Am I on the right track?

Hardware Questions and Recommendations
1

Hello, I have a bunch of used Extreme networks AP-7612, and in order to make the usable without spending a bunch of money I thought I would see what it takes to install openwrt on them. I got a console into the uBoot menu and got these hex flash memory addresses. Can I simply upload any openwrt image since it has an ipq4029 chip? Thanks for any help /info!

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00110
S - IMAGE_VARIANT_STRING=DAACANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000025
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B -       261 - PBL, Start
B -      1338 - bootable_media_detect_entry, Start
B -      2607 - bootable_media_detect_success, Start
B -      2622 - elf_loader_entry, Start
B -      4028 - auth_hash_seg_entry, Start
B -      6177 - auth_hash_seg_exit, Start
B -     74160 - elf_segs_hash_verify_entry, Start
B -    195946 - PBL, End
B -    195971 - SBL1, Start
B -    287998 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    289489 - boot_flash_init, Start
D -     95160 - boot_flash_init, Delta
B -    388946 - boot_config_data_table_init, Start
D -     13943 - boot_config_data_table_init, Delta - (419 Bytes)
B -    405642 - clock_init, Start
D -      7558 - clock_init, Delta
B -    416640 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:1
B -    420055 - sbl1_ddr_set_params, Start
B -    425149 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    429532 - Pre_DDR_clock_init, Start
D -         4 - Pre_DDR_clock_init, Delta
D -     13172 - sbl1_ddr_set_params, Delta
B -    442842 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
D -    144037 - QSEE Image Loaded, Delta - (268920 Bytes)
B -    674311 - Image Load, Start
D -      2121 - SEC Image Loaded, Delta - (2048 Bytes)
B -    684489 - Image Load, Start
D -    175057 - APPSBL Image Loaded, Delta - (412728 Bytes)
B -    859942 - QSEE Execution, Start
D -        56 - QSEE Execution, Delta
B -    866178 - SBL1, End
D -    672208 - SBL1, Delta
S - Flash Throughput, 2026 KB/s  (684467 Bytes,  337756 us)
S - DDR Frequency, 672 MHz


Bootstrap 5.9.1.0-029R (Sep 21 2017 - 14:30:20)

I2C:   ready
smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  ID = 9590dcc2
Vendor = c2
Device = dc
ONFI device found
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
512 MiB
In:    serial
Out:   serial
Err:   serial
machid: 8010001
flash_type: 2
Configuring GPIO for I2C/EEPROM
read config ........ w1i1c1
write config..............w1i1c0

NAND read: device 0 offset 0x900000, size 0x100000
 1048576 bytes read: OK
## Starting application at 0x87400000 ...


U-Boot 5.9.2.1-009R (Jun 26 2018 - 14:36:48)

I2C:   ready
smem ram ptable found: ver: 1 len: 3
DRAM:  512 MiB
machid : 0x8010001
NAND:  ID = 9590dcc2
Vendor = c2
Device = dc
ONFI device found
SF NAND unsupported id:ff:ff:ff:ffSF: Unsupported manufacturer ff
ipq_spi: SPI Flash not found (bus/cs/speed/mode) = (0/0/48000000/0)
512 MiB
In:    serial
Out:   serial
Err:   serial
machid: 8010001
flash_type: 2
Configuring GPIO for I2C/EEPROM
Net:   MAC0 addr:0:3:7f:ba:db:ad
PHY ID1: 0x4d
PHY ID2: 0xd0b2
ipq40xx_ess_sw_init done
eth0
linkup_detected=0

NAND read: device 0 offset 0xb80000, size 0x800
 2048 bytes read: OK
Hit any key to stop autoboot:  0
poplar > j
Unknown command 'j' - try 'help'
poplar > help
?       - alias for 'help'
base    - print or set address offset
bootipq - bootipq from flash device
bootm   - boot application image from memory
bootp   - boot image via network using BOOTP/TFTP protocol
bootx   - boot a redundant kernel/rootfs image
chpart  - change active partition
cmp     - memory compare
cp      - memory copy
crc32   - checksum calculation
dhcp    - boot image via network using DHCP/TFTP protocol
diag    - enter diagnostics mode
dumpipq_data- dumpipq_data crashdump collection from memory
dumpipq_flash_data- dumpipq_flash_data crashdump collection and storing in flash
echo    - echo args to console
eeprom  - EEPROM sub-system
env     - environment handling commands
fdt     - flattened device tree utility commands
fuseipq - fuse QFPROM registers from memory

fw      - firmware commands
go      - start application at address 'addr'
help    - print command description/usage
i2c     - I2C sub-system
imxtract- extract a part of a multi-image
loop    - infinite loop on address range
md      - memory display
mii     - MII utility commands
mm      - memory modify (auto-incrementing address)
mtdparts- define flash/nand partitions
mtest   - simple RAM read/write test
mw      - memory write (fill)
nand    - NAND sub-system
nboot   - boot from NAND device
nm      - memory modify (constant address)
pci     - list and access PCI Configuration Space
ping    - send ICMP ECHO_REQUEST to network host
printenv- print environment variables
progfw  - download/program full firmware image (via tftp)
reset   - Perform RESET of the CPU
run     - run commands in an environment variable
runmfg  - run in manufacturing mode
saveenv - save environment variables to persistent storage
setenv  - set environment variables
sf      - SPI flash sub-system
smeminfo- print SMEM FLASH information
source  - run script from memory
tftpboot- boot image via network using TFTP protocol
tftpput - TFTP put command, for uploading files to a server
uartrd  - uartrd read from second UART
uartwr  - uartwr to second UART
ubi     - ubi commands
usb     - USB sub-system
usbboot - boot from USB device
version - print monitor, compiler and linker version
poplar >
2

Then there would only be one image per SoC, right ?
Is there ?

3

Point made. The device I want to upload to is not listed. Am I correct that it would be a lot of work to add all the additional binary blobs to a new device from the base firmware?

4

Try to boot kernel-initramfs from tftp to not modify the device

2 Likes
5

That would be the safer way... should I try the AP-303 image as ut has the same cpu and is the same manufacturer? https://firmware-selector.openwrt.org/?version=24.10.0&target=ipq40xx%2Fgeneric&id=aruba_ap-303

6

The important part if the SoC, if it's the same, try the KERNEL (initramfs) file.

1 Like
7

Thank you.
So I assume the hex addresses in the command is empty memory addresses, do I understand that right? If not, what numbers and calculations should I use to obtain the right address?

 $ setenv bootargs_openwrt "setenv bootargs console=ttyMSM1,9600n8"
   $ setenv nandboot_openwrt "run bootargs_openwrt; ubi part aos1; ubi read 0x85000000 kernel; set fdt_high 0x87000000; bootm 0x85000000"
   # Substitute the following IP-addresses as mentioned Step 1 and 2, in case, you are using DHCP.
   $ setenv ramboot_openwrt "run bootargs_openwrt; setenv ipaddr 192.168.1.105; setenv serverip 192.168.1.75; netget; set fdt_high 0x87000000; bootm" 
   $ setenv bootcmd "run nandboot_openwrt"
   $ saveenv
8

The ide is to boot openwrt kernel meant for similar device without making changes to configuration.
With good luck it takes changing a driver or two, dumping partitions and finding wifi radio config data there, and ooking for leds. Without pe4manent change you give up put box in a shelf for later.

9

What @brada4 pointed out, use tftpboot and bootm commands in U-Boot.

10

Thanks, I will get around to try tftpboot.

I have setup a tftp server and pushed files, so just set up the server with the file and run this command:

tftpboot 0x85000000 openwrt-24.10.0-ipq40xx-generic-aruba_ap-303-initramfs-uImage.itb