4f86edf477
TP-Link EAP225-Outdoor v1 is an AC1200 (802.11ac Wave-2) pole or wall
mount access point. Debricking requires access to the serial port, which
is non-trivial.
Device specifications:
* SoC: QCA9563 @ 775MHz
* Memory: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n 2x2
* Wireless 5GHz (QCA9886): a/n/ac 2x2 MU-MIMO
* Ethernet (AR8033): 1× 1GbE, PoE
Flashing instructions:
* ssh into target device with recent (>= v1.6.0) firmware
* run `cliclientd stopcs` on target device
* upload factory image via web interface
Debricking:
To recover the device, you need access to the serial port. This requires
fine soldering to test points, or the use of probe pins.
* Open the case and solder wires to the test points: RXD, TXD and TPGND4
* Use a 3.3V UART, 115200 baud, 8n1
* Interrupt bootloader by holding ctrl+B during boot
* upload initramfs via built-in tftp client and perform sysupgrade
setenv ipaddr 192.168.1.1 # default, change as required
setenv serverip 192.168.1.10 # default, change as required
tftp 0x80800000 initramfs.bin
bootelf $fileaddr
MAC addresses:
MAC address (as on device label) is stored in device info partition at
an offset of 8 bytes. ath9k device has same address as ethernet, ath10k
uses address incremented by 1.
From stock ifconfig:
ath0 Link encap:Ethernet HWaddr D8:...:2E
ath10 Link encap:Ethernet HWaddr D8:...:2F
br0 Link encap:Ethernet HWaddr D8:...:2E
eth0 Link encap:Ethernet HWaddr D8:...:2E
Tested by forum user PolynomialDivision on firmware v1.7.0.
UART access tested by forum user arinc9.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
236 lines
6.6 KiB
Bash
236 lines
6.6 KiB
Bash
#!/bin/sh
|
|
|
|
[ -e /lib/firmware/$FIRMWARE ] && exit 0
|
|
|
|
. /lib/functions/caldata.sh
|
|
. /lib/functions/k2t.sh
|
|
|
|
board=$(board_name)
|
|
|
|
case "$FIRMWARE" in
|
|
"ath10k/cal-pci-0000:00:00.0.bin")
|
|
case $board in
|
|
allnet,all-wap02860ac|\
|
|
glinet,gl-x750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) +2)
|
|
;;
|
|
avm,fritz1750e|\
|
|
avm,fritzdvbc)
|
|
caldata_extract "urlader" 0x198a 0x844
|
|
;;
|
|
comfast,cf-wr650ac-v1|\
|
|
comfast,cf-wr650ac-v2|\
|
|
devolo,magic-2-wifi|\
|
|
qxwlan,e1700ac-v2-8m|\
|
|
qxwlan,e1700ac-v2-16m|\
|
|
qxwlan,e600gac-v2-8m|\
|
|
qxwlan,e600gac-v2-16m|\
|
|
ubnt,unifiac-lite|\
|
|
ubnt,unifiac-lr|\
|
|
ubnt,unifiac-mesh|\
|
|
ubnt,unifiac-mesh-pro|\
|
|
ubnt,lap-120|\
|
|
ubnt,litebeam-ac-gen2|\
|
|
ubnt,nanobeam-ac|\
|
|
ubnt,nanobeam-ac-gen2|\
|
|
ubnt,nanostation-ac|\
|
|
ubnt,nanostation-ac-loco|\
|
|
ubnt,powerbeam-5ac-500|\
|
|
ubnt,powerbeam-5ac-gen2|\
|
|
ubnt,unifiac-pro|\
|
|
yuncore,a770)
|
|
caldata_extract "art" 0x5000 0x844
|
|
;;
|
|
devolo,dvl1200e|\
|
|
devolo,dvl1200i|\
|
|
devolo,dvl1750c|\
|
|
devolo,dvl1750e|\
|
|
devolo,dvl1750i|\
|
|
devolo,dvl1750x)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) -1)
|
|
;;
|
|
dlink,dap-2695-a1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii bdcfg wlanmac_a)
|
|
;;
|
|
dlink,dir-859-a1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata "wlan5mac")
|
|
;;
|
|
elecom,wrc-1750ghbk2-i)
|
|
caldata_extract "art" 0x5000 0x844
|
|
;;
|
|
engenius,ecb1750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii u-boot-env athaddr)
|
|
;;
|
|
engenius,epg5000|\
|
|
iodata,wn-ac1167dgr|\
|
|
iodata,wn-ac1600dgr2|\
|
|
sitecom,wlr-7100|\
|
|
zyxel,nbg6616)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
|
|
;;
|
|
engenius,ews511ap)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) +1)
|
|
;;
|
|
glinet,gl-ar750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) +1)
|
|
;;
|
|
nec,wg800hp)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_text board_data 0x880)
|
|
;;
|
|
ocedo,koala|\
|
|
ocedo,ursus)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_binary art 0xc)
|
|
;;
|
|
openmesh,om5p-ac-v2)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) +16)
|
|
;;
|
|
qihoo,c301)
|
|
caldata_extract "radiocfg" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
;;
|
|
tplink,archer-a7-v5|\
|
|
tplink,archer-c2-v3|\
|
|
tplink,archer-c7-v4|\
|
|
tplink,archer-c7-v5|\
|
|
tplink,archer-c25-v1|\
|
|
tplink,tl-wr902ac-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) -1)
|
|
;;
|
|
tplink,archer-c5-v1|\
|
|
tplink,archer-c7-v2)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary u-boot 0x1fc00) -1)
|
|
;;
|
|
tplink,archer-d50-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary romfile 0xf100) +2)
|
|
;;
|
|
tplink,archer-d7-v1|\
|
|
tplink,archer-d7b-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary romfs 0xf100) +2)
|
|
;;
|
|
tplink,eap245-v1|\
|
|
tplink,re450-v2|\
|
|
tplink,re450-v3)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) +1)
|
|
;;
|
|
tplink,re350k-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) +2)
|
|
;;
|
|
tplink,re355-v1|\
|
|
tplink,re450-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) -2)
|
|
;;
|
|
tplink,tl-wpa8630-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary u-boot 0x0fc00) +1)
|
|
;;
|
|
esac
|
|
;;
|
|
"ath10k/cal-pci-0000:01:00.0.bin")
|
|
case $board in
|
|
sitecom,wlr-8100)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
|
|
;;
|
|
esac
|
|
;;
|
|
"ath10k/pre-cal-pci-0000:00:00.0.bin")
|
|
case $board in
|
|
comfast,cf-e313ac)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_binary art 0x6)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
rm /lib/firmware/ath10k/QCA9888/hw2.0/board-2.bin
|
|
;;
|
|
comfast,cf-e560ac|\
|
|
comfast,cf-ew72|\
|
|
comfast,cf-wr752ac-v1)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) +2)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
rm /lib/firmware/ath10k/QCA9888/hw2.0/board-2.bin
|
|
;;
|
|
dlink,dir-842-c1|\
|
|
dlink,dir-842-c2|\
|
|
dlink,dir-842-c3)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
caldata_valid "202f" || caldata_extract "reserved" 0x15000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
nec,wg1200cr)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
netgear,ex6400|\
|
|
netgear,ex7300)
|
|
caldata_extract "caldata" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_binary caldata 0xc)
|
|
;;
|
|
phicomm,k2t)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(k2t_get_mac "5g_mac")
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,archer-c58-v1|\
|
|
tplink,archer-c59-v1|\
|
|
tplink,archer-c59-v2|\
|
|
tplink,archer-c60-v1|\
|
|
tplink,archer-c60-v2|\
|
|
tplink,archer-c60-v3|\
|
|
tplink,archer-c6-v2|\
|
|
tplink,archer-c6-v2-us)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) -1)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,eap225-outdoor-v1|\
|
|
tplink,eap225-wall-v2|\
|
|
tplink,tl-wpa8630p-v2-int|\
|
|
tplink,tl-wpa8630p-v2.0-eu|\
|
|
tplink,tl-wpa8630p-v2.1-eu)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) +1)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,eap245-v3)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) +1)
|
|
;;
|
|
yuncore,a782|\
|
|
yuncore,xd4200)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
esac
|
|
;;
|
|
*)
|
|
exit 1
|
|
;;
|
|
esac
|