YunCore CPE-880

The YunCore CPE-880 is an outdoor CPE WiFi router with two Fast Ethernet ports and a 802.11a/n wireless radio with 29 dBm output power and an integrated 15 dBi antenna.

The device can be ordered on-line at AliExpress or NewEgg for approximately 60 € / 70 USD (as of January, 2016).

OpenWrt support is WiP. Using this patch you can compile an Initramfs image, upload it via TFTP to U-boot and successfully boot the device. The Ethernet and wireless network work with the appropriate MAC addresses; LEDs and button are also working. Sysupgrade and factory images are not ready yet.

YunCore CPE-880 front view YunCore CPE-880 side view YunCore CPE-880 rear view YunCore CPE-880 screws view YunCore CPE-880 connectors view

Architecture MIPS 74Kc V4.12 (ar71xx)
Vendor Atheros
Bootloader U-boot
System-On-Chip Atheros AR9344 rev 3
CPU Speed 535 MHz
RAM memory 64 MB
Flash memory 8 MB
Wired network 2 x Ethernet 100 Mbps (switched)
Ethernet chip Atheros AR934X (SoC)
Wireless chip Atheros AR9340 (SoC) 5.8 GHz 802.11a/n
Wireless antennas MiMo 2×2:2 (integrated)
USB No
Serial port Yes (TTL pins)

The serial port of the CPE-880 can be accessed using the TTL pins shown in the image below, labeled as J10. A voltage level converter (such as a CP2102 TTL-USB dongle) is required.

YunCore CPE-880 board detail view of TTL port

The communication settings are: 115200 bps 8N1.

The stock firmware uses the following MTD partitioning for the 8 MB flash memory:

~ # cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00010000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00360000 00010000 "rootfs"
mtd3: 00100000 00010000 "uImage"
mtd4: 00360000 00010000 "rootfs1"
mtd5: 00010000 00010000 "NVRAM"
mtd6: 00010000 00010000 "ART"
BusyBox v1.24.1 (2015-12-30 23:13:30 CET) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 DESIGNATED DRIVER (Bleeding Edge, r48014)
 -----------------------------------------------------
  * 2 oz. Orange Juice         Combine all juices in a
  * 2 oz. Pineapple Juice      tall glass filled with
  * 2 oz. Grapefruit Juice     ice, stir well.
  * 2 oz. Cranberry Juice
 -----------------------------------------------------
root@OpenWrt:/# cat /tmp/sysinfo/board_name
cpe-880

The stock firmware of the device appears to be based on the Atheros SDK, using Linux 2.6.31.

Hit any key to stop autoboot: 0 ## Booting image at 9f380000 ... Image Name: Linux Kernel Image Created: 2015-12-03 9:00:11 UTC Image Type: MIPS Linux Kernel Image (lzma compressed) Data Size: 955912 Bytes = 933.5 kB Load Address: 80002000 Entry Point: 801e4e60 Verifying Checksum at 0x9f380040 ...OK Uncompressing Kernel Image ... OK No initrd ## Transferring control to Linux (at address 801e4e60) ... ## Giving linux memsize in bytes, 67108864 Starting kernel ... Booting Atheros AR934x Linux version 2.6.31--LSDK-9.5.5.36 (root@localhost.localdomain) (gcc version 4.3.3 (GCC) ) #6 Tue Oct 6 15:29:30 CST 2015 flash_size passed from bootloader = 8 arg 1: console=ttyS0,115200 arg 2: root=31:02 arg 3: rootfstype=squashfs,jffs2 arg 4: init=/sbin/init arg 5: mtdparts=ath-nor0:64k(u-boot),64k(u-boot-env),3456k(rootfs),1024K(uImage),3456k(rootfs1),64k(NVRAM),64k(ART) arg 6: mem=64M CPU revision is: 0001974c (MIPS 74Kc) ath_sys_frequency: cpu srif ddr srif cpu 535 ddr 400 ahb 200 Determined physical RAM map: memory: 02000000 @ 00000000 (usable) User-defined physical RAM map: memory: 04000000 @ 00000000 (usable) Initrd not found or empty - disabling initrd Zone PFN ranges: Normal 0x00000000 -> 0x00004000 Movable zone start PFN for each node early_node_map[1] active PFN ranges 0: 0x00000000 -> 0x00004000 Built 1 zonelists in Zone order, mobility grouping on. Total pages: 16256 Kernel command line: console=ttyS0,115200 root=31:02 rootfstype=squashfs,jffs2 init=/sbin/init mtdparts=ath-nor0:64k(u-boot),64k(u-boot-env),3456k(rootfs),1024K(uImage),3456k(rootfs1),64k(NVRAM),64k(ART) mem=64M PID hash table entries: 256 (order: 8, 1024 bytes) Dentry cache hash table entries: 8192 (order: 3, 32768 bytes) Inode-cache hash table entries: 4096 (order: 2, 16384 bytes) Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes. Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes Writing ErrCtl register=00000000 Readback ErrCtl register=00000000 Memory: 62132k/65536k available (1949k kernel code, 3328k reserved, 560k data, 160k init, 0k highmem) NR_IRQS:128 plat_time_init: plat time init done Calibrating delay loop... 267.26 BogoMIPS (lpj=534528) Mount-cache hash table entries: 512 NET: Registered protocol family 16 ath_pcibios_init: bus 0 ***** Warning PCIe 0 H/W not found !!! registering PCI controller with io_map_base unset bio: create slab <bio-0> at 0 SCSI subsystem initialized NET: Registered protocol family 2 IP route cache hash table entries: 1024 (order: 0, 4096 bytes) TCP established hash table entries: 2048 (order: 2, 16384 bytes) TCP bind hash table entries: 2048 (order: 1, 8192 bytes) TCP: Hash tables configured (established 2048 bind 2048) TCP reno registered NET: Registered protocol family 1 ATH GPIOC major 0 squashfs: version 4.0 (2009/01/31) Phillip Lougher fuse init (API version 7.12) msgmni has been set to 121 alg: No test for stdrng (krng) io scheduler noop registered io scheduler deadline registered (default) Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A console [ttyS0] enabled brd: module loaded PPP generic driver version 2.4.2 PPP Deflate Compression module registered PPP BSD Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 PPPoL2TP kernel driver, V1.0 tun: Universal TUN/TAP device driver, 1.6 tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com> 7 cmdlinepart partitions found on MTD device ath-nor0 Creating 7 MTD partitions on "ath-nor0": 0x000000000000-0x000000010000 : "u-boot" 0x000000010000-0x000000020000 : "u-boot-env" 0x000000020000-0x000000380000 : "rootfs" 0x000000380000-0x000000480000 : "uImage" 0x000000480000-0x0000007e0000 : "rootfs1" 0x0000007e0000-0x0000007f0000 : "NVRAM" 0x0000007f0000-0x000000800000 : "ART" Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (1024 buckets, 4096 max) CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or sysctl net.netfilter.nf_conntrack_acct=1 to enable it. xt_time: kernel timezone is -0000 ip_tables: (C) 2000-2006 Netfilter Core Team TCP cubic registered NET: Registered protocol family 17 Bridge firewalling registered Ebtables v2.0 registered 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> All bugs added by David S. Miller <davem@redhat.com> arch/mips/atheros/gpio.c (ath_simple_config_init) JUMPSTART_GPIO: 11 athwdt_init: Registering WDT success athwdt_timer_init:429: here jiffies:2150079080 ath_otp_init: Registering OTP success ath_clksw_init: Registering Clock Switch Interface success VFS: Mounted root (squashfs filesystem) readonly on device 31:2. Freeing unused kernel memory: 160k freed init started: BusyBox v1.15.0 (2015-12-03 16:58:24 CST) starting pid 23, tty '': '/etc/rc.d/rcS' ATHR_GMAC: Length per segment 1536 ATHR_GMAC: fifo cfg 3 01f00140 ATHR_GMAC: RX TASKLET - Pkts per Intr:16 ATHR_GMAC: Mac address for unit 0:bfff0000 ATHR_GMAC: de:ad:be:ef:00:00 mac:0 Registering S27.... ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 128 ATHR_GMAC: Mac capability flags : 2580 ATHR_GMAC: RX TASKLET - Pkts per Intr:16 ATHR_GMAC: Mac address for unit 1:bfff0006 ATHR_GMAC: de:ad:be:ef:00:01 mac:1 Registering S27.... ATHR_GMAC: Max segments per packet : 1 ATHR_GMAC: Max tx descriptor count : 40 ATHR_GMAC: Max rx descriptor count : 128 ATHR_GMAC: Mac capability flags : 2D80 start create /var/config ... athr_gmac_ring_alloc Allocated 640 at 0x83934800 athr_gmac_ring_alloc Allocated 2048 at 0x8384d000 WASP ----> S27 PHY MDIO Setting Drop CRC Errors, Pause Frames and Length Error frames Setting PHY... athr_gmac_ring_alloc Allocated 640 at 0x83934400 athr_gmac_ring_alloc Allocated 2048 at 0x83949800 WASP ----> S27 PHY MDIO Setting Drop CRC Errors, Pause Frames and Length Error frames ATHRS27: resetting s27 ATHRS27: s27 reset done Setting PHY... device eth0 entered promiscuous mode device eth1 entered promiscuous mode brctl: invalid argument '0' to 'timespec' **** drop_caches_sysctl_handler: all done timer added ...**** Args: 1 adf: module license 'Proprietary' taints kernel. Disabling lock debugging due to kernel taint ath_hal: 0.9.17.1 (AR5416, AR9380, REGOPS_FUNC, WRITE_EEPROM, 11D) ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved insmod: can't insert '/lib/modules/2.6.31/net/ath_dfs.ko': No such file or directory enet1 port3 up 100Mbps Full duplex ATHR_GMAC: Enet Unit:1 PHY:3 is UP RGMii 1000Mbps full duplex ATHR_GMAC: done cfg2 0x7215 ifctl 0x0 miictrl WASP ----> S27 PHY MDIO Setting Drop CRC Errors, Pause Frames and Length Error frames br0: port 2(eth1) entering learning state ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved ath_ahb: 9.5.5.36 (Atheros/multi-bss) __ath_attach: Set global_scn[0] ACBKMinfree = 48 ACBEMinfree = 32 ACVIMinfree = 16 ACVOMinfree = 0 CABMinfree = 48 UAPSDMinfree = 0 Enterprise mode: 0x00000000 Restoring Cal data from Flash Smart Antenna Enabled ath_get_caps[5914] rx chainmask mismatch actual 3 sc_chainmak 0 ath_get_caps[5889] tx chainmask mismatch actual 3 sc_chainmak 0 ath_tx_paprd_init sc 83bc0000 PAPRD disabled in HAL SC Callback Registration for wifi0 wifi0: Atheros 9340: mem=0xb8100000, irq=2 wlan_vap_create : enter. devhandle=0x83a6c2c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x83a6c2c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. device wlan0 entered promiscuous mode wlan_vap_create : enter. devhandle=0x83a6c2c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x83a6c2c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. device wlan1 entered promiscuous mode wlan_vap_create : enter. devhandle=0x83a6c2c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x83a6c2c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. device wlan2 entered promiscuous mode wlan_vap_create : enter. devhandle=0x83a6c2c0, opmode=IEEE80211_M_HOSTAP, flags=0x1 wlan_vap_create : exit. devhandle=0x83a6c2c0, opmode=IEEE80211_M_HOSTAP, flags=0x1. device wlan3 entered promiscuous mode br0: port 2(eth1) entering forwarding state Setting Max Stations:40 ieee80211_ioctl_siwmode: imr.ifm_active=66176, new mode=3, valid=1 DEVICE IS DOWN ifname=wlan0 DEVICE IS DOWN ifname=wlan0 br0: port 3(wlan0) entering learning state br0: port 3(wlan0) entering forwarding state starting pid 16 CPE880 mips #6 Tue Oct 6 15:29:30 CST 2015 (none) CPE880 login:


The stock firmware runs a web interface on http://192.168.188.253. It allows configuring the device to work in different modes (AP, Client, Bridge, CPE router, etc.).

The web interface is written in English and Chinese.

Web interface

The login credentials for the web interface are written on the back label of the device (user: admin / password: admin).

Command line interface

The CLI can be accessed both via the TTL serial port and via Telnet. In both cases, the login credentials appear to be the Atheros SDK's defaults (user: Admin / password: 5up), which are also found on some Atheros reference design boards.

The device is shipped with U-boot 1.1.4.

U-Boot 1.1.4 (Nov 18 2015 - 16:33:47)

U-boot AP123


DRAM:  64 MB
Flash:  8 MB
In:    serial
Out:   serial
Err:   serial
Net:   
Fetching MAC Address from 0x83ff2ac8
Fetching MAC Address from 0x83ff2ac8
eth0: de:ad:be:ef:00:00
eth0 up
eth1: de:ad:be:ef:00:01
eth1 up
eth0, eth1
Hit any key to stop autoboot:  0
This website uses cookies. By using the website, you agree with storing cookies on your computer. Also you acknowledge that you have read and understand our Privacy Policy. If you do not agree leave the website.More information about cookies
  • Last modified: 2019/10/17 13:09
  • by tmomas