No, you don't read the documentation.
In the fans node you commented out the correct syntax (and removed the gpios property) and just added 3 fan nodes. This is not how it works.
Just use the example and add one more fan speed-map.
And in the thermal-zones node the type has to be one of the list:
I'm guessing this is correct?
So I'm only allowed to have one "map" and "trip" per gpio-fan phandle and the kernel controls the fan itself?
Sorry for all the questions just trying to get my dead around it.
gpio_fan: fans {
compatible = "gpio-fan";
pinctrl-0 = <&fan_pins>;
pinctrl-names = "default";
fan1 {
label = "fan1";
gpios = <&tlmm 40 GPIO_ACTIVE_HIGH>;
};
fan2 {
label = "fan2";
gpios = <&tlmm 41 GPIO_ACTIVE_HIGH>;
};
fan3 {
label = "fan3";
gpios = <&tlmm 42 GPIO_ACTIVE_HIGH>;
};
gpio-fan,speed-map = <0 0>,
<1500 1>,
<3000 2>,
<6000 3>;
//alarm-gpios = <&tlmm XX GPIO_ACTIVE_HIGH>
#cooling-cells = <2>; /* min followed by max */
};
};
};
thermal-zones {
&cpu0_thermal {
polling-delay-passive = <250>;
thermal-sensors = <&tsens 9>; //cpu 0 sensor
trips {
cpu-critical-hi {
temperature = <70000>; //fanspeed 3 sp
hysteresis = <2000>;
type = "active";
};
};
cooling-maps {
map2 {
trip = <&cpu-critical-hi>;
cooling-device = <&gpio-fan THERMAL_NO_LIMIT THERMAL_NO_LIMIT>;
};
};
};
};
I noticed mtd12 contains the root oem operating system and is 42mb.
there is also mtd13 that is the same size (but empty) is this the second slot to boot an alternate image or does the factory switch between them when upgrading or something or is it the overlay ?
dev: size erasesize name
mtd0: 00100000 00020000 "0:sbl1"
mtd1: 00100000 00020000 "0:mibib"
mtd2: 00080000 00020000 "0:bootconfig"
mtd3: 00080000 00020000 "0:bootconfig1"
mtd4: 00300000 00020000 "0:qsee"
mtd5: 00080000 00020000 "0:devcfg"
mtd6: 00080000 00020000 "0:apdp"
mtd7: 00080000 00020000 "0:rpm"
mtd8: 00080000 00020000 "0:cdt"
mtd9: 00180000 00020000 "0:appsblenv"
mtd10: 00200000 00020000 "0:appsbl"
mtd11: 00080000 00020000 "0:art"
mtd12: 02a00000 00020000 "rootfs"
mtd13: 02a00000 00020000 "rootfs_1"
mtd14: 00080000 00020000 "0:ethphyfw"
mtd15: 00900000 00020000 "factory_data"
mtd16: 01100000 00020000 "runtime_data"
offsets:
mtd0 0 0x000000
mtd1 1048576 0x100000
mtd2 2097152 0x200000
mtd3 2621440 0x280000
mtd4 3145728 0x300000
mtd5 6291456 0x600000
mtd6 6815744 0x680000
mtd7 7340032 0x680000
mtd8 7864320 0x780000
mtd9 8388608 0x800000
mtd10 9961472 0x980000
mtd11 12058624 0xb80000
mtd12 12582912 0xc00000
mtd13 56623104 0x3600000
mtd14 100663296 0x6000000
mtd15 101187584 0x6080000
mtd16 110624768 0x6980000
@stifilz I have updated the wiki with install info and links to the initramfs and factory image's and created an install guide.
I have successfully flashed my unit with OpenWrt booting on mtd12
There is mtd13 by the look of it doing nothing and I don't know if we can make use of it but there is 18mb of free space after the modem stuff and luci is installed which should be enough.
The RGB light is working as a power light, but I don't know if the fan is properly working.
The fan has a speed sensor wire, and it is not mentioned in the stock DTS and I don't know if it is connected to a GPIO that we can use in the future.
Sweet, I'll try that later on. Have you tried to go back to stock? It should work through normal recovery?
Looks like the "rootfs_1" may be showing as 'Temp Storage' in OpenWrt?
When booting intramfs 'Temp Storage' is the same size as 'Disk Space'
Yes it is mounted kind of weird?
How did you get dns working again with that image i uploaded ill have to fix that?
But I did findout after trying to get the fan working that I need to install two kmod packages for the fan and gpio to get the fan working.
There is also two leds that need removing from the dts that one of the phy chips can drive as this board does not have them.
Managed to get it installed. That was fun as my TTL connection was iffy. I decided to leave my 1.0.0 stock and install on one of the 1.0.3.
Once in had booted intramfs, I used ssh and scp to install the image.
Booted into recovery, was unanabe to revert to stock by selecting the 1.0.3 FW.
DNS I set on the end user device, not in OpenWrt/Luci.
No idea why the revert to stock function did not work as we have not touched any thing else.
you can do it by loading an iinitramfs and uploading the backup of mtd12 to tmp and running the ubi format just like installing OpenWrt.
there is a few things to fix as the file platform.sh and the envtools thing for uboot needs patching with our target as at the moment sysupgrade will just reboot the router.
I'm not 100% what to put in those two files im no expert on uboot and I'm not game to start messing in there.
I think the device when you upgrade if formats the other partition applys the image then sets the boot args to the other partition but to do that we require knowing the offset to the bootargs partition and the size which i think is the partition APPSBLENV and below is the details of that partition:
mtd9 offset: 0x800000 size: 0x180000
and all that is in the partition is:
baudrate=115200�has_default_mac=1���_boot_idx=1
i have fixed sysupgrades got the fan working (seems to just run flat out with no speed control ?)
fixed the phy led's and some other minor stuff.
but I have this one error I don't know how to fix the lan port ar8033 seems to be issues with a random MAC address every boot and I believe it should pull it from the sgmii bus or firmware or something?
Wed Aug 14 07:02:25 2024 kern.info kernel: [ 4.446150] GMAC6(ffffff800372f900) Invalid MAC@ - using c2:fc:8d:ca:0c:be
Wed Aug 14 07:02:25 2024 kern.info kernel: [ 4.454178] dp6-syn: ppe offload disabled: 0 for macid 6
Wed Aug 14 07:02:25 2024 kern.info kernel: [ 4.461013] dp6-syn: Switch attached to macid 6 status: 0
Wed Aug 14 07:02:25 2024 kern.info kernel: [ 4.513531] Qualcomm Atheros AR8031/AR8033 90000.mdio-1:04: attached PHY driver (mii_bus:phy_addr=90000.mdio-1:04, irq=POLL)
Wed Aug 14 07:02:25 2024 kern.info kernel: [
Tested a few things...
Restored FW 1.0.0 to mtd12 on the 1.0.3 that was running OpenWRT. Booted fine and had the WiFi settings from my backup (stock 1.0.0). Was unable to get the 5G/4G working (more on that later).
Updated the router to 1.0.3 via Deco. 5G/4G started working again
I was working of the basis that the mtd13 backup would be 1.0.0 from the previously updated router.
Restored the original backup of 1.0.3 stock( mtd13 supposed 1.0.0 FW) to mtd12. It booted the 1.0.3 I just had.
This made me think it was running on mtd13. Flashed 1.0.3 (mtd13 supposed 1.0.0 FW) Stock backup to mtd13 and it booted with 1.0.0!!
Can you look at your backups and confirm?
Seems the modem for 5G/4G updates with the firmware, hence once updated to 1.0.3, it no longer works on 1.0.0.
TLDR:
When updating it seems to update the other partition i.e 12/13 and then boot to that.
The mac addresses are usually patch via u-boot (utilizing the ethernet aliases in the dts)
But according to the printenv output
there is only one mac address available. In that case you need to derive the other mac address by incrementing the only available mac address by 1 for example.
This can be done in the 02_network script. Look at the entry of linksys,mx8500.
It's utilizing the function"mtd_get_mac_ascii" to get the macaddr from the devinfo partition.
You need to get the macaddr from the "appsblenv" partition (u-boot env)
But it might be possible, that there are more mac addresses in other partitions stored, TP-Link uses for example the "factory_data" partition for that.
You can mount that partition (ubi) and have a look at the contents.
It does switch between partitions with the stock setup it is so it can flash a live system, the firmware for the modem is stored on another partition and i did see the IMEI number in plain txt in the factory_data partition.
I would expect it to flash the modem partition when an update happens, the update file sprits into many parts.
I would expect any firmware to work with any version but that does not seem to be the case.
You could do the ubiformat thing and restore the modem partition, or make a backup as compare with your previous dump but there is mot much point running an old retail build I guess.
you could try flash openwrt and the stock firmware on separate partitions and see if you can reset or remove the factory password then copy it back to the booting partition.
OpenWrt can do the swap thing other devices do that already they use fw_setenv to alter the bootargs when flashing, in theory you can use it to switch banks on the fly but there is no way to switch back from retail without serial intervention.
I saw the factory data partition had the IMEI number and some other stuff but the appsblenv partition is blank apart from the first few words that has the setenv data.
ill look in the partitions for mac addresses.
appsblenv not appsbl (that's u-boot)
correct just a typo sorry
I did a grep of the factory_data partition with the mac address on the sticker on the bottom and come up with this:
root@OpenWrt:~# hexdump -C /dev/mtd15 | grep 'b4 b0 24 59 b8 0c'
00423030 b4 b0 24 59 b8 0c 5f 6e 31 18 10 06 53 7a 2a b3 |..$Y.._n1...Sz*.|
this was found at offset 423030
can I just add another mac into the applbenv partition by adding:
eth1addr=(my new mac)
of note the address that Openwrt come's up with is regular in google results it must be some driver default or backup for uboot or something.
@stifilz if you have your device that you posted the factory dump can you post your mac addrress on the sticker or ferify you can find it at the same offset address (423030) in your factory_data image?
of the device and sticker and pass me a dump of the facrory data to verify against mine.
OpenWrt
root@OpenWrt:/dev# ifconfig -a | grep HWaddr
Adults_5.0g Link encap:Ethernet HWaddr 02:03:7F:12:4E:03
Kids_5.0g Link encap:Ethernet HWaddr 00:03:7F:12:4E:03
br-adults_lan Link encap:Ethernet HWaddr 4E:3F:99:6E:99:6F
br-kids_lan Link encap:Ethernet HWaddr 00:03:7F:12:4E:03
lan Link encap:Ethernet HWaddr 4E:3F:99:6E:99:6F
miireg Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
phy1-ap0 Link encap:Ethernet HWaddr 00:03:7F:12:32:D7
phy1-ap1 Link encap:Ethernet HWaddr 02:03:7F:12:32:D7
wan Link encap:Ethernet HWaddr 00:03:7F:BA:DB:AD
OpenWrt Boot 2
[ 3.696022] GMAC6(ffffff8003f72900) Invalid MAC@ - using e2:58:4a:ea:8d:02
root@OpenWrt:/# ifconfig -a | grep HWaddr
Adults_5.0g Link encap:Ethernet HWaddr 02:03:7F:12:AD:7B
Kids_5.0g Link encap:Ethernet HWaddr 00:03:7F:12:AD:7B
br-adults_lan Link encap:Ethernet HWaddr E2:58:4A:EA:8D:02
br-kids_lan Link encap:Ethernet HWaddr 00:03:7F:12:AD:7B
lan Link encap:Ethernet HWaddr E2:58:4A:EA:8D:02
miireg Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
phy1-ap0 Link encap:Ethernet HWaddr 00:03:7F:12:69:57
phy1-ap1 Link encap:Ethernet HWaddr 02:03:7F:12:69:57
wan Link encap:Ethernet HWaddr 00:03:7F:BA:DB:AD
Stock
[ 18.156474] ssdk_dt_parse_intf_mac[766]:INFO:dp1 MAC 00:03:7f:ba:db:ad
...
[ 20.967647] EDMA HW Reset completed succesfully
[ 20.970548] Num rings - TxDesc:1 (23-23) TxCmpl:1 (7-7)
[ 20.974890] RxDesc:1 (15-15) RxFill:1 (7-7)
[ 20.981769] libphy: PHY 90000.mdio:00 not found
[ 20.984294] nss-dp: probe of 3a001000.dp1 failed with error -14
[ 20.988845] GMAC2(ffffffc039d68880) Invalid MAC@ - using be:63:6d:d4:f1:02
[ 20.994817] libphy: PHY 90000.mdio:01 not found
[ 21.001649] nss-dp: probe of 3a001200.dp2 failed with error -14
[ 21.006105] GMAC3(ffffffc039d68880) Invalid MAC@ - using de:bf:fd:f1:46:16
[ 21.012001] libphy: PHY 90000.mdio:02 not found
[ 21.018914] nss-dp: probe of 3a001400.dp3 failed with error -14
[ 21.023386] GMAC4(ffffffc039d68880) Invalid MAC@ - using 02:12:a7:1d:46:20
[ 21.029272] libphy: PHY 90000.mdio:03 not found
[ 21.036189] nss-dp: probe of 3a001600.dp4 failed with error -14
[ 21.040669] GMAC5(ffffffc039d68880) Invalid MAC@ - using 62:14:f3:eb:4d:0d
[ 21.248539] GMAC6(ffffffc039d6db00) Invalid MAC@ - using 3e:0f:89:d5:cc:8e
...
[ 57.525218] Not a Hy-Fi device, or device not found: br-iptv
[ 57.525378] Not a Hy-Fi device, or device not found: br-iptv
[ 57.756853] IPv6: ADDRCONF(NETDEV_UP): br-wan.10: link is not ready
iptv.init start iptv
iptv start_service
switch: reset_wan_vlan: select p4: 1
switch: reset_wan_vlan: select p5: 2
mac:1C-61-B4-B9-B1-AC
...
guest-eth: AP role, eth0 eth1 set tag port, vlan id is 591
guest-eth: add eth if eth0.591
[ 60.090993] device eth0.591 entered promiscuous mode
[ 60.105555] IPv6: ADDRCONF(NETDEV_UP): eth0.591: link is not ready
guest-eth: add eth if eth1.591
[ 60.133090] device eth1.591 entered promiscuous mode
[ 60.147269] IPv6: ADDRCONF(NETDEV_UP): eth1.591: link is not ready
mac:1C-61-B4-B9-B1-AC
role:AP
Stock 2nd run
[ 18.172108] ssdk_dt_parse_intf_mac[766]:INFO:dp1 MAC 00:03:7f:ba:db:ad
...
[ 20.987642] EDMA HW Reset completed succesfully
[ 20.990544] Num rings - TxDesc:1 (23-23) TxCmpl:1 (7-7)
[ 20.994885] RxDesc:1 (15-15) RxFill:1 (7-7)
[ 21.001617] libphy: PHY 90000.mdio:00 not found
[ 21.004289] nss-dp: probe of 3a001000.dp1 failed with error -14
[ 21.008838] GMAC2(ffffffc039d60880) Invalid MAC@ - using 16:a3:a8:b0:bd:38
[ 21.014810] libphy: PHY 90000.mdio:01 not found
[ 21.021645] nss-dp: probe of 3a001200.dp2 failed with error -14
[ 21.026101] GMAC3(ffffffc039d60880) Invalid MAC@ - using 52:95:db:a9:05:59
[ 21.032000] libphy: PHY 90000.mdio:02 not found
[ 21.038909] nss-dp: probe of 3a001400.dp3 failed with error -14
[ 21.043396] GMAC4(ffffffc039d60880) Invalid MAC@ - using 06:bf:9c:f0:d6:84
[ 21.049264] libphy: PHY 90000.mdio:03 not found
[ 21.056183] nss-dp: probe of 3a001600.dp4 failed with error -14
[ 21.060653] GMAC5(ffffffc039d60880) Invalid MAC@ - using 76:85:8a:0d:04:7b
[ 21.268549] GMAC6(ffffffc039d61900) Invalid MAC@ - using 76:8c:a8:fe:d1:4b
...
iptv.init start iptv
iptv start_service
switch: reset_wan_vlan: select p4: 1
switch: reset_wan_vlan: select p5: 2
mac:1C-61-B4-B9-B1-AC
As per the sticker on the bottom
Mine was here:
root@OpenWrt:/# hexdump -C /dev/mtd15 | grep '1c 61'
002e3030 1c 61 b4 b9 b1 ac 5f 6e 31 18 10 06 53 7a 2a b3
Of course you can add new key/value pairs to the u-boot env. But what for?
I already told you how you can derive a new device-unique mac address based on the u-boot env mac address.
there lies the problem the uboot macid are the same in my device and his they must be the same on every device in envargs it is on google on other devices as well it could be some sort of driver default?.
they seem to be stored in the factory data partition but are at different offsets so i guess the mac id is on a file in that partition. or something i could not figure out how to extrasct it?
I have taken screen shots of the data in a simular format in different places in the partition:
I can just bodge the addresses but that may not fly upstream.
Have you actually mounted the factory_data partition?
What files are stored there?
