Build firmware for a riverbed SDI-AP5-B020

I found 2 old APs. one ocedo koala which I successfully flashed with community help:

the other one is a riverbed SDI-AP5-B020. looks like riverbed acquired ocedo and iterated a new model with new model number and the same exterior design.

because it's not officially supported by openWrt, I'd like to build initramfs-kernel.bin and squashfs-sysupgrade.bin myself, test it and commit it.

I have software build experience but I don't know how to collect hardware info like CPU, Package architecture, Taget, Subtarget etc.

how do I go about this?

I can use koala's initramfs-kernel.bin tftp boot the riverbed AP and ssh to it. can I use busybox commands to find out more hardware info?

https://openwrt.org/docs/guide-developer/adding_new_device
https://openwrt.org/docs/guide-developer/add.new.device

@tmn505 mentioned some important points in the other thread:

Can you get the boot / kernel log for the original firmware?

@dnd @tmn505

sorry for slow rely, been on vacation.
I booted with openwrt-22.03.6-ath79-generic-ocedo_koala-initramfs-kernel.bin executed commands listed here:
https://openwrt.org/docs/guide-developer/adding_new_device#collecting_relevant_data

here are results:

dmesg
[    0.000000] Linux version 5.10.201 (builder@buildhost) (mips-openwrt-linux-musl-gcc (OpenWrt GCC 11.2.0 r20265-f85a79bcb4) 11.2.0, GNU ld (GNU Binutils) 2.37) #0 Sat Nov 25 18:18:57 2023
[    0.000000] printk: bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is OCEDO Koala
[    0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x0000000007ffffff]
[    0.000000] On node 0 totalpages: 32768
[    0.000000]   Normal zone: 288 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 32768 pages, LIFO batch:7
[    0.000000] pcpu-alloc: s0 r0 d32768 u32768 alloc=1*32768
[    0.000000] pcpu-alloc: [0] 0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 32480
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes, linear)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes, linear)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] mem auto-init: stack:off, heap alloc:off, heap free:off
[    0.000000] Memory: 110400K/131072K available (5895K kernel code, 610K rwdata, 748K rodata, 11872K init, 210K bss, 20672K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 720.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns
[    0.000008] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns
[    0.008353] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[    0.075027] pid_max: default: 32768 minimum: 301
[    0.080081] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.087861] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.097879] dyndbg: Ignore empty _ddebug table in a CONFIG_DYNAMIC_DEBUG_CORE build
[    0.108482] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.118977] futex hash table entries: 256 (order: -1, 3072 bytes, linear)
[    0.126299] pinctrl core: initialized pinctrl subsystem
[    0.135571] NET: Registered protocol family 16
[    0.140943] thermal_sys: Registered thermal governor 'step_wise'
[    0.185360] clocksource: Switched to clocksource MIPS
[    0.198186] NET: Registered protocol family 2
[    0.203028] IP idents hash table entries: 2048 (order: 2, 16384 bytes, linear)
[    0.211453] tcp_listen_portaddr_hash hash table entries: 512 (order: 0, 4096 bytes, linear)
[    0.220428] TCP established hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.228612] TCP bind hash table entries: 1024 (order: 0, 4096 bytes, linear)
[    0.236131] TCP: Hash tables configured (established 1024 bind 1024)
[    0.242998] UDP hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.250002] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes, linear)
[    0.257698] NET: Registered protocol family 1
[    0.262363] PCI: CLS 0 bytes, default 32
[    0.443071] workingset: timestamp_bits=14 max_order=15 bucket_order=1
[    0.453582] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.459831] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.471869] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[    0.482267] pinctrl-single 1804002c.pinmux: 544 pins, size 68
[    0.489373] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.498117] printk: console [ttyS0] disabled
[    0.502725] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[    0.511945] printk: console [ttyS0] enabled
[    0.520848] printk: bootconsole [early0] disabled
[    0.545706] spi-nor spi0.0: mx25l12805d (16384 Kbytes)
[    0.550976] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.557491] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.564222] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.571343] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.578116] OF: Bad cell count for /ahb/spi@1f000000/flash@0/partitions
[    0.585423] Creating 7 MTD partitions on "spi0.0":
[    0.590294] 0x000000000000-0x000000040000 : "u-boot"
[    0.599628] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.605919] 0x000000050000-0x000000790000 : "firmware"
[    0.613452] 2 uimage-fw partitions found on MTD device firmware
[    0.619516] Creating 2 MTD partitions on "firmware":
[    0.624566] 0x000000000000-0x000000140000 : "kernel"
[    0.631111] 0x000000140000-0x000000740000 : "rootfs"
[    0.636919] mtd: setting mtd4 (rootfs) as root device
[    0.642808] 1 squashfs-split partitions found on MTD device rootfs
[    0.649143] 0x0000006e0000-0x000000740000 : "rootfs_data"
[    0.656196] 0x000000790000-0x000000ed0000 : "vendor"
[    0.662089] 0x000000ed0000-0x000000fe0000 : "data"
[    0.669137] 0x000000fe0000-0x000000ff0000 : "id"
[    0.674674] 0x000000ff0000-0x000001000000 : "art"
[    1.155874] ag71xx 19000000.eth: connected to PHY at mdio.0:05 [uid=004dd072, driver=Qualcomm Atheros AR8035]
[    1.166491] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii-rxid
[    1.173596] i2c /dev entries driver
[    1.178949] NET: Registered protocol family 10
[    1.190525] Segment Routing with IPv6
[    1.194350] NET: Registered protocol family 17
[    1.198983] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.212155] 8021q: 802.1Q VLAN Support v1.8
[    1.217190] PCI host bridge /ahb/pcie-controller@180c0000 ranges:
[    1.223399]  MEM 0x0000000010000000..0x0000000011ffffff
[    1.228747]   IO 0x0000000000000000..0x0000000000000000
[    1.234211] PCI host bridge to bus 0000:00
[    1.238409] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    1.245397] pci_bus 0000:00: root bus resource [io  0x0000]
[    1.251053] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    1.257943] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    1.266026] pci 0000:00:00.0: [168c:003c] type 00 class 0x028000
[    1.272151] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0x001fffff 64bit]
[    1.279097] pci 0000:00:00.0: reg 0x30: [mem 0x00000000-0x0000ffff pref]
[    1.285972] pci 0000:00:00.0: supports D1
[    1.290036] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
[    1.296789] pci_bus 0000:00: busn_res: [bus 00-ff] end is updated to 00
[    1.303516] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    1.310984] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
[    1.363250] Freeing unused kernel memory: 11872K
[    1.367964] This architecture does not have kernel memory protection.
[    1.374506] Run /init as init process
[    1.378227]   with arguments:
[    1.378231]     /init
[    1.378235]   with environment:
[    1.378239]     HOME=/
[    1.378243]     TERM=linux
[    1.894558] init: Console is alive
[    1.898472] init: - watchdog -
[    1.921034] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.933403] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.951171] init: - preinit -
[    2.227768] random: jshn: uninitialized urandom read (4 bytes read)
[    2.375595] random: jshn: uninitialized urandom read (4 bytes read)
[    2.408815] random: jshn: uninitialized urandom read (4 bytes read)
[    5.696774] eth0: link up (1000Mbps/Full duplex)
[    5.701489] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
[    6.737652] eth0: link down
[    6.751417] procd: - early -
[    6.754635] procd: - watchdog -
[    7.372169] procd: - watchdog -
[    7.375741] procd: - ubus -
[    7.386658] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.429379] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.436357] random: ubusd: uninitialized urandom read (4 bytes read)
[    7.446120] procd: - init -
[    8.101194] kmodloader: loading kernel modules from /etc/modules.d/*
[    8.587878] Loading modules backported from Linux version v5.15.92-0-ge515b9902f5f
[    8.595617] Backport generated by backports.git v5.15.92-1-0-gdfe0f60c
[    8.804174] PPP generic driver version 2.4.2
[    8.826258] NET: Registered protocol family 24
[    8.912422] ath: EEPROM regdomain: 0x68
[    8.912433] ath: EEPROM indicates we should expect a direct regpair map
[    8.912454] ath: Country alpha2 being used: 00
[    8.912458] ath: Regpair used: 0x68
[    8.929245] ieee80211 phy0: Selected rate control algorithm 'minstrel_ht'
[    8.930977] ieee80211 phy0: Atheros AR9550 Rev:0 mem=0xb8100000, irq=13
[    8.999794] kmodloader: done loading kernel modules from /etc/modules.d/*
[   10.268518] urngd: v1.0.2 started.
[   10.330627] random: jshn: uninitialized urandom read (4 bytes read)
[   10.795567] random: jshn: uninitialized urandom read (4 bytes read)
[   10.872417] random: jshn: uninitialized urandom read (4 bytes read)
[   11.370565] random: jshn: uninitialized urandom read (4 bytes read)
[   12.167217] random: crng init done
[   12.170680] random: 31 urandom warning(s) missed due to ratelimiting
[   41.865812] br-lan: port 1(eth0) entered blocking state
[   41.871121] br-lan: port 1(eth0) entered disabled state
[   41.876739] device eth0 entered promiscuous mode
[   46.016772] eth0: link up (1000Mbps/Full duplex)
[   46.021492] br-lan: port 1(eth0) entered blocking state
[   46.026823] br-lan: port 1(eth0) entered forwarding state
[   46.035506] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
cat /proc/cmdline
console=ttyS0,115200n8 rootfstype=squashfs,jffs2
cat /proc/cpuinfo
system type             : Qualcomm Atheros QCA9558 ver 1 rev 0
machine                 : OCEDO Koala
processor               : 0
cpu model               : MIPS 74Kc V5.0
BogoMIPS                : 358.80
wait instruction        : yes
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : yes
hardware watchpoint     : yes, count: 4, address/irw mask: [0x0ffc, 0x0ffc, 0x0ffb, 0x0ffb]
isa                     : mips1 mips2 mips32r1 mips32r2
ASEs implemented        : mips16 dsp dsp2
Options implemented     : tlb 4kex 4k_cache prefetch mcheck ejtag llsc dc_aliases perf_cntr_intr_bit cdmm contextconfig perf
shadow register sets    : 1
kscratch registers      : 0
package                 : 0
core                    : 0
VCED exceptions         : not available
VCEI exceptions         : not available
cat /proc/meminfo
MemTotal:         122272 kB
MemFree:           95772 kB
MemAvailable:      71744 kB
Buffers:               0 kB
Cached:            13808 kB
SwapCached:            0 kB
Active:             8364 kB
Inactive:           7400 kB
Active(anon):       8364 kB
Inactive(anon):     7400 kB
Active(file):          0 kB
Inactive(file):        0 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          1964 kB
Mapped:             4064 kB
Shmem:             13808 kB
KReclaimable:       1096 kB
Slab:               6792 kB
SReclaimable:       1096 kB
SUnreclaim:         5696 kB
KernelStack:         344 kB
PageTables:          396 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       61136 kB
Committed_AS:      27032 kB
VmallocTotal:    1048372 kB
VmallocUsed:         352 kB
VmallocChunk:          0 kB
Percpu:               96 kB
cat /proc/devices
Character devices:
1 mem
4 ttyS
5 /dev/tty
5 /dev/console
5 /dev/ptmx
10 misc
89 i2c
90 mtd
108 ppp
128 ptm
136 pts
250 ttyATH
251 bsg
252 watchdog
253 rtc
254 gpiochip

Block devices:
31 mtdblock
259 blkext
ls /sys/devices/platform
Fixed MDIO bus.0
ahb
keys
leds
reg-dummy
regulatory.0
serial8250
uevent
cat /proc/mtd
dev:   size    erasesize  name
mtd0: 00040000 00010000 "u-boot"
mtd1: 00010000 00010000 "u-boot-env"
mtd2: 00740000 00010000 "firmware"
mtd3: 00140000 00010000 "kernel"
mtd4: 00600000 00010000 "rootfs"
mtd5: 00060000 00010000 "rootfs_data"
mtd6: 00740000 00010000 "vendor"
mtd7: 00110000 00010000 "data"
mtd8: 00010000 00010000 "id"
mtd9: 00010000 00010000 "art"
cat /sys/class/mtd/mtd*/offset
0
262144
327680
0
1310720
7208960
7929856
15532032
16646144
16711680
ifconfig -a
br-lan    Link encap:Ethernet  HWaddr 6C:98:EB:00:63:84  
        inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
        inet6 addr: fe80::6e98:ebff:fe00:6384/64 Scope:Link
        inet6 addr: fd72:9956:a6db::1/60 Scope:Global
        UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
        RX packets:163 errors:0 dropped:0 overruns:0 frame:0
        TX packets:134 errors:0 dropped:0 overruns:0 carrier:0
        collisions:0 txqueuelen:1000
        RX bytes:12935 (12.6 KiB)  TX bytes:31247 (30.5 KiB)

eth0      Link encap:Ethernet  HWaddr 6C:98:EB:00:63:84
        UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
        RX packets:164 errors:0 dropped:0 overruns:0 frame:0
        TX packets:137 errors:0 dropped:0 overruns:0 carrier:0
        collisions:0 txqueuelen:1000
        RX bytes:15287 (14.9 KiB)  TX bytes:31513 (30.7 KiB)
        Interrupt:4

lo        Link encap:Local Loopback
        inet addr:127.0.0.1  Mask:255.0.0.0
        inet6 addr: ::1/128 Scope:Host
        UP LOOPBACK RUNNING  MTU:65536  Metric:1
        RX packets:384 errors:0 dropped:0 overruns:0 frame:0
        TX packets:384 errors:0 dropped:0 overruns:0 carrier:0
        collisions:0 txqueuelen:1000
        RX bytes:29952 (29.2 KiB)  TX bytes:29952 (29.2 KiB)

wlan0     Link encap:Ethernet  HWaddr 6C:98:EB:41:65:F8
        BROADCAST MULTICAST  MTU:1500  Metric:1
        RX packets:0 errors:0 dropped:0 overruns:0 frame:0
        TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
        collisions:0 txqueuelen:1000
        RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
ls /sys/class/net
br-lan
eth0
lo
wlan0
brctl show
bridge name     bridge id               STP enabled     interfaces
br-lan          7fff.6c98eb006384       no              eth0
cat /sys/kernel/debug/gpio
gpiochip0: GPIOs 0-31, parent: platform/18040000.gpio, 18040000.gpio:
gpio-13  (                    |red:wlan58          ) out hi ACTIVE LOW
gpio-17  (                    |reset               ) in  hi IRQ ACTIVE LOW
gpio-19  (                    |blue:sys            ) out lo ACTIVE LOW
gpio-22  (                    |green:power         ) out lo ACTIVE LOW
gpio-23  (                    |yellow:wlan2        ) out hi ACTIVE LOW

Hi, welcome back :slight_smile:

This is nice, but it's important to confirm the flash layout with the original firmware.
Do you have SSH access with it?
Or can you see any boot logs?

nope, looks like ssh firewalled

image

hm, any chance to get a serial connection?

do you have a serial adapter?

Vanilla OpenWrt log is useless for determining factory flash memory layout. Either post original firmware boot log or, if You didn't overwrite the flash memory, dump of all /dev/mtdX devices in OpenWrt running from initramfs image.

sorry for the delayed reply. I've been traveling for work.
I got my hands on one of this. It's CP2102 USB to TTL, so the same as amazon one just with aluminium shell.
sadly AP is at home. will this work? how?