Uhh, no I don't recall including any fix for random reboot issue for this router. I think that was fixed officially by netgear firmware V1.2.9.52. In fact if we unpack the stock firmware and do a diff against previous version, we can see exactly what netgear changed and patched. I think I'll share my findings here, perhaps anyone might find it useful.
Changed in firmware V1.2.9.52
I extracted netgear stock fw using binwalk did a diff between stock firmware V1.2.8.40 and V1.2.9.52, -- specifically this file: /etc/init.d/ubootupgrade.sh
I noticed this key changes:
diff -urN /home/akm/Git/Clonned/Official/router-fw/rax120v2/RAX120v2v1-V1.2.8.40/extractions/RAX120-V1.2.8.40.img.extracted/620040/extractions/Linux-4.4.60.bin.extracted/0/squashfs-root/etc/init.d/ubootupgrade.sh /home/akm/Git/Clonned/Official/router-fw/rax120v2/RAX120v2v1-V1.2.9.52/extractions/RAX120-V1.2.9.52.img.extracted/620040/extractions/Linux-4.4.60.bin.extracted/0/squashfs-root/etc/init.d/ubootupgrade.sh
--- /home/akm/Git/Clonned/Official/router-fw/rax120v2/RAX120v2v1-V1.2.8.40/extractions/RAX120-V1.2.8.40.img.extracted/620040/extractions/Linux-4.4.60.bin.extracted/0/squashfs-root/etc/init.d/ubootupgrade.sh 1970-01-01 06:00:00.000000000 +0600
+++ /home/akm/Git/Clonned/Official/router-fw/rax120v2/RAX120v2v1-V1.2.9.52/extractions/RAX120-V1.2.9.52.img.extracted/620040/extractions/Linux-4.4.60.bin.extracted/0/squashfs-root/etc/init.d/ubootupgrade.sh 2023-04-07 07:53:03.000000000 +0600
@@ -0,0 +1,73 @@
+#!/bin/sh
+
+version=`devmem 0x0194D000`
+ubootversion=`strings /dev/mtd15 |grep U-boot |awk '{print $3}'`
+nosmmu=`/bin/config get uboot_nosmmu`
+mkdir -p /tmp/cache/uboot
+#6 DEVCFG BCH 0x900000 0x80000 devcfg_nosmmu.mbn
+#15 APPSBL BCH 0xd80000 0x100000 openwrt-ipq807x-u-boot.mbn
+
+upgrade_uboot()
+{
+ uboot=$1
+ tar xvf /lib/uboot/$uboot.tar.gz -C /tmp/cache/uboot/
+ tar xvf /lib/uboot/devcfg.tar.gz -C /tmp/cache/uboot/
+ if [ "$?" = "0" ];then
+ nandwrite -p /dev/mtd15 /tmp/cache/uboot/$uboot/openwrt-ipq807x-u-boot.mbn
+ if [ "$uboot" = "ubootv16-crash" ]; then
+ flash_erase /dev/mtd6 0 0
+ nandwrite -p /dev/mtd6 /tmp/cache/uboot/devcfg.mbn
+ /bin/config set uboot_nosmmu=1
+ /bin/config commit
+ #sleep 3
+ fi
+ echo "++++++Upgrade uboot successfully and will reboot now !!!!!!!!!!"
+ reboot -f
+ else
+ echo "Unzip the $1.tar.gz fail !!!" > /dev/console
+ return
+ fi
+}
+
+upgrade_to_crashdump()
+{
+ echo "!!!!!!!!!!upgrade crashdump uboot!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" > /dev/console
+ #if [ "x$version" = "x0x200D0102" -a "x$ubootversion" = "xV1.2" ];then
+ # upgrade_uboot ubootv12-crash
+ #elif [ "x$version" = "x0x200D0200" -a "x$ubootversion" = "xV1.6" ];then
+ # upgrade_uboot ubootv16-crash
+ #elif [ "x$nosmmu" != "x1" -a "x$ubootversion" = "xV1.6-Crashdump_enable" ];then
+ if [ "x$ubootversion" = "xV1.6" -o "x$ubootversion" = "xV1.6-Crashdump_enable" ]; then
+ if [ "x$nosmmu" != "x1" ]; then
+ tar xvf /lib/uboot/devcfg.tar.gz -C /tmp/cache/uboot/
+ if [ -f /tmp/cache/uboot/devcfg.mbn ];then
+ echo "++++++Upgrade devcfg.mbn successfully and will reboot now !!!!!!!!!!"
+ flash_erase /dev/mtd6 0 0
+ nandwrite -p /dev/mtd6 /tmp/cache/uboot/devcfg.mbn
+ /bin/config set uboot_nosmmu=1
+ /bin/config commit
+ sleep 3
+ reboot -f
+ fi
+ fi
+ fi
+}
+
+upgrade_to_normal()
+{
+ echo "!!!!!!!!!!upgrade normal uboot!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" > /dev/console
+ if [ "x$version" = "x0x200D0102" -a "x$ubootversion" = "xV1.2-crashdump-enable" ];then
+ upgrade_uboot ubootv12
+ elif [ "x$version" = "x0x200D0200" -a "x$ubootversion" = "xV1.6-Crashdump_enable" ];then
+ upgrade_uboot ubootv16
+ fi
+}
+
+case $1 in
+ crash)
+ upgrade_to_crashdump
+ ;;
+ normal)
+ upgrade_to_normal
+ ;;
+esac
So on the very first boot after this update, it silently re-flashes the DEVCFG partition (an actual NAND write to /dev/mtd6, followed by a forced reboot) with a variant that disables the SMMU (ARM System MMU / IOMMU) at the hardware level and it only does this once, tracked by the persistent uboot_nosmmu flag so it doesn't repeat. (SMMU = (System Memory Management Unit), so maybe it is defective?)
Basically once you flash this firmware, your /dev/mtd6 -- DEVCFG and APPSBL is permanently upgraded.
if we do a strings of new DEVCFG, we see it disabled smmu -- probably smmu was causing the infamous random reboots on RAX120v2
akm@RHEL:~/Git/Clonned/Official/router-fw/rax120v2/Stock-Backup/mtd-dump$ strings mtd6.bin | grep smmu
disable_smmu_ac
/ac/smmu
Now since this firmware permanently rewrites /dev/mtd6, theoritically, even if we downgrade stock firmware to any previous version, this random reboot fix will persists and wont happen again -- not even on openwrt.
Another interesting changes in Netgear stock V1.2.10.56
I also did a diff between V1.2.9.52 and latest release V1.2.10.56, something very interesting came up.
OFDMA / MU-MIMO gets force-disabled for "WW" region
This shows up in three places, all pointing the same direction:
/etc/init.d/boot, /etc/rc.d/S10boot, /etc/rc.d/K98boot (identical patch in all three):
if [ "x$(/bin/config get ww_region_default)" != "x0" -a "x$region" = "xWW" ]; then
/bin/config set wla_dl_ofdma="0"
/bin/config set wlg_dl_ofdma="0"
/bin/config set wla_mu_mimo="0"
/bin/config set wlg_mu_mimo="0"
/bin/config set ww_region_default="0"
fi
/sbin/update-wifi — the same region check also gets baked onto four separate functions (he_dlofdma, he_ulofdma, he_ulmumimo, and the generic mu_mimo setter), each forcing the value to 0 when region is WW.
So for some reason netgear decided to completely disable ofdma and mumimo for ww region entirely. So if anyone is using this firmware, chances are ofdma and mumimo is permanently disabled (even if it is enabled in netgear web gui).
The changelog for V1.2.10.56 stock says "Security fixes", idk if netgear by security fixes meant nerfing radios or possibly being compliant with wifi rules.
Though it is true and well documented that setting certain regions like NA (north america) using telnet boosts wifi signals on stock (benchmark and noted here)
Changing region permanently is easy, Just enable telnet then use artmtd to change region.
root@RAX120v2:/# artmtd
Usage: artmtd -r name [<arguments> ...]
************* SN Usage:
SN read:
artmtd -r sn
SN write:
artmtd -w sn number
For instance: artmtd -w sn 1ML1747D0000B
SN should be 0~9 or A~Z
************* REGION Usage:
REGION read:
artmtd -r region
REGION wirte:
Usage: artmtd -w region region name
For instance : artmtd -w region NA
The REGION name only is "NA,WW,GR,PR,RU,BZ,IN,KO,JP,AU,CA,US"
************* LANGUAGE Usage:
Language read:
artmtd -r language
************* SSID Usage:
ssid read:
artmtd -r ssid
ssid read:
artmtd -w ssid SSID
************* PASSPHRASE Usage:
passphrase read:
artmtd -r passphrase
passphrase read:
artmtd -w passphrase PASSPHRASE
************* WPSPIN Usage:
wpspin read:
artmtd -r wpspin
wpspin write:
artmtd -w wpspin 12345670
*************HW MODEL ID Usage:
HW MODEL ID read:
artmtd -r board_hw_id
artmtd -r board_model_id
artmtd -w board_hw_id HW_ID
artmtd -w board_model_id MODEL_ID
*************MAC Usage:ssid read:
artmtd -r mac
ssid read:
artmtd -w mac_lan 00:11:22:33:44:50
ssid read:
artmtd -w mac_wan 00:11:22:33:44:51
ssid read:
artmtd -w mac_5g 00:11:22:33:44:52
ssid read:
artmtd -w mac_bluetooth 00:11:22:33:44:53
*************BOOT PART Usage:board data read:
artmtd -r boot_part
board data write:
artmtd -w boot_part [1|2]
************* NMRP Usage:
nmrp read:
artmtd -r nmrp
nmrp write:
artmtd -w nmrp 1/0
************* SW_FEATURE Usage:
sw_feature read:
artmtd -r sw_feature
sw_feature write:
artmtd -w sw_feature 0001
Additional Findings
To disable Netgear Armor bloat on stock firmware (if you so choose), set this config entry using telnet and reboot.
/bin/config set dgc_func_have_armor=0
/bin/config commit
It should disable armor backend permanently -- at least untill a full router reset. Netgear scattered if-def blocks in various places, explicitely checking this to enable Netgear armor and bitdefender:
if [ "`/bin/config get dgc_func_have_armor`" != "1" ]; then
cheers!