# Xiaomi Router 4 Pro R1350 — QCA9888 5 GHz analysis

## Inputs

- User backup archive SHA256: `f4d28e9eceeefa766fc8d6aab7a4bdcd282c81d947fa616f84da7b57f25d1a37`
- Xiaomi firmware 1.0.31 SHA256: `e07ee7492ba1b07d0488bf2f514286889dd5290221fe5e7240ac1e3904d560cd`
- Full flash backup: 16 MiB
- ART partition backup: 64 KiB

## Confirmed platform

- Model: Xiaomi R1350
- Kernel machine: `Qualcomm Atheros AP152 reference board`
- Kernel: Linux 3.3.8, MIPS
- 2.4 GHz: QCA9563 integrated radio, QSDK direct-attach stack
- 5 GHz: QCA9888 hw2, QSDK offload stack
- Vendor host modules include `qca_ol.ko`, `qca_da.ko`, `umac.ko`, `qdf.ko`; vendor firmware is not using standard ath10k.

## Flash layout evidence

From the 16 MiB `all.bin` and U-Boot strings/binwalk:

- `0x000000`: U-Boot; standalone bootloader backup is 0x30000 bytes.
- `0x060000`: 64 KiB ART partition; byte-identical to `art.bin`.
- `0x200000`: firmware region, size 0xE00000 according to U-Boot recovery command.
- Within firmware:
  - `0x200000`: uImage kernel
  - `0x320000`: SquashFS rootfs

Do not overwrite ART with another unit's data.

## Exact calibration layout

Vendor scripts identify the board as `ap152` and extract:

```sh
dd if=<art> of=/tmp/wifi0.caldata bs=32 count=34  skip=128
dd if=<art> of=/tmp/wifi1.caldata bs=32 count=377 skip=640
```

Equivalent offsets and sizes:

- 2.4 GHz: ART offset `0x1000`, size `0x440` (1088 bytes)
- 5 GHz: ART offset `0x5000`, size `0x2F20` (12064 bytes)

The supplied standalone `wifi0.caldata` and `wifi1.caldata` are byte-identical to these ART slices.

## QCA9888 board data

Vendor rootfs contains QSDK firmware under:

```text
/lib/firmware/QCA9888/hw.2/
```

including Y9484, Y9582, Y9690, YA105, YA841 and fallback boarddata files.
QSDK source maps board IDs as follows:

- `0x10`: Y9690
- `0x11`: Y9484
- `0x12`: Y9582
- `0x17`: Y9690 SBS HB
- `0x18`: YA105
- `0x19`: YA841

`boarddata_0.bin` is byte-identical to YA105; `boarddata_1.bin` is byte-identical to Y9484.
The unit-specific `wifi1.caldata` is closest to YA105/default board data (97.75% equal), but its header is unit-calibrated and must be used as calibration data, not replaced with generic board data.

## Root-cause assessment

The weak OpenWrt 5 GHz signal is most likely caused by the borrowed device definition failing to load the R1350's exact 5 GHz calibration blob from ART offset `0x5000`, or loading it through an incompatible ath10k path. The radio being enumerated and creating an AP proves only PCIe and firmware startup.

The vendor kernel exposes only AP152 LED/button GPIO evidence; no userspace PA/FEM enable GPIO was found. That lowers (but does not eliminate) the external-PA GPIO hypothesis. The stronger evidence is the exact vendor calibration extraction path and the use of a different QSDK host/target firmware family than OpenWrt's ath10k-ct.

## Recommended OpenWrt fix order

1. Add a dedicated R1350 board definition; do not continue shipping another Xiaomi model's DTS/mach file unchanged.
2. Declare the ART partition read-only at flash offset `0x60000`, size `0x10000`.
3. Feed QCA9563 calibration from ART `0x1000` and QCA9888 calibration from ART `0x5000`.
4. For QCA9888, use exactly 12064 bytes from `wifi1.caldata`; do not substitute a generic `board-2.bin` for per-device calibration.
5. Test upstream `kmod-ath10k` + non-CT QCA9888 firmware first, because the vendor stack is Qualcomm 10.4/QSDK and ath10k-ct is another compatibility variable.
6. Capture full ath10k boot logs and verify whether calibration came from device tree/nvmem or fell back to generic board data.
7. If correct calibration with upstream ath10k remains weak, compare GPIO state under vendor/OpenWrt and then consider porting QSDK qca-wifi.

## Live data still needed

From OpenWrt on the physical unit:

```sh
cat /proc/mtd
cat /tmp/sysinfo/board_name 2>/dev/null
lspci -nnk
dmesg | grep -iE 'ath10k|qca|firmware|board|cal|eeprom|otp|pci|gpio'
ls -l /lib/firmware/ath10k/QCA9888/hw2.0/
iw phy
cat /sys/kernel/debug/ieee80211/phy*/ath10k/firmware_info 2>/dev/null
```

Also provide the exact OpenWrt image/model currently borrowed; its DTS/mach definition is required for a precise patch.
