FCC ID TIH-BSAP1800V2
Flash chip is a MX25L12845EMI-106 that equals 16MB
RAM is 2x A3S56D40FTP-G5 that equals 64MB of RAM
Device uses custom RedBoot that does CRC checks among other weird things.
It is a exact clone of https://wikidevi.com/wiki/H3C_WA2620-AGN and sounds similar to this OpenWRT post but one less radio https://forum.openwrt.org/viewtopic.php?id=65879
Can anyone help? GPL Sources here https://www.dropbox.com/s/n43zfzuzyydgj56/OSR_3.0.tar.gz?dl=0
Additional information available upon request.
============= BOOTLOADER STARTUP =============
Flash id read c22018
VSCXXX Found 0 unit 0:0 phy_addr: 0 id: 00070421
PHY is Vitesse VSC8601 Rev B
VSCXXX unit 0 phy_addr 0
mode_ctr (00 )=1140 auto-eg
full-duplex
f1000
mode_status (01 )=7949 auto-neg-cap
ex-cap
rcv-error (19 )=0000
false-carrier (20 )=0000
disconnect_cnt (21 )=0000
VSCXXX unit 0 phy_addr 0
mode_ctr (00 )=1140 auto-eg
full-duplex
f1000
mode_status (01 )=7949 auto-neg-cap
ex-cap
rcv-error (19 )=0000
false-carrier (20 )=0000
disconnect_cnt (21 )=0000
VSCXXX unit 0 phy_addr 0
mode_ctr (00 )=1140 auto-eg
full-duplex
f1000
mode_status (01 )=796d auto-neg-cmplt
auto-neg-cap
link-up
ex-cap
rcv-error (19 )=0000
false-carrier (20 )=0000
disconnect_cnt (21 )=0000
Ethernet eth0: MAC address 00:19:92:XX:XX:XX
=> Bootloader Version: 1.0.2
=> RAM: 64M FLASH: 16M
=> MFG State: 48
=> MAC Address [Board Data]: 00:19:92:XX:XX:XX
=> Serial Num [Board Data]: 1802xxxxxxxxxx
FIS Filesystem Integrity Check...OK
Firmware integrity check...
Booting Bank B ...
Calculating CRC: start=0xbf4d0000, Size=0x00130000
<<CRC Passed>>
.
.
=> BOOT BANK:2 CNT:1
== Executing boot script in 5.000 sec - enter password to abort ==
fis load -l vmlinux_2
Image loaded from 0x80060000-0x80376086
boot> exec -c "console=ttyS0,115200 root=31:04 rootfstype=jffs2 mem=64M@0x00000000 quiet"
Now booting linux kernel:
Base address 0x80050000 Entry 0x80354000
Cmdline : console=ttyS0,115200 root=31:04 rootfstype=jffs2 mem=64M@0x00000000 quiet
========================
ACCESS POINT CONSOLE
========================
User Access verification
BusyBox v1.1.1 (2016.11.22-17:04+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.
dmesg
Linux version 2.6.15--LSDK-7.0.0.380 (root@kickseed) (gcc version 3.4.4 (Wind River Linux)) #1 Tue Nov 22 11:05:28 CST 2016
flash_size passed from bootloader = 16
arg 1: console=ttyS0,115200 root=31:04 rootfstype=jffs2 mem=64M@0x00000000 quiet
CPU revision is: 00019374
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
User-defined physical RAM map:
memory: 04000000 @ 00000000 (usable)
On node 0 totalpages: 16384
DMA zone: 16384 pages, LIFO batch:3
DMA32 zone: 0 pages, LIFO batch:0
Normal zone: 0 pages, LIFO batch:0
HighMem zone: 0 pages, LIFO batch:0
Built 1 zonelists
Kernel command line: console=ttyS0,115200 root=31:04 rootfstype=jffs2 mem=64M@0x00000000 quiet
Primary instruction cache 64kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 32kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load handler fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
PID hash table entries: 512 (order: 9, 8192 bytes)
Using 300.000 MHz high precision timer.
Dentry cache hash table entries: 16384 (order: 4, 65536 bytes)
Inode-cache hash table entries: 8192 (order: 3, 32768 bytes)
Memory: 61196k/65536k available (2447k kernel code, 4284k reserved, 572k data, 140k init, 0k highmem)
Calibrating delay loop... 398.33 BogoMIPS (lpj=199168)
Mount-cache hash table entries: 512
Checking for 'wait' instruction... available.
NET: Registered protocol family 16
SCSI subsystem initialized
AR7100 GPIOC major 0
JFFS version 1.0, (C) 1999, 2000 Axis Communications AB
JFFS2 version 2.2. (NAND) (C) 2001-2003 Red Hat, Inc.
JFS: nTxBlock = 478, nTxLock = 3828
Initializing Cryptographic API
io scheduler noop registered
io scheduler deadline registered
Serial: 8250/16550 driver $Revision: #1 $ 4 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x0 (irq = 19) is a 16550A
RAMDISK driver initialized: 1 RAM disks of 8192K size 1024 blocksize
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky
Creating 11 MTD partitions on "ar7100-nor0":
0x00000000-0x00040000 : "Redboot"
0x00040000-0x00170000 : "vmlinux_1"
0x00170000-0x004d0000 : "root_1"
0x004d0000-0x00600000 : "vmlinux_2"
0x00600000-0x00dc0000 : "root_2"
0x00dc0000-0x00e30000 : "home"
0x00e30000-0x00fb0000 : "var"
0x00fc0000-0x00fd0000 : "Board config"
0x00fd0000-0x00fe0000 : "FIS directory"
0x00fe0000-0x00ff0000 : "Redboot config"
0x00ff0000-0x01000000 : "cert"
NET: Registered protocol family 26
Netfilter messages via NETLINK v0.30.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 4096 (order: 2, 16384 bytes)
TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP reno registered
ip_conntrack version 2.4 (512 buckets, 4096 max) - 212 bytes per conntrack
ip_conntrack_pptp version 3.1 loaded
ip_nat_pptp version 3.0 loaded
ip_tables: (C) 2000-2002 Netfilter core team
TCP bic registered
Ethernet over IPv4 tunneling driver
eip fallback tunnel initialized
NET: Registered protocol family 1
NET: Registered protocol family 10
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear
All bugs added by David S. Miller
VFS: Mounted root (jffs2 filesystem) readonly.
Freeing unused kernel memory: 140k freed
Algorithmics/MIPS FPU Emulator v1.5
1880_wdt: module license 'unspecified' taints kernel.
ar7100wdt_init: Registering WDT success
AG7100: Length per segment 512
AG7100: Max segments per packet 4
AG7100: Max tx descriptor count 400
AG7100: Max rx descriptor count 252
AG7100: fifo cfg 3 018001ff
AG7100CHH: Mac address for unit 0
AG7100CHH: 00:19:92:XX:XX:XX
vbrg: no version for "gc_new_item" found: kernel tainted.
init vbr, registering ioctl
init vbr 2
wlan: 0.8.4.2 (Atheros/multi-bss)
ath_hal: 0.9.17.1 (AR5416, DEBUG, WRITE_EEPROM, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_pci: 0.9.4.5 (Atheros/multi-bss)
PCI: Enabling device 0000:00:00.0 (0000 -> 0002)
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
No Rate table yet!!!!
No Rate table yet!!!!
ath_txq_update qnum 8 aifs 2 cwmin -1 cwmax 1023 burstime 0
__ath_attach ** device wifi0
wifi0: Atheros 9160: mem=0x10000000, irq=48 hw_base=0xb0000000
PCI: Enabling device 0000:00:01.0 (0000 -> 0002)
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
Rate cntrl mode not loaded returning
No Rate table yet!!!!
No Rate table yet!!!!
ath_txq_update qnum 8 aifs 2 cwmin -1 cwmax 1023 burstime 0
__ath_attach ** device wifi1
wifi1: Atheros 9160: mem=0x10010000, irq=49 hw_base=0xb0010000
wlan: mac acl policy registered
ag7100_ring_alloc Allocated 6400 at 0x83d68000
ag7100_ring_alloc Allocated 4032 at 0x8304b000
AG7100: cfg1 0xf cfg2 0x7014
VSC8601: Found 0 unit 0:0 phy_addr: 0 id: 00070421
VSC8601: PHY is Vitesse VSC8601 Rev B
VSC8601: unit 0 phy_addr 0
VSC8601: unit 0 phy_addr 0
AG7100: unit 0: phy not up carrier 1
Writing 4
ADDRCONF(NETDEV_UP): eth0: link is not ready
ag7100_ring_free Freeing at 0x83d68000
ag7100_ring_free Freeing at 0x8304b000
ag7100_ring_alloc Allocated 6400 at 0x83c8a000
ag7100_ring_alloc Allocated 4032 at 0x83cdf000
AG7100: cfg1 0xf cfg2 0x7014
VSC8601: Found 0 unit 0:0 phy_addr: 0 id: 00070421
VSC8601: PHY is Vitesse VSC8601 Rev B
VSC8601: unit 0 phy_addr 0
Writing 4
ADDRCONF(NETDEV_UP): eth0: link is not ready
VSC8601: unit 0 phy_addr 0
AG7100: unit 0 phy is up...RGMii 1000Mbps full duplex
AG7100: pll reg 0x18050010: 0x110000
AG7100: cfg_1: 0x1ff0000
AG7100: cfg_2: 0x3ff
AG7100: cfg_3: 0x18001ff
AG7100: cfg_4: 0xffff
AG7100: cfg_5: 0xbffef
AG7100: done cfg2 0x7215 ifctl 0x0 miictrl 0x22
ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
lsmod -vvv
Module Size Used by Tainted: PF
wlan_acl 6624 0
ath_pci 80544 0
ath_dev 202880 1 ath_pci
wlan_xauth 1408 0
wlan_ccmp 10080 0
wlan_tkip 14688 0
wlan_wep 7168 0
wlan_scan_ap 11744 0
ath_rate_atheros 75616 1 ath_dev
ath_hal 321728 4 ath_pci,ath_dev
wlan 308944 11 wlan_acl,ath_pci,ath_dev,wlan_xauth,wlan_ccmp,wlan_tkip,wlan_wep,wlan_scan_ap,ath_rate_atheros
vbrg 301824 2 ath_dev,wlan
gc 7200 10 wlan_acl,ath_pci,ath_dev,wlan_ccmp,wlan_tkip,wlan_wep,wlan_scan_ap,ath_rate_atheros,wlan,vbrg
vnl 8080 2 wlan,vbrg
ag7100_mod 26160 0
1880_wdt 4672 0
cat cmdline
console=ttyS0,115200 root=31:04 rootfstype=jffs2 mem=64M@0x00000000 quiet
cat cpuinfo
system type : Atheros AR7100 (hydra)
processor : 0
cpu model : MIPS 24K V7.4
BogoMIPS : 398.33
wait instruction : yes
microsecond timers : yes
tlb_entries : 16
extra interrupt vector : yes
hardware watchpoint : yes
ASEs implemented : mips16
VCED exceptions : not available
VCEI exceptions : not available
cat devices
Character devices:
1 mem
2 pty
3 ttyp
4 ttyS
5 /dev/tty
5 /dev/console
5 /dev/ptmx
10 misc
13 input
21 sg
77 AR7100_GPIOC
90 mtd
128 ptm
136 pts
Block devices:
1 ramdisk
8 sd
31 mtdblock
65 sd
66 sd
67 sd
68 sd
69 sd
70 sd
71 sd
128 sd
129 sd
130 sd
131 sd
132 sd
133 sd
134 sd
135 sd
cat interrupts
CPU0
2: 0 MIPS cascade
4: 534 MIPS eth0
6: 0 MIPS cascade
7: 273826 MIPS timer
18: 0 AR7100 MISC cascade
19: 3160 AR7100 MISC serial
38: 2 AR7100 GPIO Sotfware Reset
48: 0 AR7100 PCI wifi0
49: 0 AR7100 PCI wifi1
51: 0 AR7100 PCI ar7100 pci core
ERR: 0
cat mtd
dev: size erasesize name
mtd0: 00040000 00010000 "Redboot"
mtd1: 00130000 00010000 "vmlinux_1"
mtd2: 00360000 00010000 "root_1"
mtd3: 00130000 00010000 "vmlinux_2"
mtd4: 007c0000 00010000 "root_2"
mtd5: 00070000 00010000 "home"
mtd6: 00180000 00010000 "var"
mtd7: 00010000 00010000 "Board config"
mtd8: 00010000 00010000 "FIS directory"
mtd9: 00010000 00010000 "Redboot config"
mtd10: 00010000 00010000 "cert"
cat pci
PCI devices found:
Bus 0, device 0, function 0:
Class 0280: PCI device 168c:0027 (rev 1).
IRQ 48.
Master Capable. Latency=168.
Non-prefetchable 32 bit memory at 0x10000000 [0x1000ffff].
Bus 0, device 1, function 0:
Class 0280: PCI device 168c:0027 (rev 1).
IRQ 49.
Master Capable. Latency=168.
Non-prefetchable 32 bit memory at 0x10010000 [0x1001ffff].
uname -a
Linux APTest 2.6.15--LSDK-7.0.0.380 #1 Tue Nov 22 11:05:28 CST 2016 mips unknown
boot> ver
=> Bootloader Version: 1.0.2
=> RAM: 64M FLASH: 16M
boot>