IPQ8074A Tp link deco x80 5g info thread

professor_jonny · August 19, 2024, 3:33am

what is the consensus of pushing a not 100% complete target?

there is two things that need fixing fan and mac

the fan speed control does not work (fan works tho so we are not going to burn up something)

It does not get the mac from the factory_data partition but a random one every boot, this problem seems like it more to do with the init sequence on the platform not working for some reason but I don't know enough of the why or how to fix it.

The scripts does not like an underscore in the name of the partition, and the mount command fails to work with no indication why I can probably try to cat the output to a log or something that will give me more info to help?

I enabled debugging of the preinit code but did not see my mount o echo in the kernel log just the ubi attach,

I tried waits pauses etc I think I need to implement a printk to see what happens

09_mount_cfg_part_tp

slh · August 19, 2024, 3:54am

I'm not the final arbiter of that (not an OpenWrt developer/ project member), so I can only give my personal opinion:

does it work?
MACs should be correct and stable
- many ISPs rely on a stable WAN address
- MAC address conflicts on the lan are painful
- some operating systems (windows) will ask silly things (and bump the network number) when the MAC address of the lan gateway changes
- there is precedence for (usually SBC-like) devices to at least generate a random MAC (even better if you can derive it from some kind of serial number) on firstboot and to at least stick to (unless the user does a factory reset), not great, but still (relatively speaking) better than generating a new random MAC on each boot
there shouldn't result hardware damage from using the device, so it shouldn't overheat
- fine grained fan control is another topic, which can be sorted later (even if that may mean 'never').
- a case could be made for avoiding jet-engine fan speeds, avoiding 'unreasonable' noise and/or premature wear-out of the fan
LEDs, nice to have, not a blocker
there is precedent in other devices to work around incompatible partition naming (I think rootfs_data is often posing a problem), I guess others might have advice for this

professor_jonny · August 19, 2024, 5:10am

It is stable I have been using it for the past few days just the mac is an issue but it can be worked around..

I'm running windows and every reboot it comes up and says new network because of the mac change on the lan side the wan is fine as it is stored in the environment variables on the appsblenv partition on first run of tftpboot but it just loads a generic one that will be the same as every other x80, that installs OpenWrt.

One could read the mac of the bottom and save it in the appsblenv partition, but it is not how it does it for the OEM and requires the user to store them into the environment variables when setting up OpenWrt.

Another thing that could be implemented is root partition swapping with sys upgrade, but it is not really an issue apart from wear leveling, it could be nice to dual boot or use both partitions for OpenWrt use or a single big partition.

slh · August 19, 2024, 5:15am

As an nbg6817 user, dual-firmware/ dual-boot functionality is great to have (also from the position of not having to bother about which firmware slot to write OpenWrt to), but it's not essential (there are many OpenWrt supported devices that can only use one specific firmware slot) - and it can be retrofitted later on (e.g. initial nbg6817 support did not support it, I added that quite a bit later).

professor_jonny · August 19, 2024, 12:06pm

Ok so the fan is fixed now ( I should say not throwing errors in the sys log) and I have the factory_data partition mounting.

The cooling cells option I mis interpreted from the linux kernel docs for the gpio-fan node.

I did this:

#cooling-cells = <0 7>; /* min followed by max */

This was what was intended:

cooling-min-level = <0>;
cooling-max-level = <7>;
#cooling-cells = <2>; /* min followed by max */

The fan is inverted I believe as it just runs flat out with all pins low but the stock DTS states the gpio is active high but it seems it is not.

 gpio40  : out low  func0 2mA no pull
 gpio41  : out low  func0 2mA no pull
 gpio42  : out low  func0 2mA no pull

Hard coding of the partition name is required because of the underscore in the name, and it just needed to be run in a system shell /bin/sh and it mounts the partition.

I can pull the mac from the default-mac file on mounted factory_data partition in /tmp now

root@OpenWrt:~# . /lib/functions/system.sh
root@OpenWrt:~# get_mac_binary /tmp/factory_data/default-mac 0
b4:b0:24:59:b8:0croot@OpenWrt:~#

But it does not seem to commit and update the mac of the lan interface.
it is just something simple now I'm missing.

02_network

some boards update the mac in different ways and im not sure why:

[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
or like this:
ip link set dev eth1 address "$(macaddr_add $addr 1)"

naf · August 19, 2024, 2:17pm

github.com

professor-jonny/pj_openwrt/blob/7883199198751767dbe8c90e53fa3a76afd69613/target/linux/qualcommax/ipq807x/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac#L26


      
          		;;
          	buffalo,wxr-5950ax12)
          		[ "$PHYNBR" = "0" ] && macaddr_add $(get_mac_label)  8 > /sys${DEVPATH}/macaddress
          		[ "$PHYNBR" = "1" ] && macaddr_add $(get_mac_label) 16 > /sys${DEVPATH}/macaddress
          		;;
          	cmcc,rm2-6|\
          	zte,mf269)
          		[ "$PHYNBR" = "0" ] && macaddr_add $(get_mac_label) 2 > /sys${DEVPATH}/macaddress
          		[ "$PHYNBR" = "1" ] && macaddr_add $(get_mac_label) 3 > /sys${DEVPATH}/macaddress
          		;;
          	ttplink,x80-5g)
          		base_mac=$(get_mac_binary /tmp/factory_data/default-mac 0)
          		macaddr_add $base_mac $(expr "$PHYNBR" + 1) > /sys${DEVPATH}/macaddress
          		;;
          esac

ttplink --> tplink

professor_jonny · August 19, 2024, 6:36pm

thanks ill fix that
but it still does not fix the lan not updating ?

This is what I get now some what better ha ha:

naf · August 20, 2024, 5:20am

the x80-5g case is being added in a weird spot, in the middle of an existing list, so its breaking everything in the aw1000 through mx8500 part of the list i believe

naf · August 20, 2024, 5:47am

need to add a 10_fix_eth_mac.sh to the qualcommax target based off of mediatek's version at linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh but with only x80-5g supported, and do the ip link set there

professor_jonny · August 20, 2024, 8:34am

here is a another TP link device that is using the same method I tried, but I will try the other method and see what happens.

TP-Link EAP660 HD v1

I was looking in the wiki and some had in the install guide notes to store the mac in the envargs but I don't think that is a good solution when it is right there on the partition.

naf · August 20, 2024, 12:01pm

github.com

professor-jonny/pj_openwrt/blob/4a4b3f6ceb124a4836e546d3777956932133b3ab/target/linux/qualcommax/ipq807x/base-files/etc/board.d/03_gpio_switches#L5


      
          
          . /lib/functions/uci-defaults.sh
          
          board_config_update
          512
          board=$(board_name)
          
          case "$board" in
          tplink,x80-5g)
          	ucidef_add_gpio_switch "w_disable" "W_DISABLE WWAN POWER CTRL" "547" "1"
          	ucidef_add_gpio_switch "modem-reset" "MODEM_RESET CTRL" "541" "0"
          	ucidef_add_gpio_switch "ext_antenna_en" "EXT_ANTENNA_ENABLE CTRL" "568" "0"
          	;;
          esac

remove typo?

professor_jonny · August 20, 2024, 1:06pm

Yip fixed that now,

I have been playing with the thermal control and got it working correctly now, I had to invert the I/O for the fan unlike the qsdk dts, it replicates the stock fan control now.

fan has 8 speed steps from stop to 6k rpm.

It runs in speeds 0-1 below 25 degrees c, speeds 2-4 above 50 degrees c and speeds 5-8 above 70 degrees c.

The stock temps seemed really high so they must have some sort of offset so I made mine sensible:
temperature = <0x7d>; 125 deg >70
temperature = <0x69>; 105 deg>50
temperature = <0x5f>; 95 deg>25

at the moment it is sitting there and seems to be switching from speeds 0-1 under minimal load.

The lan mac still wont update so I'm wondering if i need to remove the alias from the DTS or something?

kirdes · August 20, 2024, 2:56pm

You can try to remove the ethernet alias. But I doubt this is the root cause.
Probably this is a race condition and the factory_data partition isn't mounted during the network setup.

Please post the bootlog, maybe there are some errors.

I'd try to call the ipq807x_setup_macs function after successful boot and see what happens then

professor_jonny · August 20, 2024, 8:03pm

I found a silly typo, macs are working now:

For the wan mac should this be derived from the lan mac also?
as the mac there is only set because of installing OpenWrt.

When I first set up OpenWrt the mac address was not set in envargs (I checked them) when I set the ipaddr and serverip and ran tftpboot from uboot the first time it set the value of 00:03:7f:ba:db:ad in by it's self.

That mac is somewhat of a default for uboot so it seems if one is not set it sets that it must be in the u-boot source or something as a fallback a google search reveals this theory:

Continuing the discussion from Where is "initial" MAC address extracted? [IPQ40xx Ethernet]:

I don't know what to really do here if I should remove the alias and increment the mac for the wan or something, my device is not stock now so I don't know the original mac of all the ports to look for more mac addresses somewhere.

It is static but it is just a common static mac that would likely cause conflicts.

professor_jonny · August 20, 2024, 11:01pm

@stifilz by chance do you have a device that is not modified that you can look at the stock mac addresses to see how they relate to the base mac on the sticker on the bottom?

stifilz · August 21, 2024, 12:10am

Sticker 28-87-BA-5B-21-B8
2.4Ghz Main 28-87-BA-5B-21-BA
5Ghz Main 28-87-BA-5B-21-BB
2.4Ghz Guest 2E-87-BA-5B-21-BA
5Ghz Guest 32-87-BA-5B-21-BB

Both LAN ports seemed to show the same as sticker??

Note the differences between letter B and number 8

Edit: Added word Guest for clarity

professor_jonny · August 21, 2024, 2:32am

It is interesting both lans have the same mac I don't think they should.

stifilz · August 21, 2024, 4:31am

That was looking at arp -a entries when plugged into each. Not sure how else I could check?

Edited above with "Guest"

professor_jonny · August 21, 2024, 9:32pm

@naf I noticed the stock router has a web based ISP and firmware update feature is it possible we can use this to install OpenWrt with one of your exploits ?

How to upgrade the ISP information of TP-Link Wireless Dual Band 4G LTE Router (new logo)

How to log into the web-based management interface of TP-Link Wireless 4G LTE Router

naf · August 21, 2024, 10:27pm

Yes, I would say chances are good that an exploit could be made.

I have a working exploit for the webui firmware upload in the S4 (MIPS) and the code looks the same for the X80, just need to account for the architecture (ARM vs MIPS), kernel changes, etc.

I would be interested in working on it if someone can lend me access to a shell on near-stock firmware