TP-Link AX1800(USW) Ver:4.6

nebulousdrawing · January 9, 2026, 8:34pm

I know at least some folks are working on getting support for the AX1800(USW) 4.6:

I also did a teardown like @cholman and found the same chips. Anyone know where to start with building the firmware or has anyone started working on it?

SoC: MediaTek MT7621AT (dual core CPU; datasheet)
WiFi Chips: MediaTek MT7975DN + MT7905DAN (this might be helpful; datasheet for 7095)
ESMT M15T1G1664A (DDR3L DRAM either one of these or these, but not sure)
Eon EN25HQ128A (128Mb serial flash (NOR) according to this datasheet)

nebulousdrawing · January 9, 2026, 8:56pm

Ah, this would have been helpful a while ago. Down the rabbit hole I go

hecatae · January 9, 2026, 9:16pm

Have you got serial UART access?
Your specs seem very similar to

nebulousdrawing · January 9, 2026, 9:22pm

No, I don't have a UART to USB adapter. Been thinking about ordering one, though. Would pulling the firmware directly off my device be better than referencing what TP-Link provides on their website (here; extracted using binwalk)?

hecatae · January 9, 2026, 9:33pm

Seeing if you have bootloader access so we can tftpboot an initramfs without affecting the flash would be a worthwhile purchase of a 3.3v UART to USB adapter

brada4 · January 9, 2026, 9:35pm

https://www.tp-link.com/us/support/download/archer-ax1800/v4.60/#Firmware

(they filter hot links, you have to copy/paste it)

Partition layout is a lot like AX23 (bootlog in wiki page)

partition fs-uboot base 0x00000 size 0x40000
partition os-image base 0x40000 size 0x400000
partition file-system base 0x440000 size 0xb60000
partition default-mac base 0xfa0000 size 0x00200
partition pin base 0xfa0200 size 0x00100
partition device-id base 0xfa0300 size 0x00100
partition product-info base 0xfa0400 size 0x0fc00
partition default-config base 0xfb0000 size 0x06000
partition ap-def-config base 0xfb6000 size 0x05000
partition re-def-config base 0xfbb000 size 0x05000
partition user-config base 0xfc0000 size 0x0a000
partition ag-config base 0xfca000 size 0x04000
partition certificate base 0xfce000 size 0x02000
partition ap-config base 0xfd0000 size 0x06000
partition router-config base 0xfd6000 size 0x06000
partition favicon base 0xfdc000 size 0x02000
partition logo base 0xfde000 size 0x02000
partition partition-table base 0xfe0000 size 0x00800
partition soft-version base 0xfe0800 size 0x00100
partition support-list base 0xfe0900 size 0x00400
partition profile base 0xfe0d00 size 0x03000
partition extra-para base 0xfe3d00 size 0x00100
partition radio base 0xff0000 size 0x10000

Ermm - fw shared with SOME AX23....

soft_ver:1.1.3 Build 20250904 Rel. 60739
fw_id:112DF906605E34205D8FCED94B76DB8C
SupportList:
{product_name:Archer AX23,product_ver:1.0.0,special_id:55530000}
{product_name:Archer AX23,product_ver:1.20,special_id:55530000}
{product_name:Archer AX1800,product_ver:4.6,special_id:55530000}
{product_name:Archer AX23,product_ver:1.0.0,special_id:43410000}
{product_name:Archer AX23,product_ver:1.20,special_id:43410000}
{product_name:Archer AX23,product_ver:1.0.0,special_id:54570000}
{product_name:Archer AX23,product_ver:1.20,special_id:54570000}
{product_name:Archer AX23,product_ver:1.0.0,special_id:53470000}
{product_name:Archer AX23,product_ver:1.20,special_id:53470000}
{product_name:Archer AX20,product_ver:4.6,special_id:55530000}
{product_name:Archer AX21,product_ver:4.6,special_id:55530000}

nebulousdrawing · January 9, 2026, 9:39pm

Gotcha. I'll get one then and reply with any updates. Might see if I can get remote root access via telnet in the meanwhile

brada4 · January 9, 2026, 9:41pm

Check also if you can get boot log via oem web....
(guaranteed to come out if you get serial console)

nebulousdrawing · January 10, 2026, 1:07am

Doesn't seem to be one, or at least I couldn't find evidence for one using binwalk or, once extracted, anywhere in the system files

brada4 · January 10, 2026, 1:26am

They do remove that recently and push cloud app

sparky8512 · January 10, 2026, 9:16pm

That looks like identical PCB hardware to the Archer AX21(US) v4.6, so I expect you will be able to load the AX21 OpenWRT image once that gets fully enabled in the official OpenWRT builds. The stock firmware images for AX21(US) v4.6 and AX1800(USW) v4.6 are binary identical, so I expect the difference is just in branding and the plastic case, which is a little different on AX21.

Those stock firmware images are also binary identical to the AX23(CA) v1 and AX23(CA) v1.20, so you could probably run the AX23 OpenWRT sysupgrade image, too, but probably won't be able to load its factory.bin, since the OpenWRT AX23 image does not list the US version of AX1800 in its supported hardware table.

brada4 · January 10, 2026, 9:35pm

You must add safeloader string, serial still highly recommended unless OP dedicates router to sacrifice for porting gods.

sparky8512 · January 10, 2026, 10:07pm

safeloader string for the US AX1800 is already present in the AX21 configuration that was added recently, but the version of the firmware-utils package being used in the openwrt tree has not yet been updated to pick that change up.

100% agreed on the serial recommendation.

nebulousdrawing · January 10, 2026, 11:33pm

I don't really feel like making a sacrifice right now so I'll wait for that UART adapter to come in the mail lol. Good to know that the PCB hardware and bins are identical to the AX21, though

TheEight-BitLink · January 14, 2026, 4:38am

I picked one of these up, cracked it open, and probed in with a Bus Pirate. The unit boots fine with the AX23 24.10.5 initramfs-kernel.bin loaded with TFTP per the AX23v1 TFTP method. I recorded both the standard boot process, as well as the boot process with the initramfs image loaded with bootm. I can provide the boot logs, though they’re pretty long, or perform any other tests as wanted.

nebulousdrawing · January 15, 2026, 6:47pm

My adapter just came in the mail but it seems I've been beaten to the chase lol. Anything stick out as notable (either good or bad) in the logs? Feel free to drop them in here, too, if you want

brada4 · January 15, 2026, 7:24pm

Compare partitions to AX23 https://openwrt.org/toh/tp-link/archer_ax23_v1#oem_bootlog
If they are same netboot AX23v1 initramfs and back them up
Check if LED-s are controllable, MAC is correct, 5GHZ wifi powers are ok - you do not have to bring up radio to check - iw reg set BE iw phy -> check 5GHz band has 1st 4 23dbm then 23 then 26 then 13, also check US, JP and whatever countries you choose, but restart before bringing up radio.

TheEight-BitLink · January 21, 2026, 5:18am

Sorry for the late reply. LEDs are controllable, 5 GHz works to connect to as well as 2.4GHz, LuCI works.
iw phy output:

root@OpenWrt:~# iw phy
Wiphy phy1
wiphy index: 1
max # scan SSIDs: 4
max scan IEs length: 2190 bytes
max # sched scan SSIDs: 0
max # match sets: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Device supports AP-side u-APSD.
Device supports T-DLS.
Available Antennas: TX 0x3 RX 0x3
Configured Antennas: TX 0xc RX 0xc
Supported interface modes:
* IBSS
* managed
* AP
* AP/VLAN
* monitor
* mesh point
* P2P-client
* P2P-GO
Band 2:
Capabilities: 0x9ff
RX LDPC
HT20/HT40
SM Power Save disabled
RX Greenfield
RX HT20 SGI
RX HT40 SGI
TX STBC
RX STBC 1-stream
Max AMSDU length: 7935 bytes
No DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: 4 usec (0x05)
HT TX/RX MCS rate indexes supported: 0-15
VHT Capabilities (0x339939b1):
Max MPDU length: 7991
Supported Channel Width: neither 160 nor 80+80
RX LDPC
short GI (80 MHz)
TX STBC
SU Beamformer
SU Beamformee
MU Beamformer
MU Beamformee
RX antenna pattern consistency
TX antenna pattern consistency
VHT RX MCS set:
1 streams: MCS 0-9
2 streams: MCS 0-9
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
VHT RX highest supported: 0 Mbps
VHT TX MCS set:
1 streams: MCS 0-9
2 streams: MCS 0-9
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
VHT TX highest supported: 0 Mbps
VHT extended NSS: not supported
HE Iftypes: managed
HE MAC Capabilities (0x08011a000040):
+HTC HE Supported
Trigger Frame MAC Padding Duration: 2
OM Control
Maximum A-MPDU Length Exponent: 3
A-MSDU in A-MPDU
HE PHY Capabilities: (0x44700e920d01f30e423f00):
HE40/HE80/5GHz
242 tone RUs/5GHz
Device Class: 1
LDPC Coding in Payload
HE SU PPDU with 1x HE-LTF and 0.8us GI
NDP with 4x HE-LTF and 3.2us GI
STBC Tx <= 80MHz
STBC Rx <= 80MHz
DCM Max Constellation: 2
DCM Max Constellation Rx: 2
SU Beamformer
SU Beamformee
Beamformee STS <= 80Mhz: 3
Sounding Dimensions <= 80Mhz: 1
Codebook Size SU Feedback
Codebook Size MU Feedback
Triggered CQI Feedback
Partial Bandwidth Extended Range
Partial Bandwidth DL MU-MIMO
PPE Threshold Present
Power Boost Factor ar
HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
Max NC: 1
20MHz in 40MHz HE PPDU 2.4GHz
DCM Max BW: 1
Longer Than 16HE SIG-B OFDM Symbols
Non-Triggered CQI Feedback
TX 1024-QAM
RX 1024-QAM
RX Full BW SU Using HE MU PPDU with Compression SIGB
RX Full BW SU Using HE MU PPDU with Non-Compression SIGB
HE RX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
HE TX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
PPE Threshold 0x79 0x1c 0xc7 0x71 0x1c 0xc7 0x71
HE Iftypes: AP
HE MAC Capabilities (0x00051a081044):
+HTC HE Supported
TWT Responder
BSR
OM Control
Maximum A-MPDU Length Exponent: 3
BQR
A-MSDU in A-MPDU
OM Control UL MU Data Disable RX
HE PHY Capabilities: (0x04200e920f01af08000c00):
HE40/HE80/5GHz
LDPC Coding in Payload
NDP with 4x HE-LTF and 3.2us GI
STBC Tx <= 80MHz
STBC Rx <= 80MHz
DCM Max Constellation: 2
DCM Max Constellation Rx: 2
SU Beamformer
SU Beamformee
MU Beamformer
Beamformee STS <= 80Mhz: 3
Sounding Dimensions <= 80Mhz: 1
Codebook Size SU Feedback
Codebook Size MU Feedback
Triggered SU Beamforming Feedback
Triggered MU Beamforming Feedback
Partial Bandwidth Extended Range
PPE Threshold Present
Max NC: 1
TX 1024-QAM
RX 1024-QAM
HE RX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
HE TX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
PPE Threshold 0x79 0x1c 0xc7 0x71 0x1c 0xc7 0x71
HE Iftypes: mesh point
HE MAC Capabilities (0x00011a000040):
+HTC HE Supported
OM Control
Maximum A-MPDU Length Exponent: 3
A-MSDU in A-MPDU
HE PHY Capabilities: (0x04200c0000000000008000):
HE40/HE80/5GHz
LDPC Coding in Payload
STBC Tx <= 80MHz
STBC Rx <= 80MHz
HE RX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
HE TX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
Frequencies:
* 5180.0 MHz [36] (23.0 dBm)
* 5200.0 MHz [40] (23.0 dBm)
* 5220.0 MHz [44] (23.0 dBm)
* 5240.0 MHz [48] (23.0 dBm)
* 5260.0 MHz [52] (20.0 dBm) (radar detection)
* 5280.0 MHz [56] (20.0 dBm) (radar detection)
* 5300.0 MHz [60] (20.0 dBm) (radar detection)
* 5320.0 MHz [64] (20.0 dBm) (radar detection)
* 5500.0 MHz [100] (26.0 dBm) (radar detection)
* 5520.0 MHz [104] (26.0 dBm) (radar detection)
* 5540.0 MHz [108] (26.0 dBm) (radar detection)
* 5560.0 MHz [112] (26.0 dBm) (radar detection)
* 5580.0 MHz [116] (26.0 dBm) (radar detection)
* 5600.0 MHz [120] (26.0 dBm) (radar detection)
* 5620.0 MHz [124] (26.0 dBm) (radar detection)
* 5640.0 MHz [128] (26.0 dBm) (radar detection)
* 5660.0 MHz [132] (26.0 dBm) (radar detection)
* 5680.0 MHz [136] (26.0 dBm) (radar detection)
* 5700.0 MHz [140] (26.0 dBm) (radar detection)
* 5720.0 MHz [144] (13.0 dBm) (radar detection)
* 5745.0 MHz [149] (13.0 dBm)
* 5765.0 MHz [153] (13.0 dBm)
* 5785.0 MHz [157] (13.0 dBm)
* 5805.0 MHz [161] (13.0 dBm)
* 5825.0 MHz [165] (13.0 dBm)
* 5845.0 MHz [169] (13.0 dBm)
* 5865.0 MHz [173] (13.0 dBm)
* 5885.0 MHz [177] (disabled)
valid interface combinations:
* #{ IBSS } <= 1, #{ AP, mesh point } <= 16, #{ managed } <= 19,
total <= 19, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz, 160 MHz }

HT Capability overrides:
	 * MCS: ff ff ff ff ff ff ff ff ff ff
	 * maximum A-MSDU length
	 * supported channel width
	 * short GI for 40 MHz
	 * max A-MPDU length exponent
	 * min MPDU start spacing
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Supported extended features:
	* [ VHT_IBSS ]: VHT-IBSS
	* [ RRM ]: RRM
	* [ BEACON_RATE_LEGACY ]: legacy beacon rate setting
	* [ BEACON_RATE_HT ]: HT beacon rate setting
	* [ BEACON_RATE_VHT ]: VHT beacon rate setting
	* [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
	* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
	* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
	* [ ACK_SIGNAL_SUPPORT ]: ack signal level support
	* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
	* [ SCAN_RANDOM_SN ]: use random sequence numbers in scans
	* [ SCAN_MIN_PREQ_CONTENT ]: use probe request with only rate IEs in scans
	* [ CAN_REPLACE_PTK0 ]: can safely replace PTK 0 when rekeying
	* [ AIRTIME_FAIRNESS ]: airtime fairness scheduling
	* [ AQL ]: Airtime Queue Limits (AQL)
	* [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
	* [ DEL_IBSS_STA ]: deletion of IBSS station support
	* [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
	* [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
	* [ FILS_DISCOVERY ]: FILS discovery frame transmission support
	* [ UNSOL_BCAST_PROBE_RESP ]: unsolicated broadcast probe response transmission support
	* [ BEACON_RATE_HE ]: HE beacon rate support (AP/mesh)
	* [ BSS_COLOR ]: BSS coloring support
	* [ POWERED_ADDR_CHANGE ]: can change MAC address while up

Wiphy phy0
wiphy index: 0
max # scan SSIDs: 4
max scan IEs length: 2200 bytes
max # sched scan SSIDs: 0
max # match sets: 0
Retry short limit: 7
Retry long limit: 4
Coverage class: 0 (up to 0m)
Device supports AP-side u-APSD.
Device supports T-DLS.
Available Antennas: TX 0x3 RX 0x3
Configured Antennas: TX 0x3 RX 0x3
Supported interface modes:
* IBSS
* managed
* AP
* AP/VLAN
* monitor
* mesh point
* P2P-client
* P2P-GO
Band 1:
Capabilities: 0x9ff
RX LDPC
HT20/HT40
SM Power Save disabled
RX Greenfield
RX HT20 SGI
RX HT40 SGI
TX STBC
RX STBC 1-stream
Max AMSDU length: 7935 bytes
No DSSS/CCK HT40
Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
Minimum RX AMPDU time spacing: 4 usec (0x05)
HT TX/RX MCS rate indexes supported: 0-15
HE Iftypes: managed
HE MAC Capabilities (0x08011a000040):
+HTC HE Supported
Trigger Frame MAC Padding Duration: 2
OM Control
Maximum A-MPDU Length Exponent: 3
A-MSDU in A-MPDU
HE PHY Capabilities: (0x22700e920d01f30e423f00):
HE40/2.4GHz
242 tone RUs/2.4GHz
Device Class: 1
LDPC Coding in Payload
HE SU PPDU with 1x HE-LTF and 0.8us GI
NDP with 4x HE-LTF and 3.2us GI
STBC Tx <= 80MHz
STBC Rx <= 80MHz
DCM Max Constellation: 2
DCM Max Constellation Rx: 2
SU Beamformer
SU Beamformee
Beamformee STS <= 80Mhz: 3
Sounding Dimensions <= 80Mhz: 1
Codebook Size SU Feedback
Codebook Size MU Feedback
Triggered CQI Feedback
Partial Bandwidth Extended Range
Partial Bandwidth DL MU-MIMO
PPE Threshold Present
Power Boost Factor ar
HE SU PPDU & HE PPDU 4x HE-LTF 0.8us GI
Max NC: 1
20MHz in 40MHz HE PPDU 2.4GHz
DCM Max BW: 1
Longer Than 16HE SIG-B OFDM Symbols
Non-Triggered CQI Feedback
TX 1024-QAM
RX 1024-QAM
RX Full BW SU Using HE MU PPDU with Compression SIGB
RX Full BW SU Using HE MU PPDU with Non-Compression SIGB
HE RX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
HE TX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
PPE Threshold 0x19 0x1c 0xc7 0x71
HE Iftypes: AP
HE MAC Capabilities (0x00051a081044):
+HTC HE Supported
TWT Responder
BSR
OM Control
Maximum A-MPDU Length Exponent: 3
BQR
A-MSDU in A-MPDU
OM Control UL MU Data Disable RX
HE PHY Capabilities: (0x02200e920f01af08000c00):
HE40/2.4GHz
LDPC Coding in Payload
NDP with 4x HE-LTF and 3.2us GI
STBC Tx <= 80MHz
STBC Rx <= 80MHz
DCM Max Constellation: 2
DCM Max Constellation Rx: 2
SU Beamformer
SU Beamformee
MU Beamformer
Beamformee STS <= 80Mhz: 3
Sounding Dimensions <= 80Mhz: 1
Codebook Size SU Feedback
Codebook Size MU Feedback
Triggered SU Beamforming Feedback
Triggered MU Beamforming Feedback
Partial Bandwidth Extended Range
PPE Threshold Present
Max NC: 1
TX 1024-QAM
RX 1024-QAM
HE RX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
HE TX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
PPE Threshold 0x19 0x1c 0xc7 0x71
HE Iftypes: mesh point
HE MAC Capabilities (0x00011a000040):
+HTC HE Supported
OM Control
Maximum A-MPDU Length Exponent: 3
A-MSDU in A-MPDU
HE PHY Capabilities: (0x02200c0000000000008000):
HE40/2.4GHz
LDPC Coding in Payload
STBC Tx <= 80MHz
STBC Rx <= 80MHz
HE RX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
HE TX MCS and NSS set <= 80 MHz
1 streams: MCS 0-11
2 streams: MCS 0-11
3 streams: not supported
4 streams: not supported
5 streams: not supported
6 streams: not supported
7 streams: not supported
8 streams: not supported
Frequencies:
* 2412.0 MHz [1] (20.0 dBm)
* 2417.0 MHz [2] (20.0 dBm)
* 2422.0 MHz [3] (20.0 dBm)
* 2427.0 MHz [4] (20.0 dBm)
* 2432.0 MHz [5] (20.0 dBm)
* 2437.0 MHz [6] (20.0 dBm)
* 2442.0 MHz [7] (20.0 dBm)
* 2447.0 MHz [8] (20.0 dBm)
* 2452.0 MHz [9] (20.0 dBm)
* 2457.0 MHz [10] (20.0 dBm)
* 2462.0 MHz [11] (20.0 dBm)
* 2467.0 MHz [12] (20.0 dBm)
* 2472.0 MHz [13] (20.0 dBm)
* 2484.0 MHz [14] (disabled)
valid interface combinations:
* #{ IBSS } <= 1, #{ AP, mesh point } <= 16, #{ managed } <= 19,
total <= 19, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz, 160 MHz }

HT Capability overrides:
	 * MCS: ff ff ff ff ff ff ff ff ff ff
	 * maximum A-MSDU length
	 * supported channel width
	 * short GI for 40 MHz
	 * max A-MPDU length exponent
	 * min MPDU start spacing
max # scan plans: 1
max scan plan interval: -1
max scan plan iterations: 0
Supported extended features:
	* [ VHT_IBSS ]: VHT-IBSS
	* [ RRM ]: RRM
	* [ BEACON_RATE_LEGACY ]: legacy beacon rate setting
	* [ BEACON_RATE_HT ]: HT beacon rate setting
	* [ BEACON_RATE_VHT ]: VHT beacon rate setting
	* [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
	* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
	* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
	* [ ACK_SIGNAL_SUPPORT ]: ack signal level support
	* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
	* [ SCAN_RANDOM_SN ]: use random sequence numbers in scans
	* [ SCAN_MIN_PREQ_CONTENT ]: use probe request with only rate IEs in scans
	* [ CAN_REPLACE_PTK0 ]: can safely replace PTK 0 when rekeying
	* [ AIRTIME_FAIRNESS ]: airtime fairness scheduling
	* [ AQL ]: Airtime Queue Limits (AQL)
	* [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
	* [ DEL_IBSS_STA ]: deletion of IBSS station support
	* [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
	* [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
	* [ FILS_DISCOVERY ]: FILS discovery frame transmission support
	* [ UNSOL_BCAST_PROBE_RESP ]: unsolicated broadcast probe response transmission support
	* [ BEACON_RATE_HE ]: HE beacon rate support (AP/mesh)
	* [ BSS_COLOR ]: BSS coloring support
	* [ POWERED_ADDR_CHANGE ]: can change MAC address while up

nebulousdrawing · January 27, 2026, 5:42pm

Is it safe to say, then, that the AX1800 can be used without issue with the OpenWRT AX23 firmware?

brada4 · January 27, 2026, 5:44pm

You can boot ramdisk via serial, more modifications are needed to add new device identifiers in multiple places to assure smooth instalation.