Adding Extreme AP3915i/AP7632i support

Hi,

I have a lot of AP3915i-ROW and some AP7632i-RW APs, which are802.11ac Wave 2 2x2:2 APs based on Qualcomm IPQ4029 with 512MB of RAM and 512MB of flash. IPA4029 is already supported by OpenWRT for https://openwrt.org/toh/aruba/ap-303h

They have a single gigabit ethernet port and only needs 802.3af PoE (it can also take 12V DC). There's an RJ45 serial port which works with a normal cisco console cable at 115200bps (which is good because it has T8 security Torx screws), there's also what looks to be a 4 jumper serial header inside. One button, four LEDs. The bootloader can be stopped (it'll ask for the default credentials, admin/new2day) I'll attach a boot log in a reply.

# cat /proc/partitions 
major minor  #blocks  name

  31        0     524288 mtdblock0
  31        1         64 mtdblock1
  31        2        448 mtdblock2
  31        3         64 mtdblock3
  31        4         64 mtdblock4
  31        5        448 mtdblock5
  31        6         64 mtdblock6
  31        7        512 mtdblock7
  31        8      15040 mtdblock8
  31        9      15040 mtdblock9
  31       10         64 mtdblock10
  31       11     497488 mtdblock11
# cat /proc/meminfo 
MemTotal:         495796 kB

I'm happy to post some to developers interested in adding support, or working remotely to test images.

Datasheet:

This is the FCC version but it looks the same as the ROW:
https://fccid.io/QXO-AP3915I/Internal-Photos/Internal-Photos-3515655

Console boot log:


Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00110
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B -       262 - PBL, Start
B -      1341 - bootable_media_detect_entry, Start
B -      1682 - bootable_media_detect_success, Start
B -      1696 - elf_loader_entry, Start
B -      5102 - auth_hash_seg_entry, Start
B -      7263 - auth_hash_seg_exit, Start
B -    584262 - elf_segs_hash_verify_entry, Start
B -    701368 - PBL, End
B -    701392 - SBL1, Start
B -    791890 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    793422 - boot_flash_init, Start
D -     54501 - boot_flash_init, Delta
B -    852073 - boot_config_data_table_init, Start
D -      3854 - boot_config_data_table_init, Delta - (419 Bytes)
B -    859606 - clock_init, Start
D -      7558 - clock_init, Delta
B -    871235 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    874648 - sbl1_ddr_set_params, Start
B -    879744 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    884126 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13174 - sbl1_ddr_set_params, Delta
B -    897439 - pm_driver_init, Start
D -         3 - pm_driver_init, Delta
B -    968029 - sbl1_wait_for_ddr_training, Start
D -        27 - sbl1_wait_for_ddr_training, Delta
B -    984201 - Image Load, Start
D -    138200 - QSEE Image Loaded, Delta - (268920 Bytes)
B -   1122835 - Image Load, Start
D -      1441 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1133154 - Image Load, Start
D -    187231 - APPSBL Image Loaded, Delta - (382643 Bytes)
B -   1320782 - QSEE Execution, Start
D -        60 - QSEE Execution, Delta
B -   1327000 - SBL1, End
D -    627686 - SBL1, Delta
S - Flash Throughput, 2001 KB/s  (654030 Bytes,  326694 us)
S - DDR Frequency, 672 MHz


U-Boot 2012.07.19-r00020.1 (Jul 17 2017 - 17:24:13) (back-up)

smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  ONFI device found
ID = 9590dc2c
Vendor = 2c
Device = dc
SF: Detected Spansion with page size 64 KiB, total 32 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x2000000
544 MiB
In:    serial
Out:   serial
Err:   serial
machid: 8010001
Net:   MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b2
gBoardSubType = 2
Size = 536870912 bytes, ipqNand 512 MB
ipq40xx_ess_sw_init done
eth0
Warning: eth0 MAC addresses don't match:
Address in SROM is         00:03:7f:ba:db:ad
Address in environment is  b4:2d:56:8e:d2:38

Hit the 's' key to stop autoboot:  0
SF: Detected Spansion with page size 64 KiB, total 32 MiB

found primary bootROM, load and run...
## Starting application at 0x83300000 ...


U-Boot 2012.07.20 (Oct 05 2017 - 16:32:22) (primary)

smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  ONFI device found
ID = 9590dc2c
Vendor = 2c
Device = dc
SF: Detected Spansion with page size 64 KiB, total 32 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x2000000
544 MiB
In:    serial
Out:   serial
Err:   serial
machid: 8010001
Net:   MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b2
gBoardSubType = 2
Size = 536870912 bytes, ipqNand 512 MB
ipq40xx_ess_sw_init done
eth0
Warning: eth0 MAC addresses don't match:
Address in SROM is         00:03:7f:ba:db:ad
Address in environment is  b4:2d:56:8e:d2:38

Hit the 's' key to stop autoboot:  0
## Executing script at 833565b0
check for watchdog, limit=3...
check for reset by watchdog...
no watchdog...
bSaveEnviron=0 image_order=0 1
ready to boot kernel...

Loading from nand2, offset 0x280000
Fit image detected...
   FIT description: ARM OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel@1)
     Description:  ARM OpenWrt Linux-3.14.43
     Type:         Kernel Image
     Compression:  uncompressed
     Data Start:   0x836000e4
     Data Size:    10650056 Bytes = 10.2 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   7914b1e4
    Image 1 (fdt@1)
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x840283a8
     Data Size:    36135 Bytes = 35.3 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   70f43b54
    Default Configuration: 'config@1'
    Configuration 0 (config@1)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@1
Automatic boot of image at addr 0x83600000 ...
## Booting kernel from FIT Image at 83600000 ...
   Using 'config@1' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM OpenWrt Linux-3.14.43
     Type:         Kernel Image
     Compression:  uncompressed
     Data Start:   0x836000e4
     Data Size:    10650056 Bytes = 10.2 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   7914b1e4
   Verifying Hash Integrity ... crc32+ OK
## Flattened Device Tree from FIT Image at 83600000
   Using 'config@1' configuration
   Trying 'fdt@1' FDT blob subimage
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x840283a8
     Data Size:    36135 Bytes = 35.3 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   70f43b54
   Verifying Hash Integrity ... crc32+ OK
   Booting using the fdt blob at 0x840283a8
   Loading Kernel Image ... OK
OK
   Loading Device Tree to 800f4000, end 800ffd26 ... OK
eth0 MAC Address from ART is not valid
eth1 MAC Address from ART is not valid
Using machid 0x8010001 from environment

Starting kernel ...

Booting Linux on physical CPU 0x0
Linux version 3.14.43--10.51.20.0003 (chantry_build@bld-debian1) (gcc version 4.9.1 (crosstool-NG 1.21.0) ) #2 SMP Tue Jul 27 00:20:14 EDT 2021
CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
Machine model: Qualcomm Technologies, Inc. IPQ40xx/AP-DK04.1-C1
Memory policy: Data cache writealloc
PERCPU: Embedded 7 pages/cpu @dfbc8000 s8192 r8192 d12288 u32768
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 125696
Kernel command line: mtdparts=nand2:64k@896k(CFG1),448k(BootBAK)ro,64k(WINGCFG1),64k(ART),448k(BootPRI),64k(WINGCFG2),512k(FS),15040k(PriImg),15040k(SecImg),64k(CFG2) BOOT_BOOTROM="U-Boot 2012.07.20 (Oct 05 2017 - 16:32:22) (primary)" BOOT_KERNEL=primary console=ttyMSM0,115200n81 ubi.mtd=0  panic=30 nohlt ro clk_ignore_unused
PID hash table entries: 2048 (order: 1, 8192 bytes)
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
Memory: 463400K/506880K available (4147K kernel code, 327K rwdata, 1372K rodata, 32396K init, 477K bss, 43480K reserved)
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xe0800000 - 0xff000000   ( 488 MB)
    lowmem  : 0xc0000000 - 0xe0000000   ( 512 MB)
    modules : 0xbf000000 - 0xc0000000   (  16 MB)
      .text : 0xc0208000 - 0xc076be3c   (5520 kB)
      .init : 0xc076c000 - 0xc270f000   (32396 kB)
      .data : 0xc2710000 - 0xc2761f3c   ( 328 kB)
       .bss : 0xc2761f3c - 0xc27d95e0   ( 478 kB)
SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:16 nr_irqs:16 16
Initializaing the hardware watchdog..
Starting tick...
Architected cp15 timer(s) running at 48.00MHz (virt).
sched_clock: 56 bits at 48MHz, resolution 20ns, wraps every 2863311552512ns
Switching to timer-based delay loop
Calibrating delay loop (skipped), value calculated using timer frequency.. 96.00 BogoMIPS (lpj=48000)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
CPU: Testing write buffer coherency: ok
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x80214258 - 0x802142b0
CPU1: Booted secondary processor
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
CPU2: Booted secondary processor
CPU2: thread -1, cpu 2, socket 0, mpidr 80000002
CPU3: Booted secondary processor
CPU3: thread -1, cpu 3, socket 0, mpidr 80000003
Brought up 4 CPUs
SMP: Total of 4 processors activated (384.00 BogoMIPS).
CPU: All CPU(s) started in SVC mode.
VFP support v0.3: implementor 41 architecture 2 part 30 variant 7 rev 5
pinctrl core: initialized pinctrl subsystem
regulator-dummy: no parameters
NET: Registered protocol family 16
DMA: preallocated 2048 KiB pool for atomic coherent allocations
cpuidle: using governor ladder
cpuidle: using governor menu
hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 2
hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 1
hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 3
hw-breakpoint: CPU 1 failed to disable vector catch
hw-breakpoint: Debug register access (0xee003e17) caused undefined instruction on CPU 0

Version Rollback Feature Disabled
i2c-msm-v2 78b7000.i2c: probing driver i2c-msm-v2
i2c-msm-v2 78b8000.i2c: probing driver i2c-msm-v2
sps:sps is ready.
bio: create slab <bio-0> at 0
SD0 VccQ: 1800 <--> 3000 mV
SCSI subsystem initialized
msm_bus_fabric_init_driver
msm_bus_device 580000.ad-hoc-bus: Dev 4096
msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100
msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100
msm_bus_device 580000.ad-hoc-bus: get_bus_node_device_data:Failed to get bus clk for bus4096 ctx0
msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus4096 ctx1
msm_bus_device 580000.ad-hoc-bus: Dev 1024
msm_bus_device 580000.ad-hoc-bus: Util-fact is missing, default to 100
msm_bus_device 580000.ad-hoc-bus: Vrail-comp is missing, default to 100
msm_bus_device 580000.ad-hoc-bus: get_bus_node_device_data:Failed to get bus clk for bus1024 ctx0
msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus1024 ctx1
pcie_init: pcie_init: unable to create IPC log context for pcie0-short
pcie_init: pcie_init: unable to create IPC log context for pcie0-long
Switched to clocksource arch_sys_counter
NET: Registered protocol family 2
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 12288 bytes)
UDP-Lite hash table entries: 256 (order: 1, 12288 bytes)
NET: Registered protocol family 1
hw perfevents: enabled with ARMv7 Cortex-A7 PMU driver, 5 counters available
futex hash table entries: 1024 (order: 4, 65536 bytes)
jffs2: version 2.2 (NAND) (SUMMARY) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
msgmni has been set to 905
io scheduler noop registered
io scheduler deadline registered (default)
tcsr 194b000.tcsr: setting usb hs phy mode select = e700e7
tcsr 1953000.ess_tcsr: setting ess interface select = 0
tcsr 1949000.tcsr: setting wifi_glb_cfg = 41000000
tcsr 1957000.tcsr: setting wifi_noc_memtype_m0_m2 = 2222222
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
msm_serial_hsl_probe: detected port #0 (ttyMSM0)
msm_serial_hsl_probe: Bus scaling is disabled
78af000.serial: ttyMSM0 at MMIO 0x78af000 (irq = 139, base_baud = 115200) is a MSM
msm_hsl_console_setup: console setup on port #0
console [ttyMSM0] enabled
msm_serial_hsl_probe: detected port #1 (ttyMSM1)
msm_serial_hsl_probe: Bus scaling is disabled
78b0000.serial: ttyMSM1 at MMIO 0x78b0000 (irq = 140, base_baud = 115200) is a MSM
msm_serial_hsl_init: driver initialized
msm_serial_hs module loaded
sps: BAM device 0x07984000 is not registered yet.
sps:BAM 0x07984000 is registered.
msm_nand_bam_init: msm_nand_bam_init: BAM device registered: bam_handle 0xdca48600
sps:BAM 0x07984000 (va:0xe0a60000) enabled: ver:0x19, number of pipes:7
msm_nand_version_check: nand_major:1, nand_minor:4, qpic_major:1, qpic_minor:4
msm_nand_scan: missing page size info - extract from NAND ID
msm_nand_scan: NAND Id: 0x9590dc2c Buswidth: 8Bits Density: 512 MByte
msm_nand_scan: pagesize: 2048 Erasesize: 131072 oobsize: 64 (in Bytes)
msm_nand_scan: BCH ECC: 4 Bit
msm_nand_scan: CFG0: 0x2a0408c0,      CFG1: 0x0804745c
            RAWCFG0: 0x280420c0,   RAWCFG1: 0x0005045d
          ECCBUFCFG: 0x00000203, ECCBCHCFG: 0x42040700
     BAD BLOCK BYTE: 0x000001d1
1 ofpart partitions found on MTD device 7980000.qcom,nand
Creating 1 MTD partitions on "7980000.qcom,nand":
0x000000000000-0x000020000000 : "nand_flash"
msm_nand_probe: NANDc phys addr 0x7980000, BAM phys addr 0x7984000, BAM IRQ 133
msm_nand_probe: Allocated DMA buffer at virt_addr 0xe0a5c000, phys_addr 0x9ca4a000
sps: BAM device 0x07884000 is not registered yet.
sps:BAM 0x07884000 is registered.
sps:BAM 0x07884000 (va:0xe0b40000) enabled: ver:0x19, number of pipes:12
m25p80 spi0.0: found s25fl256s1, expected n25q128a11
m25p80 spi0.0: s25fl256s1 (32768 Kbytes)
10 ofpart partitions found on MTD device spi0.0
Creating 10 MTD partitions on "spi0.0":
0x0000000e0000-0x0000000f0000 : "CFG1"
0x0000000f0000-0x000000160000 : "BootBAK"
0x000000160000-0x000000170000 : "WINGCFG1"
0x000000170000-0x000000180000 : "ART"
0x000000180000-0x0000001f0000 : "BootPRI"
0x0000001f0000-0x000000200000 : "WINGCFG2"
0x000000200000-0x000000280000 : "FS"
0x000000280000-0x000001130000 : "PriImg"
0x000001130000-0x000001fe0000 : "SecImg"
0x000001fe0000-0x000001ff0000 : "CFG2"
libphy: ipq40xx_mdio: probed
ipq40xx-mdio 90000.mdio: ipq40xx-mdio driver was registered
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
i2c /dev entries driver
Netfilter messages via NETLINK v0.30.
nf_conntrack version 0.5.0 (7240 buckets, 28960 max)
ctnetlink v0.93: registering with nfnetlink.
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
NET: Registered protocol family 10
NET: Registered protocol family 17
8021q: 802.1Q VLAN Support v1.8
Registering SWP/SWPB emulation handler
SD0 VccQ: disabling
regulator-dummy: disabling
UBI: attaching mtd0 to ubi0
UBI: scanning is finished
UBI: attached mtd0 (name "nand_flash", size 512 MiB) to ubi0
UBI: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
UBI: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
UBI: VID header offset: 2048 (aligned 2048), data offset: 4096
UBI: good PEBs: 4096, bad PEBs: 0, corrupted PEBs: 0
UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
UBI: max/mean erase counter: 4/2, WL threshold: 4096, image sequence number: 82061083
UBI: available PEBs: 0, total reserved PEBs: 4096, PEBs reserved for bad PEB handling: 80
UBI: background thread "ubi_bgt0d" started, PID 69
hctosys.c: unable to open rtc device (rtc0)
clk: Not disabling unused clocks
Freeing unused kernel memory: 32396K (c076c000 - c270f000)
init started: BusyBox v1.17.4 (2021-07-26 23:43:02 EDT)
starting pid 70, tty '': '/etc/rc.d/rcS'
UBIFS: background thread "ubifs_bgt0_0" started, PID 160
UBIFS: recovery needed
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 0, name "nand_flash"
UBIFS: LEB size: 126976 bytes (124 KiB), min./max. I/O unit sizes: 2048 bytes/2048 bytes
UBIFS: FS size: 508030976 bytes (484 MiB, 4001 LEBs), journal size 9023488 bytes (8 MiB, 72 LEBs)
UBIFS: reserved for root: 0 bytes (0 KiB)
UBIFS: media format: w4/r0 (latest is w4/r0), UUID 5DEAF011-725F-4131-B2EE-A983E205E07B, small LPT model
data plane cores = 3,2
fast path cores = 3,2
rcS: watchdogDis 0 serNum 1824Y-1105600000
Read/Write Crypto Section successfully !
Setting gBoardSubType to 2
sh: 2667315200: out of range
eth0 hw addr: B4:2D:56:8E:D2:38
netif_napi_add() called with weight 256 on device dispatcher
update_compliance_file: /flash/v3_confData.bin up to date (Ver in Image /etc/v3_AP3915i-ROW.bin-75 Ver on AP AP3915i-ROW-75 format 193)
writeVersionToFile Imported Compliance Table V1.71 dated on 3/10/2020 (AP39XX_Power_Settings_V9.xlsx)


MODEL          AP3915i-ROW
SERVICETYPE    siemens
SERVICEATTRS   ac_manager,ru_manager
AC_HOSTNAME    Controller
VERSIONBASE    0
SERIALNUMBER   1824Y-1105600000
AP_FLAG        128
AP_MODE        0
AP_PERSONALITY identifi
NUM_ANTENNAS   4

starting pid 875, tty '': '/sbin/getty ttyMSM0 115200'

 (none) armv7l #2 SMP Tue Jul 27 00:20:14 EDT 2021 (none)

Hi trs80

What Openwrt-image did you install on the AP3915i?
The Aruba AP-303H Image?

Nothing, that's the vendor firmware. The offer to post some APs to someone who can add support is still open.

Ok
I found a hint for the WS-AP3915 in the master image on github.

In package/firmware/ipq-wifi you find board-extreme-network_ws-ap3915i.qca4019.

Does that mean that openwrt basically works if you compile the github-master?

Yes, looks like support for it was added in September: https://github.com/openwrt/openwrt/commit/e16a0e7e8876df0a92ec4779fe766de1a943307a

I went to build it and it's been disabled because it's not converted to DSA:

I'm trying a build of 132545785bbbe50c4403640153b686c3b75b63a8 which is just before it was disabled.

My build failed with

/home/trs80/openwrt/openwrt/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx_generic/linux-5.15.71/arch/arm/boot/dts/qcom-ipq4019.dtsi:37.10-43.4: ERROR (path_references): /aliases: Reference to non-existent node or label "gmac0"

also defined at /home/trs80/openwrt/openwrt/build_dir/target-arm_cortex-a7+neon-vfpv4_musl_eabi/linux-ipq40xx_generic/linux-5.15.71/arch/arm/boot/dts/qcom-ipq4018-gl-ap1300.dts:12.10-18.4
ERROR: Input tree has errors, aborting (use -f to force output)

Looking at other patches that add DSA support, they're fairly simple (could just be adding some lines to the .dts file) but how do I tell which switchport is used for the single ethernet? Most others with a single port seem to use port 5 ... I made a patch, it compiles, let's see if it works.

Do you have any details about your patch?
Did you just replace „D-LINK DAP-2610“ with „Extreme-Networks_ws-ap3915i“?

Sorry but I'm openwrt newbie.