Juniper Mist AP33-WW

Hello,

Juniper tries to push their wireless brand "Mist" into market and offer a free AP if you take part in an online demo called "Wireless Wednesday". Quite similar what Meraki has done or is still doing.
Out of curiosity I took part and got one of their AP33-WW Access Points. (Not sure if the "WW" stands for "Wireless Wednesday".)
It feels like pretty solid Wifi-6 hardware and the antenna array is quite impressive.

Before connecting it to the cloud I wanted to check if I get console access, and succeded quite quickly via UART connector.
Unfortunately they use some challenge/response to get full console access, but it is possible to get in a preboot environment if you hit Ctrl-C at the right time.

Does anyone else got a Mist AP, too? May this be a good candidate for OpenWRT?

tiac

----
BTRM
V1.3
MEM?
MEMP
CACH
CODE
ZBSS
MAIN
OTP?
OTPP
USBT
NAND
IMG?
IMGL
UHD?
UHDP
RLO?
RLOP
UBI?
UBIP
PASS
HELO
CPU0
L1CD
MMUI
ZBBS
MAIN
5.0207HNDpre9-1.0.38-163.196
Boot Strap Register:  0x7fffff42
Applying trim code 0x1 reg 0x4 from otp to LDO controller...
NVRAM memcfg 0x121530
No valid MCB found for memcfg 0x121530, use safe mode setting
DDR init safe mode
MCB chksum 0xa41d9a22, config 0x120530
DDR4-2133 CL15 total 1024MB 1 16bits part[s] High Temperature ASR

DDR test done successfully
mist_magic:APLX
boot: w1i2c2gg > w1i2c1gg
watchdog enabled
loading uboot2 698352 bytes csum good (c1530b76)


U-Boot 2018.01 (May 28 2020 - 05:56:54 +0000)

I2C:   ready
DRAM:  1 GiB
00000000
HS_UART: ready
NAND:  BCH-4 256 MiB
In:    serial
Out:   serial
Err:   serial
Take PMC out of reset
waiting for PMC finish booting
PMC rev: 3.0.8.216831 running
pmc_init:PMC using DQM mode
atmega uptime: 7488 ticks (cold boot)
atmega: upgrade not needed
Net:   Initalizing switch low level hardware.
sf2_rreg: mdio timeout!
Software Resetting Switch (Id=0) ... sf2_rreg: mdio timeout!
sf2_wreg: mdio timeout!
sf2_rreg: mdio timeout!
Done.
Done
Broadcom BCM 47622 Ethernet driver 0.1
getrcal for res select 5, int 657, ext 608, ratio 118 ratio1 168, rcal 10
Setting SGMII Calibration value to 0xa
    PLL_PON(8051): 0x0290; TX_PON(8067): 0x0050; RX_PON(80b2): 0x0a80

Detecting PHYs...
54991EL  B0 3590:5089 --> 0x1e

Loading firmware into detected PHYs...
decompressed firmware 165526 -> 294708 bytes
Halt the PHYs processors operation
Upload the firmware into the on-chip memory: OK
Reset the processors to start execution of the code in the on-chip memory
Verify that the processors are running: OK
Verify that the firmware has been loaded with good CRC: OK
Firmware loading completed successfully

bcm47622_eth-0
MAC: d4:20:b0:xx:xx:xx

Press Ctrl-C within 2 seconds to stop autoboot.
boot config w1i2c1gg -ubi0: attaching mtd1
MG link 1G
ubi0: scanning is finished
ubi0: attached mtd1 (name "mtd=4", size 248 MiB)
ubi0: PEB size: 131072 bytes (128 KiB), LEB size: 126976 bytes
ubi0: min./max. I/O unit sizes: 2048/2048, sub-page size 2048
ubi0: VID header offset: 2048 (aligned 2048), data offset: 4096
ubi0: good PEBs: 1987, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 3, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 0
ubi0: available PEBs: 0, total reserved PEBs: 1987, PEBs reserved for bad PEB handling: 40
Loading file '/boot/mist-aplx.dtb' to addr 0x02800000...
Done
Loading file '/boot/uImage' to addr 0x00ffffc0...
Done
## Booting kernel from Legacy Image at 00ffffc0 ...
   Image Name:   Linux-4.4.113
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2750832 Bytes = 2.6 MiB
   Load Address: c0018000
   Entry Point:  01000000
   Verifying Checksum ... OK
## Flattened Device Tree blob at 02800000
   Booting using the fdt blob at 0x2800000
   Loading Kernel Image ... OK
   reserving fdt memory region: addr=0 size=8000
   reserving fdt memory region: addr=4000000 size=100000
   Using Device Tree in place at 02800000, end 02804e90

Starting kernel ...

** Shuting down ethernet before jumping to linux **
[    0.428944] nand: Could not find valid ONFI parameter page; aborting
Starting logging: OK
Firmware version :  apfw-0.9.20739-master-164f
Built at :  2020-05-28_05:57:45_UTC
Starting watchdog: OK
Initializing random number generator... done.
Starting rngd: OK
Starting system message bus: Failed to start message bus: Could not get UID and GID for username "dbus"
done
Starting mist_pm: Setting up PM IN GPIOs: Setting up PM Out GPIOs: 100+0 records in
100+0 records out
Starting network: OK
Starting ntpd: OK
Starting NVRAM:info: Use Good NVRAM from /rw

Reading NVRAM from /rw/etc/mist/nvram/.kernel_nvram.setting
OK
Starting wl: OK
Starting wxlan: OK
Non FIPS AP
Starting ep-control: OK
Starting pace: OK
Starting bleBeacon... BackgroundedAP33-WW

Welcome to Mist APLx
mist_aplx login: BLE hci: Attaching Primary controller to /dev/ttyH0
BLE hci: Switched line discipline from 0 to 15
BLE hci: Device index 0 attached
1970/01/01 00:00:49 Trouble connecting to cloud: code 0x03 no IP address, no IP address on vlan1
1970/01/01 00:00:49 called from connector/connector.go:1787
Error log for /usr/sbin/ep-control created in /rw/var/log/errors/ep-control.report.last

256 MB NAND flash and 1 GB RAM sound good, the Broadcom SOC and (likely) according Broadcom wireless less so.

Broadcom and uboot - haven't seen that around here...