Signed up for a 5G fixed wireless plan last week and received the modem today. Great hardware, rubbish default config. Runs an old version of OpenWRT. Appears to be a reference design (HK09)
Full u-boot output
Full bootlog
I haven't been able to work out how to do a firmware dump yet but would love some guidance on how to do so.
@robimarko I believe this should build against your IPQ807x backport branch (save for the Quectel RM500Q modem). Is this correct?
Despite it saying AP-HK09, its probably quite different, even if it wasn't there is no HK09 support at all.
But if you want to add it please use the ipq807x-5.15 branch as base
Thanks for replying!
I dumped all the partitions from the device and uploaded them to GitHub for future reference:
I'll have a crack at building for it tonight and will post my results. I'm a newbie so it might be a mess 
Can you check if secure boot is enabled first?
U-boot will tell you during boot
boot log's in the 1st post ?
Yeah, I completely missed it.
Nice, the secure fuse is not blown.
@kylemd I don't know what are you gonna build as there is no support for that board at all.
Ideally you would get the GPL dump and then it probably can be supported
Thanks for your help. Sucks that there isn't anything out there that it would make it easy.
I've E-Mailed Telstras' dev team and Arcadyan, let's see if anything comes of that.
In the meantime I did find references to it in what I presume is the QSDK on an unnamed server. It's the only place I can find the AP-HK09 referenced:
http://35.208.87.16/ubihub-ipq/develop/
http://35.208.87.16/ubihub-ipq/develop/ubihub-ipq-0.0.755/sdk/OpenWrt-SDK-ipq-ipq807x_64_gcc-5.2.0_musl-1.1.16.Linux-x86_64.tar.bz2
ag -iuz --silent HK09 ./
Binary file .git\index matches.
Binary file develop\ubihub-ipq-0.0.755\build\bin\norplusemmc-ipq807x_64_v1.2-apps.img matches.
Binary file develop\ubihub-ipq-0.0.755\build\bin\norplusemmc-ipq807x_64_v2.0-apps.img matches.
Binary file develop\ubihub-ipq-0.0.755\build\bin\norplusemmc-ipq807x_64_v1.2-single.img matches.
Binary file develop\ubihub-ipq-0.0.755\build\bin\norplusemmc-ipq807x_64_v2.0-single.img matches.
develop\ubihub-ipq-0.0.755\build\ipq_x64\index.html
49:<a href="cdt-AP-HK09_512M16_DDR4.bin">cdt-AP-HK09_512M16_DDR4.bin</a> 11-Mar-2022 03:11 548
50:<a href="cdt-AP-HK09_512M16_DDR4.bin.padded">cdt-AP-HK09_512M16_DDR4.bin.padded</a> 11-Mar-2022 03:11
1024
132:<a href="openwrt-ipq-ipq807x_64-qcom-ipq807x-hk09-fit-uImage-initramfs.itb">openwrt-ipq-ipq807x_64-qcom-ipq807x-hk09-fit-uI..></a> 11-Mar-2022 03:11 38067376
133:<a href="openwrt-ipq-ipq807x_64-qcom-ipq807x-hk09-fit-uImage.itb">openwrt-ipq-ipq807x_64-qcom-ipq807x-hk09-fit-uI..></a> 11-Mar-2022 03:11 4079760
191:<a href="qcom-ipq807x-hk09.dtb">qcom-ipq807x-hk09.dtb</a> 11-Mar-2022 03:11 84863
develop\ubihub-ipq-0.0.755\build\ipq_x64\ipq807x\config.xml
130: <board>AP-HK09</board>
develop\ubihub-ipq-0.0.755\build\ipq_x64\ipq807x\machid_xml\index.html
19:<a href="AP-HK09_512M16_DDR4.xml">AP-HK09_512M16_DDR4.xml</a> 11-Mar-2022 03:11 10095
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq-ipq807x_64-qcom-ipq807x-hk09-fit-uImage.itb matches.
Binary file .git\objects\b5\bfffc1397270eba4a2bfc8628e46b85e150cc0 matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq-ipq807x_64-qcom-ipq807x-hkxx-fit-uImage.itb matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq-ipq807x_64-qcom-ipq807x-hkxx-fit-uImage.itb.padded matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq-ipq807x_64-qcom-ipq807x-hk09-fit-uImage-initramfs.itb matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq807x-u-boot.img matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq807x-u-boot.mbn matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq-ipq807x_64-ubi-root-m4096-p256KiB.img matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq-ipq807x_64-ubi-root-m4096-p512KiB.img matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq807x-u-boot.mbn.padded matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq807x-u-boot_phdr.pbn matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq-ipq807x_64-ubi-root.img matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\openwrt-ipq807x-u-boot.elf matches.
Binary file develop\ubihub-ipq-0.0.755\build\ipq_x64\qcom-ipq807x-hk09.dtb matches.
develop\ubihub-ipq-0.0.755\build\update_common.log
278:2022-03-11 03:10:22,582 cdt_generator.py 227 INFO: Filename: '/home/jenkins/workspace/ubihub-ipq/common/build/ipq_x64/ipq807x/machid_xml/AP-HK09_512M16_DDR4.xml'
291:Created 'cdt-AP-HK09_512M16_DDR4.bin'
320:0x8010008 AP-HK09 512M16_DDR4
366: cdt_info_file location: /home/jenkins/workspace/ubihub-ipq/common/build/ipq_x64/ipq807x/machid_xml/AP-HK09_512M16_DDR4.xml
2652:<stdout>: Warning (unit_address_vs_reg): Node /images/ddr-AP-HK09_512M16_DDR4-43ce18dc0c2a45c785530d5bcf69215d2c788487/hash@1 has a unit name, but no reg property
2878: Image 21 (ddr-AP-HK09_512M16_DDR4-43ce18dc0c2a45c785530d5bcf69215d2c788487)
2879: Description: cdt-AP-HK09_512M16_DDR4.bin.padded
3059:<stdout>: Warning (unit_address_vs_reg): Node /images/ddr-AP-HK09_512M16_DDR4-c8b273c53d89bfdbc1d2c98d4d188710523efda0/hash@1 has a unit name, but no reg property
3285: Image 21 (ddr-AP-HK09_512M16_DDR4-c8b273c53d89bfdbc1d2c98d4d188710523efda0)
3286: Description: cdt-AP-HK09_512M16_DDR4.bin
3465:<stdout>: Warning (unit_address_vs_reg): Node /images/ddr-AP-HK09_512M16_DDR4-43ce18dc0c2a45c785530d5bcf69215d2c788487/hash@1 has a unit name, but no reg property
3681: Image 20 (ddr-AP-HK09_512M16_DDR4-43ce18dc0c2a45c785530d5bcf69215d2c788487)
3682: Description: cdt-AP-HK09_512M16_DDR4.bin.padded
3861:<stdout>: Warning (unit_address_vs_reg): Node /images/ddr-AP-HK09_512M16_DDR4-c8b273c53d89bfdbc1d2c98d4d188710523efda0/hash@1 has a unit name, but no reg property
4079: Image 20 (ddr-AP-HK09_512M16_DDR4-c8b273c53d89bfdbc1d2c98d4d188710523efda0)
4080: Description: cdt-AP-HK09_512M16_DDR4.bin
4279:<stdout>: Warning (unit_address_vs_reg): Node /images/ddr-AP-HK09_512M16_DDR4-43ce18dc0c2a45c785530d5bcf69215d2c788487/hash@1 has a unit name, but no reg property
4493: Image 20 (ddr-AP-HK09_512M16_DDR4-43ce18dc0c2a45c785530d5bcf69215d2c788487)
4494: Description: cdt-AP-HK09_512M16_DDR4.bin.padded
4653:<stdout>: Warning (unit_address_vs_reg): Node /images/ddr-AP-HK09_512M16_DDR4-c8b273c53d89bfdbc1d2c98d4d188710523efda0/hash@1 has a unit name, but no reg property
4867: Image 20 (ddr-AP-HK09_512M16_DDR4-c8b273c53d89bfdbc1d2c98d4d188710523efda0)
4868: Description: cdt-AP-HK09_512M16_DDR4.bin
5678:2022-03-11 03:10:36,568 cdt_generator.py 227 INFO: Filename: '/home/jenkins/workspace/ubihub-ipq/common/build/ipq_x64/ipq807x/machid_xml/AP-HK09_512M16_DDR4.xml'
5691:Created 'cdt-AP-HK09_512M16_DDR4.bin'
5720:0x8010008 AP-HK09 512M16_DDR4
5766: cdt_info_file location: /home/jenkins/workspace/ubihub-ipq/common/build/ipq_x64/ipq807x/machid_xml/AP-HK09_512M16_DDR4.xml
7326:2022-03-11 03:10:41,243 cdt_generator.py 227 INFO: Filename: '/home/jenkins/workspace/ubihub-ipq/common/build/ipq_x64/ipq807x/machid_xml/AP-HK09_512M16_DDR4.xml'
7339:Created 'cdt-AP-HK09_512M16_DDR4.bin'
7368:0x8010008 AP-HK09 512M16_DDR4
7414: cdt_info_file location: /home/jenkins/workspace/ubihub-ipq/common/build/ipq_x64/ipq807x/machid_xml/AP-HK09_512M16_DDR4.xml
Binary file develop\ubihub-ipq-0.0.755\packages\ubifeed\ubi-lte-ota_rc_1.0.0-20220128-f6a1423-1_ipq.ipk.cms matches.
If you don’t get anywhere please let me know and I’ll try to move some things internally at the big T. No promises.
Ultimately it is my personal opinion that it is Arcadyans responsibility to provide the GPL, but we will see what comes back.
I think so too, but I figured I'd hit Telstra up because the last lot of source code for an Arcadyan device (that I can find anyway) came from Telefonica Germany (o2)
That would be greatly appreciated, thanks!
Please don't rely on the HK09 reference at all, it's probably just based on it and then heavily modified.
You can find all of the QSDK parts in QCA-s Codeaurora repos, kernel for example:
https://source.codeaurora.org/quic/qsdk/oss/kernel/linux-ipq-5.4/tree/?h=NHSS.QSDK.12.1.r2
Not a lawyer, but....
The GPL is really applied copyright law. You can't hide behind some sub-contractor. All obligations and rights follw the entire supply chain. It's not like you are free to distribute a movie just because you got it from someone else.
Sure, and you may be right.
I’ve clarified my statement above to make it absolutely clear. What I said is my opinion, and not a statement on behalf of anyone/thing else.
Let’s just see where it goes 
Been a while!
I never did hear back from Arcadyan or Telstra.
I'll have to see if there's anything I can do to bring the device up!
Unfortunately i was not able to source anything. I’d suggest persisting with Arcadyan
Hi, i have gained root access to the device, am backing up everything and way planning on doing a sysupgrade...has anyone else got any further than this? I gained root by uploading a new socat file to open 22 and then tried root:root on my first attempt which just happened to work... no need to brute force it!
Anyway, if anyone has any pearls of wisdom it would be greatly appreciated.
My goal is to have firewall control and port forwarding etc. Wifi isnt needed, anything else is a bonus.
I can use socat to port forward i guess...
Dear all,
i'm trying to porting OpenWRT on Arcadyan AW-1000. This router is based on IPQ8072 chip with an onboard Quectel RG500Q.
I'm starting using as baseline Buffalo WXR-5950AX12, here is my first DTS but i got error on compile:
// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
/dts-v1/;
#include "ipq8074.dtsi"
#include "ipq8074-hk-cpu.dtsi"
#include "ipq8074-ess.dtsi"
#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/leds/common.h>
#include <dt-bindings/input/input.h>
/ {
model = "Arcadyan AW1000";
compatible = "arcadyan,aw1000", "qcom,ipq8074";
aliases {
serial0 = &blsp1_uart5;
led-boot = &led_power_white;
led-failsafe = &led_power_red;
led-running = &led_power_white;
led-upgrade = &led_power_white;
label-mac-device = &dp5_syn;
};
chosen {
stdout-path = "serial0:115200n8";
bootargs-append = " ubi.mtd=user_property root=/dev/ubiblock1_0";
};
leds {
compatible = "gpio-leds";
led-0 {
label = "white:router";
gpios = <&tlmm 21 GPIO_ACTIVE_HIGH>;
color = <LED_COLOR_ID_WHITE>;
};
led-1 {
label = "red:router";
gpios = <&tlmm 22 GPIO_ACTIVE_HIGH>;
color = <LED_COLOR_ID_RED>;
};
led_power_red: led-2 {
label = "red:power";
gpios = <&tlmm 31 GPIO_ACTIVE_HIGH>;
color = <LED_COLOR_ID_RED>;
function = LED_FUNCTION_POWER;
};
led_power_white: led-3 {
label = "white:power";
gpios = <&tlmm 34 GPIO_ACTIVE_HIGH>;
color = <LED_COLOR_ID_WHITE>;
function = LED_FUNCTION_POWER;
};
led-4 {
label = "white:internet";
gpios = <&tlmm 43 GPIO_ACTIVE_HIGH>;
color = <LED_COLOR_ID_WHITE>;
};
led-5 {
label = "red:internet";
gpios = <&tlmm 44 GPIO_ACTIVE_HIGH>;
color = <LED_COLOR_ID_RED>;
};
led-6 {
label = "red:wireless";
gpios = <&tlmm 55 GPIO_ACTIVE_HIGH>;
color = <LED_COLOR_ID_RED>;
function = LED_FUNCTION_WLAN;
};
led-7 {
label = "white:wireless";
gpios = <&tlmm 56 GPIO_ACTIVE_HIGH>;
color = <LED_COLOR_ID_WHITE>;
function = LED_FUNCTION_WLAN;
};
};
keys {
compatible = "gpio-keys";
/*
* mode: 3x position switch
*
* - ROUTER
* - AP
* - WB (Wireless Bridge)
*/
ap {
label = "mode-ap";
gpios = <&tlmm 29 GPIO_ACTIVE_LOW>;
linux,code = <BTN_0>;
};
bridge {
label = "mode-wb";
gpios = <&tlmm 30 GPIO_ACTIVE_LOW>;
linux,code = <BTN_1>;
};
/*
* op: 2x position switch
*
* - AUTO
* - MANUAL (select Router/AP/WB manually)
*/
manual {
label = "op-manual";
gpios = <&tlmm 52 GPIO_ACTIVE_LOW>;
linux,code = <BTN_2>;
};
wps {
label = "wps";
gpios = <&tlmm 51 GPIO_ACTIVE_LOW>;
linux,code = <KEY_WPS_BUTTON>;
};
reset {
label = "reset";
gpios = <&tlmm 54 GPIO_ACTIVE_LOW>;
linux,code = <KEY_RESTART>;
};
};
reg_usb_vbus: regulator-5v-vbus {
compatible = "regulator-fixed";
regulator-name = "vbus";
regulator-min-microvolt = <5000000>;
regulator-max-microvolt = <5000000>;
gpio = <&tlmm 64 GPIO_ACTIVE_HIGH>;
enable-active-high;
regulator-always-on;
};
};
&tlmm {
mdio_pins: mdio-pins {
mdc {
pins = "gpio68";
function = "mdc";
drive-strength = <8>;
bias-pull-up;
};
mdio {
pins = "gpio69";
function = "mdio";
drive-strength = <8>;
bias-pull-up;
};
};
};
&blsp1_uart5 {
status = "okay";
};
&prng {
status = "okay";
};
&cryptobam {
status = "okay";
};
&crypto {
status = "okay";
};
&qpic_bam {
status = "okay";
};
&qpic_nand {
status = "okay";
nand@0 {
reg = <0>;
nand-ecc-strength = <4>;
nand-ecc-step-size = <512>;
nand-bus-width = <8>;
partitions {
compatible = "qcom,smem-part";
partition-0-appsblenv {
compatible = "fixed-partitions";
label = "0:appsblenv";
read-only;
#address-cells = <1>;
#size-cells = <1>;
partition@0 {
compatible = "u-boot,env";
label = "env-data";
reg = <0x0 0x40000>;
macaddr_appsblenv_ethaddr: ethaddr {
};
};
};
};
};
};
&mdio {
status = "okay";
pinctrl-0 = <0x2b>;
pinctrl-names = "default";
compatible = "qcom,ipq40xx-mdio";
phy-reset-gpio = <0x0f 0x25 0x00 0x0f 0x40 0x01>;
qca8075_1: ethernet-phy@0 {
reg = <0x00>;
};
qca8075_2: ethernet-phy@1 {
reg = <0x01>;
};
qca8075_3: ethernet-phy@2 {
reg = <0x02>;
};
qca8075_4: ethernet-phy@3 {
reg = <0x03>;
};
qca8075_5: ethernet-phy@4 {
reg = <0x04>;
};
qca8075_6: ethernet-phy@5 {
reg = <0x1c>;
};
&switch {
status = "okay";
switch_cpu_bmp = <0x01>;
switch_lan_bmp = <0x3e>;
switch_wan_bmp = <0x40>;
switch_mac_mode = <0x0b>;
switch_mac_mode1 = <0xff>;
switch_mac_mode2 = <0x0f>;
bm_tick_mode = <0>;
tm_tick_mode = <0>;
qcom,port_phyinfo {
port@0 {
port_id = <1>;
phy_address = <0x00>;
};
port@1 {
port_id = <2>;
phy_address = <0x01>;
};
port@2 {
port_id = <3>;
phy_address = <0x02>;
};
port@3 {
port_id = <4>;
phy_address = <0x03>;
};
port@4 {
port_id = <5>;
phy_address = <0x04>;
};
port@5 {
port_id = <6>;
phy_address = <0x1c>;
};
};
};
&edma {
status = "okay";
};
&dp2 {
status = "okay";
phy-handle = <&qca8075_2>;
label = "lan4";
nvmem-cells = <&macaddr_appsblenv_ethaddr>;
nvmem-cell-names = "mac-address";
};
&dp3 {
status = "okay";
phy-handle = <&qca8075_3>;
label = "lan3";
nvmem-cells = <&macaddr_appsblenv_ethaddr>;
nvmem-cell-names = "mac-address";
};
&dp4 {
status = "okay";
phy-handle = <&qca8075_4>;
label = "lan2";
nvmem-cells = <&macaddr_appsblenv_ethaddr>;
nvmem-cell-names = "mac-address";
};
&dp5_syn {
status = "okay";
phy-handle = <&qca8075_5>;
label = "wan";
nvmem-cells = <&macaddr_appsblenv_ethaddr>;
nvmem-cell-names = "mac-address";
};
&dp6_syn {
status = "okay";
phy-handle = <&qca8075_6>;
label = "lan1";
nvmem-cells = <&macaddr_appsblenv_ethaddr>;
nvmem-cell-names = "mac-address";
};
&ssphy_0 {
status = "okay";
};
&qusb_phy_0 {
status = "okay";
};
&usb_0 {
status = "okay";
vbus-supply = <®_usb_vbus>;
};
&wifi {
status = "okay";
qcom,ath11k-calibration-variant = "Buffalo-WXR-5950AX12";
};
The error is at line is this one /ipq8074-wxr-5950ax12.dts:245.1-8 syntax error, but line 245 is the word &switch
Here is also the original DTS that i've extracted from a OWRT chinese firmware:
@robimarko any hints?
thanks in advance!
qca8075_6: ethernet-phy@5 {
reg = <0x1c>;
needs to be:
qca8075_6: ethernet-phy@5 {
reg = <0x1c>;
};
damn.. ok i've fixed it and now compiles, but on the boot msg i see this one:
[ 2.385693] ssdk_phy_driver_init[369]:INFO:dev_id = 0, phy_adress = 0, phy_id = 0x0 phytype doesn't match
[ 2.385744] ssdk_phy_driver_init[369]:INFO:dev_id = 0, phy_adress = 1, phy_id = 0x0 phytype doesn't match
[ 2.394293] ssdk_phy_driver_init[369]:INFO:dev_id = 0, phy_adress = 2, phy_id = 0x0 phytype doesn't match
[ 2.403813] ssdk_phy_driver_init[369]:INFO:dev_id = 0, phy_adress = 3, phy_id = 0x0 phytype doesn't match
[ 2.413360] ssdk_phy_driver_init[369]:INFO:dev_id = 0, phy_adress = 4, phy_id = 0x0 phytype doesn't match
[ 2.422908] ssdk_phy_driver_init[369]:INFO:dev_id = 0, phy_adress = 5, phy_id = 0x0 phytype doesn't match
That means the phys aren't recognised on mdio.
You are using qsdk dts syntax, that's not working in the upstream kernel from OpenWrt.
Set the mdio node/properties accordingly, for example:
There's is only one mdio reset-gpio possible, set the second reset at the the last phy property.
The same goes for any other part of your dts, do not use qsdk code at all.