OpenWrt support for TP Link EAP115

Nice progress. It looks like you are about to make it. Your device is apparently the EU version, while I have the UN version. As you continue with your process, I will have to connect the device to the serial and check if everything matches.

The sticker on the RJ45 connector says EAP115(EU)v4, however if you look into my dumps from OEM firmware there is indication that it is UN.

...and supported devices in the OEM firmware pack indicates UN compatibility

Maybe you need to download OEM firmware for UN and EU and compare what is the difference. We can look also on pictures to see essential differences in the PCB assembly. Finally you can go steps I've described above to check if CPE210v3 initramfs images works on your device.

2 Likes

That's great.
Sure. I will be removing one in the next day or two, and I will disassemble it to have a look at the PCB assembly.

Next step achieved - backups of OEM firmware stored in ROM (NOR Flash).

Method 1: Requires OpenWRT running (e.g. initramfs)
In the console setup static address of eth port within your network ifconfig br-lan 192.168.14.15 netmask 255.255.255.0

Make dumps of the ROM partitions:

root@OpenWrt:/tmp# dd if=/dev/mtd0ro of=/tmp/mtd0_uboot.bin
root@OpenWrt:/tmp# dd if=/dev/mtd1ro of=/tmp/mtd1_partition_table.bin
root@OpenWrt:/tmp# dd if=/dev/mtd2ro of=/tmp/mtd2_product_info.bin
root@OpenWrt:/tmp# dd if=/dev/mtd4ro of=/tmp/mtd4_config.bin
root@OpenWrt:/tmp# dd if=/dev/mtd5ro of=/tmp/mtd5_art.bin
root@OpenWrt:/tmp# dd if=/dev/mtd3ro of=/tmp/mtd3_kernel_rootfs.bin

...and finally copy it to host, generate checksum, tar and zip:

$ scp root@192.168.14.15:/tmp/*.bin ./
$ md5sum *.bin > mtd_bak.md5
$ tar -cvzf eap115_mtd_bak.tar.gz mtd*

(EDIT)
Method 2 (recommended): Works on OEM firmware, need ssh login only

# login from host to your device
ssh admin@$(your_dev_ip) 

# create backup folder
mkdir /tmp/logdump/bak

# dump flash images, generate check sum and store flash layout
cd /dev; for part in mtdblock*; do dd bs=1 if=$part of=/tmp/logdump/bak/$part.bin; done
cd /tmp/logdump/bak/;md5sum *.bin > mtdblocks.md5
cat /proc/mtd > /tmp/logdump/bak/mtd-partitions.txt

# store kernel log and various device info
dmesg > /tmp/logdump/bak/kernel-log.txt
cat /tmp/vendor /tmp/device-info /tmp/region /tmp/firmware-version > /tmp/logdump/bak/dev_info.txt

# making tarball archive and exit from ssh session
tar -cf /tmp/logdump/eap115v4.tar /tmp/logdump/bak/*
exit

# pull the tarball archive onto host (make sure to put right IP address of the device
ssh admin@$(your_dev_ip) "dd if=/tmp/logdump/eap115v4.tar" > eap115v4.tar
2 Likes

After exploring hardware and its specific implementation, now it is time to start second part of this adventure - adding support for this device into OpenWRT. After couple of weeks of googling and howtos reading I've decided to download build environment and try source code modification and hopefully generating dedicated sysupgrade and factory images. Here is my part II "game plan" - please comment and support:

A. Download build environment and OpenWRT source tree
B. Make trial build for CPE210v3 device
C. Understand factory image format for EAP115v4
D. Identify source files to be modified and create source files to be added
E. Build EAP115v4 images
F. Flash device with sysupgrade image
G. Tests functionality and performance
H. Revert back to factory firmware and flash OpenWRT factory image

Looks like pretty challenging and ambitious plan for me. Looking for volunteers to help and contribute!

1 Like

A. Download build environment and source tree
I've followed the guidelines from OpenWRT - it went smooth as per instructions:

  • Build system essentials - this give generic overview of build concept, cross-compilation, folders, etc.
  • Build system setup - to understand what prerequisite packages need to be installed on host machine, and step-by-step commands to configure and execute build
  • Dockerfile (optional) - this is recipe to run the build environment in docker container

B. Make trial build for CPE210v3 device
This step was relatively simply if you follow above instruction, but it is pretty lengthy. On my old NAS machine it took more than 2h to compile toolchain, packages and final kernel and flash images.

C. Understand factory image format for EAP115v4
It looks that the original images download from TP-Link web page are somehow SafeLoader format similar (more details in: tp-link-safeloader.c). However these are signed with RSA key (that's differs to CPE210 devices). There are some tricks to overcome signature check by stock firmware as per other TP-Link devices. While I have full backup of stock NOR flash let's park this problem for later.

D. Identify source files to be modified and create source files to be added
Here is what I believe need to be added to create proper Device Tree Structure (I'll base on CPE210 devices, changing LEDs configs):

openwrt/target/linux/ath79/dts/qca9533_tplink_eap11x.dtsi
openwrt/target/linux/ath79/dts/qca9533_tplink_eap115-v4.dts 

These files need to be modified to reflect LED configuration and lack of network switch while only one LAN port in use:

target/linux/ath79/base-files/etc/board.d/01_leds
target/linux/ath79/base-files/etc/board.d/02_network

And finally recipe for images creation needs to be defined for the device here:

target/linux/ath79/image/generic-tp-link.mk
tools/firmware-utils/src/tplink-safeloader.c

Did I miss something - all suggestions and help welcome :slight_smile:

Hi, thanks for your hard work on this. I have ordered a EAP115, but am pretty new to Openwrt development, while being a user for a long time. Watching this thread with fascination :slight_smile:

1 Like

Hello @Lpcvoid
Thank you for replay. I'm in the process to build image dedicated for EAP115 (hope it will work on EAP110 too). At the moment have initramfs working. Still some build problem with factory and sysupgrade image creation. Hope in upcoming days will overcome these issues.
I'll need some people to flash and test it. What capabilities you have? Did you make alive debug console on your device? Was you able to follow this thread and make backup of MTD partitions - that's essential to have something for recovery if softbrick the device.

1 Like

Below diff log from OpenWRT 22.03 baseline to my changes/additions:

Added device to `02_network` script and device images creation and recipe for image creation (at the moment I'm only using `initramfs`, neither `factory` nor `sysupgrade` has been verified yet)
user@2f4e8d5980b0:/home/openwrt$ git diff
diff --git a/target/linux/ath79/generic/base-files/etc/board.d/02_network b/target/linux/ath79/generic/base-files/etc/board.d/02_network
index 4d3296c0af..078e867d97 100644
--- a/target/linux/ath79/generic/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/generic/base-files/etc/board.d/02_network
@@ -76,6 +76,7 @@ ath79_setup_interfaces()
        tplink,cpe610-v1|\
        tplink,cpe610-v2|\
        tplink,cpe710-v1|\
+       tplink,eap115-v4|\
        tplink,eap225-outdoor-v1|\
        tplink,eap225-v1|\
        tplink,eap225-v3|\
diff --git a/target/linux/ath79/image/generic-tp-link.mk b/target/linux/ath79/image/generic-tp-link.mk
index fed572c884..612872ef98 100644
--- a/target/linux/ath79/image/generic-tp-link.mk
+++ b/target/linux/ath79/image/generic-tp-link.mk
@@ -381,6 +381,19 @@ define Device/tplink_cpe710-v1
 endef
 TARGET_DEVICES += tplink_cpe710-v1
 
+define Device/tplink_eap115-v4
+  $(Device/tplink-safeloader)
+  SOC := qca9533
+  IMAGE_SIZE := 7680k
+  DEVICE_MODEL := EAP115
+  DEVICE_VARIANT := v4
+  TPLINK_BOARD_ID := EAP115V4
+  DEVICE_PACKAGES := -rssileds
+  LOADER_TYPE := elf
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma
+endef
+TARGET_DEVICES += tplink_eap115-v4
+
 define Device/tplink-eap2x5
   $(Device/tplink-safeloader)
   LOADER_TYPE := elf

Here come new device-tree files:

qca9533_tplink_eap115-v4.dts
// SPDX-License-Identifier: GPL-2.0-or-later OR MIT

#include "qca9533_tplink_eap11x.dtsi"

/ {
	compatible = "tplink,eap115-v4", "qca,qca9533";
	model = "TP-Link EAP115 v4";
};

&eth1 {
	compatible = "syscon", "simple-mfd";
};
qca9533_tplink_eap11x.dtsi
// SPDX-License-Identifier: GPL-2.0-or-later OR MIT

#include "qca953x.dtsi"

#include <dt-bindings/gpio/gpio.h>
#include <dt-bindings/input/input.h>
#include <dt-bindings/leds/common.h>

/ {

	aliases {
		led-boot = &led_status_green;
		led-failsafe = &led_status_amber;
		led-running = &led_status_green;
		led-upgrade = &led_status_amber;
		label-mac-device = &wmac;
	};
	
	leds: leds {
		compatible = "gpio-leds";

		led_status_green: status_green {
			label = "green:status";
			gpios = <&gpio 14 GPIO_ACTIVE_HIGH>;
			color = <LED_COLOR_ID_GREEN>;
			function = LED_FUNCTION_STATUS;
			default-state = "on";
		};

		led_status_amber: status_amber {
			label = "amber:status";
			gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
			color = <LED_COLOR_ID_AMBER>;
			function = LED_FUNCTION_STATUS;
		};
			
		led_status_red: status_red {
			label = "red:status";
			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
			color = <LED_COLOR_ID_RED>;
			function = LED_FUNCTION_PANIC;			
		};
	};
	
	keys {
		compatible = "gpio-keys";

		reset {
			label = "Reset button";
			linux,code = <KEY_RESTART>;
			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
			debounce-interval = <60>;
		};
	};
};

&spi {
	status = "okay";

	flash@0 {
		#address-cells = <1>;
		#size-cells = <1>;
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <25000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			uboot: partition@0 {
				label = "u-boot";
				reg = <0x000000 0x020000>;
				read-only;
			};

			partition@20000 {
				label = "partition-table";
				reg = <0x020000 0x010000>;
				read-only;
			};

			info: partition@30000 {
				label = "info";
				reg = <0x030000 0x010000>;
				read-only;
			};

			partition@40000 {
				label = "firmware";
				reg = <0x040000 0x780000>;
				compatible = "tplink,firmware";
			};

			config: partition@7c0000 {
				label = "config";
				reg = <0x7c0000 0x030000>;
				read-only;
			};

			art: partition@7f0000 {
				label = "art";
				reg = <0x7f0000 0x010000>;
				read-only;
			};
		};
	};
};

&eth0 {
	status = "okay";

	phy-handle = <&swphy4>;

	nvmem-cells = <&macaddr_info_8>;
	nvmem-cell-names = "mac-address";
};

&wmac {
	status = "okay";

	mtd-cal-data = <&art 0x1000>;
	nvmem-cells = <&macaddr_info_8>;
	nvmem-cell-names = "mac-address";
};

&info {
	compatible = "nvmem-cells";
	#address-cells = <1>;
	#size-cells = <1>;

	macaddr_info_8: macaddr@8 {
		reg = <0x8 0x6>;
	};
};
...and modifications in tplink-safeloader.c
user@2f4e8d5980b0:/home/openwrt$ diff ../bak/tplink-safeloader.bak ./build_dir/host/firmware-utils-2022-04-25-ddc3e00e/src/tplink-safeloader.c  --color -c
*** ../bak/tplink-safeloader.bak        Sun Apr 24 20:35:46 2022
--- ./build_dir/host/firmware-utils-2022-04-25-ddc3e00e/src/tplink-safeloader.c Sat Dec 10 12:05:53 2022
***************
*** 1518,1523 ****
--- 1518,1553 ----
                .last_sysupgrade_partition = "file-system"
        },
  
+       /** Firmware layout for the EAP115 V4 */
+       {
+               .id     = "EAP115V4",
+               .vendor = "",
+               .support_list =
+                       "SupportList:\r\n"
+                       "EAP110-Outdoor(TP-LINK|UN|N300-2):3.0\r\n"
+                       "EAP110(TP-LINK|UN|N300-2):4.0  841\r\n"
+                       "EAP115-Wall(TP-LINK|UN|N300-2):1.0\r\n"
+                       "EAP115(TP-LINK|UN|N300-2):4.0  841\r\n",
+ 
+               .soft_ver = SOFT_VER_DEFAULT,
+ 
+               .partitions = {
+                       {"fs-uboot", 0x00000, 0x20000},
+                       {"partition-table", 0x20000, 0x02000},
+                       {"default-mac", 0x30000, 0x01000},
+                       {"support-list", 0x31000, 0x00100},
+                       {"product-info", 0x31100, 0x00400},
+                       {"soft-version", 0x32000, 0x00100},
+                       {"firmware", 0x40000, 0x780000},
+                       {"user-config", 0x7c0000, 0x30000},
+                       {"radio", 0x7f0000, 0x10000},
+                       {NULL, 0, 0}
+               },
+ 
+               .first_sysupgrade_partition = "os-image",
+               .last_sysupgrade_partition = "file-system"
+       },
+ 
        /** Firmware layout for the EAP120 */
        {
                .id     = "EAP120",

The initramfs kernel image works okay (sideload from console and tested uci and manual configurations for both AP and STA mode - remember these settings aren't persistent).

The file is shared here openwrt-ath79-generic-tplink_eap115-v4-initramfs-kernel.bin. Feel free to test it more and provide feedback.

My next steps are:

  • Verify factory and sysupgrade images format/content/size
  • Find way to flash factory image from stock firmware - probably need to patch TP-Link's uclited utility, however my bin differs to the one from here

Hey, sorry for the late reply. I just noticed that I am possibly looking at a different device - TP-Link EAP115-Wall is what I want to use. I guess they could be similar (judging by comments on this thread). Once I have a bit of time I will try and flash your progress so far and see what happens. I need to read up on the whole openwrt dev process a bit.

Again, thanks for your hard work so far!

1 Like

Stock firmware for both devices (EAP115 and -Wall) are the same. Prior flashing backup original ROM content (at minimum ART partition), than try initramfs image which works from RAM. That's safe way to test prior overwrite stock firmware. Would be good if you make serial console alive, but for this you need to open the device and solder 5-pin header and maybe 3 resistors.

1 Like

I finally got the AP (EAP115-WALL) in the mail today. Opened it up - looks a bit different from your PCB. Edit: There are indeed the same footprints as on your board here, see third image.

I will try and get serial working for uboot on the weekend to see if I can follow what you did so far.



2 Likes

Have you tried the tftp recovery details of 192.168.1.10 as the server and 192.168.1.1 as the device?

I saw it on the bootlog and was wondering if the EAP115 is looking for a certain filename that would be visible using wireshark or tshark.

Alternatively the eap225 flash process may work:

Great you are here back - good to have someone contributing to this port. Would be helpful if you can make some more zoom in photo to read some component references and check whether are populated:

  1. Zoom in J3 header and a few resistors on the left.
  2. Right edge of the SoC (there is oscilator in metal can nearby) with a few of the resistors in the middle
  3. LEDs - how many of them? What color?

Hi @hecatae
I didn't try tftp recovery yet. From the begining assumed will need console working.
I've looked on other devices port e.g. EAP2x5. Their solution looks promissing. Hope will have some spare time and post progress soon.

After a few weeks of break here is what I was able to achieve so far.

  1. Build three images: initramfs (this time with ELF loader therefore use bootelf in u-boot), factory and sysupgrade with following receipt similar to EAP2x5 devices (additions in generic-tp-link.mk)
define Device/tplink-eap11x
  $(Device/tplink-safeloader)
  LOADER_TYPE := elf
  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel
  KERNEL_INITRAMFS := $$(KERNEL)
  IMAGE/factory.bin := append-rootfs | tplink-safeloader factory | \
        pad-extra 128
endef

define Device/tplink_eap115-v4
  $(Device/tplink-eap11x)
  SOC := qca9533
  IMAGE_SIZE := 7680k
  DEVICE_MODEL := EAP115
  DEVICE_VARIANT := v4
  DEVICE_PACKAGES := -rssileds
  TPLINK_BOARD_ID := EAP115V4
endef
TARGET_DEVICES += tplink_eap115-v4
  1. Succeed with disabling signature check (ssh login and cliclientd cs command) and flashing "poisoned" 5.0.4 OEM firmware (one with fake signature at the end of image) to check if web flashing really accepts images w/o valid signature. THIS SOLUTION WORKS :slight_smile:

  2. I've also successfully downgrade OEM firmware from 5.0.0 to 3.20.0, and bring it back to 5.0.4

  3. Tried to flash my build3 factory image from TP-Link's web utility. But here it fails probably at firmware or HW version check. It looks that tplink-safeloader.c doesn't generate version number and/or HW version. Investigation in progress.

Flashing start logs - various scenarios
>>>> Flash OpenWRT factory <<<< (FAILED!)

memFree = 21921792
[utilities_debug: getFirmwareRpm:148]get request
[NM_Debug](nm_fwup_buildUpgradeStruct) 02009: nFileBytes = 5459775
[NM_Debug](nm_lib_getProductInfoFromNvram) 00928: productinfo from NVRAM is (EAP115(TP-LINK|UN|N300-2):4.0
key=BgIAAAAkAABSU0ExAAQAAAEAAQDZtUNzD6KsxO4Tfx/Sp8S7w8TwPWwoppXy77wSPNs5WoV+Wr4kh09nu70vHVmSPji5KFUG+hmRjapsJsIJj+M0Zmd4EycKY8r0Ea3D4XO/uvloX4VHVPsDZkm8Krian5iNy6BgApVlebx0zQxto0GkgvPBq1nhoZxJNapLghGO7w==
rsaKey=BgIAAACkAABSU0ExAAQAAAEAAQC33Ux/UTRSBo17Xm/eESv+2ZRoomAXfr1LIk2PbKmBLSldPpfeCH/m4rhY4wLiXqAke7DiRZkK6xjdahNG3uzffdaRZaxTjzY/UqsWJaqlP08Q+p1tF8YfqqeEn3WqCG6nVxmCvoIH8t3xTZQ8RgDNWdO7v1IBARwN/8ffyjr4uQ==
HWID=7E639B5E49FED83E06C86CAB70E151EF
)

[NM_Debug](checkSupportList) 00925: Firmwave supports EAP115(TP-LINK|UN|N300-2):4.0, check OK..
[NM_NOTICE](nm_fwup_getFirmwareSoftVersion) 02470: Soft-version Ptn size in fw is 13, not have addiHardwareVer, set to default 0.

[NM_Debug](nm_fwup_verifyFwupFile) 02244: curSoftVer:5.0.4 Build 20220216 Rel. 57495,newSoftVer:0.0.0 Build 20221014 Rel. 19803

AddiHardwareVer check: NEW(0x0) >= CUR(0x1), Failed, Refuse upgrade!
[Error][checkFirmware] 273: nm_api_verifyFwupFile failed, errCode 50008


>>> OEM firmware upgrade: 3.20.0 -> 5.0.4 <<< (SUCCEED)
[utilities_debug: postFirmwareRpm:207]post request
memFree = 20676608
[utilities_debug: getFirmwareRpm:148]get request
[NM_Debug](nm_fwup_buildUpgradeStruct) 01989: nFileBytes = 5690825
[NM_Debug](nm_lib_getProductInfoFromNvram) 00930: productinfo from NVRAM is (EAP115(TP-LINK|UN|N300-2):4.0
key=BgIAAAAkAABSU0ExAAQAAAEAAQDZtUNzD6KsxO4Tfx/Sp8S7w8TwPWwoppXy77wSPNs5WoV+Wr4kh09nu70vHVmSPji5KFUG+hmRjapsJsIJj+M0Zmd4EycKY8r0Ea3D4XO/
uvloX4VHVPsDZkm8Krian5iNy6BgApVlebx0zQxto0GkgvPBq1nhoZxJNapLghGO7w==
rsaKey=BgIAAACkAABSU0ExAAQAAAEAAQC33Ux/UTRSBo17Xm/eESv+2ZRoomAXfr1LIk2PbKmBLSldPpfeCH/m4rhY4wLiXqAke7DiRZkK6xjdahNG3uzffdaRZaxTjzY/UqsWJ
aqlP08Q+p1tF8YfqqeEn3WqCG6nVxmCvoIH8t3xTZQ8RgDNWdO7v1IBARwN/8ffyjr4uQ==
HWID=7E639B5E49FED83E06C86CAB70E151EF
)

[NM_Debug](checkSupportList) 00908: Firmwave supports EAP115(TP-LINK|UN|N300-2):4.0, check OK..
[NM_Debug](nm_fwup_verifyFwupFile) 02223: curSoftVer:3.20.0 Build 20200525 Rel. 36931,newSoftVer:5.0.4 Build 20220216 Rel. 57495

AddiHardwareVer check: NEW(0x1) >= CUR(0x1), Success.

>>>> OEM firmware downgrade 5.0.0 -> 3.20.0 <<< (SUCCEED)

[utilities_debug: postFirmwareRpm:207]post request
memFree = 20492288
[utilities_debug: getFirmwareRpm:148]get request
[NM_Debug](readFlashPublicKey) 00175: key=: BgIAAAAkAABSU0ExAAQAAAEAAQDZtUNzD6KsxO4Tfx/Sp8S7w8TwPWwoppXy77wSPNs5WoV+Wr4kh09nu70vHVmSPji5
KFUG+hmRjapsJsIJj+M0Zmd4EycKY8r0Ea3D4XO/uvloX4VHVPsDZkm8Krian5iNy6BgApVlebx0zQxto0GkgvPBq1nhoZxJNapLghGO7w==!

Rsa verify success
MD5 verify success!
[NM_NOTICE](nm_fwup_verifyFwupFile) 02195: checkFwupMd5Rsa [  107.620000] [Debug led_proc_write:633] Write led_green.
success!

[NM[  107.628000] [Debug led_common_write_proc:472] Execute LED action: _Debug](nm_fwup_        { 1   1   0   0   0 }
buildUpgradeStruct) 01992: nFileBytes = 5423245
[NM_Debug](nm_lib_getProductInfoFromNvram) 00928: productinfo from NVRAM is (EAP115(TP-LINK|UN|N300-2):4.0
key=BgIAAAAkAABSU0ExAAQAAAEAAQDZtUNzD6KsxO4Tfx/Sp8S7w8TwPWwoppXy77wSPNs5WoV+Wr4kh09nu70vHVmSPji5KFUG+hmRjapsJsIJj+M0Zmd4EycKY8r0Ea3D4XO/
uvloX4VHVPsDZkm8Krian5iNy6BgApVlebx0zQxto0GkgvPBq1nhoZxJNapLghGO7w==
rsaKey=BgIAAACkAABSU0ExAAQAAAEAAQC33Ux/UTRSBo17Xm/eESv+2ZRoomAXfr1LIk2PbKmBLSldPpfeCH/m4rhY4wLiXqAke7DiRZkK6xjdahNG3uzffdaRZaxTjzY/UqsWJ
aqlP08Q+p1tF8YfqqeEn3WqCG6nVxmCvoIH8t3xTZQ8RgDNWdO7v1IBARwN/8ffyjr4uQ==
HWID=7E639B5E49FED83E06C86CAB70E151EF
)

[NM_Debug](checkSupportList) 00908: Firmwave supports EAP115(TP-LINK|UN|N300-2):4.0, check OK..
[NM_Debug](nm_fwup_verifyFwupFile) 02227: curSoftVer:5.0.0 Build 20200914 Rel. 52854,newSoftVer:3.20.0 Build 20200525 Rel. 36931

AddiHardwareVer check: NEW(0x1) >= CUR(0x1),

Any suggestions how to verify generated images of OpenWRT in compliance with SafeLoader format are very welcome.

Hi All, and Happy New Year!

I just became aware of this discussion. I've been tinkering with a EAP110-Outdoor v3 and a EAP110 v4, which seem to be siblings of the EAP115 variants being discussed here. It looks like we should be able to come up with a solution that covers all four variants if we combine efforts.

My approach so-far has slightly less thorough - I replaced u-boot with the CPE210 v3 version as discussed here and then addad target devices with new DTS for the EAP110*, but using CPE210V3 for the TPLINK_BOARD_ID. These images work for recovery (using the CPE210 v3 u-boot) and sysupgrade, but I assume they wouldn't work for install from TP-Link factory state. My next step would have been to look into tplink-safeloader to try to make images that are not for CPE210V3, but...

Unfortunately I didn't make a copy of u-boot before I overwrote it with the CPE210 v3 version. I wonder if the same u-boot is used across all four variants, of if there's a specific version for each. Does anyone have copies of theirs? I'd be interesting to compare them, and if I get brave enough, maybe write one to one of my devices and hope I don't brick it :slight_smile:

A few nit-picks related to LEDs...

  • We're not supposed to include default-state in the definitions (see Submitting patches / DTS checklist.
  • I don't think it's necessary to specify color or function - seems only necessary to specify aliases to cover the OpenWRT functions.
  • I don't think it's necessary to explicitly exclude rssileds from DEVICE_PACKAGES in the target device spec - just don't set DEVICE_PACKAGES at all

I think it'd be better to develop against the master branch, vs 22.03, since a submission would have to be submitted as PR against master, no?

I'm on the discord server during UK daytime if realtime discussion would be useful...

Hi @Dseven
Good to see you here for contribution.

You have a few options: leave as it is, overwrite by EAP115v4 u-boot (you can find on my google repo in bak folder) or wait until someones will share your's device original u-boot image.

I strongly recommend prior next steps you make a backup for everything else in ROM (see Method 2 as per backup post above)

Thank you for remarks. I'll correct default-state in next build, for color and function will leave it for clarity (especially while RED LED is not explicitly used in OpenWRT). I've removed rssileds package by purpose while my device have only one LED spot with three different colors which make use of this package unreasonable.

I'm not fluent in all these branches, gits, multiple repos. This definitively need a touch of person capable of these modern software engineering tools. Here will need help for sure, but leave it for a while until we are certain the build images are working fine and stable. Hope time for clean up will come soon.

The point about rssileds is that you don't have to remove it - you just don't add it in the first place!

I suppose the reviewers will eventually let you know about color and function, but I think they are not appropriate. I don't know for sure, though.

BTW, the EAP110-Outdoor v3 and EAP110 v4 do not have a red LED at all - it appears that there is a space for it on the v4 board, but it is not populated. My Outdoor is assembled right now, so I can't check if it is the same. Anyway, they are not present. Also BTW. the GPIOs for the Outdoor are different from (they are 12 and 11, and active low).

You might be digging yourself further into a hole (you'll have to refactor your changes to fit the latest master code - maybe not that big of a deal). I would just check out the git repo and make your changes to the master branch (the default one), since that's what you'll need to submit a patch for.

I've fine tuned EAP115v4 definitions in tplink-safeloader.c and final was able to generate factory image (build4) flashable via TP-Link's web interface. Unfortunately this image has problem to mount rootfs. So need to investigate more how to overcome this issue.

OpenWRT start log (build4 factory image flashed in ROM) - fail with VFS mount
U-Boot 1.1.4--LSDK-10.2-00082-4 (Nov  7 2016 - 15:13:37)

board953x - Honey Bee 2.0DRAM:
sri
Honey Bee 2.0
ath_ddr_initial_config(195): (16bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x5, 0x3b)
Tap values = (0x20, 0x20, 0x20, 0x20)
64 MB
Flash Manuf Id 0xc8, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Setting 0x181162c0 to 0x4081a100
Hit Ctrl+B to stop autoboot:  0
Loading .text @ 0x80060000 (2239584 bytes)
## Starting application at 0x80060000 ...


OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80060000...

[    0.000000] Linux version 5.10.146 (user@2f4e8d5980b0) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19803-9a599fee93) 11.2.0, GN
U ld (GNU Binutils) 2.37) #0 Fri Oct 14 22:44:41 2022
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is TP-Link EAP115 v4
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 56188K/65536K available (5462K kernel code, 602K rwdata, 1196K rodata, 1180K init, 200K bss, 9348K reserved, 0K c
ma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 650.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000010] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008342] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.074945] pid_max: default: 32768 minimum: 301
[    0.080014] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087726] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.098811] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.110084] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.120532] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.127872] pinctrl core: initialized pinctrl subsystem
[    0.135322] NET: Registered protocol family 16
[    0.220259] clocksource: Switched to clocksource MIPS
[    0.227174] NET: Registered protocol family 2
[    0.232169] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.240677] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.249594] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.257761] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.265217] TCP: Hash tables configured (established 1024 bind 1024)
[    0.272134] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.279059] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.286921] NET: Registered protocol family 1
[    0.291633] PCI: CLS 0 bytes, default 32
[    0.304905] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.316721] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.322945] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.338570] pinctrl-single 1804002c.pinmux: 576 pins, size 72
[    0.345928] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.353641] printk: console [ttyS0] disabled
[    0.358248] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.367446] printk: console [ttyS0] enabled
[    0.367446] printk: console [ttyS0] enabled
[    0.376522] printk: bootconsole [early0] disabled
[    0.376522] printk: bootconsole [early0] disabled
[    0.404759] spi-nor spi0.0: gd25q64 (8192 Kbytes)
[    0.409722] 6 fixed-partitions partitions found on MTD device spi0.0
[    0.417500] Creating 6 MTD partitions on "spi0.0":
[    0.422550] 0x000000000000-0x000000020000 : "u-boot"
[    0.432705] 0x000000020000-0x000000030000 : "partition-table"
[    0.440078] 0x000000030000-0x000000040000 : "info"
[    0.448906] 0x000000040000-0x0000007c0000 : "firmware"
[    0.456077] 0x0000007c0000-0x0000007f0000 : "config"
[    0.464993] 0x0000007f0000-0x000000800000 : "art"
[    1.161363] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    1.169490] i2c /dev entries driver
[    1.175379] NET: Registered protocol family 10
[    1.187195] Segment Routing with IPv6
[    1.191224] NET: Registered protocol family 17
[    1.195945] 8021q: 802.1Q VLAN Support v1.8
[    1.541343] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    1.881337] ag71xx 19000000.eth: Could not connect to PHY device. Deferring probe.
[    1.891060] /dev/root: Can't open blockdev
[    1.895325] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[    1.903117] Please append a correct "root=" boot option; here are the available partitions:
[    1.911785] 1f00             128 mtdblock0
[    1.911789]  (driver?)
[    1.918544] 1f01              64 mtdblock1
[    1.918547]  (driver?)
[    1.925319] 1f02              64 mtdblock2
[    1.925322]  (driver?)
[    1.932084] 1f03            7680 mtdblock3
[    1.932087]  (driver?)
[    1.938838] 1f04             192 mtdblock4
[    1.938841]  (driver?)
[    1.945604] 1f05              64 mtdblock5
[    1.945607]  (driver?)
[    1.952370] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)
[    1.960909] Rebooting in 1 seconds..
Initramfs image boot (build4)
OpenWrt kernel loader for AR7XXX/AR9XXX
Copyright (C) 2011 Gabor Juhos <juhosg@openwrt.org>
Decompressing kernel... done!
Starting kernel at 80060000...

[    0.000000] Linux version 5.10.146 (user@2f4e8d5980b0) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r19803-9a599fee93) 11.2.0, GN
U ld (GNU Binutils) 2.37) #0 Fri Oct 14 22:44:41 2022
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019374 (MIPS 24Kc)
[    0.000000] MIPS: machine is TP-Link EAP115 v4
[    0.000000] SoC: Qualcomm Atheros QCA9533 ver 2 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000003ffffff]
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 16240
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Inode-cache hash table entries: 4096 (order: 2, 16384 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 47164K/65536K available (5462K kernel code, 602K rwdata, 1196K rodata, 10204K init, 200K bss, 18372K reserved, 0K
 cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 650.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5880801374 ns
[    0.000010] sched_clock: 32 bits at 325MHz, resolution 3ns, wraps every 6607641598ns
[    0.008341] Calibrating delay loop... 432.53 BogoMIPS (lpj=2162688)
[    0.074945] pid_max: default: 32768 minimum: 301
[    0.080012] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087717] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.098804] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.110079] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.120524] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.127862] pinctrl core: initialized pinctrl subsystem
[    0.135315] NET: Registered protocol family 16
[    0.220039] clocksource: Switched to clocksource MIPS
[    0.226966] NET: Registered protocol family 2
[    0.231963] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.240471] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.249386] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.257550] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.265009] TCP: Hash tables configured (established 1024 bind 1024)
[    0.271928] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.278851] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.286706] NET: Registered protocol family 1
[    0.291427] PCI: CLS 0 bytes, default 32
[    0.520662] workingset: timestamp_bits=14 max_order=14 bucket_order=0
[    0.532435] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.538588] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.554365] pinctrl-single 1804002c.pinmux: 576 pins, size 72
[    0.561792] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.569360] printk: console [ttyS0] disabled
[    0.574070] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 1562500) is a 16550A
[    0.583211] printk: console [ttyS0] enabled
[    0.583211] printk: console [ttyS0] enabled
[    0.592285] printk: bootconsole [early0] disabled
[    0.592285] printk: bootconsole [early0] disabled
[    0.618046] spi-nor spi0.0: gd25q64 (8192 Kbytes)
[    0.623110] 6 fixed-partitions partitions found on MTD device spi0.0
[    0.630898] Creating 6 MTD partitions on "spi0.0":
[    0.635882] 0x000000000000-0x000000020000 : "u-boot"
[    0.648318] 0x000000020000-0x000000030000 : "partition-table"
[    0.655786] 0x000000030000-0x000000040000 : "info"
[    0.664620] 0x000000040000-0x0000007c0000 : "firmware"
[    0.671802] 0x0000007c0000-0x0000007f0000 : "config"
[    0.680785] 0x0000007f0000-0x000000800000 : "art"
[    1.104642] switch0: Atheros AR8229 rev. 1 switch registered on mdio.0
[    1.502220] ag71xx 19000000.eth: connected to PHY at mdio.0:1f:04 [uid=004dd042, driver=Generic PHY]
[    1.512492] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: mii
[    1.519140] i2c /dev entries driver
[    1.525054] NET: Registered protocol family 10
[    1.539830] Segment Routing with IPv6
[    1.543869] NET: Registered protocol family 17
[    1.548585] 8021q: 802.1Q VLAN Support v1.8
[    1.638479] Freeing unused kernel memory: 10204K
[    1.643304] This architecture does not have kernel memory protection.
[    1.649968] Run /init as init process
[    2.284355] init: Console is alive
[    2.288589] init: - watchdog -
[    2.324586] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    2.340808] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    2.359056] init: - preinit -
[    2.736315] random: jshn: uninitialized urandom read (4 bytes read)
[    2.912844] random: jshn: uninitialized urandom read (4 bytes read)
[    2.957552] random: jshn: uninitialized urandom read (4 bytes read)
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    7.445386] procd: - early -
[    7.448927] procd: - watchdog -
[    8.066633] procd: - watchdog -
[    8.072364] procd: - ubus -
[    8.088513] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.126679] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.134133] random: ubusd: uninitialized urandom read (4 bytes read)
[    8.145732] procd: - init -
Please press Enter to activate this console.
[    9.028750] kmodloader: loading kernel modules from /etc/modules.d/*
[    9.621831] Loading modules backported from Linux version v5.15.58-0-g7d8048d4e064
[    9.629674] Backport generated by backports.git v5.15.58-1-0-g42a95ce7
[    9.639259] urngd: v1.0.2 started.
[    9.976912] PPP generic driver version 2.4.2
[   10.001460] NET: Registered protocol family 24
[   10.153950] ieee80211 phy0: Atheros AR9531 Rev:2 mem=0xb8100000, irq=12
[   10.224740] random: crng init done
[   10.228284] random: 28 urandom warning(s) missed due to ratelimiting
[   10.240771] kmodloader: done loading kernel modules from /etc/modules.d/*



BusyBox v1.35.0 (2022-10-14 22:44:41 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 22.03.2, r19803-9a599fee93
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/#