OpenWrt for BE5000: dnsmasq-full with nftset in the VPN image (2026-11-09)

OpenWrt r36539+1248-98bc30d154, Linux 6.18.55. What is inside: firmware/openwrt/README.md. Sources: be5000-openwrt-source-patches.tar.gz (patches against OpenWrt main, apply with git am --keep-cr: one SVG of the Argon theme has CRLF line endings) and diffconfig in this release.

Changes since be5000-openwrt-20261108:

• VPN image: dnsmasq-full instead of dnsmasq (#7). It has nftset support, so pbr domain policies (resolver_set 'dnsmasq.nftset') work right after flashing and keep working after sysupgrade with kept settings, without installing dnsmasq-full by hand. Also built in: DNSSEC, DHCPv6, conntrack marks, authoritative DNS.
• The plain image keeps the small dnsmasq.

Packages installed by hand are not kept by sysupgrade, only settings are. After an upgrade, install them again or use an image that already has them.

Kernel configuration and the kmod feed directory are the same as in 20261108: sysupgrade keeps settings, and packages from the feed keep working. The VPN image grew by 0.5 MB to 24.1 MB; the limit is 25.2 MB (24 MiB).

OpenWrt for BE5000: Wi-Fi and Ethernet on separate CPU cores, temperature history, Argon theme (2026-11-08)

OpenWrt r36539+1247-98bc30d154, Linux 6.18.55. What is inside: firmware/openwrt/README.md. Sources: be5000-openwrt-source-patches.tar.gz (patches against OpenWrt main, apply with git am --keep-cr: one SVG of the Argon theme has CRLF line endings) and diffconfig in this release.

Changes since be5000-openwrt-20261107:

• Wi-Fi and Ethernet on separate CPU cores. Wi-Fi (NAPI threads, the mt76 TX worker, RPS of the Wi-Fi interfaces) runs on CPU1, Ethernet on CPU0, so both halves of a bridged, routed or tunnelled flow are processed in parallel. The layout is applied at boot and again after the NPU switch reloads the Wi-Fi driver. Measured from a 2x2 160 MHz MacBook, three runs each:
  • AmneziaWG through a server on the router, download: 147–197 → 224–274 Mbit/s with the NPU, 159–234 → 223–264 Mbit/s without it.
  • Wi-Fi ↔ wired without the NPU: 748–787 → 861–881 Mbit/s upload, 516–953 → 1063–1101 Mbit/s download. With the NPU: the same or better.
  • Turned off by setting Packet Steering to disabled in Network → Interfaces → Global network options.
• AmneziaWG sends encrypted packets in batches (one UDP GSO buffer per batch): about +10% download through the tunnel over Wi-Fi, +20–25% encryption speed on a wired link. Switchable at runtime: /sys/module/amneziawg/parameters/tx_batch.
• Temperature history: Status → Realtime Graphs → Temperature draws the CPU, SoC and Wi-Fi temperatures of the last 24 hours with the current, lowest and highest value; the temperature block on the overview links to it. One reading a minute, kept in RAM, starts over after a reboot.
• VPN image: Argon LuCI theme (jerrykuku/luci-theme-argon 3.1.3, with translations). It becomes the theme on first boot and also after sysupgrade with kept settings; Bootstrap stays in System → System → Language and Style.
• Services → AmneziaWG looks right in every theme, and its "no interfaces yet" text is shown.

Kernel configuration and the kmod feed directory are the same as in 20261107: sysupgrade keeps settings, and packages from the feed keep working. The VPN image grew to 23.6 MB of 24 MiB because of the theme and its dependencies.

OpenWrt for BE5000: no more PSE events flooding the kernel log (2026-11-07)

OpenWrt r36539+1241-98bc30d154, Linux 6.18.55. What is inside: firmware/openwrt/README.md. Sources: be5000-openwrt-source-patches.tar.gz (patches against OpenWrt main) and diffconfig in this release.

Changes since be5000-openwrt-20261105:

• The kernel log no longer fills with airoha_eth 1fb50000.ethernet: PSE events 00000001 (fq empty 0, fc drop 0, fc N, exception 1) once a second. These were routine flow-control events inside the Ethernet frame engine, not errors. They are now only counted in /sys/kernel/debug/airoha_fe_stall/pse_*; the log gets a warning only when the frame engine runs out of buffers or drops frames.

Kernel configuration and the kmod feed directory are the same as in 20261105: sysupgrade keeps settings, and packages from the feed keep working.

OpenWrt for BE5000: IPv6 over PPPoE offload on a LAN port, full-rate eth1 shaper (2026-11-05)

OpenWrt r36539+1240-98bc30d154, Linux 6.18.55. What is inside: firmware/openwrt/README.md. Sources: be5000-openwrt-source-patches.tar.gz (patches against OpenWrt main) and diffconfig in this release.

Changes since be5000-openwrt-20261104-2 (issue #6, part 2):

• IPv6 over PPPoE with hardware offload now works on a LAN (MT7530) port used as WAN when that port has its own MAC address (for example the WAN MAC set on lan1). IPv6 entries of the packet engine carry only an index into its source-MAC table, and such a port used the slot holding the eth0 MAC, so the PPPoE server dropped the offloaded frames and IPv6 downloads stalled after a few hundred KB. The port now gets a slot of its own. Bench: a stall at ~260 KB before, 912 Mbit/s (1 stream) and 917 Mbit/s (6 streams) after; IPv4 was not affected.
• /sys/kernel/debug/ppe/entries shows the source-MAC slot (smacN) and the PPPoE session id of IPv6 entries instead of a fake MAC; /sys/kernel/debug/ppe/smac lists the extra slots.
• The eth1 shaper (2.5G port below 2.5 Gbit/s) now runs at 100% of the link rate instead of 95%. At 1 Gbit/s the router's own upload is ~610 Mbit/s with no retransmits and no link drops; offloaded flows are not shaped (~940 Mbit/s).

Also checked on this release: Wi-Fi through the access point with WPA2 and WPA3 (Wi-Fi 6 and Wi-Fi 7 clients) gives the same speed (both at the 1 Gbit/s uplink limit in the test).

OpenWrt for BE5000: stable 2.5G WAN port at 1 Gbit/s and full-rate upload on it (2026-11-04-2)

OpenWrt r36539+1238-98bc30d154, Linux 6.18.55. What is inside: firmware/openwrt/README.md. Sources: be5000-openwrt-source-patches.tar.gz (patches against OpenWrt main) and diffconfig in this release.

Changes since be5000-openwrt-20261104 (issue #6):

• The 2.5G WAN port (EN8811H) no longer drops the link under upload when it runs at 1 Gbit/s (a 1 Gbit/s ONT or switch): the SoC's SerDes MAC now honours the PHY's PAUSE frames.
• Upload through that port at 1 Gbit/s: ~920 Mbit/s instead of ~250 (offloaded flows go through the QDMA with DRAM buffering, as in the stock firmware); at 2.5 Gbit/s 1.45–1.69 Gbit/s.
• CPU-originated traffic on eth1 is shaped to 95% of the link rate while the link is below 2.5 Gbit/s (be5000-eth1-shaper service).

Not changed: IPv6 over PPPoE with hardware offload on an MT7530 LAN port used as WAN (issue #6, part 2) is still being investigated.

OpenWrt for BE5000: routing offload by default, Ethernet that survives CPU load (2026-11-04)

OpenWrt r36539+1235-98bc30d154, Linux 6.18.55, on OpenWrt main of 2026-10-25. The kernel configuration is the same as in 20261026, so the image keeps using the kmods/6.18.55-b2ecdad1… directory of the kmod feed; kernel modules installed with apk add keep working.

New

• Routing offload on by default on a router. Users saw Wi-Fi upload stuck at ~150 Mbit/s and the internet dropping every day or two: without Network → Firewall → Routing/NAT Offloading every Wi-Fi ↔ WAN frame went through the CPU. With software and hardware offload the same test runs at ~1.1 Gbit/s upload and ~1.7 Gbit/s download with the CPU almost idle, IPv4 and IPv6, PPPoE included. The upgrade turns both on once, only on a router (with a wan interface) and only if the option was never set; an access point is left as it is.
• Ethernet no longer stops until a reboot under CPU load. The AN7563 driver waited up to 1 ms per transmitted frame and could release a transmit entry twice, which lost a frame and stopped an Ethernet transmit queue for good. Transmit is now asynchronous and each entry is released once.
• Frame engine set up as in the stock firmware (PSE buffer pool, thresholds, flow control): fewer congestion stalls and ~20% more upload through the CPU.
• Frame engine recovery. Under heavy CPU-routed Wi-Fi upload the frame engine of this SoC can jam, on the stock firmware too, which resets it from a monitor. The driver now does the same: it notices the jam within ~3 s and resets the frame engine in ~0.1 s; TCP connections survive. If the receive DMA itself is stuck, the driver reboots the router (reboot_on_wedge module parameter).
• Bench result: 24 runs of a 6-stream Wi-Fi upload routed through the CPU without a hang (before: the router died on the first or second run).

Everything from 20261030-4 stays: Wi-Fi 7 MLO network in LuCI, TCP MSS for PPPoE, factory MAC addresses on every port, Xray and AmneziaWG in LuCI, all image languages, VPN on the router with the NPU on, 2.5G WAN by default, temperatures in LuCI, Reset failsafe, gaming mode, two images (plain and VPN), Wi-Fi 7 and MLO offload.

Install or upgrade

• From be5000-openwrt-20261018 or newer: sysupgrade; settings are kept.
• From any be5000-openwrt version before 2026-10-18: upgrade to be5000-openwrt-20261018 first, then to this release.
• From Xiaomi stock: sh install.sh (or install.bat on Windows), then the image in the U-Boot web failsafe (README). Use a current browser: Internet Explorer and old Chromium do not show the upload and do not open LuCI.
• From xinyooo or iscle OpenWrt: sysupgrade -n; settings are not kept.

Known issues

• The reboot after sysupgrade sometimes hangs (about 1 in 3): the LED stays off. Unplug the power and plug it back in; the image and the settings are already written.
• With routing offload off, heavy Wi-Fi upload still jams the frame engine now and then; the driver resets it in ~0.1 s. Keep routing offload on.
• Not tested yet: the routing offload default on a router's first boot (tested: an upgraded access point, where it stays off).
• Packages added with apk add are not kept by sysupgrade: install them again after an upgrade, or use the VPN image.

Sources: be5000-openwrt-source-patches.tar.gz (105 patches against OpenWrt main 6c9452a35b, the LuCI fix under feeds-patches/) and diffconfig in this release. What is inside: firmware/openwrt/README.md.

OpenWrt for BE5000: Wi-Fi 7 MLO network in LuCI with full-width radios (2026-10-30)

OpenWrt r36539+1232-98bc30d154, Linux 6.18.55, on OpenWrt main of 2026-10-25. The kernel configuration is the same as in 20261026, so the image keeps using the kmods/6.18.55-b2ecdad1… directory of the kmod feed; kernel modules installed with apk add keep working.

New

• Wi-Fi 7 MLO network in LuCI. Network → Advanced settings → Wi-Fi 7 MLO turns on a separate WPA3 network on 2.4 and 5 GHz at once: enter a name and a password. A Wi-Fi 7 device stays connected over both bands and picks the better one for each direction. The router builds the network from these settings and removes it when MLO is off; change it on this page only.
• Full-width radios while MLO is on. All networks of the router use 40 MHz on 2.4 GHz and 160 MHz on 5 GHz (channels 36–64) while the MLO network is on; the previous widths come back when it is turned off.
• Changing the MLO network keeps 2.4 GHz up. hostapd cannot rebuild an MLO network in place: its 2.4 GHz link failed and took every 2.4 GHz network down. The router restarts Wi-Fi fully when the MLO network changes.
• The LuCI wireless page works with an MLO network. It failed with a JavaScript error on a network that lists several radios; the image carries the fix from openwrt/luci#9102.
• Network → Advanced settings is the new name of the NPU acceleration page: it holds the NPU switch, the gaming mode, the PPPoE MSS and the MLO network.

Everything from 20261030 stays: TCP MSS for PPPoE, full upload through hardware routing offload after a firewall reload, factory MAC addresses on every port, Xray and AmneziaWG in LuCI, all image languages, VPN on the router with the NPU on, 2.5G WAN by default, temperatures in LuCI, Reset failsafe, gaming mode, two images (plain and VPN), Wi-Fi 7 and MLO offload.

Install or upgrade

• From be5000-openwrt-20261018 or newer: sysupgrade; settings are kept.
• From any be5000-openwrt version before 2026-10-18: upgrade to be5000-openwrt-20261018 first, then to this release.
• From Xiaomi stock: sh install.sh (or install.bat on Windows), then the image in the U-Boot web failsafe (README). Use a current browser: Internet Explorer and old Chromium do not show the upload and do not open LuCI.
• From xinyooo or iscle OpenWrt: sysupgrade -n; settings are not kept.

Known issues

• The reboot after sysupgrade sometimes hangs (about 1 in 3): the LED stays off. Unplug the power and plug it back in; the image and the settings are already written.
• After turning the NPU on in LuCI the router once stopped sending anything to Wi-Fi clients (ping worked, pages did not open) until a reboot. If that happens, reboot the router.
• Under a long CPU-bound upload through PPPoE (1500-byte packets fragmented by the CPU, with the MSS setting off) the router froze three times on the test bench and needed a power cycle. Not seen with the MSS setting on.
• Packages added with apk add are not kept by sysupgrade: install them again after an upgrade, or use the VPN image.

Sources: be5000-openwrt-source-patches.tar.gz (102 patches against OpenWrt main 6c9452a35b, the LuCI fix under feeds-patches/) and diffconfig in this release. What is inside: firmware/openwrt/README.md.

Transition step only: upgrade from versions before 2026-10-18

Important

This release is only a transition step. You need it only if your router runs any be5000-openwrt version before 2026-10-18. Everyone else (Xiaomi stock, xinyooo or iscle OpenWrt, be5000-openwrt 20261018 and newer): skip it and install the latest release.

OpenWrt r36539+844-98bc30d154, Linux 6.18.55. It moves the settings partition (ubi-data) to the layout that later releases expect: 93 MiB to the end of the flash instead of 40 MiB, about 79 MiB free in /overlay. It also brings the upgrade script that unloads the Wi-Fi driver before writing the image.

Upgrade from a version before 2026-10-18

1. Over a cable, run wifi down.
2. Run sysupgrade with openwrt-airoha-an7563-xiaomi_be5000-squashfs-sysupgrade.bin. Settings are kept.
3. Run the same sysupgrade once more. This grows /overlay from about 31 to about 79 MiB.
4. Upgrade to the latest release with sysupgrade.

Known issues

• The first upgrade still runs the upgrade script of the old version. The reboot after it can hang (no LED): unplug the power and plug it back in. The image and the settings are already written. wifi down in step 1 makes this less likely.

Sources: be5000-openwrt-source-patches.tar.gz (patches against OpenWrt main) and diffconfig in this release.