Dear all,
if someone is seriously interested to create new firmware for Avaya WAP9102, originally made by Xirrus, i am more then happy to provide you with a bunch of devices.
I hope that one of you can free the device and make it available so that electronic waste could be prevented.
If you need more information (e.g. detailed photos of the mainboard ...) about the devices, please let me know.
Thank you so much for all your work!
Best,
Chris
PS: I am situated in Germany.
Can you provide a bit more specs?
J500 could be serial.
Do you happen to know the chipset of the WiFi cards?
EDIT: It's actually 256Mbit * 16 per chip, so in total 1GByte of RAM
Thought so too; maybe the pinout is printed on the other side of the PCB.
@Chrizz: Could you photograph the other side too, if it has any markings or ICs on it?
Hi @Chrizz, I'm interested on this device. I live in Spain.
That's rebranded Xirrus XR600, https://fccid.io/SK6-XR620. The radios are QCA9882. Unfortunately I only briefly poked at it and couldn't find yet the UART pins. Tossed on the shelf for lack of time for it.
I was hoping to see more RAM chips on the bottom of the board, but no it only has the two on top for 64MB. ath10k needs a lot of memory, two instances in 64M is going to be a problem.
Yes need the number on that Samsung chip. Some managed APs network boot from their controller, so only have a small flash in the AP.
J6 looks like a site for a USB-A socket, which could support a USB flash drive internally like the Edgerouter-Lite has.
I bought one for cheap on ebay a while ago in the hope to repurpose the wifi cards into another device. However I couldn't get it to work, possibly due to the calibration data not being stored on the cards but in flash?
The 4 holes at J500 are the uart / serial connector. Some info I managed to gather below:
printenv:
Press space bar to exit to bootloader: 3
Username: admin
Password: *****
XBL>printenv
Variable Value
----------------- -------------------------------
baudrate 115200n8
bootargs console=ttyS0,115200n8
root =/dev/ram rw quiet
bootcmd bootsetup;
load $loadaddr $bootfile && boot $loadaddr;
reset
bootcmd_old if dir u-boot*.bin -q;
then load $loadaddr u-boot*.bin;
del u-boot*.bin -q;
update mem u-boot;
fi;
if dir scd*.bin -q;
then load $loadaddr scd*.bin;
del scd*.bin -q;
update mem scd;
fi;
env set bootfile $bootfile_active;
if dir lastboot -q;
then rename lastboot lastboot.old -q;
-- More --
else dir $bootfile_backup -q && env set bootfile
$bootfile_backup;
fi;
load $loadaddr $bootfile;
boot $loadaddr;
reset
bootdelay 3
bootfile_active XS-8.2.0-6852.bin
bootfile_backup X*.bin
commandset full
country_code DE
cpucard_date 2014-Jul-21 9:43
cpucard_prt# 100-0167-001.A
cpucard_ser# 0000027556
dhcp disabled
download_baudrate 115200
env_addr 1f5f8000
env_size 1000
eth 0
eth0addr 64:a7:dd:00:6b:a4
eth1addr 64:a7:dd:00:6b:a5
ethact eth0
flash_base_addr 1f400000
-- More --
flash_size 200000
flash_unused_addr 1f580000
flash_unused_size 60000
license_key 153NL-N1Q46-HNQ2M-6J9B4
license_old 09582-NX94V-HNB6M-6JBU6
loadaddr 0x20000000
numcores 2
password enc 862d8d4937
rfaddrbase 64:a7:dd:1d:e1:a0
rfaddrcount 2
rfcard00_date 2014-Jul-21 08:00
rfcard00_prt# 100-0166-002.2
rfcard00_ser# 0002113514
rfcard01_date 2014-Jul-21 09:00
rfcard01_prt# 100-0166-002.2
rfcard01_ser# 0002112803
stderr ser_xc
stdin ser_xc
stdout ser_xc
subindent 8
system_date 2014-Jul-21 9:43
system_ser# A271429006BA4
uboot_flash_addr 0x1f400000
-- More --
uboot_flash_size 0x180000
username admin
version Avaya Boot Loader 7.1.0 (Jul 25 2016), Build: 7141
Environment size: 1536/4092 bytes
uboot commands available:
XBL>?
? - alias for 'help'
aqr105 - Aquantia PHY tool
askenv - get environment variables from stdin
ath_dump - dump all documented registers in Atheros AR8033 Ethernet PHY
base - print or set address offset
base64 - print or set address offset
bdinfo - print Board Info structure
boot - boot operating system or application
bootd - boot default, i.e., run 'bootcmd'
bootelf - Boot from an ELF image in memory
bootm - boot application image from memory
bootoct - Boot from an Octeon Executive ELF image in memory
bootoctelf - Boot a generic ELF image in memory. NOTE: This command does not
support simple executive applications, use bootoct for those.
bootoctlinux- Boot from a linux ELF image in memory
bootp - boot image via network using BOOTP/TFTP protocol
bootsetup - update boot status and select bootfile
button - current reset button state
chpart - change active partition
cmp - memory compare
cmp64 - memory compare
compass - compass calibration or heading in degrees
-- More --
coninfo - print console devices and information
cp - memory copy
cp64 - memory copy
crc32 - checksum calculation
date - get/set/reset date & time
dhcp - boot image via network using DHCP/TFTP protocol
dmesg - linux post-mortem report what the kernel last logged
dtt - Read temperature from Digital Thermometer and Thermostat
echo - echo args to console
editenv - editenv - edit environment variables
eeprom - EEPROM sub-system
env - environment handling commands
erase - erase FLASH memory
eraseenv - erase the environment in flash
eth - eth - set or report the current ethernet device
ethinfo - ethinfo - display info on ethernet device(s)
exit - exit script
ext4load - load binary file from a Ext4 filesystem
ext4ls - list files in a directory (default /)
false - do nothing, unsuccessfully
fatinfo - print information about filesystem
fatload - load binary file from a dos filesystem
fatls - list files in a directory (default /)
-- More --
fd - read 32-bit word from fpga memory address
flinfo - print FLASH memory information
flush_dcache- Flushes and invalidates the data cache
flush_l2c - Flushes the L2 cache
freeprint - Print list of free bootmem blocks
fw - write 32-bit word to fpga memory address
go - start application at address 'addr'
grepenv - search environment variables
help - print command description/usage
i2c - I2C sub-system
inv_icache - Invalidates the instruction cache
itest - return true/false on integer compare
led - radio led
load - load binary file from a filesystem
loop - infinite loop on address range
loop64 - infinite loop on address range
ls - list files in a directory (default /)
md - memory display
md5sum - compute MD5 message digest
md64 - memory display
meminfo - display memory information
mii - MII utility commands
mii45 - MII clause 45 utility commands
-- More --
mm - memory modify (auto-incrementing address)
mm64 - memory modify (auto-incrementing address)
mmc - MMC sub system
mmcinfo - display MMC info
moneta - memory order-and-normalcy evaluation-and-test agent
mtdparts - define flash/nand partitions
mtest - simple RAM read/write test
mw - memory write (fill)
mw64 - memory write (fill)
namedalloc - Allocate a named bootmem block
namedfree - Free a named bootmem block
namedprint - Print list of named bootmem blocks
nm - memory modify (constant address)
nm64 - memory modify (constant address)
nmi - Generate a non-maskable interrupt
octbootbus - print boot bus parameters
octreginfo - print register information
pci - list and access PCI Configuration Space
pd - read 32-bit word from pcie memory address
ping - send ICMP ECHO_REQUEST to network host
printenv - print environment variables
protect - enable or disable FLASH write protection
-- More --
pw - write 32-bit word to pcie memory address
qlm - Octeon QLM debug function
read64 - read 64 bit word from 64 bit address (deprecated)
read64b - read 8 bit word from 64 bit address (deprecated)
read64l - read 32 bit word from 64 bit address (deprecated)
read64s - read 16 bit word from 64 bit address (deprecated)
red - read 16-bit words from radio eeprom
remove - remove fpga images from the boot FLASH
reset - Perform RESET of the CPU
rew - write 16-bit words to radio eeprom
rewt - write fixed data to radio eeprom to test byte alignment
ri - radio information
rs - radio set manufacturing information
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
scd - scd handling commands
setenv - set environment variables
setexpr - set environment variable as the result of eval expression
sha1sum - compute SHA1 message digest
showvar - print local hushshell variables
sleep - delay execution for some time
source - run script from memory
strings - display strings
-- More --
test - minimal test like /bin/sh
tftp - alias for tftpboot command (deprecated)
tftpboot - boot image via network using TFTP protocol
time - run commands and summarize execution time
true - do nothing, successfully
update - update the boot FLASH
usb - USB sub-system
version - print monitor version
watchdog - enable, disable, set or report the watchdog timer period
write64 - write 64 bit word to 64 bit address (deprecated)
write64b - write 8 bit word to 64 bit address (deprecated)
write64l - write 32 bit word to 64 bit address (deprecated)
write64s - write 16 bit word to 64 bit address (deprecated)
xktrace - post-mortem display of the final events of the linux kernel
xrp - listen for XRP beacons
XBL>
boot log (not sure if complete?)
[MMC 0 ] File : XS-8.2.0-6852.bin
[MMC 0 ] Address : 0x20000000
[MMC 0 ] Loading : ############################################### done
[MMC 0 ] Complete: 3.8 sec, 21.0 MB/sec
[Boot ] Address : 0x20000000
[Image ] Name : XR-8.2.0-6852
[Image ] Created : 2016-09-23 23:39:40 UTC
[Image ] Type : MIPS Linux Multi-File Image (uncompressed)
[Image ] Size : 81376725 Bytes = 77.6 MB
[Image ] Contents: File 0: 10900736 Bytes = 10.4 MB
[Image ] Contents: File 1: 53065918 Bytes = 50.6 MB
[Image ] Contents: File 2: 17410053 Bytes = 16.6 MB
[Boot ] Image : Verifying image ....... OK
[Boot ] Loading : Multi-File Image .... OK
[Boot ] Watchdog: Disabling .... OK
[Boot ] Execute : Transferring control to OS
[ 0.000000] Wasting 14336 bytes for tracking 256 unused pages
[ 0.000000] Initial ramdisk at: 0x800000000410b000 (53065918 bytes)
[ 0.000000] DMA Descriptor Block = 1000000 at 8000000020000000 (20000000)
[ 0.000000] Using internal Device Tree.
[ 0.000000] software IO TLB [mem 0x21e0a000-0x21e4a000] (256KiB) mapped at [8000000021e0a000-8000000021e49fff]
[ 0.000000] Zone ranges:
[ 0.000000] DMA [mem 0x00100000-0x0fffffff]
[ 0.000000] Normal [mem 0x10000000-0x4effffff]
[ 0.000000] Movable zone start for each node
[ 0.000000] Early memory node ranges
[ 0.000000] node 0: [mem 0x00100000-0x0099ffff]
[ 0.000000] node 0: [mem 0x00c00000-0x03ffffff]
[ 0.000000] node 0: [mem 0x07400000-0x0fbfffff]
[ 0.000000] node 0: [mem 0x20000000-0x4effffff]
[ 0.000000] Primary instruction cache 37kB, virtually tagged, 37 way, 8 sets, linesize 128 bytes.
[ 0.000000] Primary data cache 32kB, 32-way, 8 sets, linesize 128 bytes.
[ 0.000000] Secondary unified cache 512kB, 8-way, 512 sets, linesize 128 bytes.
[ 0.000000] PERCPU: Embedded 11 pages/cpu @8000000021e63000 s13440 r8192 d23424 u45056
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 239527
[ 0.000000] Kernel command line: console=ttyS0,115200n8 root=/dev/ram rw earlyprintk rd_start=0x8410B000 rd_size=0x329B8BE flash_start=0x1F400000 flash_size=0x200000
[ 0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes)
[ 0.000000] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes)
[ 0.000000] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes)
[ 0.000000] Memory: 929784k/971392k available (5783k kernel code, 41608k reserved, 2717k data, 328k init, 0k highmem)
[ 0.000000] SLUB: HWalign=128, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] Hierarchical RCU implementation.
[ 0.000000] RCU restricting CPUs from NR_CPUS=6 to nr_cpu_ids=2.
[ 0.000000] NR_IRQS:512
[ 0.459907] Calibrating delay loop (skipped) preset value.. 800.00 BogoMIPS (lpj=400000)
[ 0.467842] pid_max: default: 32768 minimum: 501
[ 0.472915] Security Framework initialized
[ 0.477062] Mount-cache hash table entries: 256
[ 0.483124] Checking for the daddi bug... no.
[ 0.489136] SMP: Booting CPU01 (CoreId 1)...
[ 0.493366] CPU revision is: 000d9301 (Cavium Octeon II)
[ 0.493751] Brought up 2 CPUs
[ 0.506800] NET: Registered protocol family 16
[ 0.513246] PTP Clock: Using sclk reference at 400000000 Hz
[ 0.518670] Installing handlers for error tree at: ffffffff808e8ba0
[ 0.530566] PCIe: Initializing port 0
[ 0.580091] PCIe: Port 0 link active, 1 lanes, speed gen1
[ 0.686913] PCIe: Initializing port 1
[ 0.736391] PCIe: Port 1 link active, 1 lanes, speed gen1
[ 0.878273] bio: create slab <bio-0> at 0
[ 0.884140] SCSI subsystem initialized
[ 0.888955] usbcore: registered new interface driver usbfs
[ 0.894569] usbcore: registered new interface driver hub
[ 0.900074] usbcore: registered new device driver usb
[ 0.905395] EDAC MC: Ver: 3.0.0
[ 0.910002] PCI host bridge to bus 0000:00
[ 0.913981] pci_bus 0000:00: root bus resource [mem 0x1000000000000]
[ 0.920300] pci_bus 0000:00: root bus resource [io 0x0000]
[ 0.925849] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[ 0.934114] PCI host bridge to bus 0000:01
[ 0.938096] pci_bus 0000:01: root bus resource [mem 0x11b00f0000000-0x11b0fffffffff] (bus address [0xf0000000-0xfffffffff])
[ 0.949186] pci_bus 0000:01: root bus resource [io 0x1000-0xffffffff]
[ 0.955700] pci_bus 0000:01: No busn resource found for root bus, will use [bus 01-ff]
[ 0.978133] pci 0000:01:00.0: BAR 0: assigned [mem 0x11b00f0000000-0x11b00f01fffff 64bit]
[ 0.988219] pci 0000:01:00.0: BAR 6: assigned [mem 0x11b00f0200000-0x11b00f020ffff pref]
[ 0.996473] PCI host bridge to bus 0001:02
[ 1.000455] pci_bus 0001:02: root bus resource [mem 0x11c00f0000000-0x11c0fffffffff] (bus address [0xf0000000-0xfffffffff])
[ 1.011549] pci_bus 0001:02: root bus resource [io 0x100000000-0x1ffffffff] (bus address [0x0000-0xffffffff])
[ 1.021519] pci_bus 0001:02: No busn resource found for root bus, will use [bus 02-ff]
[ 1.043948] pci 0001:02:00.0: BAR 0: assigned [mem 0x11c00f0000000-0x11c00f01fffff 64bit]
[ 1.054031] pci 0001:02:00.0: BAR 6: assigned [mem 0x11c00f0200000-0x11c00f020ffff pref]
[ 1.065921] Switching to clocksource OCTEON_CVMCOUNT
[ 1.074620] NET: Registered protocol family 2
[ 1.079954] TCP established hash table entries: 8192 (order: 5, 131072 bytes)
[ 1.087265] TCP bind hash table entries: 8192 (order: 6, 262144 bytes)
[ 1.094041] TCP: Hash tables configured (established 8192 bind 8192)
[ 1.100346] TCP: reno registered
[ 1.103477] UDP hash table entries: 512 (order: 3, 49152 bytes)
[ 1.109437] UDP-Lite hash table entries: 512 (order: 3, 49152 bytes)
[ 1.116374] NET: Registered protocol family 1
[ 1.121177] RPC: Registered named UNIX socket transport module.
[ 1.126961] RPC: Registered udp transport module.
[ 1.131637] RPC: Registered tcp transport module.
[ 1.136328] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 1.143104] Trying to unpack rootfs image as initramfs...
[ 9.727011] Freeing initrd memory: 51820K (800000000410b000 - 80000000073a6000)
[ 9.744517] octeon_pci_console: Console not created.
[ 9.749513] /proc/octeon_perf: Octeon performance counter interface loaded
[ 9.806219] NFS: Registering the id_resolver key type
[ 9.811209] Key type id_resolver registered
[ 9.815301] Key type id_legacy registered
[ 9.819356] msgmni has been set to 1917
[ 9.824910] io scheduler noop registered
[ 9.828703] io scheduler deadline registered
[ 9.833717] io scheduler cfq registered (default)
[ 9.838748] octeon_gpio 1070000000800.gpio-controller: OCTEON GPIO
[ 9.986129] Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
[ 9.995114] 1180000000800.serial: ttyS0 at MMIO 0x1180000000800 (irq = 34) is a OCTEON
[ 10.002927] console [ttyS0] enabled, bootconsole disabled
[ 10.002927] console [ttyS0] enabled, bootconsole disabled
[ 10.029057] 1180000000c00.serial: ttyS1 at MMIO 0x1180000000c00 (irq = 35) is a OCTEON
[ 10.052274] octeon_rng octeon_rng: Octeon Random Number Generator
[ 10.073860] brd: module loaded
[ 10.099110] loop: module loaded
[ 10.122646] libphy: mdio-octeon: probed
[ 10.161510] mdio-octeon 1180000001800.mdio: Version 1.0
[ 10.181251] libphy: mdio-octeon: probed
[ 10.219822] mdio-octeon 1180000001900.mdio: Version 1.0
[ 10.239512] tun: Universal TUN/TAP device driver, 1.6
[ 10.258707] tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
[ 10.279397] octeon-ethernet 2.0
[ 10.302134] Interface 1 has 4 ports (SGMII)
[ 10.320602] Interface 2 has 4 ports (NPI)
[ 10.338754] Interface 3 has 4 ports (LOOP)
[ 10.379608] NOHZ: local_softirq_pending 08
[ 10.397909] ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
[ 10.418708] ehci_octeon_drv_probe: usb clocks are disabled
[ 10.438576] ehci-pci: EHCI PCI platform driver
[ 10.457424] ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
[ 10.477878] ohci_octeon_drv_probe: usb clocks are disabled
[ 10.498287] usbcore: registered new interface driver usb-storage
[ 10.518948] i2c /dev entries driver
[ 10.537659] i2c-octeon 1180000001000.i2c: version 2.5
[ 10.567175] rtc-pcf8563 0-0051: read ret=2, buf[0]=0
[ 10.586294] rtc-pcf8563 0-0051: chip found, driver version 0.4.3
[ 10.607510] rtc-pcf8563 0-0051: rtc core: registered rtc-pcf8563 as rtc0
[ 10.628488] rtc-pcf8563 0-0051: write ret=2
[ 10.646815] rtc-pcf8563 0-0051: cleared boot status byte
[ 10.676573] rtc-ds1307: probe of 0-0068 failed with error -5
[ 10.697294] EDAC DEVICE0: Giving out device to module 'octeon-cpu' controller 'cache': DEV 'octeon_pc_edac' (INTERRUPT)
[ 10.722643] EDAC DEVICE1: Giving out device to module 'octeon-l2c' controller 'octeon_l2c_err': DEV 'octeon_l2c_edac' (POLLED)
[ 10.748520] octeon_lmc_edac octeon_lmc_edac.0: Disabled (ECC not enabled)
[ 10.793878] Mirror/redirect action on
[ 10.811691] u32 classifier
[ 10.828528] Actions configured
[ 10.846055] Netfilter messages via NETLINK v0.30.
[ 10.864982] nf_conntrack version 0.5.0 (7668 buckets, 30672 max)
[ 10.886490] ctnetlink v0.93: registering with nfnetlink.
[ 10.906171] xt_time: kernel timezone is -0000
[ 10.924939] gre: GRE over IPv4 demultiplexor driver
[ 10.943945] ip_gre: GRE over IPv4 tunneling driver
[ 10.966381] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 10.986209] TCP: cubic registered
[ 11.006274] NET: Registered protocol family 10
[ 11.029478] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 11.049614] sit: IPv6 over IPv4 tunneling driver
[ 11.070063] NET: Registered protocol family 17
[ 11.088857] 8021q: 802.1Q VLAN Support v1.8
[ 11.107279] Key type dns_resolver registered
[ 11.125955] Skipping L2 locking due to reduced L2 cache size
[ 11.145890] Bootbus flash: Setting flash for 8MB flash at 0x1f400000
[ 12.493591] phys_mapped_flash: Found 1 x16 devices at 0x0 in 16-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0022c4
[ 12.518290] Amd/Fujitsu Extended Query Table at 0x0040
[ 12.537773] Amd/Fujitsu Extended Query version 1.0.
[ 12.556967] phys_mapped_flash: JEDEC Device ID is 0x22C4. Assuming broken CFI table.
[ 12.578838] phys_mapped_flash: Swapping erase regions for top-boot CFI table.
[ 12.600102] number of CFI chips: 1
[ 12.621047] console [netcon0] enabled
[ 12.638850] netconsole: network logging started
[ 12.657527] netpoll: xircon: device eth0 not up yet, forcing it
[ 12.677983] eth0: phy link=1
[ 12.730620] eth0: 100 Mbps Full duplex, port 16
[ 12.749927] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 12.769932] Warning: PCSX_INTX_REG(0,1)[DBG_SYNC]
[ 12.788861] hey! The gig1 ethernet phy has been reset because phy error interrupts were detected (1).
[ 12.812222] Warning: PCSX_INTX_REG(0,1)[RXLOCK]
[ 12.830909] Warning: PCSX_INTX_REG(0,1)[DBG_SYNC]
[ 13.678828] libphy: eth0 setting need_reset
[ 13.732288] eth0: Link down
[ 14.770821] netpoll: xircon: timeout waiting for carrier
[ 14.790366] netpoll: xircon1: device eth1 not up yet, forcing it
[ 14.810913] eth1: phy link=0
[ 14.828707] IPv6: ADDRCONF(NETDEV_UP): eth1: link is not ready
[ 15.810819] libphy: eth1 setting need_reset
[ 16.848820] netpoll: xircon1: timeout waiting for carrier
[ 16.868358] netpoll: xircon1: local port 22612
[ 16.886929] netpoll: xircon1: local IPv4 address 10.0.2.1
[ 16.906444] netpoll: xircon1: interface 'eth1'
[ 16.925002] netpoll: xircon1: remote port 22612
[ 16.943647] netpoll: xircon1: remote IPv4 address 224.0.0.120
[ 16.963509] netpoll: xircon1: remote ethernet address 01:00:5e:00:00:78
[ 16.984237] netpoll: xircon: local port 22612
[ 17.002709] netpoll: xircon: local IPv4 address 10.0.2.1
[ 17.022135] netpoll: xircon: interface 'eth0'
[ 17.040608] netpoll: xircon: remote port 22612
[ 17.059176] netpoll: xircon: remote IPv4 address 224.0.0.120
[ 17.078956] netpoll: xircon: remote ethernet address 01:00:5e:00:00:78
[ 17.599545] rtc-pcf8563 0-0051: setting system clock to 2020-12-09 01:13:28 UTC (1607476408)
[ 17.623516] Freeing unused kernel memory: 328K (ffffffff8094e000 - ffffffff809a0000)
I've also copied the firmware file 'XS-8.5.8-7708.bin' from the device. Let me know if anybody wants a copy and I can upload it somewhere.
Samsung KLM4G1YE4C which is an emmc chip apparently:
https://datasheetspdf.com/pdf-file/913815/Samsung/KLM4G1YE4C-B001/1
Macronix mx 29lv160dtt:
https://www.digikey.co.uk/en/products/detail/macronix/MX29LV160DTTI-70G/2744816
chipset of the WiFi cards is QCA9882, i can also make a photo if needed
RAM is Nanya NT5CC256M16CP
is the right chip, you can see on the photos now
Thanks for sharing. Unfortunately, he 64M RAM are a real limit for dual ath10k, as @mk24 already pointed out. Apart from that, it looks doable. I assume that U-Boot is in the SPI flash, it then loads the OS from the eMMC.
EDIT: The cards could be swapped, but I don't know if usable cards exist!? So it would probably make sense to do a port.
@andyboeh Are you sure that its only 64MB of RAM? I am not an OpenWRT developer but the datasheets i found said at least 1GB each chip. --> https://www.kynix.com/Detail/1179260/NT5CC256M16DP-DI.html
Those sizes are usually given in gigaBITs, not gigaBYTEs, 1GBit would however mean 128MB.
If its an Xirrus 620 as it seems then it has at least 512MB or according to this sheet 1GB
--> https://infolink-usa.com/joomla3/images/Xirrus_Cutsheets/XR620_ds.pdf
512MB:
--> https://www.scalablewifi.com/XR-620.asp
The processor is a Cavium CN6020 so it has probably 1GB RAM?
I found another source https://fccid.io/SK6-XR620/User-Manual/User-manual-1-2415511
Look at the "Internal Photos.pdf" in "Related documents" thats should be exactly the model i want to donate.
You are right, sorry for the confusion.
I mistakenly took the 256M for 256MBit per chip which would have been 32MBytes per IC. However, it's 256MBit in 16banks, so it's 512MBytes per chip. I added a note to my previous post to make it clear from the beginning.
