What should I do?
I opened up the EAP-110 outdoor V3 - it's much more compact than the V1 but the specifications are very similar. It easily opens by removing the threaded nut on the antennas
The 115200 baud serial console works fine (pins on the picture below), and can get root with root/admin (via serial console only). From the TP-Link GPL code, it seems dropbear maps all SSH logins to 'guest' user in svr-auth.c, so can not login with root remotely.
I have not found a way to trigger a fail-safe tftpboot like other tp-link devices, but tftpboot does work from the u-boot command line after a ctrl-b.
I can load an openwrt kernel using elf loader-kernel, and the appropriate cmdlinepart (no tplink header, much like CPE210 v2). However it still needs wireless driver working and GPIO LEDs to be functional.
ath> tftpboot 0x80060000 sysupgrade.bin
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'sysupgrade.bin'.
Load address: 0x80060000
Loading: #################################################################
...
done
Bytes transferred = 7803543 (771297 hex)
ath> erase 0x9f040000 +0x771297
Erasing flash...
First 0x4 last 0x7b sector size 0x10000
123
Erased 120 sectors
ath> cp.b 0x80060000 0x9f040000 0x771297
Copy to Flash... write addr: 9f040000
done
ath> bootelf 0x9f040000
Loading .text @ 0x80060000 (1477575 bytes)
## Starting application at 0x80060000 ...
OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80060000...
[ 0.000000] Linux version 4.14.81 (stonacek@ks-VirtualBox) (gcc version 7.3.0 (OpenWrt GCC 7.3.0 r8466-251c350727)) #0 Fri Nov 16 12:43:33 2018
[ 0.000000] bootconsole [early0] enabled
[ 0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[ 0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[ 0.000000] Determined physical RAM map:
[ 0.000000] memory: 04000000 @ 00000000 (usable)
[ 0.000000] Initrd not found or empty - disabling initrd
[ 0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[ 0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[ 0.000000] Zone ranges:
[ 0.000000] Normal [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[ 0.000000] random: get_random_bytes called from start_kernel+0x8c/0x474 with crng_init=0
[ 0.000000] Built 1 zonelists, mobility grouping on. Total pages: 16256
[ 0.000000] Kernel command line: board=EAP110-OUTDOOR-V3 mtdparts=spi0.0:128k(u-boot)ro,64k(partition-table)ro,64k(product-info)ro,1536k(kernel),6144k(rootfs),1
92k(config),64k(ART)ro,7680k@0x40000(firmware) console=ttyS0,115200 rootfstype=squashfs noinitrd
[ 0.000000] PID hash table entries: 256 (order: -2, 1024 bytes)
[ 0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
[ 0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
[ 0.000000] Writing ErrCtl register=00000000
[ 0.000000] Readback ErrCtl register=00000000
[ 0.000000] Memory: 59652K/65536K available (3338K kernel code, 177K rwdata, 832K rodata, 316K init, 201K bss, 5884K reserved, 0K cma-reserved)
[ 0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.000000] NR_IRQS: 51
[ 0.000000] Clocks: CPU:650.000MHz, DDR:392.016MHz, AHB:216.666MHz, Ref:25.000MHz
[ 0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[ 0.000009] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[ 0.008263] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[ 0.074883] pid_max: default: 32768 minimum: 301
[ 0.079997] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.086976] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.097109] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.107554] futex hash table entries: 256 (order: -1, 3072 bytes)
[ 0.114614] NET: Registered protocol family 16
[ 0.121056] MIPS: machine is TP-LINK EAP110-OUTDOOR-V3
[ 0.620085] clocksource: Switched to clocksource MIPS
[ 0.626636] NET: Registered protocol family 2
[ 0.632199] TCP established hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.639564] TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
[ 0.646352] TCP: Hash tables configured (established 1024 bind 1024)
[ 0.653264] UDP hash table entries: 256 (order: 0, 4096 bytes)
[ 0.659451] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[ 0.666485] NET: Registered protocol family 1
[ 0.677121] Crashlog allocated RAM at address 0x3f00000
[ 0.684460] workingset: timestamp_bits=30 max_order=14 bucket_order=0
[ 0.696986] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 0.703202] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[ 0.725495] io scheduler noop registered
[ 0.729635] io scheduler deadline registered (default)
[ 0.735466] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[ 0.742665] console [ttyS0] disabled
[ 0.766606] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11, base_baud = 1562500) is a 16550A
[ 0.775724] console [ttyS0] enabled
[ 0.775724] console [ttyS0] enabled
[ 0.783287] bootconsole [early0] disabled
[ 0.783287] bootconsole [early0] disabled
[ 0.797026] m25p80 spi0.0: found s25fl064k, expected m25p80
[ 0.812309] m25p80 spi0.0: s25fl064k (8192 Kbytes)
[ 0.817330] 8 cmdlinepart partitions found on MTD device spi0.0
[ 0.823481] Creating 8 MTD partitions on "spi0.0":
[ 0.828436] 0x000000000000-0x000000020000 : "u-boot"
[ 0.835645] 0x000000020000-0x000000030000 : "partition-table"
[ 0.843417] 0x000000030000-0x000000040000 : "product-info"
[ 0.851686] 0x000000040000-0x0000001c0000 : "kernel"
[ 0.858530] 0x0000001c0000-0x0000007c0000 : "rootfs"
[ 0.864677] mtd: device 4 (rootfs) set to be root filesystem
[ 0.870660] 1 squashfs-split partitions found on MTD device rootfs
[ 0.877055] 0x000000350000-0x0000007c0000 : "rootfs_data"
[ 0.885790] 0x0000007c0000-0x0000007f0000 : "config"
[ 0.892741] 0x0000007f0000-0x000000800000 : "ART"
S 0.900207] 0x000000040000-0x0000007c0000 : "firmware"
[ 0.908379] libphy: Fixed MDIO Bus: probed
[ 0.941565] libphy: ag71xx_mdio: probed
[ 1.573159] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[ 1.583310] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[ 2.212669] ag71xx-mdio.1: Found an AR934X built-in switch
[ 2.266016] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
[ 2.273387] NET: Registered protocol family 17
[ 2.280515] 8021q: 802.1Q VLAN Support v1.8
[ 2.293120] VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
[ 2.303119] Freeing unused kernel memory: 316K
[ 2.307710] This architecture does not have kernel memory protection.
[ 2.540100] random: fast init done
[ 2.965074] init: Console is alive
[ 2.968876] init: - watchdog -
[ 3.574125] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[ 3.659719] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[ 3.678035] init: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[ 6.493685] eth0: link up (100Mbps/Full duplex)
[ 7.736143] mount_root: jffs2 not ready yet, using temporary tmpfs overlay
[ 7.769577] urandom-seed: Seed file not found (/etc/urandom.seed)
[ 7.873531] eth0: link down
[ 7.890055] procd: - early -
[ 7.894152] procd: - watchdog -
[ 8.507235] procd: - watchdog -
[ 8.510899] procd: - ubus -
[ 8.546659] random: ubusd: uninitialized urandom read (4 bytes read)
[ 8.565056] random: ubusd: uninitialized urandom read (4 bytes read)
[ 8.572929] random: ubusd: uninitialized urandom read (4 bytes read)
[ 8.580786] procd: - init -
Please press Enter to activate this console.
[ 8.865318] kmodloader: loading kernel modules from /etc/modules.d/*
[ 8.881821] nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
[ 8.960267] xt_time: kernel timezone is -0000
[ 8.967478] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 8.985884] PPP generic driver version 2.4.2
[ 8.993591] NET: Registered protocol family 24
[ 9.003297] kmodloader: done loading kernel modules from /etc/modules.d/*
[ 10.264165] urandom_read: 5 callbacks suppressed
[ 10.264175] random: jshn: uninitialized urandom read (4 bytes read)
[ 10.390856] random: jshn: uninitialized urandom read (4 bytes read)
[ 15.492691] jffs2_scan_eraseblock(): End of filesystem marker found at 0x0
[ 15.499824] jffs2_build_filesystem(): unlocking the mtd device...
[ 15.511162] done.
[ 15.519548] jffs2_build_filesystem(): erasing all blocks after the end marker...
[ 18.745774] br-lan: port 1(eth0) entered blocking state
[ 18.758996] br-lan: port 1(eth0) entered disabled state
[ 18.764741] device eth0 entered promiscuous mode
[ 21.853733] eth0: link up (100Mbps/Full duplex)
[ 21.858482] br-lan: port 1(eth0) entered blocking state
[ 21.863946] br-lan: port 1(eth0) entered forwarding state
[ 31.136297] done.
[ 31.138346] jffs2: notice: (809) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orp
han) found.
[ 31.285202] overlayfs: upper fs does not support tmpfile.
BusyBox v1.29.3 () built-in shell (ash)
_______ ________ __
| |.-----.-----.-----.| | | |.----.| |_
| - || _ | -__| || | | || _|| _|
|_______|| __|_____|__|__||________||__| |____|
|__| W I R E L E S S F R E E D O M
-----------------------------------------------------
OpenWrt SNAPSHOT, r8466-251c350727
-----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#
U-Boot details
U-Boot 1.1.4--LSDK-10.2-00082-4 (Aug 23 2017 - 18:13:40)
board953x - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x6, 0x3a)
Tap values = (0x20, 0x20, 0x20, 0x20)
64 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash: 8 MB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
Setting 0x181162c0 to 0x50a1a100
Hit Ctrl+B to stop autoboot: 0
Net: ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
Honey Bee ----> MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
ath> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),2240k(rootfs),14)
bootcmd=bootelf 0x9f040000
bootdelay=2
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
ipaddr=192.168.1.1
serverip=192.168.1.10
dir=
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}board953x${bc}-jffs2&&erase 0x9f050000 +0x630000&&cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize&&cp.b $fileaddr 0x9f680000 $filesize
stdin=serial
stdout=serial
stderr=serial
ethact=eth0
Environment size: 689/65532 bytes
Device Info from factory OS:
$ cat /proc/cmdline
console=ttyS0,115200 root=31:04 rootfstype=squashfs init=/init mtdparts=ath-nor0:128k(u-boot),64k(pation-table),64k(product-info),1536k(kernel),6144k(rootfs),192k(config),64k(ART) mem=64M
$ cat /proc/cpuinfo
system type : QCA953x
processor : 0
cpu model : MIPS 24Kc V7.4
BogoMIPS : 432.12
wait instruction : yes
microsecond timers : yes
tlb_entries : 16
extra interrupt vector : yes
hardware watchpoint : yes, count: 4, address/irw mask: [0x0004, 0x0b18, 0x0ef0, 0x0ff8]
ASEs implemented : mips16
shadow register sets : 1
core : 0
VCED exceptions : not available
VCEI exceptions : not available
$ cat /proc/meminfo
MemTotal: 62676 kB
MemFree: 20452 kB
Buffers: 3996 kB
Cached: 15004 kB
SwapCached: 0 kB
Active: 13496 kB
Inactive: 15728 kB
Active(anon): 10224 kB
Inactive(anon): 0 kB
Active(file): 3272 kB
Inactive(file): 15728 kB
Unevictable: 0 kB
Mlocked: 0 kB
SwapTotal: 0 kB
SwapFree: 0 kB
Dirty: 0 kB
Writeback: 0 kB
AnonPages: 10244 kB
Mapped: 3760 kB
Slab: 9656 kB
SReclaimable: 536 kB
SUnreclaim: 9120 kB
PageTables: 268 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
WritebackTmp: 0 kB
CommitLimit: 31336 kB
Committed_AS: 29452 kB
VmallocTotal: 1048404 kB
VmallocUsed: 2760 kB
VmallocChunk: 1036404 kB
$ cat /proc/devices
Character devices:
1 mem
4 ttyS
5 /dev/tty
5 /dev/console
5 /dev/ptmx
10 misc
77 ATH_GPIOC
90 mtd
108 ppp
128 ptm
136 pts
238 ar7100_gpio_chrdev
239 ar7240_flash_chrdev
251 tp_domain
Block devices:
259 blkext
31 mtdblock
$ cat /proc/mtd
dev: size erasesize name
mtd0: 00020000 00010000 "u-boot"
mtd1: 00010000 00010000 "pation-table"
mtd2: 00010000 00010000 "product-info"
mtd3: 00180000 00010000 "kernel"
mtd4: 00600000 00010000 "rootfs"
mtd5: 00030000 00010000 "config"
mtd6: 00010000 00010000 "ART"
$ ifconfig -a
ath0 Link encap:Ethernet HWaddr AC:84:C6:23:XX:YY
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:2872 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
br0 Link encap:Ethernet HWaddr AC:84:C6:23:XX:YY
inet addr:192.168.1.100 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4810 errors:0 dropped:0 overruns:0 frame:0
TX packets:2199 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1265016 (1.2 MiB) TX bytes:1877660 (1.7 MiB)
eth0 Link encap:Ethernet HWaddr AC:84:C6:23:XX:YY
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
eth1 Link encap:Ethernet HWaddr AC:84:C6:23:XX:YY
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4880 errors:0 dropped:70 overruns:0 frame:0
TX packets:2024 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1356076 (1.2 MiB) TX bytes:1767180 (1.6 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:30680 errors:0 dropped:0 overruns:0 frame:0
TX packets:30680 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2186322 (2.0 MiB) TX bytes:2186322 (2.0 MiB)
wifi0 Link encap:UNSPEC HWaddr AC-84-C6-23-6B-01-XX-YY-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:26881 errors:0 dropped:0 overruns:0 frame:0
TX packets:27174 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:5368097 (5.1 MiB) TX bytes:6495 (6.3 KiB)
Interrupt:2 Memory:b8100000-b811ffff
$ dmesg
ch node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
On node 0 totalpages: 16384
free_area_init_node: node 0, pgdat 80228b50, node_mem_map 81000000
Normal zone: 128 pages used for memmap
Normal zone: 0 pages reserved
Normal zone: 16256 pages, LIFO batch:3
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:04 rootfstype=squashfs init=/init mtdparts=ath-nor0:128k(u-boot),64k(pation-table),64k(product-info),1536k(kernel),6144k(rootfs),192k(config),64k(ART) mem=64M
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 62492k/65536k available (1753k kernel code, 2972k reserved, 456k data, 112k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 432.12 BogoMIPS (lpj=864256)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switched to high resolution mode on CPU 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 122
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
7 cmdlinepart partitions found on MTD device ath-nor0
Creating 7 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000030000 : "pation-table"
0x000000030000-0x000000040000 : "product-info"
0x000000040000-0x0000001c0000 : "kernel"
0x0000001c0000-0x0000007c0000 : "rootfs"
0x0000007c0000-0x0000007f0000 : "config"
0x0000007f0000-0x000000800000 : "ART"
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
athwdt_timer_init: Starting WDT.
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 112k freed
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (1024 buckets, 30720 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
---portal module open ok
Register vlan_manage hooks success.
qca953x_GMAC: Length per segment 1536
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:0 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 0:bfff0000
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet : 1
qca953x_GMAC: Max tx descriptor count : 128
qca953x_GMAC: Max rx descriptor count : 128
qca953x_GMAC: Mac capability flags : 3581
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:1 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 1:bfff0006
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet : 1
qca953x_GMAC: Max tx descriptor count : 128
qca953x_GMAC: Max rx descriptor count : 128
qca953x_GMAC: Mac capability flags : 3D81
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
athr_gmac_ring_alloc Allocated 2048 at 0x83a92000
athr_gmac_ring_alloc Allocated 2048 at 0x83b0b800
HONEYBEE ----> S27 PHY MDIO
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
athr_gmac_ring_alloc Allocated 2048 at 0x83b57000
athr_gmac_ring_alloc Allocated 2048 at 0x83b0a800
HONEYBEE ----> S27 PHY MDIO
ATHRS27: resetting s27
ATHRS27: s27 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
Disable VlanManage, data.enable(0), data.vid(1)
br_dhcp_filter: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
dhcp_filter: started sta0="ath7" sta1="".
command not supported
CJ++ for mspi_read_id get id=0xef
ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_spectral: Version 2.0.0
Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved
SPECTRAL module built on Nov 9 2016 16:07:26
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_ahb: 10.2-00082-4 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=512
Enterprise mode: 0x03fc0000
Restoring Cal data from Flash
SPECTRAL : get_capability not registered
HAL_CAP_PHYDIAG : Capable
SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
SPECTRAL : get_capability not registered
HAL_CAP_RADAR : Capable
SPECTRAL : Need to fix the capablity check for SPECTRAL
(spectral_attach : 236)
SPECTRAL : get_capability not registered
HAL_CAP_SPECTRAL_SCAN : Capable
SPECTRAL : get_tsf64 not registered
spectral_init_netlink 52 NULL SKB
SPECTRAL : No ADVANCED SPECTRAL SUPPORT
SPECTRAL :----- module attached
ath_get_caps[6180] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[6155] tx chainmask mismatch actual 3 sc_chainmak 0
ath_attach_dfs[12619] dfsdomain 1
SPECTRAL : module already attached
****************************************************
maclimit init
****************************************************
ATH_RESERVED_TXBUF = 1000
ath_tx_paprd_init sc 82600000 PAPRD disabled in HAL
wifi0: Atheros ???: mem=0xb8100000, irq=2
ath_pci: 10.2-00082-4 (Atheros/multi-bss)
ath_attach_dfs[12619] dfsdomain 1
wlan_vap_create : enter. devhandle=0x825602c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
wlan_vap_create : exit. devhandle=0x825602c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
VAP device ath0 created
ath_attach_dfs[12619] dfsdomain 1
DES SSID SET=TP-Link_2.4GHz_236B01
device ath0 entered promiscuous mode
br0: port 3(ath0) entering forwarding state
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
CJ++ for mspi_read_id get id=0xef
enet1 port4 up 100Mbps Full duplex
953x_GMAC: Enet Unit:1 PHY:4 is UP eth1 RGMII 1000Mbps full duplex
953x_GMAC: done cfg2 0x7215 ifctl 0x0 miictrl
Setting Drop CRC Errors, Pause Frames and Length Error frames
br0: port 2(eth1) entering forwarding state
I still get a blank screen with config cable gnd-gnd rx-tx tx-rx baudrate 115200, but it can still be accessed via the web, maybe it should be done with spi flash programmer
Don't know what to suggest other than triple check your RS232 and PINs (i.e. make sure the serial rx isn't connected to the EAP110's VCC). I don't have the V1 hardware so I can't confirm the pins. But I can say the serial interface works as expected on V2. The dmesg earlier in this thread shows 115200 is the correct baud rate for the eap110 V1.
Vcc and Gnd I Check with multimeter, RX TX I have tried change each pin
Most likely both of ttl devices are damaged, when the first time I connected the VCC pin on the Eap110 to VCC ttl device
I have to walk away from this for a while and attend to other projects. I didn't quite get the time to make ATH and MII interfaces working properly. The MII assignment stops working after restarting openwrt. The only way to get ethernet interfaces back is to jump into uboot and boot from there. It seems there is some form of switch init that uboot can trigger that isn't incorported into openwrt.
from uboot bootelf with MII identification
[ 0.908379] libphy: Fixed MDIO Bus: probed
[ 0.941565] libphy: ag71xx_mdio: probed
[ 1.573159] ag71xx ag71xx.0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[ 1.583310] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode:MII
[ 2.212669] ag71xx-mdio.1: Found an AR934X built-in switch
[ 2.266016] eth1: Atheros AG71xx at 0xba000000, irq 5, mode:GMII
boot without MII identification
[ 1.651319] ag71xx ag71xx.0: no PHY found with phy_mask=00000010
[ 2.180021] random: fast init done
[ 2.302147] ag71xx-mdio.1: unknown phy id 'ffff:ffff'
Here is the git diff of the changes I've made so far if someone else wants to make an attempt
index 7f209fbcac..985001b073 100755
--- a/target/linux/ar71xx/base-files/etc/board.d/02_network
+++ b/target/linux/ar71xx/base-files/etc/board.d/02_network
@@ -77,6 +77,7 @@ ar71xx_setup_interfaces()
cf-e380ac-v2|\
cpe210-v2|\
dr342|\
+ eap110-outdoor-v3|\
eap120|\
eap300v2|\
eap7660d|\
diff --git a/target/linux/ar71xx/base-files/etc/diag.sh b/target/linux/ar71xx/base-files/etc/diag.sh
index 3c9f17d8c3..a21e363397 100644
--- a/target/linux/ar71xx/base-files/etc/diag.sh
+++ b/target/linux/ar71xx/base-files/etc/diag.sh
@@ -98,6 +98,7 @@ get_status_led() {
tl-wr802n-v1|\
tl-wr810n|\
tl-wr810n-v2|\
+ eap110-outdoor-v3|\
tl-wr940n-v4|\
tl-wr941nd-v6)
status_led="tp-link:blue:system"
diff --git a/target/linux/ar71xx/base-files/lib/ar71xx.sh b/target/linux/ar71xx/base-files/lib/ar71xx.sh
index b11d2cf926..6e8218d8a6 100755
--- a/target/linux/ar71xx/base-files/lib/ar71xx.sh
+++ b/target/linux/ar71xx/base-files/lib/ar71xx.sh
@@ -700,6 +700,10 @@ ar71xx_board_detect() {
*"E750G v8")
name="e750g-v8"
;;
+ *"EAP110-Outdoor V3")
+ name="eap110-outdoor-v3"
+ tplink_pharos_board_detect "$(tplink_pharos_v2_get_model_string)"
+ ;;
*"EAP120")
name="eap120"
tplink_pharos_board_detect "$(tplink_pharos_get_model_string | tr -d '\r')"
diff --git a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
index 21ad3075bd..4af5718972 100755
--- a/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ar71xx/base-files/lib/upgrade/platform.sh
@@ -607,6 +607,12 @@ platform_check_image() {
;;
esac
;;
+ eap110-outdoor-v3)
+ local modelstr="$(tplink_pharos_v2_get_model_string)"
+ tplink_pharos_board_detect $modelstr
+ tplink_pharos_check_image "$1" "7f454c46" "$modelstr" '\0\xff\r' && return 0
+ return 1
+ ;;
a40|\
a60|\
mr1750|\
diff --git a/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt b/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
index a5a8452e6d..8b5e9e8555 100644
--- a/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
+++ b/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
@@ -897,6 +897,15 @@ config ATH79_MACH_GL_USB150
select ATH79_DEV_M25P80
select ATH79_DEV_WMAC
+config ATH79_MACH_EAP110_OUTDOOR_V3
+ bool "TP-LINK EAP110-Outdoor V3 support"
+ select SOC_QCA953X
+ select ATH79_DEV_ETH
+ select ATH79_DEV_GPIO_BUTTONS
+ select ATH79_DEV_LEDS_GPIO
+ select ATH79_DEV_M25P80
+ select ATH79_DEV_WMAC
+
config ATH79_MACH_EAP120
bool "TP-LINK EAP120 support"
select SOC_AR934X
diff --git a/target/linux/ar71xx/files/arch/mips/ath79/Makefile b/target/linux/ar71xx/files/arch/mips/ath79/Makefile
index 0265b3d818..5c8231ebb1 100644
--- a/target/linux/ar71xx/files/arch/mips/ath79/Makefile
+++ b/target/linux/ar71xx/files/arch/mips/ath79/Makefile
@@ -116,6 +116,7 @@ obj-$(CONFIG_ATH79_MACH_E558_V2) += mach-e558-v2.o
obj-$(CONFIG_ATH79_MACH_E600G_V2) += mach-e600g-v2.o
obj-$(CONFIG_ATH79_MACH_E750A_V4) += mach-e750a-v4.o
obj-$(CONFIG_ATH79_MACH_E750G_V8) += mach-e750g-v8.o
+obj-$(CONFIG_ATH79_MACH_EAP110_OUTDOOR_V3) += mach-eap110.o
obj-$(CONFIG_ATH79_MACH_EAP120) += mach-eap120.o
obj-$(CONFIG_ATH79_MACH_EAP300V2) += mach-eap300v2.o
obj-$(CONFIG_ATH79_MACH_EAP7660D) += mach-eap7660d.o
diff --git a/target/linux/ar71xx/files/arch/mips/ath79/mach-eap110.c b/target/linux/ar71xx/files/arch/mips/ath79/mach-eap110.c
new file mode 100644
index 0000000000..d4d5745d40
--- /dev/null
+++ b/target/linux/ar71xx/files/arch/mips/ath79/mach-eap110.c
@@ -0,0 +1,124 @@
+/*
+ * TP-LINK EAP110-OUTDOOR-V3 board support
+ *
+ * Copyright (c) 2012 Qualcomm Atheros
+ * Copyright (c) 2012 Gabor Juhos <juhosg@openwrt.org>
+ * Copyright (c) 2016 Jens Steinhauser <jens.steinhauser@gmail.com>
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/gpio.h>
+#include <linux/platform_device.h>
+#include <linux/ar8216_platform.h>
+
+#include <asm/mach-ath79/ar71xx_regs.h>
+
+#include "common.h"
+#include "dev-gpio-buttons.h"
+#include "dev-eth.h"
+#include "dev-leds-gpio.h"
+#include "dev-m25p80.h"
+#include "dev-wmac.h"
+#include "machtypes.h"
+
+#define EAP110_GPIO_BTN_RESET 17
+#define EAP110_GPIO_LED_SYSTEM 18
+
+#define EAP110_KEYS_POLL_INTERVAL 20 /* msecs */
+#define EAP110_KEYS_DEBOUNCE_INTERVAL (3 * EAP110_KEYS_POLL_INTERVAL)
+
+#define EAP110_WMAC_CALDATA_OFFSET 0x1000
+
+/*
+static const char *eap110_outdoor_v3_part_probes[] = {
+ "tp-link",
+ NULL,
+};
+
+static struct flash_platform_data eap110_outdoor_v3_flash_data = {
+ .part_probes = eap110_outdoor_v3_part_probes,
+};*/
+
+static struct gpio_led eap110_outdoor_v3_leds_gpio[] __initdata = {
+ {
+ .name = "tp-link:blue:system",
+ .gpio = EAP110_GPIO_LED_SYSTEM,
+ .active_low = 1,
+ },
+};
+
+static struct gpio_keys_button eap110_outdoor_v3_gpio_keys[] __initdata = {
+ {
+ .desc = "reset",
+ .type = EV_KEY,
+ .code = KEY_RESTART,
+ .debounce_interval = EAP110_KEYS_DEBOUNCE_INTERVAL,
+ .gpio = EAP110_GPIO_BTN_RESET,
+ .active_low = 1,
+ },
+};
+
+static void __init tl_ap143_setup(int lan_mac_offset)
+{
+ //u8 *mac = (u8 *) KSEG1ADDR(0x1f01fc00);
+ u8 *mac = (u8 *) KSEG1ADDR(0x1f830008);
+ //u8 *art = (u8 *) KSEG1ADDR(0x1fff0000);
+ u8 *art = (u8 *) KSEG1ADDR(0x1fff1000);
+
+
+
+ ath79_register_m25p80(NULL);
+ //ath79_register_m25p80(&eap110_outdoor_v3_flash_data);
+
+ ath79_setup_ar933x_phy4_switch(false, false);
+
+ ath79_register_mdio(0, 0x0);
+
+ /* LAN */
+ ath79_eth0_data.phy_if_mode = PHY_INTERFACE_MODE_MII;
+ ath79_eth0_data.duplex = DUPLEX_FULL;
+ ath79_eth0_data.speed = SPEED_100;
+ ath79_eth0_data.phy_mask = BIT(4);
+ ath79_init_mac(ath79_eth0_data.mac_addr, mac, 1);
+ ath79_register_eth(0);
+
+ /* LAN */
+ ath79_switch_data.phy4_mii_en = 1;
+ ath79_eth1_data.phy_if_mode = PHY_INTERFACE_MODE_GMII;
+ ath79_eth1_data.duplex = DUPLEX_FULL;
+ ath79_eth1_data.speed = SPEED_100;
+ ath79_switch_data.phy_poll_mask |= BIT(4);
+ ath79_init_mac(ath79_eth1_data.mac_addr, mac, lan_mac_offset);
+ ath79_register_eth(1);
+
+ ath79_register_wmac(art + EAP110_WMAC_CALDATA_OFFSET, mac);
+
+ ath79_register_leds_gpio(-1,
+ ARRAY_SIZE(eap110_outdoor_v3_leds_gpio),
+ eap110_outdoor_v3_leds_gpio);
+ ath79_register_gpio_keys_polled(-1,
+ EAP110_KEYS_POLL_INTERVAL,
+ ARRAY_SIZE(eap110_outdoor_v3_gpio_keys),
+ eap110_outdoor_v3_gpio_keys);
+}
+
+static void __init eap110_outdoor_v3_setup(void)
+{
+ tl_ap143_setup(-1);
+
+}
+
+MIPS_MACHINE(ATH79_MACH_EAP110_OUTDOOR_V3, "EAP110-OUTDOOR-V3", "TP-LINK EAP110-OUTDOOR-V3",
+ eap110_outdoor_v3_setup);
+
diff --git a/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h b/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
index c4a7fa350a..08289c9a15 100644
--- a/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
+++ b/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
@@ -111,6 +111,7 @@ enum ath79_mach_type {
ATH79_MACH_E600GAC_V2, /* Qxwlan E600GAC v2 */
ATH79_MACH_E750A_V4, /* Qxwlan E750A v4 */
ATH79_MACH_E750G_V8, /* Qxwlan E750G v8 */
+ ATH79_MACH_EAP110_OUTDOOR_V3, /* TP-LINK EAP110-Outdoor v3 */
ATH79_MACH_EAP120, /* TP-LINK EAP120 */
ATH79_MACH_EAP300V2, /* EnGenius EAP300 v2 */
ATH79_MACH_EAP7660D, /* Senao EAP7660D */
diff --git a/target/linux/ar71xx/generic/config-default b/target/linux/ar71xx/generic/config-default
index 25b58ae91e..3955499b93 100644
--- a/target/linux/ar71xx/generic/config-default
+++ b/target/linux/ar71xx/generic/config-default
@@ -77,6 +77,7 @@ CONFIG_ATH79_MACH_E558_V2=y
CONFIG_ATH79_MACH_E600G_V2=y
CONFIG_ATH79_MACH_E750A_V4=y
CONFIG_ATH79_MACH_E750G_V8=y
+CONFIG_ATH79_MACH_EAP110_OUTDOOR_V3=y
CONFIG_ATH79_MACH_EAP120=y
CONFIG_ATH79_MACH_EAP300V2=y
CONFIG_ATH79_MACH_EAP7660D=y
diff --git a/target/linux/ar71xx/image/generic-tp-link.mk b/target/linux/ar71xx/image/generic-tp-link.mk
index 08cc444a49..2688a6545a 100644
--- a/target/linux/ar71xx/image/generic-tp-link.mk
+++ b/target/linux/ar71xx/image/generic-tp-link.mk
@@ -177,6 +177,22 @@ define Device/cpe510-520-v1
endef
TARGET_DEVICES += cpe510-520-v1
+define Device/eap110-outdoor-v3
+ $(Device/tplink-safeloader)
+ DEVICE_TITLE := TP-LINK EAP110-OUTDOOR-V3
+ BOARDNAME := EAP110-OUTDOOR-V3
+ TPLINK_BOARD_ID := EAP110-Outdoor-V3
+ TPLINK_HWID := 0x0
+ TPLINK_HWREV := 0
+ LOADER_TYPE := elf
+ MTDPARTS := spi0.0:128k(u-boot)ro,64k(partition-table)ro,64k(product-info)ro,1536k(kernel),6144k(rootfs),192k(config)ro,64k(ART)ro,7680k@0x40000(firmware)
+ CONSOLE := ttyS0,115200
+ KERNEL := kernel-bin | patch-cmdline | lzma | loader-kernel
+ IMAGES += sysupgrade.bin factory.bin
+ IMAGE_SIZE := 7680k
+endef
+TARGET_DEVICES += eap110-outdoor-v3
+
define Device/cpe210-220-v1
$(Device/cpe510-520-v1)
DEVICE_TITLE := TP-LINK CPE210/220 v1
diff --git a/tools/firmware-utils/src/tplink-safeloader.c b/tools/firmware-utils/src/tplink-safeloader.c
index a51cca476e..f61d5abd68 100644
--- a/tools/firmware-utils/src/tplink-safeloader.c
+++ b/tools/firmware-utils/src/tplink-safeloader.c
@@ -276,6 +276,39 @@ static struct device_info boards[] = {
.first_sysupgrade_partition = "os-image",
.last_sysupgrade_partition = "support-list",
},
+
+ /** Firmware layout for the EAP110-OUTDOOR V3 */
+ {
+ .id = "EAP110-Outdoor-V3",
+ .vendor = "EAP-Outdoor(TP-LINK|UN|N300-2):3.0\r\n",
+ .support_list =
+ "SupportList:\r\n"
+ "EAP-Outdoor(TP-LINK|UN|N300-2):3.0\r\n"
+ "EAP-Outdoor(TP-LINK|EU|N300-2):3.0\r\n"
+ "EAP-Outdoor(TP-LINK|US|N300-2):3.0\r\n",
+ .support_trail = '\xff',
+ .soft_ver = NULL,
+
+ .partitions = {
+ {"fs-uboot", 0x00000, 0x20000},
+ {"partition-table", 0x20000, 0x02000},
+ {"default-mac", 0x30000, 0x00020},
+ {"product-info", 0x31100, 0x00100},
+ {"soft-version", 0x32000, 0x00100},
+ {"os-image", 0x40000, 0x180000},
+ {"file-system", 0x1c0000, 0x600000},
+ {"soft-version", 0x7b0000, 0x00100},
+ {"support-list", 0x7b1000, 0x01000},
+ {"user-config", 0x7c0000, 0x10000},
+ {"default-config", 0x7d0000, 0x10000},
+ {"log", 0x7e0000, 0x10000},
+ {"radio", 0x7f0000, 0x10000},
+ {NULL, 0, 0}
+ },
+
+ .first_sysupgrade_partition = "os-image",
+ .last_sysupgrade_partition = "support-list",
+ },
{
.id = "WBS510",
1 Like
Hi.Where can I download the code with your changes? Thanks.
tp-link disabled the console for EAP110 V1 with unsolder the jumper resistor to tx and rx pin, you must populated missing resistor to make console work.
I would like to get the serial console to work with my EAP110-Outdoor (EU) Ver 1.1.
Does anyone know how to populate the missing parts of the board to get serial working?
C82
R25
R27
R28
R30
R212
Thanks in advance for any assistance.
I would start from shortening the resistors which are inline with the Tx/Rx pins - R27 and R28(?).
@AndrewZ Thanks for the tip. It worked... Below is the bootlog with original firmware:
64 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash: 8 MB
*** Warning - bad CRC, using default environment
In: serial
Out: serial
Err: serial
Setting 0x181162c0 to 0x4081a100
Hit Ctrl+B to stop autoboot: 0
Loading .text @ 0x802469c0 (4784 bytes)
Loading .rodata.str1.4 @ 0x80247c70 (212 bytes)
Loading .data @ 0x80247d50 (779149 bytes)
Clearing .bss @ 0x803060e0 (4202512 bytes)
## Starting application at 0x802469c0 ...
Booting QCA953x
Linux version 2.6.31 (root@Sohoilinuxbuild) (gcc version 4.3.3 (GCC) ) #1 PREEMP
T Wed Nov 9 16:01:56 CST 2016
flash_size passed from bootloader = -1
CPU revision is: 00019374 (MIPS 24Kc)
ath_sys_frequency: cpu apb ddr apb cpu 650 ddr 390 ahb 216
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 04000000 @ 00000000 (usable)
Zone PFN ranges:
Normal 0x00000000 -> 0x00004000
Movable zone start PFN for each node
early_node_map[1] active PFN ranges
0: 0x00000000 -> 0x00004000
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256
Kernel command line: console=ttyS0,115200 root=31:04 rootfstype=squashfs init=/i
nit mtdparts=ath-nor0:128k(u-boot),64k(pation-table),64k(product-info),1536k(ker
nel),6144k(rootfs),192k(config),64k(ART) mem=64M
PID hash table entries: 256 (order: 8, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
Writing ErrCtl register=00000000
Readback ErrCtl register=00000000
Memory: 62492k/65536k available (1753k kernel code, 2972k reserved, 455k data, 1
12k init, 0k highmem)
NR_IRQS:128
plat_time_init: plat time init done
Calibrating delay loop... 432.12 BogoMIPS (lpj=864256)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 2048 (order: 2, 16384 bytes)
TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
TCP: Hash tables configured (established 2048 bind 2048)
TCP reno registered
NET: Registered protocol family 1
ATH GPIOC major 0
squashfs: version 4.0 (2009/01/31) Phillip Lougher
msgmni has been set to 122
alg: No test for lzma (lzma-generic)
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
console [ttyS0] enabled
PPP generic driver version 2.4.2
NET: Registered protocol family 24
7 cmdlinepart partitions found on MTD device ath-nor0
Creating 7 MTD partitions on "ath-nor0":
0x000000000000-0x000000020000 : "u-boot"
0x000000020000-0x000000030000 : "pation-table"
0x000000030000-0x000000040000 : "product-info"
0x000000040000-0x0000001c0000 : "kernel"
0x0000001c0000-0x0000007c0000 : "rootfs"
0x0000007c0000-0x0000007f0000 : "config"
0x0000007f0000-0x000000800000 : "ART"
TCP cubic registered
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
athwdt_init: Registering WDT success
athwdt_timer_init: Starting WDT.
VFS: Mounted root (squashfs filesystem) readonly on device 31:4.
Freeing unused kernel memory: 112k freed
init started: BusyBox v1.01 (2016.05.23-08:15+0000) multi-call binary
This Board use 2.6.31
xt_time: kernel timezone is -0000
nf_conntrack version 0.5.0 (1024 buckets, 30720 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
---portal module open ok
Register vlan_manage hooks success.
(none) mips #1 PREEMPT Wed Nov 9 16:01:56 CST 2016 (none)
(none) login: [flow]opSysModInit 62: Begin opLanInit!
[spectrum_error: opSpectrumInit:68]Begin opSpectrum
[flow]opRegionInit 823: Begin
opRegionInit
[flow]opMacFilterExtInit 63: Begin opMacFilterExt
[flow]opSearchInit 222: Begin opSearchInit
[flow]opWScheduleInit 61: Begin opWScheduleInit
Monitor Thread pid(176), tid(5126) created.
opClusterInit
Product-info region code:0, name:.
Flash region info, code: 276, name: EU.
*************************$$$$$$$$$$$$$$EAP110-Outdoor(TP-LINK|UN|N300-2):1.0
key=BgIAAAAkAABSU0ExAAQAAAEAAQDZtUNzD6KsxO4Tfx/Sp8S7w8TwPWwoppXy77wSPNs5WoV+Wr4k
h09nu70vHVmSPji5KFUG+hmRjapsJsIJj+M0Zmd4EycKY8r0Ea3D4XO/uvloX4VHVPsDZkm8Krian5iN
y6BgApVlebx0zQxto0GkgvPBq1nhoZxJNapLghGO7w==
rsaKey=BgIAAACkAABSU0ExAAQAAAEAAQC33Ux/UTRSBo17Xm/eESv+2ZRoomAXfr1LIk2PbKmBLSldP
pfeCH/m4rhY4wLiXqAke7DiRZkK6xjdahNG3uzffdaRZaxTjzY/UqsWJaqlP08Q+p1tF8YfqqeEn3WqC
G6nVxmCvoIH8t3xTZQ8RgDNWdO7v1IBARwN/8ffyjr4uQ==
*************************country$
rsaKey=BgIAAACkAABSU0ExAAQAAAEAAQC33Ux/UTRSBo17Xm/eESv+2ZRoomAXfr1LIk2PbKmBLSldP
pfeCH/m4rhY4wLiXqAke7DiRZkK6xjdahNG3uzffdaRZaxTjzY/UqsWJaqlP08Q+p1tF8YfqqeEn3WqC
G6nVxmCvoIH8t3xTZQ8RgDNWdO7v1IBARwN/8ffyjr4uQ==
[cltCfg_JsonToData:260]: ~~~~~~~~
~~~~~~~~~~~~~~~~~rdCnt = 1~~~~~~~~~~~~~~~~
[cltCfg_JsonToData:266]: ~~~~~~~~~~~~~~~~~~~~~~~~~size = 1~~~~~~~~~~~~~~~~
[cltCfg_JsonToData:313]: ~~~~~~~~~~~~~~~~~~~~~~~~~index = 0~~~~~~~~~~~~~~~~
<debug>[_printClientData:402]: basicCfg.rdId = 0
<debug>[_printClientData:403]: basicCfg.bWirelessEnable = 1
<debug>[_printClientData:404]: basicCfg.Ssid = TP-LINK-RootAp
<debug>[_printClientData:405]: basicCfg.Bssid = 00:00:00:00:00:00
<debug>[_printClientData:406]: basicCfg.uWDS = 0
<debug>[_printClientData:407]: basicCfg.bDfsEnable = 0
<debug>[_printClientData:408]: basicCfg.lockToAp = 0
<debug>[_printClientData:409]: secCfg.bSecurityEnable = 0
<debug>[_printClientData:411]: secCfg.uAuthType = 0(0: None 1: WEP 2: WP
A 3: PSK)
Syslog disabled or log buffer not allocated
qca953x_GMAC: Length per segment 1536
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:0 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 0:bfff0000
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet : 1
qca953x_GMAC: Max tx descriptor count : 128
qca953x_GMAC: Max rx descriptor count : 128
qca953x_GMAC: Mac capability flags : 3581
953x_GMAC: qca953x_gmac_attach
Link Int Enabled
qca953x_set_gmac_caps CHECK DMA STATUS
mac:1 Registering S27....
qca953x_GMAC: RX TASKLET - Pkts per Intr:18
qca953x_GMAC: RX TASKLET - Timer Freq r:376
qca953x_GMAC: RX TASKLET - Rx Desc :128
qca953x_GMAC: Mac address for unit 1:bfff0006
qca953x_GMAC: ff:ff:ff:ff:ff:ff
qca953x_GMAC: Max segments per packet : 1
qca953x_GMAC: Max tx descriptor count : 128
qca953x_GMAC: Max rx descriptor count : 128
qca953x_GMAC: Mac capability flags : 3D81
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
athr_gmac_ring_alloc Allocated 2048 at 0x83a69000
athr_gmac_ring_alloc Allocated 2048 at 0x83ae7800
HONEYBEE ----> S27 PHY MDIO
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
athr_gmac_ring_alloc Allocated 2048 at 0x83b32000
athr_gmac_ring_alloc Allocated 2048 at 0x83ae9800
HONEYBEE ----> S27 PHY MDIO
ATHRS27: resetting s27
ATHRS27: s27 reset done
Setting Drop CRC Errors, Pause Frames and Length Error frames
Setting PHY...
Disable VlanManage, data.enable(0), data.vid(1)
[LAN][_lanLinkThread:449]lanLinkThread pid: 303
[LAN][initLanLinkThread:510]lanLi
nkThread tid: 9226
br_dhcp_filter: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
dhcp_filter: started sta0="ath7" sta1="".
command not supported
[flow]ucApCfg_init 364: wlan_init
***********CJ++ for mspi_read_id get id=0xef
************************* 0
Rsa verify success
ath_hal: 0.9.17.1 (AR5416, AR9380,
REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Right
s Reserved
ath_spectral: Version 2.0.0
Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved
SPECTRAL module built on Nov 9 2016 16:07:26
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserve
d
ath_ahb: 10.2-00082-4 (Atheros/multi-bss)
__ath_attach: Set global_scn[0]
*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value wi
ll be used instead ***
ACBKMinfree = 48
ACBEMinfree = 32
ACVIMinfree = 16
ACVOMinfree = 0
CABMinfree = 48
UAPSDMinfree = 0
ATH_TXBUF=512
Enterprise mode: 0x03fc0000
Restoring Cal data from Flash
4646, ar9300_eeprom_restore_from_flash, ant_ctrl_chain = 0x1000:0x1000:0x1000
4650, ar9300_eeprom_restore_from_flash, xatten1_margin = 0x9:0x9:0x9
4654, ar9300_eeprom_restore_from_flash, xatten1_db = 0x1f:0x1f:0x1f
SPECTRAL : get_capability not registered
HAL_CAP_PHYDIAG : Capable
SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
SPECTRAL : get_capability not registered
HAL_CAP_RADAR : Capable
SPECTRAL : Need to fix the capablity check for SPECTRAL
(spectral_attach : 236)
SPECTRAL : get_capability not registered
HAL_CAP_SPECTRAL_SCAN : Capable
SPECTRAL : get_tsf64 not registered
spectral_init_netlink 52 NULL SKB
SPECTRAL : No ADVANCED SPECTRAL SUPPORT
SPECTRAL :----- module attached
ath_get_caps[6180] rx chainmask mismatch actual 3 sc_chainmak 0
ath_get_caps[6155] tx chainmask mismatch actual 3 sc_chainmak 0
ath_attach_dfs[12619] dfsdomain 1
SPECTRAL : module already attached
****************************************************
maclimit init
****************************************************
ATH_RESERVED_TXBUF = 1000
ath_tx_paprd_init sc 83bd8000 PAPRD disabled in HAL
wifi0: Atheros ???: mem=0xb8100000, irq=2
ath_pci: 10.2-00082-4 (Atheros/multi-bss)
[flow]wlanStartAllRadio 4608: here..
[flow]wlanCommonInit 2711: countryCode: 276
ath_attach_dfs[12619] dfsdomain 1
wlan_vap_create : enter. devhandle=0x824002c0, opmode=IEEE80211_M_HOSTAP, flags=
0x1
wlan_vap_create : exit. devhandle=0x824002c0, opmode=IEEE80211_M_HOSTAP, flags=0
x1.
VAP device ath0 created
ath0
ath_attach_dfs[12619] dfsdomain 2
DES SSID SET=test.freifunk.net
device ath0 entered promiscuous mode
br0: port 3(ath0) entering forwarding state
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
mlme_create_infra_bss : Overriding HT40 channel with HT20 channel
radio id error 1
raThread pid(176) tid(16400) created.
radio id error 1
radio id error 1
[cw_get_ssid_table:282]radio(1) is error
<radius>[debug]_radius_entryThread(): 553 -> Enter _radius_entryThreadCJ++ for
mspi_read_id get id=0xef
.!!!!!!!!!
<radius>[debug]_radius_init(): 525 -> Enter _radius_init.!!!!!!!!!
Rsa verify success
uclite init ok, now startup eap-cs ---------------------
httpMu
dCreate: MUD 0x684db0 was created
httpClusterRefreshInit
httpServerCreate---------
---------
httpServerCreate: try to add port 80
[WLAN_MONOTOR][ERR] no rx change
ACKTIMEOUT call ath_internal_reset begin
ACKTIMEOUT call ath_internal_reset end
wifi0 get_acktimeout:64
flashLogTread start----
[WLAN_MONOTOR][ERR] no rx change
ACKTIMEOUT call ath_internal_reset begin
ACKTIMEOUT call ath_internal_reset end
wifi0 get_acktimeout:64
EAP110 v1 using the same hardware with cpe210 v3, you can install official openwrt for cpe210v3 to eap110v1, but you must update the u-boot from cpe210v3.
@blinkstar88 Thanks for the info. I'm currently looking for the u-boot partition from a CPE210v3. I have asked a few friends (I'm not sure which version(s) they have).
To write a new u-boot, I would just have to start the origional u-boot, tftp the replacement u-boot, and write using mw, right? Or should I get out the soldering iron, spi-programmer, and write it that way?
I'll keep this forum posted as to how things are going.
Here's u-boot cpe210v3 u-boot-cp210v3
you can update through uart console.
Use hex editor to change the mac address with your mac, mac adress offset start at 0x30000.
To stop u-boot use ctrl-B at command prompt type following command
- tftpboot 0x80060000 u-boot210v3.bin
- erase 0x9f000000 +0x40000
- cp.b 0x80060000 0x9f000000 0x40000
- reset
after u-boot was updated, type "tp" to stop u-boot and tftp openwrt initrams or use standard recovery from tp-link.
Success!
Here is a recap of all the steps I needed to do:
- open up the case. This involves removing the nuts from the antenne connectors and carefully removing the rubber rings. Additionally, there are two screws under the sticker on the back of the router. Now the plastic cover slides easily off. If you find yourself forcing the platic cover off, check again that all the nuts and screws are removed.
- remove the heat-sink. It is held down by 3 screws. One of the screws is under the rf-shield. The rf schield slides off easily with a screwdriver.
- solder together both contacts of R27 and both contacts of R28. Additionally, solder pins onto the serial port.
- reattach the heat sink and rf-shield.
- download the u-boot-210v3.bin linked by @blinkstar88 in the previous post (https://drive.google.com/file/d/1JYi4vXrMl3hXpLs1tvhaik1yXTuYM4ga/view?usp=sharing)
- hexedit the mac address at offset 0x30000, replacing D8 0D 17 26 C6 5C with the mac address printed on the device
- set up the tftp server on your computer and copy the edited u-boot-210v3.bin to the tftp server's directory
- download openwrt's factory firmware for the CPE210v3 and save it to the tftp server's directoy under the name recovery.bin
- connect a USB-serial adapter to the router. The pins starting from the side of ethernet port are VCC (don't use), GND, RX, TX. The connection should be made at 115200 8N1.
- power on the router and be prepared to hit Ctrl-B to stop u-boot from booting the firmware.
- set the tftp-server's ip address to 192.168.1.10/24
- execute the commands posted by @blinkstar88 in Firmware support Tp-link EAP110-Outdoor
- tftpboot 0x80060000 u-boot-210v3.bin
- erase 0x9f000000 +0x40000
- cp.b 0x80060000 0x9f000000 0x40000
- reset
- set the tftp-server's ip address to 192.168.1.100/24. (tip, put a switch between the tftp-server and the EAP110v1.
- disconnect power to the router, hold in the reset button, give power again to the router. You can watch the progress on the serial connection.
Thanks again for all the support.
5 Likes
Hello kcstonacek,
Can you put me in the right direcction for install openwrt in EAP110 Outdoor v3?
I can help for do that.
Thanks a lot
I am also interested in getting openwrt working on EAP110 Outdoor v3. I have several of these, have opened one of them, and now have serial/console access ... I have not attempted to build and deploy from source. I am happy to be a tester on my hardware if someone can create a firmware or create/provide the necessary instructions I can use to do it.
Thanks.
I actually tried to make a port of what @kcstonacek did for EAP110-Outdoor-v3 as he posted the changed stuff here to ath79 / dts targets.
my changes are in my fork of the openwrt repo: https://github.com/bjdag1234/openwrt-eap110-o-v3
the only thing I can't get to work is the LAN port which seems to need the AR8229 switch to be initialized somewhat. in the following dmesg, when the eth ports are initialized in u-boot it does work:
Setting 0x181162c0 to 0x50a1a100
Hit Ctrl+B to stop autoboot: 0
Net: ath_gmac_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
ath_gmac_enet_initialize: reset mask:c02200
Scorpion ---->S27 PHY*
S27 reg init
: cfg1 0x800c0000 cfg2 0x7114
eth0: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
Honey Bee ----> MAC 1 S27 PHY *
S27 reg init
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:09:0b:ad
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
[ 0.686997] 0x0000007f0000-0x000000800000 : "art"
[ 0.695679] libphy: Fixed MDIO Bus: probed
[ 1.019878] libphy: ag71xx_mdio: probed
[ 1.025520] libphy: ar8xxx-mdio: probed
[ 1.093664] switch0: Atheros AR8229 rev. 1 switch registered on mdio.0
[ 1.130822] random: fast init done
[ 1.457559] ag71xx 19000000.eth: connected to PHY at mdio.0:1f:04 [uid=004dd042, driver=Generic PHY]
[ 1.467876] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[ 1.474406] i2c /dev entries driver
[ 1.480566] NET: Registered protocol family 10
yet when the openwrt image is just booted directly w/o the u-boot initializing the eth ports
0.687122] 0x0000007f0000-0x000000800000 : "art"
[ 0.695810] libphy: Fixed MDIO Bus: probed
[ 1.020037] libphy: ag71xx_mdio: probed
[ 1.127559] random: fast init done
[ 1.340663] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[ 1.348781] i2c /dev entries driver
[ 1.354856] NET: Registered protocol family 10
[ 1.364621] Segment Routing with IPv6
[ 1.368646] NET: Registered protocol family 17
[ 1.373371] 8021q: 802.1Q VLAN Support v1.8
[ 1.692660] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[ 2.016647] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
If anyone has ideas what to change somewhere or what to put in the DTS to make it work, it will be greatly appreciated.
The EAP245v1 (and related devices) had similar issues. Maybe you can try some of the fixes introduced for those access points? Note that the hardware for these devices isn't the same, but TP-Link may have used the same or similar code.