KT-AR06-012H WiFi problem (fixed)

[baalwy]

I have problem with wifi when the official system run first time the wifi tx power for 5G and 2.4 it's normal after a press reboot button and enter to bootloader and upload image to ram and run system the wifi still working normally and if I update the system and reboot also working normally until I shut down router and turn on again the wifi tx power it's very weak especially 5G and 2.4 normal why😭😭😭😭😭😭😭
any one help me please
I think the official system put something in ram if I upgraded and shutdown router the wifi be very weak -85

[laipeng668]

The WiFi signal of this router is inherently weak, and it is not on the official OpenWrt support list. I am not entirely sure about the specific cause.

There is no need to power off the router, you can opt for scheduled reboots instead.

You can also try logging into the router via SSH and entering the command wifi down && wifi up to see if it helps.

If it does, add this command to the startup script.

[baalwy]

actually it's not CMIOT-AX18 but it's same I saw in this website https://www.acwifi.net/13867.html

dts
https://mega.nz/file/1olAQYwC#kWHOIQk7WdKdRdDIuDjlfyER4RsB6LMvfReZDi9lsdw

ar06-012h-e4e1-log-boot
https://mega.nz/file/1olAQYwC#kWHOIQk7WdKdRdDIuDjlfyER4RsB6LMvfReZDi9lsdw

board-kt_ar06-012h.ipq6018
https://mega.nz/file/NoszjQbQ#sUh-C-QnJqcK5xOe9K3zVEggjjlpahd7NrSbCF92iN0
I hope to fix the problem because everything it's working normally except wifi tx power and i hope to help me with dts file make a new one

[baalwy]

The WiFi signal of this router is inherently weak, and it is not on the official OpenWrt support list. I am not entirely sure about the specific cause.

There is no need to power off the router, you can opt for scheduled reboots instead.

You can also try logging into the router via SSH and entering the command wifi down && wifi up to see if it helps.

If it does, add this command to the startup script.

It is not issue about wifi down && wifi up I thinking the system uploaded something to ram and the device keeps running very well until I completely shutdown device of course after I upgrade system to LiBwrt

before shutting down

after shutting down

[baalwy]

By the way, if the wireless power is strong, it is necessary to recover the original ROOTFS file, and then I will take off the original software and after taking off the original software, re -operate and upgrade the device

[laipeng668]

Is this the device?
https://www.h1-radio.com/bbs/board.php?bo_table=product01_en
It's probably not an issue with the DTS, but rather with the board file.
I've added support for your device in this repository—you can give it a try.
One LAN port may not be recognized, but that’s expected.
Once you’ve tested it, I’ll correct the DTS.

[baalwy]

Is this the device? https://www.h1-radio.com/bbs/board.php?bo_table=product01_en It's probably not an issue with the DTS, but rather with the board file. I've added support for your device in this repository—you can give it a try. One LAN port may not be recognized, but that’s expected. Once you’ve tested it, I’ll correct the DTS.

thanks for reply

I created everything for this device also I build bootloader everything in this link
https://mega.nz/file/QlFkxJoY#t-FFG1pHTWs4M5F_VyYLwcqR9kov1Tn0_hpPiFIp1zY
please check the files and tell me if do wrong

when I checked everything in router it's completely working normally also USB and LED perfectly even Ethernet and keys please check the logs

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.XF.0.3-00086-IPQ60xxLZB-1
S - IMAGE_VARIANT_STRING=IPQ6018LA
S - OEM_IMAGE_VERSION_STRING=crm-ubuntu200
S - Boot Interface: NAND
S - Secure Boot: Off
S - Boot Config @ 0x000a602c = 0x000002e5
S - JTAG ID @ 0x000a607c = 0x001390e1
S - OEM ID @ 0x000a6080 = 0x00000000
S - Serial Number @ 0x000a4128 = 0xde4ffe3f
S - OEM Config Row 0 @ 0x000a4188 = 0x0000000000000000
S - OEM Config Row 1 @ 0x000a4190 = 0x0000000000000000
S - Feature Config Row 0 @ 0x000a4130 = 0x0000800018200021
S - Feature Config Row 1 @ 0x000a4138 = 0x02c3e83783000009
S - PBL Patch Ver: 1
S - I-cache: On
S - D-cache: On
B -      3413 - PBL, Start
B -       592 - bootable_media_detect_entry, Start
B -      4340 - bootable_media_detect_success, Start
B -      5148 - elf_loader_entry, Start
B -      5320 - auth_hash_seg_entry, Start
B -      7788 - auth_hash_seg_exit, Start
B -      8283 - elf_segs_hash_verify_entry, Start
B -    103703 - elf_segs_hash_verify_exit, Start
B -    107897 - auth_xbl_sec_hash_seg_entry, Start
B -    108043 - auth_xbl_sec_hash_seg_exit, Start
B -    114588 - xbl_sec_segs_hash_verify_entry, Start
B -    114589 - xbl_sec_segs_hash_verify_exit, Start
B -    115518 - PBL, End
B -     97417 - SBL1, Start
B -    237229 - GCC [RstStat:0x0, RstDbg:0x600000] WDog Stat : 0x4
B -    239669 - clock_init, Start
D -      2775 - clock_init, Delta
B -    248148 - boot_flash_init, Start
D -     29829 - boot_flash_init, Delta
B -    281240 - sbl1_ddr_set_default_params, Start
D -       274 - sbl1_ddr_set_default_params, Delta
B -    287859 - boot_config_data_table_init, Start
D -      4697 - boot_config_data_table_init, Delta - (575 Bytes)
B -    297619 - CDT Version:2,Platform ID:8,Major ID:3,Minor ID:2,Subtype:0
B -    302529 - Image Load, Start
D -      6618 - OEM_MISC Image Loaded, Delta - (0 Bytes)
B -    311862 - Image Load, Start
D -      5063 - PMIC Image Loaded, Delta - (0 Bytes)
B -    319731 - sbl1_ddr_set_params, Start
B -    324733 - CPR configuration: 0x555
B -    327905 - Pre_DDR_clock_init, Start
D -       213 - Pre_DDR_clock_init, Delta
D -         0 - sbl1_ddr_set_params, Delta
B -    360693 - Image Load, Start
D -       427 - APDP Image Loaded, Delta - (0 Bytes)
B -    378718 - Image Load, Start
D -       427 - QTI_MISC Image Loaded, Delta - (0 Bytes)
B -    381128 - Image Load, Start
D -       854 - Auth Metadata
D -       580 - Segments hash check
D -     22082 - QSEE Dev Config Image Loaded, Delta - (36458 Bytes)
B -    405162 - Image Load, Start
D -      6557 - Auth Metadata
D -     10248 - Segments hash check
D -    318694 - QSEE Image Loaded, Delta - (1419168 Bytes)
B -    724283 - Image Load, Start
D -       732 - Auth Metadata
D -       946 - Segments hash check
D -     33794 - RPM Image Loaded, Delta - (102800 Bytes)
B -    759755 - Image Load, Start
D -       763 - Auth Metadata
D -      3447 - Segments hash check
D -    131790 - APPSBL Image Loaded, Delta - (628024 Bytes)
B -    907161 - SBL1, End
D -    810049 - SBL1, Delta
S - Flash Throughput, 5000 KB/s  (2187697 Bytes,  428393 us)
S - Core 0 Frequency, 800 MHz
S - DDR Frequency, 466 MHz


U-Boot 2016.01 (Aug 26 2025 - 22:25:28 +0000)

DRAM:  smem ram ptable found: ver: 2 len: 4
512 MiB
NAND:  ONFI device found
ID = 1580a1c2
Vendor = c2
Device = a1
SF: Unsupported flash IDs: manuf 00, jedec 0000, ext_jedec 0000
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
128 MiB
MMC:   <NULL>: 0
In:    serial@78B1000
Out:   serial@78B1000
Err:   serial@78B1000
machid: 8030200
eth5 MAC Address from ART is not valid
Net:   MAC0 addr:1c:ec:72:3c:27:6
PHY ID1: 0x4d
PHY ID2: 0xd0b1
EDMA ver 1 hw init
Num rings - TxDesc:1 (0-0) TxCmpl:1 (0-0)
RxDesc:1 (15-15) RxFill:1 (7-7)
ipq6018_edma_alloc_rings: successfull
ipq6018_edma_setup_ring_resources: successfull
ipq6018_edma_configure_rings: successfull
ipq6018_edma_hw_init: successfull
eth0
Hit any key to stop autoboot:  0
IPQ6018# 444444444
Unknown command '444444444' - try 'help'
IPQ6018# tftpboot libwrt-qualcommax-ipq60xx-kt_ar06-012h-initramfs-uImage.itb; bootm
ipq6018_eth_halt: done
eth0 PHY0 Down Speed :10 Half duplex
eth0 PHY1 up Speed :1000 Full duplex
eth0 PHY2 Down Speed :10 Half duplex
eth0 PHY3 Down Speed :10 Half duplex
eth0 PHY4 Down Speed :10 Half duplex
ipq6018_eth_init: done
Using eth0 device
TFTP from server 192.168.1.2; our IP address is 192.168.1.1
Filename 'libwrt-qualcommax-ipq60xx-kt_ar06-012h-initramfs-uImage.itb'.
Load address: 0x44000000
Loading: *
Got TFTP_OACK: TFTP remote port: changes from 69 to 51994
#################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ###
         3 MiB/s
done
Bytes transferred = 27713148 (1a6de7c hex)
ipq6018_eth_halt: done
## Loading kernel from FIT Image at 44000000 ...
   Using 'config@cp03-c1' configuration
   Trying 'kernel-1' kernel subimage
     Description:  ARM64 OpenWrt Linux-6.12.45
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x440000e8
     Data Size:    27672899 Bytes = 26.4 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x41000000
     Entry Point:  0x41000000
     Hash algo:    crc32
     Hash value:   62026af6
     Hash algo:    sha1
     Hash value:   d21421468e5d1b3eecb9788c7fa67e48ae5a577a
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Loading fdt from FIT Image at 44000000 ...
   Using 'config@cp03-c1' configuration
   Trying 'fdt-1' fdt subimage
     Description:  ARM64 OpenWrt kt_ar06-012h device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x45a64368
     Data Size:    38341 Bytes = 37.4 KiB
     Architecture: AArch64
     Hash algo:    crc32
     Hash value:   18962d1a
     Hash algo:    sha1
     Hash value:   7a3cf342a76a0020927aabffa892f3fcb2519313
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x45a64368
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 484f3000, end 484ff5c4 ... OK
Using machid 0x8030200 from environment

Starting kernel ...

Jumping to AARCH64 kernel via monitor
[    0.000000] Booting Linux on physical CPU 0x0000000000 [0x51af8014]
[    0.000000] Linux version 6.12.45 (baalwy@baalwy) (aarch64-openwrt-linux-musl-gcc (OpenWrt GCC 14.3.0 r0-1 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP PREEMPT Sun Sep  7 13:24:08 2025
[    0.000000] Machine model: KT-AR06-012H
[    0.000000] OF: reserved mem: 0x0000000000060000..0x0000000000065fff (24 KiB) nomap non-reusable memory@60
[    0.000000] OF: reserved mem: 0x0000000040000000..0x0000000040ffffff (16384 KiB) nomap non-reusable memory00
[    0.000000] OF: reserved mem: 0x000000004a100000..0x000000004a4fffff (4096 KiB) nomap non-reusable bootloa00000
[    0.000000] OF: reserved mem: 0x000000004a600000..0x000000004a9fffff (4096 KiB) nomap non-reusable memory@0
[    0.000000] OF: reserved mem: 0x000000004aa00000..0x000000004aafffff (1024 KiB) nomap non-reusable memory@0
[    0.000000] OF: reserved mem: 0x000000004ab00000..0x000000004fffffff (87040 KiB) nomap non-reusable memory00
[    0.000000] OF: reserved mem: 0x0000000050b00000..0x0000000050bfffff (1024 KiB) nomap non-reusable q6_etr_b00000
[    0.000000] OF: reserved mem: 0x0000000050c00000..0x0000000050cfffff (1024 KiB) nomap non-reusable m3_dump00
[    0.000000] OF: reserved mem: 0x0000000050d00000..0x0000000050dfffff (1024 KiB) nomap non-reusable ramoops00
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000]   DMA32    empty
[    0.000000]   Normal   empty
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000040000000-0x0000000040ffffff]
[    0.000000]   node   0: [mem 0x0000000041000000-0x000000004a0fffff]
[    0.000000]   node   0: [mem 0x000000004a100000-0x000000004a4fffff]
[    0.000000]   node   0: [mem 0x000000004a500000-0x000000004a5fffff]
[    0.000000]   node   0: [mem 0x000000004a600000-0x000000004fffffff]
[    0.000000]   node   0: [mem 0x0000000050000000-0x0000000050afffff]
[    0.000000]   node   0: [mem 0x0000000050b00000-0x0000000050dfffff]
[    0.000000]   node   0: [mem 0x0000000050e00000-0x000000005fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x000000005fffffff]
[    0.000000] psci: probing for conduit method from DT.
[    0.000000] psci: PSCIv1.0 detected in firmware.
[    0.000000] psci: Using standard PSCI v0.2 function IDs
[    0.000000] psci: MIGRATE_INFO_TYPE not supported.
[    0.000000] psci: SMC Calling Convention v1.0
[    0.000000] percpu: Embedded 20 pages/cpu s43736 r8192 d29992 u81920
[    0.000000] Detected VIPT I-cache on CPU0
[    0.000000] CPU features: detected: Spectre-v4
[    0.000000] alternatives: applying boot alternatives
[    0.000000] Kernel command line: console=ttyMSM0,115200n8 root=/dev/ubiblock0_1 swiotlb=1
[    0.000000] Dentry cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[    0.000000] Inode-cache hash table entries: 32768 (order: 6, 262144 bytes, linear)
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 131072
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] software IO TLB: area num 4.
[    0.000000] software IO TLB: SWIOTLB bounce buffer size roundup to 1MB
[    0.000000] software IO TLB: mapped [mem 0x000000005f4c0000-0x000000005f5c0000] (1MB)
[    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[    0.000000] rcu: Preemptible hierarchical RCU implementation.
[    0.000000]  Trampoline variant of Tasks RCU enabled.
[    0.000000]  Tracing variant of Tasks RCU enabled.
[    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 10 jiffies.
[    0.000000] RCU Tasks: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[    0.000000] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=4.
[    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
[    0.000000] Root IRQ handler: gic_handle_irq
[    0.000000] GICv2m: range[mem 0x0b00a000-0x0b00affc], SPI[448:479]
[    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[    0.000000] arch_timer: cp15 and mmio timer(s) running at 24.00MHz (virt/virt).
[    0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x588fe9dc0, max_idle_ns: 44592 ns
[    0.000001] sched_clock: 56 bits at 24MHz, resolution 41ns, wraps every 4398046511097ns
[    0.000081] Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj)
[    0.000094] pid_max: default: 32768 minimum: 301
[    0.005289] Mount-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.005303] Mountpoint-cache hash table entries: 1024 (order: 1, 8192 bytes, linear)
[    0.010400] rcu: Hierarchical SRCU implementation.
[    0.010410] rcu:     Max phase no-delay instances is 1000.
[    0.010710] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[    0.011129] smp: Bringing up secondary CPUs ...
[    0.011812] Detected VIPT I-cache on CPU1
[    0.011919] CPU1: Booted secondary processor 0x0000000001 [0x51af8014]
[    0.012704] Detected VIPT I-cache on CPU2
[    0.012781] CPU2: Booted secondary processor 0x0000000002 [0x51af8014]
[    0.013587] Detected VIPT I-cache on CPU3
[    0.013659] CPU3: Booted secondary processor 0x0000000003 [0x51af8014]
[    0.013745] smp: Brought up 1 node, 4 CPUs
[    0.013753] SMP: Total of 4 processors activated.
[    0.013757] CPU: All CPU(s) started at EL1
[    0.013761] CPU features: detected: 32-bit EL0 Support
[    0.013766] CPU features: detected: CRC32 instructions
[    0.013809] alternatives: applying system-wide alternatives
[    0.013994] CPU features: emulated: Privileged Access Never (PAN) using TTBR0_EL1 switching
[    0.014256] Memory: 358672K/524288K available (8704K kernel code, 896K rwdata, 2808K rodata, 22656K init, s, 162656K reserved, 0K cma-reserved)
[    0.022838] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000
[    0.022862] futex hash table entries: 1024 (order: 4, 65536 bytes, linear)
[    0.022968] 23872 pages in range for non-PLT usage
[    0.022973] 515392 pages in range for PLT usage
[    0.025101] pinctrl core: initialized pinctrl subsystem
[    0.027499] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[    0.028131] DMA: preallocated 128 KiB GFP_KERNEL pool for atomic allocations
[    0.028171] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
[    0.028206] DMA: preallocated 128 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
[    0.028573] thermal_sys: Registered thermal governor 'step_wise'
[    0.028638] cpuidle: using governor menu
[    0.028852] ASID allocator initialised with 65536 entries
[    0.035813] /soc@0/interrupt-controller@b000000: Fixed dependency cycle(s) with /soc@0/interrupt-controlle00
[    0.101697] regulator-usb-vbus enforce active low on GPIO handle
[    0.102572] SCSI subsystem initialized
[    0.102794] usbcore: registered new interface driver usbfs
[    0.102837] usbcore: registered new interface driver hub
[    0.102914] usbcore: registered new device driver usb
[    0.103210] qcom_scm: convention: smc arm 64
[    0.105245] clocksource: Switched to clocksource arch_sys_counter
[    0.109001] NET: Registered PF_INET protocol family
[    0.109153] IP idents hash table entries: 8192 (order: 4, 65536 bytes, linear)
[    0.111216] tcp_listen_portaddr_hash hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.111237] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[    0.111293] TCP established hash table entries: 4096 (order: 3, 32768 bytes, linear)
[    0.111343] TCP bind hash table entries: 4096 (order: 5, 131072 bytes, linear)
[    0.111487] TCP: Hash tables configured (established 4096 bind 4096)
[    0.111972] MPTCP token hash table entries: 512 (order: 1, 12288 bytes, linear)
[    0.112143] UDP hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.112170] UDP-Lite hash table entries: 256 (order: 1, 8192 bytes, linear)
[    0.112605] NET: Registered PF_UNIX/PF_LOCAL protocol family
[    0.112644] PCI: CLS 0 bytes, default 64
[    0.114450] workingset: timestamp_bits=46 max_order=17 bucket_order=0
[    0.115218] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.115225] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc
[    0.124058] qcom-qmp-usb-phy 78000.ssphy: supply vdda-phy not found, using dummy regulator
[    0.124229] qcom-qmp-usb-phy 78000.ssphy: supply vdda-pll not found, using dummy regulator
[    0.125931] qcom-qusb2-phy 59000.qusb: supply vdd not found, using dummy regulator
[    0.126088] qcom-qusb2-phy 59000.qusb: supply vdda-pll not found, using dummy regulator
[    0.126157] qcom-qusb2-phy 59000.qusb: supply vdda-phy-dpdm not found, using dummy regulator
[    0.126403] qcom-qusb2-phy 59000.qusb: Registered Qcom-QUSB2 phy
[    0.126897] qcom-qusb2-phy 79000.qusb: supply vdda-pll not found, using dummy regulator
[    0.127028] qcom-qusb2-phy 79000.qusb: supply vdda-phy-dpdm not found, using dummy regulator
[    0.127227] qcom-qusb2-phy 79000.qusb: Registered Qcom-QUSB2 phy
[    0.136601] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[    0.137691] msm_serial 78b1000.serial: msm_serial: detected port #0
[    0.137776] msm_serial 78b1000.serial: uartclk = 1843200
[    0.138160] 78b1000.serial: ttyMSM0 at MMIO 0x78b1000 (irq = 21, base_baud = 115200) is a MSM
[    0.138243] msm_serial: console setup on port #0
[    0.138290] printk: legacy console [ttyMSM0] enabled
[    0.989704] msm_serial: driver initialized
[    0.999842] loop: module loaded
[    1.001359] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xa1
[    1.001804] nand: Macronix MX30UF1G18AC
[    1.008494] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    1.012021] qcom-nandc 79b0000.nand-controller: Opcode not supported: 238
[    1.019653] Block protection check failed
[    1.884503] spi_qup 78b5000.spi: IN:block:16, fifo:64, OUT:block:16, fifo:64
[    1.990596] i2c_dev: i2c /dev entries driver
[    1.997986] sdhci: Secure Digital Host Controller Interface driver
[    1.998033] sdhci: Copyright(c) Pierre Ossman
[    2.003068] sdhci-pltfm: SDHCI platform and OF driver helper
[    2.011995] remoteproc remoteproc0: releasing cd00000.remoteproc
[    2.015930] NET: Registered PF_INET6 protocol family
[    2.020651] Segment Routing with IPv6
[    2.024209] In-situ OAM (IOAM) with IPv6
[    2.027865] NET: Registered PF_PACKET protocol family
[    2.031753] l2tp_core: L2TP core driver, V2.0
[    2.036679] l2tp_netlink: L2TP netlink interface
[    2.041039] 8021q: 802.1Q VLAN Support v1.8
[    2.084322] nand: device found, Manufacturer ID: 0xc2, Chip ID: 0xa1
[    2.084367] nand: Macronix MX30UF1G18AC
[    2.089895] nand: 128 MiB, SLC, erase size: 128 KiB, page size: 2048, OOB size: 64
[    2.093332] qcom-nandc 79b0000.nand-controller: Opcode not supported: 238
[    2.100975] Block protection check failed
[    2.125716] 24 qcomsmem partitions found on MTD device qcom_nand.0
[    2.125767] Creating 24 MTD partitions on "qcom_nand.0":
[    2.130805] 0x000000000000-0x000000180000 : "0:sbl1"
[    2.138117] 0x000000180000-0x000000280000 : "0:mibib"
[    2.142453] 0x000000280000-0x000000300000 : "0:bootconfig"
[    2.147099] 0x000000300000-0x000000380000 : "0:bootconfig1"
[    2.152355] 0x000000380000-0x000000700000 : "0:qsee"
[    2.160263] 0x000000700000-0x000000a80000 : "0:qsee_1"
[    2.165345] 0x000000a80000-0x000000b00000 : "0:devcfg"
[    2.168016] 0x000000b00000-0x000000b80000 : "0:devcfg_1"
[    2.173143] 0x000000b80000-0x000000c00000 : "0:rpm"
[    2.178752] 0x000000c00000-0x000000c80000 : "0:rpm_1"
[    2.183254] 0x000000c80000-0x000000d00000 : "0:cdt"
[    2.188474] 0x000000d00000-0x000000d80000 : "0:cdt_1"
[    2.193141] 0x000000d80000-0x000000e00000 : "0:appsblenv"
[    2.198397] 0x000000e00000-0x000000f80000 : "0:appsbl"
[    2.204526] 0x000000f80000-0x000001100000 : "0:appsbl_1"
[    2.209584] 0x000001100000-0x000001180000 : "0:art"
[    2.214188] 0x000001180000-0x000003bc0000 : "rootfs"
[    2.251120] mtd: setting mtd16 (rootfs) as root device
[    2.251425] mtdsplit: no squashfs found in "rootfs"
[    2.255219] 0x000003bc0000-0x0000043c0000 : "free"
[    2.266578] 0x0000043c0000-0x000006e00000 : "rootfs_1"
[    2.299746] 0x000006e00000-0x000007580000 : "free_1"
[    2.306072] 0x000007580000-0x000007600000 : "crashdump"
[    2.307009] 0x000007600000-0x000007e00000 : "0:appsrw"
[    2.316799] 0x000007e00000-0x000007f00000 : "0:nvram"
[    2.318072] 0x000007f00000-0x000008000000 : "0:nvram2"
[    2.333268] cpufreq: cpufreq_online: CPU0: Running at unlisted initial frequency: 799999 KHz, changing to: KHz
[    2.335981] remoteproc remoteproc0: cd00000.remoteproc is avail[    2.360493] Freeing unused kernel memoryK
[    2.360593] Run /init as init process
[    2.801126] init: Console is alive
[    2.801266] init: - watchdog -
[    2.816493] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.853941] gpio_button_hotplug: loading out-of-tree module taints kernel.
[    2.870743] ssdk_dt_parse_interrupt[942]:INFO:intr-gpio does not exist
[    3.235685] __adpt_hppe_uniphy_psgmii_mode_set[1194]:INFO:uniphy 0 psgmii channel selection
[    3.350399] regi_init[2525]:INFO:Initializing CPPE Done!!
[    3.350531] regi_init[2574]:INFO:qca-ssdk module init succeeded!
[    3.357577] EDMA ver 1 hw init
[    3.361068] EDMA HW Reset completed succesfully
[    3.363739] Num rings - TxDesc:1 (23-23) TxCmpl:1 (23-23)
[    3.368181] RxDesc:1 (15-15) RxFill:1 (7-7)
[    3.546186] Qualcomm QCA8075 90000.mdio-1:00: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:00, irq=P
[    3.615679] Qualcomm QCA8075 90000.mdio-1:01: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:01, irq=P
[    3.685683] Qualcomm QCA8075 90000.mdio-1:02: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:02, irq=P
[    3.755668] Qualcomm QCA8075 90000.mdio-1:03: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:03, irq=P
[    3.825662] Qualcomm QCA8075 90000.mdio-1:04: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:04, irq=P
[    3.826827] **********************************************************
[    3.834566] * NSS Data Plane driver
[    3.841137] **********************************************************
[    3.858228] phy phy-59000.qusb.2: QUSB2PHY pll lock failed: status reg = 0
[    3.858276] phy phy-59000.qusb.2: phy init failed --> -16
[    3.864003] dwc3 7000000.usb: error -EBUSY: failed to initialize core
[    3.869498] dwc3 7000000.usb: probe with driver dwc3 failed with error -16
[    3.883142] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    3.883194] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 1
[    3.889210] xhci-hcd xhci-hcd.1.auto: hcc params 0x0220fe65 hci version 0x110 quirks 0x0000808000000010
[    3.895748] xhci-hcd xhci-hcd.1.auto: irq 39, io mem 0x08a00000
[    3.905202] xhci-hcd xhci-hcd.1.auto: xHCI Host Controller
[    3.911070] xhci-hcd xhci-hcd.1.auto: new USB bus registered, assigned bus number 2
[    3.916536] xhci-hcd xhci-hcd.1.auto: Host supports USB 3.0 SuperSpeed
[    3.924460] hub 1-0:1.0: USB hub found
[    3.930745] hub 1-0:1.0: 1 port detected
[    3.934641] usb usb2: We don't know the algorithms for LPM for this host, disabling LPM.
[    3.938794] hub 2-0:1.0: USB hub found
[    3.946868] hub 2-0:1.0: 1 port detected
[    3.954495] usbcore: registered new interface driver usb-storage
[    3.955709] usbcore: registered new interface driver uas
[    3.960433] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    3.972635] init: - preinit -
[    9.875250] random: crng init done
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[   14.328331] procd: - early -
[   14.328455] procd: - watchdog -
[   14.868530] procd: - watchdog -
[   14.868770] procd: - ubus -
[   15.024274] procd: - init -
Please press Enter to activate this console.
[   15.220947] kmodloader: loading kernel modules from /etc/modules.d/*
[   15.355828] NET: Registered PF_ALG protocol family
[   15.390175] urngd: v1.0.2 started.
[   15.682218] hotplug: symlinking qca-nss0.bin to /lib/firmware/qca-nss0-retail.bin
[   15.699825] qca-nss 39000000.nss: NSS FW Version: NSS.CP.11.4.0.5-6-R
[   15.699870] qca-nss 39000000.nss: fw of size 862880 bytes copied to addr: 40000000, nss_id: 0
[   15.707183] ffffffc07a73e880: NSS core 0 DDR from 40000000 to 41000000
[   15.743826] qca-nss 39000000.nss: NSS core 0 booted successfully
[   15.827476] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[   15.831078] nat46: module (version 04923c51039e8ca270c6f1dde3f04f3b36958089) loaded.
[   15.834235] gre: GRE over IPv4 demultiplexor driver
[   15.841852] ip_gre: GRE over IPv4 tunneling driver
[   15.847981] ip6_gre: GRE over IPv6 tunneling driver
[   15.855427] nss_vlan_mgr_init_module[1939]:Module (Build Build Id: 09/13/25, 04:02:27) loaded
[   15.860930] PPP generic driver version 2.4.2
[   15.918953] NET: Registered PF_PPPOX protocol family
[   15.922789] PPTP driver version 0.8.5
[   15.928656] nss_wifi_meshmgr_init_module[1994]:Module Build Id: 09/13/25, 04:02:30 loaded
[   15.933017] GACT probability on
[   15.937217] Mirror/redirect action on
[   15.945064] u32 classifier
[   15.945100]     input device check on
[   15.946759]     Actions configured
[   15.960037] ntfs3: Enabled Linux POSIX ACLs support
[   15.962556] Loading modules backported from Linux version v6.16-0-g038d61fd6422
[   15.963735] Backport generated by backports.git v6.1.145-1-47-g6194bf852a3e
[   15.973025] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[   15.987541] PPP MPPE Compression module registered
[   15.988997] <NSS-CRYPTO>:module loaded Build_ID - 09/13/25, 03:47:06 SoC=ipq60xx
[   15.993693] NET: Registered PF_QIPCRTR protocol family
[   16.002208] usbcore: registered new interface driver ums-alauda
[   16.004547] usbcore: registered new interface driver ums-cypress
[   16.010574] usbcore: registered new interface driver ums-datafab
[   16.016841] usbcore: registered new interface driver ums-freecom
[   16.022691] usbcore: registered new interface driver ums-isd200
[   16.028988] usbcore: registered new interface driver ums-jumpshot
[   16.034286] usbcore: registered new interface driver ums-karma
[   16.040764] usbcore: registered new interface driver ums-sddr09
[   16.046392] usbcore: registered new interface driver ums-sddr55
[   16.052219] usbcore: registered new interface driver ums-usbat
[   16.123307] ath11k c000000.wifi: ipq6018 hw1.0
[   16.123342] ath11k c000000.wifi: FW memory mode: 1
[   16.158129] remoteproc remoteproc0: powering up cd00000.remoteproc
[   16.158259] remoteproc remoteproc0: Booting fw image IPQ6018/q6_fw.mdt, size 7340
[   16.456681] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   16.458252] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   16.463661] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   16.471345] ath11k c000000.wifi: fw_version 0x25008f8e fw_build_timestamp 2024-03-01 03:54 fw_build_id WLA5.0.1-03982-QCAHKSWPL_SILICONZ-3
[   16.471826] kmodloader: done loading kernel modules from /etc/modules.d/*
[   16.664782] ath11k c000000.wifi: nss init soc nss if_num 203 userpd_id 0
[   20.528830] br-lan: port 1(lan1) entered blocking state
[   20.528880] br-lan: port 1(lan1) entered disabled state
[   20.532923] nss-dp 3a001800.dp5 lan1: entered allmulticast mode
[   20.539532] nss-dp 3a001800.dp5 lan1: entered promiscuous mode
[   20.548957] br-lan: port 2(lan2) entered blocking state
[   20.549923] br-lan: port 2(lan2) entered disabled state
[   20.555055] nss-dp 3a001600.dp4 lan2: entered allmulticast mode
[   20.561023] nss-dp 3a001600.dp4 lan2: entered promiscuous mode
[   20.569681] br-lan: port 3(lan3) entered blocking state
[   20.572069] br-lan: port 3(lan3) entered disabled state
[   20.577344] nss-dp 3a001400.dp3 lan3: entered allmulticast mode
[   20.582815] nss-dp 3a001400.dp3 lan3: entered promiscuous mode
[   20.591778] br-lan: port 4(lan4) entered blocking state
[   20.594174] br-lan: port 4(lan4) entered disabled state
[   20.599387] nss-dp 3a001200.dp2 lan4: entered allmulticast mode
[   20.604969] nss-dp 3a001200.dp2 lan4: entered promiscuous mode
[   22.583398] br-lan: port 5(phy0-ap0) entered blocking state
[   22.583662] br-lan: port 5(phy0-ap0) entered disabled state
[   22.588332] ath11k c000000.wifi phy0-ap0: entered allmulticast mode
[   22.593899] ath11k c000000.wifi phy0-ap0: entered promiscuous mode
[   23.058515] br-lan: port 5(phy0-ap0) entered blocking state
[   23.058565] br-lan: port 5(phy0-ap0) entered forwarding state
[   23.157535] br-lan: port 6(phy1-ap0) entered blocking state
[   23.158413] br-lan: port 6(phy1-ap0) entered disabled state
[   23.162696] ath11k c000000.wifi phy1-ap0: entered allmulticast mode
[   23.168851] ath11k c000000.wifi phy1-ap0: entered promiscuous mode
[   23.195438] ECM init
[   23.195529] ECM database jhash random seed: 0xc88dd582
[   23.198414] ECM init complete
[   23.686028] nss-dp 3a001200.dp2 lan4: PHY Link up speed: 1000
[   23.686181] br-lan: port 4(lan4) entered blocking state
[   23.690781] br-lan: port 4(lan4) entered forwarding state
[   25.219515] qca-nss 39000000.nss: Configuring additional NSS pbufs
[   25.228340] qca-nss 39000000.nss: Additional pbufs of size 3100672 got added to NSS
[   25.415571] ath11k c000000.wifi phy0-ap0: left allmulticast mode
[   25.415636] ath11k c000000.wifi phy0-ap0: left promiscuous mode
[   25.421038] br-lan: port 5(phy0-ap0) entered disabled state
[   25.946756] ath11k c000000.wifi phy1-ap0: left allmulticast mode
[   25.946839] ath11k c000000.wifi phy1-ap0: left promiscuous mode
[   25.952100] br-lan: port 6(phy1-ap0) entered disabled state
[   26.845606] br-lan: port 5(phy0-ap0) entered blocking state
[   26.845668] br-lan: port 5(phy0-ap0) entered disabled state
[   26.850048] ath11k c000000.wifi phy0-ap0: entered allmulticast mode
[   26.856641] ath11k c000000.wifi phy0-ap0: entered promiscuous mode
[   27.243524] br-lan: port 5(phy0-ap0) entered blocking state
[   27.243584] br-lan: port 5(phy0-ap0) entered forwarding state
[   27.339655] br-lan: port 6(phy1-ap0) entered blocking state
[   27.339707] br-lan: port 6(phy1-ap0) entered disabled state
[   27.344163] ath11k c000000.wifi phy1-ap0: entered allmulticast mode
[   27.350256] ath11k c000000.wifi phy1-ap0: entered promiscuous mode
[   27.356157] br-lan: port 6(phy1-ap0) entered blocking state
[   27.362128] br-lan: port 6(phy1-ap0) entered forwarding state
[   27.368122] br-lan: port 6(phy1-ap0) entered disabled state
[   39.082776] br-lan: port 6(phy1-ap0) entered blocking state
[   39.082830] br-lan: port 6(phy1-ap0) entered forwarding state

the only problem it's Wi-Fi

and I have many routes but with other Model I hope to find solutions for this problem

[laipeng668]

I've reviewed the files you modified (including the DTS) and the boot logs. You've done a great job with the modifications, and I can't identify any issues. The boot logs also appear normal.

Generally speaking, if the WiFi hardware is correctly recognized but there is a problem with the transmission power, it is likely related to the ART partition data not being properly read.

Before powering off, the correct ART data is stored in memory, so when you restart the router at this point, the WiFi still functions normally.

However, after a power cycle, when the router boots up again, the WiFi may fail to read the correct ART data, resulting in very weak signal.

Also, you could try disabling the WiFi startup script to see if that helps. Try deleting the files in this directory and see if it works.
target\linux\qualcommax\ipq60xx\base-files\etc\uci-defaults

[baalwy]

I've reviewed the files you modified (including the DTS) and the boot logs. You've done a great job with the modifications, and I can't identify any issues. The boot logs also appear normal.

Generally speaking, if the WiFi hardware is correctly recognized but there is a problem with the transmission power, it is likely related to the ART partition data not being properly read.

Before powering off, the correct ART data is stored in memory, so when you restart the router at this point, the WiFi still functions normally.

However, after a power cycle, when the router boots up again, the WiFi may fail to read the correct ART data, resulting in very weak signal.

Also, you could try disabling the WiFi startup script to see if that helps. Try deleting the files in this directory and see if it works.
target\linux\qualcommax\ipq60xx\base-files\etc\uci-defaults

When let device boot in official system and upload my software it's working perfectly
I Restore partition rootfs because I make backup for official and boot it's show larger data uploaded and I reboot manually and boot to bootloader to upgrade my software everything perfectly until I shutdown the device
I noticed the old dts it's written the memory it's 1G
But the device it's 512m
I want to know what addresses I can to pulled from ram or what exactly address responsible about wifi I can share ubi partition with you to see inti.d files

rootfs partition
https://mega.nz/file/ostxHRCY#I7cl0FmbUvLDKnXhdZkwkB757aEbcDAr3JinQNXtZLk
I hope this will help to exploration what exactly the old system doing during booting
What exactly files uploaded to memory

[laipeng668]

I don't have this router on hand and cannot open your file.

The memory size defined in the DTS (1GB or 512MB) only specifies the NSS reserved memory and should not affect WiFi signals.

Researching the official system may not be very useful due to significant kernel differences.

It would be better to focus on whether the ART partition can be read correctly.

[baalwy]

this is a art and ubi_fw_wifi
https://mega.nz/file/1k1zRJzQ#Wa3WvjMTR_IKsejw5S6bvLVAuXseVCxX-E0gi0njC0o

I just created board-2.json with this

[
    {
        "board": [
            {
                "names": [
                    "bus=ahb,qmi-chip-id=0,qmi-board-id=255,variant=KT-AR06-012H"
                ],
                "data": "bdwlan.bin"
            }
        ],
        "regdb": []
    }
]

and create a board-2.bin but when I try it's giving me errors

[   12.235722] usbcore: registered new interface driver ums-sddr09
[   12.241153] usbcore: registered new interface driver ums-sddr55
[   12.247124] usbcore: registered new interface driver ums-usbat
[   12.446775] ath11k c000000.wifi: ipq6018 hw1.0
[   12.446813] ath11k c000000.wifi: FW memory mode: 1
[   14.025031] remoteproc remoteproc0: powering up cd00000.remoteproc
[   14.042862] remoteproc remoteproc0: Booting fw image IPQ6018/q6_fw.mdt, size 7340
[   14.959334] remoteproc remoteproc0: remote processor cd00000.remoteproc is now up
[   14.960910] ath11k c000000.wifi: qmi fail to get qcom,m3-dump-addr, ignore m3 dump mem req
[   14.966369] ath11k c000000.wifi: chip_id 0x0 chip_family 0x4 board_id 0xff soc_id 0xffffffff
[   14.973980] ath11k c000000.wifi: fw_version 0x25008f8e fw_build_timestamp 2024-03-01 03:54 fw_build_id WLAN.HK.2.5.0.1-03982-QCAHKSWPL_SILICONZ-3
[   14.974614] kmodloader: done loading kernel modules from /etc/modules.d/*
[   15.102952] ath11k c000000.wifi: No regulatory rules available in the event info
[   15.103005] ath11k c000000.wifi: failed to extract regulatory info
[   15.111149] ath11k c000000.wifi: No regulatory rules available in the event info
[   15.115438] ath11k c000000.wifi: failed to extract regulatory info
[   15.127410] ath11k c000000.wifi: nss init soc nss if_num 203 userpd_id 0
[   15.149784] ath11k c000000.wifi: failed to receive default regd during init
[   15.150359] ath11k c000000.wifi: failed to receive default regd during init
[   18.908853] ECM init
[   18.908931] ECM database jhash random seed: 0xdb49516e
[   18.911650] ECM init complete
[   19.054077] br-lan: port 1(lan1) entered blocking state
[   19.054142] br-lan: port 1(lan1) entered disabled state
[   19.058615] nss-dp 3a001800.dp5 lan1: entered allmulticast mode
[   19.063953] nss-dp 3a001800.dp5 lan1: entered promiscuous mode
[   19.073286] br-lan: port 2(lan2) entered blocking state
[   19.075174] br-lan: port 2(lan2) entered disabled state

after many searching I finally got a solution it's changing the offset of bdwlan.bin C5FA from 00 to 01 and the problem fixed

and one more thing I have many devices like this model the ART it's completely different even bdwlan.bin I don't know why it's
a same

thanks again
I'm very glad to talking to you

[baalwy]

now I discovery thing it's amazing I the device have the final build software I shut down it and I turn on and full boot with wifi weak and I upgraded to other software I make in official openwrt-24.10 and the wifi fully tx power without install or restore official software but I try to shutdown and turn on agen but unfortunately the 5G it's very weak
Through my previous experience, it became clear to me that it is not because of the original software
I just upgraded from libwrt-qualcommax-ipq60xx-kt_ar06-012h-squashfs-sysupgrade.bin to openwrt-qualcommax-ipq60xx-kt_ar06-012h-squashfs-sysupgrade.bin and wifi working very well I'm so confused 😕

[baalwy]

now I sure 100% it's board-2.bin because I build one image with from-libwrt-board-kt_ar06-012h.ipq6018 and I build another image with from-openwrt-board-kt_ar06-012h.ipq6018 in same build root LibWrt

1. the device in build from-libwrt-board-kt_ar06-012h.ipq6018 and it's completely turnoff
2. I upgraded to image how's build with from-openwrt-board-kt_ar06-012h.ipq6018
3. the Wi-Fi signal it's awesome
4. but the problem is I am still a beginner to modify the board-2.bin 😕
5. please help me to create best board-2.bin for my device

[laipeng668]

I have a different perspective. If the board-2.bin (board-kt_ar06-012h.ipq6018) is the original factory file, I believe it does not need to be modified.

The board-2.bin (board-kt_ar06-012h.ipq6018) is the same for routers of the same model, but the ART partition is different—each device has a unique ART partition.

Clarify that the files in the firmware corresponds to the files in the source code：
/lib/firmware/ath11k/IPQ6018/hw1.0/board-2.bin=package\firmware\ipq-wifi\src\board-kt_ar06-012h.ipq6018
/etc/hotplug.d/firmware/11-ath11k-caldata=target\linux\qualcommax\ipq60xx\base-files\etc\hotplug.d\firmware\11-ath11k-caldata.

So the board-2.bin file here is copied directly from the source code.
And this cal-ahb-c000000.wifi.bin file is extracted by the firmware from the ART partition according to the 11-ath11k-caldata file.
This cal-ahb-c000000.wifi.bin file is the calibration data for the wireless network.

You can use cat /proc/mtd to obtain the correct ART partition name. Testing can be done by modifying files within the firmware, without the need to modify and recompile the source code.

[laipeng668]

Ignore what I mentioned here; I've checked and found that they are incorrect.

[baalwy]

I have a different perspective. If the board-2.bin (board-kt_ar06-012h.ipq6018) is the original factory file, I believe it does not need to be modified.

The board-2.bin (board-kt_ar06-012h.ipq6018) is the same for routers of the same model, but the ART partition is different—each device has a unique ART partition.

Clarify that the files in the firmware corresponds to the files in the source code： /lib/firmware/ath11k/IPQ6018/hw1.0/board-2.bin=package\firmware\ipq-wifi\src\board-kt_ar06-012h.ipq6018 /etc/hotplug.d/firmware/11-ath11k-caldata=target\linux\qualcommax\ipq60xx\base-files\etc\hotplug.d\firmware\11-ath11k-caldata.

So the board-2.bin file here is copied directly from the source code. And this cal-ahb-c000000.wifi.bin file is extracted by the firmware from the ART partition according to the 11-ath11k-caldata file. This cal-ahb-c000000.wifi.bin file is the calibration data for the wireless network.

You can use cat /proc/mtd to obtain the correct ART partition name. Testing can be done by modifying files within the firmware, without the need to modify and recompile the source code.

it's not board-2.bin it's bdwlan.bin I used qca-swiss-army-knife to create board-2.bin from bdwlan.bin

I created 2 files board-kt_ar06-012h.ipq6018 one make by official board-2.bin and the other I make from bdwlan.bin who's come with device and I build two image one form bdwlan.bin and other form board-2.bin
when I upgraded device with image board-2.bin general the WiFi 5G it's strong
but when upgrading device with bdwlan.bin the WiFi 5G it's very weak and the 2.4g it's strong