Add support for TP-LINK AX55 V1

akm-04 · July 26, 2024, 11:01am

I was able to use your script, edit it slightly, and be able to unpack my oem firmware, enable telnet and then again repack and finally flash it onto my router successfully. The router boots without any issue and telnet is also working correctly.
My router : TP Link Archer AX53 -v 1
I did tried to enable ssh but was unsuccessful as no matter what i did my ssh connection from client was always refused.
I'll share some logs, hope it helps:

akm@HP450G1:~/Git/Git_Clonned/tp-link-ax55-fw-hacks$ telnet 192.168.0.1
Trying 192.168.0.1...
Connected to 192.168.0.1.
Escape character is '^]'.

 === IMPORTANT ============================
  Use 'passwd' to set your login password
  this will disable telnet and enable SSH
 ------------------------------------------


BusyBox v1.19.4 (2024-01-29 22:43:13 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (Attitude Adjustment, unknown)
 ---------------------------------------------------------------

root@Archer_AX53:/etc/modules.d# uname -r
4.4.60
root@Archer_AX53:/etc/modules.d# uname -a
Linux Archer_AX53 4.4.60 #1 SMP PREEMPT Mon Jan 29 22:19:25 CST 2024 armv7l GNU/Linux
Qualcomm Technologies, Inc. IPQ5018/AP-MP02.1root@Archer_AX53:/etc/modules.d# uname -m
armv7l

root@Archer_AX53:/tp_data# cat product-info
vendor_name:TP-Link
vendor_url:www.tp-link.com
product_name:Archer AX53
device_name:Wireless Router Archer AX53
country:DE
product_ver:1.0.0
hw_ver:00000001
product_id:30003001
special_id:45550000
hw_id:B8A21A250D06358193A839AAFE53DB78
oem_id:33407C629E68ACD6503BFE6D4A596762

root@Archer_AX53:/etc/modules.d# cat /proc/cpuinfo
processor       : 0
model name      : ARMv7 Processor rev 4 (v7l)
BogoMIPS        : 60.48
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm aes pmull sha1 sha2 crc32 
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0xa
CPU part        : 0x801
CPU revision    : 4

processor       : 1
model name      : ARMv7 Processor rev 4 (v7l)
BogoMIPS        : 60.48
Features        : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm aes pmull sha1 sha2 crc32 
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0xa
CPU part        : 0x801
CPU revision    : 4

Hardware        : Generic DT based system
Revision        : 0000
Serial          : 0000000000000000
root@Archer_AX53:/etc/modules.d# cat /proc/meminfo
MemTotal:         198040 kB
MemFree:           70152 kB
MemAvailable:      74252 kB
Buffers:            5936 kB
Cached:            22796 kB
SwapCached:            0 kB
Active:            32840 kB
Inactive:           8444 kB
Active(anon):      13360 kB
Inactive(anon):      900 kB
Active(file):      19480 kB
Inactive(file):     7544 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:         12568 kB
Mapped:            10272 kB
Shmem:              1708 kB
Slab:              53596 kB
SReclaimable:       3304 kB
SUnreclaim:        50292 kB
KernelStack:        1280 kB
PageTables:         1272 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       99020 kB
Committed_AS:      31632 kB
VmallocTotal:    1818624 kB
VmallocUsed:           0 kB
VmallocChunk:          0 kB
root@Archer_AX53:/etc/modules.d# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00080000 00020000 "0:SBL1"
mtd1: 00080000 00020000 "0:MIBIB"
mtd2: 00040000 00020000 "0:BOOTCONFIG"
mtd3: 00040000 00020000 "0:BOOTCONFIG1"
mtd4: 00100000 00020000 "0:QSEE"
mtd5: 00040000 00020000 "0:DEVCFG"
mtd6: 00040000 00020000 "0:CDT"
mtd7: 00080000 00020000 "0:APPSBLENV"
mtd8: 00140000 00020000 "0:APPSBL"
mtd9: 00100000 00020000 "0:ART"
mtd10: 00080000 00020000 "0:TRAINING"
mtd11: 02a00000 00020000 "rootfs"
mtd12: 02a00000 00020000 "rootfs_1"
mtd13: 00840000 00020000 "tp_data"
mtd14: 00440000 00020000 "radio"
mtd15: 00080000 00020000 "data"
mtd16: 00345000 0001f000 "kernel"
mtd17: 01740000 0001f000 "ubi_rootfs"
mtd18: 00b43000 0001f000 "rootfs_data"
mtd19: 0064c000 0001f000 "tp_data"
mtd20: 0026c000 0001f000 "radio"

root@Archer_AX53:/etc/modules.d# cat /proc/version
Linux version 4.4.60 (pan@ubuntu) (gcc version 5.2.0 (OpenWrt GCC 5.2.0 388e9f2+r49254) ) #1 SMP PREEMPT Mon Jan 29 22:19:25 CST 2024
root@Archer_AX53:/etc/modules.d# cat /proc/device-tree/model
Qualcomm Technologies, Inc. IPQ5018/AP-MP02.1root@Archer_AX53

root@Archer_AX53:/etc/modules.d# cat /etc/openwrt_release
DISTRIB_ID="OpenWrt"
DISTRIB_RELEASE="Attitude Adjustment"
DISTRIB_REVISION="unknown"
DISTRIB_CODENAME="attitude_adjustment"
DISTRIB_TARGET="board_ipq50xx/generic"
DISTRIB_DESCRIPTION="OpenWrt Attitude Adjustment 12.09-rc1"
root@Archer_AX53:/etc/modules.d# cat /etc/openwrt_version
12.09-rc1

root@Archer_AX53:/etc/modules.d# df -h
Filesystem                Size      Used Available Use% Mounted on
mtd:ubi_rootfs           23.3M     23.3M         0 100% /rom
tmpfs                    96.7M    736.0K     96.0M   1% /tmp
tmpfs                   512.0K         0    512.0K   0% /dev
root                     96.7M         0     96.7M   0% /mnt
root                     96.7M    440.0K     96.3M   0% /overlay
overlayfs:/overlay       96.7M    440.0K     96.3M   0% /
ubi1:tp_data              4.0M     80.0K      4.0M   2% /tp_data
ubi2:radio              572.0K     24.0K    484.0K   5% /radio

root@Archer_AX53:/etc/modules.d# iwconfig
soc1      no wireless extensions.

gre0      no wireless extensions.

ath03     IEEE 802.11axg  ESSID:"kyBew9CW3tBusM8ISjpSi2sbHrbYAy"  
          Mode:Master  Frequency:2.427 GHz  Access Point: BE:53:22:27:F5:7B   
          Bit Rate:573.5 Mb/s   Tx-Power:19 dBm   
          RTS thr:off   Fragment thr:off
          Encryption key:5042-93E8-93A4-8EB8-05C7-011E-F77B-59E6   Security mode:restricted
          Power Management:off
          Link Quality=0/94  Signal level=-99 dBm  Noise level=-99 dBm (BDF averaged NF value in dBm)
          Rx invalid nwid:383  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

ath13     IEEE 802.11axa  ESSID:"5NDSdqg5Xym9JfOrfv9o2mJZ20ccHV"  
          Mode:Master  Frequency:5.18 GHz  Access Point: BE:53:22:27:F5:7A   
          Bit Rate:2.4019 Gb/s   Tx-Power:22 dBm   
          RTS thr:off   Fragment thr:off
          Encryption key:1A8A-62FD-8CDE-B712-7246-BFC1-2A05-235E   Security mode:restricted
          Power Management:off
          Link Quality=0/94  Signal level=-97 dBm  Noise level=-97 dBm (BDF averaged NF value in dBm)
          Rx invalid nwid:40  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

eth1.3    no wireless extensions.

wifi0     no wireless extensions.

sit0      no wireless extensions.

eth1.4    no wireless extensions.

gretap0   no wireless extensions.

ath0      IEEE 802.11axg  ESSID:"TP-Link_F57C"  
          Mode:Master  Frequency:2.427 GHz  Access Point: 9C:53:22:27:F5:7B   
          Bit Rate:573.5 Mb/s   Tx-Power:19 dBm   
          RTS thr:off   Fragment thr:off
          Encryption key:870F-B48B-92AC-E835-8152-0107-0657-55FF   Security mode:restricted
          Power Management:off
          Link Quality=0/94  Signal level=-99 dBm  Noise level=-99 dBm (BDF averaged NF value in dBm)
          Rx invalid nwid:287  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

ath1      IEEE 802.11axa  ESSID:"TP-Link_F57C"  
          Mode:Master  Frequency:5.18 GHz  Access Point: 9C:53:22:27:F5:7A   
          Bit Rate:2.4019 Gb/s   Tx-Power:22 dBm   
          RTS thr:off   Fragment thr:off
          Encryption key:2176-619A-2AC7-8E93-CF6D-D683-44D4-8181   Security mode:restricted
          Power Management:off
          Link Quality=0/94  Signal level=-97 dBm  Noise level=-97 dBm (BDF averaged NF value in dBm)
          Rx invalid nwid:26  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

lo        no wireless extensions.

eth1.5    no wireless extensions.

eth0      no wireless extensions.

eth1      no wireless extensions.

ip6tnl0   no wireless extensions.

br-lan    no wireless extensions.

wifi1     no wireless extensions.

eth1.4094  no wireless extensions.

soc0      no wireless extensions.

eth1.2    no wireless extensions.

root@Archer_AX53:/etc/modules.d# ifconfig -a
ath0      Link encap:Ethernet  HWaddr 9C:53:22:27:F5:7B  
          inet6 addr: fe80::9e53:22ff:fe27:f57b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:21635 errors:0 dropped:0 overruns:0 frame:0
          TX packets:36812 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1942482 (1.8 MiB)  TX bytes:51716384 (49.3 MiB)

ath03     Link encap:Ethernet  HWaddr BE:53:22:27:F5:7B  
          inet6 addr: fe80::bc53:22ff:fe27:f57b/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ath1      Link encap:Ethernet  HWaddr 9C:53:22:27:F5:7A  
          inet6 addr: fe80::9e53:22ff:fe27:f57a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ath13     Link encap:Ethernet  HWaddr BE:53:22:27:F5:7A  
          inet6 addr: fe80::bc53:22ff:fe27:f57a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br-lan    Link encap:Ethernet  HWaddr 9C:53:22:27:F5:7C  
          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: fe80::9e53:22ff:fe27:f57c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:21593 errors:0 dropped:9 overruns:0 frame:0
          TX packets:36447 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1635369 (1.5 MiB)  TX bytes:50336369 (48.0 MiB)

eth0      Link encap:Ethernet  HWaddr 00:11:22:33:44:55  
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

eth1      Link encap:Ethernet  HWaddr 9C:53:22:27:F5:7C  
          inet6 addr: fe80::9e53:22ff:fe27:f57c/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:35002 errors:0 dropped:0 overruns:0 frame:0
          TX packets:22585 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:49017312 (46.7 MiB)  TX bytes:2446728 (2.3 MiB)

eth1.2    Link encap:Ethernet  HWaddr 9C:53:22:27:F5:7C  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:410 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:100970 (98.6 KiB)

eth1.3    Link encap:Ethernet  HWaddr 9C:53:22:27:F5:7C  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:415 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:101260 (98.8 KiB)

eth1.4    Link encap:Ethernet  HWaddr 9C:53:22:27:F5:7C  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:414 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:101150 (98.7 KiB)

eth1.4094 Link encap:Ethernet  HWaddr 9C:53:22:27:F5:7D  
          inet addr:172.17.0.98  Bcast:172.17.0.255  Mask:255.255.255.0
          inet6 addr: fe80::9e53:22ff:fe27:f57d/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:34493 errors:0 dropped:0 overruns:0 frame:0
          TX packets:19157 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:48290638 (46.0 MiB)  TX bytes:1677776 (1.5 MiB)

eth1.5    Link encap:Ethernet  HWaddr 9C:53:22:27:F5:7C  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:413 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:101072 (98.7 KiB)

gre0      Link encap:UNSPEC  HWaddr 00-00-00-00-63-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1476  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

gretap0   Link encap:Ethernet  HWaddr 00:00:00:00:00:00  
          BROADCAST MULTICAST  MTU:1462  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ip6tnl0   Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          NOARP  MTU:1452  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:429 errors:0 dropped:0 overruns:0 frame:0
          TX packets:429 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:61655 (60.2 KiB)  TX bytes:61655 (60.2 KiB)

sit0      Link encap:IPv6-in-IPv4  
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

soc0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          [NO FLAGS]  MTU:0  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

soc1      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          [NO FLAGS]  MTU:0  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wifi0     Link encap:UNSPEC  HWaddr 9C-53-22-27-F5-7B-00-00-00-00-00-00-00-00-00-00  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:21654 errors:0 dropped:0 overruns:0 frame:0
          TX packets:37812 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:2699 
          RX bytes:1944597 (1.8 MiB)  TX bytes:50459148 (48.1 MiB)

wifi1     Link encap:UNSPEC  HWaddr 9C-53-22-27-F5-7A-00-00-00-00-00-00-00-00-00-00  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1371 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:2699 
          RX bytes:0 (0.0 B)  TX bytes:283289 (276.6 KiB)

I'm slightly concerned about the memory logs, I expected Ax53 - atlease version 1 to have around 512mb of ram, but the logs tell a different story, i could be wrong though could anyone take a look. I haven't open up the router to take a look at memory chip though.

root@Archer_AX53:/etc/modules.d# free -h
             total         used         free       shared      buffers
Mem:        190908       114056        76852         1320         3436
-/+ buffers:             110620        80288
Swap:            0            0            0
root@Archer_AX53:/etc/modules.d# cat /proc/meminfo
MemTotal:         190908 kB
MemFree:           76776 kB
MemAvailable:      73980 kB
Buffers:            3436 kB
Cached:            14088 kB
SwapCached:            0 kB
Active:            19924 kB
Inactive:           5976 kB
Active(anon):       8804 kB
Inactive(anon):      892 kB
Active(file):      11120 kB
Inactive(file):     5084 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          8412 kB
Mapped:             8164 kB
Shmem:              1320 kB
Slab:              52224 kB
SReclaimable:       2776 kB
SUnreclaim:        49448 kB
KernelStack:        1112 kB
PageTables:          856 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       95452 kB
Committed_AS:      20904 kB
VmallocTotal:    1818624 kB
VmallocUsed:           0 kB
VmallocChunk:          0 kB

I'll share my telnet enabled repacked firmware incase anyone intends to see around and play with any settings. Just uploading the repacked firmware from oem update page is enough to flash the firmware correctly.
Do note my router is TP Link AX53 version1 and not version 2

I've posted two firmware versions, one for the latest bplink oem beta firmware and the other for latest stable oem firmware (1.2.4)

https://drive.google.com/drive/folders/1vr6oBHo-TKTsoGEeNcMp5J-ta0H2UMTH?usp=sharing

OnOffre · September 5, 2024, 10:46am

I see you are very stressed. Relax!

master8 · September 22, 2024, 6:23pm

IPQ5018: Информация о GLiNET B3000 - Для разработчиков - Форум OpenWrt

Mainc0de32 · October 9, 2024, 3:34pm

TP-Link AX55 DTS device tree extracted from original FDT. Maybe it will help someone..
AX-55 .dts file

frollic · October 9, 2024, 6:13pm

Not until the statement in the 2nd post in this thread is invalidated.

Mainc0de32 · October 14, 2024, 10:36am

I built the Openwrt image for AX55 on the 6.6 kernel. But a problem was found - the QUART connector on the router has only GND, VCC and TX working (USB output). But the RX input from USB does not work. Does not respond to commands in any way. Therefore, it is impossible to flash through the bootloader. Just look at the console output. The adapter is working, tested on another router. How do I find the input (RX) pin on the board? Any help?

Hostle · October 14, 2024, 12:20pm

is common for vendors to remove the pullup resistor on uart. You need to trace the leads and most likely add a blob of solder across the points, in place of the missing resistor...

a multi-meter should help you determine the proper points to connect. start at the port, use continuity test to trace from uart to point a, from there, point b should be identifiable, if not, check the suspects for activity with the meter.

slh · October 14, 2024, 3:58pm

Vendors like to either cut the trace (missing 0-ohm resistor --> solder blob) or pull the signal explicitly down to gnd (remove superfluous resistor). The provided image isn't quite clear enough what's the situation here.

Mainc0de32 · October 14, 2024, 5:03pm

Thank you all for the answers. Only 3 pins work in the picture: GND,VCC,TX(to rx on R30 dot). I can read the UBOOT console without any problems. But I can't send commands to the console because I can't find the working RX pin. The first and second pins on the left are not connected to anything. That's the problem. Sorry for the bad English.

Hostle · October 16, 2024, 2:12pm

uboot console maybe disabled, or it could be the console program you are using as well. If the uboot console is not disabled, it should prompt you to hit a certain key/s within a certain time ...usually 2sec, it turn will present console or a list of options. See below

                                                                                
U-Boot 2016.01 (24.01.30 - 14:36:14 +0800)                                      
                                                                                
DRAM ptable founen: 4                                                           
512 iB                                                                          
NAND:  QPIC cpport serial NAND                                                  
ID = 21baef                                                                     
Vendor = ef                                                                     
Device = ba                                                                     
Serial Nand Device Found With ID : 0xef 0xba                                    
Serial NAND device Manufacturer:W25N01GWZEIG                                    
Device Size:128 MiB, Page size:2048, Spare Size:64, ECC:4-bit                   
SF: Unsupported flash IDs: manuf 00, jedec 0000, ext_jedec 0000                 
iFlash not found (bus/cs/speed/mode) = (0/0/48000000/0)                         
128 MiB                                                                         
MMC:   sdhci: Node Not found, skipping initialization                           
                                                                                
PCI Link Intialized                                                             
In:    serial@78AF000                                                           
Out:   serial@78AF000                                                           
Err:   serial@78AF000                                                           
machid: 8040004                                                                 
eth0 MAC Address from ART is not valid                                          
                                                                                
Net:   cmbblk is stable 5                                                       
MAC0 addr:00:11:22:33:44:55                                                      
PHY ID1: 0x4d                                                                   
PHY ID2: 0xd0c0                                                                 
MAC1 addr:99:88:77:66:55:44                                                     
athrs17_reg_init: complete                                                      
athrs17_vlan_config ...done                                                     
S17c init  done                                                                 
board_update_caldata: Unable to find slot-Id, Default CapIn/CapOut values used  
eth0, eth1                                                                      
                                                                                
Hit "gl" key to stop booting in 2 seconds      

IPQ5018#

sorry, I misread your last post ... i will leave my response because it may be relevant once you find the point.

The rx point should have constant voltage (usually). Have you tested the points I circled below

hard to tell from the pic but that seems to be the path of the trace. Also what is the rx label in the pic pointing too. From here that looks like the path of tx not rx

Mainc0de32 · October 16, 2024, 3:15pm

Ok. I checked the specified pins, there is no voltage, tried tracing - there is no reaction to the commands. Strange. I also tried to flash the image .ubi via telnet with the command "ubiformat /dev/mtd12 -y -f /tmp/openwrt-qualcommax-ipq50xx-tplink_ax55-squashfs-nand-factory.ubi" (to rootfs 1). The process was interrupted with the error "ubiformat: Arithmetic exception"...
Can i flash image somehow, if I already have root and telnet? I mean without bootloader commands, but with telnet commands? TP-Link routers have an emergency mode with a separate bootloader and a web interface for recovery if something goes wrong.. Thanks! I'm noob in OpenWrt porting and just learning

Hostle · October 16, 2024, 3:37pm

you should be able to wget or scp a firmware image to the tmp directory easy enough. then just mtd write ... try mtd -h and see if its available. Or use the tplink recovery to flash the firmware ??

However, what firmware do you plan to flash ? I think you're putting the wagon before the horse here. you should be dumping the routers contents first, and reverse engineering it, if you plan on making an openwrt image for it...

in that case ... you should be able to dd the mtd partitions to file/s, then use scp to get them to safety. See the B3000 thread for more info on dumping the partitions. I know little about this unit so I am unsure of your intentions

Mainc0de32 · October 16, 2024, 6:10pm

However, what firmware do you plan to flash ?

I built the firmware using your repository and added a device tree for AX55, FW blobs (v2.5), AX55 DTS and so on. As a result, I assembled the firmware.

you should be dumping the routers contents first, and reverse engineering it, if you plan on making an openwrt image for it..

It's already been done. I took everything I needed from disassembled OEM firmware and added the device
I am currently at the stage of flashing the image into the router's memory. I have written the image to /tmp and am trying to flash it with the command "ubiformat /dev/mtd12 -y -f /tmp/openwrt-qualcommax-ipq50xx-tplink_ax55-squashfs-nand-factory.ubi" like it was in instructions for redmi AX6000. But using own MTD number (mtd12 rootfs1)
and I get an error in the terminal "ubiformat: Arithmetic exception".
Wat i have for now: router with enabled root terminal and ready to flash ubi firmware image for AX55. I want to understand what does an "ubiformat: Arithmetic exception" error mean? Fw image size is about 9Mb. Rootfs 1 partition size is about 42Mb..

Hostle · October 16, 2024, 6:34pm

Not familiar with this approach, perhaps someone else with more knowledge in this area will chime in In the meantime, i would keep hunting for the rx pin. As, i recall, any tp-link device i've ever attached uart on, the rx was missing resistor. But after locating the pin, and connecting the points, uboot cmd prompt was accessible.

As for your current approach, I'd look into the sysupgrade scripts and see how its done there. It should provide some insight for your mission.

look in the lib/upgrade directory, in the build directory

/linux-<target>/base-files/ipkg-<target>/base-files/lib/upgrade/

Hostle · October 24, 2024, 1:05pm

you could build a firmware.img file and flash it using sysupgrade. I will push my latest commits this afternoon, with the added the makefile magic, to compile .imgs files.

do you have a copy of the stock firmware , is it an .img file ? If so, then you can likely just spoof your custom img so you can flash from directly from oem webui --> upgrade firmware

Mainc0de32 · October 24, 2024, 1:45pm

Yes, i have some copies of stock firmware. It's in .bin format (ax55v1-up-all-ver1-1-5-P1[20221105-rel1354]-sign_2022-11-05_12.03.05.bin) as example.

There is a great tool for unpack and repack TP-Link stock FW by Kolomparrudi, maybe it's help?

I can do any needed tests\flashing if it's help in progress. Also i can provide any files\drivers from stock FW including DTS

Hostle · October 24, 2024, 2:07pm

I'll take a look at what you've got and see if i can help. Have you tried to use sysupgrade with a bin ? or are you only building the .ubi image ?

My new makefile will produce .img, .bin, and sysupgrade.tar images. If you set things up correctly, you should be able to produce the sysupgrade and factory bins, then use the factory bin to upgrade via sysupgrade.

I'll have a look once i am finished updating my repo.

Mainc0de32 · October 24, 2024, 2:20pm

As a result 3 files was builded:
openwrt-qualcommax-ipq50xx-tplink_ax55-initramfs-uImage.itb
openwrt-qualcommax-ipq50xx-tplink_ax55-squashfs-nand-factory.ubi
openwrt-qualcommax-ipq50xx-tplink_ax55-squashfs-sysupgrade.bin

Will try to flash as you say, thank you!

Hostle · October 24, 2024, 2:23pm

try the sysupgrade bin,rename it firmware.bin and scp it to the tmp directory of the router.

then on router

cd /tmp
sysupgrade -F -n firmware.bin

Mainc0de32 · October 24, 2024, 2:51pm

The result of flashing:
scr2
And then router rebooting to stock FW...

There is a thing calling "nvrammanager" in upgrade process. I think it's not OpenWrt standart binary..