Buffalo WXR-5950AX12 v1

abgn+ac+ax (AX60008S)
	WiFi Wireless LAN Router
Homepage	Product page
Wikipedia	Buffalo Inc.
WikiDevi.wi-cat.ru	Buffalo WXR-5950AX12
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Supported
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	Buffalo WXR-5950AX12 v1
FCC ID	none specified
Type	wireless router
CPU1	Qualcomm IPQ8074A
CPU1 Type	ARM Cortex-A53
CPU1 Speed	2.2 GHz ( 4 cores ) 64-bit
Flash1 Chip	Winbond W29N02GZBIBA
Flash1 Size	256 MiB 268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br /> (NAND)
RAM1 Size	1 GiB 1,024 MiB <br />1,073,741,824 B <br />8,388,608 Kib <br />1,048,576 KiB <br />8,192 Mib <br /> (DDR3)
RAM1 Chip	Nanya NT5CC256M16ER-EK x 2
ETH chip1	Qualcomm IPQ8074A
ETH chip2	Marvell (Aquantia) AQR113C
ETH chip3	Marvell (Aquantia) AQR113C
Switch	Qualcomm Atheros QCA8075
Ethernet Port Count	1-10GbE-WAN; 1-10GbE x 3-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab/3bz/an
	802dot11 OUI: 50:C4:DD; Ethernet OUI: 50:C4:DD
Stock bootloader	U-Boot
Expansion IF types	USB 3.0
USB ports	1
USB Hub Compatible	Untested
Power	12 VDC, 4 A
Connector type	barrel
Serial Port (UART)	yes, 3.3V TTL, (115200 8N1)
	Flags:; Wi-Fi 6, WPA3, 1024QAM, MU-MIMO, HE160
Other
3rd Party Firmware Support	OpenWrt • (List \| Dev \| DLs);
Retail
Availability	End of Life
(Est.) release date	22 September 2019
ASIN	B07Y1GWNK5
Physical
Dimensions	7.5 x 30 x 19.5 cm
Weight	1.6 kg
Radio 1
Chip1	Qualcomm QCN5024
Wireless interface OUI	50:C4:DD
Antenna Connector Type	none specified
MIMO status	4x4:4
Wireless Standard	IEEE 802.11b/g/n/ax
802.11ax	up to 1148 Mbps
n-QAM	up to 1000 Mbps
802.11n	up to 600 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio 2
Chip1	Qualcomm QCN5054
Wireless interface OUI	50:C4:DD
Antenna Connector Type	none specified
MIMO status	4x4:4
Wireless Standard	IEEE 802.11a/n/ac/ax
AX-QAM	up to 4804 Mbps
802.11ax	up to 2402 Mbps
AC-QAM	up to 3466 Mbps
802.11ac	up to 1733 Mbps
802.11n	up to 600 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz

For a list of all currently documented Aquantia SoC's with specifications, see Aquantia.
For a list of all currently documented Qualcomm chipsets with specifications, see Qualcomm.
For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.

For a list of all currently documented Buffalo devices with specifications, see Buffalo.

• 4804 Mbps - 4SS 5GHz 802.11ax (80MHz chan., 1024-QAM)

• 1148 Mbps - 4SS 2.4GHz 802.11ax (40MHz chan., 256-QAM) = AX6000 class

Overview

List of WiFi 6 Routers on 24|Wireless • Compare (JP)

Flashing

NOTE: During configuration or flashing a device, the only things that should be hooked to the device is the computer and power.

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)
On the OpenWrt Wiki

Target: qualcommax
Subtarget: ipq807x
Package architecture: aarch64_cortex-a53
Supported Since Commit
Support started version: 23.05.0
Current supported version: 25.12.2

LAN Hardware: Qualcomm Atheros QCA8075
LAN Comment: 2x Marvell AQR113C 10Gbe Phy
WLAN Hardware: Qualcomm QCN5024, 2x Qualcomm QCN5054
WLAN Comment: 1x 2.4Ghz, 2x 5Ghz Tri-Band
Installation method(s):
TFTP generic, see git-commit
Recovery method(s):
CLI generic
Comment:
WiFi 5GHz band can either support 4x4 MU-MIMO 160Mhz channel -or- 8x8 MU-MIMO 80Mhz channel configuration, but NOT BOTH

git • >>

ipq807x: add support for Buffalo WXR-5950AX12
Buffalo WXR-5950AX12 is a 2.4/5 GHz band 11ax (Wi-Fi 6) router, based on
IPQ8074A.

Specification:

- SoC         : Qualcomm IPQ8074A
- RAM         : DDR3 1024 MiB (2x Nanya NT5CC256M16ER-EK)
- Flash       : RAW NAND 256 MiB (Winbond W29N02GZBIBA)
- WLAN        : 2.4/5 GHz (IPQ8074A)
- Ethernet    : 5 ports
  - WAN       : 100/1000/2500/10000 Mbps x1 (AQR113C)
  - LAN       : 100/1000/2500/10000 Mbps x1 (AQR113C),
                10/100/1000 Mbps x3 (QCA8075)
- LED/Keys    : 8x/5x
- UART        : pin header on PCB (J7)
  - assignment: 3.3V, GND, TX, RX from disc marking
  - settings  : 115200n8
- Power       : 12 VDC, 4 A

Flash instruction using initramfs image:

1. Prepare TFTP server with IP address 192.168.11.10
2. Rename OpenWrt initramfs image to "WXR-5950AX12-initramfs.uImage and
   place it to TFTP directory
3. Hold AOSS (WPS) button and power on WXR-5950AX12
4. WXR-5950AX12 downloads initramfs image from TFTP server and boots
   with it automatically
5. Upload sysupgrade image to WXR-5950AX12 and perform sysupgrade
6. Wait ~120 seconds to complete flashing

Partition layout:

0x000000000000-0x000000100000 : "0:sbl1"
0x000000100000-0x000000200000 : "0:mibib"
0x000000200000-0x000000280000 : "0:bootconfig"
0x000000280000-0x000000300000 : "0:bootconfig1"
0x000000300000-0x000000600000 : "0:qsee"
0x000000600000-0x000000900000 : "0:qsee_1"
0x000000900000-0x000000980000 : "0:devcfg"
0x000000980000-0x000000a00000 : "0:devcfg_1"
0x000000a00000-0x000000a80000 : "0:apdp"
0x000000a80000-0x000000b00000 : "0:apdp_1"
0x000000b00000-0x000000b80000 : "0:rpm"
0x000000b80000-0x000000c00000 : "0:rpm_1"
0x000000c00000-0x000000c80000 : "0:cdt"
0x000000c80000-0x000000d00000 : "0:cdt_1"
0x000000d00000-0x000000d80000 : "0:appsblenv"
0x000000d80000-0x000000e80000 : "0:appsbl"
0x000000e80000-0x000000f80000 : "0:appsbl_1"
0x000000f80000-0x000001000000 : "0:art"
0x000001000000-0x000001080000 : "0:art_1"
0x000001080000-0x000001100000 : "0:orgdata"
0x000001100000-0x000001180000 : "0:orgdata_1"
0x000001180000-0x000005180000 : "rootfs"
0x000005180000-0x000009180000 : "rootfs_recover"
0x000009180000-0x000010000000 : "user_property"

Notes:

- WXR-5950AX12 has 2x OS images on NAND flash. The 1st image is for
  normal operation and the 2nd one is for recoverying or firmware
  upgrading on stock.

- Stock U-Boot checks MD5 hashes in "fw_hash" volume in each "root*"
  partition when booting. This is just a comparation of hash strings.

  Behaviors:

  - both "fw_hash" volumes exist, hashes are rootfs == rootfs_recover
    ---> boot from rootfs

  - both "fw_hash" volumes exist, hashes are rootfs != rootfs_recover
    ---> boot from rootfs_recover

    Note: this behavior is used for firmware upgrading on stock

  - "fw_hash" volume in rootfs is missing
    ---> boot from rootfs_recover

  - "fw_hash" volume in rootfs_recover is missing
    ---> boot from rootfs

  - "fw_hash" volumes in both root* partition are missing
    ---> boot from rootfs_recover

Reverting to stock firmware:

1. Decrypt official image by buffalo-enc and remove header

   example of decryption:

   $ buffalo-enc -i wxr_5950ax12_jp_305 -o wxr_5950ax12_jp_305.dec \
                 -d -k olaffuB -O 0xc8

   example of removing header (v3.05):

   - before

   $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.dec
   00000000  57 58 52 2d 35 39 35 30  41 58 31 32 5f 33 2e 30  |WXR-5950AX12_3.0|
   00000010  35 5f 31 2e 30 31 5f 4a  50 5f 6a 70 5f 71 63 61  |5_1.01_JP_jp_qca|
   00000020  0a 66 69 6c 65 6c 65 6e  3d 34 35 33 35 30 39 31  |.filelen=4535091|
   00000030  32 0a 55 42 49 23 01 00  00 00 00 00 00 00 00 00  |2.UBI#..........|
   00000040

   - after

   $ hexdump -n 64 -v -C wxr_5950ax12_jp_305.ubi
   00000000  55 42 49 23 01 00 00 00  00 00 00 00 00 00 00 00  |UBI#............|
   00000010  00 00 08 00 00 00 10 00  78 cf c4 91 00 00 00 00  |........x.......|
   00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
   00000030  00 00 00 00 00 00 00 00  00 00 00 00 3d 2a 64 fd  |............=*d.|
   00000040

2. Boot WXR-5950AX12 with OpenWrt initramfs image

3. Upload modified stock image to WXR-5950AX12

4. Find partitions "rootfs" and "rootfs_recover"

   example:

   root@OpenWrt:/# cat /proc/mtd
   dev:    size   erasesize  name
   ...
   mtd22: 04000000 00020000 "rootfs"
   mtd23: 04000000 00020000 "rootfs_recover"
   ...

   in this case, "rootfs" is mtd22 and "rootfs_recover" is mtd23

5. Format "rootfs"/"rootfs_recover" partition with the uploaded image

   example:

   ubiformat /dev/mtd22 -f /tmp/wxr_5950ax12_jp_305.ubi
   ubiformat /dev/mtd23 -f /tmp/wxr_5950ax12_jp_305.ubi

6. Remove "rootfs"/"rootfs_data" volume from user_property partition

   example:

   . /lib/upgrade/nand.sh
   UBI=$(nand_attach_ubi user_property)
   ubirmvol /dev/$UBI -N rootfs
   ubirmvol /dev/$UBI -N rootfs_data

7. Reboot

MAC addresses:

LAN    : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
WAN    : 50:C4:DD:xx:xx:28 (0:APPSBLENV, ethaddr (text))
2.4 GHz: 50:C4:DD:xx:xx:30 (0:APPSBLENV, wlan0addr (text))
5 GHz  : 50:C4:DD:xx:xx:38 (0:APPSBLENV, wlan1addr (text))

Buffalo WXR-5950AX12 v1

Overview

Flashing

Flashing OpenWrt

See also

Navigation menu

Page actions

Page actions

Personal tools

empty section

Search

Navigation

data/misc

Tools

query forms

Shoutwiki

ShoutWiki messages

abgn+ac+ax (AX60008S)
WiFi Wireless LAN Router

Homepage	Product page
Wikipedia	Buffalo Inc.
WikiDevi.wi-cat.ru	Buffalo WXR-5950AX12
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Supported
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	Buffalo WXR-5950AX12 v1
FCC ID	none specified
Type	wireless router
CPU1 Y	Qualcomm IPQ8074A
CPU1 Type	ARM Cortex-A53
CPU1 Speed	2.2 GHz ( 4 cores ) 64-bit
Flash1 Chip	Winbond W29N02GZBIBA
Flash1 Size	256 MiB 268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br /> (NAND)
RAM1 Size	1 GiB 1,024 MiB <br />1,073,741,824 B <br />8,388,608 Kib <br />1,048,576 KiB <br />8,192 Mib <br /> (DDR3)
RAM1 Chip	Nanya NT5CC256M16ER-EK x 2
ETH chip1	Qualcomm IPQ8074A
ETH chip2	Marvell (Aquantia) AQR113C
ETH chip3	Marvell (Aquantia) AQR113C
Switch	Qualcomm Atheros QCA8075
Ethernet Port Count	1-10GbE-WAN 1-10GbE x 3-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab/3bz/an
802dot11 OUI: 50:C4:DD Ethernet OUI: 50:C4:DD
Stock bootloader	U-Boot
Expansion IF types	USB 3.0
USB ports	1
USB Hub Compatible	Untested
Power	12 VDC, 4 A
Connector type	barrel
Serial Port (UART)	yes, 3.3V TTL, (115200 8N1)
Flags: Wi-Fi 6, WPA3, 1024QAM, MU-MIMO, HE160

Other

3rd Party Firmware Support	OpenWrt • (List \| Dev \| DLs)
Retail
Availability	End of Life
(Est.) release date	22 September 2019
ASIN	B07Y1GWNK5
Physical
Dimensions	7.5 x 30 x 19.5 cm
Weight	1.6 kg
Radio 1
Chip1	Qualcomm QCN5024
Wireless interface OUI	50:C4:DD
Antenna Connector Type	none specified
MIMO status	4x4:4
Wireless Standard	IEEE 802.11b/g/n/ax
802.11ax	up to 1148 Mbps
n-QAM	up to 1000 Mbps
802.11n	up to 600 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio 2
Chip1	Qualcomm QCN5054
Wireless interface OUI	50:C4:DD
Antenna Connector Type	none specified
MIMO status	4x4:4
Wireless Standard	IEEE 802.11a/n/ac/ax
AX-QAM	up to 4804 Mbps
802.11ax	up to 2402 Mbps
AC-QAM	up to 3466 Mbps
802.11ac	up to 1733 Mbps
802.11n	up to 600 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz