Extreme Networks/Motorola/Zebra AP 8232

https://web.archive.org/web/20231102190913/https://cdn.barcodesinc.com/themes/barcodesinc/pdf/Motorola/ap8232.pdf
https://web.archive.org/web/20231102190617/https://fccid.io/ANATEL/02613-15-02439/Manual/C8CAA416-BD66-43E0-932D-A141DEEEEC80/PDF
https://web.archive.org/web/20231102191501/https://fcc.report/FCC-ID/UZ7RAAP800/2104658.pdf

This device is being sold at a cheap price on eBay right now, presumably because of the disastrous firmware situation.

Baud rate for the console port is 19200.

CPU: NetLogic XLS018XD0750-11
RAM: ?
ROM: Samsung K9F4G08U0E (512 MB)
RJ45: Broadcom BCM54616SC0KFBG
Wi-Fi: Motorola KHAP-800 (?) & Motorola RAAP-800 (Qualcomm Atheros QCA9890)





Could J3 be a UART connector?

What about the port named "Console"?

From eBay pics:

screen220

I have to check whether the boot log can be acquired through it, I'll let you know.

1 Like
BootOS (c) 2004-2018 Extreme Networks, Inc. All rights reserved.
AP82XX version 5.9.1.5-001R
Booting from NAND image1

Found a PHY at address 4 with id 0x3625d12: BCM 54616S
Found a PHY at address 5 with id 0x3625d12: BCM 54616S
PCIe: detecting the PCIe mode...[2RCx1]
[USB in Host Controller mode]
Examining boot block 9
Examining boot block 10
Examining boot block 11
boot2: good
Sending LLDP power request............... (no response)
Maximum available power is 25.5W
Loading runtime image 1. Press ESC to abort.
..................ok
Welcome.
ls: /sys/block/*da/uevent: No such file or directory
[   19.481553] init_dataplane_time - Done
[   19.503992] init_instrumentation - Done
[   19.527110] init_logging - Done
[   19.545911] init_messaging - Done
[   19.565743] init_thread_to_thread_messaging - Done
[   19.594442] init_crypto - Done
Fixing tree-node configuration
Running Primary software, version 5.9.1.5-001R
Alternate software Secondary, version 5.8.6.9-003R
Software fallback feature is enabled
Starting daemons...,....,,,
Waiting for system initialization to complete

Please press Enter to activate this console.
ap8232-XXXXXX login:
ap8232-XXXXXX>show boot
--------------------------------------------------------------------------------
     IMAGE            BUILD DATE             INSTALL DATE          VERSION
--------------------------------------------------------------------------------
  Primary       04/11/2018 04:56:33     11/21/2019 07:33:48     5.9.1.5-001R
  Secondary     02/14/2018 19:48:04     11/21/2019 07:12:48     5.8.6.9-003R
--------------------------------------------------------------------------------
Current Boot       : Primary
Next Boot          : Primary
Software Fallback  : Enabled
ap8232-XXXXXX>show version
AP8232 version 5.9.1.5-001R
Copyright (c) 2004-2018 Extreme Networks, Inc. All rights reserved.
Booted from primary

ap8232-XXXXXX uptime is 0 days, 00 hours 06 minutes
CPU is Netlogic XLS V0.1, No. of CPUs 2
Base ethernet MAC address is 84-24-8D-XX-XX-XX
System serial number is XXXXXXXXXXXXXX
Model number is AP-8232-67040-EU
Radio HAL version is 92 (DFS:92)

Netlogic XLS/XLR were dropped from mainline starting kernel 5.16. You could perhaps build support for 21.02, but unlikely to see support for bringing current openwrt to such an aged device.

1 Like

Ironically it's one of the few relevant results I found when searching for "Netlogic XLS": https://www.phoronix.com/news/Linux-5.16-Drops-MIPS-Netlogic

Consider, though, that Linux 5.15 is LTS and supported until October 2026. In fact, it looks like OpenWrt 23.05 is using that:

You could certainly build your own custom image for v23, if you want to put in the time to add SOC support for something that is end of life

Actually, there used to be support for Netlogic XLP/XLR. XLS appear to be the same as XLR.

@ffainelli

I reverted the commit, bumped the kernel version to 5.15 and built the squashfs image successfully with just a patch required:

--- drivers/staging/netlogic/xlr_net.c
+++ drivers/staging/netlogic/xlr_net.c
@@ -8,6 +8,7 @@
 #include <linux/delay.h>
 #include <linux/netdevice.h>
 #include <linux/smp.h>
+#include <linux/linkmode.h>
 #include <linux/ethtool.h>
 #include <linux/module.h>
 #include <linux/etherdevice.h>
@@ -783,6 +784,13 @@
 static int xlr_mii_probe(struct xlr_net_priv *priv)
 {
 	struct phy_device *phydev = xlr_get_phydev(priv);
+	const unsigned long mask = (ADVERTISED_10baseT_Full
+							  | ADVERTISED_10baseT_Half
+							  | ADVERTISED_100baseT_Full
+							  | ADVERTISED_100baseT_Half
+							  | ADVERTISED_1000baseT_Full
+							  | ADVERTISED_Autoneg
+							  | ADVERTISED_MII);
 
 	if (!phydev) {
 		pr_err("no PHY found on phy_addr %d\n", priv->phy_addr);
@@ -797,15 +805,11 @@
 		pr_err("could not attach PHY\n");
 		return PTR_ERR(phydev);
 	}
-	phydev->supported &= (ADVERTISED_10baseT_Full
-				| ADVERTISED_10baseT_Half
-				| ADVERTISED_100baseT_Full
-				| ADVERTISED_100baseT_Half
-				| ADVERTISED_1000baseT_Full
-				| ADVERTISED_Autoneg
-				| ADVERTISED_MII);
 
-	phydev->advertising = phydev->supported;
+	linkmode_and(phydev->supported, phydev->supported, &mask);
+
+	linkmode_copy(phydev->advertising, phydev->supported);
+
 	phy_attached_info(phydev);
 	return 0;
 }
boot> ?
  reset                  : reset the system
  eeprom                 : eeprom operations
  memory                 : memory functions
  fw                     : firmware operations
  tftp                   : download a file to memory (via tftp)
  gpio                   : gpio operations
  cfgrom                 : CFG EEPROM operations
  mfgrom                 : Manufacturing EEPROM operations
  help                   : display general user interface help
  history                : display CLI history
  diag                   : access extended diagnostics mode
  set                    : set configuration
  show                   : show system information
  probe                  : probe system buses
  test                   : perform diagnostic functions
  nic                    : ethernet NIC operations
  net                    : networking configuration
  lldp                   : LLDP operations
  nand                   : NAND flash operations
  tpm                    : TPM operations
boot> memory map
XLS IO.......1 MB at physical addresses 0x1ef00000-0x1effffff, virtual addresses 0xbef00000-0xbeffffff
NAND.........128 Bytes at physical addresses 0x1f100000-0x1f10007f, virtual addresses 0xbf100000-0xbf10007f
.text........195 KB at physical addresses 0x0-0x30e8f, virtual addresses 0x80000000-0x80030e8f
.rodata......144 KB at physical addresses 0x30e90-0x551cf, virtual addresses 0x80030e90-0x800551cf
.data........568 Bytes at physical addresses 0x551d0-0x55407, virtual addresses 0x800551d0-0x80055407
.bss.........152 KB at physical addresses 0x55420-0x7b747, virtual addresses 0x80055420-0x8007b747
.late_bss....57 KB at physical addresses 0x7b748-0x89bbf, virtual addresses 0x8007b748-0x80089bbf
EBase........2 KB at physical addresses 0x0-0x7ff, virtual addresses 0x80000000-0x800007ff
RAM..........167 MB at physical addresses 0x0-0xa6fffff, virtual addresses 0x80000000-0x8a6fffff
RAM..........89 MB at physical addresses 0xa700000-0xfffffff, virtual addresses 0x8a700000-0x8fffffff
boot> gpio status
e1_phy_rst[0]       : out 1
e2_phy_rst[1]       : out 1
pcie0_rst[2]        : out 1
pcie1_rst[3]        : out 1
auxpwr[4]           : in  1
poe_type2[5]        : in  0
led1[6]             : out 1
led2[7]             : out 0
usb0_en[8]          : out 1
usb1_en[9]          : out 1
usb0_flag[10]       : in  1
usb1_flag[11]       : in  1
wd_en[12]           : out 1
usb_hipwr[13]       : out 0
gpio14[14]          : in  0
gpio15[15]          : in  0
gpio16[16]          : in  0
nand_rb[17]         : in  1
gpio18[18]          : in  0
nor_rst[19]         : out 1
led3[20]            : out 0
e1_phy_int[21]      : in  0 (inverted)
e2_phy_int[22]      : in  0 (inverted)
thermal[23]         : in  0
wd_input[24]        : out 0
boot> mfgrom dump
tag 0x6 RTC calibration (len=1) at offset 0x0:
address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
00000000  04                                               .
tag 0x4 MAC address (len=6) at offset 0x3:
address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
00000000  84 24 8d 1a 90 40                                .$...@
tag 0x2 HW version (len=1) at offset 0xb:
address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
00000000  42                                               B
tag 0x3 Mfg. date (len=10) at offset 0xe:
address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
00000000  32 30 31 34 2f 30 39 2f 30 36                    2014/09/06
tag 0x1 HW model (len=16) at offset 0x1a:
address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
00000000  41 50 2d 38 32 33 32 2d 36 37 30 34 30 2d 45 55  AP-8232-67040-EU
tag 0x5 Serial # (len=14) at offset 0x2c:
address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
00000000  XX XX XX XX XX XX XX XX XX XX XX XX XX XX        XXXXXXXXXXXXXX
tag 0x8 Mint ID (len=1) at offset 0x3c:
address   0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F
00000000  4d                                               M
TLV data ends at offset 63
boot> show info
platform = falcon
mips_clock = 750.0MHz = 750000000Hz
gpio_clock = 66.7MHz = 66666666Hz
num_cores = 2
num_l2_banks = 2
num_secs = 1
num_gmacs = 2
baud_rate = 19200
clocks_per_sec = 2929687
base_mint_id = 0x4d000000
boot> show boot
running image1
boot image1 6 times before falling back to other image
NAND bootstrap: OK
NAND image1: OK
NAND image2: OK
boot> show version
AP82XX BootOS 5.9.1.5-001R (r263459)
Base MAC Address 84:24:8d:xx:xx:xx
NAND bootstrap version 1
MIPS ProcessorID 0.12.206.1
2 MIPS cores at 0.75GHz, 2x256KB L2 cache, 1+1 security coprocessors
boot> show partitions
name         device   start       end         size
bootstrap    nand     0x00000000  0x0001ffff  0x00020000
boot1        nand     0x00020000  0x0011ffff  0x00100000   (bootmark)
boot2        nand     0x00120000  0x0021ffff  0x00100000   (bootmark)
linux1       nand     0x00220000  0x00a1ffff  0x00800000   (bootmark)
linux2       nand     0x00a20000  0x0121ffff  0x00800000   (bootmark)
rootfs1      nand     0x01220000  0x09b1ffff  0x08900000
rootfs2      nand     0x09b20000  0x1241ffff  0x08900000
var2         nand     0x12420000  0x1461ffff  0x02200000   (jffs2)
etc2         nand     0x14620000  0x1861ffff  0x04000000   (jffs2)
flash        nand     0x18620000  0x1da1ffff  0x05400000
panic        nand     0x1da20000  0x1fffffff  0x025e0000
boot> probe i2c
Probing I2C bus 0:
.........................................
 found something at address 0x29
.............................................
 found something at address 0x57
................
 found something at address 0x68
.......................
Probing I2C bus 1:
............................................................................
 found something at address 0x4c
...................................................
boot> probe pci
Slot 1: Detected device 168c.003c at 1.0.0: Qualcomm QCA9890 (Peregrine) 802.11ac Radio
Slot 2: Detected device 168c.0030 at 2.0.0: Atheros AR9390 (Osprey) 802.11abgn Radio
boot> probe phys
Found a PHY at address 4 with id 0x3625d12: BCM 54616S
Found a PHY at address 5 with id 0x3625d12: BCM 54616S
boot> nand id
NAND0 ID:  0xec 0xdc 0x10 0x95 0x55
  IDed as a Samsung K9F4G08U0E
  page size 2048+64; 64 pages/block; 4096 blocks (262144 pages)
boot> nand status
NAND0: status = *0x00000000[7:0] = 0xc0 = 192 = 11000000b
 [0] = 0............generic error: ok, no error
 [6] = 1............controller status: idle
 [7] = 1............write protection: not protected

I have performed a full physical dump of the NAND flash.

Download: https://kdrive.infomaniak.com/app/share/320976/ec34ada8-65ef-461b-b941-bc68aceac4db