Support for Yuncore XD6700

Hi ,
I have a number of these ceiling mounted AP's which are running a customized lede from Yuncore. I am in the process of getting access to the OS so I can see what is required to create a patch for the system.
I am comfortable around Linux / c programming, so hopefully I should be able to do most of this on my own but I may come looking for help....


Replying to thread: The system is easily accessible by removing covers (4 screws) and attaching serial cable to motherboard (tx / rx / gnd & 3.3v pins connected and presented) which allows access to remount squashfs and reset root passwd.
CPU revision is 00019374 (Mips 24Kc)
SoC is Qualcomm Atheros QCA9531 rev 2

[ 0.790000] ag71xx_mdio: probed
[ 0.820000] ar8216: Unknown Atheros device [ver=2, rev=1, phy_id=004dd042]
[ 0.850000] ar8216: Unknown Atheros device [ver=2, rev=1, phy_id=004dd042]
[ 0.870000] ar8216: Unknown Atheros device [ver=2, rev=1, phy_id=004dd042]
[ 0.900000] ar8216: Unknown Atheros device [ver=2, rev=1, phy_id=004dd042]
[ 0.920000] ar8216: Unknown Atheros device [ver=2, rev=1, phy_id=004dd042]
[ 0.930000] ag71xx_mdio: probed
[ 0.930000] eth0: Atheros AG71xx at 0xb9000000, irq 4
[ 1.490000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.1:04 [uid=004dd042, driver=Generic PHY]
[ 1.500000] eth1: Atheros AG71xx at 0xba000000, irq 5
[ 2.060000] eth1: Found an AR934X built-in switch

[ 19.830000] ath_hal: (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
[ 19.850000] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved

cmdline board=AP147 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot),64k(u-boot-env),14528k(rootfs),1472k(kernel),64k(art),16000k@0x50000(firmware) rootfstype=squashfs,jffs2 noinitrd

root@XD6700:~# cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00e30000 00010000 "rootfs"
mtd3: 00420000 00010000 "rootfs_data"
mtd4: 00170000 00010000 "kernel"
mtd5: 00010000 00010000 "art"
mtd6: 00fa0000 00010000 "firmware"

A question, looking at some of the git commits to add support for devices and the cmdline above

how does this equate to the configuration in image/ I see an exact match to this structure for the Buffalo BHR-4GRV2. Do I need to specify all the above parameters in the MTDPARTS declaration ? Is the following correct ?

define Device/xd6700
DEVICE_TITLE := YunCore XD6700
DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca988x
CONSOLE = ttyS0,115200
ROOTFS_SIZE := 14528k
KERNEL_SIZE := 1472k
IMAGE_SIZE := 16000k
MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env)ro,14528k(rootfs),1472k(kernel),64k(art)ro,16000k@0x50000(firmware)
IMAGES := sysupgrade.bin factory.bin
IMAGE/sysupgrade.bin := append-rootfs | pad-rootfs | pad-to $$$$(ROOTFS_SIZE) | append-kernel | check-size $$$$(IMAGE_SIZE)
IMAGE/factory.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | append-rootfs | pad-rootfs | mkbuffaloimg


normaly you need only to set


is the


partition at the end of the flash??
it looks like ...
Then please add this to.

kernel, rootfs, rootfs_data are normally calculated during build
Look for similar layouts with 16MiB flash, I remember some templates for this.

Thanks for the update, just compiling etc now.
The uboot has a bootdelay of 2 sec so a -c interupts it and gives a uboot prompt
The default IP is and it looks to connect to a server on
and looks like it trys to load uboot, firmware and linux in that order

bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init
bootcmd=bootm 0x9fe80000
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize lf=tftp 0x80060000 ${dir}ap152${bc}-jffs2&&erase 0x9f050000
+0xE30000&&cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9fe80000
+$filesize&&cp.b $fileaddr 0x9fe80000 $filesize

Environment size: 700/65532 bytes

The original firmware installed was openwrt 12_09_beta1 running a 3.8.8.... which is just a bit out of date.... Have managed to get patched Lede with initrd booting from uboot tftp so happy that I am making progress. Will try copy the sysupgrade image and see how it runs from the device now I'm happy I can boot from initrd image

Hi ruairi.hickey

I have ordered this product for 10 pcs from Yuncore.
I called them for a openwrt firmware which I can access root.
They gave me a openwrt firmware name XD9531-9887.
I install the firmware on web gui after finish. I need to reset the device by press reset button.
After that I can access to ssh on openwrt.
I install lede 17.01.02

by follow the instruction from pepe2k.

Flash instruction under vendor firmware, using telnet/SSH:

  1. If your firmware does not have root password, go to point 5
  2. Connect PC with 192.168.1.x address to LAN or WAN port
  3. Power up device, enter failsafe mode with button (no LED indicator!)
  4. Change root password and reboot (mount_root, passwd ..., reboot -f)
  5. Upload lede-ar71xx-...-sysupgrade.bin to /tmp using SCP
  6. Connect PC with 192.168.188.x address to LAN port, SSH to
  7. Invoke:
  • cd /tmp
  • fw_setenv bootcmd "bootm 0x9fe80000 || bootm 0x9f050000"
  • mtd -e firmware -r write lede-ar71xx-...-sysupgrade.bin firmware

Now I can install lede to the device 2.4GHZ work good but BAD NEWS is 5GHZ not work.
I waiting driver for 5GHZ.

Can you advice me?

I have created a patch for the source based on the patch from pepe and have compiled and installed. I have the two test routers connected to a raspberry pi vis USB to ttl so I can muck about with them. The patch from this morning looks to have a functioning 5GHz as I get it to list when running iw phy. I will work on it some more tonight and if it is working I will post a patch here....


I was able to get the updated lede installed and the wireless works perfectly, both 2.4 & 5.8... I must have made a config error when building as eth1 is no longer showing... I will have a look at this tonight .. I can email you a patch (not sure if I'm allowed post them here)


I have the router booting, both wireless radios working, ethernet ports & switch working. I need to check if I have the lan wan descriptions matched to the case... I will put the case back together again to check. But as there has been a request I am posting patch to current tree to add support for xd6700.


  • Check eth0 eth1 matches LAN WAN definition
  • Check gpio settings to ensure they are correct..

Patch below....
indent preformatted text by 4 spaces

diff --git a/target/linux/ar71xx/base-files/etc/board.d/01_leds b/target/linux/ar71xx/base-files/etc/board.d/01_leds
index 84b1a7dfd9..127e3cb9cf 100755
--- a/target/linux/ar71xx/base-files/etc/board.d/01_leds
+++ b/target/linux/ar71xx/base-files/etc/board.d/01_leds
@@ -96,6 +96,7 @@ ap147-010)
        ucidef_set_led_wlan "wlan2g" "WLAN 2.4 GHz" "ap147:green:wlan-2g" "phy0tpt"
diff --git a/target/linux/ar71xx/base-files/etc/board.d/02_network b/target/linux/ar71xx/base-files/etc/board.d/02_network
index 5889b2bf80..4e65ac36ae 100755
--- a/target/linux/ar71xx/base-files/etc/board.d/02_network
+++ b/target/linux/ar71xx/base-files/etc/board.d/02_network
@@ -455,7 +455,8 @@ ar71xx_setup_interfaces()
                        "0@eth0" "1:lan" "2:wan"
-       xd3200)
+       xd3200|\
+        xd6700)
                ucidef_add_switch "switch0" \
                        "0@eth0" "2:lan" "3:wan"
diff --git a/target/linux/ar71xx/base-files/etc/ b/target/linux/ar71xx/base-files/etc/
index 7753a7156d..2ef50d642e 100644
--- a/target/linux/ar71xx/base-files/etc/
+++ b/target/linux/ar71xx/base-files/etc/
@@ -27,7 +27,8 @@ get_status_led() {
-       xd3200)
+       xd3200|\
+       xd6700)
diff --git a/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata b/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
index 6a50e0c86e..7872ed4f67 100644
--- a/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
+++ b/target/linux/ar71xx/base-files/etc/hotplug.d/firmware/11-ath10k-caldata
@@ -65,7 +65,8 @@ case "$FIRMWARE" in
-       xd3200)
+       xd3200|\
+        xd6700)
                ath10kcal_extract "art" 20480 2116
diff --git a/target/linux/ar71xx/base-files/lib/ b/target/linux/ar71xx/base-files/lib/
index 7fd5fb4522..d1b78317a3 100755
--- a/target/linux/ar71xx/base-files/lib/
+++ b/target/linux/ar71xx/base-files/lib/
@@ -1318,6 +1318,9 @@ ar71xx_board_detect() {
+       *"XD6700")
+               name="xd6700"
+               ;;
diff --git a/target/linux/ar71xx/base-files/lib/upgrade/ b/target/linux/ar71xx/base-files/lib/upgrade/
index 05b5634aa5..0f4b54a143 100755
--- a/target/linux/ar71xx/base-files/lib/upgrade/
+++ b/target/linux/ar71xx/base-files/lib/upgrade/
@@ -297,7 +297,8 @@ platform_check_image() {
-       xd3200)
+       xd3200|\
+        xd6700)
                [ "$magic" != "2705" ] && {
                        echo "Invalid image type."
                        return 1
diff --git a/target/linux/ar71xx/config-4.4 b/target/linux/ar71xx/config-4.4
index 70793af3a3..912a8f7c44 100644
--- a/target/linux/ar71xx/config-4.4
+++ b/target/linux/ar71xx/config-4.4
@@ -247,6 +247,7 @@ CONFIG_ATH79_MACH_WZR_HP_G300NH=y
 # CONFIG_ATH79_MACH_Z1 is not set
diff --git a/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt b/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
index ff9c3037a1..5e645a9287 100644
--- a/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
+++ b/target/linux/ar71xx/files/arch/mips/ath79/Kconfig.openwrt
@@ -482,12 +482,24 @@ config ATH79_MACH_WPJ563
 config ATH79_MACH_XD3200
        bool "YunCore XD3200 support"
-       select SOC_QCA956X
+        select SOC_QCA956X
+        select ATH79_DEV_ETH
+        select ATH79_DEV_GPIO_BUTTONS
+        select ATH79_DEV_LEDS_GPIO
+        select ATH79_DEV_M25P80
+        select ATH79_DEV_USB
+        select ATH79_DEV_WMAC
+config ATH79_MACH_XD6700
+       bool "YunCore XD6700 support"
+        select SOC_QCA956X
+       select SOC_QCA953X
        select ATH79_DEV_AP9X_PCI if PCI
        select ATH79_DEV_ETH
        select ATH79_DEV_GPIO_BUTTONS
        select ATH79_DEV_LEDS_GPIO
        select ATH79_DEV_M25P80
+        select ATH79_DEV_USB
        select ATH79_DEV_WMAC
 config ATH79_MACH_DGL_5500_A1
diff --git a/target/linux/ar71xx/files/arch/mips/ath79/Makefile b/target/linux/ar71xx/files/arch/mips/ath79/Makefile
index 469b6a794c..e25ab8fb6c 100644
--- a/target/linux/ar71xx/files/arch/mips/ath79/Makefile
+++ b/target/linux/ar71xx/files/arch/mips/ath79/Makefile
@@ -252,6 +252,7 @@ obj-$(CONFIG_ATH79_MACH_WZR_HP_G300NH)              += mach-wzr-hp-g300nh.o
 obj-$(CONFIG_ATH79_MACH_WZR_HP_G300NH2)                += mach-wzr-hp-g300nh2.o
 obj-$(CONFIG_ATH79_MACH_WZR_HP_G450H)          += mach-wzr-hp-g450h.o
 obj-$(CONFIG_ATH79_MACH_XD3200)                        += mach-sr3200.o
+obj-$(CONFIG_ATH79_MACH_XD6700)                        += mach-xd6700.o
 obj-$(CONFIG_ATH79_MACH_Z1)                    += mach-z1.o
 obj-$(CONFIG_ATH79_MACH_ZBT_WE1526)            += mach-zbt-we1526.o
 obj-$(CONFIG_ATH79_MACH_ZCN_1523H)             += mach-zcn-1523h.o
diff --git a/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h b/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
index 5bc50a42ff..6001af1ada 100644
--- a/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
+++ b/target/linux/ar71xx/files/arch/mips/ath79/machtypes.h
@@ -326,6 +326,7 @@ enum ath79_mach_type {
        ATH79_MACH_WZR_HP_G300NH2,              /* Buffalo WZR-HP-G300NH2 */
        ATH79_MACH_WZR_HP_G450H,                /* Buffalo WZR-HP-G450H */
        ATH79_MACH_XD3200,                      /* YunCore XD3200 */
+       ATH79_MACH_XD6700,                      /* YunCore XD6700 */
        ATH79_MACH_Z1,                          /* Cisco Meraki Z1 */
        ATH79_MACH_ZBT_WE1526,                  /* Zbtlink ZBT-WE1526 */
        ATH79_MACH_ZCN_1523H_2,                 /* Zcomax ZCN-1523H-2-xx */
diff --git a/target/linux/ar71xx/image/ b/target/linux/ar71xx/image/
index 01c5bdc677..0c43492138 100644
--- a/target/linux/ar71xx/image/
+++ b/target/linux/ar71xx/image/
@@ -660,6 +660,17 @@ define Device/xd3200
+define Device/xd6700
+  DEVICE_TITLE := YunCore XD6700
+  DEVICE_PACKAGES := kmod-usb-core kmod-usb2 kmod-ath10k ath10k-firmware-qca988x
+  CONSOLE = ttyS0,115200
+  MTDPARTS := spi0.0:256k(u-boot)ro,64k(u-boot-env),16000k(firmware),64k(art)ro
 define Device/tellstick-znet-lite
   DEVICE_TITLE := TellStick ZNet Lite

Thank you so much for your update. I 'm a firmware user. I 'm not a developer.
Please let me know a detail how to make a 5GHZ work.

Or please let me know when device is support on snapshot.

Thank you.

I have just finished the patch and will get a fork of the tree to make a
patch for uploading for submission...

If you would like a copy of the an image to test you can download them from...


I have submitted a pull request from my tree to master to add my patches - I hope I did this correctly, it's the first time I've done this.... Let me know if I've messed up...


hi, @ruairi.hickey
I also have this boards, and i tried to use the firmwares you made
using this firmware the 5Ghz works, but VLAN is not working,
using this firmware VLAN works, but 5Ghz not working

do you or could you please upload patches for VLAN?


I believe there is a switch behind one of the ports - I will have a look tonight and edit the build


Hi, looking at the config of the device shows

root@XD6700:~# ls -l /sys/class/net
lrwxrwxrwx 1 root root 0 Oct 30 10:37 ath0 -> ../../devices/virtual/net/ath0
lrwxrwxrwx 1 root root 0 Oct 30 10:37 ath1 -> ../../devices/virtual/net/ath1
lrwxrwxrwx 1 root root 0 Oct 30 10:37 bond0 -> ../../devices/virtual/net/bond0
-rw-r--r-- 1 root root 4096 Oct 30 10:37 bonding_masters
lrwxrwxrwx 1 root root 0 Oct 30 10:37 br-lan -> ../../devices/virtual/net/br-lan
lrwxrwxrwx 1 root root 0 Jan 1 1970 eth0 -> ../../devices/platform/ag71xx.0/net/eth0
lrwxrwxrwx 1 root root 0 Jan 1 1970 eth1 -> ../../devices/platform/ag71xx.1/net/eth1
lrwxrwxrwx 1 root root 0 Oct 30 10:37 ifb0 -> ../../devices/virtual/net/ifb0
lrwxrwxrwx 1 root root 0 Oct 30 10:37 ifb1 -> ../../devices/virtual/net/ifb1
lrwxrwxrwx 1 root root 0 Jan 1 1970 lo -> ../../devices/virtual/net/lo
lrwxrwxrwx 1 root root 0 Jan 1 1970 teql0 -> ../../devices/virtual/net/teql0
lrwxrwxrwx 1 root root 0 Oct 30 10:37 wifi0 -> ../../devices/virtual/net/wifi0
lrwxrwxrwx 1 root root 0 Oct 30 10:37 wifi1 -> ../../devices/pci0000:00/0000:00:00.0/net/wifi1

with both network devices being physical, I believe that means vlans are configured in the OS as per the linked article... is that your thinking also ?


running swconfig shows a switch on eth1 (LAN interface)

swconfig dev eth1 show
Global attributes:
enable_vlan: 0
mirror_monitor_port: 15
Port 0:
enable_mirror_rx: 0
enable_mirror_tx: 0
pvid: 0
link: port:0 link:up speed:1000baseT full-duplex txflow rxflow
Port 1:
enable_mirror_rx: 0
enable_mirror_tx: 0
pvid: 0
link: port:1 link:down
Port 2:
enable_mirror_rx: 0
enable_mirror_tx: 0
pvid: 0
link: port:2 link:down
Port 3:
enable_mirror_rx: 0
enable_mirror_tx: 0
pvid: 0
link: port:3 link:down
Port 4:
enable_mirror_rx: 0
enable_mirror_tx: 0
pvid: 0
link: port:4 link:up speed:100baseT full-duplex auto
vid: 0
ports: 0 1 2 3 4

Port 0 is the WAN port, runs as GB ethernet which Port 4 is the physical LAN port, restricted to 100MB...

You can enable VLAN's by typing

swconfig dev eth1 set enable_vlan 1


Hi Ruairi,
until now,i had not been able to set the vlan for this device
also if u dont mind, i have another question, when using the firmware, do you have problem with some Kitkat and Lollipop android?
mostly is when u put more than 10 device under one subnet.
Android kit kat and lollipop will have problem when connecting, but iphone, laptop will not have any issue


Hi ruairi,
i flashed this image on this board last month.

i just realized that there's no switch in luci web interface
then i tried to enable vlan with

swconfig dev eth1 set enable_vlan 1
swconfig dev eth1 set apply

then i check

swconfig dev eth1 show

it works, but then after reboot it changes back to enable_vlan 0