Custom firmware for consumer network devices

I’ve been lurking in the router modding scene for quite some time now, mostly freeloading hardworking developers (yeah, I’m looking at you, RedHat). While I may not be the main player in the OpenWrt project, I’ve had my fair share of contributions, especially in porting some devices to it.
My journey into this world began when someone started porting the US-Robotics firmware to an ISP modem in my country, and since then, I’ve been hooked on choosing hardware that supports modded firmware.

Now, let’s talk about my current setup: an x86 machine functioning as my router/gateway, technically a VM if you want to dive into the nitty-gritty details. The details are available in the Forbidden Router Topic But instead of opting for the usual suspects like pfSense or VyOS, I’ve gone with OpenWrt. Why, you might ask?

For starters, ease of use plays a significant role. OpenWrt, right out of the box, supports almost all the protocols I need to navigate via IPv4. But that’s just scratching the surface. The web UI is feature-rich, offering a seamless experience for configuring my network. Plus, let’s not forget the package manager, a feature akin to any other Linux distro, allowing me to install kernel modules and additional software hassle-free.

Unfortunately, not all the work put into OpenWrt is readily accepted by the Linux kernel, leading to some features being backported and maintained exclusively for OpenWrt. A prime example is the transition from swconfig, the old OpenWrt way for managing network switches, to DSA (Distributed Switch Architecture), the accepted method by the Linux kernel community. This migration has seen almost all drivers being moved over, but it changed a lot of things and it was not so seamless for the users!

Now, I know many of you might raise an eyebrow at the age of some BSPs (Board Support Packages), often those are based on a older versions of OpenWrt. But fear not, because the folks behind the scenes are diligently working on porting these messy, convoluted drivers into a cleaner, albeit sometimes less feature-rich, state that can be seamlessly submitted to the mainline. Unfortunatly this require a lot of work and not all the SoCs are supported, for example the IPQ 5000 series is not as the Qcom stack is a spaghetti plate ready to be build and fail (Yes I’ve tried to build their BSP for some HW I own and I’ve failed to do so).

Another standout example is the mt76 wireless driver, arguably one of the few fully open wireless drivers available for Linux. While some magic still resides in the firmware, it’s significantly less reliant on blobs compared to its Qualcomm counterparts. The evolution of wireless drivers, like ath9k, into more blob-heavy implementations has led to challenges for older hardware in receiving new features.

For instance, take the AirCube AC, which supports OpenWrt, but updating to the latest wireless firmware consumes excessive RAM. This leaves users with a tough choice between sticking with the official firmware with potential security vulnerabilities or upgrading to OpenWrt and sacrificing the 5G interface; the blob for the ath10k is very ram dependant.

I think that the progress has been stagnant for Broadcom devices for quite some time, and support for Lantiq/Intel/Max Linear wireless chips is also lacking. As for the part sold to Cypress, I’m not entirely sure about recent developments as I haven’t been keeping up with the news.

OpenWrt has developed multiple core libraries and patches, often serving as micro “μ” replacements for components common in standard Linux distributions. For instance, netifd handles network management instead of dbus, and there’s a custom init system called procd, capable of handling hotplug events.

Building OpenWrt might seem daunting at first, but if you’re familiar with buildroot, Yocto, or Armbian, it’s a breeze. Pre-built images are also available for many devices, making installation straightforward. If you’re unsure about installing OpenWrt on your device, the wiki or forum usually provide detailed guides. Additionally, checking the PR/commit that added your device often contains crucial information like UART pins and installation instructions.

Over the years, I’ve had the opportunity to install OpenWrt on a variety of devices, each with its own unique features and challenges. Here are a few notable ones:

  • Netgear WNDR3700: A reliable router that has been a staple in many OpenWrt enthusiasts’ setups. Its robust hardware and ample features made it a popular choice for running OpenWrt.

  • Netgear DGN3500: What’s interesting about this device is its ADSL support in OpenWrt. Thanks to the Lantiq chips, ADSL and even VoIP functionalities are available out of the box, offering a versatile solution for users with specific requirements.

  • TP-Link TD-W8970: Another device with ADSL and VDSL support based on another Lantiq chip, making it suitable for a wide range of internet connection types.

I’ve recetly ported, with some friends, OpenWrt to the Zyxel EX5601-T0, I was resposable for u-boot and some other changes, IMHO one of the best supported SOC and wireless configuration.

In addition to these devices, I’ve also had success with various Ubiquiti products, such as the Aircube and UAPs. The community’s efforts extend to Realtek chip support, with even older devices like the Zyxel GS1900 now enjoying OpenWrt compatibility, despite ufficially running on outdated kernel versions 2.X.

When it comes to choosing hardware for OpenWrt, consulting the supported hardware table is essential. This resource provides valuable insights into compatibility and ensures a smooth installation process. However, for those seeking a convenient and globally available option devices like the R3, R3 Mini, and R4 are well-supported by OpenWrt, offering an easy choice.

Furthermore, the recent collaboration with BananaPis has yielded the development of custom hardware, the OpenWrt One, while not the best hardware available it is promising even more options for enthusiasts seeking to build their ideal network setup or learn in the embedded world.

With OpenWrt, you essentially have an up-to-date Linux distribution on your embedded device, also enabling functionalities like VMs, LXC, and Docker. Most common tools are readily available out of the box, and the cherry on top is the “reset to factory” feature, ensuring you can always restore your device to a working state if things go down the wrong path…

So, if you’re on the fence about fetures, and security updates give OpenWrt a serious consideration (if is supported by your hardware or try it in a x86 machine). It might just surprise you with its versatility and ease of use.

@wendell asked and I replied as best I can :smiley:
Looking forward to hearing your thoughts and experience!



3 Likes

Thank you. You echo a lot of my own thoughts, especially around broadcom. For about the last ~~2 years… I’ve been thinking that it is going to take an “alliance” like open compute (in the sense that open compute is an “alliance” to keep manufacturers in check by threatening not to buy their landmine-laiden hardware) to reign in the wild west we have for wireless device makers.

I kinda have the start of a video, I think, that also talks about the mess that is wifi7 – multi link as a way to deal with the side effect of noise and loss of link but only in portions of that 320mhz channel width, and bugged devices where apple had their head up their butt for ages with 40mhz wifi channel width on iphone – and most radio vendors worked around it with “oh? iphone? have 20mhz in the beacon reply” … which is not fun to troubleshoot on wireshark.

… but a lot of those types of things are now in opaque binaries. I think? only mediatek has enough parts you could run their chipset in AP mode, that’s also a big complaint from me, and broadcom has gotten actively hostile even with basic stuff like… pls may I have wifi7 on my framework laptop?

Intel will probably allow wifi7 on linux soon, looks like, but mostly it seems like intel is focused on mlo+160mhz and not 320mhz.

I have not fully internally absorbed all of these things, and so, I may misunderstand and I would like to understand before doing a video on it. “The situation” here feels like the climate right before opencompute was founded in direct response to these exact sort of shenanigans for table stakes functionality in servers, routers, switches, etc.

Short of amd/intel shoving an fpga into the iodie, I would also like to see PC architecture evolve so we can offload even more functionality onto on-chip resources.

A xeon-d can really do iscsci crazy fast via the hardware paths whereas sapphire rapids xeon doing the same job struggles to keep up if you do it purely on the cpu core… as is often the case when windows does stuff.

I understand, unfortunatly over here WiFi7 will take more time as the 6Ghz is a licensed band in my continent. It will take some time to have it available.

I’ve seen a lot of folks having issues with AP mode on some chipset, if I recall some Intel chips cannot do AP mode on the 5G inteface.

Strange behaviour with WiFi has been observed by my friends with iPhones and MTK chipsets but I’m not sure if it has been solved properly.

Another limitation I am aware is the DBDC in mt76, but it could have been solved. Unfortunaly I’ve jumped from a Aircube AC (2x2 dual chipset Qualcom) to the Zyxel EX5601 that is a 4x4 WiFi 6 (MTK).

But AFIK the stiky issue on band steering is still present and common especially on low end HW.

About the blobs I think it has been also due to FCC regulations as some guys decided to use the SDRs in the WiFi chips to transmit out of the regulations. One of the mandates was that firmware modification had to be halted. (I dont remember it has been years since that news).

EU is also introducing the Cyber Resilience Act and things should change a bit with security updates but I hope that it will not prevent to boot custom firmware on my newer hardware.

Mediatek lately has take a good path (at least in the networking department) upstreaming a lot of their BSPs to the linux kernel and to u-boot.

The OpenWrt community is active in both the forum and in the IRC. There you can get some dev opinions too to write a script for the video.
Some of them has been really helpful as I’m mainly a webdev and working on embedded system is not as straightforward.

I also want to add that due to the IPv4 starvation my ISP network is IPv6 first, and they offer IPv4aaS and OpenWrt is the only project that support (OOB) the rfc7599. Another local ISPs uses a variation of that: rfc7597 But most of the older ISPs uses PPPoE or PPPoA on top of a VLAN. Connections speeds are GPON 2.5Gbps so having decent hardware from the ISP or in the shelf is starting to become a must.
HW accelleration is a must unless you have a SOC with 4 ARM cores, but then you run into IRQ balance territory.

The RPI4 was barely able to do 1Gbps, I didnt do the test by myself so I dont remember the results but I can check with some folks that had run the benchmarks when we tested the MAP-T implementation on ARM devices.

Another common device that now seems to support an out of tree verson of OpenWrt is the rb5009. Why out of tree? It requires some heavy modification to the bootloader (thanks Mikrotik for closing the uart) so it was not be accepted upstream. There was some discussion to support the PoE variant too!

Thanks for your insightful post.

For that reason I’ve been looking at OpenWrt for a while.

Also very insightful.

I expect quite some forum members interested in OpenWrt.

Unfortunately, I just upgraded to APs based on 802.11 AX, for which as far as I can tell OpenWrt doesn’t have supported devices, yet.
With this I think I fall into a second class of forum members that try to have access to latest technology budget permitting.

Maybe some user feedback.
I really like the OpenWrt “Table of Hardware” that allows looking up if one of my existing devices is supported by OpenWrt. The database is quite extensive, technically correct, but unfortunately doesn’t help with adopting OpenWrt.

I am not really sure what the likelihood is of OpenWrt at some point in time supporting whatever device I want to buy today. I have just checked and none of my current and past devices are supported.
I would absolutely consider this table at the time of purchase, but I get lost in the vast amount of detail.
As a consumer the exact model numbers and hw versions are important to be technically accurate. But with >2400 I get lost without some extra help.
I would appreciate some extra metadata, e.g. highest wifi standard supported by hw (802.11 ax vs 802.11 ac), which would cut down the data volume for me to review/consider substantially.
As a result I could consider spending my hard-earned money on devices that OpenWrt is supporting today.

2 Likes

It depends on the Wireless chipset you have for MTK it is available:

Summary
root@EX5601:~# iwinfo phy0 htmodelist
HT20 HT40 HE20 HE40
root@EX5601:~# iwinfo phy1 htmodelist
HT20 HT40 VHT20 VHT40 VHT80 VHT160 HE20 HE40 HE80 HE160
root@EX5601:~#
root@EX5601:~# iwinfo phy0 info
phy0      ESSID: unknown
          Access Point: 10:71:B3:9C:98:73
          Mode: Master  Channel: 1 (2.412 GHz)  HT Mode: HE20
          Center Channel 1: 1 2: unknown
          Tx-Power: 20 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: unknown
          Bit Rate: unknown
          Encryption: unknown
          Type: nl80211  HW Mode(s): 802.11ax/b/g/n
          Hardware: embedded [MediaTek MT7986]
          TX power offset: none
          Frequency offset: none
          Supports VAPs: yes  PHY name: phy0
root@EX5601:~# iwinfo phy1 info
phy1      ESSID: unknown
          Access Point: 10:71:B3:9C:98:74
          Mode: Master  Channel: 36 (5.180 GHz)  HT Mode: HE80
          Center Channel 1: 42 2: unknown
          Tx-Power: 23 dBm  Link Quality: unknown/70
          Signal: unknown  Noise: unknown
          Bit Rate: unknown
          Encryption: unknown
          Type: nl80211  HW Mode(s): 802.11ac/ax/n
          Hardware: embedded [MediaTek MT7986]
          TX power offset: none
          Frequency offset: none
          Supports VAPs: yes  PHY name: phy1
root@EX5601:~# iw phy phy0 info
Wiphy phy0
        wiphy index: 0
        max # scan SSIDs: 4
        max scan IEs length: 2200 bytes
        max # sched scan SSIDs: 0
        max # match sets: 0
        Retry short limit: 7
        Retry long limit: 4
        Coverage class: 0 (up to 0m)
        Device supports AP-side u-APSD.
        Device supports T-DLS.
        Available Antennas: TX 0xf RX 0xf
        Configured Antennas: TX 0xf RX 0xf
        Supported interface modes:
                 * IBSS
                 * managed
                 * AP
                 * AP/VLAN
                 * monitor
                 * mesh point
                 * P2P-client
                 * P2P-GO
        Band 1:
                Capabilities: 0x9ff
                        RX LDPC
                        HT20/HT40
                        SM Power Save disabled
                        RX Greenfield
                        RX HT20 SGI
                        RX HT40 SGI
                        TX STBC
                        RX STBC 1-stream
                        Max AMSDU length: 7935 bytes
                        No DSSS/CCK HT40
                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
                Minimum RX AMPDU time spacing: 4 usec (0x05)
                HT TX/RX MCS rate indexes supported: 0-31
                HE Iftypes: managed
                        HE MAC Capabilities (0x08011a000040):
                                +HTC HE Supported
                                Trigger Frame MAC Padding Duration: 2
                                OM Control
                                Maximum A-MPDU Length Exponent: 3
                                A-MSDU in A-MPDU
                        HE PHY Capabilities: (0x2270ce126d00f3164e3f00):
                                HE40/2.4GHz
                                242 tone RUs/2.4GHz
                                Device Class: 1
                                LDPC Coding in Payload
                                HE SU PPDU with 1x HE-LTF and 0.8us GI
                                NDP with 4x HE-LTF and 3.2us GI
                                STBC Tx <= 80MHz
                                STBC Rx <= 80MHz
                                Full Bandwidth UL MU-MIMO
                                Partial Bandwidth UL MU-MIMO
                                DCM Max Constellation: 2
                                DCM Max Constellation Rx: 2
                                SU Beamformee
                                Beamformee STS <= 80Mhz: 3
                                Beamformee STS > 80Mhz: 3
                                Codebook Size SU Feedback
                                Codebook Size MU Feedback
                                Triggered CQI Feedback
                                Partial Bandwidth Extended Range
                                Partial Bandwidth DL MU-MIMO
                                PPE Threshold Present
                                Power Boost Factor ar
                                HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
                                Max NC: 2
                                20MHz in 40MHz HE PPDU 2.4GHz
                                20MHz in 160/80+80MHz HE PPDU
                                80MHz in 160/80+80MHz HE PPDU
                                DCM Max BW: 1
                                Longer Than 16HE SIG-B OFDM Symbols
                                Non-Triggered CQI Feedback
                                TX 1024-QAM
                                RX 1024-QAM
                                RX Full BW SU Using HE MU PPDU with Compression SIGB
                                RX Full BW SU Using HE MU PPDU with Non-Compression SIGB
                        HE RX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE TX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        PPE Threshold 0x3b 0x1c 0xc7 0x71 0x1c 0xc7 0x71 0x1c 0xc7 0x71
                EHT Iftypes: managed
                        EHT MAC Capabilities (0x0000):
                        EHT PHY Capabilities: (0x0000000000000000):
                        EHT MCS/NSS: (0x):
                        EHT bw=20 MHz, max NSS for MCS 0-7: Rx=0, Tx=0
                        EHT bw=20 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
                        EHT bw=20 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
                        EHT bw=20 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
                HE Iftypes: AP
                        HE MAC Capabilities (0x00051a081044):
                                +HTC HE Supported
                                TWT Responder
                                BSR
                                OM Control
                                Maximum A-MPDU Length Exponent: 3
                                BQR
                                A-MSDU in A-MPDU
                                OM Control UL MU Data Disable RX
                        HE PHY Capabilities: (0x0220ce926f1bafd0000c00):
                                HE40/2.4GHz
                                LDPC Coding in Payload
                                NDP with 4x HE-LTF and 3.2us GI
                                STBC Tx <= 80MHz
                                STBC Rx <= 80MHz
                                Full Bandwidth UL MU-MIMO
                                Partial Bandwidth UL MU-MIMO
                                DCM Max Constellation: 2
                                DCM Max Constellation Rx: 2
                                SU Beamformer
                                SU Beamformee
                                MU Beamformer
                                Beamformee STS <= 80Mhz: 3
                                Beamformee STS > 80Mhz: 3
                                Sounding Dimensions <= 80Mhz: 3
                                Sounding Dimensions > 80Mhz: 3
                                Codebook Size SU Feedback
                                Codebook Size MU Feedback
                                Triggered SU Beamforming Feedback
                                Triggered MU Beamforming Feedback
                                Partial Bandwidth Extended Range
                                PPE Threshold Present
                                Max NC: 2
                                STBC Tx > 80MHz
                                STBC Rx > 80MHz
                                TX 1024-QAM
                                RX 1024-QAM
                        HE RX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE TX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        PPE Threshold 0x3b 0x1c 0xc7 0x71 0x1c 0xc7 0x71 0x1c 0xc7 0x71
                EHT Iftypes: AP
                        EHT MAC Capabilities (0x0000):
                        EHT PHY Capabilities: (0x0000000000000000):
                        EHT MCS/NSS: (0x):
                        EHT bw=20 MHz, max NSS for MCS 0-7: Rx=0, Tx=0
                        EHT bw=20 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
                        EHT bw=20 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
                        EHT bw=20 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
                HE Iftypes: mesh point
                        HE MAC Capabilities (0x00011a000040):
                                +HTC HE Supported
                                OM Control
                                Maximum A-MPDU Length Exponent: 3
                                A-MSDU in A-MPDU
                        HE PHY Capabilities: (0x02200c0000000000008000):
                                HE40/2.4GHz
                                LDPC Coding in Payload
                                STBC Tx <= 80MHz
                                STBC Rx <= 80MHz
                        HE RX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE TX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                EHT Iftypes: mesh point
                        EHT MAC Capabilities (0x0000):
                        EHT PHY Capabilities: (0x0000000000000000):
                        EHT MCS/NSS: (0x):
                        EHT bw=20 MHz, max NSS for MCS 0-7: Rx=0, Tx=0
                        EHT bw=20 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
                        EHT bw=20 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
                        EHT bw=20 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
                Frequencies:
                        * 2412 MHz [1] (20.0 dBm)
                        * 2417 MHz [2] (20.0 dBm)
                        * 2422 MHz [3] (20.0 dBm)
                        * 2427 MHz [4] (20.0 dBm)
                        * 2432 MHz [5] (20.0 dBm)
                        * 2437 MHz [6] (20.0 dBm)
                        * 2442 MHz [7] (20.0 dBm)
                        * 2447 MHz [8] (20.0 dBm)
                        * 2452 MHz [9] (20.0 dBm)
                        * 2457 MHz [10] (20.0 dBm)
                        * 2462 MHz [11] (20.0 dBm)
                        * 2467 MHz [12] (20.0 dBm)
                        * 2472 MHz [13] (20.0 dBm)
                        * 2484 MHz [14] (disabled)
        valid interface combinations:
                 * #{ IBSS } <= 1, #{ AP, mesh point } <= 16, #{ managed } <= 19,
                   total <= 19, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz, 160 MHz }

        HT Capability overrides:
                 * MCS: ff ff ff ff ff ff ff ff ff ff
                 * maximum A-MSDU length
                 * supported channel width
                 * short GI for 40 MHz
                 * max A-MPDU length exponent
                 * min MPDU start spacing
        max # scan plans: 1
        max scan plan interval: -1
        max scan plan iterations: 0
        Supported extended features:
                * [ VHT_IBSS ]: VHT-IBSS
                * [ RRM ]: RRM
                * [ BEACON_RATE_LEGACY ]: legacy beacon rate setting
                * [ BEACON_RATE_HT ]: HT beacon rate setting
                * [ BEACON_RATE_VHT ]: VHT beacon rate setting
                * [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
                * [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
                * [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
                * [ ACK_SIGNAL_SUPPORT ]: ack signal level support
                * [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
                * [ SCAN_RANDOM_SN ]: use random sequence numbers in scans
                * [ SCAN_MIN_PREQ_CONTENT ]: use probe request with only rate IEs in scans
                * [ CAN_REPLACE_PTK0 ]: can safely replace PTK 0 when rekeying
                * [ AIRTIME_FAIRNESS ]: airtime fairness scheduling
                * [ STA_TX_PWR ]: TX power control per station
                * [ AQL ]: Airtime Queue Limits (AQL)
                * [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
                * [ DEL_IBSS_STA ]: deletion of IBSS station support
                * [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
                * [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
                * [ FILS_DISCOVERY ]: FILS discovery frame transmission support
                * [ UNSOL_BCAST_PROBE_RESP ]: unsolicated broadcast probe response transmission support
                * [ BEACON_RATE_HE ]: HE beacon rate support (AP/mesh)
                * [ BSS_COLOR ]: BSS coloring support
                * [ RADAR_BACKGROUND ]: Radar background support
root@EX5601:~# iw phy phy1 info
Wiphy phy1
        wiphy index: 1
        max # scan SSIDs: 4
        max scan IEs length: 2190 bytes
        max # sched scan SSIDs: 0
        max # match sets: 0
        Retry short limit: 7
        Retry long limit: 4
        Coverage class: 0 (up to 0m)
        Device supports AP-side u-APSD.
        Device supports T-DLS.
        Available Antennas: TX 0xf RX 0xf
        Configured Antennas: TX 0xf RX 0xf
        Supported interface modes:
                 * IBSS
                 * managed
                 * AP
                 * AP/VLAN
                 * monitor
                 * mesh point
                 * P2P-client
                 * P2P-GO
        Band 2:
                Capabilities: 0x9ff
                        RX LDPC
                        HT20/HT40
                        SM Power Save disabled
                        RX Greenfield
                        RX HT20 SGI
                        RX HT40 SGI
                        TX STBC
                        RX STBC 1-stream
                        Max AMSDU length: 7935 bytes
                        No DSSS/CCK HT40
                Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
                Minimum RX AMPDU time spacing: 4 usec (0x05)
                HT TX/RX MCS rate indexes supported: 0-31
                VHT Capabilities (0x339b79f6):
                        Max MPDU length: 11454
                        Supported Channel Width: 160 MHz
                        RX LDPC
                        short GI (80 MHz)
                        short GI (160/80+80 MHz)
                        TX STBC
                        SU Beamformer
                        SU Beamformee
                        MU Beamformer
                        MU Beamformee
                        RX antenna pattern consistency
                        TX antenna pattern consistency
                VHT RX MCS set:
                        1 streams: MCS 0-9
                        2 streams: MCS 0-9
                        3 streams: MCS 0-9
                        4 streams: MCS 0-9
                        5 streams: not supported
                        6 streams: not supported
                        7 streams: not supported
                        8 streams: not supported
                VHT RX highest supported: 0 Mbps
                VHT TX MCS set:
                        1 streams: MCS 0-9
                        2 streams: MCS 0-9
                        3 streams: MCS 0-9
                        4 streams: MCS 0-9
                        5 streams: not supported
                        6 streams: not supported
                        7 streams: not supported
                        8 streams: not supported
                VHT TX highest supported: 0 Mbps
                VHT extended NSS: supported
                HE Iftypes: managed
                        HE MAC Capabilities (0x08011a000040):
                                +HTC HE Supported
                                Trigger Frame MAC Padding Duration: 2
                                OM Control
                                Maximum A-MPDU Length Exponent: 3
                                A-MSDU in A-MPDU
                        HE PHY Capabilities: (0x4c70ce126d00f3164e3f00):
                                HE40/HE80/5GHz
                                HE160/5GHz
                                242 tone RUs/5GHz
                                Device Class: 1
                                LDPC Coding in Payload
                                HE SU PPDU with 1x HE-LTF and 0.8us GI
                                NDP with 4x HE-LTF and 3.2us GI
                                STBC Tx <= 80MHz
                                STBC Rx <= 80MHz
                                Full Bandwidth UL MU-MIMO
                                Partial Bandwidth UL MU-MIMO
                                DCM Max Constellation: 2
                                DCM Max Constellation Rx: 2
                                SU Beamformee
                                Beamformee STS <= 80Mhz: 3
                                Beamformee STS > 80Mhz: 3
                                Codebook Size SU Feedback
                                Codebook Size MU Feedback
                                Triggered CQI Feedback
                                Partial Bandwidth Extended Range
                                Partial Bandwidth DL MU-MIMO
                                PPE Threshold Present
                                Power Boost Factor ar
                                HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
                                Max NC: 2
                                20MHz in 40MHz HE PPDU 2.4GHz
                                20MHz in 160/80+80MHz HE PPDU
                                80MHz in 160/80+80MHz HE PPDU
                                DCM Max BW: 1
                                Longer Than 16HE SIG-B OFDM Symbols
                                Non-Triggered CQI Feedback
                                TX 1024-QAM
                                RX 1024-QAM
                                RX Full BW SU Using HE MU PPDU with Compression SIGB
                                RX Full BW SU Using HE MU PPDU with Non-Compression SIGB
                        HE RX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE TX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE RX MCS and NSS set 160 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE TX MCS and NSS set 160 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        PPE Threshold 0x3b 0x1c 0xc7 0x71 0x1c 0xc7 0x71 0x1c 0xc7 0x71
                EHT Iftypes: managed
                        EHT MAC Capabilities (0x0000):
                        EHT PHY Capabilities: (0x0000000000000000):
                        EHT MCS/NSS: (0x):
                        EHT bw <= 80 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
                        EHT bw <= 80 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
                        EHT bw <= 80 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
                        EHT bw=160 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
                        EHT bw=160 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
                        EHT bw=160 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
                HE Iftypes: AP
                        HE MAC Capabilities (0x00051a081044):
                                +HTC HE Supported
                                TWT Responder
                                BSR
                                OM Control
                                Maximum A-MPDU Length Exponent: 3
                                BQR
                                A-MSDU in A-MPDU
                                OM Control UL MU Data Disable RX
                        HE PHY Capabilities: (0x0c20ce926f1bafd0000c00):
                                HE40/HE80/5GHz
                                HE160/5GHz
                                LDPC Coding in Payload
                                NDP with 4x HE-LTF and 3.2us GI
                                STBC Tx <= 80MHz
                                STBC Rx <= 80MHz
                                Full Bandwidth UL MU-MIMO
                                Partial Bandwidth UL MU-MIMO
                                DCM Max Constellation: 2
                                DCM Max Constellation Rx: 2
                                SU Beamformer
                                SU Beamformee
                                MU Beamformer
                                Beamformee STS <= 80Mhz: 3
                                Beamformee STS > 80Mhz: 3
                                Sounding Dimensions <= 80Mhz: 3
                                Sounding Dimensions > 80Mhz: 3
                                Codebook Size SU Feedback
                                Codebook Size MU Feedback
                                Triggered SU Beamforming Feedback
                                Triggered MU Beamforming Feedback
                                Partial Bandwidth Extended Range
                                PPE Threshold Present
                                Max NC: 2
                                STBC Tx > 80MHz
                                STBC Rx > 80MHz
                                TX 1024-QAM
                                RX 1024-QAM
                        HE RX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE TX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE RX MCS and NSS set 160 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE TX MCS and NSS set 160 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        PPE Threshold 0x3b 0x1c 0xc7 0x71 0x1c 0xc7 0x71 0x1c 0xc7 0x71
                EHT Iftypes: AP
                        EHT MAC Capabilities (0x0000):
                        EHT PHY Capabilities: (0x0000000000000000):
                        EHT MCS/NSS: (0x):
                        EHT bw <= 80 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
                        EHT bw <= 80 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
                        EHT bw <= 80 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
                        EHT bw=160 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
                        EHT bw=160 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
                        EHT bw=160 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
                HE Iftypes: mesh point
                        HE MAC Capabilities (0x00011a000040):
                                +HTC HE Supported
                                OM Control
                                Maximum A-MPDU Length Exponent: 3
                                A-MSDU in A-MPDU
                        HE PHY Capabilities: (0x0c200c0000000000008000):
                                HE40/HE80/5GHz
                                HE160/5GHz
                                LDPC Coding in Payload
                                STBC Tx <= 80MHz
                                STBC Rx <= 80MHz
                        HE RX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE TX MCS and NSS set <= 80 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE RX MCS and NSS set 160 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                        HE TX MCS and NSS set 160 MHz
                                1 streams: MCS 0-11
                                2 streams: MCS 0-11
                                3 streams: MCS 0-11
                                4 streams: MCS 0-11
                                5 streams: not supported
                                6 streams: not supported
                                7 streams: not supported
                                8 streams: not supported
                EHT Iftypes: mesh point
                        EHT MAC Capabilities (0x0000):
                        EHT PHY Capabilities: (0x0000000000000000):
                        EHT MCS/NSS: (0x):
                        EHT bw <= 80 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
                        EHT bw <= 80 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
                        EHT bw <= 80 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
                        EHT bw=160 MHz, max NSS for MCS 8-9: Rx=0, Tx=0
                        EHT bw=160 MHz, max NSS for MCS 10-11: Rx=0, Tx=0
                        EHT bw=160 MHz, max NSS for MCS 12-13: Rx=0, Tx=0
                Frequencies:
                        * 5180 MHz [36] (23.0 dBm)
                        * 5200 MHz [40] (23.0 dBm)
                        * 5220 MHz [44] (23.0 dBm)
                        * 5240 MHz [48] (23.0 dBm)
                        * 5260 MHz [52] (20.0 dBm) (radar detection)
                        * 5280 MHz [56] (20.0 dBm) (radar detection)
                        * 5300 MHz [60] (20.0 dBm) (radar detection)
                        * 5320 MHz [64] (20.0 dBm) (radar detection)
                        * 5500 MHz [100] (26.0 dBm) (radar detection)
                        * 5520 MHz [104] (26.0 dBm) (radar detection)
                        * 5540 MHz [108] (26.0 dBm) (radar detection)
                        * 5560 MHz [112] (26.0 dBm) (radar detection)
                        * 5580 MHz [116] (26.0 dBm) (radar detection)
                        * 5600 MHz [120] (26.0 dBm) (radar detection)
                        * 5620 MHz [124] (26.0 dBm) (radar detection)
                        * 5640 MHz [128] (26.0 dBm) (radar detection)
                        * 5660 MHz [132] (26.0 dBm) (radar detection)
                        * 5680 MHz [136] (26.0 dBm) (radar detection)
                        * 5700 MHz [140] (26.0 dBm) (radar detection)
                        * 5720 MHz [144] (13.0 dBm) (radar detection)
                        * 5745 MHz [149] (13.0 dBm)
                        * 5765 MHz [153] (13.0 dBm)
                        * 5785 MHz [157] (13.0 dBm)
                        * 5805 MHz [161] (13.0 dBm)
                        * 5825 MHz [165] (13.0 dBm)
                        * 5845 MHz [169] (13.0 dBm)
                        * 5865 MHz [173] (13.0 dBm)
                        * 5885 MHz [177] (disabled)
        valid interface combinations:
                 * #{ IBSS } <= 1, #{ AP, mesh point } <= 16, #{ managed } <= 19,
                   total <= 19, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz, 160 MHz }

        HT Capability overrides:
                 * MCS: ff ff ff ff ff ff ff ff ff ff
                 * maximum A-MSDU length
                 * supported channel width
                 * short GI for 40 MHz
                 * max A-MPDU length exponent
                 * min MPDU start spacing
        max # scan plans: 1
        max scan plan interval: -1
        max scan plan iterations: 0
        Supported extended features:
                * [ VHT_IBSS ]: VHT-IBSS
                * [ RRM ]: RRM
                * [ BEACON_RATE_LEGACY ]: legacy beacon rate setting
                * [ BEACON_RATE_HT ]: HT beacon rate setting
                * [ BEACON_RATE_VHT ]: VHT beacon rate setting
                * [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
                * [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
                * [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
                * [ ACK_SIGNAL_SUPPORT ]: ack signal level support
                * [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
                * [ SCAN_RANDOM_SN ]: use random sequence numbers in scans
                * [ SCAN_MIN_PREQ_CONTENT ]: use probe request with only rate IEs in scans
                * [ CAN_REPLACE_PTK0 ]: can safely replace PTK 0 when rekeying
                * [ AIRTIME_FAIRNESS ]: airtime fairness scheduling
                * [ STA_TX_PWR ]: TX power control per station
                * [ AQL ]: Airtime Queue Limits (AQL)
                * [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
                * [ DEL_IBSS_STA ]: deletion of IBSS station support
                * [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
                * [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
                * [ FILS_DISCOVERY ]: FILS discovery frame transmission support
                * [ UNSOL_BCAST_PROBE_RESP ]: unsolicated broadcast probe response transmission support
                * [ BEACON_RATE_HE ]: HE beacon rate support (AP/mesh)
                * [ BSS_COLOR ]: BSS coloring support
                * [ RADAR_BACKGROUND ]: Radar background support
root@EX5601:~#

This is a bit harder, SoC side you have to see if there is at least one device with support.

The general rule is: skip broadcom HW, old ath79 is supported mediatek filogic and MIPS devices are well supported, same for Marvell devices as the sources are generally available. Qualcomm newer IPQ series are spotty as the NSS drivers are a mess to work with and even basic CPU brigup code is missing like the IPQ 5000. But there are some out of three forks if you really need that.

For wireless or eth phys the thing is a bit harder. It is more device dependant. But the common ath9k and ath10k, ath11k are present so for qualcomm wireless at least AC should be supported. But i’m not sure how the ath11k is in the making.

I know that the ToH is a bit hard to navigate but most of the devices should have tags associated so you can also use those to navigate to different models. And if necessary there is the full ToH with all the parameter serchable. Another great resource are FCCIDs of the devices and the “Internal Photos” that allows you to see what chip a device uses if there is no info available online.

I generelly buy a device that I know is supported right now, not that it will receive the update. My only exception may have been the RB5009, but I ultimately settled on the Zyxel + x86. And The zyxel was also ported by me and friends so we knew that it was possible to support it.

A small clarification on the Zyxel:
The SFP and FXS ports are not working as there is no open driver available.

I’ve started the reverse by sniffing the data between the SoC and the SLIC chip. I’ve tried a reply attack but the init failed. So I didnt do a lot of progress. I’m sure that it is doable as is a SPI init (reg configuration) + PCM from Alsa but the initialization process requres some blobs. (A lot of data is tranfered during init on two registers)

The SFP is waiting for some mainline patches that rewrites phylink and some other structures as mulltiple PHYs on the single MAC/SerDev is now common. And the linux net subsystem dont support such layout.
A workaround it to load a custom device tree overlay to disable the built in RJ45 PHY and only enable the SFP.

I think one of the most interesting options is modifying the beacon interval.

Most devices only allow a one second setting, anyone tried 10s or a full minute?

Also, the signal strength in milliwatts or decibels. Low power with less broadcast seems more secure.

This topic was automatically closed 273 days after the last reply. New replies are no longer allowed.