Mercury MAC1200R v1

The Mercury MAC1200R v1 is a wireless router with dual wireless radio (802.11a/b/g/n and 802.11ac) based on the Atheros AR9344 SoC and five fast (not GBit!) Ethernet ports.

This device can be found at AliExpress for about 30€.

Support for 802.11a/b/g/n radio (ath9k driver) is mature but 802.11ac radio only (ath10k driver) supports AP and STA modes.

→ Install OpenWrt (generic explanation)

Installing OpenWrt from the factory firmware is not possible right now; TP-Link started to use a new firmware format with RSA signature in China. It is possible however to do it from U-Boot via TFTP.

To upload the firmware via TFTP you need a TFTP server running on your computer configured with the IP address 192.168.1.100/24. Place the firmware image (openwrt-ar71xx-generic-mc-mac1200r-squashfs-factory.bin) in the root folder of the TFTP server.

Connect your computer to the serial TTL port of the router and to one of the LAN (blue) ports. Power the router on and enter the bootloader menu by quickly typing “tpl” when you see Autobooting in 1 seconds.

Type the following commands to load the firmware file to the router's RAM, erase the flash sectors, copy from RAM to flash, and boot the new firmware:

tftpboot 0x81000000 openwrt-ar71xx-generic-mc-mac1200r-squashfs-factory.bin
erase 0x9f020000 +0x3c0000
cp.b 0x81000000 0x9f020000 0x3c0000
bootm 9f020000

You could also type reset to reboot the device). See the log below:

Autobooting in 1 seconds
db12x>
db12x>
db12x> tftpboot 0x81000000 openwrt-firmware-for-mac1200r.bin
eth1 link down
enet0 port1 up
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.1.100; our IP address is 192.168.1.111
Filename 'openwrt-firmware-for-mac1200r.bin'.
Load address: 0x81000000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##############################
done
Bytes transferred = 3145732 (300004 hex)
db12x> erase 0x9f020000 +0x3c0000
Erasing flash... ............................................................
Erased 60 sectors
db12x> cp.b 0x81000000 0x9f020000 0x3c0000
Copy to Flash... ............................................................done
db12x> bootm 9f020000

The serial port of the MAC1200R can be accessed using the TTL pins shown in the image below. A voltage level converter (such as a CP2102 TTL-USB dongle) is required.

With the Atheros logo the right way up and the leds to the back, counting from the Atheros SOC left to right, the pinout is TX, RX, GND. Also see the image (which is upside down):

The communication settings are: TTL voltage, 115200 bps, 8N1.

The device uses U-Boot as the bootloader. To access the bootloader menu via the serial TTL port, type “tpl” when booting (when the “Autobooting in 1 seconds” message is shown).

U-Boot 1.1.4--LSDK-10.1.389 (Apr  9 2014 - 15:23:02)

U-Boot DB120
Wasp 1.2

DRAM:  64 MB
Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17
flash size 8MB, sector count = 128
Flash:  8 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag934x_enet_initialize...
No valid address in Flash. Using fixed address
No valid address in Flash. Using fixed address
 wasp  reset mask:c02200 
WASP ----> S27 PHY 
s27 reg init 
: cfg1 0x80000000 cfg2 0x7114
eth0: ba:be:fa:co:ff:ee
athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10
eth0 up
WASP ----> S27 PHY 
s27 reg init lan 
ATHRS27: resetting s27
ATHRS27: s27 reset done
: cfg1 0x800c0000 cfg2 0x7214
eth1: ba:be:ca:fe:ca:fe
athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10
athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10
athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10
athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000
athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10
eth1 up
eth0, eth1
Setting 0xb8116290 to 0x28502d0f
Autobooting in 1 seconds
## Booting image at 9f020000 ...
   Uncompressing Kernel Image ... OK

Starting kernel ...

• Manufacturer's site: http://mercurycom.com.cn/Product/detail?pd=125 (in English with Google Translate).
• OpenWrt forum: https://forum.openwrt.org/viewtopic.php?id=54811
• OpenWrt ticket including the original patch for Barrier Breaker 14.07: https://dev.openwrt.org/ticket/18605
• Article at ComputerSolutions.cn: http://www.computersolutions.cn/blog/2014/12/flashing-a-mercury-mac1200r-wifi-router/

How to add tags