The serial console RJ45 port on the back is Cisco compatible (115200 8n1)
The boot process can be interrupted.
I noted the chips from the pictures from FCC. The most matching already supported devices are
Edgecore ECW5410 and AP148
Boot (BAK)-> set serverip 192.168.1.66
Boot (BAK)-> set ipaddr 192.168.1.10
Boot (BAK)-> tftpboot openwrt-ipq806x-generic-edgecore_ecw5410-initramfs-fit-uImage.itb
Full duplex link
Link 0 up, Phy_status = bc50
Port:0 speed 1000Mbps
Using eth0 device
TFTP from server 192.168.1.66; our IP address is 192.168.1.10
Filename 'openwrt-ipq806x-generic-edgecore_ecw5410-initramfs-fit-uImage.itb'.
Load address: 0x44000000
Loading: *#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##################
done
Bytes transferred = 7887988 (785c74 hex)
Boot (BAK)-> bootm
## Booting kernel from FIT Image at 44000000 ...
Using 'config@v2.0-ap160' configuration
Trying 'kernel@1' kernel subimage
Description: ARM OpenWrt Linux-5.4.91
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x440000e4
Data Size: 7855945 Bytes = 7.5 MiB
Architecture: ARM
OS: Linux
Load Address: 0x42208000
Entry Point: 0x42208000
Hash algo: crc32
Hash value: 5c061fe0
Hash algo: sha1
Hash value: c46d016a230f1505aa5a26458a2ca850f61ee251
Verifying Hash Integrity ... crc32+ sha1+ OK
Uncompressing Kernel Image ... OK
Setting up atags for msm partition: nand_flash
device nand1 <nand1>, # parts = 13
#: name size offset mask_flags
0: CFG1 0x00010000 0x002a0000 0
1: BootPRI 0x00080000 0x002b0000 0
2: CFG2 0x00010000 0x00330000 0
3: NVRAM1 0x00010000 0x00340000 0
4: NVRAM2 0x00010000 0x00350000 0
5: NVRAM3 0x00010000 0x00360000 0
6: NVRAM4 0x00010000 0x00370000 0
7: NVRAM5 0x00010000 0x00380000 0
8: NVRAM6 0x00010000 0x00390000 0
9: NVRAM7 0x00010000 0x003a0000 0
10: NVRAM8 0x00010000 0x003b0000 0
11: PriImg 0x00e10000 0x003c0000 0
12: SecImg 0x00e10000 0x011d0000 0
active partition: nand1,0 - (CFG1) 0x00010000 @ 0x002a0000
defaults:
mtdids : nand1=nand1
mtdparts: mtdparts=nand1:64k@2688k(CFG1),512k(BootPRI),64k(CFG2),64k(NVRAM1),64k(NVRAM2),64k(NVRAM3),64k(NVRAM4),64k(NVRAM5),64k(NVRAM6),64k(NVRAM7),64k(NVRAM8),14400k(PriImg),14400k(SecImg)
Setting up atags for msm partition: CFG1
Setting up atags for msm partition: BootPRI
Setting up atags for msm partition: CFG2
Setting up atags for msm partition: NVRAM1
Setting up atags for msm partition: NVRAM2
Setting up atags for msm partition: NVRAM3
Setting up atags for msm partition: NVRAM4
Setting up atags for msm partition: NVRAM5
Setting up atags for msm partition: NVRAM6
Setting up atags for msm partition: NVRAM7
Setting up atags for msm partition: NVRAM8
Setting up atags for msm partition: PriImg
Setting up atags for msm partition: SecImg
Using machid 0x1260 from environment
Starting kernel ...
My problem is that I don't get further than "starting kernel" with initramfs from AP148 or edgecore_ecw5410 image.
There is also an 4-pin serial header on the board. In Stock boot process I noted "console=ttyHSL0,115200n81" but in other images "" console=ttyMSM0,115200n8 root=/dev/ubiblock0_1";"
Is AP148 or edgecore_ecw5410 the better start point for my own DTS file?
TP-LINK Archer C2600 seems to also use the AP148 DTS based on the kernel output, so you could try that DTS too for something similar, but if you could extract the factory DTS, that'll probably be your best starting point.
Also, the SSH user/password should be admin/new2day if you can try and access any info from the CLI
Essentially use some serial application (miniterm / minicom / realterm or whatever) and capture the serial output to file, and then do md to see the kernel image as hex, and then use the uboot-mdb-dump tool above to turn that into the binary form of it.
Once you have the dtb (the binary form) you can convert into source using
dtc -I dtb -O dts filename.dtb
Managed to buy one of these for AU$30 (using an AfterPay voucher code), so hopefully by the time it arrives at my doorstep you'll have OpenWRT running on it already!
devicetree decompilation is a nice trick, but in this situation it is a lot of effort and not necessary.
I would recommend simply opening the case, removing the shields (the very thin metal lids), taking and sharing some pictures and the FCC ID, and recording chip models
and from there you find a similar DTS in openwrt and copy it and make the necessary edits
if you do a very smooth job with removing the shields, they can be put back on
msm_serial_hs.0: ttyHS0 at MMIO 0x12490000 (irq = 227) is a MSM HS UART
msm_serial_hs module loaded
msm_serial_hsl: detected port #0
msm_serial_hsl.0: ttyHSL0 at MMIO 0x16640000 (irq = 190) is a MSM
msm_serial_hsl: console setup on port #0
console [ttyHSL0] enabled
So, it looks like we need serial active on 0x16640000, which hopefully maps to the RJ45 console.
I am trying to build something for the device, and am using:
&gsbi7 {
status = "okay";
gsbi7_serial: serial@16640000 {
status = "okay";
};
};
So hopefully that'll solve the serial issue.
I tried to extract the dts from the dtb, but it complains about invalid format...
I'm trying to get an access to 3935i through the putty by using serial port with configuration 115200, bits 8-1, parity none, flow control Xon Xoff, but nothing isn't going.
Is this configuration right? Or what should I do for having the access?
It is also possible that serial console is simply blocked by the software (and by software, it could be either pin muxing registers or missing "console=" in kernel command line), in which case the workaround is to downgrade the firmware and enable SSH
before you modify the board, you should share pictures of your board (or just tell us the FCC ID so we can look up pictures). You should verify the board designs are the same before ripping off any resistors.
I'm trying to compile your repository but when I start make config I'm not sure which target system/subtarget/image to choose to be able to select AP3935i. Can you tell us which categories/subcategories to choose to be able to list AP3935i?
I'm new to openWRT and I wanted to prepare bin firmware so I can try to flash my device.
hy,
I am trying to flash one ap3935i accesspoint, but it does not work.
After sysupgrade it always boots the default image again.
Any Idea what is wrong?
