9dd4ba3d7e
TP-Link EAP245 v3 is an AC1750 (802.11ac Wave-2) ceiling mount access
point. UART access (for debricking) requires non-trivial soldering.
Specifications:
* SoC: QCA9563 (CPU/DDR/AHB @ 775/650/258 MHz)
* RAM: 128MiB
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n 3x3
* Wireless 5GHz (QCA9982): a/n/ac 3x3 with MU-MIMO
* Ethernet (QCA8337N switch): 2× 1GbE, ETH1 (802.3at PoE) and ETH2
* Green and amber status LEDs
* Reset switch (GPIO, available for failsafe)
Flashing instructions:
All recent firmware versions (latest is 2.20.0), can disable firmware
signature verification and use a padded firmware file to flash OpenWrt:
* ssh into target device and run `cliclientd stopcs`
* upload factory image via web interface
The stopcs-method is supported from firmware version 2.3.0. Earlier
versions need to be upgraded to a newer stock version before flashing
OpenWrt.
Factory images for these devices are RSA signed by TP-Link. While the
signature verification can be disabled, the factory image still needs to
have a (fake) 1024 bit signature added to pass file checks.
Debricking instructions:
You can recover using u-boot via the serial port:
* Serial port is available from J3 (1:TX, 2:RX, 3:GND, 4:3.3V)
* Bridge R237 to connect RX, located next to J3
* Bridge R225 to connect TX, located inside can on back-side of board
* Serial port is 115200 baud, 8n1, interrupt u-boot by holding ctrl+B
* Upload initramfs with tftp and upgrade via OpenWrt
Device mac addresses:
Stock firmware has the same mac address for 2.4GHz wireless and
ethernet, 5GHz is incremented by one. The base mac address is stored in
the 'default-mac' partition (offset 0x90000) at an offset of 8 bytes.
ART blobs contain no mac addresses.
From OEM ifconfig:
ath0 Link encap:Ethernet HWaddr 74:..:E2
ath10 Link encap:Ethernet HWaddr 74:..:E3
br0 Link encap:Ethernet HWaddr 74:..:E2
eth0 Link encap:Ethernet HWaddr 74:..:E2
Signed-off-by: Sander Vanheule <sander@svanheule.net>
Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
224 lines
6.2 KiB
Bash
224 lines
6.2 KiB
Bash
#!/bin/sh
|
|
|
|
[ -e /lib/firmware/$FIRMWARE ] && exit 0
|
|
|
|
. /lib/functions/caldata.sh
|
|
. /lib/functions/k2t.sh
|
|
|
|
board=$(board_name)
|
|
|
|
case "$FIRMWARE" in
|
|
"ath10k/cal-pci-0000:00:00.0.bin")
|
|
case $board in
|
|
allnet,all-wap02860ac|\
|
|
glinet,gl-x750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) +2)
|
|
;;
|
|
avm,fritz1750e|\
|
|
avm,fritzdvbc)
|
|
caldata_extract "urlader" 0x198a 0x844
|
|
;;
|
|
comfast,cf-wr650ac-v1|\
|
|
comfast,cf-wr650ac-v2|\
|
|
devolo,magic-2-wifi|\
|
|
ubnt,unifiac-lite|\
|
|
ubnt,unifiac-lr|\
|
|
ubnt,unifiac-mesh|\
|
|
ubnt,unifiac-mesh-pro|\
|
|
ubnt,lap-120|\
|
|
ubnt,litebeam-ac-gen2|\
|
|
ubnt,nanobeam-ac|\
|
|
ubnt,nanostation-ac|\
|
|
ubnt,nanostation-ac-loco|\
|
|
ubnt,powerbeam-5ac-500|\
|
|
ubnt,powerbeam-5ac-gen2|\
|
|
ubnt,unifiac-pro|\
|
|
yuncore,a770)
|
|
caldata_extract "art" 0x5000 0x844
|
|
;;
|
|
devolo,dvl1200e|\
|
|
devolo,dvl1200i|\
|
|
devolo,dvl1750c|\
|
|
devolo,dvl1750e|\
|
|
devolo,dvl1750i|\
|
|
devolo,dvl1750x)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) -1)
|
|
;;
|
|
dlink,dap-2695-a1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii bdcfg wlanmac_a)
|
|
;;
|
|
dlink,dir-859-a1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata "wlan5mac")
|
|
;;
|
|
elecom,wrc-1750ghbk2-i)
|
|
caldata_extract "art" 0x5000 0x844
|
|
;;
|
|
engenius,ecb1750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii u-boot-env athaddr)
|
|
;;
|
|
engenius,epg5000|\
|
|
iodata,wn-ac1167dgr|\
|
|
iodata,wn-ac1600dgr2|\
|
|
sitecom,wlr-7100|\
|
|
zyxel,nbg6616)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
|
|
;;
|
|
engenius,ews511ap)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) +1)
|
|
;;
|
|
glinet,gl-ar750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) +1)
|
|
;;
|
|
nec,wg800hp)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_text board_data 0x880)
|
|
;;
|
|
ocedo,koala|\
|
|
ocedo,ursus)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_binary art 0xc)
|
|
;;
|
|
openmesh,om5p-ac-v2)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) +16)
|
|
;;
|
|
qihoo,c301)
|
|
caldata_extract "radiocfg" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
;;
|
|
tplink,archer-a7-v5|\
|
|
tplink,archer-c2-v3|\
|
|
tplink,archer-c7-v4|\
|
|
tplink,archer-c7-v5|\
|
|
tplink,archer-c25-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) -1)
|
|
;;
|
|
tplink,archer-c5-v1|\
|
|
tplink,archer-c7-v2)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary u-boot 0x1fc00) -1)
|
|
;;
|
|
tplink,archer-d50-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary romfile 0xf100) +2)
|
|
;;
|
|
tplink,archer-d7-v1|\
|
|
tplink,archer-d7b-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary romfs 0xf100) +2)
|
|
;;
|
|
tplink,re350k-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary config 0x10008) +2)
|
|
;;
|
|
tplink,re355-v1|\
|
|
tplink,re450-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) -2)
|
|
;;
|
|
tplink,re450-v2|\
|
|
tplink,re450-v3)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) +1)
|
|
;;
|
|
tplink,tl-wpa8630-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary u-boot 0x0fc00) +1)
|
|
;;
|
|
tplink,tl-wr902ac-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary tplink 0x8) -1)
|
|
;;
|
|
esac
|
|
;;
|
|
"ath10k/cal-pci-0000:01:00.0.bin")
|
|
case $board in
|
|
sitecom,wlr-8100)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
|
|
;;
|
|
esac
|
|
;;
|
|
"ath10k/pre-cal-pci-0000:00:00.0.bin")
|
|
case $board in
|
|
comfast,cf-e313ac)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_binary art 0x6)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
rm /lib/firmware/ath10k/QCA9888/hw2.0/board-2.bin
|
|
;;
|
|
comfast,cf-e560ac|\
|
|
comfast,cf-ew72|\
|
|
comfast,cf-wr752ac-v1)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) +2)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
rm /lib/firmware/ath10k/QCA9888/hw2.0/board-2.bin
|
|
;;
|
|
dlink,dir-842-c1|\
|
|
dlink,dir-842-c2|\
|
|
dlink,dir-842-c3|\
|
|
nec,wg1200cr)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
netgear,ex6400|\
|
|
netgear,ex7300)
|
|
caldata_extract "caldata" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_binary caldata 0xc)
|
|
;;
|
|
phicomm,k2t)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(k2t_get_mac "5g_mac")
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,archer-c58-v1|\
|
|
tplink,archer-c59-v1|\
|
|
tplink,archer-c59-v2|\
|
|
tplink,archer-c60-v1|\
|
|
tplink,archer-c60-v2|\
|
|
tplink,archer-c60-v3|\
|
|
tplink,archer-c6-v2|\
|
|
tplink,archer-c6-v2-us)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary mac 0x8) -1)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,tl-wpa8630p-v2-eu|\
|
|
tplink,tl-wpa8630p-v2-int)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary mac 0x8) +1)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,eap245-v3)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) +1)
|
|
;;
|
|
yuncore,a782|\
|
|
yuncore,xd4200)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
esac
|
|
;;
|
|
*)
|
|
exit 1
|
|
;;
|
|
esac
|