Adding OpenWrt Support for Netgear RAX120 (Nighthawk AX12)

Uhh, no I don't recall including any fix for random reboot issue for this router. I think that was fixed officially by netgear firmware V1.2.9.52. In fact if we unpack the stock firmware and do a diff against previous version, we can see exactly what netgear changed and patched. I think I'll share my findings here, perhaps anyone might find it useful.

Changed in firmware V1.2.9.52

I extracted netgear stock fw using binwalk did a diff between stock firmware V1.2.8.40 and V1.2.9.52, -- specifically this file: /etc/init.d/ubootupgrade.sh
I noticed this key changes:

diff -urN /home/akm/Git/Clonned/Official/router-fw/rax120v2/RAX120v2v1-V1.2.8.40/extractions/RAX120-V1.2.8.40.img.extracted/620040/extractions/Linux-4.4.60.bin.extracted/0/squashfs-root/etc/init.d/ubootupgrade.sh /home/akm/Git/Clonned/Official/router-fw/rax120v2/RAX120v2v1-V1.2.9.52/extractions/RAX120-V1.2.9.52.img.extracted/620040/extractions/Linux-4.4.60.bin.extracted/0/squashfs-root/etc/init.d/ubootupgrade.sh
--- /home/akm/Git/Clonned/Official/router-fw/rax120v2/RAX120v2v1-V1.2.8.40/extractions/RAX120-V1.2.8.40.img.extracted/620040/extractions/Linux-4.4.60.bin.extracted/0/squashfs-root/etc/init.d/ubootupgrade.sh	1970-01-01 06:00:00.000000000 +0600
+++ /home/akm/Git/Clonned/Official/router-fw/rax120v2/RAX120v2v1-V1.2.9.52/extractions/RAX120-V1.2.9.52.img.extracted/620040/extractions/Linux-4.4.60.bin.extracted/0/squashfs-root/etc/init.d/ubootupgrade.sh	2023-04-07 07:53:03.000000000 +0600
@@ -0,0 +1,73 @@
+#!/bin/sh
+
+version=`devmem 0x0194D000`
+ubootversion=`strings /dev/mtd15 |grep U-boot |awk '{print $3}'`
+nosmmu=`/bin/config get uboot_nosmmu`
+mkdir -p /tmp/cache/uboot
+#6       DEVCFG           BCH           0x900000        0x80000 devcfg_nosmmu.mbn
+#15      APPSBL           BCH           0xd80000       0x100000     openwrt-ipq807x-u-boot.mbn
+
+upgrade_uboot()
+{
+	uboot=$1
+	tar xvf /lib/uboot/$uboot.tar.gz -C /tmp/cache/uboot/
+	tar xvf /lib/uboot/devcfg.tar.gz -C /tmp/cache/uboot/
+	if [ "$?" = "0" ];then
+		nandwrite -p /dev/mtd15 /tmp/cache/uboot/$uboot/openwrt-ipq807x-u-boot.mbn
+		if [ "$uboot" = "ubootv16-crash" ]; then
+			flash_erase /dev/mtd6 0 0
+			nandwrite -p /dev/mtd6 /tmp/cache/uboot/devcfg.mbn
+			/bin/config set uboot_nosmmu=1
+			/bin/config commit
+			#sleep 3
+		fi
+		echo "++++++Upgrade uboot successfully and will reboot now !!!!!!!!!!"	
+		reboot -f
+	else
+		echo "Unzip the $1.tar.gz fail !!!"  > /dev/console
+		return
+	fi
+}
+
+upgrade_to_crashdump()
+{
+	echo "!!!!!!!!!!upgrade crashdump uboot!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"  > /dev/console
+	#if [  "x$version" = "x0x200D0102" -a "x$ubootversion" = "xV1.2" ];then
+	#	upgrade_uboot ubootv12-crash
+	#elif [ "x$version" = "x0x200D0200" -a "x$ubootversion" = "xV1.6" ];then
+	#	upgrade_uboot ubootv16-crash
+	#elif [ "x$nosmmu" != "x1" -a "x$ubootversion" = "xV1.6-Crashdump_enable" ];then
+	if [ "x$ubootversion" = "xV1.6" -o "x$ubootversion" = "xV1.6-Crashdump_enable" ]; then
+		if [ "x$nosmmu" != "x1" ]; then
+			tar xvf /lib/uboot/devcfg.tar.gz -C /tmp/cache/uboot/
+			if [ -f /tmp/cache/uboot/devcfg.mbn ];then
+				echo "++++++Upgrade devcfg.mbn successfully and will reboot now !!!!!!!!!!"
+				flash_erase /dev/mtd6 0 0
+				nandwrite -p /dev/mtd6 /tmp/cache/uboot/devcfg.mbn
+				/bin/config set uboot_nosmmu=1
+				/bin/config commit
+				sleep 3
+				reboot -f
+			fi 
+		fi
+	fi
+}
+
+upgrade_to_normal()
+{
+	echo "!!!!!!!!!!upgrade normal uboot!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"  > /dev/console
+	if [  "x$version" = "x0x200D0102" -a "x$ubootversion" = "xV1.2-crashdump-enable" ];then
+		upgrade_uboot ubootv12
+	elif [ "x$version" = "x0x200D0200" -a "x$ubootversion" = "xV1.6-Crashdump_enable" ];then
+		upgrade_uboot ubootv16
+	fi
+}
+
+case $1 in
+	crash)
+	upgrade_to_crashdump
+	;;
+	normal)
+	upgrade_to_normal
+	;;
+esac

So on the very first boot after this update, it silently re-flashes the DEVCFG partition (an actual NAND write to /dev/mtd6, followed by a forced reboot) with a variant that disables the SMMU (ARM System MMU / IOMMU) at the hardware level and it only does this once, tracked by the persistent uboot_nosmmu flag so it doesn't repeat. (SMMU = (System Memory Management Unit), so maybe it is defective?)

Basically once you flash this firmware, your /dev/mtd6 -- DEVCFG and APPSBL is permanently upgraded.
if we do a strings of new DEVCFG, we see it disabled smmu -- probably smmu was causing the infamous random reboots on RAX120v2

akm@RHEL:~/Git/Clonned/Official/router-fw/rax120v2/Stock-Backup/mtd-dump$ strings mtd6.bin | grep smmu
disable_smmu_ac
/ac/smmu

Now since this firmware permanently rewrites /dev/mtd6, theoritically, even if we downgrade stock firmware to any previous version, this random reboot fix will persists and wont happen again -- not even on openwrt.

Another interesting changes in Netgear stock V1.2.10.56

I also did a diff between V1.2.9.52 and latest release V1.2.10.56, something very interesting came up.

OFDMA / MU-MIMO gets force-disabled for "WW" region

This shows up in three places, all pointing the same direction:

/etc/init.d/boot, /etc/rc.d/S10boot, /etc/rc.d/K98boot (identical patch in all three):

if [ "x$(/bin/config get ww_region_default)" != "x0" -a "x$region" = "xWW" ]; then
    /bin/config set wla_dl_ofdma="0"
    /bin/config set wlg_dl_ofdma="0"
    /bin/config set wla_mu_mimo="0"
    /bin/config set wlg_mu_mimo="0"
    /bin/config set ww_region_default="0"
fi

/sbin/update-wifi — the same region check also gets baked onto four separate functions (he_dlofdma, he_ulofdma, he_ulmumimo, and the generic mu_mimo setter), each forcing the value to 0 when region is WW.

So for some reason netgear decided to completely disable ofdma and mumimo for ww region entirely. So if anyone is using this firmware, chances are ofdma and mumimo is permanently disabled (even if it is enabled in netgear web gui).

The changelog for V1.2.10.56 stock says "Security fixes", idk if netgear by security fixes meant nerfing radios or possibly being compliant with wifi rules.

Though it is true and well documented that setting certain regions like NA (north america) using telnet boosts wifi signals on stock (benchmark and noted here)

Changing region permanently is easy, Just enable telnet then use artmtd to change region.

root@RAX120v2:/# artmtd
Usage: artmtd -r name [<arguments> ...]

************* SN Usage:
SN read:
artmtd -r sn

SN write:
artmtd -w sn number
For instance: artmtd -w sn 1ML1747D0000B
SN should be 0~9 or A~Z

************* REGION Usage:

REGION read:
artmtd -r region

REGION wirte:
Usage: artmtd -w region region name
For instance : artmtd -w region NA
The REGION name only is "NA,WW,GR,PR,RU,BZ,IN,KO,JP,AU,CA,US"

************* LANGUAGE Usage:

Language read:
artmtd -r language

************* SSID Usage:
ssid read:
artmtd -r ssid

ssid read:
artmtd -w ssid SSID


************* PASSPHRASE Usage:
passphrase read:
artmtd -r passphrase

passphrase read:
artmtd -w passphrase PASSPHRASE


************* WPSPIN Usage:
wpspin read:
artmtd -r wpspin

wpspin write:
artmtd -w wpspin 12345670


*************HW MODEL ID Usage:
HW MODEL ID read:
artmtd -r board_hw_id
artmtd -r board_model_id
artmtd -w board_hw_id HW_ID
artmtd -w board_model_id MODEL_ID

*************MAC Usage:ssid read:
artmtd -r mac

ssid read:
artmtd -w mac_lan 00:11:22:33:44:50

ssid read:
artmtd -w mac_wan 00:11:22:33:44:51

ssid read:
artmtd -w mac_5g  00:11:22:33:44:52

ssid read:
artmtd -w mac_bluetooth  00:11:22:33:44:53


*************BOOT PART Usage:board data read:
artmtd -r boot_part

board data write:
artmtd -w boot_part [1|2]


************* NMRP Usage:
nmrp read:
artmtd -r nmrp

nmrp write:
artmtd -w nmrp 1/0


************* SW_FEATURE Usage:
sw_feature read:
artmtd -r sw_feature

sw_feature write:
artmtd -w sw_feature 0001

Additional Findings

To disable Netgear Armor bloat on stock firmware (if you so choose), set this config entry using telnet and reboot.

/bin/config set dgc_func_have_armor=0
/bin/config commit

It should disable armor backend permanently -- at least untill a full router reset. Netgear scattered if-def blocks in various places, explicitely checking this to enable Netgear armor and bitdefender:

if [ "`/bin/config get dgc_func_have_armor`" != "1" ]; then

cheers!

Thank you so much for this. This is a more definitive solution than my jank files, which I got because I was deperately trying to make the RAX120 work and I was quite appalled at the disastrous 5G range.

I wonder why upstream still effs the cal data up to this day....

Edit: Any way to find out once we're in OpenWRT to check the capabilities you mention with artmtd? Though I'm pretty sure my RAX120s never touched 1.2.10 and are US region I'd rather double check.

Unfortunately artmtd binary is only available on stock firmware in /sbin/ folder. Only way to change region of art partition is enabling telnet then using that binary to write new region.

akm@RHEL:~/Git/Clonned/netgear_telnet$ python3 telnet-enable.py 172.20.0.1 C89E43811A34 admin @Km1234567
Netgear Telnet enabler V3.1 (c) B.Kerler 2021-2023
Done sending pw data 75A8C6B2293B476E26CFBC89F52260CE6488033EFDA6E5EDCE91A4C7B41F7454 to 172.20.0.1:23
akm@RHEL:~/Git/Clonned/netgear_telnet$ telnet 172.20.0.1
Trying 172.20.0.1...
Connected to 172.20.0.1.
Escape character is '^]'.
 === LOGIN ===============================
  Please enter your account and password,
  It's the same with DUT GUI
 ------------------------------------------
telnet account:admin
telnet password:
=== IMPORTANT ============================
 Use 'passwd' to set your login password
 this will disable telnet and enable SSH
------------------------------------------


BusyBox v1.31.1 () built-in shell (ash)
Enter 'help' for a list of built-in commands.

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Chaos Calmer, RAX120-V1.2.9.52+r49254)
 ---------------------------------------------------------------
root@RAX120v2:/# artmtd -r region
The region number is: 0x0001
REGION: NA
root@RAX120v2:/# 

To change region:

artmtd -w region NA

As for Wi-Fi range issue, I'm not entirely sure whether the ath11k driver strictly relies on OpenWrt's regdb software country codes, or if it hard-enforces regulatory domain limitations embedded directly within the hardware's ART partition. If it uses regdb, region change in art patition probably won't matter.

I did used a script few months ago when i switched to NSS Openwrt to fix caldata when run, you can see the script here / copy onto your openwrt and run to fix caldata. It'll fetch caldata according to your unit and replace and fix MAC and wifi range. Though do note this script expects netgear board-2.bin in /sbin folder, if you must use / want tri band configuration, delete that line. (PS: More useful scripts here)

Honestly I bought this router for cheap second hand on ebay, and it shipped with FW V1.2.9.52, So i never had that reboot issue. You can flash this stock fw or any fw that came after this version to fix the random reboots.

But do note, upon flashing this V1.2.9.52 stock fw, it will PERMANENTLY write /dev/mtd6 (DEVCFG) -- Qualcomm Device Configuration partition AND /dev/mtd15 (APPSBL) Application Secondary Bootloader (U-Boot). So you may consider taking backup of mtd6 and mtd15 if you want to keep that partition / compare and see changes later (which I never got to do unfortunately).

Hello,

Thank you for all the work on the NSS builds. I have good range and speed on the 5g bands

I am using the following firmware provided by AKM-04:

Device: Netgear RAX120v2
Release: RAX120v2_25.12-snapshot_25-01-2026
OpenWrt revision: r0-009bb0c
Kernel: 6.12.67

I am trying to install Tailscale.

Running:

apk add tailscale

returns:

ERROR: unable to select packages:
  kmod-tun (no such package):
    required by: tailscale-1.98.3-r1[kmod-tun]

Additional troubleshooting:

ls -l /dev/net/tun
-> No such file or directory

modprobe tun
-> failed to find a module named tun

find /lib/modules/$(uname -r) -type f | grep tun
-> No results

Is kmod-tun intentionally omitted from this build, or is the package feed incomplete?

Would it be possible to include kmod-tun in the firmware or publish the matching package so Tailscale can be installed?

Thank you!

tried accessing that URL with your browser ?