CF-E355AC v2 Support

I recently received a CF-E355AC v2 model AP from Comfast. It has a Qualcomm QCA9886 chip (different from the original CF-E355AC which had the QCA9882. When I install the LEDE software for the original CF-E355AC on the v2 it works, but I cannot get the 5ghz radio working (I suspect because it is missing the right drivers).

In an ideal world there would exist a version of LEDE that supports this hardware but I haven't been able to find it. The manufacturer has provided me with 2 files (board-2.bin and firmware-5.bin) and provided directions to replace the files in /trunk/package/kernel/mac80211/QCA9888 with these newly provided files, recompile and voila.

I have been following these instructions to compile LEDE: https://lede-project.org/docs/guide-developer/quickstart-build-images

When I clone the master branch and search for board-2.bin and firmware-5.bin, I find them in the following locations:

chris@ubuntu:~$ find ~/ -name "board-2.bin"
/home/chris/lede/build_dir/target-mips_24kc_musl/ath10k-firmware-2017-03-29-956e2609/QCA4019/hw1.0/board-2.bin
/home/chris/lede/build_dir/target-mips_24kc_musl/ath10k-firmware-2017-03-29-956e2609/QCA9888/hw2.0/board-2.bin
/home/chris/lede/build_dir/target-mips_24kc_musl/ath10k-firmware-2017-03-29-956e2609/QCA6174/hw3.0/board-2.bin
/home/chris/lede/build_dir/target-mips_24kc_musl/ath10k-firmware-2017-03-29-956e2609/QCA6174/hw2.1/board-2.bin
/home/chris/lede/build_dir/target-mips_24kc_musl/ath10k-firmware-2017-03-29-956e2609/QCA9984/hw1.0/board-2.bin
/home/chris/lede/build_dir/target-mips_24kc_musl/ath10k-firmware-2017-03-29-956e2609/QCA9377/hw1.0/board-2.bin

/home/chris/lede/build_dir/target-mips_24kc_musl/root-ar71xx/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
/home/chris/lede/build_dir/target-mips_24kc_musl/root.orig-ar71xx/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
/home/chris/lede/build_dir/target-mips_24kc_musl/ath10k-firmware-2017-03-29-956e2609/ipkg-mips_24kc/ath10k-firmware-qca988x/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
/home/chris/lede/build_dir/target-mips_24kc_musl/ath10k-firmware-2017-03-29-956e2609/.pkgdir/ath10k-firmware-qca988x/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin
/home/chris/lede/staging_dir/target-mips_24kc_musl/root-ar71xx/lib/firmware/ath10k/QCA988X/hw2.0/firmware-5.bin

Can I simply replace all existences of the original board-2 and firmware-5.bin files with the mfg supplied, recompile and install the file "lede-ar71xx-generic-cf-e355ac-squashfs-sysupgrade.bin " that I receive after compilation? I suspect not, as that file likely contains the incorrect drivers still.

As can be seen I am a bit of a novice here but hoping to learn what my best next steps are!

Thank you in advance,

Chris

1 Like

Out of curiosity, what does running dmesg tell you on your router? That should tell you what firmware files the ath10k driver is looking for, and in which places. You could then position and/or rename the binaries you got accordingly.

E.g. on my UniFi AP, this is some info filtered from dmesg:

# dmesg -l warn,err
[    0.000000] No valid device tree found, continuing without
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.339202] registering PCI controller with io_map_base unset
[    0.345455] Can't analyze schedule() prologue at 80067048
[    0.391953] pci 0000:00:00.0: invalid calibration data
[    0.472507] Crashlog allocated RAM at address 0x3f00000
[    7.715988] jffs2_scan_eraseblock(): End of filesystem marker found at 0x10000
[    7.723479] jffs2_build_filesystem(): unlocking the mtd device... done.
[    7.730318] jffs2_build_filesystem(): erasing all blocks after the end marker... done.
[   19.240239] urandom-seed: Seed file not found (/etc/urandom.seed)
[   20.751168] PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
[   20.975308] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/pre-cal-pci-0000:00:00.0.bin failed with error -2
[   20.986394] ath10k_pci 0000:00:00.0: Falling back to user helper
[   21.127224] firmware ath10k!pre-cal-pci-0000:00:00.0.bin: firmware_loading_store: map pages failed
[   21.136782] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/cal-pci-0000:00:00.0.bin failed with error -2
[   21.147504] ath10k_pci 0000:00:00.0: Falling back to user helper
[   28.594487] ath10k_pci 0000:00:00.0: Direct firmware load for ath10k/QCA988X/hw2.0/board-2.bin failed with error -2
[   28.605289] ath10k_pci 0000:00:00.0: Falling back to user helper
[   28.683815] firmware ath10k!QCA988X!hw2.0!board-2.bin: firmware_loading_store: map pages failed

Multiple firmwares should be able to coexist normally. Firmware path on my device is /lib/firmware/ath10k/QCA988X/hw2.0/.

I couldn't get dmesg -l warn,err to work so I did just dmesg. The output is below - I see nothing about board-2.bin or ath10k

[    0.000000] Linux version 4.9.58 (chris@ubuntu) (gcc version 5.5.0 (LEDE GCC 5.5.0 r5216-5302abe745) ) #0 Sun Oct 29 22:41:00 2017
[    0.000000] MyLoader: sysp=9c0a45ff, boardp=42f04994, parts=80c6e8ee
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] OF: fdt:No valid device tree found, continuing without
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] On node 0 totalpages: 32768
[    0.000000] free_area_init_node: node 0, pgdat 80482754, node_mem_map 81000020
[    0.000000]   Normal zone: 256 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32768 pages, LIFO batch:7
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0 
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line:  board=CF-E355AC mtdparts=spi0.0:64k(u-boot)ro,64k(art)ro,16192k(firmware),64k(art-backup)ro console=ttyS0,115200 rootfstype=squashfs noinitrd
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 124744K/131072K available (3245K kernel code, 171K rwdata, 820K rodata, 300K init, 213K bss, 6328K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Clocks: CPU:650.000MHz, DDR:392.724MHz, AHB:216.666MHz, Ref:25.000MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000009] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008269] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.071122] pid_max: default: 32768 minimum: 301
[    0.076119] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.083101] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.093667] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.104071] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.111209] NET: Registered protocol family 16
[    0.117737] MIPS: machine is COMFAST CF-E355AC
[    0.608406] registering PCI controller with io_map_base unset
[    0.630056] PCI host bridge to bus 0000:00
[    0.634397] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.641707] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.647578] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.654736] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.663123] pci 0000:00:00.0: [168c:0056] type 00 class 0x028000
[    0.663135] pci 0000:00:00.0: invalid calibration data
[    0.668589] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    0.668718] pci 0000:00:00.0: PME# supported from D0 D3hot
[    0.668951] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    0.668984] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    0.676718] pci 0000:00:00.0: using irq 40 for pin 1
[    0.682806] clocksource: Switched to clocksource MIPS
[    0.689374] NET: Registered protocol family 2
[    0.694962] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[    0.702336] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[    0.709119] TCP: Hash tables configured (established 1024 bind 1024)
[    0.715959] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.722138] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.729119] NET: Registered protocol family 1
[    0.733816] PCI: CLS 0 bytes, default 32
[    0.739014] Crashlog allocated RAM at address 0x3f00000
[    0.745809] workingset: timestamp_bits=30 max_order=15 bucket_order=0
[    0.760050] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.766254] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.786748] io scheduler noop registered
[    0.790886] io scheduler deadline registered (default)
[    0.796880] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.804147] console [ttyS0] disabled
[    0.828083] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[    0.837190] console [ttyS0] enabled
[    0.844747] bootconsole [early0] disabled
[    0.857838] m25p80 spi0.0: found w25q128, expected m25p80
[    0.863515] m25p80 spi0.0: w25q128 (16384 Kbytes)
[    0.868410] 4 cmdlinepart partitions found on MTD device spi0.0
[    0.874534] Creating 4 MTD partitions on "spi0.0":
[    0.879488] 0x000000000000-0x000000010000 : "u-boot"
[    0.887074] 0x000000010000-0x000000020000 : "art"
[    0.893907] 0x000000020000-0x000000ff0000 : "firmware"
[    0.923726] 2 uimage-fw partitions found on MTD device firmware
[    0.929873] 0x000000020000-0x000000180000 : "kernel"
[    0.936627] 0x000000180000-0x000000ff0000 : "rootfs"
[    0.943711] mtd: device 4 (rootfs) set to be root filesystem
[    0.949613] 1 squashfs-split partitions found on MTD device rootfs
[    0.956084] 0x0000003a0000-0x000000ff0000 : "rootfs_data"
[    0.963704] 0x000000ff0000-0x000001000000 : "art-backup"
[    0.972256] libphy: Fixed MDIO Bus: probed
[    1.002169] libphy: ag71xx_mdio: probed
[    1.635372] ag71xx-mdio.1: Found an AR934X built-in switch
[    1.688780] eth0: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[    2.325767] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[    2.336042] eth1: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[    2.344058] NET: Registered protocol family 10
[    2.352549] NET: Registered protocol family 17
[    2.357427] 8021q: 802.1Q VLAN Support v1.8
[    2.369891] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[    2.379722] Freeing unused kernel memory: 300K
[    2.384357] This architecture does not have kernel memory protection.
[    2.552818] random: fast init done
[    2.970821] init: Console is alive
[    2.974729] init: - watchdog -
[    3.827672] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    3.876200] usbcore: registered new interface driver usbfs
[    3.881983] usbcore: registered new interface driver hub
[    3.887673] usbcore: registered new device driver usb
[    3.899468] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[    3.908204] ehci-platform: EHCI generic platform driver
[    3.913797] ehci-platform ehci-platform: EHCI Host Controller
[    3.919774] ehci-platform ehci-platform: new USB bus registered, assigned bus number 1
[    3.930122] ehci-platform ehci-platform: irq 3, io mem 0x1b000000
[    3.962845] ehci-platform ehci-platform: USB 2.0 started, EHCI 1.00
[    3.970327] hub 1-0:1.0: USB hub found
[    3.974666] hub 1-0:1.0: 1 port detected
[    3.982133] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[    3.990210] ohci-platform: OHCI generic platform driver
[    3.996615] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    4.006383] init: - preinit -
[    5.161244] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[    6.794245] eth0: link up (1000Mbps/Full duplex)
[    6.799065] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    8.534612] jffs2: notice: (371) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found.
[    8.553115] mount_root: switching to jffs2 overlay
[    8.592158] urandom-seed: Seeding with /etc/urandom.seed
[    8.717611] eth0: link down
[    8.737020] procd: - early -
[    8.740114] procd: - watchdog -
[    9.359073] procd: - watchdog -
[    9.362626] procd: - ubus -
[    9.434421] procd: - init -
[   10.275840] kmodloader: loading kernel modules from /etc/modules.d/*
[   10.304150] ip6_tables: (C) 2000-2006 Netfilter Core Team
[   10.324646] Loading modules backported from Linux version wt-2017-10-06-0-ga7a22fbbd1f0
[   10.333010] Backport generated by backports.git v4.14-rc2-1-6-gedfb595c
[   10.343416] ip_tables: (C) 2000-2006 Netfilter Core Team
[   10.358821] nf_conntrack version 0.5.0 (2048 buckets, 8192 max)
[   10.432690] xt_time: kernel timezone is -0000
[   10.508503] PPP generic driver version 2.4.2
[   10.515992] NET: Registered protocol family 24
[   10.571918] ath: EEPROM regdomain: 0x0
[   10.571930] ath: EEPROM indicates default country code should be used
[   10.571933] ath: doing EEPROM country->regdmn map search
[   10.571952] ath: country maps to regdmn code: 0x3a
[   10.571958] ath: Country alpha2 being used: US
[   10.571961] ath: Regpair used: 0x3a
[   10.583718] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[   10.591084] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=47
[   10.662144] kmodloader: done loading kernel modules from /etc/modules.d/*
[   17.438115] br-lan: port 1(eth0) entered blocking state
[   17.443617] br-lan: port 1(eth0) entered disabled state
[   17.449434] device eth0 entered promiscuous mode
[   17.497845] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   17.539784] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[   19.244273] eth0: link up (1000Mbps/Full duplex)
[   19.249120] br-lan: port 1(eth0) entered blocking state
[   19.254551] br-lan: port 1(eth0) entered forwarding state
[   19.262344] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
[   19.786317] eth1: link up (100Mbps/Full duplex)
[   19.791049] IPv6: ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready

I have replaced the default firmware-5.bin with the file provided by Comfast. I have uploaded board-2.bin (also provided by Comfast) and left the board.bin file which was there by default. Rebooting the unit and running iw list gives the following output:

root@LEDE:/lib/firmware/ath10k/QCA988X/hw2.0# iw list
Wiphy phy0
	max # scan SSIDs: 4
	max scan IEs length: 2257 bytes
	max # sched scan SSIDs: 0
	max # match sets: 0
	max # scan plans: 1
	max scan plan interval: -1
	max scan plan iterations: 0
	Retry short limit: 7
	Retry long limit: 4
	Coverage class: 0 (up to 0m)
	Device supports AP-side u-APSD.
	Device supports T-DLS.
	Available Antennas: TX 0x3 RX 0x3
	Configured Antennas: TX 0x3 RX 0x3
	Supported interface modes:
		 * IBSS
		 * managed
		 * AP
		 * AP/VLAN
		 * monitor
		 * mesh point
		 * P2P-client
		 * P2P-GO
		 * outside context of a BSS
	Band 1:
		Capabilities: 0x11ef
			RX LDPC
			HT20/HT40
			SM Power Save disabled
			RX HT20 SGI
			RX HT40 SGI
			TX STBC
			RX STBC 1-stream
			Max AMSDU length: 3839 bytes
			DSSS/CCK HT40
		Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
		Minimum RX AMPDU time spacing: 8 usec (0x06)
		HT TX/RX MCS rate indexes supported: 0-15
		Frequencies:
			* 2412 MHz [1] (26.0 dBm)
			* 2417 MHz [2] (26.0 dBm)
			* 2422 MHz [3] (26.0 dBm)
			* 2427 MHz [4] (26.0 dBm)
			* 2432 MHz [5] (26.0 dBm)
			* 2437 MHz [6] (26.0 dBm)
			* 2442 MHz [7] (26.0 dBm)
			* 2447 MHz [8] (26.0 dBm)
			* 2452 MHz [9] (26.0 dBm)
			* 2457 MHz [10] (26.0 dBm)
			* 2462 MHz [11] (26.0 dBm)
			* 2467 MHz [12] (disabled)
			* 2472 MHz [13] (disabled)
			* 2484 MHz [14] (disabled)
	valid interface combinations:
		 * #{ managed } <= 2048, #{ AP, mesh point } <= 8, #{ P2P-client, P2P-GO } <= 1, #{ IBSS } <= 1,
		   total <= 2048, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz }

	HT Capability overrides:
		 * MCS: ff ff ff ff ff ff ff ff ff ff
		 * maximum A-MSDU length
		 * supported channel width
		 * short GI for 40 MHz
		 * max A-MPDU length exponent
		 * min MPDU start spacing

When I boot the unit via TTL and watch the sequence, it shows that the SoC is "Qualcomm Atheros QCA9533" - no reference to the QCA9886 that it is supposed to have as well. I recorded my screen of the boot sequence (USB to TTL) - it can be found here: https://youtu.be/8bcTadh3-r0

I'm not seeing anything ath10k related. You do have the ath10k package installed right?

# opkg list-installed|grep ath10k
ath10k-firmware-qca988x - 2017-01-11-ab432c60-1
kmod-ath10k - 4.4.95+2017-01-31-3

Does grepping dmesg for ath10k give you anything? From a cursory look there doesn't seem to be anything ath10k related in your paste.

1 Like

@chrisgilpin : I am facing the same issue, did you get any solution ?

FYI - Support for CF-E355AC v2 added with https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=e07014e70bae07201844265d74f88234685e694c

@tmomas : I tried this already and i did it again, is it not working. But I executed the following commands and rebooted it works, I don't know how long it will run.

dd if=/dev/mtd6 of=/lib/firmware/ath10k/QCA9888/hw2.0/board.bin bs=1 skip=20480 count=12064
dd if=/dev/mtd6 of=/lib/firmware/ath10k/pre-cal-pci-0000:00:00.0.bin bs=1 skip=20480 count=12048

Hi, I am running latest trunk of lede and have noticed a few things.
The trunk compiles and works well on 2.4 and 5GHz by default but the mac address of the 5GHz is 12:34:56:78:90:12 by default. Any one noticecd this?
in Dmesg I got two problems

  1. that the file firmware-6.bin is missing so I took care of it by renaming the file firmeware-5.bin to firmware-6.bin and the error disappeared
  2. [ 0.664441] pci 0000:00:00.0: invalid calibration data
    [ 0.669896] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]

This invalid calibration data...

Can anyone please guide me to automatically detect correct mac address for this 5GHz?

Hi everyone.
I was looking into buying one of these.
Has anyone been able to use the 5GHz band?
Thanks for the help.