Help adding support for Fortinet FortiAP-220B

[s4ndm4n]

I got 5 pieces of these AP`s.

I opened them up to inspect what's inside of them.
I already found the Serial Ports and soldered pins to them and read through serial.
Boot up is interruptible and gives the option to load an image through TFTP.

boot output

FortiAP-220B (Mar 17 2011 - 11:11:49)

Ver:04000010
Serial number: FAP22B3U11009734
Region code: E
DRAM:  b8050000: 0xc0140180
64 MB
id read 0x100000ff
flash size 16MB, sector count = 256
Flash: 16 MB
Using default environment

In:    serial
Out:   serial
Err:   serial
Net:   ag7100_enet_initialize...
ATHRF1E:
No phy found for unit 0
eth0: 00:09:0f:f3:51:f0
eth0 up
ATHRF1E: Port 1, Negotiation timeout
ATHRF1E: unit 1 phy addr 0 ATHRF1E: reg0 1000
eth1: 00:09:0f:f3:51:f1
eth1 up
eth0, eth1
Hit any key to stop autoboot:  1

[G]:  Get OS image from TFTP server.
[Q]:  Quit menu and continue to boot with default OS.
[H]:  Display this list of options.

Enter G,Q,or H:


[G]:  Get OS image from TFTP server.
[Q]:  Quit menu and continue to boot with default OS.
[H]:  Display this list of options.

Enter G,Q,or H:

Please connect TFTP server to Ethernet port 'eth1'.

Enter TFTP server address [192.168.1.1]:
Enter local address [192.168.1.2]:
Enter firmware image file name [image.out]:
eth0 link down
eth1 link down
*** ERROR: `serverip' not set                                                                                                                                                  0
## Booting image at bf940000 ...
   Image Name:   Linux Kernel Image
   Created:      2016-07-05  22:38:13 UTC
   Image Type:   MIPS Linux Kernel Image (gzip compressed)
   Data Size:    1720039 Bytes =  1.6 MB
   Load Address: 80002000
   Entry Point:  802b85a0
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...
init started: BusyBox v1.15.0 (2016-07-05 15:40:15 PDT)
starting pid 798, tty '': '/sbin/getty ttyS0 9600'

 FAP22B3U11009734 mips #1 Tue Jul 5 15:38:06 PDT 2016 (none)
FAP22B3U11009734 login:

CPU:
AR7161-BC1A

RAM:
H5DU2562GTR Datasheet 256Mb DDR SDRAM

Wifi Chips are:
Atheros AR9223-AC1A
Atheros AR9220-AC1A

Ethernet Chip:
Atheros AR8021

FCC-ID:
TVE-220102

For my understanding this looks like they could be supported.
Can someone guide me through?

[stragies]

More knowledgeable people will have to chime in with details, but the rough outline starting from here:

1. Find a Device under ath79, that most resembles the FortiAP Hardware-wise
2. Adapt the DTS for that to match your device as much as possible.
3. Create a new board-entry in the list-file with all board-names
4. Attempt to TFTP-boot an initramfs image with your DTS
5. Examine the error messages you receive on bootup
6. Fix DTS
7. Possibly add/fix drivers
8. Goto(4)

[s4ndm4n]

For what specific similarities did i have to look for?

The problem is, i can't find any firmware image online to dive into.

[stragies]

I don't have much experience with this process, but I think, you'll need to identify devices with same CPU, or Switch, or Ethernet, or Memory, or Flash, and then find their DTSs, and then attempt to "collate" one DTS file from those, that is near enough to your device, that it'll boot far enough to show you stuff on serial output. And then you work from there, probably working towards the NIC, and then the Switch-Chip.

There is an "Ath79 Porting guide" in this forum.

[tmomas]

@stragies

There is an "Ath79 Porting guide" in this forum.

Porting guide ar71xx to ath79?

Hey there, as the topic says, does anybody work currently on an 4.14 config and patches for ar71xx platform? I want to switch from shortcut-fe (fast-classifier) to the new ipt-offload kernel (4.14) modules and i dont know what the steps are for creating a good config for my ar71xx routers. Also i see there are a lot of patches for 4.4 and 4.9 versions... I'm not a big openwrt dev, but i know something about building linux kernel and rootfs for embedded machines and also about build a custom …

[Borromini]

Getting a GPL tarball would be a boon, that would llow you to skip a few things.

[s4ndm4n]

Where to get one?

[Borromini]

Fortinet is legally required to provide you with the GPL tarball, I googled a bit but I'm not finding any clear information on that (says enough they stay mum about it, they had an injunction and settlement about honouring the GPL in 2005 as well).

If you bought these devices new you should have gotten a notice with it detailing how to request a GPL tarball for your device.

[s4ndm4n]

Sadly they are all used. came from a company.

So you think if i write them an Email they give me the tar file?

I also read about this injunction which decreases my hope to get that tar

[Borromini]

You can hope for it, they are legally obliged to do it when someone owning their device requests it.

[s4ndm4n]

I wrote an Email to legal@fortinet.com.

If i get the source.
What are the next steps?
is there any doc,guide available?

[Borromini]

There's this page on the wiki which looks good to get started:

Hardware Hacking First Steps

[s4ndm4n]

i got a dmesg out of it:

dmesg output

FAP22B3U11009734 # dmesg
<5>Linux version 2.6.31--LSDK-9.2.0.405 (root@build192) (gcc version 3.4.4) #1 T                                                          ue Jul 5 15:38:06 PDT 2016
<4>flash_size passed from bootloader = 16
<4>arg 1: console=ttyS0,9600
<4>arg 2: root=31:01
<4>arg 3: rootfstype=jffs2
<4>arg 4: init=/sbin/init
<4>arg 5: mtdparts=ar7100-nor0:256k(bios),9216k(rootfs),1728k(uImage),5120k(rese                                                          rved),64k(caldata)
<4>arg 6: mem=64M
<6>CPU revision is: 00019374 (MIPS 24Kc)
<6>Determined physical RAM map:
<6> memory: 02000000 @ 00000000 (usable)
<4>OLD CMDLINE: console=ttyS0,9600 root=31:01 rootfstype=jffs2 init=/sbin/init m                                                          tdparts=ar7100-nor0:256k(bios),9216k(rootfs),1728k(uImage),5120k(reserved),64k(c                                                          aldata) mem=64M
<4>CFG BaudRate: 9600
<4>NEW CMDLINE: console=ttyS0,9600 root=31:01 rootfstype=jffs2 init=/sbin/init m                                                          tdparts=ar7100-nor0:256k(bios),9216k(rootfs),1728k(uImage),5120k(reserved),64k(c                                                          aldata) mem=64M
<6>User-defined physical RAM map:
<6> memory: 04000000 @ 00000000 (usable)
<4>Zone PFN ranges:
<4>  Normal   0x00000000 -> 0x00004000
<4>Movable zone start PFN for each node
<4>early_node_map[1] active PFN ranges
<4>    0: 0x00000000 -> 0x00004000
<7>On node 0 totalpages: 16384
<7>free_area_init_node: node 0, pgdat 803836a0, node_mem_map 81000000
<7>  Normal zone: 128 pages used for memmap
<7>  Normal zone: 0 pages reserved
<7>  Normal zone: 16256 pages, LIFO batch:3
<4>Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16256
<5>Kernel command line: console=ttyS0,9600 root=31:01 rootfstype=jffs2 init=/sbi                                                          n/init mtdparts=ar7100-nor0:256k(bios),9216k(rootfs),1728k(uImage),5120k(reserve                                                          d),64k(caldata) mem=64M
<4>PID hash table entries: 256 (order: 8, 1024 bytes)
<6>Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
<6>Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
<4>Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
<4>Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
<6>Writing ErrCtl register=00000000
<6>Readback ErrCtl register=00000000
<6>Memory: 60888k/65536k available (2796k kernel code, 4576k reserved, 802k data                                                          , 168k init, 0k highmem)
<6>SLUB: Genslabs=7, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
<6>Hierarchical RCU implementation.
<6>NR_IRQS:128
<4>plat_time_init: plat time init done : freq 340000000
<4>r4k_clockevent_init: Ignoring int_usable failure
<4>Console: colour dummy device 80x25
<6>Calibrating delay loop... 452.60 BogoMIPS (lpj=905216)
<4>Mount-cache hash table entries: 512
<6>NET: Registered protocol family 16
<4>registering PCI controller with io_map_base unset
<4>arch/mips/ar7100/gpio.c (pbXX_simple_config_init) JUMPSTART_GPIO: 3
<4>bio: create slab <bio-0> at 0
<5>SCSI subsystem initialized
<6>usbcore: registered new interface driver usbfs
<6>usbcore: registered new interface driver hub
<6>usbcore: registered new device driver usb
<7>pci 0000:00:00.0: reg 10 32bit mmio: [0x10000000-0x1000ffff]
<6>pci 0000:00:00.0: PME# supported from D0 D3hot
<6>pci 0000:00:00.0: PME# disabled
<7>pci 0000:00:01.0: reg 10 32bit mmio: [0x10010000-0x1001ffff]
<6>pci 0000:00:01.0: PME# supported from D0 D3hot
<6>pci 0000:00:01.0: PME# disabled
<6>NET: Registered protocol family 2
<6>IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
<6>TCP established hash table entries: 2048 (order: 2, 16384 bytes)
<6>TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
<6>TCP: Hash tables configured (established 2048 bind 2048)
<6>TCP reno registered
<6>NET: Registered protocol family 1
<4>AR7100 GPIOC major 0
<6>JFFS2 version 2.2 (NAND) (ZLIB) (RTIME) (c) 2001-2006 Red Hat, Inc.
<6>msgmni has been set to 119
<6>Block layer SCSI generic (bsg) driver version 0.4 loaded (major 254)
<6>io scheduler noop registered
<6>io scheduler deadline registered (default)
<6>Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
<6>serial8250.0: ttyS0 at MMIO 0xb8020000 (irq = 19) is a 16550A
<6>console [ttyS0] enabled
<6>brd: module loaded
<5>5 cmdlinepart partitions found on MTD device ar7100-nor0
<5>Creating 5 MTD partitions on "ar7100-nor0":
<5>0x000000000000-0x000000040000 : "bios"
<5>0x000000040000-0x000000940000 : "rootfs"
<5>0x000000940000-0x000000af0000 : "uImage"
<5>0x000000af0000-0x000000ff0000 : "reserved"
<5>0x000000ff0000-0x000001000000 : "caldata"
<5>usbmon: debugfs is not available
<6>ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
<4>
<4>In ar7100_ehci_drv_probe
<4>Probing ehci...
<4>hcd->regs is 0xbb000000
<7>drivers/usb/host/ehci-ar7100.c: Starting AR7100 EHCI USB Controller...done. r                                                          eset 0x40 usb config 0x30000
<4>ehci->caps is 0xbb000000
<4>ehci->caps->hc_base is 0x1000010
<6>ar7100-ehci ar7100-ehci.0: AR7100 EHCI
<6>ar7100-ehci ar7100-ehci.0: new USB bus registered, assigned bus number 1
<6>ar7100-ehci ar7100-ehci.0: irq 3, io mem 0x1b000000
<6>ar7100-ehci ar7100-ehci.0: USB 0.0 started, EHCI 1.00
<6>usb usb1: configuration #1 chosen from 1 choice
<6>hub 1-0:1.0: USB hub found
<6>hub 1-0:1.0: 2 ports detected
<4>...probing done
<6>ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
<6>uhci_hcd: USB Universal Host Controller Interface driver
<6>Initializing USB Mass Storage driver...
<6>usbcore: registered new interface driver usb-storage
<6>USB Mass Storage support registered.
<6>usbcore: registered new interface driver usbserial
<6>USB Serial support registered for generic
<6>usbcore: registered new interface driver usbserial_generic
<6>usbserial: USB Serial Driver core
<6>USB Serial support registered for aircable
<6>usbcore: registered new interface driver aircable
<6>USB Serial support registered for ark3116
<6>usbcore: registered new interface driver ark3116
<6>USB Serial support registered for Belkin / Peracom / GoHubs USB Serial Adapte                                                          r
<6>usbcore: registered new interface driver belkin
<6>belkin_sa: v1.2:USB Belkin Serial converter driver
<6>USB Serial support registered for ch341-uart
<6>usbcore: registered new interface driver ch341
<6>USB Serial support registered for cp210x
<6>usbcore: registered new interface driver cp210x
<6>cp210x: v0.09:Silicon Labs CP210x RS232 serial adaptor driver
<6>USB Serial support registered for Reiner SCT Cyberjack USB card reader
<6>usbcore: registered new interface driver cyberjack
<6>cyberjack: v1.01 Matthias Bruestle
<6>cyberjack: REINER SCT cyberJack pinpad/e-com USB Chipcard Reader Driver
<6>USB Serial support registered for DeLorme Earthmate USB
<6>USB Serial support registered for HID->COM RS232 Adapter
<6>USB Serial support registered for Nokia CA-42 V2 Adapter
<6>usbcore: registered new interface driver cypress
<6>cypress_m8: v1.09:Cypress USB to Serial Driver
<6>USB Serial support registered for Digi 2 port USB adapter
<6>USB Serial support registered for Digi 4 port USB adapter
<6>usbcore: registered new interface driver digi_acceleport
<6>digi_acceleport: v1.80.1.2:Digi AccelePort USB-2/USB-4 Serial Converter drive                                                          r
<6>USB Serial support registered for Edgeport 2 port adapter
<6>USB Serial support registered for Edgeport 4 port adapter
<6>USB Serial support registered for Edgeport 8 port adapter
<6>USB Serial support registered for EPiC device
<6>usbcore: registered new interface driver io_edgeport
<6>io_edgeport: v2.7:Edgeport USB Serial Driver
<6>USB Serial support registered for Edgeport TI 1 port adapter
<6>USB Serial support registered for Edgeport TI 2 port adapter
<6>usbcore: registered new interface driver io_ti
<6>io_ti: v0.7mode043006:Edgeport USB Serial Driver
<6>USB Serial support registered for empeg
<6>usbcore: registered new interface driver empeg
<6>empeg: v1.2:USB Empeg Mark I/II Driver
<6>USB Serial support registered for FTDI USB Serial Device
<6>usbcore: registered new interface driver ftdi_sio
<6>ftdi_sio: v1.5.0:USB FTDI Serial Converters Driver
<6>USB Serial support registered for funsoft
<6>usbcore: registered new interface driver funsoft
<6>USB Serial support registered for Garmin GPS usb/tty
<6>usbcore: registered new interface driver garmin_gps
<6>garmin_gps: v0.33:garmin gps driver
<6>USB Serial support registered for hp4X
<6>usbcore: registered new interface driver hp4X
<6>hp4x: v1.00:HP4x (48/49) Generic Serial driver
<6>USB Serial support registered for PocketPC PDA
<6>usbcore: registered new interface driver ipaq
<6>ipaq: v0.5:USB PocketPC PDA driver
<6>USB Serial support registered for IPWireless converter
<6>usbcore: registered new interface driver ipwtty
<6>ipw: v0.3:IPWireless tty driver
<6>USB Serial support registered for IR Dongle
<6>usbcore: registered new interface driver ir-usb
<6>ir_usb: v0.4:USB IR Dongle driver
<6>USB Serial support registered for iuu_phoenix
<6>usbcore: registered new interface driver iuu_phoenix
<6>iuu_phoenix: v0.10:Infinity USB Unlimited Phoenix driver
<6>USB Serial support registered for Keyspan - (without firmware)
<6>USB Serial support registered for Keyspan 1 port adapter
<6>USB Serial support registered for Keyspan 2 port adapter
<6>USB Serial support registered for Keyspan 4 port adapter
<6>usbcore: registered new interface driver keyspan
<6>keyspan: v1.1.5:Keyspan USB to Serial Converter Driver
<6>USB Serial support registered for Keyspan PDA
<6>USB Serial support registered for Keyspan PDA - (prerenumeration)
<6>USB Serial support registered for Xircom / Entregra PGS - (prerenumeration)
<6>usbcore: registered new interface driver keyspan_pda
<6>keyspan_pda: v1.1:USB Keyspan PDA Converter driver
<6>USB Serial support registered for KL5KUSB105D / PalmConnect
<6>usbcore: registered new interface driver kl5kusb105d
<6>kl5kusb105: v0.3a:KLSI KL5KUSB105 chipset USB->Serial Converter driver
<6>USB Serial support registered for KOBIL USB smart card terminal
<6>usbcore: registered new interface driver kobil
<6>kobil_sct: 21/05/2004:KOBIL USB Smart Card Terminal Driver (experimental)
<6>USB Serial support registered for MCT U232
<6>usbcore: registered new interface driver mct_u232
<6>mct_u232: z2.1:Magic Control Technology USB-RS232 converter driver
<6>USB Serial support registered for Moschip 2 port adapter
<6>mos7720: 1.0.0.4F:Moschip USB Serial Driver
<6>usbcore: registered new interface driver moschip7720
<6>USB Serial support registered for Moschip 7840/7820 USB Serial Driver
<6>mos7840: 1.3.2:Moschip 7840/7820 USB Serial Driver
<6>usbcore: registered new interface driver mos7840
<6>USB Serial support registered for moto-modem
<6>usbcore: registered new interface driver moto-modem
<6>USB Serial support registered for navman
<6>usbcore: registered new interface driver navman
<6>USB Serial support registered for ZyXEL - omni.net lcd plus usb
<6>usbcore: registered new interface driver omninet
<6>omninet: v1.1:USB ZyXEL omni.net LCD PLUS Driver
<6>USB Serial support registered for opticon
<6>usbcore: registered new interface driver opticon
<6>USB Serial support registered for GSM modem (1-port)
<6>usbcore: registered new interface driver option
<6>option: v0.7.2:USB Driver for GSM modems
<6>USB Serial support registered for oti6858
<6>usbcore: registered new interface driver oti6858
<6>USB Serial support registered for pl2303
<6>usbcore: registered new interface driver pl2303
<6>pl2303: Prolific PL2303 USB to serial adaptor driver
<6>USB Serial support registered for Qualcomm USB modem
<6>usbcore: registered new interface driver qcserial
<6>safe_serial: v0.0b:USB Safe Encapsulated Serial
<6>USB Serial support registered for safe_serial
<6>usbcore: registered new interface driver safe_serial
<6>USB Serial support registered for siemens_mpi
<6>usbcore: registered new interface driver siemens_mpi
<6>Driver for Siemens USB/MPI adapter
<6>Version 0.1 09/26/2005 Thomas Hergenhahn@web.de http://libnodave.sf.net
<6>USB Serial support registered for Sierra USB modem
<6>usbcore: registered new interface driver sierra
<6>sierra: v.1.3.7:USB Driver for Sierra Wireless USB modems
<6>USB Serial support registered for SPCP8x5
<6>usbcore: registered new interface driver spcp8x5
<6>spcp8x5: v0.04:SPCP8x5 USB to serial adaptor driver
<6>USB Serial support registered for symbol
<6>usbcore: registered new interface driver symbol
<6>USB Serial support registered for TI USB 3410 1 port adapter
<6>USB Serial support registered for TI USB 5052 2 port adapter
<6>usbcore: registered new interface driver ti_usb_3410_5052
<6>ti_usb_3410_5052: v0.9:TI USB 3410/5052 Serial Driver
<6>USB Serial support registered for Handspring Visor / Palm OS
<6>USB Serial support registered for Sony Clie 3.5
<6>USB Serial support registered for Sony Clie 5.0
<6>usbcore: registered new interface driver visor
<6>visor: USB HandSpring Visor / Palm OS driver
<6>USB Serial support registered for Connect Tech - WhiteHEAT - (prerenumeration                                                          )
<6>USB Serial support registered for Connect Tech - WhiteHEAT
<6>usbcore: registered new interface driver whiteheat
<6>whiteheat: v2.0:USB ConnectTech WhiteHEAT driver
<6>usbcore: registered new interface driver usbhid
<6>usbhid: v2.6:USB HID core driver
<4>nf_conntrack version 0.5.0 (1024 buckets, 4096 max)
<6>ip_tables: (C) 2000-2006 Netfilter Core Team
<6>TCP cubic registered
<6>NET: Registered protocol family 17
<5>Bridge firewalling registered
<6>802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
<6>All bugs added by David S. Miller <davem@redhat.com>
<4>ar7100wdt_init: Registering watchdog timer success
<4>Watchdog freq 170000000
<4>VFS: Mounted root (jffs2 filesystem) readonly on device 31:1.
<6>Freeing unused kernel memory: 168k freed
<4>Algorithmics/MIPS FPU Emulator v1.5
<4>ftnt_fap_flash: module license 'unspecified' taints kernel.
<4>Disabling lock debugging due to kernel taint
<4>FAP FLASH: read fap flash regcode: E
<4>FAP FLASH: read fap flash base mac 00:09:0f:f3:51:f0
<4>AG7100: Length per segment 512
<4>AG7100: Max segments per packet 4
<4>AG7100: Max tx descriptor count    400
<4>AG7100: Max rx descriptor count    512
<4>AG7100: fifo cfg 3 018001ff
<4>FAP FLASH: MAC Base 00:09:0f:f3:51:f0 Unit: 1 00:09:0f:f3:51:f1
<4>AG7100CHH: Mac address for unit 0 base=19000000
<4>AG7100CHH: 00:09:0f:f3:51:f1
<4>FAP FLASH: MAC Base 00:09:0f:f3:51:f0 Unit: 0 00:09:0f:f3:51:f0
<4>AG7100CHH: Mac address for unit 1 base=1a000000
<4>AG7100CHH: 00:09:0f:f3:51:f0
<4>FAP FLASH: MAC Base 00:09:0f:f3:51:f0 Unit: 0 00:09:0f:f3:51:f0
<4>ag7100_ring_alloc Allocated 4800 at 0x83a4a000
<4>ag7100_ring_alloc Allocated 6144 at 0x83a4c000
<4>AG7100: cfg1 0x7 cfg2 0x7014
<4>ATHRF1:
<4>No phy found for unit 0
<4>Writing 4
<4>ag7100_ring_alloc Allocated 4800 at 0x83a4e000
<4>ag7100_ring_alloc Allocated 6144 at 0x831b0000
<4>AG7100: cfg1 0xf cfg2 0x7014
<4>ATHRF1: Port 1, Auto-Negotiation timeout
<4>ATHRF1: unit 1 phy addr 0 ATHRF1: reg0 1000
<4>Writing 6
<4>ag7100_ring_free Freeing at 0x83a4a000
<4>ag7100_ring_free Freeing at 0x83a4c000
<6>device eth0 entered promiscuous mode
<4>ag7100_ring_free Freeing at 0x83a4e000
<4>ag7100_ring_free Freeing at 0x831b0000
<6>device eth1 entered promiscuous mode
<6>ath_hal: 0.9.17.1 (AR5416, AR9380, DEBUG, REGOPS_FUNC, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
<6>ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
<6>ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
<6>ath_pci: 10.2.85 (Atheros/multi-bss)
<6>ath_pci_probe: PCI_SUBSYSTEM_ID a095
<4>__ath_attach: Set global_scn[0]
<4>*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
<4>ACBKMinfree = 48
<4>ACBEMinfree = 32
<4>ACVIMinfree = 16
<4>ACVOMinfree = 0
<4>CABMinfree = 48
<4>UAPSDMinfree = 0
<4>ATH_TXBUF=540
<4>ath_txq_setup: wifi1 qtype 3(QUEUE_CAB  ) subtype -1(N/A       ) qnum 8 sc_txqsetup 0100 axq_minfree 48
<4>ath_txq_setup: wifi1 qtype 1(QUEUE_DATA ) subtype  0(WME_AC_BK ) qnum 0 sc_txqsetup 0101 axq_minfree 48
<4>ath_txq_setup: wifi1 qtype 1(QUEUE_DATA ) subtype  1(WME_AC_BE ) qnum 1 sc_txqsetup 0103 axq_minfree 32
<4>ath_txq_setup: wifi1 qtype 1(QUEUE_DATA ) subtype  2(WME_AC_VI ) qnum 2 sc_txqsetup 0107 axq_minfree 16
<4>ath_txq_setup: wifi1 qtype 1(QUEUE_DATA ) subtype  3(WME_AC_VO ) qnum 3 sc_txqsetup 010f axq_minfree 0
<4>ath_txq_setup: wifi1 qtype 4(QUEUE_UAPSD) subtype -1(N/A       ) qnum 7 sc_txqsetup 018f axq_minfree 0
<4>Green-AP : Green-AP : Attached
<4>
<4>ath_get_caps[6205] rx chainmask mismatch actual 3 sc_chainmak 0
<4>ath_get_caps[6180] tx chainmask mismatch actual 3 sc_chainmak 0
<4>ieee80211_acs_register_scantimer_handler  ieee80211_acs_register_scantimer_handler
<4>
<4>!!!!! SC Callback Registration for wifi1
<4>FAP FLASH: MAC Base 00:09:0f:f3:51:f0 Unit: 9 00:09:0f:f3:51:f9
<6>wifi1: Atheros 9280: mem=0x10000000, irq=48 hw_base=0xb0000000
<6>ath_pci_probe: PCI_SUBSYSTEM_ID 2096
<4>__ath_attach: Set global_scn[1]
<4>*** All the minfree values should be <= ATH_TXBUF-32, otherwise default value will be used instead ***
<4>ACBKMinfree = 48
<4>ACBEMinfree = 32
<4>ACVIMinfree = 16
<4>ACVOMinfree = 0
<4>CABMinfree = 48
<4>UAPSDMinfree = 0
<4>ATH_TXBUF=540
<4>ath_txq_setup: wifi0 qtype 3(QUEUE_CAB  ) subtype -1(N/A       ) qnum 8 sc_txqsetup 0100 axq_minfree 48
<4>ath_txq_setup: wifi0 qtype 1(QUEUE_DATA ) subtype  0(WME_AC_BK ) qnum 0 sc_txqsetup 0101 axq_minfree 48
<4>ath_txq_setup: wifi0 qtype 1(QUEUE_DATA ) subtype  1(WME_AC_BE ) qnum 1 sc_txqsetup 0103 axq_minfree 32
<4>ath_txq_setup: wifi0 qtype 1(QUEUE_DATA ) subtype  2(WME_AC_VI ) qnum 2 sc_txqsetup 0107 axq_minfree 16
<4>ath_txq_setup: wifi0 qtype 1(QUEUE_DATA ) subtype  3(WME_AC_VO ) qnum 3 sc_txqsetup 010f axq_minfree 0
<4>ath_txq_setup: wifi0 qtype 4(QUEUE_UAPSD) subtype -1(N/A       ) qnum 7 sc_txqsetup 018f axq_minfree 0
<4>Green-AP : Green-AP : Attached
<4>
<4>ath_get_caps[6205] rx chainmask mismatch actual 3 sc_chainmak 0
<4>ath_get_caps[6180] tx chainmask mismatch actual 3 sc_chainmak 0
<4>ieee80211_acs_register_scantimer_handler  ieee80211_acs_register_scantimer_handler
<4>
<4>!!!!! SC Callback Registration for wifi0
<4>FAP FLASH: MAC Base 00:09:0f:f3:51:f0 Unit: 2 00:09:0f:f3:51:f2
<6>wifi0: Atheros 9280: mem=0x10010000, irq=49 hw_base=0xb0010000
<6>fapportal uses obsolete (PF_INET,SOCK_PACKET)
<4>ag7100_ring_alloc Allocated 4800 at 0x821d8000
<4>ag7100_ring_alloc Allocated 6144 at 0x821da000
<4>AG7100: cfg1 0xf cfg2 0x7014
<4>ATHRF1: Port 1, Auto-Negotiation timeout
<4>ATHRF1: unit 1 phy addr 0 ATHRF1: reg0 1000
<4>Writing 6
<4>DV: : fini! ==========
<4>DV: : init! ==========
<4>DV: Mgmt vlan id: 0
<4>DV: Base dev interface: eth1
<4>FAP FLASH: MAC Base 00:09:0f:f3:51:f0 Unit: 0 00:09:0f:f3:51:f0
<4>wlan_vap_create : enter. devhandle=0x824002c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
<4>ieee80211_find_dot11_channel: total available channels 19 input mode 1 mode 1 selected chan 140 (5700)
<4>ieee80211_find_dot11_channel: total available channels 13 input mode 2 mode 2 selected chan 2 (2417)
<4>ieee80211_find_dot11_channel: total available channels 13 input mode 3 mode 3 selected chan 8 (2447)
<4>ieee80211_find_dot11_channel: total available channels 19 input mode 7 mode 7 selected chan 36 (5180)
<4>ieee80211_find_dot11_channel: total available channels 13 input mode 8 mode 8 selected chan 12 (2467)
<4>ieee80211_find_dot11_channel: total available channels 9 input mode 9 mode 9 selected chan 108 (5540)
<4>ieee80211_find_dot11_channel: total available channels 9 input mode a mode a selected chan 56 (5280)
<4>ieee80211_find_dot11_channel: total available channels 9 input mode b mode b selected chan 9 (2452)
<4>ieee80211_find_dot11_channel: total available channels 9 input mode c mode c selected chan 12 (2467)
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:15, modeflags:00100100
<4>ieee80211_find_dot11_channel: total available channels 32 input mode 12 mode 12 selected chan 7 (2442)
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:16, modeflags:00200100
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:17, modeflags:00400100
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:19, modeflags:00800100
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 140 mode 1
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 2 mode 2
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 8 mode 3
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 36 mode 7
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 12 mode 8
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 108 mode 9
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 56 mode 10
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 9 mode 11
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 12 mode 12
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 1 mode 13
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 36 mode 14
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 15
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 7 mode 18
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 16
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 17
<4>[595.016]vap-00: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 19
<4>[595.016]vap-00: ieee80211_reset_bss
<4>[595.016]vap-00: [00:09:0f:f3:51:f2] ieee80211_alloc_node: vap=0x823f8000, nodecount=1, ni=0x823e0000 ref=2, ni_bss_node=0x823e0000 bss_ref=2
<4>wlan_vap_create : exit. devhandle=0x824002c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
<6>VAP device wlan00 created
<4>_ieee80211_scan_get_requestor_id: module=osif_umac requestor=8000
<4>wlan_vap_create : enter. devhandle=0x831602c0, opmode=IEEE80211_M_HOSTAP, flags=0x1
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:1, modeflags:00000140
<4>ieee80211_find_dot11_channel: total available channels 13 input mode 2 mode 2 selected chan 13 (2472)
<4>ieee80211_find_dot11_channel: total available channels 13 input mode 3 mode 3 selected chan 11 (2462)
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:7, modeflags:00010100
<4>ieee80211_find_dot11_channel: total available channels 13 input mode 8 mode 8 selected chan 4 (2427)
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:9, modeflags:00020100
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:10, modeflags:00040100
<4>ieee80211_find_dot11_channel: total available channels 9 input mode b mode b selected chan 2 (2417)
<4>ieee80211_find_dot11_channel: total available channels 9 input mode c mode c selected chan 7 (2442)
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:14, modeflags:00000000
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:15, modeflags:00100100
<4>ieee80211_find_dot11_channel: total available channels 32 input mode 12 mode 12 selected chan 4 (2427)
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:16, modeflags:00200100
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:17, modeflags:00400100
<4>ieee80211_find_dot11_channel_1st: no any channel to match chan:0, mode:19, modeflags:00800100
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 1
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 13 mode 2
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 11 mode 3
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 7
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 4 mode 8
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 9
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 10
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 2 mode 11
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 7 mode 12
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 1 mode 13
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 14
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 15
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 4 mode 18
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 16
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 17
<4>[595.024]vap-10: ieee80211_vap_setup_des_chan ic_cfg_chan 0 iv_des_chan 0 mode 19
<4>[595.024]vap-10: ieee80211_reset_bss
<4>[595.024]vap-10: [00:09:0f:f3:51:f9] ieee80211_alloc_node: vap=0x81800000, nodecount=1, ni=0x823e2000 ref=2, ni_bss_node=0x823e2000 bss_ref=2
<4>wlan_vap_create : exit. devhandle=0x831602c0, opmode=IEEE80211_M_HOSTAP, flags=0x1.
<6>VAP device wlan10 created
<4>_ieee80211_scan_get_requestor_id: module=osif_umac requestor=8000
<4>DV: : fini! ==========
<4>DV: : init! ==========
<4>DV: Mgmt vlan id: 0
<4>DV: Base dev interface: eth1
<4>FAP FLASH: MAC Base 00:09:0f:f3:51:f0 Unit: 0 00:09:0f:f3:51:f0
<4>[595.720]vap-00: osif_vap_open,4985, osif_vap_init start running, ifname=wlan00, opmode=6 ******
<4>[595.736]vap-00: osif_vap_stop : stopping AP vap
<4>[595.736]vap-00: osif_vap_down : sending MLME Event
<4>[595.736]vap-00: wlan_mlme_stop_bss flags = 0x0
<4>[595.736]vap-00: wlan_mlme_stop_bss: disassocing/deauth all stations
<4>[595.736]vap-00: ieee80211_state_event: VAP state event 0, cur_state=0, vap_deleted_is_set=0
<4>[595.736]vap-00: ieee80211_state_event: VAP state transition INIT -> INIT
<4>[595.736]vap-00: ieee80211_reset_bss
<4>[595.736]vap-00: [00:09:0f:f3:51:f2] ieee80211_alloc_node: vap=0x823f8000, nodecount=2, ni=0x823e4000 ref=2, ni_bss_node=0x823e4000 bss_ref=2
<4>[595.736]vap-00: [00:09:0f:f3:51:f2] _ieee80211_free_node sta_assoc cnt iv 0 ==> 0 ic 0 ==> 0
<4>[595.736]vap-00: [00:09:0f:f3:51:f2] station free
<4>[595.736]vap-00: [00:09:0f:f3:51:f2] _ieee80211_free_node: vap=0x823f8000, nodecount=2, ni=0x823e0000 ref=0, ni_bss_node=0x823e0000 bss_ref=0
<4>[595.736]vap-00: [00:09:0f:f3:51:f2] ieee80211_node_saveq_cleanup 0 sta's in ps mode TS 595.736
<4>[595.736]vap-00: [00:09:0f:f3:51:f2] ieee80211_node_clear_keys: vap=0x823f8000, nodecount=2, ni=0x823e0000, ni_bss_node=0x823e0000 bss_ref=0
<4>[595.736]vap-00: [00:09:0f:f3:51:f2] node_cleanup sta_assoc cnt iv 0 ==> 0 ic 0 ==> 0
<4>[595.736]vap-00: ieee80211_state_event: VAP state event 11, cur_state=0, vap_deleted_is_set=0
<4>[595.736]vap-00: ieee80211_state_event: VAP EVENT_NODE_FREED node count 1
<4>[595.736]vap-00: ieee80211_state_event: VAP state transition INIT -> INIT
<4>[595.748]vap-00: osif_vap_open,4985, osif_vap_init start running, ifname=wlan00, opmode=6 ******
<4>[595.756]vap-00: osif_vap_stop : stopping AP vap
<4>[595.756]vap-00: osif_vap_down : sending MLME Event
<4>[595.756]vap-00: wlan_mlme_stop_bss flags = 0x0
<4>[595.756]vap-00: wlan_mlme_stop_bss: disassocing/deauth all stations
<4>[595.756]vap-00: ieee80211_state_event: VAP state event 0, cur_state=0, vap_deleted_is_set=0
<4>[595.756]vap-00: ieee80211_state_event: VAP state transition INIT -> INIT
<4>[595.756]vap-00: ieee80211_reset_bss
<4>[595.756]vap-00: [00:09:0f:f3:51:f2] ieee80211_alloc_node: vap=0x823f8000, nodecount=2, ni=0x823e0000 ref=2, ni_bss_node=0x823e0000 bss_ref=2
<4>[595.756]vap-00: [00:09:0f:f3:51:f2] _ieee80211_free_node sta_assoc cnt iv 0 ==> 0 ic 0 ==> 0
<4>[595.756]vap-00: [00:09:0f:f3:51:f2] station free
<4>[595.756]vap-00: [00:09:0f:f3:51:f2] _ieee80211_free_node: vap=0x823f8000, nodecount=2, ni=0x823e4000 ref=0, ni_bss_node=0x823e4000 bss_ref=0
<4>[595.756]vap-00: [00:09:0f:f3:51:f2] ieee80211_node_saveq_cleanup 0 sta's in ps mode TS 595.756
<4>[595.756]vap-00: [00:09:0f:f3:51:f2] ieee80211_node_clear_keys: vap=0x823f8000, nodecount=2, ni=0x823e4000, ni_bss_node=0x823e4000 bss_ref=0
<4>[595.756]vap-00: [00:09:0f:f3:51:f2] node_cleanup sta_assoc cnt iv 0 ==> 0 ic 0 ==> 0
<4>[595.756]vap-00: ieee80211_state_event: VAP state event 11, cur_state=0, vap_deleted_is_set=0
<4>[595.756]vap-00: ieee80211_state_event: VAP EVENT_NODE_FREED node count 1
<4>[595.756]vap-00: ieee80211_state_event: VAP state transition INIT -> INIT
<4>[595.772]vap-10: osif_vap_open,4985, osif_vap_init start running, ifname=wlan10, opmode=6 ******
<4>[595.788]vap-10: osif_vap_stop : stopping AP vap
<4>[595.788]vap-10: osif_vap_down : sending MLME Event
<4>[595.788]vap-10: wlan_mlme_stop_bss flags = 0x0
<4>[595.788]vap-10: wlan_mlme_stop_bss: disassocing/deauth all stations
<4>[595.788]vap-10: ieee80211_state_event: VAP state event 0, cur_state=0, vap_deleted_is_set=0
<4>[595.788]vap-10: ieee80211_state_event: VAP state transition INIT -> INIT
<4>[595.788]vap-10: ieee80211_reset_bss
<4>[595.788]vap-10: [00:09:0f:f3:51:f9] ieee80211_alloc_node: vap=0x81800000, nodecount=2, ni=0x823e4000 ref=2, ni_bss_node=0x823e4000 bss_ref=2
<4>[595.788]vap-10: [00:09:0f:f3:51:f9] _ieee80211_free_node sta_assoc cnt iv 0 ==> 0 ic 0 ==> 0
<4>[595.788]vap-10: [00:09:0f:f3:51:f9] station free
<4>[595.788]vap-10: [00:09:0f:f3:51:f9] _ieee80211_free_node: vap=0x81800000, nodecount=2, ni=0x823e2000 ref=0, ni_bss_node=0x823e2000 bss_ref=0
<4>[595.788]vap-10: [00:09:0f:f3:51:f9] ieee80211_node_saveq_cleanup 0 sta's in ps mode TS 595.788
<4>[595.788]vap-10: [00:09:0f:f3:51:f9] ieee80211_node_clear_keys: vap=0x81800000, nodecount=2, ni=0x823e2000, ni_bss_node=0x823e2000 bss_ref=0
<4>[595.788]vap-10: [00:09:0f:f3:51:f9] node_cleanup sta_assoc cnt iv 0 ==> 0 ic 0 ==> 0
<4>[595.788]vap-10: ieee80211_state_event: VAP state event 11, cur_state=0, vap_deleted_is_set=0
<4>[595.788]vap-10: ieee80211_state_event: VAP EVENT_NODE_FREED node count 1
<4>[595.788]vap-10: ieee80211_state_event: VAP state transition INIT -> INIT
<4>[595.800]vap-10: osif_vap_open,4985, osif_vap_init start running, ifname=wlan10, opmode=6 ******
<4>[595.808]vap-10: osif_vap_stop : stopping AP vap
<4>[595.808]vap-10: osif_vap_down : sending MLME Event
<4>[595.808]vap-10: wlan_mlme_stop_bss flags = 0x0
<4>[595.808]vap-10: wlan_mlme_stop_bss: disassocing/deauth all stations
<4>[595.808]vap-10: ieee80211_state_event: VAP state event 0, cur_state=0, vap_deleted_is_set=0
<4>[595.808]vap-10: ieee80211_state_event: VAP state transition INIT -> INIT
<4>[595.808]vap-10: ieee80211_reset_bss
<4>[595.808]vap-10: [00:09:0f:f3:51:f9] ieee80211_alloc_node: vap=0x81800000, nodecount=2, ni=0x823e2000 ref=2, ni_bss_node=0x823e2000 bss_ref=2
<4>[595.808]vap-10: [00:09:0f:f3:51:f9] _ieee80211_free_node sta_assoc cnt iv 0 ==> 0 ic 0 ==> 0
<4>[595.808]vap-10: [00:09:0f:f3:51:f9] station free
<4>[595.808]vap-10: [00:09:0f:f3:51:f9] _ieee80211_free_node: vap=0x81800000, nodecount=2, ni=0x823e4000 ref=0, ni_bss_node=0x823e4000 bss_ref=0
<4>[595.808]vap-10: [00:09:0f:f3:51:f9] ieee80211_node_saveq_cleanup 0 sta's in ps mode TS 595.808
<4>[595.808]vap-10: [00:09:0f:f3:51:f9] ieee80211_node_clear_keys: vap=0x81800000, nodecount=2, ni=0x823e4000, ni_bss_node=0x823e4000 bss_ref=0
<4>[595.808]vap-10: [00:09:0f:f3:51:f9] node_cleanup sta_assoc cnt iv 0 ==> 0 ic 0 ==> 0
<4>[595.808]vap-10: ieee80211_state_event: VAP state event 11, cur_state=0, vap_deleted_is_set=0
<4>[595.808]vap-10: ieee80211_state_event: VAP EVENT_NODE_FREED node count 1
<4>[595.808]vap-10: ieee80211_state_event: VAP state transition INIT -> INIT
<4>[600.012]vap-00:

[Borromini]

That should help you to determine some stuff and start putting a DTS together, like someone said earlier check the tree for support for similar hardware. That often has pointers on what you need.

[s4ndm4n]

Found a very similar Device:

Aruba AP-105

Same WIFI(2.4&5GHz),CPU,ETH

i wrote a dts file with the Aruba AP-105 as a base: sorry but i really doesnt know what im doing here, there`s not that much documented about how to edit such a thing

// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
/dts-v1/;

#include <dt-bindings/input/input.h>

#include "ar7100.dtsi"

/ {
	compatible = "fortinet,fap-220-b", "qca,ar7161";
	model = "FortiAP FAP-220-BE";

	chosen {
		bootargs = "console=ttyS0,9600";
	};

	extosc: ref {
		compatible = "fixed-clock";
		#clock-cells = <0>;
		clock-output-names = "ref";
		clock-frequency = <40000000>;
	};
	};

&pcie0 {
	status = "okay";

	ath9k0: wifi@0,11 { /* 2.4 GHz */
		compatible = "pci168c,0029";
		mtd-mac-address = <&hwinfo 0x1c>;
		mtd-mac-address-increment = <1>;
		reg = <0x8800 0 0 0 0>;
		#gpio-cells = <2>;
		gpio-controller;
	};

	ath9k1: wifi@0,12 { /* 5 GHz */
		compatible = "pci168c,0029";
		mtd-mac-address = <&hwinfo 0x1c>;
		mtd-mac-address-increment = <2>;
		reg = <0x9000 0 0 0 0>;
		#gpio-cells = <2>;
		gpio-controller;
	};
};

&uart {
	status = "okay";
};

&mdio0 {
	status = "okay";

	phy-mask = <0x1>;

	phy0: ethernet-phy@0 {
		reg = <0>;
	};
};

&eth0 {
	status = "okay";
	mtd-mac-address = <&hwinfo 0x1c>;

	pll-data = <0x00110000 0x00001099 0x00991099>;

	phy-mode = "rgmii";
	phy-handle = <&phy0>;
};

&spi {
	status = "okay";
	num-cs = <1>;

	flash@0 {
		compatible = "jedec,spi-nor";
		reg = <0>;
		spi-max-frequency = <25000000>;

		partitions {
			compatible = "fixed-partitions";
			#address-cells = <1>;
			#size-cells = <1>;

			partition@0 {
				label = "bios";
				reg = <0x000000 0x40000>;
				read-only;
			};

			partition@40000 {
				label = "rootfs";
				reg = <0x40000 0x940000>;
				compatible = "denx,uimage";
			};

			partition@940000 {
				label = "uImage";
				reg = <0x940000 0xaf0000>;
				read-only;
			};

			partition@af0000 {
				label = "reserved";
				reg = <0xaf0000 0xff0000>;
				read-only;
			};
      partition@ff0000 {
        label = "caldata";
        reg = <0xff0000 0x1000000>;
        read-only;
      };
		};
	};
};

the mtd partitions i got from dmesg:

[s4ndm4n]

Can someone please give me tips on how to adapt the dts file?

What does e.g. &mdio mean, where can I get the "reg" address for it.

What do I write at &spi, &flash0 under partitions at the point compatible = "fixed partitions"

How do I know that rgmii is the correct "phy-mode" for &eth0 and whether phy0 is the correct "phy-handle".

do I need all &* entries to do a test boot at least once.

The documentation to support new devices is really not very helpful because it is kept very short.

I don't see through that at all.
e.g. for the Meraki MR-12 it took 7 files that had to be edited.
But only 3 for the Aruba?

[mpratt14]

@s4ndm4n if you're still around I can help

I worked on FAP-221-B and support for that is being reviewed now

despite the model names being almost the same, the hardware is quite different though

[s4ndm4n]

@mpratt14 Sadly i already threw them away

[Leo-PL]

I just got my hands on one and got some success - Ethernet and Wi-Fi are working, regarding factory image - everything looks like methods used for FAP-221-B should work here as well, but haven't flashed just yet. The lack of security in a product made by a security company is astonishing.
Edit: Sysupgrade works just by copying parameters from FAP-221-B, I need to double-check the factory image version, because that gets rejected by stock U-boot.

Edit 2: @mpratt14 your work saved me a ton of effort. Factory install works as well after minor tweak to version ID. And USB works as well, so the support looks complete. I'll submit a PR soon.

[mpratt14]

Glad to hear you got it running

It makes all the time I wasted on the 221B worth it, so others can add the rest easily.

Getting the first one to work was pretty challenging and took quite a while. Under someone else's suggestion, I was using Ghidra to decompile the busybox binary to at least have a clue of what was going on. I'm just glad that there was a text output for rejected images so I had somewhere to start. So I suppose we can also thank the NSA

In my opinion, even if it was easy to get custom software to boot on it, I wouldn't consider that a security flaw. It definitely requires having physical access to the device, or alternatively, digital access through their own remote upgrading, which hopefully uses scp, but I wouldn't know. All of these old Fortinet APs are EOL which is enough for me to consider it to be a security risk in deployment. I'm just hoping that enough people catch on instead of just recycle or trash these nice boards.

I never did get my hands on OEM firmware for 221B, but I found one that was similar to make sure the flash layout was correct. All of the Fortinet forums including on Reddit have a rule that you're not allowed to ask others for any copy of firmware, which is in my opinion extremely disgraceful behavior for any tech company.

case in point:
https://www.reddit.com/r/fortinet/comments/mg5zh2/firmware_for_fap221b/