Adding support for Arista C-130 / Mojo C-130 / WatchGuard AP420

I had a chance this weekend to poke around more in the factory image.

Here is a full listing of the /sbin/ scripts if anyone wants to grep through them. The GPIO scripts in /sbin/ appear to just display the current state and allow setting pin values:

/ # head -n 99999 /sbin/gpio*
==> /sbin/gpio.sh <==
#!/bin/sh

PIN=$1
DIR=$2
VAL=$3

#echo $1 $2 $3

GPIODIR=/sys/class/gpio

if [ ! -e $GPIODIR/gpio$PIN ]
then
        echo $PIN > $GPIODIR/export
fi

if [ -e $2 ]
then
        echo "Old vlaue:"
        cat $GPIODIR/gpio$PIN/value
        cat $GPIODIR/gpio$PIN/direction
else
        echo $DIR > $GPIODIR/gpio$PIN/direction
        echo "Old vlaue:"
        cat $GPIODIR/gpio$PIN/value
        echo "New value:"
        echo $VAL > $GPIODIR/gpio$PIN/value
        cat $GPIODIR/gpio$PIN/value
fi

==> /sbin/gpio_dump.sh <==
#!/bin/sh
GPIOCHIP=0
BASE=$(cat /sys/class/gpio/gpiochip${GPIOCHIP}/base)
NGPIO=$(cat /sys/class/gpio/gpiochip${GPIOCHIP}/ngpio)
max=$(($BASE+$NGPIO))
gpio=$BASE
while [ $gpio -lt $max ] ; do
        echo $gpio > /sys/class/gpio/export
        [ -d /sys/class/gpio/gpio${gpio} ] && {
                echo in > /sys/class/gpio/gpio${gpio}/direction
                echo "[GPIO${gpio}] value $(cat /sys/class/gpio/gpio${gpio}/value)"
                echo ${gpio} > /sys/class/gpio/unexport
        }
        gpio=$((gpio+1))
done

I put the output from gpio_dump.sh here.

This is /lib/ipq806x.sh:

/ # cat /lib/ipq806x.sh
#!/bin/sh
#
# Copyright (c) 2013 The Linux Foundation. All rights reserved.
# Copyright (C) 2011 OpenWrt.org
#

IPQ806X_BOARD_NAME=
IPQ806X_MODEL=

ipq806x_board_detect() {
        local machine
        local name

        machine=$(awk 'BEGIN{FS="[ \t]+:[ \t]"} /Hardware/ {print $2}' /proc/cpuinfo)

        case "$machine" in
        *"DB149 reference board")
                name="db149"
                ;;
        *"AP148 reference board")
                name="ap148"
                ;;
        *"AP145 reference board")
                name="ap145"
                ;;
        *"AP145-1XX reference board")
                name="ap145_1xx"
                ;;
        *"DB149-1XX reference board")
                name="db149_1xx"
                ;;
        *"DB149-2XX reference board")
                name="db149_2xx"
                ;;
        *"AP148-1XX reference board")
                name="ap148_1xx"
                ;;
        *"AP160 reference board")
                name="ap160"
                ;;
        *"AP160-2XX reference board")
                name="ap160_2xx"
                ;;
        *"AP161 reference board")
                name="ap161"
                ;;
        *"AK01-1XX reference board")
                name="ak01_1xx"
                ;;
        esac

        [ -z "$name" ] && name="unknown"

        [ -z "$IPQ806X_BOARD_NAME" ] && IPQ806X_BOARD_NAME="$name"
        [ -z "$IPQ806X_MODEL" ] && IPQ806X_MODEL="$machine"

        [ -e "/tmp/sysinfo/" ] || mkdir -p "/tmp/sysinfo/"

        echo "$IPQ806X_BOARD_NAME" > /tmp/sysinfo/board_name
        echo "$IPQ806X_MODEL" > /tmp/sysinfo/model
}

ipq806x_board_name() {
        local name

        [ -f /tmp/sysinfo/board_name ] && name=$(cat /tmp/sysinfo/board_name)
        [ -z "$name" ] && name="unknown"

        echo "$name"
}

As far as GPL archives, they have their EOS sources available but I haven't been able to find anything useful specific to the C-130 in there yet.

from 8023af.sh:

        # turn usb on
        gpio.sh 67 out 1
        # turn eth1 on
        gpio.sh 8 out 1
        ifconfig eth1 up

Can you try adapting the Meraki MR52 dts to this? You'll need to add gpio8 to phy_active in qcom-ipq8068-cryptid-common.dtsi and comment out i2c_pins in qcom-ipq8068-mr52.dts and experiment with mdio_gpio0 section to add gpio 8 there.

Good spot on the GPIO pins.

I have created a new C130 dts based on the MR52 and have it booting from that now. I am able to see eth0 and wlan0 interfaces in ip link, but from the logs it doesn't appear to be finding the ethernet PHYs, only one wireless.

iw list
Wiphy phy2
	wiphy index: 2
	max # scan SSIDs: 16
	max scan IEs length: 195 bytes
	max # sched scan SSIDs: 0
	max # match sets: 0
	Retry short limit: 7
	Retry long limit: 4
	Coverage class: 0 (up to 0m)
	Device supports AP-side u-APSD.
	Available Antennas: TX 0x3 RX 0x3
	Configured Antennas: TX 0x3 RX 0x3
	Supported interface modes:
		 * managed
		 * AP
		 * AP/VLAN
		 * monitor
		 * mesh point
	Band 1:
		Capabilities: 0x19ef
			RX LDPC
			HT20/HT40
			SM Power Save disabled
			RX HT20 SGI
			RX HT40 SGI
			TX STBC
			RX STBC 1-stream
			Max AMSDU length: 7935 bytes
			DSSS/CCK HT40
		Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
		Minimum RX AMPDU time spacing: 8 usec (0x06)
		HT TX/RX MCS rate indexes supported: 0-15
		Frequencies:
			* 2412 MHz [1] (20.0 dBm)
			* 2417 MHz [2] (20.0 dBm)
			* 2422 MHz [3] (20.0 dBm)
			* 2427 MHz [4] (20.0 dBm)
			* 2432 MHz [5] (20.0 dBm)
			* 2437 MHz [6] (20.0 dBm)
			* 2442 MHz [7] (20.0 dBm)
			* 2447 MHz [8] (20.0 dBm)
			* 2452 MHz [9] (20.0 dBm)
			* 2457 MHz [10] (20.0 dBm)
			* 2462 MHz [11] (20.0 dBm)
			* 2467 MHz [12] (20.0 dBm) (no IR)
			* 2472 MHz [13] (20.0 dBm) (no IR)
			* 2484 MHz [14] (20.0 dBm) (no IR)
	Band 2:
		Capabilities: 0x19ef
			RX LDPC
			HT20/HT40
			SM Power Save disabled
			RX HT20 SGI
			RX HT40 SGI
			TX STBC
			RX STBC 1-stream
			Max AMSDU length: 7935 bytes
			DSSS/CCK HT40
		Maximum RX AMPDU length 65535 bytes (exponent: 0x003)
		Minimum RX AMPDU time spacing: 8 usec (0x06)
		HT TX/RX MCS rate indexes supported: 0-15
		VHT Capabilities (0x338001b2):
			Max MPDU length: 11454
			Supported Channel Width: neither 160 nor 80+80
			RX LDPC
			short GI (80 MHz)
			TX STBC
			RX antenna pattern consistency
			TX antenna pattern consistency
		VHT RX MCS set:
			1 streams: MCS 0-9
			2 streams: MCS 0-9
			3 streams: not supported
			4 streams: not supported
			5 streams: not supported
			6 streams: not supported
			7 streams: not supported
			8 streams: not supported
		VHT RX highest supported: 0 Mbps
		VHT TX MCS set:
			1 streams: MCS 0-9
			2 streams: MCS 0-9
			3 streams: not supported
			4 streams: not supported
			5 streams: not supported
			6 streams: not supported
			7 streams: not supported
			8 streams: not supported
		VHT TX highest supported: 0 Mbps
		Frequencies:
			* 5180 MHz [36] (20.0 dBm)
			* 5200 MHz [40] (20.0 dBm)
			* 5220 MHz [44] (20.0 dBm)
			* 5240 MHz [48] (20.0 dBm)
			* 5260 MHz [52] (20.0 dBm) (no IR, radar detection)
			* 5280 MHz [56] (20.0 dBm) (no IR, radar detection)
			* 5300 MHz [60] (20.0 dBm) (no IR, radar detection)
			* 5320 MHz [64] (20.0 dBm) (no IR, radar detection)
			* 5500 MHz [100] (20.0 dBm) (no IR, radar detection)
			* 5520 MHz [104] (20.0 dBm) (no IR, radar detection)
			* 5540 MHz [108] (20.0 dBm) (no IR, radar detection)
			* 5560 MHz [112] (20.0 dBm) (no IR, radar detection)
			* 5580 MHz [116] (20.0 dBm) (no IR, radar detection)
			* 5600 MHz [120] (20.0 dBm) (no IR, radar detection)
			* 5620 MHz [124] (20.0 dBm) (no IR, radar detection)
			* 5640 MHz [128] (20.0 dBm) (no IR, radar detection)
			* 5660 MHz [132] (20.0 dBm) (no IR, radar detection)
			* 5680 MHz [136] (20.0 dBm) (no IR, radar detection)
			* 5700 MHz [140] (20.0 dBm) (no IR, radar detection)
			* 5720 MHz [144] (20.0 dBm) (no IR, radar detection)
			* 5745 MHz [149] (20.0 dBm) (no IR)
			* 5765 MHz [153] (20.0 dBm) (no IR)
			* 5785 MHz [157] (20.0 dBm) (no IR)
			* 5805 MHz [161] (20.0 dBm) (no IR)
			* 5825 MHz [165] (20.0 dBm) (no IR)
			* 5845 MHz [169] (disabled)
			* 5865 MHz [173] (disabled)
	valid interface combinations:
		 * #{ AP, mesh point } <= 8, #{ managed } <= 1,
		   total <= 8, #channels <= 1, STA/AP BI must match, radar detect widths: { 20 MHz (no HT), 20 MHz, 40 MHz, 80 MHz }

	HT Capability overrides:
		 * MCS: ff ff ff ff ff ff ff ff ff ff
		 * maximum A-MSDU length
		 * supported channel width
		 * short GI for 40 MHz
		 * max A-MPDU length exponent
		 * min MPDU start spacing
	max # scan plans: 1
	max scan plan interval: -1
	max scan plan iterations: 0
	Maximum associated stations in AP mode: 128
	Supported extended features:
		* [ VHT_IBSS ]: VHT-IBSS
		* [ RRM ]: RRM
		* [ SET_SCAN_DWELL ]: scan dwell setting
		* [ FILS_STA ]: STA FILS (Fast Initial Link Setup)
		* [ CQM_RSSI_LIST ]: multiple CQM_RSSI_THOLD records
		* [ CONTROL_PORT_OVER_NL80211 ]: control port over nl80211
		* [ ACK_SIGNAL_SUPPORT ]: ack signal level support
		* [ TXQS ]: FQ-CoDel-enabled intermediate TXQs
		* [ AIRTIME_FAIRNESS ]: airtime fairness scheduling
		* [ AQL ]: Airtime Queue Limits (AQL)
		* [ CONTROL_PORT_NO_PREAUTH ]: disable pre-auth over nl80211 control port support
		* [ SCAN_FREQ_KHZ ]: scan on kHz frequency support
		* [ CONTROL_PORT_OVER_NL80211_TX_STATUS ]: tx status for nl80211 control port support
root@OpenWrt:/# ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop master br-lan state DOWN qlen 1000
    link/ether 88:b1:e1:24:9a:ff brd ff:ff:ff:ff:ff:ff
3: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 88:b1:e1:24:92:e0 brd ff:ff:ff:ff:ff:ff
4: br-lan: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN qlen 1000
    link/ether 88:b1:e1:24:9a:ff brd ff:ff:ff:ff:ff:ff
root@OpenWrt:/# ifconfig eth0 up
[  559.763528] ipq806x-gmac-dwmac 37400000.ethernet eth0: no phy at addr -1
[  559.763576] ipq806x-gmac-dwmac 37400000.ethernet eth0: stmmac_open: Cannot attach to PHY (error: -19)
ifconfig: SIOCSIFFLAGS: No such device

Good news is that one wireless interface I am able to bring up in AP mode and successfully connect clients.

I haven't had much time yet to poke around and see why only one eth interface is showing up but I suspect it has something to do with my DTS configuration at this point. As to why the PHY is not found, not sure if that is just a case of not flipping the correct GPIO bit, missing driver, or something else entirely.

I have a Watchguard AP420 I've been poking at but unfortunately it looks like it has much newer uboot version that doesn't have the serial console enabled:

U-Boot 2012.07-00003-gb4b8aa3d7 [local,local] (Jan 31 2020 - 06:48:05)

smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  SF: Detected MX25U25635F with page size 4 KiB, total 32 MiB
ipq_spi: page_size: 0x100, sector_size: 0x1000, size: 0x2000000
160 MiB
MMC:   
PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
MMC Device 0 not found
cdp: get part failed for rootfs
MMC Device 0 not found
cdp: get part failed for opt
Net:   MAC2 addr:0:1:21:11:21:7f
Port:2 speed 10Mbps
Skipping switch init
Switch inits done
MAC3 addr:0:1:21:11:21:7e
Port:3 speed 10Mbps
eth0, eth1
Device 1: nand1... is now current device

NAND read: device 1 offset 0x4a0000, size 0x500000
 5242880 bytes read: OK

## Checking Image at 44000000 ...
   FIT image found
   FIT description: ARM OpenWrt FIT (Flattened Image Tree)
    Image 0 (kernel@1)
     Description:  ARM OpenWrt Linux-Linux-3.14.77
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x44000118
     Data Size:    3016719 Bytes = 2.9 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x42208000
     Entry Point:  0x42208000
     Hash algo:    crc32
     Hash value:   66769fe8
     Hash algo:    sha1
     Hash value:   9e2ce43c99de1ebb96e8b5906bddab5d62072d86
    Image 1 (fdt@ap148)
     Description:  ARM OpenWrt qcom-ipq8064-ap148 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x442e0a68
     Data Size:    24700 Bytes = 24.1 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   e2433e71
     Hash algo:    sha1
     Hash value:   6ed7eb278a36d4c06cd501694e69dcf8ca59b65b
    Image 2 (fdt@v2.0-ap148)
     Description:  ARM OpenWrt qcom-ipq8064-ap148 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x442e6c04
     Data Size:    24923 Bytes = 24.3 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   fa1c7a64
     Hash algo:    sha1
     Hash value:   8cbe31715908b38e658d2edd28c515b3343bc185
    Image 3 (fdt@v3.0-ap148)
     Description:  ARM OpenWrt qcom-ipq8064-ap148 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x442ece80
     Data Size:    25346 Bytes = 24.8 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   8594ad31
     Hash algo:    sha1
     Hash value:   8fd4bb598f36229adb581c070ee59f8392e45413
    Default Configuration: 'config@4704_1'
    Configuration 0 (config@4704_2)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@ap148
    Configuration 1 (config@4704_3)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@v2.0-ap148
    Configuration 2 (config@4704_4)
     Description:  OpenWrt
     Kernel:       kernel@1
     FDT:          fdt@v3.0-ap148
## Checking hash(es) for FIT Image at 44000000 ...
   Hash(es) for Image 0 (kernel@1): crc32+ sha1+ 
   Hash(es) for Image 1 (fdt@ap148): crc32+ sha1+ 
   Hash(es) for Image 2 (fdt@v2.0-ap148): crc32+ sha1+ 
   Hash(es) for Image 3 (fdt@v3.0-ap148): crc32+ sha1+ 
MMC Device 0 not found
MMC Device 0 not found

NAND read: device 1 offset 0x4a0000, size 0x500000
 5242880 bytes read: OK
## Booting kernel from FIT Image at 44000000 ...
   Using 'config@4704_2' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM OpenWrt Linux-Linux-3.14.77
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x44000118
     Data Size:    3016719 Bytes = 2.9 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x42208000
     Entry Point:  0x42208000
     Hash algo:    crc32
     Hash value:   66769fe8
     Hash algo:    sha1
     Hash value:   9e2ce43c99de1ebb96e8b5906bddab5d62072d86
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 44000000
   Using 'config@4704_2' configuration
   Trying 'fdt@ap148' FDT blob subimage
     Description:  ARM OpenWrt qcom-ipq8064-ap148 device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x442e0a68
     Data Size:    24700 Bytes = 24.1 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   e2433e71
     Hash algo:    sha1
     Hash value:   6ed7eb278a36d4c06cd501694e69dcf8ca59b65b
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Loading FDT from 0x442e0a68 to 0x43f00000
   Booting using the fdt blob at 0x43f00000
   Uncompressing Kernel Image ... OK
   Using Device Tree in place at 43f00000, end 43f0907b
MMC Device 0 not found
cdp: get part failed for rootfs
MMC Device 0 not found
cdp: get part failed for opt
mtdparts = mtdparts=nand0:0x2000000@0(rootfs);nand1:128K@0x0(0:SBL1),128K@0x20000(0:MIBIB),256K@0x40000(0:SBL2),512K@0x80000(0:SBL3),64K@0x100000(0:DDRCONFIG),64K@0x110000(0:SSD),512K@0x120000(0:TZ),512K@0x1a0000(0:RPM),1024K@0x220000(0:APPSBL),256K@0x320000(0:APPSBLENV),1024K@0x360000(0:ART),128K@0x460000(0:VENDORDATA),64K@0x490000(0:BOOTCONFIG),5M@0x4a0000(0:HLOS),5M@0x9a0000(0:HLOS1),4M@0xea0000(0:UCONFIG),13M@0x12a0000(0:RECOVERY),
Using machid 0x1260 from environment

Starting kernel ...

I haven't found a way to escape the cli shell yet so limited options.
Any suggestions?

I know this is old. Have you made any more traction on this? I have an interest in helping out. We have a few of these devices laying around at the office that aren't supported anymore.

The AP420? Or one of the others?

I failed to make any headway on the 420. No way to access uboot I could find.

Looking for the mojo C-130.

I still have mine on the bench and have it booting OpenWRT but needing to learn how to correctly setup the device tree. Right now the Ethernet interfaces are not working and only one wireless radio comes up. Haven't had a huge amount of time as of late to figure my way through that portion.

Certainly willing to answer any questions regarding the progress I have so far.

I took apart one of the ones here and noticed that the chip for the ethernet controllers is a bothhand VP6014. Which from their site is really a Broadcom BCM5481. Would adding kmod-phy-broadcom to the DEVICE_PACKAGES work? I'm really new to the openwrt builder and not 100% sure what actually needs to be changed.

https://forum.openwrt.org/t/openwrt-support-for-watchguard-ap320-aka-mojo-c-75/87679/4?u=malihcell

Run setenv bootdelay 3 is not working on this modem, then run setenv bootstopkey s and saveenv.

Any progress? This device are similiar to nokia ac400i which got support lastly.

Did you ever find a way to interrupt uboot on the WatchGuard AP420? I recently bought a cheap Mojo C-120 on ebay and unfortunately it also has the same uboot version as the AP420 and I've not found a way to interrupt it yet.

The C-120 hardware is the same as the C-130 without the mini pcie wifi radio but it is running a slightly newer uboot and kernel.

Unfortunately I didn't. It's still sitting next to my desk gathering dust. I considered it might have a secondary console connection but haven't gotten around to looking for it. Otherwise I'd guess it's jtag time. I can certainly try anything anyone suggests.

This posting show on how to do it on the Mojo C-75 or WG AP320 (My device). Open your AP and check if your board has this same chip aswell. I was able to interrupt the autoboot and upload the OpenWRT firmware, but i was having an issue for save the config in the memory.

1 Like

Ooo interesting. I'll try that this weekend if I have time.

Thanks for the advice. There is a similar 16 pin Spansion FL256SA chip on the back of the board. I've tried a few times to short the pins but have had no luck so far. It either resets the board and starts again or it ends in a frozen state that requires a full power off. I've not been able to end up with an uboot shell unfortunately.

U-Boot 2012.07-00003-gb4b8aa3d7 [local,local] (Jan 31 2020 - 06:48:05)

smem ram ptable found: ver: 0 len: 5
DRAM:  491 MiB
NAND:  SF: Detected S25FL256S with page size 64 KiB, total 32 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x2000000
160 MiB
MMC:   
PCI0 Link Intialized
PCI1 Link Intialized
In:    serial
Out:   serial
Err:   serial
MMC Device 0 not found
cdp: get part failed for rootfs
MMC Device 0 not found
cdp: get part failed for opt
Net:   MAC2 addr:0:11:74:f5:fb:9f
Port:2 speed 10Mbps
Skipping switch init
Switch inits done
MAC3 addr:0:11:74:f5:fb:9e
Port:3 speed 10Mbps
eth0, eth1
Device 1: nand1... is now current device

NAND read: device 1 offset 0x4a0000, size 0x500000
 5242880 bytes read: OK

## Checking Image at 44000000 ...
Unknown image format!
Saving Environment to NAND...
Erasing Nand...
Erasing at 0x350000 -- 100% complete.
Writing to Nand... done
resetting ...

Resetting with watch dog!