TP-Link EAP110 Omada Indoor crazy porting

For Developers
1

I don't know if this is Offtopic as it is more of an anecdote but it may be useful to others.

In this case I want to tell you about how I made a crazy "port" of Openwrt to this device that was not supported, a few months ago I was given 3 of these devices.

TP-Link EAP110 Omada Indoor Ceiling Mount v4

Tech DATA:
SOC: QCA9533
Wifi N 300Mbps x2 3dbi internal antenna
RAM 64Mb
ROM 8MB
1 LAN Port 10/100 24V Passive Poe

My idea was to use it with 802.11r in roaming (the device is natively compatible but requires the Omada hardware to be managed).
After many attempts and research I could not find support for this device but I did find support for the EAP110 Outdoor version. I dumped the SPI ROM with a ch342a to be able to analyze it, I replaced the kernel section with a hex editor and I tried to load a kernel/squasfs from a model with the same characteristics but everything was unsuccessful since the bootloader was signed (I suppose that being a "Business Product" they put more security), TFTP was also blocked.
In the end I gave up and saved the APs for future use.

A few days ago I was brought a TP-Link CPE210 v3 to which I also installed Openwrt correctly, while I was looking at its features I noticed that they are extremely similar to the EAP110 that I had stored (with the difference of the larger and amplified antenna of course).

Then I thought, what if I copy the SPI ROM from the CPE and flash it on the EAP? I had nothing more to lose.

It worked, the EAP booted with Openwrt using the CPE ROM.
I know that this is not a "valid port" since I could never defeat the original bootloader and it was a cloned installation, but it does work.

Now that I have more time, what I have left to do is:

  • Restore the original MACs, since they are all clones, they are all the same.
  • Restore the calibration data, nvram, etc.
  • Change the name and model of the device.
  • Assign the corresponding GPIOs and LEDs.
  • Create a less intrusive way of installation

I want to clarify that I am not a developer so I have no idea how to add a device from scratch, there may have been easier installation methods before this hard method.

1 Like
2

Updates after a week
Well, you can restore the ART partition using dd

$ dd if="rom original eap.bin" of="rom CPE.bin" bs=1K skip=8192 seek=8192 count=64

(luckily it was also located at the end of the rom)

Here I leave the dumps on Gdrive of both without modifications, first the "tp link EAP1.bin" is the unmodified OEM ROM of the EAP110 (Indoor) and "tp link cpe 2.4.bin" is the ROM of the CPE210 running openwrt that worked when installed on the EAP110

3

ART is the calibration data for your integrated wireless cards, this is device specific and can't be used on any other device. 5-6 figure measuring equipment tests the variances of your hardware during production and uses this data to write the signal deltas at various frequencies and temperatures, to get the hardware into specs and legal compliance. This data is unique to your device and cannot (reasonably) be recovered, if lost (without a backup from your device).

4

I know that's why I restored the ART from the original ROM.
When I used the cloned ART the antenna values ​​in "Transmition Power" its wrong, that's why I restored it.

Now all that's left is to restore the original MAC

5

How do I know if I have lost this unique data for each device? Loss of signal or something related? And how is it possible to lose it?

6

If the ART is from a completely different model, the Antenna calibration is lost.

The ART is usually generic between the same models, it is not "unique" for each device (sometimes they vary between regions), the MAC and Unique Serial Number are stored in some other partition depending on the device.

In short, ART saves the data of the Antenna type, Maximum Power, MIMO etc for the specific model (or regulation).
Not unique data such as MAC or SN.

The short answer to your question is Yes, if the ART is from totally different device, will use different values ​​from the original antenna which would cause a loss of performance.

But it is not unique to the device if you lost, you can clone from another device that is the same model, revision and/or region.