base-files: boot: add sync after uci-defaults

A scenario was seen where UCI config was not flushed to disk before
an AP power-cycle after uci-defaults was completed.  Since these
scripts are deleted after being ran once, there is no way to recover
without a factory reset.

Adding this sync operation proved to help avoid this situation from
happening

Signed-off-by: Paul White <paul@shasta.cloud>

feeds/ipq807x_v5.4/ipq50xx/base-files/lib/upgrade/platform.sh

@@ -107,29 +107,42 @@ platform_do_upgrade() {
 
 	board=$(board_name)
 	case $board in
-	glinet,b3000|\
 	edgecore,oap101|\
 	edgecore,oap101-6e|\
 	edgecore,oap101e|\
 	edgecore,oap101e-6e|\
 	edgecore,eap104)
+		if [ "$(find_mtd_chardev rootfs)" ]; then
+			CI_UBIPART="rootfs"
+		else
+			if grep -q rootfs1 /proc/cmdline; then
+				CI_UBIPART="rootfs2"
+				CI_FWSETENV="active 2"
+			else
+				CI_UBIPART="rootfs1"
+				CI_FWSETENV="active 1"
+			fi
+		fi
+		nand_upgrade_tar "$1"
+		;;
+	glinet,b3000)
 		CI_UBIPART="rootfs1"
 		[ "$(find_mtd_chardev rootfs)" ] && CI_UBIPART="rootfs"
 		nand_upgrade_tar "$1"
 		;;
-        hfcl,ion4x_w|\
+	hfcl,ion4x_w|\
 	hfcl,ion4xi_w)
-                wp_part=$(fw_printenv primary | cut  -d = -f2)
-                echo "Current Primary is $wp_part"
-                if [[ $wp_part == 1 ]]; then
-                        CI_UBIPART="rootfs"
-                        CI_FWSETENV="primary 0"
-                else
-                        CI_UBIPART="rootfs_1"
-                        CI_FWSETENV="primary 1"
-                fi
-                nand_upgrade_tar "$1"
-                ;;
+		wp_part=$(fw_printenv primary | cut  -d = -f2)
+		echo "Current Primary is $wp_part"
+		if [[ $wp_part == 1 ]]; then
+				CI_UBIPART="rootfs"
+				CI_FWSETENV="primary 0"
+		else
+				CI_UBIPART="rootfs_1"
+				CI_FWSETENV="primary 1"
+		fi
+		nand_upgrade_tar "$1"
+		;;
 	cig,wf186w|\
 	cig,wf186h|\
 	emplus,wap385c|\

feeds/tip/cloud_discovery/files/etc/init.d/cloud_discover

@@ -22,6 +22,19 @@ start_service() {
 	[ "$valid" == "true" ] || 
 		/usr/share/ucentral/ucentral.uc /etc/ucentral/ucentral.cfg.0000000001 > /dev/null
 
+	est_client check
+	[ $? -eq 1 ] && {
+		logger ERROR
+		logger ERROR
+		logger ERROR
+		logger The certificate used has a CN that does not match the serial of the device
+		echo The certificate used has a CN that does not match the serial of the device
+		logger ERROR
+		logger ERROR
+		logger ERROR
+		return
+	}
+
 	procd_open_instance
 	procd_set_param command "$PROG"
 	procd_set_param respawn

feeds/tip/cloud_discovery/files/usr/bin/est_client

@@ -4,6 +4,7 @@
 
 import { ulog_open, ulog, ULOG_SYSLOG, ULOG_STDIO, LOG_DAEMON, LOG_INFO } from 'log';
 import * as fs from 'fs';
+import * as libuci from 'uci';
 
 let store_operational_pem = false;
 let store_operational_ca = false;
@@ -139,6 +140,9 @@ function load_operational_ca() {
 }
 
 function fwtool() {
+	if (!fs.stat('/etc/ucentral/cert.pem'))
+		return 0;
+
 	let pipe = fs.popen(`openssl x509 -in /etc/ucentral/cert.pem -noout -issuer`);
 	let issuer = pipe.read("all");
 	pipe.close();
@@ -163,6 +167,20 @@ function fwtool() {
 	return 0;
 }
 
+function check_cert() {
+	if (!fs.stat('/etc/ucentral/cert.pem'))
+		return 0;
+	let pipe = fs.popen("openssl x509 -in /etc/ucentral/cert.pem  -noout -subject -nameopt multiline | grep commonName | awk '{ print $3 }'");
+	let cn = pipe.read("all");
+	pipe.close();
+	if (!cn)
+		return 0;
+	cn = lc(trim(cn));
+	let uci = libuci.cursor();
+	let serial = uci.get('ucentral', 'config', 'serial');
+	return cn != serial;
+}
+
 switch(ARGV[0]) {
 case 'enroll':
 	let ret = simpleenroll();
@@ -184,4 +202,7 @@ case 'reenroll':
 
 case 'fwtool':
 	exit(fwtool());
+
+case 'check':
+	exit(check_cert());
 }

patches/0096-base-files-boot-add-sync-after-uci-defaults.patch

@@ -0,0 +1,33 @@
+From 309a419087da906a2f3b0f39763f021e9729dd85 Mon Sep 17 00:00:00 2001
+From: Paul White <paul@shasta.cloud>
+Date: Mon, 4 Aug 2025 04:14:23 +0000
+Subject: [PATCH] base-files: boot: add sync after uci-defaults
+
+A scenario was seen where UCI config was not flushed to disk before
+an AP power-cycle after uci-defaults was completed.  Since these
+scripts are deleted after being ran once, there is no way to recover
+without a factory reset.
+
+Adding this sync operation proved to help avoid this situation from
+happening
+
+Signed-off-by: Paul White <paul@shasta.cloud>
+---
+ package/base-files/files/etc/init.d/boot | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/package/base-files/files/etc/init.d/boot b/package/base-files/files/etc/init.d/boot
+index 15756669a9..c8a803e32c 100755
+--- a/package/base-files/files/etc/init.d/boot
++++ b/package/base-files/files/etc/init.d/boot
+@@ -15,6 +15,7 @@ uci_apply_defaults() {
+ 		( . "./$(basename $file)" ) && rm -f "$file"
+ 	done
+ 	uci commit
++	sync
+ }
+ 
+ boot() {
+-- 
+2.43.0
+

patches/0099-wireless-regdb-fix-channel-14-in-JP.patch

@@ -0,0 +1,39 @@
+From d0a0f0304f292a40f2fcdd20b320089627b0f05f Mon Sep 17 00:00:00 2001
+From: John Crispin <john@phrozen.org>
+Date: Thu, 7 Aug 2025 14:50:51 +0200
+Subject: [PATCH] wireless-regdb: fix channel 14 in JP
+
+Signed-off-by: John Crispin <john@phrozen.org>
+---
+ .../patches/200-jp-no-channel-14.patch        | 19 +++++++++++++++++++
+ 1 file changed, 19 insertions(+)
+ create mode 100644 package/firmware/wireless-regdb/patches/200-jp-no-channel-14.patch
+
+diff --git a/package/firmware/wireless-regdb/patches/200-jp-no-channel-14.patch b/package/firmware/wireless-regdb/patches/200-jp-no-channel-14.patch
+new file mode 100644
+index 0000000000..ea1411cfdd
+--- /dev/null
++++ b/package/firmware/wireless-regdb/patches/200-jp-no-channel-14.patch
+@@ -0,0 +1,19 @@
++--- a/db.txt
+++++ b/db.txt
++@@ -16,8 +16,6 @@ country 00:
++ 	(2402 - 2472 @ 40), (20)
++ 	# Channel 12 - 13.
++ 	(2457 - 2482 @ 20), (20), NO-IR, AUTO-BW
++-	# Channel 14. Only JP enables this and for 802.11b only
++-	(2474 - 2494 @ 20), (20), NO-IR, NO-OFDM
++ 	# Channel 36 - 48
++ 	(5170 - 5250 @ 80), (20), AUTO-BW
++ 	# Channel 52 - 64
++@@ -945,7 +943,6 @@ country JO: DFS-JP
++ # https://www.soumu.go.jp/main_content/000833682.pdf
++ country JP: DFS-JP
++ 	(2402 - 2482 @ 40), (20)
++-	(2474 - 2494 @ 20), (20), NO-OFDM
++ 	(4910 - 4990 @ 40), (23)
++ 	(5170 - 5250 @ 80), (20), AUTO-BW
++ 	(5250 - 5330 @ 80), (20), DFS, AUTO-BW
+-- 
+2.34.1
+