# Archer C7: upgrade OpenWrt 19.07.4 → 25.12.5

> **Outcome (2026-08-20):** upgrade done (flashed clean per this doc).
> The USB-tether flapping survived the new kernel → root cause is the
> C7's USB port lacking charging current (phone dropped off the bus
> whenever it drew charge). **WAN is now the phone's Wi-Fi hotspot**:
> 2.4 GHz `radio1` in STA mode → interface `wwan` (`phy1-sta0`, in the
> wan zone), phone on a mains charger. `usbwan` stays configured for a
> future powered-USB-hub wired option. Post-flash gotcha: fw4 compiled
> NAT for `eth0.2` only while `usbwan` was down at reload time — LAN
> had no internet until `service firewall restart` with the WAN
> interface up.

Home router **TP-Link Archer C7 v5** (`tplink,archer-c7-v5`, target
`ath79/generic`, 16 MB flash / 128 MB RAM) at `192.168.0.2`, running
OpenWrt 19.07.4 (2020, kernel 4.14, EOL since 2022). Target release:
**OpenWrt 25.12.5** (kernel 6.12.94, firewall4/nftables, `apk` package
manager instead of `opkg`).

Context (2026-08-19): after a reboot the router came up with **dnsmasq,
firewall and odhcpd disabled** (missing `/etc/rc.d/` symlinks — no DHCP,
no NAT). All three were restarted and re-enabled, but the incident plus
the EOL release motivated this upgrade. A fresh flash also rules out
any other overlay damage.

Current setup worth knowing:

- **WAN = OPPO phone (SM8350) USB-tethered** on `usb0` via RNDIS
  (`kmod-usb-net-rndis`), interface `usbwan`, DHCP from the phone
  (10.205.61.0/24). The ethernet WAN port is unused — the ISP box at
  `.1` is dead, which is also why the router LAN IP is `.2`.
- SSH: `ssh -i id_rsa_claude root@192.168.0.2` (key at perso repo root;
  19.07's dropbear needs
  `-o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa`
  from a modern OpenSSH; 25.12 won't)
- DNS: dnsmasq forwards everything to **blocky** at `192.168.0.254`
  (`noresolv` + `server=192.168.0.254`), and DHCP option 6 hands blocky
  directly to clients
- Wi-Fi: 5 GHz only (`radio0`, ch 36, VHT80, SSID `HOME`, WPA2-PSK);
  2.4 GHz radio disabled
- 7 static DHCP leases (see script below)
- Only user-installed packages on 19.07: `kmod-usb-net-rndis` + deps

## Prerequisites (done 2026-08-19)

- [x] Config backup: `sysupgrade -b` → `~/code/perso/backup-archer-c7-20260819.tar.gz`
      (laptop; contains Wi-Fi PSK and dropbear host keys — never commit)
- [x] Firmware `openwrt-25.12.5-ath79-generic-tplink_archer-c7-v5-squashfs-sysupgrade.bin`
      downloaded, **sha256 verified** (`f15b16b3…`) against the release
      `sha256sums`, staged in `~/code/perso/archer-c7-upgrade/` and on
      the router at `/tmp/` (`/tmp` is RAM — gone after any reboot,
      re-`scp` if needed)
- [x] **Offline driver packages** staged in `~/code/perso/archer-c7-upgrade/`:
      `kmod-mii`, `kmod-usb-net`, `kmod-usb-net-cdc-ether`,
      `kmod-usb-net-rndis` (all `6.12.94-r1.apk`). Critical: the phone
      tether is the only WAN and the RNDIS driver is **not** in the
      default image, so after flashing the router has no internet to
      install it from — it must be `scp`'d in.

## Upgrade

**Do not keep settings across this jump** (19.07 → 25.12 spans the
fw3→fw4 and network-syntax migrations). Flash clean with `-n` and
reconfigure with the script below.

You need the **laptop on ethernet** to a LAN port: the fresh image
boots at `192.168.1.1` with Wi-Fi disabled.

```sh
# on the router — image already in /tmp, verify then flash
sha256sum /tmp/openwrt-25.12.5-ath79-generic-tplink_archer-c7-v5-squashfs-sysupgrade.bin
# expect f15b16b36df7fce8a5cf1302320fdb428c3bb6fbc2949a4858afa257f4f364a2
sysupgrade -n -v /tmp/openwrt-25.12.5-ath79-generic-tplink_archer-c7-v5-squashfs-sysupgrade.bin
```

The router reboots (~3 min, don't power-cycle). Then from the laptop
(ethernet, DHCP gives a 192.168.1.x address):

```sh
# passwordless root at first boot — set a password and install the key
ssh root@192.168.1.1        # no password
passwd
mkdir -p /etc/dropbear && exit
scp ~/code/perso/id_rsa_claude.pub root@192.168.1.1:/etc/dropbear/authorized_keys

# push the offline RNDIS drivers
scp ~/code/perso/archer-c7-upgrade/kmod-*.apk root@192.168.1.1:/tmp/
```

## Reconfigure

Run on the router. Single source of truth for the whole config;
`<wifi-psk>` is in the backup tarball (`etc/config/wireless`).

```sh
#!/bin/sh
set -eux

# RNDIS drivers (offline — phone tether is the only WAN)
apk add --allow-untrusted /tmp/kmod-mii-*.apk /tmp/kmod-usb-net-6*.apk \
    /tmp/kmod-usb-net-cdc-ether-*.apk /tmp/kmod-usb-net-rndis-*.apk

# --- network: keep the generated switch/bridge config, change only what we need
uci set network.lan.ipaddr='192.168.0.2'
uci set network.usbwan=interface
uci set network.usbwan.proto='dhcp'
uci set network.usbwan.device='usb0'
uci commit network

# --- firewall: usbwan joins the wan zone (zone[1] = 'wan' in the default config)
uci add_list firewall.@zone[1].network='usbwan'
uci commit firewall

# --- dhcp/dns: forward to blocky, hand blocky to clients, static leases
uci set dhcp.@dnsmasq[0].noresolv='1'
uci add_list dhcp.@dnsmasq[0].server='192.168.0.254'
uci add_list dhcp.lan.dhcp_option='6,192.168.0.254'
add_host() {
  uci add dhcp host >/dev/null
  uci set dhcp.@host[-1].mac="$1"
  uci set dhcp.@host[-1].ip="$2"
  uci set dhcp.@host[-1].name="$3"
  uci set dhcp.@host[-1].dns='1'
}
add_host 'F4:5C:89:BE:C1:C3' '192.168.0.20'  'LAPTOP719974'
add_host '10:66:6A:87:A1:49' '192.168.0.254' 'blocky'
add_host '10:66:6A:C8:E1:0A' '192.168.0.5'   'jellyfin-server'
add_host '10:66:6A:FF:59:1C' '192.168.0.6'   'jellyfin-client'
add_host '10:66:6A:85:20:B7' '192.168.0.11'  'privoxy'
add_host '10:66:6A:55:9F:10' '192.168.0.7'   'transmission-bt'
add_host '50:9A:4C:20:D9:2B' '192.168.0.21'  'patate'
uci commit dhcp

# --- wifi: 5 GHz AP as before, upgraded to WPA2/WPA3 mixed; 2.4 GHz stays off
uci set wireless.radio0.channel='36'
uci set wireless.radio0.htmode='VHT80'
uci set wireless.radio0.disabled='0'
uci set wireless.default_radio0.ssid='HOME'
uci set wireless.default_radio0.encryption='sae-mixed'
uci set wireless.default_radio0.key='<wifi-psk>'
uci set wireless.default_radio0.network='lan'
uci commit wireless

reload_config
/etc/init.d/network restart
```

The LAN IP change kicks you off; reconnect at `192.168.0.2` (plug the
phone back in for WAN).

## Verify

```sh
ssh root@192.168.0.2
ifstatus usbwan | grep -E 'up|address'   # up:true, 10.205.61.x
ping -c2 8.8.8.8 && ping -c2 openwrt.org # WAN + DNS via blocky
nft list chain inet fw4 srcnat_wan       # masquerade on usbwan
ls /etc/rc.d/ | grep -E 'dnsmasq|firewall|odhcpd'   # all enabled
```

Then from a LAN client: renew DHCP (expect 192.168.0.100–249, DNS
`.254`), check internet, check the static leases land on their IPs.

## Known issue: 5 GHz `ath10k-ct`

The C7 v2/v5 has a long-standing 5 GHz issue with the default
`ath10k-ct` driver: `SWBA overrun on vdev 0` log spam plus client
drops under some loads. **Only if it shows up**, swap to the non-ct
driver (needs working WAN, or pre-download the same way as the RNDIS
apks):

```sh
apk del kmod-ath10k-ct ath10k-firmware-qca988x-ct
apk add kmod-ath10k ath10k-firmware-qca988x
reboot
```

## Recovery

If the flash bricks: C7 v5 has TFTP recovery — hold **Reset** while
powering on, router pulls `ArcherC7v5_tp_recovery.bin` (the OpenWrt
**factory** image renamed to that) from a TFTP server at
`192.168.0.66`. Factory image is in the same release directory as the
sysupgrade one.

## Post-upgrade cleanup

- Delete `/tmp` copies (automatic on reboot)
- Keep `~/code/perso/backup-archer-c7-20260819.tar.gz` until the new
  setup has survived a reboot + a few days
- `~/code/perso/archer-c7-upgrade/` can go once the RNDIS drivers are
  installed and Wi-Fi is confirmed stable (or keep the apks in case of
  a re-flash)