  │  │  │  ├─ _bitwise.lua
│  │  │  │  ├─ _strict.lua
│  │  │  │  ├─ ctype.so
│  │  │  │  ├─ dirent.so
│  │  │  │  ├─ errno.so
│  │  │  │  ├─ fcntl.so
│  │  │  │  ├─ fnmatch.so
│  │  │  │  ├─ glob.so
│  │  │  │  ├─ grp.so
│  │  │  │  ├─ init.lua
│  │  │  │  ├─ libgen.so
│  │  │  │  ├─ poll.so
│  │  │  │  ├─ pwd.so
│  │  │  │  ├─ sched.so
│  │  │  │  ├─ signal.so
│  │  │  │  ├─ stdio.so
│  │  │  │  ├─ stdlib.so
│  │  │  │  ├─ sys
│  │  │  │  │  ├─ msg.so
│  │  │  │  │  ├─ resource.so
│  │  │  │  │  ├─ socket.so
│  │  │  │  │  ├─ stat.so
│  │  │  │  │  ├─ statvfs.so
│  │  │  │  │  ├─ time.so
│  │  │  │  │  ├─ times.so
│  │  │  │  │  ├─ utsname.so
│  │  │  │  │  └─ wait.so
│  │  │  │  ├─ sys.lua
│  │  │  │  ├─ syslog.so
│  │  │  │  ├─ termio.so
│  │  │  │  ├─ time.so
│  │  │  │  ├─ unistd.so
│  │  │  │  ├─ util.lua
│  │  │  │  ├─ utime.so
│  │  │  │  └─ version.lua
│  │  │  ├─ socket
│  │  │  │  ├─ core.so ⭢ ../socket-3.1.0.so
│  │  │  │  ├─ ftp.lua
│  │  │  │  ├─ headers.lua
│  │  │  │  ├─ http.lua
│  │  │  │  ├─ smtp.lua
│  │  │  │  ├─ tp.lua
│  │  │  │  ├─ unix.so
│  │  │  │  └─ url.lua
│  │  │  ├─ socket-3.1.0.so
│  │  │  ├─ socket.lua
│  │  │  ├─ ssl
│  │  │  │  └─ https.lua
│  │  │  ├─ ssl.lua
│  │  │  ├─ ssl.so
│  │  │  ├─ uci.so
│  │  │  └─ zlib.so
│  │  ├─ opkg
│  │  │  ├─ info
│  │  │  │  ├─ base-files.conffiles
│  │  │  │  ├─ base-files.control
│  │  │  │  ├─ base-files.list
│  │  │  │  ├─ base-files.prerm
│  │  │  │  ├─ block-mount.control
│  │  │  │  ├─ block-mount.list
│  │  │  │  ├─ block-mount.prerm
│  │  │  │  ├─ busybox.control
│  │  │  │  ├─ busybox.list
│  │  │  │  ├─ busybox.prerm
│  │  │  │  ├─ ccrypt.control
│  │  │  │  ├─ ccrypt.list
│  │  │  │  ├─ ccrypt.prerm
│  │  │  │  ├─ datconf-lua.control
│  │  │  │  ├─ datconf-lua.list
│  │  │  │  ├─ datconf-lua.prerm
│  │  │  │  ├─ datconf.control
│  │  │  │  ├─ datconf.list
│  │  │  │  ├─ datconf.prerm
│  │  │  │  ├─ dnsmasq.control
│  │  │  │  ├─ dnsmasq.list
│  │  │  │  ├─ dnsmasq.prerm
│  │  │  │  ├─ dropbear.control
│  │  │  │  ├─ dropbear.list
│  │  │  │  ├─ dropbear.prerm
│  │  │  │  ├─ ethtool.control
│  │  │  │  ├─ ethtool.list
│  │  │  │  ├─ ethtool.prerm
│  │  │  │  ├─ fstools.control
│  │  │  │  ├─ fstools.list
│  │  │  │  ├─ fstools.prerm
│  │  │  │  ├─ fwtool.control
│  │  │  │  ├─ fwtool.list
│  │  │  │  ├─ fwtool.prerm
│  │  │  │  ├─ getrandom.control
│  │  │  │  ├─ getrandom.list
│  │  │  │  ├─ getrandom.prerm
│  │  │  │  ├─ gsplit.control
│  │  │  │  ├─ gsplit.list
│  │  │  │  ├─ gsplit.prerm
│  │  │  │  ├─ ip-bridge.control
│  │  │  │  ├─ ip-bridge.list
│  │  │  │  ├─ ip-bridge.prerm
│  │  │  │  ├─ jike_encrypt.control
│  │  │  │  ├─ jike_encrypt.list
│  │  │  │  ├─ jike_encrypt.prerm
│  │  │  │  ├─ jshn.control
│  │  │  │  ├─ jshn.list
│  │  │  │  ├─ jshn.prerm
│  │  │  │  ├─ jsonfilter.control
│  │  │  │  ├─ jsonfilter.list
│  │  │  │  ├─ jsonfilter.prerm
│  │  │  │  ├─ kernel.control
│  │  │  │  ├─ kernel.list
│  │  │  │  ├─ kernel.prerm
│  │  │  │  ├─ kmod-conninfra.control
│  │  │  │  ├─ kmod-conninfra.list
│  │  │  │  ├─ kmod-conninfra.prerm
│  │  │  │  ├─ kmod-crypto-aead.control
│  │  │  │  ├─ kmod-crypto-aead.list
│  │  │  │  ├─ kmod-crypto-aead.prerm
│  │  │  │  ├─ kmod-crypto-arc4.control
│  │  │  │  ├─ kmod-crypto-arc4.list
│  │  │  │  ├─ kmod-crypto-arc4.prerm
│  │  │  │  ├─ kmod-crypto-ecb.control
│  │  │  │  ├─ kmod-crypto-ecb.list
│  │  │  │  ├─ kmod-crypto-ecb.prerm
│  │  │  │  ├─ kmod-crypto-hash.control
│  │  │  │  ├─ kmod-crypto-hash.list
│  │  │  │  ├─ kmod-crypto-hash.prerm
│  │  │  │  ├─ kmod-crypto-manager.control
│  │  │  │  ├─ kmod-crypto-manager.list
│  │  │  │  ├─ kmod-crypto-manager.prerm
│  │  │  │  ├─ kmod-crypto-null.control
│  │  │  │  ├─ kmod-crypto-null.list
│  │  │  │  ├─ kmod-crypto-null.prerm
│  │  │  │  ├─ kmod-crypto-pcompress.control
│  │  │  │  ├─ kmod-crypto-pcompress.list
│  │  │  │  ├─ kmod-crypto-pcompress.prerm
│  │  │  │  ├─ kmod-crypto-sha1.control
│  │  │  │  ├─ kmod-crypto-sha1.list
│  │  │  │  ├─ kmod-crypto-sha1.prerm
│  │  │  │  ├─ kmod-gpio-button-hotplug.control
│  │  │  │  ├─ kmod-gpio-button-hotplug.list
│  │  │  │  ├─ kmod-gpio-button-hotplug.prerm
│  │  │  │  ├─ kmod-leds-gpio.control
│  │  │  │  ├─ kmod-leds-gpio.list
│  │  │  │  ├─ kmod-leds-gpio.prerm
│  │  │  │  ├─ kmod-lib-crc-ccitt.control
│  │  │  │  ├─ kmod-lib-crc-ccitt.list
│  │  │  │  ├─ kmod-lib-crc-ccitt.prerm
│  │  │  │  ├─ kmod-mt7981e.control
│  │  │  │  ├─ kmod-mt7981e.list
│  │  │  │  ├─ kmod-mt7981e.prerm
│  │  │  │  ├─ kmod-mtdtests.control
│  │  │  │  ├─ kmod-mtdtests.list
│  │  │  │  ├─ kmod-mtdtests.prerm
│  │  │  │  ├─ kvcedit.control
│  │  │  │  ├─ kvcedit.list
│  │  │  │  ├─ kvcedit.prerm
│  │  │  │  ├─ libblobmsg-json20210516.control
│  │  │  │  ├─ libblobmsg-json20210516.list
│  │  │  │  ├─ libblobmsg-json20210516.prerm
│  │  │  │  ├─ libc.control
│  │  │  │  ├─ libc.list
│  │  │  │  ├─ libc.prerm
│  │  │  │  ├─ libevent2-7.control
│  │  │  │  ├─ libevent2-7.list
│  │  │  │  ├─ libevent2-7.prerm
│  │  │  │  ├─ libfstools-bootparam.control
│  │  │  │  ├─ libfstools-bootparam.list
│  │  │  │  ├─ libfstools-bootparam.prerm
│  │  │  │  ├─ libgcc1.control
│  │  │  │  ├─ libgcc1.list
│  │  │  │  ├─ libgcc1.prerm
│  │  │  │  ├─ libiwinfo-lua.control
│  │  │  │  ├─ libiwinfo-lua.list
│  │  │  │  ├─ libiwinfo-lua.prerm
│  │  │  │  ├─ libiwinfo1.control
│  │  │  │  ├─ libiwinfo1.list
│  │  │  │  ├─ libiwinfo1.prerm
│  │  │  │  ├─ libjson-c5.control
│  │  │  │  ├─ libjson-c5.list
│  │  │  │  ├─ libjson-c5.prerm
│  │  │  │  ├─ libjson-script20210516.control
│  │  │  │  ├─ libjson-script20210516.list
│  │  │  │  ├─ libjson-script20210516.prerm
│  │  │  │  ├─ libkvcutil.control
│  │  │  │  ├─ libkvcutil.list
│  │  │  │  ├─ libkvcutil.prerm
│  │  │  │  ├─ liblua5.1.5.control
│  │  │  │  ├─ liblua5.1.5.list
│  │  │  │  ├─ liblua5.1.5.prerm
│  │  │  │  ├─ libnl-tiny1.control
│  │  │  │  ├─ libnl-tiny1.list
│  │  │  │  ├─ libnl-tiny1.prerm
│  │  │  │  ├─ libopenssl-conf.control
│  │  │  │  ├─ libopenssl-conf.list
│  │  │  │  ├─ libopenssl-conf.prerm
│  │  │  │  ├─ libopenssl1.1.control
│  │  │  │  ├─ libopenssl1.1.list
│  │  │  │  ├─ libopenssl1.1.prerm
│  │  │  │  ├─ libubox20210516.control
│  │  │  │  ├─ libubox20210516.list
│  │  │  │  ├─ libubox20210516.prerm
│  │  │  │  ├─ libubus20210630.control
│  │  │  │  ├─ libubus20210630.list
│  │  │  │  ├─ libubus20210630.prerm
│  │  │  │  ├─ libuci-lua.control
│  │  │  │  ├─ libuci-lua.list
│  │  │  │  ├─ libuci-lua.prerm
│  │  │  │  ├─ libuci20130104.control
│  │  │  │  ├─ libuci20130104.list
│  │  │  │  ├─ libuci20130104.prerm
│  │  │  │  ├─ libuclient20201210.control
│  │  │  │  ├─ libuclient20201210.list
│  │  │  │  ├─ libuclient20201210.prerm
│  │  │  │  ├─ libustream-openssl20201210.control
│  │  │  │  ├─ libustream-openssl20201210.list
│  │  │  │  ├─ libustream-openssl20201210.prerm
│  │  │  │  ├─ logd.control
│  │  │  │  ├─ logd.list
│  │  │  │  ├─ logd.prerm
│  │  │  │  ├─ lua-bit32.control
│  │  │  │  ├─ lua-bit32.list
│  │  │  │  ├─ lua-bit32.prerm
│  │  │  │  ├─ lua-cjson.control
│  │  │  │  ├─ lua-cjson.list
│  │  │  │  ├─ lua-cjson.prerm
│  │  │  │  ├─ lua-greadio.control
│  │  │  │  ├─ lua-greadio.list
│  │  │  │  ├─ lua-greadio.prerm
│  │  │  │  ├─ lua-gsplit.control
│  │  │  │  ├─ lua-gsplit.list
│  │  │  │  ├─ lua-gsplit.prerm
│  │  │  │  ├─ lua-lzlib.control
│  │  │  │  ├─ lua-lzlib.list
│  │  │  │  ├─ lua-lzlib.prerm
│  │  │  │  ├─ lua-md5.control
│  │  │  │  ├─ lua-md5.list
│  │  │  │  ├─ lua-md5.prerm
│  │  │  │  ├─ lua.control
│  │  │  │  ├─ lua.list
│  │  │  │  ├─ lua.prerm
│  │  │  │  ├─ luabitop.control
│  │  │  │  ├─ luabitop.list
│  │  │  │  ├─ luabitop.prerm
│  │  │  │  ├─ luai2c.control
│  │  │  │  ├─ luai2c.list
│  │  │  │  ├─ luai2c.prerm
│  │  │  │  ├─ luajit.control
│  │  │  │  ├─ luajit.list
│  │  │  │  ├─ luajit.prerm
│  │  │  │  ├─ luaposix.control
│  │  │  │  ├─ luaposix.list
│  │  │  │  ├─ luaposix.prerm
│  │  │  │  ├─ luasec.control
│  │  │  │  ├─ luasec.list
│  │  │  │  ├─ luasec.prerm
│  │  │  │  ├─ luasocket.control
│  │  │  │  ├─ luasocket.list
│  │  │  │  ├─ luasocket.prerm
│  │  │  │  ├─ luci-bwc.control
│  │  │  │  ├─ luci-bwc.list
│  │  │  │  ├─ luci-bwc.prerm
│  │  │  │  ├─ luci-lib-nixio.control
│  │  │  │  ├─ luci-lib-nixio.list
│  │  │  │  ├─ luci-lib-nixio.prerm
│  │  │  │  ├─ mii_mgr.control
│  │  │  │  ├─ mii_mgr.list
│  │  │  │  ├─ mii_mgr.prerm
│  │  │  │  ├─ mtd.control
│  │  │  │  ├─ mtd.list
│  │  │  │  ├─ mtd.prerm
│  │  │  │  ├─ netifd.conffiles
│  │  │  │  ├─ netifd.control
│  │  │  │  ├─ netifd.list
│  │  │  │  ├─ netifd.prerm
│  │  │  │  ├─ nginx-ssl.control
│  │  │  │  ├─ nginx-ssl.list
│  │  │  │  ├─ nginx-ssl.prerm
│  │  │  │  ├─ nginx-ssl.prerm-pkg
│  │  │  │  ├─ odhcp6c.control
│  │  │  │  ├─ odhcp6c.list
│  │  │  │  ├─ odhcp6c.prerm
│  │  │  │  ├─ openssl-util.control
│  │  │  │  ├─ openssl-util.list
│  │  │  │  ├─ openssl-util.prerm
│  │  │  │  ├─ procd.control
│  │  │  │  ├─ procd.list
│  │  │  │  ├─ procd.prerm
│  │  │  │  ├─ regs.control
│  │  │  │  ├─ regs.list
│  │  │  │  ├─ regs.prerm
│  │  │  │  ├─ swconfig.control
│  │  │  │  ├─ swconfig.list
│  │  │  │  ├─ swconfig.prerm
│  │  │  │  ├─ switch.control
│  │  │  │  ├─ switch.list
│  │  │  │  ├─ switch.prerm
│  │  │  │  ├─ ubi-utils.control
│  │  │  │  ├─ ubi-utils.list
│  │  │  │  ├─ ubi-utils.prerm
│  │  │  │  ├─ ubox.control
│  │  │  │  ├─ ubox.list
│  │  │  │  ├─ ubox.prerm
│  │  │  │  ├─ ubus.control
│  │  │  │  ├─ ubus.list
│  │  │  │  ├─ ubus.prerm
│  │  │  │  ├─ ubusd.control
│  │  │  │  ├─ ubusd.list
│  │  │  │  ├─ ubusd.prerm
│  │  │  │  ├─ uci.control
│  │  │  │  ├─ uci.list
│  │  │  │  ├─ uci.prerm
│  │  │  │  ├─ uclient-fetch.control
│  │  │  │  ├─ uclient-fetch.list
│  │  │  │  ├─ uclient-fetch.prerm
│  │  │  │  ├─ wificonf.control
│  │  │  │  ├─ wificonf.list
│  │  │  │  ├─ wificonf.prerm
│  │  │  │  ├─ wireless-tools.control
│  │  │  │  ├─ wireless-tools.list
│  │  │  │  ├─ wireless-tools.prerm
│  │  │  │  ├─ xfrpc.control
│  │  │  │  ├─ xfrpc.list
│  │  │  │  ├─ xfrpc.prerm
│  │  │  │  ├─ zlib.control
│  │  │  │  ├─ zlib.list
│  │  │  │  └─ zlib.prerm
│  │  │  ├─ lists
│  │  │  └─ status
│  │  └─ os-release
│  ├─ lib64 ⭢ lib
│  ├─ libexec
│  │  ├─ login.sh
│  │  └─ validate_firmware_image
│  ├─ sbin
│  │  ├─ arping ⭢ ../../bin/BB
│  │  ├─ brctl ⭢ ../../bin/BB
│  │  ├─ bridge
│  │  ├─ chroot ⭢ ../../bin/BB
│  │  ├─ crond ⭢ ../../bin/BB
│  │  ├─ dnsmasq
│  │  ├─ ethtool
│  │  ├─ iwconfig
│  │  ├─ iwlist ⭢ iwconfig
│  │  ├─ iwpriv ⭢ iwconfig
│  │  ├─ mii_mgr
│  │  ├─ mii_mgr_cl45
│  │  ├─ nginx
│  │  ├─ odhcp6c
│  │  ├─ swapoff ⭢ ../../sbin/block
│  │  ├─ swapon ⭢ ../../sbin/block
│  │  ├─ switch
│  │  ├─ ubiattach
│  │  ├─ ubiblock
│  │  ├─ ubicrc32
│  │  ├─ ubidetach
│  │  ├─ ubiformat
│  │  ├─ ubimkvol
│  │  ├─ ubinfo
│  │  ├─ ubinize
│  │  ├─ ubirename
│  │  ├─ ubirmvol
│  │  ├─ ubirsvol
│  │  └─ ubiupdatevol
│  └─ share
│     ├─ fm.cpt
│     ├─ libiwinfo
│     │  └─ hardware.txt
│     ├─ libubox
│     │  └─ jshn.sh
│     ├─ lua ⭢ ../lib/lua
│     ├─ luajit-2.1.0-beta3
│     │  └─ jit
│     │     ├─ bc.lua
│     │     ├─ bcsave.lua
│     │     ├─ dis_arm.lua
│     │     ├─ dis_arm64.lua
│     │     ├─ dis_arm64be.lua
│     │     ├─ dis_mips.lua
│     │     ├─ dis_mips64.lua
│     │     ├─ dis_mips64el.lua
│     │     ├─ dis_mipsel.lua
│     │     ├─ dis_ppc.lua
│     │     ├─ dis_x64.lua
│     │     ├─ dis_x86.lua
│     │     ├─ dump.lua
│     │     ├─ p.lua
│     │     ├─ v.lua
│     │     ├─ vmdef.lua
│     │     └─ zone.lua
│     └─ udhcpc
│        └─ default.script
├─ var ⭢ tmp
└─ www

(s/BB/busybox/)

[raenye]

mediatek: mt7981: add support for Widelantech WAP430X

Currently there's a 448 KiB gap between the end of the firmware MTD partition and the next partition (opt).
Between kernel 6.12 and mt7981 firmware, there's not a lot remaining in rootfs_data, so I'm wondering whether it's OK to increase the firmware MTD partition size from 0xe00000 to 0xe70000.