I would like to get the serial console to work with my EAP110-Outdoor (EU) Ver 1.1.
Does anyone know how to populate the missing parts of the board to get serial working?
C82
R25
R27
R28
R30
R212
Thanks in advance for any assistance.
I would start from shortening the resistors which are inline with the Tx/Rx pins - R27 and R28(?).
@AndrewZ Thanks for the tip. It worked... Below is the bootlog with original firmware:
64 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash: 8 MB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
Setting 0x181162c0 to 0x4081a100
Hit Ctrl+B to stop autoboot: 0
Loading .text @ 0x802469c0 (4784 bytes)
Loading .rodata.str1.4 @ 0x80247c70 (212 bytes)
Loading .data @ 0x80247d50 (779149 bytes)
Clearing .bss @ 0x803060e0 (4202512 bytes)
## Starting application at 0x802469c0 ...
Booting QCA953x
Linux version 2.6.31 (root@Sohoilinuxbuild) (gcc version 4.3.3 (GCC) ) #1 PREEMP
T Wed Nov 9 16:01:56 CST 2016
flash_size passed from bootloader = -1
CPU revision is: 00019374 (MIPS 24Kc)
ath_sys_frequency: cpu apb ddr apb cpu 650 ddr 390 ahb 216
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:04 rootfstype=squashfs init=/i
nit mtdparts=ath-nor0:128k(u-boot),64k(pation-table),64k(product-info),1536k(ker
nel),6144k(rootfs),192k(config),64k(ART) mem=64M
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 62492k/65536k available (1753k kernel code, 2972k reserved, 455k data, 1
12k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 432.12 BogoMIPS (lpj=864256)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 122
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
7 cmdlinepart partitions found on MTD device ath-nor0
Creating 7 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000030000 : "pation-table"
0x000000030000-0x000000040000 : "product-info"
0x000000040000-0x0000001c0000 : "kernel"
0x0000001c0000-0x0000007c0000 : "rootfs"
0x0000007c0000-0x0000007f0000 : "config"
0x0000007f0000-0x000000800000 : "ART"
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
athwdt_timer_init: Starting WDT.
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 112k freed
init started: BusyBox v1.01 (2016.05.23-08:15+0000) multi-call binary
This Board use 2.6.31
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (1024 buckets, 30720 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
---portal module open ok
Register vlan_manage hooks success.
(none) mips #1 PREEMPT Wed Nov 9 16:01:56 CST 2016 (none)
(none) login: [flow]opSysModInit 62: Begin opLanInit!
[spectrum_error: opSpectrumInit:68]Begin opSpectrum
[flow]opRegionInit 823: Begin
opRegionInit
[flow]opMacFilterExtInit 63: Begin opMacFilterExt
[flow]opSearchInit 222: Begin opSearchInit
[flow]opWScheduleInit 61: Begin opWScheduleInit
Monitor Thread pid(176), tid(5126) created.
opClusterInit
Product-info region code:0, name:.
Flash region info, code: 276, name: EU.
*************************$$$$$$$$$$$$$$EAP110-Outdoor(TP-LINK|UN|N300-2):1.0
key=BgIAAAAkAABSU0ExAAQAAAEAAQDZtUNzD6KsxO4Tfx/Sp8S7w8TwPWwoppXy77wSPNs5WoV+Wr4k
h09nu70vHVmSPji5KFUG+hmRjapsJsIJj+M0Zmd4EycKY8r0Ea3D4XO/uvloX4VHVPsDZkm8Krian5iN
y6BgApVlebx0zQxto0GkgvPBq1nhoZxJNapLghGO7w==
rsaKey=BgIAAACkAABSU0ExAAQAAAEAAQC33Ux/UTRSBo17Xm/eESv+2ZRoomAXfr1LIk2PbKmBLSldP
pfeCH/m4rhY4wLiXqAke7DiRZkK6xjdahNG3uzffdaRZaxTjzY/UqsWJaqlP08Q+p1tF8YfqqeEn3WqC
G6nVxmCvoIH8t3xTZQ8RgDNWdO7v1IBARwN/8ffyjr4uQ==
*************************country$
rsaKey=BgIAAACkAABSU0ExAAQAAAEAAQC33Ux/UTRSBo17Xm/eESv+2ZRoomAXfr1LIk2PbKmBLSldP
pfeCH/m4rhY4wLiXqAke7DiRZkK6xjdahNG3uzffdaRZaxTjzY/UqsWJaqlP08Q+p1tF8YfqqeEn3WqC
G6nVxmCvoIH8t3xTZQ8RgDNWdO7v1IBARwN/8ffyjr4uQ==
[cltCfg_JsonToData:260]: ~~~~~~~~
~~~~~~~~~~~~~~~~~rdCnt = 1~~~~~~~~~~~~~~~~
[cltCfg_JsonToData:266]: ~~~~~~~~~~~~~~~~~~~~~~~~~size = 1~~~~~~~~~~~~~~~~
[cltCfg_JsonToData:313]: ~~~~~~~~~~~~~~~~~~~~~~~~~index = 0~~~~~~~~~~~~~~~~
<debug>[_printClientData:402]: basicCfg.rdId = 0
<debug>[_printClientData:403]: basicCfg.bWirelessEnable = 1
<debug>[_printClientData:404]: basicCfg.Ssid = TP-LINK-RootAp
<debug>[_printClientData:405]: basicCfg.Bssid = 00:00:00:00:00:00
<debug>[_printClientData:406]: basicCfg.uWDS = 0
<debug>[_printClientData:407]: basicCfg.bDfsEnable = 0
<debug>[_printClientData:408]: basicCfg.lockToAp = 0
<debug>[_printClientData:409]: secCfg.bSecurityEnable = 0
<debug>[_printClientData:411]: secCfg.uAuthType = 0(0: None 1: WEP 2: WP
A 3: PSK)
Syslog disabled or log buffer not allocated
qca953x_GMAC: Length per segment 1536
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:0 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 0:bfff0000
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet : 1
qca953x_GMAC: Max tx descriptor count : 128
qca953x_GMAC: Max rx descriptor count : 128
qca953x_GMAC: Mac capability flags : 3581
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:1 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 1:bfff0006
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet : 1
qca953x_GMAC: Max tx descriptor count : 128
qca953x_GMAC: Max rx descriptor count : 128
qca953x_GMAC: Mac capability flags : 3D81
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
athr_gmac_ring_alloc Allocated 2048 at 0x83a69000
athr_gmac_ring_alloc Allocated 2048 at 0x83ae7800
HONEYBEE ----> S27 PHY MDIO
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
athr_gmac_ring_alloc Allocated 2048 at 0x83b32000
athr_gmac_ring_alloc Allocated 2048 at 0x83ae9800
HONEYBEE ----> S27 PHY MDIO
ATHRS27: resetting s27
ATHRS27: s27 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
Disable VlanManage, data.enable(0), data.vid(1)
[LAN][_lanLinkThread:449]lanLinkThread pid: 303
[LAN][initLanLinkThread:510]lanLi
nkThread tid: 9226
br_dhcp_filter: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
dhcp_filter: started sta0="ath7" sta1="".
command not supported
[flow]ucApCfg_init 364: wlan_init
***********CJ++ for mspi_read_id get id=0xef
************************* 0
Rsa verify success
ath_hal: 0.9.17.1 (AR5416, AR9380,
REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Right
s Reserved
ath_spectral: Version 2.0.0
Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved
SPECTRAL module built on Nov 9 2016 16:07:26
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserve
d
ath_ahb: 10.2-00082-4 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value wi
ll be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=512
Enterprise mode: 0x03fc0000
Restoring Cal data from Flash
4646, ar9300_eeprom_restore_from_flash, ant_ctrl_chain = 0x1000:0x1000:0x1000
4650, ar9300_eeprom_restore_from_flash, xatten1_margin = 0x9:0x9:0x9
4654, ar9300_eeprom_restore_from_flash, xatten1_db = 0x1f:0x1f:0x1f
SPECTRAL : get_capability not registered
HAL_CAP_PHYDIAG : Capable
SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
SPECTRAL : get_capability not registered
HAL_CAP_RADAR : Capable
SPECTRAL : Need to fix the capablity check for SPECTRAL
(spectral_attach : 236)
SPECTRAL : get_capability not registered
HAL_CAP_SPECTRAL_SCAN : Capable
SPECTRAL : get_tsf64 not registered
spectral_init_netlink 52 NULL SKB
SPECTRAL : No ADVANCED SPECTRAL SUPPORT
SPECTRAL :----- module attached
ath_get_caps[6180] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[6155] tx chainmask mismatch actual 3 sc_chainmak 0
ath_attach_dfs[12619] dfsdomain 1
SPECTRAL : module already attached
****************************************************
maclimit init
****************************************************
ATH_RESERVED_TXBUF = 1000
ath_tx_paprd_init sc 83bd8000 PAPRD disabled in HAL
wifi0: Atheros ???: mem=0xb8100000, irq=2
ath_pci: 10.2-00082-4 (Atheros/multi-bss)
[flow]wlanStartAllRadio 4608: here..
[flow]wlanCommonInit 2711: countryCode: 276
ath_attach_dfs[12619] dfsdomain 1
wlan_vap_create : enter. devhandle=0x824002c0, opmode=IEEE80211_M_HOSTAP, flags=
0x1
wlan_vap_create : exit. devhandle=0x824002c0, opmode=IEEE80211_M_HOSTAP, flags=0
x1.
VAP device ath0 created
ath0
ath_attach_dfs[12619] dfsdomain 2
DES SSID SET=test.freifunk.net
device ath0 entered promiscuous mode
br0: port 3(ath0) entering forwarding state
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
radio id error 1
raThread pid(176) tid(16400) created.
radio id error 1
radio id error 1
[cw_get_ssid_table:282]radio(1) is error
<radius>[debug]_radius_entryThread(): 553 -> Enter _radius_entryThreadCJ++ for
mspi_read_id get id=0xef
.!!!!!!!!!
<radius>[debug]_radius_init(): 525 -> Enter _radius_init.!!!!!!!!!
Rsa verify success
uclite init ok, now startup eap-cs ---------------------
httpMu
dCreate: MUD 0x684db0 was created
httpClusterRefreshInit
httpServerCreate---------
---------
httpServerCreate: try to add port 80
[WLAN_MONOTOR][ERR] no rx change
ACKTIMEOUT call ath_internal_reset begin
ACKTIMEOUT call ath_internal_reset end
wifi0 get_acktimeout:64
flashLogTread start----
[WLAN_MONOTOR][ERR] no rx change
ACKTIMEOUT call ath_internal_reset begin
ACKTIMEOUT call ath_internal_reset end
wifi0 get_acktimeout:64
EAP110 v1 using the same hardware with cpe210 v3, you can install official openwrt for cpe210v3 to eap110v1, but you must update the u-boot from cpe210v3.
@blinkstar88 Thanks for the info. I'm currently looking for the u-boot partition from a CPE210v3. I have asked a few friends (I'm not sure which version(s) they have).
To write a new u-boot, I would just have to start the origional u-boot, tftp the replacement u-boot, and write using mw, right? Or should I get out the soldering iron, spi-programmer, and write it that way?
I'll keep this forum posted as to how things are going.
Here's u-boot cpe210v3 u-boot-cp210v3
you can update through uart console.
Use hex editor to change the mac address with your mac, mac adress offset start at 0x30000.
To stop u-boot use ctrl-B at command prompt type following command
- tftpboot 0x80060000 u-boot210v3.bin
- erase 0x9f000000 +0x40000
- cp.b 0x80060000 0x9f000000 0x40000
- reset
after u-boot was updated, type "tp" to stop u-boot and tftp openwrt initrams or use standard recovery from tp-link.
Success!
Here is a recap of all the steps I needed to do:
- open up the case. This involves removing the nuts from the antenne connectors and carefully removing the rubber rings. Additionally, there are two screws under the sticker on the back of the router. Now the plastic cover slides easily off. If you find yourself forcing the platic cover off, check again that all the nuts and screws are removed.
- remove the heat-sink. It is held down by 3 screws. One of the screws is under the rf-shield. The rf schield slides off easily with a screwdriver.
- solder together both contacts of R27 and both contacts of R28. Additionally, solder pins onto the serial port.
- reattach the heat sink and rf-shield.
- download the u-boot-210v3.bin linked by @blinkstar88 in the previous post (https://drive.google.com/file/d/1JYi4vXrMl3hXpLs1tvhaik1yXTuYM4ga/view?usp=sharing)
- hexedit the mac address at offset 0x30000, replacing D8 0D 17 26 C6 5C with the mac address printed on the device
- set up the tftp server on your computer and copy the edited u-boot-210v3.bin to the tftp server's directory
- download openwrt's factory firmware for the CPE210v3 and save it to the tftp server's directoy under the name recovery.bin
- connect a USB-serial adapter to the router. The pins starting from the side of ethernet port are VCC (don't use), GND, RX, TX. The connection should be made at 115200 8N1.
- power on the router and be prepared to hit Ctrl-B to stop u-boot from booting the firmware.
- set the tftp-server's ip address to 192.168.1.10/24
- execute the commands posted by @blinkstar88 in Firmware support Tp-link EAP110-Outdoor
- tftpboot 0x80060000 u-boot-210v3.bin
- erase 0x9f000000 +0x40000
- cp.b 0x80060000 0x9f000000 0x40000
- reset
- set the tftp-server's ip address to 192.168.1.100/24. (tip, put a switch between the tftp-server and the EAP110v1.
- disconnect power to the router, hold in the reset button, give power again to the router. You can watch the progress on the serial connection.
Thanks again for all the support.
5 Likes
Hello kcstonacek,
Can you put me in the right direcction for install openwrt in EAP110 Outdoor v3?
I can help for do that.
Thanks a lot
I am also interested in getting openwrt working on EAP110 Outdoor v3. I have several of these, have opened one of them, and now have serial/console access ... I have not attempted to build and deploy from source. I am happy to be a tester on my hardware if someone can create a firmware or create/provide the necessary instructions I can use to do it.
Thanks.
I actually tried to make a port of what @kcstonacek did for EAP110-Outdoor-v3 as he posted the changed stuff here to ath79 / dts targets.
my changes are in my fork of the openwrt repo: https://github.com/bjdag1234/openwrt-eap110-o-v3
the only thing I can't get to work is the LAN port which seems to need the AR8229 switch to be initialized somewhat. in the following dmesg, when the eth ports are initialized in u-boot it does work:
Setting 0x181162c0 to 0x50a1a100
Hit Ctrl+B to stop autoboot: 0
Net: ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
Honey Bee ----> MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
[ 0.686997] 0x0000007f0000-0x000000800000 : "art"
[ 0.695679] libphy: Fixed MDIO Bus: probed
[ 1.019878] libphy: ag71xx_mdio: probed
[ 1.025520] libphy: ar8xxx-mdio: probed
[ 1.093664] switch0: Atheros AR8229 rev. 1 switch registered on mdio.0
[ 1.130822] random: fast init done
[ 1.457559] ag71xx 19000000.eth: connected to PHY at mdio.0:1f:04 [uid=004dd042, driver=Generic PHY]
[ 1.467876] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[ 1.474406] i2c /dev entries driver
[ 1.480566] NET: Registered protocol family 10
yet when the openwrt image is just booted directly w/o the u-boot initializing the eth ports
0.687122] 0x0000007f0000-0x000000800000 : "art"
[ 0.695810] libphy: Fixed MDIO Bus: probed
[ 1.020037] libphy: ag71xx_mdio: probed
[ 1.127559] random: fast init done
[ 1.340663] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[ 1.348781] i2c /dev entries driver
[ 1.354856] NET: Registered protocol family 10
[ 1.364621] Segment Routing with IPv6
[ 1.368646] NET: Registered protocol family 17
[ 1.373371] 8021q: 802.1Q VLAN Support v1.8
[ 1.692660] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[ 2.016647] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
If anyone has ideas what to change somewhere or what to put in the DTS to make it work, it will be greatly appreciated.
The EAP245v1 (and related devices) had similar issues. Maybe you can try some of the fixes introduced for those access points? Note that the hardware for these devices isn't the same, but TP-Link may have used the same or similar code.
thanks for pointing this out, i'll see if it will work sometime soon.
I've stopped testing for a while due to health reasons and work eating up my time.
actually I also based much of the changes I do on the higher models (EAP2x5) since it looks more similar to them than the older CPEs but as blinkstar88 mentioned above, it seems that the EAP110-Outdoor-v3 uses the same hardware as CPE210v3, might as well try that out.
Hello bjdag1234,
I newbee porting OpenWrt, but How can I help to obtain a working OpenWrt on EAP110 Outdoor?
Can you point me in the right direction?
Thanks a lot.
Is it possible to enable channels 12 and 13 with maximum transmit power (usually only enabled in US version) via access to serial console for EAP 110 outdoor v3? There are countries like Slovenia where it is allowed to use channels 1-13 with up to 1000 mW / 30 dBm transmit power.
Did anyone try if there is a hidden recovery mode like with CPE210 or WR802nd? In this mode firmware image is downloaded from an TFTP-Server, so OpenWRT Firmware could be placed there and no need anymore to open device and solder.
I've tried. No arp requests when pressing reset button, powering on device and holding it at least for 10 seconds. WR802nd shows ARP requests for resolving 192.168.0.66. So sadly no option to flash via TFTP.
Greetings to all, I tried with this method but after installing Openwrt or Gargoyle the output power of the device does not exceed 8dbm, what am I doing wrong? can this be repaired ??
[image]
Do you have right eeprom for your board? Or you dumped fullflash from another device on it? What exactly method you used to put Openwrt on this particular device?
Copie un fullflash CPE210v3, saludos