New device - Extreme Networks AP3805i - support for OpenWrt possible?

saxy · July 17, 2020, 7:09am

i downloaded stock firmware of eap1200h and ews350ap
there are two files in that package "*uImage-lzma.bin" and "*root.squashfs"
I only can boot the uImage-lzma.bin - it ends with kernel panic because of the rootfs
the "*root.squashfs" is not bootable because of the "Bad Magic Number" error that I don't understand

I don't understand, where is the failsafe partition? in the stock firmware file of eap1200h or ews350ap?
what are the commands in uboot to do that?

Boot (PRI)-> tftp 0x89000000 openwrt-ar71xx-generic-ews350ap-root.squashfs
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'openwrt-ar71xx-generic-ews350ap-root.squashfs'.
Load address: 0x89000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #############################################################
done
Bytes transferred = 9961472 (980000 hex)
Boot (PRI)-> bootm
## Booting image at 89000000 ...
Bad Magic Number
Boot (PRI)->


Boot (PRI)-> 
Boot (PRI)-> tftp 0x89000000 openwrt-ar71xx-generic-ews350ap-uImage-lzma.bin
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'openwrt-ar71xx-generic-ews350ap-uImage-lzma.bin'.
Load address: 0x89000000
Loading: *#################################################################
e[8C #################################################################
e[8C #################################################################
e[8C ##########
done
Bytes transferred = 1048576 (100000 hex)
Boot (PRI)-> bootm
## Booting image at 89000000 ...
   Image Name:   MIPS OpenWrt Linux-3.3.8
   Created:      2018-09-19   8:39:59 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1047115 Bytes = 1022.6 kB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 3.3.8 (root@marine-ubuntu1604) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Wed Sep 19 16:38:59 CST 2018
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9558 rev 0
[    0.000000] Clocks: CPU:720.000MHz, DDR:600.000MHz, AHB:200.000MHz, Ref:40.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00008000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00008000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line:  board=EWS350AP console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot),64k(u-boot-env),320k(custom),1536k(kernel),11584k(rootfs),2560k(failsafe),64k(ART),13120k@0xa0000(firmware) rootfstype=squashfs,yaffs,jffs2 noinitrd
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 126272k/131072k available (2233k kernel code, 4800k reserved, 589k data, 212k init, 0k highmem)
[    0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[    0.060000] pid_max: default: 32768 minimum: 301
[    0.060000] Mount-cache hash table entries: 512
[    0.070000] Initialized recycle list for cpu 0.
[    0.070000] NET: Registered protocol family 16
[    0.080000] gpiochip_add: registered GPIOs 0 to 23 on device: ath79
[    0.080000] MIPS: machine is Senao EWS350AP
[    0.090000] registering PCI controller with io_map_base unset
[    0.090000] ar724x-pci ar724x-pci.1: PCIe link is down
[    0.100000] registering PCI controller with io_map_base unset
[    0.310000] bio: create slab <bio-0> at 0
[    0.310000] PCI host bridge to bus 0000:00
[    0.320000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.320000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.330000] pci 0000:00:00.0: invalid calibration data
[    0.330000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    0.340000] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
[    0.340000] PCI host bridge to bus 0000:01
[    0.350000] pci_bus 0000:01: root bus resource [mem 0x12000000-0x13ffffff]
[    0.350000] pci_bus 0000:01: root bus resource [io  0x0001]
[    0.360000] pci 0000:00:00.0: using irq 40 for pin 1
[    0.360000] Switching to clocksource MIPS
[    0.370000] NET: Registered protocol family 2
[    0.370000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.370000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.380000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.380000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.390000] TCP reno registered
[    0.390000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.400000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.400000] NET: Registered protocol family 1
[    0.420000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.420000] JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.430000] msgmni has been set to 246
[    0.440000] io scheduler noop registered
[    0.440000] io scheduler deadline registered (default)
[    0.450000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.470000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.480000] console [ttyS0] enabled, bootconsole disabled
[    0.480000] console [ttyS0] enabled, bootconsole disabled
[    0.490000] m25p80 spi0.0: found s25fl512s, expected m25p80
[    0.500000] m25p80 spi0.0: s25fl512s (65536 Kbytes)
[    0.500000] 8 cmdlinepart partitions found on MTD device spi0.0
[    0.510000] Creating 8 MTD partitions on "spi0.0":
[    0.520000] 0x000000000000-0x000000040000 : "u-boot"
[    0.520000] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.530000] 0x000000050000-0x0000000a0000 : "custom"
[    0.530000] mtd: partition "custom" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.550000] 0x0000000a0000-0x000000220000 : "kernel"
[    0.550000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.570000] 0x000000220000-0x000000d70000 : "rootfs"
[    0.570000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.590000] mtd: partition "rootfs" set to be root filesystem
[    0.590000] split_squashfs: no squashfs found in "spi0.0"
[    0.600000] 0x000000d70000-0x000000ff0000 : "failsafe"
[    0.600000] mtd: partition "failsafe" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.620000] 0x000000ff0000-0x000001000000 : "ART"
[    0.620000] 0x0000000a0000-0x000000d70000 : "firmware"
[    0.630000] mtd: partition "firmware" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.640000] /proc/Lan_Led created
[    0.660000] ag71xx_mdio: probed
[    0.660000] eth0: Atheros AG71xx at 0xb9000000, irq 4
[    1.220000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.0:05 [uid=004dd072, driver=Generic PHY]
[    1.230000] GACT probability on
[    1.230000] Mirror/redirect action on
[    1.230000] u32 classifier
[    1.240000]     Performance counters on
[    1.240000]     input device check on
[    1.250000]     Actions configured
[    1.250000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.250000] TCP bic registered
[    1.260000] TCP cubic registered
[    1.260000] TCP westwood registered
[    1.260000] TCP highspeed registered
[    1.270000] TCP hybla registered
[    1.270000] TCP htcp registered
[    1.270000] TCP vegas registered
[    1.280000] TCP veno registered
[    1.280000] TCP scalable registered
[    1.280000] TCP lp registered
[    1.290000] TCP yeah registered
[    1.290000] TCP illinois registered
[    1.290000] NET: Registered protocol family 17
[    1.300000] Bridge firewalling registered
[    1.300000] 8021q: 802.1Q VLAN Support v1.8
[    1.310000] VFS: Cannot open root device "(null)" or unknown-block(31,4)
[    1.320000] Please append a correct "root=" boot option; here are the available partitions:
[    1.320000] 1f00             256 mtdblock0  (driver?)
[    1.330000] 1f01              64 mtdblock1  (driver?)
[    1.330000] 1f02             320 mtdblock2  (driver?)
[    1.340000] 1f03            1536 mtdblock3  (driver?)
[    1.340000] 1f04           11584 mtdblock4  (driver?)
[    1.350000] 1f05            2560 mtdblock5  (driver?)
[    1.350000] 1f06              64 mtdblock6  (driver?)
[    1.360000] 1f07           13120 mtdblock7  (driver?)
[    1.360000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)

Boot (PRI)-> bootm     tftp 0x89000000 openwrt-ar71xx-generic-eap1200h-root.squashfs                                             openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename 'openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin'.
Load address: 0x89000000
Loading: *#################################################################
e[8C #################################################################
e[8C #################################################################
e[8C ##########
done
Bytes transferred = 1048576 (100000 hex)
Boot (PRI)-> tftp 0x89000000 openwrt-ar71xx-generic-eap1200h-uImage-lzma.bin                                                               bootm
## Booting image at 89000000 ...
   Image Name:   MIPS OpenWrt Linux-3.3.8
   Created:      2018-07-16   9:40:27 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1047504 Bytes = 1023 kB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

[    0.000000] Linux version 3.3.8 (root@Derek.Linux) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #1 Mon Jul 16 17:38:45 CST 2018
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019750 (MIPS 74Kc)
[    0.000000] SoC: Qualcomm Atheros QCA9558 rev 0
[    0.000000] Clocks: CPU:720.000MHz, DDR:600.000MHz, AHB:200.000MHz, Ref:40.000MHz
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00008000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00008000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 32512
[    0.000000] Kernel command line:  board=EAP1200H console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot),64k(u-boot-env),320k(custom),1536k(kernel),11584k(rootfs),2560k(failsafe),64k(ART),13120k@0xa0000(firmware) rootfstype=squashfs,yaffs,jffs2 noinitrd
[    0.000000] PID hash table entries: 512 (order: -1, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 126272k/131072k available (2232k kernel code, 4800k reserved, 589k data, 212k init, 0k highmem)
[    0.000000] SLUB: Genslabs=9, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:51
[    0.000000] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[    0.060000] pid_max: default: 32768 minimum: 301
[    0.060000] Mount-cache hash table entries: 512
[    0.070000] Initialized recycle list for cpu 0.
[    0.070000] NET: Registered protocol family 16
[    0.080000] gpiochip_add: registered GPIOs 0 to 23 on device: ath79
[    0.080000] MIPS: machine is Senao EAP1200H
[    0.090000] registering PCI controller with io_map_base unset
[    0.090000] ar724x-pci ar724x-pci.1: PCIe link is down
[    0.100000] registering PCI controller with io_map_base unset
[    0.310000] bio: create slab <bio-0> at 0
[    0.310000] PCI host bridge to bus 0000:00
[    0.320000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.320000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.330000] pci 0000:00:00.0: invalid calibration data
[    0.330000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    0.340000] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
[    0.340000] PCI host bridge to bus 0000:01
[    0.350000] pci_bus 0000:01: root bus resource [mem 0x12000000-0x13ffffff]
[    0.350000] pci_bus 0000:01: root bus resource [io  0x0001]
[    0.360000] pci 0000:00:00.0: using irq 40 for pin 1
[    0.360000] Switching to clocksource MIPS
[    0.370000] NET: Registered protocol family 2
[    0.370000] IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.370000] TCP established hash table entries: 4096 (order: 3, 32768 bytes)
[    0.380000] TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
[    0.380000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.390000] TCP reno registered
[    0.390000] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.400000] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.400000] NET: Registered protocol family 1
[    0.420000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.420000] JFFS2 version 2.2 (NAND) (SUMMARY) (ZLIB) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.430000] msgmni has been set to 246
[    0.440000] io scheduler noop registered
[    0.440000] io scheduler deadline registered (default)
[    0.450000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.470000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.480000] console [ttyS0] enabled, bootconsole disabled
[    0.480000] console [ttyS0] enabled, bootconsole disabled
[    0.490000] m25p80 spi0.0: found s25fl512s, expected m25p80
[    0.500000] m25p80 spi0.0: s25fl512s (65536 Kbytes)
[    0.500000] 8 cmdlinepart partitions found on MTD device spi0.0
[    0.510000] Creating 8 MTD partitions on "spi0.0":
[    0.520000] 0x000000000000-0x000000040000 : "u-boot"
[    0.520000] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.530000] 0x000000050000-0x0000000a0000 : "custom"
[    0.530000] mtd: partition "custom" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.550000] 0x0000000a0000-0x000000220000 : "kernel"
[    0.550000] mtd: partition "kernel" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.570000] 0x000000220000-0x000000d70000 : "rootfs"
[    0.570000] mtd: partition "rootfs" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.590000] mtd: partition "rootfs" set to be root filesystem
[    0.590000] split_squashfs: no squashfs found in "spi0.0"
[    0.600000] 0x000000d70000-0x000000ff0000 : "failsafe"
[    0.600000] mtd: partition "failsafe" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.620000] 0x000000ff0000-0x000001000000 : "ART"
[    0.620000] 0x0000000a0000-0x000000d70000 : "firmware"
[    0.630000] mtd: partition "firmware" must either start or end on erase block boundary or be smaller than an erase block -- forcing read-only
[    0.650000] /proc/Lan_Led created
[    0.660000] ag71xx_mdio: probed
[    0.660000] eth0: Atheros AG71xx at 0xb9000000, irq 4
[    1.220000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.0:05 [uid=004dd072, driver=Generic PHY]
[    1.230000] GACT probability on
[    1.230000] Mirror/redirect action on
[    1.240000] u32 classifier
[    1.240000]     Performance counters on
[    1.240000]     input device check on
[    1.250000]     Actions configured
[    1.250000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.250000] TCP bic registered
[    1.260000] TCP cubic registered
[    1.260000] TCP westwood registered
[    1.260000] TCP highspeed registered
[    1.270000] TCP hybla registered
[    1.270000] TCP htcp registered
[    1.270000] TCP vegas registered
[    1.280000] TCP veno registered
[    1.280000] TCP scalable registered
[    1.280000] TCP lp registered
[    1.290000] TCP yeah registered
[    1.290000] TCP illinois registered
[    1.290000] NET: Registered protocol family 17
[    1.300000] Bridge firewalling registered
[    1.300000] 8021q: 802.1Q VLAN Support v1.8
[    1.310000] VFS: Cannot open root device "(null)" or unknown-block(31,4)
[    1.320000] Please append a correct "root=" boot option; here are the available partitions:
[    1.320000] 1f00             256 mtdblock0  (driver?)
[    1.330000] 1f01              64 mtdblock1  (driver?)
[    1.330000] 1f02             320 mtdblock2  (driver?)
[    1.340000] 1f03            1536 mtdblock3  (driver?)
[    1.340000] 1f04           11584 mtdblock4  (driver?)
[    1.350000] 1f05            2560 mtdblock5  (driver?)
[    1.350000] 1f06              64 mtdblock6  (driver?)
[    1.360000] 1f07           13120 mtdblock7  (driver?)
[    1.370000] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(31,4)

blinkstar88 · July 17, 2020, 6:33pm

the easy way to make it work is to convert your original firmware to eap1200h or ews350ap. The first you need to do is to backup your original art partition or do full backup. Full flash with dump from eap1200h or ews350 and restore your original art partition.

lucki1000 · September 21, 2020, 9:11am

@saxy did you get it working? I've also an AP3805i and want use OpenWrt.

saxy · September 23, 2020, 7:12am

not yet
but at the moment I have very little time for that.

but it seems we need someone that provides us a dump from eap1200h or ews350ap.
can anyone help with that?

what are the commands for "full backup"

saxy · October 2, 2020, 2:54pm

hy,
I think the problem with ap3805i board is that watchdog/autoreboot is triggered.
because openwrt ist bootet successfully, but then gets rebooted by watchdog.
how can this be turned off?

Boot (PRI)-> pri
bootargs=console=ttyS0,115200n81 mtdparts=ath-nor0:512K(BootBAK)ro,512K(BootPRI),256K(CFG1),256K(CFG2),256K(NVRAM4),256K(NVRAM3),256K(NVRAM2),256K(NVRAM1),16384K(PriImg),16384K(SecImg),29440K(FS); BOOT_KERNEL=primary BOOT_BOOTROM=unknown mem=261632K panic=30
bootcmd=run boot_flash
bootdelay=2
baudrate=115200
ipaddr=192.168.1.1
serverip=192.168.1.10
ethact=eth0
WATCHDOG_COUNT=0
WATCHDOG_LIMIT=3
BOOT_KERNEL=primary
BOOT_BOOTROM=unknown
SERVICETYPE=siemens
SERVICEATTRS=ac_manager,ru_manager
AC_HOSTNAME=Controller
VERSIONBASE=0
REGION=NA
NUM_ANTENNAS=4
CRYPTO_FLAG=3
menucmd=run boot_diag
mtdparts=mtdparts=ath-nor0:512K(BootBAK)ro,512K(BootPRI),256K(CFG1),256K(CFG2),256K(NVRAM4),256K(NVRAM3),256K(NVRAM2),256K(NVRAM1),16384K(PriImg),16384K(SecImg),29440K(FS);
static_bootargs=console=ttyS0,115200n81 mem=261632K panic=30 ro
boot_diag=if fsload 0x89000000 diag.gz.uImage; then if imi 0x89000000; then bootm 0x89000000; exit; fi; fi;echo ERROR: Problem with diag image, dropping to interactive shell
boot_ram=setenv bootargs "$mtdparts BOOT_BOOTROM=\""$ver"\"" BOOT_KERNEL=vmlinux.gz.uImage.3805 $static_bootargs; tftpboot 0x89000000 vmlinux.gz.uImage.3805; bootm 0x89000000
boot_flash=autoscr boot_kernel
DEFAULT_SETTING=0
CURR_VER=U-Boot 1.2.0.03 (Mar 28 2016 - 20:40:29)
MODEL=AP3805i
SERIAL#=1234567890123450
ethaddr=D8:84:66:11:22:33
RADIOADDR0=D8:84:66:11:22:33
RADIOADDR1=D8:84:66:11:22:33
HW_RELEASE=511
AP_FLAG=0
AP_MODE=0
MOSTRECENTKERNEL=1
stdin=serial
stdout=serial
stderr=serial
mem=261632k
PriImg=9f280000
SecImg=a0280000
ver=U-Boot 1.2.0.03 (Mar 28 2016 - 20:40:29)
filesize=39

Environment size: 1595/65531 bytes

Boot (PRI)-> tftp 0x89000000
dup 1 speed 1000
*** Warning: no boot file name; using '0101A8C0.img'
Using eth0 device
TFTP from server 192.168.1.10; our IP address is 192.168.1.1
Filename '0101A8C0.img'.
Load address: 0x89000000
Loading: *#################################################################
e[8C #################################################################
e[8C #################################################################
e[8C #################################################################
e[8C #################################################################
e[8C #################################################################
e[8C #################################################################
e[8C #################################################################
e[8C #################################################################
e[8C #################################################################
e[8C #################################################################
e[8C ###############################
done
Bytes transferred = 3817134 (3a3eae hex)
Boot (PRI)-> bootm
## Booting image at 89000000 ...
   Image Name:   MIPS OpenWrt Linux-4.14.180
   Created:      2020-05-16  18:32:20 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    3817070 Bytes =  3.6 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
 
Starting kernel ...
 
[    0.000000] Linux version 4.14.180 (builder@buildhost) (gcc version 7.5.0 (OpenWrt GCC 7.5.0 r11063-85e04e9f46)) #0 Sat May 16 18:32:20 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU0 revision is: 00019750 (MIPS 74Kc)
[    0.000000] MIPS: machine is OCEDO Koala
[    0.000000] SoC: Qualcomm Atheros QCA9558 ver 1 rev 0
[    0.000000] Determined physical RAM map:
[    0.000000]  memory: 10000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, cache aliases, linesize 32 bytes
[    0.000000] Zone ranges:
[    0.000000]   Normal   [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x000000000fffffff]
[    0.000000] random: get_random_bytes called from 0x804ff740 with crng_init=0
[    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 65024
[    0.000000] Kernel command line: console=ttyS0,115200n8 rootfstype=squashfs,jffs2
[    0.000000] PID hash table entries: 1024 (order: 0, 4096 bytes)
[    0.000000] Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
[    0.000000] Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 246340K/262144K available (4030K kernel code, 162K rwdata, 532K rodata, 8132K init, 212K bss, 15804K reserved, 0K cma-reserved)
[    0.000000] SLUB: HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS: 51
[    0.000000] CPU clock: 720.000 MHz
[    0.000000] clocksource: MIPS: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 5309056796 ns
[    0.000007] sched_clock: 32 bits at 360MHz, resolution 2ns, wraps every 5965232126ns
[    0.008295] Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[    0.074984] pid_max: default: 32768 minimum: 301
[    0.080065] Mount-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.087103] Mountpoint-cache hash table entries: 1024 (order: 0, 4096 bytes)
[    0.098076] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[    0.108576] futex hash table entries: 256 (order: -1, 3072 bytes)
[    0.115127] pinctrl core: initialized pinctrl subsystem
[    0.122559] NET: Registered protocol family 16
[    0.129782] PCI host bridge /ahb/pcie-controller@180c0000 ranges:
[    0.136311]  MEM 0x0000000010000000..0x0000000011ffffff
[    0.141868]   IO 0x0000000000000000..0x0000000000000000
[    0.160481] PCI host bridge to bus 0000:00
[    0.164849] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.172196] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.178124] pci_bus 0000:00: root bus resource [??? 0x00000000 flags 0x0]
[    0.185351] pci_bus 0000:00: No busn resource found for root bus, will use [bus 00-ff]
[    0.194196] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    0.202019] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
[    0.212052] clocksource: Switched to clocksource MIPS
[    0.218253] NET: Registered protocol family 2
[    0.223634] TCP established hash table entries: 2048 (order: 1, 8192 bytes)
[    0.231072] TCP bind hash table entries: 2048 (order: 1, 8192 bytes)
[    0.237894] TCP: Hash tables configured (established 2048 bind 2048)
[    0.244777] UDP hash table entries: 256 (order: 0, 4096 bytes)
[    0.251003] UDP-Lite hash table entries: 256 (order: 0, 4096 bytes)
[    0.257901] NET: Registered protocol family 1
[    0.399494] Crashlog allocated RAM at address 0x3f00000
[    0.406245] workingset: timestamp_bits=30 max_order=16 bucket_order=0
[    0.417176] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.423413] jffs2: version 2.2 (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) (c) 2001-2006 Red Hat, Inc.
[    0.489455] io scheduler noop registered
[    0.493662] io scheduler deadline registered (default)
[    0.500920] pinctrl-single 1804002c.pinmux: 544 pins at pa b804002c size 68
[    0.509226] Serial: 8250/16550 driver, 16 ports, IRQ sharing enabled
[    0.517932] console [ttyS0] disabled
[    0.521762] 18020000.uart: ttyS0 at MMIO 0x18020000 (irq = 9, base_baud = 2500000) is a 16550A
[    0.530975] console [ttyS0] enabled
[    0.530975] console [ttyS0] enabled
[    0.538399] bootconsole [early0] disabled
[    0.538399] bootconsole [early0] disabled
[    0.554056] m25p80 spi0.0: s25fl512s (65536 Kbytes)
[    0.559051] 7 fixed-partitions partitions found on MTD device spi0.0
[    0.565535] Creating 7 MTD partitions on "spi0.0":
[    0.570404] 0x000000000000-0x000000040000 : "u-boot"
[    0.576102] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.582141] 0x000000050000-0x000000790000 : "firmware"
[    0.593240] 0x000000790000-0x000000ed0000 : "vendor"
[    0.598901] 0x000000ed0000-0x000000fe0000 : "data"
[    0.604416] 0x000000fe0000-0x000000ff0000 : "id"
[    0.609717] 0x000000ff0000-0x000001000000 : "art"
[    0.616030] libphy: Fixed MDIO Bus: probed
[    0.630504] ag71xx 19000000.eth: invalid MAC address, using random address
[    0.973737] libphy: ag71xx_mdio: probed
[    1.092671] ag71xx 19000000.eth: connected to PHY at mdio-bus.0:05 [uid=004dd072, driver=Atheros 8035 ethernet]
[    1.103425] eth0: Atheros AG71xx at 0xb9000000, irq 4, mode: rgmii-rxid
[    1.112018] NET: Registered protocol family 10
[    1.120443] Segment Routing with IPv6
[    1.124288] NET: Registered protocol family 17
[    1.128829] bridge: filtering via arp/ip/ip6tables is no longer available by default. Update your scripts to load br_netfilter if you need this.
[    1.141984] 8021q: 802.1Q VLAN Support v1.8
[    1.147569] hctosys: unable to open rtc device (rtc0)
[    1.181851] Freeing unused kernel memory: 8132K
[    1.186471] This architecture does not have kernel memory protection.
[    1.205328] init: Console is alive
[    1.208953] init: - watchdog -
[    1.228484] kmodloader: loading kernel modules from /etc/modules-boot.d/*
[    1.237294] kmodloader: done loading kernel modules from /etc/modules-boot.d/*
[    1.245775] init: - preinit -
[    1.422935] random: jshn: uninitialized urandom read (4 bytes read)
[    1.499934] random: jshn: uninitialized urandom read (4 bytes read)
[    1.533104] random: jshn: uninitialized urandom read (4 bytes read)
[    1.693847] IPv6: ADDRCONF(NETDEV_UP): eth0: link is not ready
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
[    3.622052] random: fast init done
[    4.823605] procd: - early -
[    4.826611] procd: - watchdog -
[    5.390828] procd: - watchdog -
[    5.394296] procd: - ubus -
[    5.402674] urandom_read: 5 callbacks suppressed
[    5.402681] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.447413] random: ubusd: uninitialized urandom read (4 bytes read)
[    5.455121] procd: - init -
Please press Enter to activate this console.
[    5.837999] kmodloader: loading kernel modules from /etc/modules.d/*
[    5.866814] ip6_tables: (C) 2000-2006 Netfilter Core Team
[    5.887981] Loading modules backported from Linux version v4.19.120-0-gfdc072324f3c
[    5.895790] Backport generated by backports.git v4.19.120-1-0-g60c3a249
[    5.923964] ip_tables: (C) 2000-2006 Netfilter Core Team
[    5.946639] nf_conntrack version 0.5.0 (4096 buckets, 16384 max)
[    6.034315] xt_time: kernel timezone is -0000
[    6.126387] PPP generic driver version 2.4.2
[    6.142775] NET: Registered protocol family 24
[    6.200918] urngd: v1.0.2 started.
[    6.210578] ath: phy0: Unable to initialize hardware; initialization status: -5
[    6.218032] ath9k 18100000.wmac: failed to initialize device
[    6.223830] ath9k: probe of 18100000.wmac failed with error -5
[    6.262375] kmodloader: done loading kernel modules from /etc/modules.d/*
[    6.368535] random: crng init done
 
 
 
BusyBox v1.30.1 () built-in shell (ash)
 
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 19.07.3, r11063-85e04e9f46
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@(none):/# 
root@(none):/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# [   24.561375] eth0: link up (1000Mbps/Full duplex)
[   24.575655] br-lan: port 1(eth0) entered blocking state
[   24.580960] br-lan: port 1(eth0) entered disabled state
[   24.586539] device eth0 entered promiscuous mode
[   24.621308] br-lan: port 1(eth0) entered blocking state
[   24.626652] br-lan: port 1(eth0) entered forwarding state
[   24.632293] IPv6: ADDRCONF(NETDEV_UP): br-lan: link is not ready
[   25.632190] IPv6: ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
root@OpenWrt:/# 
 
U-Boot 1.2.0.03 (Mar 28 2016 - 20:40:29)
 
ap135 - Scorpion 1.0DRAM:  
sri
Scorpion 1.0
ath_ddr_initial_config(205): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x3, 0x1f)
Tap values = (0x11, 0x11, 0x11, 0x11)
256 MB
Flash Manuf Id 0x1, DeviceId0 0x2, DeviceId1 0x20
flash size 64MB, sector count = 256
Flash: 64 MB
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
ath_gmac_enet_initialize: reset mask:c02200 
Scorpion  ----> S17 PHY *
TEST: FINAL REG VAL after TX Calibration - 0x00000000
TEST: FINAL XMII VAL after RX Calibration - 0x00000000
TEST: FINAL ETH_CFG VAL after RX Calibration - 0x00000001
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7135
eth0: d8:84:66:4f:fd:dc
eth0 up
eth0
Setting 0x18116290 to 0x60c0214f
Hit 'd' for diagnostics, or any other key to stop autoboot:  2  1  0 
## Executing script at 8ff6e160
check for watchdog, limit=3...
check for reset by watchdog...
no watchdog...
bSaveEnviron=0 image_order=1 0
ready to boot kernel...
## Booting image at a0280000 ...
   Image Name:   10.41.08.0012
   Created:      2018-06-22   0:50:36 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    8532062 Bytes =  8.1 MB
   Load Address: 80002000
   Entry Point:  801d3430
   Verifying Checksum ... OK
   Uncompressing Kernel Image ... OK
 
Starting kernel ...

Dragets · December 19, 2020, 2:36pm

I've just started working on this device this week, i got a few of them from a friend since they are basicly worthless (with stock fw) when you migrate from Extreme Networks controller to something else. I read this thread and throught i'd give it a try.

With a serial connection it is possible to access the U-boot console as pointed out earlier, as well as the stock Busybox terminal. From there you can do 'chdir /" to get to the root folder and inspect the filesystem. Then i dumped all my MTD-partitions to have a look and reverse some stuff.
I've got just some basic knowledge in this stuff and pretty much learn as i go.

I've tried to match the MTD-structure in a new DTS-file as well as copy some matching boards LED GPIO configs.
I'm slowly doing progress as i learn more.

@saxy have you addressed the watchdog-reboot problem?

From what i can gather and from the logs i get, is that if you have a faulty MTD-setup, and from what you can see in your boot-logs is that the "firmware" partition is not split and no root, rootfs or rootfs_data partitions made. That makes the watchdog-handover to ubus at around 10sec into the boot to fail. (The logs show correct and working watchdog triggers until that.
Thats what i work on right now in my dts-file. I'll do some further testing later this weekend and see what i can do. But it's sure doable since all the onboard chips are well supported and represented.

saxy · December 21, 2020, 7:30am

that sounds like you have a plan, because I don't
I am an openwrt enduser. I nerver made support for a new device.
If I can assist in anyway by testing. please let me know.

I never touched flash on my device, I thought an image with INITRAMFS can run without flash partitions. Is that correct?

Dragets · December 21, 2020, 9:56am

As i understand it, the Initramfs-images available is kernel only and used to mount the flash rootfs. That's why it fails in the MTD-split? (Maybe a more experienced person can acc this?)

And from what i get, this board has the following stock MTD layout:

MTD0: U-boot-backup (BootBAK)
MTD1: U-boot (BootPRI)
MTD2: U-boot environments 1 (CFG1)
MTD3: U-boot environments 2 (CFG2)
MTD4-7: Nvram partitions, these i dont understand. I know there are ports of devices with quite similar partitions (Siemens AP3610i, Enterasys WS-AP3705i) and if someone with the knowledge could point out the use of these? In my MTD-dumps all they contain is some logs.
MTD8: Kernel partition (PriImg)
MTD9: Kernel backup (SecImg)
MTD10: Filesystem? Rootfs? MTD-Dump is giving me around 11 JFFS2, almost equal, partitions. One of them contains a private key i DER-format if that tells someone something? This is mounted and readable as early as in the U-Boot terminal. If you type 'ls' in U-Boot, the contains of one of these partitions is showing up. (FS)

If i'm to guess, i think the Enterasys AP3705i-port is the key to this one as well. They share the same OEM-firmware. If you read some of the scripts in this device you can see that it defines and change some stuff depending on if its a ap3805i or ap3705i.
So partition wise-> Look at 3705.

saxy · December 28, 2020, 1:54pm

This will create an image with kernel + initramfs, that will have initramfs in the name. The resulting image can be loaded in the device through the bootloader's tftp function and should boot to a prompt without relying on flash/filesystem support.

maybe that private key has something todo with "cloud readyness" from the manufacturer

mpratt14 · February 10, 2021, 10:16pm

Hi,

a pull request is open for adding support for this device

you are welcome to copy his branch and test an image yourself

read the commit message carefully as the flashing process is not common...

saxy · February 11, 2021, 7:28am

I know and I already build a working image. Works great so far.
What needs to be done so that it is in official OpenWRT tree?
can only @Dragets do it or can someone else do it - it was mostly his effort.

when 19.07.7 will be released, will it also be for that device?
or only with next stable release?

mpratt14 · February 11, 2021, 3:13pm

the pull request is already open

after it is reviewed and accepted, public images will be available in next major release 21.xx

backporting to 19.07 is possible, but someone has to do that work
and start a pull request for that after this one

saxy · February 22, 2021, 7:15am

hy,
I have seen that there will be a branch for 21.x soon.
why does it take so long for the PR to be reviewed/accepted?
Is there any way to speed this up?
the last message was, that it is only a formal issue

mpratt14 · February 22, 2021, 10:28pm

sometimes the devs are just busy, and don't want to add devices at the moment
offen times, many PRs for adding a board are merged at the same time in bulk

branching happened already, so a backport is required to bring it to the new stable branch
this is not a big deal since it is early, its possible that the devs will put it in both branches

lucki1000 · April 17, 2021, 5:10pm

@saxy I also own this device is there some build I can flash on this device?

saxy · July 2, 2021, 6:47am

hy
@mpratt14 @Dragets
any chance for official openwrt support for ap3805? the other senao devices where already added. why was this device ignored?

mpratt14 · July 2, 2021, 6:58am

main issue that is blocking AP3805i is no factory.bin (it has different software compared to Senao SDK)
and the first comment still says WIP (work in progress)

other than that, someone needs to start the conversation again at the pull request

at this point it is best to wait until release of 21.02 because it will have to be backported either way
they would not be so busy after release

saxy · March 28, 2022, 6:28pm

https://drive.google.com/file/d/1ePAX6CvSPFkW0wfaq4HRhEPVtaJ-kWxM/view?usp=sharing
AP3805
OpenWrt 21.02 with LUCI