b11ad48764
TP-Link EAP245 v1 is an AC1750 (802.11ac Wave-1) ceiling mount access point.
Device specifications:
* SoC: QCA9563 @ 775MHz
* RAM: 128MiB DDR2
* Flash: 16MiB SPI-NOR
* Wireless 2.4GHz (SoC): b/g/n, 3x3
* Wireless 5Ghz (QCA9880): a/n/ac, 3x3
* Ethernet (AR8033): 1× 1GbE, 802.3at PoE
Flashing instructions:
* Upgrade the device to firmware v1.4.0 if necessary
* Exploit the user management page in the web interface to start telnetd
by changing the username to `;/usr/sbin/telnetd -l/bin/sh&`.
* Immediately change the malformed username back to something valid
(e.g. 'admin') to make ssh work again.
* Use the root shell via telnet to make /tmp world writeable (chmod 777)
* Extract /usr/bin/uclited from the device via ssh and apply the binary
patch listed below. The patch is required to prevent `uclited -u` in
the last step from crashing.
* Copy the patched uclited programme back to the device at /tmp/uclited
(via ssh)
* Upload the factory image to /tmp/upgrade.bin (via ssh)
* Run `chmod +x /tmp/uclited && /tmp/uclited -u` to install OpenWrt.
--- xxd uclited
+++ xxd uclited-patched
@@ -53796,7 +53796,7 @@
000d2240: 8c44 0000 0320 f809 0000 0000 8fbc 0010 .D... ..........
000d2250: 8fa6 0a4c 02c0 2821 8f82 87b8 0000 0000 ...L..(!........
-000d2260: 8c44 0000 0c13 45e0 27a7 0018 8fbc 0010 .D....E.'.......
+000d2260: 8c44 0000 2402 0000 0000 0000 8fbc 0010 .D..$...........
000d2270: 1040 001d 0000 1821 8f99 8374 3c04 0058 .@.....!...t<..X
000d2280: 3c05 0056 2484 a898 24a5 9a30 0320 f809 <..V$...$..0. ..
Debricking:
* Serial port can be soldered on PCB J3 (1: TXD, 2: RXD, 3: GND, 4: VCC)
* Bridge unpopulated resistors R225 (TXD) and R237 (RXD).
Do NOT bridge R230.
* Use 3.3V, 115200 baud, 8n1
* Interrupt bootloader by holding CTRL+B during boot
* tftp initramfs to flash via the LuCI web interface
setenv ipaddr 192.168.1.1 # default, change as required
setenv serverip 192.168.1.10 # default, change as required
tftp 0x80800000 initramfs.bin
bootelf $fileaddr
Tested on the EAP245 v1 running the latest firmware (v1.4.0). The binary
patch might not apply to uclited from other firmware versions.
EAP245 v1 device support was originally developed and maintained by
Julien Dusser out-of-tree. This patch and "ath79: prepare for 1-port
TP-Link EAP2x5 devices" are based on that work.
Signed-off-by: Sander Vanheule <sander@svanheule.net>
235 lines
6.6 KiB
Bash
235 lines
6.6 KiB
Bash
#!/bin/sh
|
|
|
|
[ -e /lib/firmware/$FIRMWARE ] && exit 0
|
|
|
|
. /lib/functions/caldata.sh
|
|
. /lib/functions/k2t.sh
|
|
|
|
board=$(board_name)
|
|
|
|
case "$FIRMWARE" in
|
|
"ath10k/cal-pci-0000:00:00.0.bin")
|
|
case $board in
|
|
allnet,all-wap02860ac|\
|
|
glinet,gl-x750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) +2)
|
|
;;
|
|
avm,fritz1750e|\
|
|
avm,fritzdvbc)
|
|
caldata_extract "urlader" 0x198a 0x844
|
|
;;
|
|
comfast,cf-wr650ac-v1|\
|
|
comfast,cf-wr650ac-v2|\
|
|
devolo,magic-2-wifi|\
|
|
qxwlan,e1700ac-v2-8m|\
|
|
qxwlan,e1700ac-v2-16m|\
|
|
qxwlan,e600gac-v2-8m|\
|
|
qxwlan,e600gac-v2-16m|\
|
|
ubnt,unifiac-lite|\
|
|
ubnt,unifiac-lr|\
|
|
ubnt,unifiac-mesh|\
|
|
ubnt,unifiac-mesh-pro|\
|
|
ubnt,lap-120|\
|
|
ubnt,litebeam-ac-gen2|\
|
|
ubnt,nanobeam-ac|\
|
|
ubnt,nanobeam-ac-gen2|\
|
|
ubnt,nanostation-ac|\
|
|
ubnt,nanostation-ac-loco|\
|
|
ubnt,powerbeam-5ac-500|\
|
|
ubnt,powerbeam-5ac-gen2|\
|
|
ubnt,unifiac-pro|\
|
|
yuncore,a770)
|
|
caldata_extract "art" 0x5000 0x844
|
|
;;
|
|
devolo,dvl1200e|\
|
|
devolo,dvl1200i|\
|
|
devolo,dvl1750c|\
|
|
devolo,dvl1750e|\
|
|
devolo,dvl1750i|\
|
|
devolo,dvl1750x)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) -1)
|
|
;;
|
|
dlink,dap-2695-a1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii bdcfg wlanmac_a)
|
|
;;
|
|
dlink,dir-859-a1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata "wlan5mac")
|
|
;;
|
|
elecom,wrc-1750ghbk2-i)
|
|
caldata_extract "art" 0x5000 0x844
|
|
;;
|
|
engenius,ecb1750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii u-boot-env athaddr)
|
|
;;
|
|
engenius,epg5000|\
|
|
iodata,wn-ac1167dgr|\
|
|
iodata,wn-ac1600dgr2|\
|
|
sitecom,wlr-7100|\
|
|
zyxel,nbg6616)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
|
|
;;
|
|
engenius,ews511ap)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) +1)
|
|
;;
|
|
glinet,gl-ar750)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) +1)
|
|
;;
|
|
nec,wg800hp)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_text board_data 0x880)
|
|
;;
|
|
ocedo,koala|\
|
|
ocedo,ursus)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_binary art 0xc)
|
|
;;
|
|
openmesh,om5p-ac-v2)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) +16)
|
|
;;
|
|
qihoo,c301)
|
|
caldata_extract "radiocfg" 0x5000 0x844
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
;;
|
|
tplink,archer-a7-v5|\
|
|
tplink,archer-c2-v3|\
|
|
tplink,archer-c7-v4|\
|
|
tplink,archer-c7-v5|\
|
|
tplink,archer-c25-v1|\
|
|
tplink,tl-wr902ac-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) -1)
|
|
;;
|
|
tplink,archer-c5-v1|\
|
|
tplink,archer-c7-v2)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary u-boot 0x1fc00) -1)
|
|
;;
|
|
tplink,archer-d50-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary romfile 0xf100) +2)
|
|
;;
|
|
tplink,archer-d7-v1|\
|
|
tplink,archer-d7b-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary romfs 0xf100) +2)
|
|
;;
|
|
tplink,eap245-v1|\
|
|
tplink,re450-v2|\
|
|
tplink,re450-v3)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) +1)
|
|
;;
|
|
tplink,re350k-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) +2)
|
|
;;
|
|
tplink,re355-v1|\
|
|
tplink,re450-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(cat /sys/class/net/eth0/address) -2)
|
|
;;
|
|
tplink,tl-wpa8630-v1)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary u-boot 0x0fc00) +1)
|
|
;;
|
|
esac
|
|
;;
|
|
"ath10k/cal-pci-0000:01:00.0.bin")
|
|
case $board in
|
|
sitecom,wlr-8100)
|
|
caldata_extract "art" 0x5000 0x844
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) +1)
|
|
;;
|
|
esac
|
|
;;
|
|
"ath10k/pre-cal-pci-0000:00:00.0.bin")
|
|
case $board in
|
|
comfast,cf-e313ac)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_binary art 0x6)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
rm /lib/firmware/ath10k/QCA9888/hw2.0/board-2.bin
|
|
;;
|
|
comfast,cf-e560ac|\
|
|
comfast,cf-ew72|\
|
|
comfast,cf-wr752ac-v1)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary art 0x0) +2)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
rm /lib/firmware/ath10k/QCA9888/hw2.0/board-2.bin
|
|
;;
|
|
dlink,dir-842-c1|\
|
|
dlink,dir-842-c2|\
|
|
dlink,dir-842-c3)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
caldata_valid "202f" || caldata_extract "reserved" 0x15000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
nec,wg1200cr)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_ascii devdata wlan5mac)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
netgear,ex6400|\
|
|
netgear,ex7300)
|
|
caldata_extract "caldata" 0x5000 0x2f20
|
|
ath10k_patch_mac $(mtd_get_mac_binary caldata 0xc)
|
|
;;
|
|
phicomm,k2t)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(k2t_get_mac "5g_mac")
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,archer-c58-v1|\
|
|
tplink,archer-c59-v1|\
|
|
tplink,archer-c59-v2|\
|
|
tplink,archer-c60-v1|\
|
|
tplink,archer-c60-v2|\
|
|
tplink,archer-c60-v3|\
|
|
tplink,archer-c6-v2|\
|
|
tplink,archer-c6-v2-us)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) -1)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,eap225-wall-v2|\
|
|
tplink,tl-wpa8630p-v2-int|\
|
|
tplink,tl-wpa8630p-v2.0-eu|\
|
|
tplink,tl-wpa8630p-v2.1-eu)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) +1)
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
tplink,eap245-v3)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ath10k_patch_mac $(macaddr_add $(mtd_get_mac_binary info 0x8) +1)
|
|
;;
|
|
yuncore,a782|\
|
|
yuncore,xd4200)
|
|
caldata_extract "art" 0x5000 0x2f20
|
|
ln -sf /lib/firmware/ath10k/pre-cal-pci-0000\:00\:00.0.bin \
|
|
/lib/firmware/ath10k/QCA9888/hw2.0/board.bin
|
|
;;
|
|
esac
|
|
;;
|
|
*)
|
|
exit 1
|
|
;;
|
|
esac
|