Pakedge devices?

t4thfavor · May 21, 2023, 3:45pm

I’ve recently inherited a couple odd wired devices and accesspoints from a friend. They are “Pakedge” branded and consist of a dual wan router with 8 lan ports, an 8 port poe switch, and a wireless lan controller. I’m working towards getting cpu info on them, but everything inside is covered in heat sinks I don’t want to distrub until I can get console access. There is a console port, so I’ll mess with that in a little bit.

The router model is “RK-1” the switch is unmanaged so idk the mode, and the controller is “NK-1”, and the ap is wa-2200.

Anyone know if these are just rebranded “something else’s”? Or are they really custom devices which nobody has heard of before?

andyboeh · May 21, 2023, 8:37pm

According to this they are mostly Aheros-based, so the WA-2200 seems supportable (ipq4019). There is no info about the NK-1 and RK-1, though.

t4thfavor · May 21, 2023, 11:11pm

The router and the controller both seem to be running the cavium octeon cn7020-aap at 1.2ghz, and some Linux build with kernel 3.10.87. It’s definitely running Linux already and shows full console boot log when booting.

andyboeh · May 22, 2023, 5:15am

Oh...

I'm trying to get an Avaya (Xirrus) AP with the very same chipset up and running for half a year now, but I'm experiencing problems with the PCIe driver, preventing WiFi from working. That might not be an issue on a router/controller without WiFi.

Booting an initramfs build was straight forward and went without bigger issues.

t4thfavor · May 22, 2023, 10:48am

With my available time, and the rarity of this hardware it might as well be e-waste I guess.

tmn505 · May 24, 2023, 2:22pm

I could help You port the WA-2200 access point, since I did support for WR-1. It has similar SoC and probably recovery procedure, but we'll need serial console attached to it, to see what's going on booting. UART is probably exposed here:
Screenshot_20230524_161548
You'll need an UART adapter to access it, something like this https://www.amazon.com/dp/B00LODGRV8. Cheaper ones can also be found.

t4thfavor · May 24, 2023, 2:56pm

I have a UART console somewhere from my other endeavors. Honestly I was hoping I could get openwrt running on the wired boxes more than the AP's, but they do seem like decent devices, maybe I can get some time to mess with the console soon. The wired boxes expose the bootloader directly on the console port, but they have some obscure Octeon processor which might be hard to get working.

I might have even left them alone if the controller that came with them wasn't just a cloud managed "controller hub", it's a shame such nice hardware turns into ewaste so easily.

What do you need from the UARTl ? I'll see if I can mess with it later tonight or some day this week.

tmn505 · May 24, 2023, 7:04pm

The most important information is if the access to bootloader is locked by password. If it's locked then does it have recovery option? On WR-1 (https://git.openwrt.org/80baffd2aa91) there's recovery option using USB stick. Here we have no USB port but on WR-1, when recovery was triggered, also ethernet ports were probed and TFTP was checked for an image. I would assume here's similar situation. So question what happens when reset/recovery button is pressed and power applied? UART output should tell what's happening.

Regarding other devices, OpenWrt provides generic-initramfs-kernel.bin images for octeon. Try to download one (You may also try out images for older releases), setup TFTP server. The flow of commands is something like this:

dhcp
tftpboot $(loadaddr) <openwrt_image>
bootoctlinux $(loadaddr)

If Your environment does not provide DHCP server, setting static ip in environment will be necessary (I don't remember the name of variable).

t4thfavor · February 8, 2024, 3:59pm

Finally got back to this, took some good pictures and got a serial log. I still can't get it to accept my enter at the "Press Enter to activate this terminal" prompt.


iled, hub doesn't have any ports! (err -19)
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
jffs2 is ready
No jffs2 marker was found
switching to overlay
377+0 records in
377+0 records out
377+0 records in
377+0 records out
== boot_mode_sel 0 ==
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
[
   19.673591] qca-nss-drv.ko is loaded for symbol link
[   19.725381] RTNL: assertion failed at net/core/dev.c (1094)
[   19.780452] RTNL: assertion failed at net/core/dev.c (1586)
[   19.785473] RTNL: assertion failed at net/core/dev.c (4587)
[   19.795558] RTNL: assertion failed at net/core/rtnetlink.c (976)
[   19.801152] RTNL: assertion failed at net/core/dev.c (4587)
[   19.806650] RTNL: assertion failed at net/core/fib_rules.c (744)
[   19.813000] RTNL: assertion failed at net/wireless/wext-core.c (350)
[   19.818974] RTNL: assertion failed at net/ipv4/devinet.c (1348)
[   20.024322] nss is not enabled on this platform

Format: Log Type - Time(microsec) - Message - Optional Info
Log Type: B - Since Boot(Power On Reset),  D - Delta,  S - Statistic
S - QC_IMAGE_VERSION_STRING=BOOT.BF.3.1.1-00117
S - IMAGE_VARIANT_STRING=DAABANAZA
S - OEM_IMAGE_VERSION_STRING=CRM
S - Boot Config, 0x00000021
S - Reset status Config, 0x00000000
S - Core 0 Frequency, 0 MHz
B -       262 - PBL, Start
B -      1343 - bootable_media_detect_entry, Start
B -      1685 - bootable_media_detect_success, Start
B -      1699 - elf_loader_entry, Start
B -      5125 - auth_hash_seg_entry, Start
B -      7299 - auth_hash_seg_exit, Start
B -    587842 - elf_segs_hash_verify_entry, Start
B -    707276 - PBL, End
B -    707300 - SBL1, Start
B -    798180 - pm_device_init, Start
D -         7 - pm_device_init, Delta
B -    799719 - boot_flash_init, Start
D -     63361 - boot_flash_init, Delta
B -    867235 - boot_config_data_table_init, Start
D -      3873 - boot_config_data_table_init, Delta - (419 Bytes)
B -    874430 - clock_init, Start
D -      7574 - clock_init, Delta
B -    886507 - CDT version:2,Platform ID:8,Major ID:1,Minor ID:0,Subtype:0
B -    889921 - sbl1_ddr_set_params, Start
B -    895018 - cpr_init, Start
D -         2 - cpr_init, Delta
B -    899400 - Pre_DDR_clock_init, Start
D -         5 - Pre_DDR_clock_init, Delta
D -     13176 - sbl1_ddr_set_params, Delta
B -    913138 - pm_driver_init, Start
D -         2 - pm_driver_init, Delta
B -    983228 - sbl1_wait_for_ddr_training, Start
D -        28 - sbl1_wait_for_ddr_training, Delta
B -    998922 - Image Load, Start
D -    140772 - QSEE Image Loaded, Delta - (274048 Bytes)
B -   1140123 - Image Load, Start
D -      1439 - SEC Image Loaded, Delta - (2048 Bytes)
B -   1150531 - Image Load, Start
D -    188178 - APPSBL Image Loaded, Delta - (384203 Bytes)
B -   1339106 - QSEE Execution, Start
D -        60 - QSEE Execution, Delta
B -   1345321 - SBL1, End
D -    640098 - SBL1, Delta
S - Flash Throughput, 2000 KB/s  (660718 Bytes,  330220 us)
S - DDR Frequency, 537 MHz


U-Boot 2012.07 [Chaos Calmer 1.03.0.100127,unknown] (Dec 21 2018 - 14:40:44)

smem ram ptable found: ver: 1 len: 3
DRAM:  256 MiB
machid : 0x8010000
NAND:  SF: Detected W25Q256 with page size 64 KiB, total 32 MiB
ipq_spi: page_size: 0x100, sector_size: 0x10000, size: 0x2000000
32 MiB
In:    serial
Out:   serial
Err:   serial
machid: 8010000
flash_type: 0
Net:
WAP353: ethernet init GPIO change to 63
MAC0 addr:90:a7:c1:64:ff:ff
PHY ID1: 0x4d
PHY ID2: 0xd0b2
ipq40xx_ess_sw_init done
eth0
Warning: eth0 MAC addresses don't match:
Address in SROM is         90:a7:c1:64:ff:ff
Address in environment is  90:a7:c1:42:1e:84

Hit any key to stop autoboot:  0
SF: Detected W25Q256 with page size 64 KiB, total 32 MiB
## Booting kernel from FIT Image at 84000000 ...
   Using 'config@4' configuration
   Trying 'kernel@1' kernel subimage
     Description:  ARM OpenWrt Linux-3.14.77
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x840000e4
     Data Size:    3253720 Bytes = 3.1 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x80208000
     Entry Point:  0x80208000
     Hash algo:    crc32
     Hash value:   c9754d22
     Hash algo:    sha1
     Hash value:   80d3464a4e3649d26abf663e533d472727ccb2f8
   Verifying Hash Integrity ... crc32+ sha1+ OK
## Flattened Device Tree from FIT Image at 84000000
   Using 'config@4' configuration
   Trying 'fdt@4' FDT blob subimage
     Description:  ARM OpenWrt qcom-ipq40xx-ap.dkxx device tree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x84338630
     Data Size:    34548 Bytes = 33.7 KiB
     Architecture: ARM
     Hash algo:    crc32
     Hash value:   c69ad3e3
     Hash algo:    sha1
     Hash value:   f1650a59094987b33bf57aea00fac56464576af6
   Verifying Hash Integrity ... crc32+ sha1+ OK
   Booting using the fdt blob at 0x84338630
   Uncompressing Kernel Image ... OK
   Loading Device Tree to 86ff4000, end 86fff6f3 ... OK
eth0 ff:ff:ff:ff:ff:ff MAC Address from ART is not valid
eth1 ff:ff:ff:ff:ff:ff MAC Address from ART is not valid
Using machid 0x8010000 from environment

Starting kernel ...

[    0.163517] msm_bus_fabric_init_driver
[    0.163724] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus4096 ctx1
[    0.163798] msm_bus_device 580000.ad-hoc-bus: Failed to get bus clk for bus1024 ctx1
[    0.234286] sps: BAM device 0x07884000 is not registered yet.
[    0.251517] mtd:  "rootfs_data" partition size is larger than 0x400000, adjust size
[    0.287731] drivers/rtc/hctosys.c: unable to open rtc device (rtc0)
procd: Console is alive
procd: - watchdog -
[    7.568981] hub 4-0:1.0: config failed, hub doesn't have any ports! (err -19)
procd: - preinit -
Press the [f] key and hit [enter] to enter failsafe mode
Press the [1], [2], [3] or [4] key and hit [enter] to select the debug level
jffs2 is ready
No jffs2 marker was found
switching to overlay
377+0 records in
377+0 records out
377+0 records in
377+0 records out
== boot_mode_sel 0 ==
procd: - early -
procd: - watchdog -
procd: - ubus -
procd: - init -
Please press Enter to activate this console.
Please press Enter to activate this console.
[   21.371170] qca-nss-drv.ko is loaded for symbol link
[   21.422889] RTNL: assertion failed at net/core/dev.c (1094)
[   21.450305] RTNL: assertion failed at net/core/dev.c (1586)
[   21.455328] RTNL: assertion failed at net/core/dev.c (4587)
[   21.462822] RTNL: assertion failed at net/core/rtnetlink.c (976)
[   21.469111] RTNL: assertion failed at net/core/dev.c (4587)
[   21.474621] RTNL: assertion failed at net/core/fib_rules.c (744)
[   21.480098] RTNL: assertion failed at net/wireless/wext-core.c (350)
[   21.490488] RTNL: assertion failed at net/ipv4/devinet.c (1348)
[   21.689932] nss is not enabled on this platform
[   30.639487] nss is not enabled on this platform
[   32.904236] +HWT
[   32.914070] -HWT
[   32.972442] spectral_init_netlink 78 NULL SKB
[   32.995163] nss is not enabled on this platform
[   34.339231] +HWT
[   34.349055] -HWT
[   34.408445] spectral_init_netlink 78 NULL SKB
No Direct-Attach chipsets found.

The console was unpopulated, but I added some pins. The order seems to be from top(The one with the arrow being the top) down 3v, G, Txd, Rxd

t4thfavor · February 8, 2024, 4:04pm

t4thfavor · February 8, 2024, 5:17pm

The output from the WK-1 AP. It also will not stop when I press P or any other key. Either they disable the rxd pin or something is wrong with my environment (I've used it for other devices, just not recently). My FTDI a Waveshare USB to TTL adapter set to 3.3v (which I don't hook up the 3.3v line ever)


U-Boot 1.0.0-g44de5771-dirty (Jan 22 2015 - 14:59:10)

WP836-PK - Scorpion 1.0DRAM:
sri
Scorpion 1.0
ath_ddr_initial_config(200): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x3, 0x1c)
Tap values = (0xf, 0xf, 0xf, 0xf)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 210k for U-Boot at: 87fc8000
Reserving 192k for malloc() at: 87f98000
Reserving 44 Bytes for Board Info at: 87f97fd4
Reserving 36 Bytes for Global Data at: 87f97fb0
Reserving 128k for boot params() at: 87f77fb0
Stack Pointer at: 87f77f98
Now running in RAM - U-Boot at: 87fc8000
Flash Manuf Id 0xc2, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
flash size 16MB, sector count = 256
Flash: 32 MB
*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
Fetching MAC Address from 0x87feb12c
Fetching MAC Address from 0x87feb12c
ath_gmac_enet_initialize: reset mask:c02200
Scorpion  ----> S17 PHY *
Vlan config...
s17 phy0 register value 0x00004140
TEST: FINAL REG VAL after TX Calibration - 0x86000000
TEST: FINAL XMII VAL after RX Calibration - 0x96000000
TEST: FINAL ETH_CFG VAL after RX Calibration - 0x00000001
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7335
eth0: 90:a7:c1:1f:87:4e
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 90:a7:c1:1f:87:4f
eth1 up
eth0, eth1
Setting 0x18116290 to 0x50a0214f

Press 'p' to abort autoboot in 2 seconds

## Booting image at 9f050000 ...
   Image Name:   MIPS OpenWrt Linux-3.4.113
   Created:      2020-08-27  15:35:47 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    1103158 Bytes =  1.1 MB
   Load Address: 80060000
   Entry Point:  80060000
   Verifying Checksum at 0x9f050040 ...OK
   Uncompressing Kernel Image ... OK
No initrd
## Transferring control to Linux (at address 80060000) ...
## Giving linux memsize in bytes, 134217728

Starting kernel ...

[    0.000000] Linux version 3.4.113 (pakdev@jenkins) () #1 Thu Aug 27 17:24:58 CEST 2020
[    0.000000] bootconsole [early0] enabled
[    0.000000] CPU revision is: 00019750 (MIPS 74Kc)
[    0.000000] setup: ath79 SoC is QCA9558 rev 0x0
[    0.000000] setup: SoC: Qualcomm Atheros QCA9558 rev 0
[    0.000000] clock: Clocks: CPU:720.000MHz, DDR:600.000MHz, AHB:200.000MHz, Ref:40.000MHz
[    0.000000] setup: Determined physical RAM map:
[    0.000000]  memory: 08000000 @ 00000000 (usable)
[    0.000000] Initrd not found or empty - disabling initrd
[    0.000000] Zone PFN ranges:
[    0.000000]   Normal   0x00000000 -> 0x00002000
[    0.000000] Movable zone start PFN for each node
[    0.000000] Early memory PFN ranges
[    0.000000]     0: 0x00000000 -> 0x00002000
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 8176
[    0.000000] Kernel command line:  board=WK1 console=ttyS0,115200 mtdparts=spi0.0:256k(u-boot)ro,64k(u-boot-env),1408k(kernel),13952k(rootfs),64k(config),64k(unknown),512k(mib0),64k(ART),16064k@0x50000(firmware),320k@0xf50000(backup) rootfstype=squashfs,jffs2 noinitrd
[    0.000000] PID hash table entries: 512 (order: -3, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 2, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 1, 32768 bytes)
[    0.000000] Primary instruction cache 64kB, VIPT, 4-way, linesize 32 bytes.
[    0.000000] Primary data cache 32kB, 4-way, VIPT, no aliases, linesize 32 bytes
[    0.000000] Writing ErrCtl register=00000000
[    0.000000] Readback ErrCtl register=00000000
[    0.000000] Memory: 125760k/131072k available (2371k kernel code, 5312k reserved, 689k data, 192k init, 0k highmem)
[    0.000000] SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[    0.000000] NR_IRQS:83
[    0.000000] calibrate: Calibrating delay loop... 358.80 BogoMIPS (lpj=1794048)
[    0.060000] pid: pid_max: default: 32768 minimum: 301
[    0.060000] Mount-cache hash table entries: 2048
[    0.070000] NET: Registered protocol family 16
[    0.070000] Crashlog allocated RAM at address 0x7f00000 size 0x10000
[    0.080000] SYSTEM CRASH NOT DETECTED
[    0.080000] gpiolib: gpiochip_add: registered GPIOs 0 to 23 on device: ath79
[    0.090000] mips_machine: MIPS: machine is WK-1
[    0.090000] WLAN firmware dump buffer allocation of 2097152 bytes @ address 0x86200000- SUCCESS !!!
[    0.210000] mach_pakedge_wk1: ATH79: device=WK-1    sn=WK-1C0818A10131  domain=NOT SET! country=NOT SET! wifi0=90:a7:c1:1f:87:3c wifi1=90:a7:c1:1f:87:45  mach_uid=0003
[    0.220000] registering PCI controller with io_map_base unset
[    0.220000] ar724x-pci ar724x-pci.1: PCIe link is down
[    0.230000] registering PCI controller with io_map_base unset
[    0.670000] bio: create slab <bio-0> at 0
[    0.680000] PCI host bridge to bus 0000:00
[    0.680000] pci_bus 0000:00: root bus resource [mem 0x10000000-0x11ffffff]
[    0.690000] pci_bus 0000:00: root bus resource [io  0x0000]
[    0.690000] pci 0000:00:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
[    0.700000] pci 0000:00:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
[    0.700000] PCI host bridge to bus 0000:01
[    0.710000] pci_bus 0000:01: root bus resource [mem 0x12000000-0x13ffffff]
[    0.710000] pci_bus 0000:01: root bus resource [io  0x0001]
[    0.720000] pci: pci 0000:00:00.0: using irq 40 for pin 1
[    0.720000] Switching to clocksource MIPS
[    0.730000] NET: Registered protocol family 2
[    0.730000] IP route cache hash table entries: 4096 (order: 0, 16384 bytes)
[    0.740000] TCP established hash table entries: 4096 (order: 1, 32768 bytes)
[    0.750000] TCP bind hash table entries: 4096 (order: 0, 16384 bytes)
[    0.750000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.760000] TCP: reno registered
[    0.760000] UDP hash table entries: 1024 (order: 0, 16384 bytes)
[    0.770000] UDP-Lite hash table entries: 1024 (order: 0, 16384 bytes)
[    0.770000] NET: Registered protocol family 1
[    0.790000] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[    0.800000] jffs2: version 2.2. (NAND) (SUMMARY) (ZLIB) (LZO) (LZMA) (RTIME) (RUBIN) (CMODE_NONE) (c) 2001-2006 Red Hat, Inc.
[    0.810000] ROMFS MTD (C) 2007 Red Hat, Inc.
[    0.810000] msgmni has been set to 245
[    0.820000] io scheduler noop registered
[    0.820000] io scheduler deadline registered (default)
[    0.830000] Serial: 8250/16550 driver, 1 ports, IRQ sharing disabled
[    0.850000] serial8250.0: ttyS0 at MMIO 0x18020000 (irq = 11) is a 16550A
[    0.860000] console [ttyS0] enabled, bootconsole disabled
[    0.860000] console [ttyS0] enabled, bootconsole disabled
[    0.870000] brd: module loaded
[    0.870000] PAKEDGE_DFS: Init persistent storage for DFS channels.
[    0.880000] ath79-spi ath79-spi: master is unqueued, this is deprecated
[    0.890000] m25p80 spi0.0: found mx25l12805d, expected m25p80
[    0.900000] m25p80 spi0.0: mx25l12805d (16384 Kbytes)
[    0.900000] 10 cmdlinepart partitions found on MTD device spi0.0
[    0.910000] Creating 10 MTD partitions on "spi0.0":
[    0.910000] 0x000000000000-0x000000040000 : "u-boot"
[    0.920000] 0x000000040000-0x000000050000 : "u-boot-env"
[    0.920000] 0x000000050000-0x0000001b0000 : "kernel"
[    0.930000] 0x0000001b0000-0x000000f50000 : "rootfs"
[    0.940000] mtd: partition "rootfs" set to be root filesystem
[    0.940000] mtd: partition "rootfs_data" created, fixed size, ofs=0x00c50000, len=0x00300000
[    0.950000] 0x000000c50000-0x000000f50000 : "rootfs_data"
[    0.960000] 0x000000f50000-0x000000f60000 : "config"
[    0.960000] 0x000000f60000-0x000000f70000 : "unknown"
[    0.970000] 0x000000f70000-0x000000ff0000 : "mib0"
[    0.980000] 0x000000ff0000-0x000001000000 : "ART"
[    0.980000] 0x000000050000-0x000001000000 : "firmware"
[    0.990000] 0x000000f50000-0x000000fa0000 : "backup"
[    0.990000] m25p80 spi0.1: found pm25lv512, expected m25p80
[    1.000000] m25p80 spi0.1: pm25lv512 (64 Kbytes)
[    1.010000] ar8216: switch0: Atheros AR8337 rev. 2 switch registered on ag71xx-mdio.0
[    1.630000] libphy: ag71xx_mdio: probed
[    1.630000] ag71xx: eth0: Atheros AG71xx at 0xb9000000, irq 4
[    2.280000] ag71xx ag71xx.0: eth0: connected to PHY at ag71xx-mdio.0:00 [uid=004dd036, driver=Atheros AR8216/AR8236/AR8316]
[    2.290000] ag71xx ag71xx.1: no MII bus device specified
[    2.290000] ag71xx: probe of ag71xx.1 failed with error -22
[    2.300000] ath79_wdt: AR71XX_RESET_REG_WDOG_CTRL: 0x0
[    2.310000] nf_conntrack version 0.5.0 (1965 buckets, 7860 max)
[    2.310000] TCP: bic registered
[    2.320000] TCP: cubic registered
[    2.320000] TCP: westwood registered
[    2.320000] TCP: highspeed registered
[    2.330000] TCP: hybla registered
[    2.330000] TCP: htcp registered
[    2.330000] TCP: vegas registered
[    2.340000] TCP: veno registered
[    2.340000] TCP: scalable registered
[    2.340000] TCP: lp registered
[    2.350000] TCP: yeah registered
[    2.350000] TCP: illinois registered
[    2.350000] NET: Registered protocol family 17
[    2.360000] Bridge firewalling registered
[    2.360000] 8021q: 802.1Q VLAN Support v1.8
[    2.370000] VFS: Mounted root (squashfs filesystem) readonly on device 31:3.
[    2.380000] Freeing unused kernel memory: 192k freed
[    3.420000] init: Console is alive
[    3.420000] init: - watchdog -
[    5.430000] init: - preinit -
[    6.230000] fstools: jffs2 is ready /dev/mtdblock4:rootfs_data
[    6.300000] jffs2: notice: (330) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 12 of xref (0 dead, 2 orphan) found.
[    6.310000] fstools: switching to overlay /dev/mtdblock4:rootfs_data
[    6.340000] procd: - early -
[    6.340000] procd: - watchdog -
[    7.150000] procd: - ubus -
[    8.170000] procd: - init -
Please press Enter to activate this console.

[ run   ] /etc/rc.d/S* boot
[ start ] /etc/rc.d/S00sysfixtime boot pid=424
[ stop  ] /etc/rc.d/S00sysfixtime boot
[ start ] /etc/rc.d/S01sysctl boot pid=593
[ stop  ] /etc/rc.d/S01sysctl boot
[ start ] /etc/rc.d/S10boot boot pid=595
[ stop  ] /etc/rc.d/S10boot boot
[ start ] /etc/rc.d/S10system boot pid=732
[ stop  ] /etc/rc.d/S10system boot
[ start ] /etc/rc.d/S11admin boot pid=745
[ stop  ] /etc/rc.d/S11admin boot
[ start ] /etc/rc.d/S11caldata boot pid=780
[ stop  ] /etc/rc.d/S11caldata boot
[ start ] /etc/rc.d/S11set_regdomain boot pid=789
[ stop  ] /etc/rc.d/S11set_regdomain boot
[ start ] /etc/rc.d/S12upgrade_wifi boot pid=861
[ stop  ] /etc/rc.d/S12upgrade_wifi boot
[ start ] /etc/rc.d/S15qca-hostapd boot pid=1208
[ stop  ] /etc/rc.d/S15qca-hostapd boot
[ start ] /etc/rc.d/S15qca-wpa-supplicant boot pid=1214
[ stop  ] /etc/rc.d/S15qca-wpa-supplicant boot
[ start ] /etc/rc.d/S15syslog-ng3 boot pid=1220
[ stop  ] /etc/rc.d/S15syslog-ng3 boot
[ start ] /etc/rc.d/S15u_boot_env boot pid=1222
[ stop  ] /etc/rc.d/S15u_boot_env boot
[ start ] /etc/rc.d/S20network boot pid=1226
[ stop  ] /etc/rc.d/S20network boot
[ start ] /etc/rc.d/S40ntpd boot pid=1244
[ stop  ] /etc/rc.d/S40ntpd boot
[ start ] /etc/rc.d/S50cron boot pid=1510
[ stop  ] /etc/rc.d/S50cron boot
[ start ] /etc/rc.d/S50snmpd boot pid=1611
[ stop  ] /etc/rc.d/S50snmpd boot
[ start ] /etc/rc.d/S72shortcut-fe boot pid=1776
[ stop  ] /etc/rc.d/S72shortcut-fe boot
[ start ] /etc/rc.d/S95done boot pid=1801
[ stop  ] /etc/rc.d/S95done boot
[ start ] /etc/rc.d/S95sddpd boot pid=1829
[ stop  ] /etc/rc.d/S95sddpd boot
[ start ] /etc/rc.d/S95sudo boot pid=1849
[ stop  ] /etc/rc.d/S95sudo boot
[ start ] /etc/rc.d/S96led boot pid=1856
[ stop  ] /etc/rc.d/S96led boot
[ start ] /etc/rc.d/S98dropbear boot pid=1902
[ stop  ] /etc/rc.d/S98dropbear boot
[ start ] /etc/rc.d/S98uhttpd boot pid=1941
[ stop  ] /etc/rc.d/S98uhttpd boot
[ start ] /etc/rc.d/S98wmwd boot pid=2064
[ stop  ] /etc/rc.d/S98wmwd boot
[ start ] /etc/rc.d/S99cpu_utilization boot pid=2076
[ stop  ] /etc/rc.d/S99cpu_utilization boot
[ start ] /etc/rc.d/S99ntpdate boot pid=2100
[ stop  ] /etc/rc.d/S99ntpdate boot
[ start ] /etc/rc.d/S99ovrc boot pid=2108
[ stop  ] /etc/rc.d/S99ovrc boot
[ start ] /etc/rc.d/S99vm boot pid=2117
[ stop  ] /etc/rc.d/S99vm boot

t4thfavor · February 8, 2024, 5:22pm

Holding the reset button on the 2200 results in "Hit any key to stop autoboot: 0" and it just sits there until you let go of the button, and it then appears to boot normally.

tmn505 · February 8, 2024, 6:28pm

Might be that they disabled RX line but that's done very rarely, make sure that the pin is properly connected (maybe there's missing resistor on the line), otherwise it'll be difficult to proceed.

Looking at the WA-2200 log I see they didn't disable failsafe. Enter it by following Press the [f] key and hit [enter] to enter failsafe mode, the window to do that is very short. If You can enter it run mount_root. If it's successful You can disable password for root user and can log in after reboot.

Regarding WK-1. On old QCA U-Boot fork they didn't have protection against flash read failures and if it occurred on loading kernel as failure it dropped user to U-Boot command line. Try to short 'chip select' and 'data out' pins on NOR flash chip, when Press 'p' to abort autoboot in 2 seconds is displayed, keep it shorted until kernel checksum fails and see if it drops You to U-Boot shell.

t4thfavor · February 8, 2024, 6:45pm

All the resistors appear to be there, I can't see anything specific that would tell me the rxd pin was damaged or anything. I mostly posted these because I wanted to complete my analysis as I don't really have time to mess with them further unless it's literally to TFTP an image and perform the flash commands.

tmn505 · February 8, 2024, 6:59pm

For TFTP we need to be in U-Boot console. But sometimes getting there is difficult. To follow up on WA-2200, if You get in to failsafe mode try to issue fw_setenv bootdelay 3. This should add delay so You can actually interrupt boot process.
If any of these fail, log in the web interface (if there is any) and check if there's settings backup option. If it's there send me the files generated by it. I'll look at them.

t4thfavor · February 8, 2024, 8:43pm

I'm saying that my console isn't registering any input on either device, so I'm either configured oddly or the rxd pin isn't connected internally