Mercury MAC1200R v1
The Mercury MAC1200R v1 is a wireless router with dual wireless radio (802.11a/b/g/n and 802.11ac) based on the Atheros AR9344 SoC and five fast (not GBit!) Ethernet ports.
This device can be found at AliExpress for about 30€.
Supported Versions
Support for 802.11a/b/g/n radio (ath9k driver) is mature but 802.11ac radio only (ath10k driver) supports AP and STA modes.
Hardware Highlights
Installation
→ Install OpenWrt (generic explanation)
Installing OpenWrt from the factory firmware is not possible right now; TP-Link started to use a new firmware format with RSA signature in China. It is possible however to do it from U-Boot via TFTP.
TFTP method
To upload the firmware via TFTP you need a TFTP server running on your computer configured with the IP address 192.168.1.100/24. Place the firmware image (openwrt-ar71xx-generic-mc-mac1200r-squashfs-factory.bin) in the root folder of the TFTP server.
Connect your computer to the serial TTL port of the router and to one of the LAN (blue) ports. Power the router on and enter the bootloader menu by quickly typing “tpl” when you see Autobooting in 1 seconds.
Type the following commands to load the firmware file to the router's RAM, erase the flash sectors, copy from RAM to flash, and boot the new firmware:
tftpboot 0x81000000 openwrt-ar71xx-generic-mc-mac1200r-squashfs-factory.bin erase 0x9f020000 +0x3c0000 cp.b 0x81000000 0x9f020000 0x3c0000 bootm 9f020000
You could also type reset to reboot the device). See the log below:
Autobooting in 1 seconds db12x> db12x> db12x> tftpboot 0x81000000 openwrt-firmware-for-mac1200r.bin eth1 link down enet0 port1 up dup 1 speed 1000 Using eth0 device TFTP from server 192.168.1.100; our IP address is 192.168.1.111 Filename 'openwrt-firmware-for-mac1200r.bin'. Load address: 0x81000000 Loading: ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ################################################################# ############################## done Bytes transferred = 3145732 (300004 hex) db12x> erase 0x9f020000 +0x3c0000 Erasing flash... ............................................................ Erased 60 sectors db12x> cp.b 0x81000000 0x9f020000 0x3c0000 Copy to Flash... ............................................................done db12x> bootm 9f020000
Hardware
Detailed hardware
| Instruction set | MIPS |
|---|---|
| Vendor | Qualcomm Atheros |
| bootloader | U-Boot |
| System-On-Chip | Atheros AR9344 rev 2 |
| CPU @Frq | MIPS 74Kc V4.12 @560 MHz |
| Flash size | 8192 KiB |
| Flash Chip | Spansion S25FL064K |
| RAM size | 128 MiB |
| RAM Chip | ? |
| Wireless No1 | SoC-integrated: AR9344 2×2 MIMO 802.11b/g/n (2.4 GHz) |
| Wireless No2 | On-board chip: QCA9882 2×2 MIMO 802.11a/n/ac (5 GHz) |
| switch | AR934X built-in 10/100 switch w/ vlan support |
| USB | No |
| Serial | Yes |
Serial
The serial port of the MAC1200R can be accessed using the TTL pins shown in the image below. A voltage level converter (such as a CP2102 TTL-USB dongle) is required.
With the Atheros logo the right way up and the leds to the back, counting from the Atheros SOC left to right, the pinout is TX, RX, GND. Also see the image (which is upside down):
The communication settings are: TTL voltage, 115200 bps, 8N1.
Bootloader
The device uses U-Boot as the bootloader. To access the bootloader menu via the serial TTL port, type “tpl” when booting (when the “Autobooting in 1 seconds” message is shown).
U-Boot bootlog
U-Boot 1.1.4--LSDK-10.1.389 (Apr 9 2014 - 15:23:02) U-Boot DB120 Wasp 1.2 DRAM: 64 MB Flash Manuf Id 0xef, DeviceId0 0x40, DeviceId1 0x17 flash size 8MB, sector count = 128 Flash: 8 MB Using default environment In: serial Out: serial Err: serial Net: ag934x_enet_initialize... No valid address in Flash. Using fixed address No valid address in Flash. Using fixed address wasp reset mask:c02200 WASP ----> S27 PHY s27 reg init : cfg1 0x80000000 cfg2 0x7114 eth0: ba:be:fa:co:ff:ee athrs27_phy_setup ATHR_PHY_CONTROL 4 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 4 :10 eth0 up WASP ----> S27 PHY s27 reg init lan ATHRS27: resetting s27 ATHRS27: s27 reset done : cfg1 0x800c0000 cfg2 0x7214 eth1: ba:be:ca:fe:ca:fe athrs27_phy_setup ATHR_PHY_CONTROL 0 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 0 :10 athrs27_phy_setup ATHR_PHY_CONTROL 1 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 1 :10 athrs27_phy_setup ATHR_PHY_CONTROL 2 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 2 :10 athrs27_phy_setup ATHR_PHY_CONTROL 3 :1000 athrs27_phy_setup ATHR_PHY_SPEC_STAUS 3 :10 eth1 up eth0, eth1 Setting 0xb8116290 to 0x28502d0f Autobooting in 1 seconds ## Booting image at 9f020000 ... Uncompressing Kernel Image ... OK Starting kernel ...
External links
- Manufacturer's site: http://mercurycom.com.cn/Product/detail?pd=125 (in English with Google Translate).
- OpenWrt forum: https://forum.openwrt.org/viewtopic.php?id=54811
- OpenWrt ticket including the original patch for Barrier Breaker 14.07: https://dev.openwrt.org/ticket/18605
- Article at ComputerSolutions.cn: http://www.computersolutions.cn/blog/2014/12/flashing-a-mercury-mac1200r-wifi-router/