Skip to content

qualcommbe: ipq53xx: add support for Ubiquiti UniFi 7 Pro XGS - #25185

Open
tk154 wants to merge 9 commits into
openwrt:mainfrom
tk154:ubnt-u7-pro-xgs
Open

tk154 wants to merge 9 commits into
openwrt:mainfrom
tk154:ubnt-u7-pro-xgs

Conversation

@tk154

@tk154 tk154 commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

This PR adds support for the Ubiquiti UniFi 7 Pro XGS. It depends on #23161 for the ipq53xx subtarget.

Device specification

  • SoC: Qualcomm IPQ5332, quad-core Cortex-A53, 1.5 GHz
  • RAM: 2 GB
  • Flash: MT3204 eMMC, 4 GB
  • Ethernet: 1x 10GbE RJ45
  • WiFi: WiFi 7, 8 spatial streams
  • Radio topology: 5 GHz radio on PCIe1, 2.4/6 GHz radio on PCIe2
  • Power: PoE++, 29 W max.
  • LEDs: 1x white status, 1x blue WLAN
  • Console: ttyMSM0 at 115200 8n1

Notes

  • I did not add the QCN9160 WiFi present on PCIe0 because Ubiquiti seems to use it only for scanning and missing upstream support.
  • The Wi-Fi currently suffers from the same radio index problem as wifi-scripts: multi-radio phys sometimes assign wrong radio #24370: If PCIe1 probes first, the radio order becomes 5 GHz, 2.4 GHz, and 6 GHz. Whereas if PCIe2 probes first, it becomes 2.4 GHz, 6 GHz, and 5 GHz.

Installation

  1. Boot the device into the vendor firmware.

    The factory firmware should be reachable via SSH at 192.168.1.20 with user ubnt and password ubnt. If the device has already been adopted, the SSH credentials can be found in the UniFi WebUI under Devices -> Device Updates and Settings -> Device SSH Settings.

  2. Check the vendor firmware and U-Boot versions.

    The firmware version can be checked in the SSH banner or via:

    cat /usr/lib/semver

    The U-Boot version can be checked via:

    strings /dev/mtd8 | grep '^U-Boot '
  3. If the device runs firmware newer than 8.0.23 or U-Boot newer than 2024.01 v1.0.51.63, downgrade first to 8.0.23.

    Newer U-Boot versions enforce signature checks while loading the image, which prevents booting OpenWrt.

    Download:
    https://dl.ui.com/unifi/firmware/U7PRO/8.0.23.16670/BZ.ipq53xx_8.0.23+16670.250316.0909.bin

    Downgrade via SSH by copying the image to /tmp/fwupdate.bin and running:

    fwupdate -c
    syswrapper.sh upgrade2

    Or use the UniFi WebUI: Devices -> <select AP> -> Manage -> Manual Firmware Update

    After the AP reboots, log in again and repeat the checks from step 2. Continue only once the device reports firmware 8.0.23 and U-Boot 2024.01 v1.0.51.63 or older.

  4. Check which kernel slot the device is set to boot from:

    hexdump -n1 -e '1/1 "%u\n"' /dev/mmcblk0p4

    If the command prints 1, switch the boot slot to kernel0:

    printf '\0' | dd of=/dev/mmcblk0p4 bs=1 conv=fsync

    Then run the check again and make sure it now prints 0.

    If the command already printed 0, back up kernel0 to kernel1:

    dd if=/dev/mmcblk0p1 of=/dev/mmcblk0p2 bs=1M conv=fsync
  5. Copy the initramfs image to /tmp via SCP.

  6. Flash the initramfs FIT image to mmcblk0p1:

    dd if=/tmp/openwrt-qualcommbe-ipq53xx-ubnt_u7-pro-xgs-initramfs.itb of=/dev/mmcblk0p1 bs=1M conv=fsync
  7. Reboot the device. The stock bootloader loads kernel0 and boots the OpenWrt initramfs image. The AP has the default IP 192.168.1.1 now.

  8. Copy the sysupgrade image to /tmp via SCP and install it from the initramfs system:

    sysupgrade -n /tmp/openwrt-qualcommbe-ipq53xx-ubnt_u7-pro-xgs-squashfs-sysupgrade.itb

@openwrt openwrt Bot added core packages pull request/issue for core (in-tree) packages kernel pull request/issue with Linux kernel related changes labels Sep 14, 2026
@openwrt

openwrt Bot commented Sep 14, 2026

Copy link
Copy Markdown

Formality Check: Suggestions Available

We checked this pull request against the contribution guidelines. Here is what needs your attention:

⚠️ STYLISTIC WARNINGS & SUGGESTIONS

Package Release Audit:

  • ⚠️ Content changed in these packages, but without a PKG_RELEASE or version bump:

    • package/firmware/ipq-wifi

    Increment PKG_RELEASE by 1 (or bump PKG_VERSION/PKG_SOURCE_DATE and reset PKG_RELEASE to 1) so users receive the update.

Do not increment release for minor changes. Cosmetic edits (e.g., typos in comments, copyright updates, formatting/whitespace), changing the package maintainer (PKG_MAINTAINER), or updating source download info (PKG_SOURCE_URL / PKG_HASH) do not require incrementing PKG_RELEASE.


Something broken? Consider reporting an issue.
Running version 059e3de deployed on 2026-09-09 11:53:18 CEST

@openwrt openwrt Bot added the target/qualcommbe pull request/issue for qualcommbe target label Sep 14, 2026

@openwrt-ai openwrt-ai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit checks

  • 2117b11d "qualcommbe: add IPQ53xx subtarget" — the message covers only the subtarget and kernel config, but the commit also introduces the two-pass Build/fit-inline-rootfs image recipe. Mention the inline-FIT/squashfs-alignment recipe in the body, or split it out.
  • 3abafe94 "qualcommbe: add support for Ubiquiti UniFi 7 Pro XGS" — the MAC address layout section covers only the Ethernet port; add one line per remaining interface (2.4/5/6 GHz). The hardware specification also has no Buttons line although the Recovery section uses the Reset button.

Generated by Claude Code

Comment thread target/linux/qualcommbe/dts/ipq5332-u7-pro-xgs.dts Outdated
Comment thread target/linux/qualcommbe/dts/ipq5332-u7-pro-xgs.dts
Comment thread target/linux/qualcommbe/dts/ipq5332-u7-pro-xgs.dts
Comment thread target/linux/qualcommbe/image/ipq53xx.mk Outdated
Comment thread target/linux/qualcommbe/image/ipq53xx.mk Outdated
Comment thread target/linux/qualcommbe/image/ipq53xx.mk Outdated
Comment thread package/firmware/ipq-wifi/Makefile

@openwrt-ai openwrt-ai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit checks

  • 1a85a329 "qualcommbe: add support for Ubiquiti UniFi 7 Pro XGS" — the hardware specification still has no Buttons line, although the DTS now describes a reset button on gpio26 and the Recovery section depends on it. Add e.g. Buttons: 1x reset.
  • 05acb8f2 "mac80211: ath12k: allow DT board_id override for board data selection" — subject and body say board_id, but the code now reads qcom,board-id; the patch file's own Subject:/description carry the same stale name. Update both to the property actually implemented.

Generated by Claude Code

Comment thread target/linux/qualcommbe/dts/ipq5332-u7-pro-xgs.dts Outdated
Comment thread target/linux/qualcommbe/dts/ipq5332-u7-pro-xgs.dts Outdated
Comment thread target/linux/qualcommbe/image/ipq53xx.mk Outdated

@openwrt-ai openwrt-ai left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit checks

  • 124b0a1b "mac80211: ath12k: allow DT board_id override for board data selection" — the subject still names board_id, but the property the patch implements is qcom,ath12k-board-id (the patch's own Subject: was updated). Rename the subject accordingly.
  • 18da1692 "qualcommbe: add support for Ubiquiti UniFi 7 Pro XGS" — subject says UniFi 7 Pro XGS while DEVICE_MODEL and the DTS model added by this commit say UniFi U7 Pro XGS.

Generated by Claude Code

Comment thread package/firmware/ipq-wifi/Makefile Outdated
Some vendor eMMC boot flows use inline FIT images with an embedded
root filesystem and expose the selected image through the rootdisk DT
property. The existing fitblk code is too strict for those images and
fails in several ways: it requires u-boot,version, it limits the
temporary FIT buffer too aggressively, it only accepts external-data
subimages, and it maps the writable remainder before the end of the full
FIT blob.

Add the missing pieces required for those inline FIT images:
- make u-boot,version optional when rootdisk is present
- allow larger FIT indexes and use kvmalloc() for the temporary buffer
- accept subimages stored in the inline data property
- map /dev/fitrw only after the full FIT image on disk

This keeps the existing external-data flow unchanged while making inline
squashfs FIT images usable for first boot and sysupgrade on eMMC based
targets.

Signed-off-by: Til Kaiser <[email protected]>
Some PCIe ath12k platforms report an unusable board ID from OTP or
QMI, which makes board-2.bin lookup fall back to the wrong entry.

Allow DTS to override the board ID in both the MHI and QMI paths so
boards can provide a stable value for firmware board-data selection
while keeping the current fallback logic for existing targets.

Signed-off-by: Til Kaiser <[email protected]>
Disable missing kernel symbols that were prompted while
building all kernel modules.

Signed-off-by: Til Kaiser <[email protected]>
Add the missing IPQ5332 DTS nodes for the PWM block used by
front-panel LEDs and for the MDIO bus used by external Ethernet PHYs.

Signed-off-by: Til Kaiser <[email protected]>
Add the IPQ5332 NSSCC bindings, clock definitions,
interconnect updates, clock controller driver, and DTS nodes
from the v5 mailing-list series.

The series is imported with a deliberate deviation: a dedicated
ftbl_nss_cc_ppe_clk_src is added so the PPE clock can reach 300 MHz
instead of being capped at the CE table's 200 MHz.

Link: https://lore.kernel.org/all/[email protected]/
Signed-off-by: Til Kaiser <[email protected]>
Add the IPQ5332 specific PCS, PPE, and NSS clock changes needed
to bring up the integrated Ethernet datapath on IPQ5332 based boards.

Signed-off-by: Til Kaiser <[email protected]>
Add the IPQ5332 specific changes required to use the second PCIe
controller, including the shared reset and mux handling in the UNIPHY
driver and the corresponding DTS nodes.

Signed-off-by: Til Kaiser <[email protected]>
Add the IPQ53xx subtarget to qualcommbe together with the
default kernel configuration needed by IPQ5332 based boards.

This also includes the ipq53xx image recipe using fit-inline-rootfs,
which builds a Flattened Image Tree (FIT) with an inline SquashFS
root filesystem aligned to a 4KB boundary.

Signed-off-by: Til Kaiser <[email protected]>
Add support for the Ubiquiti UniFi U7 Pro XGS ceiling-mounted
access point.

Device specification
--------------------

SoC:                    Qualcomm IPQ5332, quad-core Cortex-A53, 1.5 GHz
RAM:                    2 GB
Flash:                  MT3204 eMMC, 4 GB
Flash:                  MX25U6435F SPI-NOR, 8 MB
Ethernet:               1x 10GbE RJ45
WiFi:                   WiFi 7, 8 spatial streams
                        2.4 GHz 2x2, 5 GHz 4x4, 6 GHz 2x2
Power:                  PoE++, 29 W max.
LEDs:                   1x white status, 1x blue WLAN
Buttons:                1x reset
Console:                ttyMSM0 at 115200 8n1
Bootloader:             U-Boot

Installing OpenWrt
------------------

1. Boot the device into the vendor firmware.

   The factory firmware should be reachable via SSH at 192.168.1.20
   with user ubnt and password ubnt. If the device has already been
   adopted, the SSH credentials can be found in the UniFi WebUI under
   Devices -> Device Updates and Settings -> Device SSH Settings.

2. Check the vendor firmware and U-Boot versions.

   The firmware version can be checked in the SSH banner or via:

     cat /usr/lib/semver

   The U-Boot version can be checked via:

     strings /dev/mtd8 | grep '^U-Boot '

3. If the device runs firmware newer than 8.0.23 or U-Boot newer than
   2024.01 v1.0.51.63, downgrade first to 8.0.23.

   Newer U-Boot versions enforce a signature check while loading the
   image, which prevents booting OpenWrt.

   Download:
   https://dl.ui.com/unifi/firmware/U7PRO/8.0.23.16670/BZ.ipq53xx_8.0.23+16670.250316.0909.bin

   Downgrade via SSH by copying the image to /tmp/fwupdate.bin and
   running:

     fwupdate -c
     syswrapper.sh upgrade2

   Or use the UniFi WebUI:
   Devices -> <select AP> -> Manage -> Manual Firmware Update

   After the AP reboots, log in again and repeat the checks from step 2.
   Continue only once the device reports firmware 8.0.23 and U-Boot
   2024.01 v1.0.51.63 or older.

4. Copy the initramfs image to /tmp via SCP.

5. Check which kernel slot the device is set to boot from:

     hexdump -n1 -e '1/1 "%u\n"' /dev/mmcblk0p4

   If the command prints 1, switch the boot slot to kernel0:

     printf '\0' | dd of=/dev/mmcblk0p4 bs=1 conv=fsync

   Then run the check again and make sure it now prints 0.

   If the command already printed 0, back up kernel0 to kernel1:

     dd if=/dev/mmcblk0p1 of=/dev/mmcblk0p2 bs=1M conv=fsync

6. Flash the initramfs FIT image to mmcblk0p1:

     dd if=/tmp/openwrt-qualcommbe-ipq53xx-ubnt_u7-pro-xgs-initramfs.itb of=/dev/mmcblk0p1 bs=1M conv=fsync

7. Reboot the device. The stock bootloader loads kernel0 and boots the
   OpenWrt initramfs image. The AP has the default IP 192.168.1.1 now.

8. Copy the sysupgrade image to /tmp via SCP and install it from the
   initramfs system:

     sysupgrade -n /tmp/openwrt-qualcommbe-ipq53xx-ubnt_u7-pro-xgs-squashfs-sysupgrade.itb

Recovery
--------

1. Connect your computer to the AP network or directly to the data port
   on the PoE adapter.
2. Press and hold the Reset button until the LED flashes white, blue,
   off.
3. Use TFTP to upload the downgrade image to 192.168.1.20:

     tftp 192.168.1.20
     binary
     rexmt 1
     timeout 60
     put /path/to/BZ.ipq53xx_8.0.23+16670.250316.0909.bin

4. Wait for the AP to upgrade and reboot automatically.

Reference:
https://help.ui.com/hc/en-us/articles/360043360253-UniFi-Recovery-Mode

MAC address layout:
The all-zero local-mac-address is a placeholder that stock
U-Boot fills in via the ethernet1 alias.

Signed-off-by: Til Kaiser <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

core packages pull request/issue for core (in-tree) packages kernel pull request/issue with Linux kernel related changes target/qualcommbe pull request/issue for qualcommbe target

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants