Friends,

Many have asked and users zloop and Zajec almost volunteered, so here is an opportunity for us to make that build for NETGEAR R7500 Nighthawk X4 AC2350 Smart WiFi Router we all want:

So I have one and I cracked it open likeso:

• Unscrew five screws on the bottom, one visible center near front, four under each of the rubber feet.

• Carefuly bend open from left front, pressing the circuit board down to remain in the bottom half

• Across the top at the back, the top shell has four hooks projecting down held by four pins protruding forward from the vertical back plate. Using a flat screwdriver, Apply pressure at the right side close to the top edge of the back plate, and the top will come right off

• Celebrate!

Then I bought a Raspberry-Pi USB to serial adapter, ready for 3.3 V brand JBTek $7 on Amazon.
Connect 3 of the four leads to the serial header named J3, visible in front right corner.

1. marked with white dot on circuit board, towards front: +3.3 V (do not connect anything to this pin)

2. tx to white cable (rx into usb)

3. rx to green cable (tx out of usb)

4. towards back: gnd to black cable

the red vcc cable is no connection.

Plug usb connector into your favorite Ubuntu Linux computer.

Verify that the cable is recognized by Linux:

lsusb
…
Bus 003 Device 005: ID 067b:2303 Prolific Technology, Inc. PL2303 Serial Port

Verify that the kernel device driver has loaded:

$ lsmod | grep 2303
pl2303                 19022  0 
usbserial              45100  1 pl2303

Find your new fancy serial device:

$ ls /dev/*USB*
/dev/ttyUSB0

Pick a wild guess for what software you gonna use:

sudo apt-get install minicom
sudo mincom --setup
Serial port setup:
A: /dev/ttyUSB0
F: Hardware Flow Control: No
G: Software Flow Control: Yes
<Enter> to exit
Save setup as dfl
Exit
<Enter>
quantenna #

You're online with the fanciest router in the World: Celebrate!

So this routery runs the beta AA from 9/2014. Here's the boot log, 347 lines:

Valid CRC found in flash restoring env...
hw_config_id 65535: 'QTP840_5S1_MS'
PCIe early init, done@60ms
DDR_INIT: type = 16 speed = 500MHz
init board as PCIe End Point mode
PCIe Shmem BAR2=0x10000 Len:64k
PCIe Sysctl BAR0=0xe0000000 Len:64k
PCIe DMA BAR3=0xe9000000 Len:64k
Quantenna Mini U-Boot
Version: v36.6.0.1 Built: Apr 28 2014 at 23:54:34
Polling for PCIe Link up
Waiting for handshake start
PCI memory region is little endian
Host memory start address is 0x41500000
PCIe MSI Interrupt Support
setup_atu_msi: msi_addr=a0000000
0:MSI64: Host:0x0a0000000 EP:0xcfff0000
1:Mem: EP(0x0->0xbfffffff) Host(0x41500000->0x14fffff)
2:BD: EP(0xcffd0000->0xcffeffff) Host(dynamic alloc in RC)
Ready to load firmware....
PCIe Load FW[0] 0xc800000->0x88000000 Sz:68772...
done
PCIe Gen: 1
Go to address 88000030
Boot reached stage 13
Boot reached stage 12
Valid CRC found in flash restoring env...
Boot reached stage 11
Reset status: 0x00000002
hw_config_id 65535: 'QTP840_5S1_MS'
Warm boot
BDA at 0x80002000
In:    serial
Out:   serial
Err:   serial
Boot reached stage 64
error: no emac enabled
No ethernet found.
Boot reached stage -64
Hit any key to stop autoboot:  3  2  1  0
Polling for PCIe Link up
Waiting for handshake start
PCI memory region is little endian
Host memory start address is 0x41500000
PCIe MSI Interrupt Support
setup_atu_msi: msi_addr=a0000000
0:MSI64: Host:0x0a0000000 EP:0xcfff0000
1:Mem: EP(0x0->0xbfffffff) Host(0x41500000->0x14fffff)
2:BD: EP(0xcffd0000->0xcffeffff) Host(dynamic alloc in RC)
Ready to load firmware....
PCIe Load FW[0] 0xbc00000->0x83000000 Sz:1048576...
done
PCIe Load FW[1] 0xbc00000->0x83100000 Sz:1048576...
done
PCIe Load FW[2] 0xbc00000->0x83200000 Sz:1048576...
done
PCIe Load FW[3] 0xbc00000->0x83300000 Sz:989250...
done
PCIe Gen: 2
PCIe Loadaddr:0x83000000
Boot reached stage 1
## Booting kernel from Legacy Image at 83000000 ...
Boot reached stage 2
Boot reached stage 3
   Image Name:   topaz-linux
   Image Type:   arc Linux Kernel Image (lzma compressed)
   Data Size:    4126786 Bytes =  3.9 MB
   Load Address: 846da000
   Entry Point:  846da000
   Verifying Checksum ... OK
Boot reached stage 4
Boot reached stage 5
Boot reached stage 6
Boot reached stage 14
   Uncompressing Kernel Image ... OK
Boot reached stage 7
Boot reached stage 8
Command line TAG setup
Params->u.cmdline.cmdline console=ttyS0,115200n8 earlyprintk=1 hw_config_id=65535
p console=ttyS0,115200n8 earlyprintk=1 hw_config_id=65535
## Transferring control to Linux (at address 846da000) ATAG parameters 8803bab0 - 8803bb08...
[    0.000000] Linux version 2.6.35.12 (gary@debian) (gcc version 4.2.1 (ARC_2.3)) #2 Sat Jul 26 22:23:56 CST 2014
[    0.000000] Parsing ATAG parameters from bootloader
[    0.000000] ATAG_CORE: successful parsing
[    0.000000] ATAG_CMDLINE: command line = console=ttyS0,115200n8 earlyprintk=1 hw_config_id=65535
[    0.000000] Board id: 65535
[    0.000000] ATAG_HW_CONFIG_ID: hw_config_id = 65535
[    0.000000]
[    0.000000] Processor Family: ARC 700 [0x33]
[    0.000000] CPU speed :    500.00 Mhz
[    0.000000] Timers:     TIMER1 TIMER0
[    0.000000] Interrupt Vect Base:     0x88026800
[    0.000000] Peripheral Base: NOT present; assuming 0xCOFC0000
[    0.000000] Data UNCACHED Base (I/O): start 0xc0 Sz, 1024 MB
[    0.000000] ARC700 MMU Ver [2]
[    0.000000]    PAGE SIZE 8k
[    0.000000]    JTLB 128 x 2 = 256 entries
[    0.000000]    uDTLB 8 entr, uITLB 4 entr
[    0.000000] TLB Refill "will NOT" Flush uTLBs
[    0.000000] Detected I-cache :
[    0.000000]   Type=2 way set-assoc, Line length=32, Size=16K (enabled)
[    0.000000] Detected D-cache :
[    0.000000]   Type=4 way set-assoc, Line length=32, Size=16K (enabled)
[    0.000000] Extensions:
[    0.000000]    MPY: 32x32 with ANY Result Reg   MAC MPY: Dual 16 x 16 and 32 x 16
[    0.000000]    DCCM: N/A  ICCM: N/A
[    0.000000]    CRC: N/A,   SWAP: Present   NORM: Present
[    0.000000]    Min-Max: Present,   Barrel Shifter: Present
[    0.000000]    Ext Arith Insn: Present
[    0.000000] Floating Point Extension: N/A
[    0.000000] On node 0 totalpages: 16383
[    0.000000] free_area_init_node: node 0, pgdat 853ad6bc, node_mem_map 8544e024
[    0.000000]   Normal zone: 72 pages used for memmap
[    0.000000]   Normal zone: 0 pages reserved
[    0.000000]   Normal zone: 16311 pages, LIFO batch:3
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 16311
[    0.000000] Kernel command line: console=ttyS0,115200n8 earlyprintk=1 hw_config_id=65535
[    0.000000] bootconsole [ruby_early0] enabled
[    0.000000] PID hash table entries: 512 (order: -2, 2048 bytes)
[    0.000000] Dentry cache hash table entries: 16384 (order: 3, 65536 bytes)
[    0.000000] Inode-cache hash table entries: 8192 (order: 2, 32768 bytes)
[    0.000000] Memory: 43992KB available (2123K code,988K data, 10656K init)
[    0.000000] Hierarchical RCU implementation.
[    0.000000]     RCU debugfs-based tracing is enabled.
[    0.000000]     RCU-based detection of stalled CPUs is disabled.
[    0.000000]     Verbose stalled-CPUs detection is disabled.
[    0.000000] clockevent mode switch to [1]
[    0.000000] clockevent mode switch to [2]
[    0.000000] Calibrating delay loop... 249.03 BogoMIPS (lpj=622592)
[    0.115000] pid_max: default: 4096 minimum: 301
[    0.120000] Mount-cache hash table entries: 1024
[    0.125000] Starting run_ksoftirqd, stack (thread_info) at 88010000 cpu 0
[    0.130000] NET: Registered protocol family 16
[    0.135000] Topaz heap in SRAM 880164a0<->88020000
[    0.140000] Quantenna I2C device register
[    0.150000] bio: create slab <bio-0> at 0
[    0.155000] Switching to clocksource ARC Timer1
[    0.165000] NET: Registered protocol family 2
[    0.170000] IP route cache hash table entries: 2048 (order: 0, 8192 bytes)
[    0.175000] TCP established hash table entries: 4096 (order: 2, 32768 bytes)
[    0.180000] TCP bind hash table entries: 4096 (order: 1, 16384 bytes)
[    0.185000] TCP: Hash tables configured (established 4096 bind 4096)
[    0.190000] TCP reno registered
[    0.195000] NET: Registered protocol family 1
[    0.630000] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
[    0.640000] msgmni has been set to 85
[    0.640000] io scheduler noop registered (default)
[    1.065000] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled
[    1.075000] serial8250.0: ttyS0 at MMIO 0xf0000000 (irq = 48) is a 16550A
[    1.080000] console [ttyS0] enabled, bootconsole disabled
[    1.080000] console [ttyS0] enabled, bootconsole disabled
[    1.090000] serial8250.0: ttyS1 at MMIO 0xf5000000 (irq = 49) is a 16550A
[    1.100000] brd: module loaded
[    1.110000] loop: module loaded
[    1.110000] Creating 3 MTD partitions on "spi_flash":
[    1.120000] 0x000000000000-0x000000005000 : "uboot"
[    1.125000] 0x000000005000-0x00000000b000 : "uboot_env"
[    1.135000] 0x00000000b000-0x000000010000 : "data"
[    1.140000] spi_flash: SPI flash driver initialized successfully!
[    1.145000] ruby_health loading
[    1.640000] topaz_hbm_init_pool_list pool 0 pool_list 0x88000000 bus_range 0x4ac000 to 0x24ac000 sz 4096 count 8192
[    1.640000] topaz_hbm_init_pool_list pool 1 pool_list 0x88008000 bus_range 0x24ac000 to 0x46ac000 sz 17408 count 2048
[    1.640000] topaz_hbm_init_pool_list pool 3 pool_list 0x8800a000 bus_range 0x0 to 0x0 sz 0 count 4096
[    1.645000] topaz_busmon_init success
[    1.645000] topaz_temp_sens_init success
[    1.650000] u32 classifier
[    1.655000]     input device check on
[    1.660000]     Actions configured
[    1.660000] Netfilter messages via NETLINK v0.30.
[    1.665000] nf_conntrack version 0.5.0 (687 buckets, 2748 max)
[    1.675000] ip_tables: (C) 2000-2006 Netfilter Core Team
[    1.680000] TCP cubic registered
[    1.685000] NET: Registered protocol family 10
[    1.690000] NET: Registered protocol family 17
[    1.695000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
[    1.700000] All bugs added by David S. Miller <davem@redhat.com>
[    1.715000] Freeing unused kernel memory: 10656k freed [846da000] TO [85142000]
[    1.720000] Common mmap addr-space starts 2b0f0000
init started: BusyBox v1.10.3 (2014-07-26 22:18:41 CST)
starting pid 45, tty '': '/etc/init.d/rcS'
Starting portmap: done
Initializing random number generator... done.
[    2.155000] load_module: 'bootcfg' using DRAM (offset:0x86130000, size:0x8cf4)
Starting network...
[    2.590000] load_module: 'rtl8367b' using DRAM (offset:0x86180000, size:0x28c08)
[    2.600000] rtl8367b: module license 'unspecified' taints kernel.
[    2.605000] Disabling lock debugging due to kernel taint
[    2.635000] load_module: 'emaclib' using DRAM (offset:0x86160000, size:0x4a2c)
[    2.735000] load_module: 'dpi' using DRAM (offset:0x860d4000, size:0x1ae4)
[    2.765000] load_module: 'fwt_if' using DRAM (offset:0x8788e640, size:0x1098)
[    2.795000] load_module: 'switch_tqe' using DRAM (offset:0x860e4000, size:0x3394)
[    2.820000] tqe_descs_alloc: 256 tqe_rx_descriptors at kern uncached 0x550d84a8 bus 0x800164a8
[    2.860000] load_module: 'fwt_ctrl' using DRAM (offset:0x861c0000, size:0x1e800)
[    2.915000] load_module: 'switch_emac' using DRAM (offset:0x860f2000, size:0x15f4)
[    2.955000] topaz_emac_init, emac0
[    2.960000] topaz_emac_init, emac1
insmod: cannot insert '/lib/modules/2.6.35.12/drivers/topaz/switch_emac.ko': No such device
modprobe: failed to load module switch_emac
No Ethernet interfaces found
Using IP address 1.1.1.2
Using netmask 255.0.0.0
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCSIFHWADDR: No such device
/sbin/ifup -a
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCSIFADDR: No such device
ifconfig: SIOCGIFFLAGS: No such device
ifconfig: SIOCSIFADDR: No such device
Starting inetd ...
PCIe target enabled
[    3.800000] load_module: 'qdpc_pcie' using DRAM (offset:0x86178000, size:0x6574), SRAM (offset:0x880174b8, size:0x1718)
[    3.835000] topaz_vnet version 1.0 Quantenna Communications Inc.
[    3.845000] Random stuff 2F
[    3.845000] ATU outband region 2 (Host BD): EP(0xcffd0000->0xcffeffff) Host(0x4e460000->0x4e47ffff)
[    3.850000] Tx Descriptor table: uncache virtual addr: 0xcffdc000 bda_rc_tx_bd_num: 180
[    3.855000] Rx Descriptor table: uncache virtual addr: 0xcffdc5a0
[    3.860000] EP Handled idx: uncache virtual addr: 0xcffdd1a0
[    3.865000] RC tqxqueue wake flag address: uncache virtual addr: 0xcffdd1a4
[    3.875000] PCIe MSI Interrupt Enabled
[    3.900000] pcie0: Vmac Ethernet found
[    3.905000] Waiting for host start signal
[    3.910000] Enable DMA engines
[    3.960000] Connection established with Host
[    3.960000] tqe_descs_alloc: 2048 tqe_rx_descriptors at kern uncached 0x55140000 bus 0x06140000
[    4.085000] device pcie0 entered promiscuous mode
[    4.110000] br0: port 1(pcie0) entering forwarding state
[    4.115000] br0: port 1(pcie0) entering forwarding state
Starting wireless...
Loading modules
[    4.425000] load_module: 'qtn_debug' using DRAM (offset:0x861e1000, size:0x378)
[    4.490000] load_module: 'i2cbus' using DRAM (offset:0x86120000, size:0xb08)
[    4.515000] se95-i2c : I2C driver register code = 0
[    4.580000] load_module: 'qtsens' using DRAM (offset:0x86307000, size:0x6c4)
[    4.605000] temp_sensor: (SE95) has not been detected
[    4.670000] load_module: 'pm_interval' using DRAM (offset:0x860f2000, size:0x1308)
[    4.765000] load_module: 'wlan' using DRAM (offset:0x86400000, size:0x59bd4)
[    4.965000] wlan: 0.8.4.2 (0.9.3.3)
[    5.120000] load_module: 'radar' using DRAM (offset:0x863a0000, size:0x196e0)
[    5.175000] load_module: 'qvspmod' using DRAM (offset:0x86320000, size:0xffac)
[    5.260000] load_module: 'qdrv' using DRAM (offset:0x86480000, size:0x79d34)
[    5.485000] load_module: 'wlan_xauth' using DRAM (offset:0x861e0c00, size:0x2a4)
[    5.550000] load_module: 'wlan_ccmp' using DRAM (offset:0x861fc000, size:0x16d4)
[    5.630000] load_module: 'wlan_tkip' using DRAM (offset:0x86318000, size:0x257c)
Loading MuC driver (qtn_driver.qtn_ruby.0.bin)
Waiting for Wireless Events from interfaces...
QCS API error 2: No such file or directory
[    6.390000] MuC: uc_print_initialise_shared_data linux buf 557e1760
[    6.395000] MuC: build date=Fri Jul 25 19:52:01 PDT 2014
[    6.400000] MuC: slow heap begin=0x001d3700 end=0x0032f700
[    6.405000] MuC: fast heap begin=0x800307a0 end=0x800387a0
[    6.410000] MuC: stack start=0x8003efc0 sp=0x8003f724
[    6.415000] MuC: calstate is 3 (prod), dcache on
[    6.420000] MuC: scancnt=4
[    6.420000] MuC: 4x4 11ac FO RGMII/PCIe QV840
[    6.490000] MuC: RFIC version = 1
[    6.505000] MuC: os_uc, after bb_rf_complete_attach.
[    6.510000] MuC: fd start=0xe5040300 count=48 size=108 end=0xe5041740
[    6.515000] MuC: TX QoS schedule=0
[    6.520000] MuC: dynamic one-bit autocorrelation enabled
[    6.525000] MuC: bbrf_get_RFIC_freqID 1 g_proj_ID 1
[    6.530000] MuC: enable IRQs
[    6.530000] MuC: Wait for AuC ready
[    6.535000] MuC: Sync with AuC
[    6.540000] MuC: AuC is booted: 0xe5100ba8:0x6005e918 auc ilink addr: 0xe5100260:0xe5100264
[    6.545000] MuC: node stats - 0x6005d258
[    6.550000] MuC: vap  stats - 0x6005e5d8
[    6.555000] AuC: uc_print_initialise_shared_data linux buf 55fe01b0
[    6.565000] qdrv_wlan_80211_init rf_chipid 1
[    6.570000] QDRV: power adjust scancnt=0
[    6.575000] QDRV: using default temperature profile
[    6.580000] QDRV: could not read temperature sensor
[    6.585000] MuC boot succeeded 0.105 seconds
[    6.665000] load_module: 'wlan_scan_ap' using DRAM (offset:0x863e0000, size:0x1e80)
[    6.780000] MuC: bbrf_get_RFIC_freqID 1 g_proj_ID 1
[    6.800000] VAP create succeeded 0.010 seconds
QCS API error 2: No such file or directory
Enabling beamforming with bfoff
radar in 80MHZ mode
Jan  1 00:00:07 qcsapi_regulatory_database[397]: database /proc/bootcfg/qtn_regulatory_db.bin is loaded.

version of /proc/bootcfg/qtn_regulatory_db.bin is v0
Jan  1 00:00:07 qcsapi_regulatory_database[398]: database /etc/qtn_regulatory_db.bin is loaded.

version of /etc/qtn_regulatory_db.bin is v36.6.0.3
Select database version: v36.6.0.3
Configuring to load /etc/qtn_regulatory_db.bin
[ERROR] Couldn't get channels list for us regulatory region
Check that qtn_regulatory_db.bin is loaded in /proc/bootcfg
Jan  1 00:00:07 iwevent: 00:00:07.843473   wifi0    Set Channel=0

QCS API error 2: No such file or directory
QCS API error 1044: Option is not supported
[    7.910000] device wifi0 entered promiscuous mode
[    8.005000] Enabling SSDP flooding
start-prod: adding default "manufacturer=Quantenna" to /tmp//hostapd.conf
start-prod: adding default "device_name=Reference Design" to /tmp//hostapd.conf
start-prod: adding default "model_name=Topaz" to /tmp//hostapd.conf
start-prod: adding default "model_number=QV860.00" to /tmp//hostapd.conf
start-prod: adding default "serial_number=002686F01A93" to /tmp//hostapd.conf
start-prod: adding default "friendly_name=UPnP Access Point" to /tmp//hostapd.conf
start-prod: adding default "device_type=6-0050F204-1" to /tmp//hostapd.conf
Jan  1 00:00:09 iwevent: 00:00:09.571696   wifi0    Set ESSID:"Quantenna"

[    9.505000] MuC: Soft TQE ring init. emac0 size = 1024, emac1 size = 1024
[    9.510000] AuC: triple: free 0 rxq 8 8 64 descriptors: addr 0x80040100 size 1280 rx status: addr 0x80040600 size 2560
[    9.515000] AuC: last_ilink1 addr=0xe5100260, last_ilink2 addr=0xe5100264
[    9.520000] AuC: AuC rx watchdog started
[    9.525000] MuC: g_calibration_algo_ver_to_report_dciq == 0x801
[    9.530000] MuC: RALG: Error 11ac 4ss table index 22 rate 22 has incorrect higher rate 13
[    9.535000] MuC: RALG: Error 11ac 4ss table index 33 rate 34 has incorrect higher rate 24
[    9.540000] WPS: push button is not configured
[    9.575000] br0: port 2(wifi0) entering forwarding state
[    9.580000] br0: port 2(wifi0) entering forwarding state
QCS API error 22: Invalid argument
802.11ac Enabled
[    9.880000] qdrv_sch_red: attached to pcie0
Jan  1 00:00:10 iwevent: 00:00:10.036860   wifi0    Custom driver event:SCS: stats task is started

SCS disabled
VSP: load profile off
[   10.260000] qvsp_ioctl_rule_del_index: rule delete done
[   10.265000] qvsp_strm_reset: stream reset
VSP enabled: 0
sh: rxsts: unknown operand
[   10.605000] start ba_setup detect timer
[   11.000000] [2]Comparing register set Global control
[   11.015000] [6]Comparing register set BB Global regs
Starting httpd
bind: Bad file descriptor
bind: Bad file descriptor
Carrier ID 0, uboot update flag 0
complete
starting pid 645, tty '/dev/console': '/bin/sh -l'
/scripts/cmdloop starting /sbin/qcsapi_rpcd, at 00:00:11 up 0 min, load average: 0.15, 0.03, 0.01

BusyBox v1.10.3 (2014-07-26 22:18:41 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

/scripts/cmdloop starting /sbin/call_qcsapi_rpcd, at 00:00:11 up 0 min, load average: 0.15, 0.03, 0.01
/scripts/cmdloop starting /sbin/qcsapi_rpcd, at 00:00:11 up 0 min, load average: 0.15, 0.03, 0.01
quantenna # [   14.410000] pcie0: no IPv6 routers present
[   14.420000] br0: no IPv6 routers present
[   17.005000] MuC: WMM AC 0:3,4,6,0 1:7,4,10,0 2:1,3,4,188 3:1,2,3,188

More goodies:

quantenna # cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00005000 00001000 "uboot"
mtd1: 00006000 00001000 "uboot_env"
mtd2: 00005000 00001000 "data"

That quantenna prompt look so good on you!

This build no haz nvram commando. However, one can do $(cat /dev/mtd1 | strings) and gets some:

cat /dev/mtd1
yethaddr=30:46:9a:25:be:e4ipaddr=192.168.1.100serverip=192.168.1.150bootfile=topaz-linux.lzma.imgcarrier_id=0hw_config_id=65535bootargs=console=ttyS0,115200n8 earlyprintk=1 hw_config_id=65535bootdelay=3loadaddr=0x88040000ext_lna_gain=12antenna_num=4antenna_gain=4506ext_lna_bypass_gain=-5min_tx_power=9bootcmd=pciebootstdin=serialstdout=serialstderr=serialfilesize=1AAtx_power_cal=0max_tx_power=23uboot_version=v36.6.0.7qtn_hw_board_db.bin=cfg 0x00001000 0x000009affilepath.txt=cfg 0x000019af 0x00000400qtn_regulatory_db.bin=cfg 0x00001daf 0x000003b5qtn_hw_board_config.bin=cfg 0x00002164 0x000001aatx_power_QSR1000_us.txt=cfg 0x0000230e 0x0000026crx_iq.cal=cfg 0x0000257a 0x00000308dc_iq.cal=cfg 0x00002882 0x00001a30pdetector.cal=cfg 0x000042b2 0x00000332config_data_end=0x000045e4calstate=3lstate=3config_data_end=0x000045afcalstate=3
        012345678
UNIVERSAL_ID
hw_QTN_test
DDR_16_ETRON
DDR_32_MICRON
DDR_16_MICRON
DDR_32_ETRON
DDR_32_SAMSUNG
DDR_16_SAMSUNG
DDR_16_HYNIX
DDR3_16_WINBOND
DDR3_32_WINBOND
DEFAULT_DDR_CFG
DDR_160
DDR_250
DDR_320
DDR_400
DDR3_320MHz
DDR3_400MHz
DDR3_500MHz
DDR3_640MHz
DDR3_800MHz
DEFAULT_DDR_SPEED
DDR_32MB
DDR_64MB
        DDR_128MB
        DDR_256MB
DDR_AUTO
DEFAULT_DDR_SIZE
EMAC_IN_USE
EMAC_RGMII_AN
EMAC_NOT_IN_USE
EMAC_MII_AN
EMAC_MII_100M
EMAC_MII_100M_PHY
EMAC_AR8327_RGMII
EMAC_RTL8363S_RGMII
EMAC_RTL8363SB_RGMII_P0
EMAC_RTL8363SB_RGMII_P1
MAC_RTL8363SB_RGMII_BONDED
EMAC_RTL8211E_RGMII
EMAC_88E6071_MII
0EMAC_B2B_RGMII
EMAC_B2B_RGMII_100M
EMAC_B2B_RGMII_1000M
EMAC_AR8236_MII
EMAC_MII_GPIO1_RST
EMAC_MII_100M_GPIO13_RST
DEFAULT_EMAC
EMAC_IN_USE
EMAC_RGMII_AN
EMAC_NOT_IN_USE
EMAC_MII_AN
EMAC_MII_100M
EMAC_MII_100M_PHY
EMAC_AR8327_RGMII
EMAC_RTL8363S_RGMII
EMAC_RTL8363SB_RGMII_P0
EMAC_RTL8363SB_RGMII_P1
MAC_RTL8363SB_RGMII_BONDED
EMAC_RTL8211E_RGMII
EMAC_88E6071_MII
0EMAC_B2B_RGMII
EMAC_B2B_RGMII_100M
EMAC_B2B_RGMII_1000M
EMAC_AR8236_MII
EMAC_MII_GPIO1_RST
EMAC_MII_100M_GPIO13_RST
DEFAULT_EMAC
EMAC_PHY_ADDR_SCAN
EMAC_PHY0_ADDR
EMAC_PHY1_ADDR
DEFAULT_PHY_ADDR
EMAC_PHY_ADDR_SCAN
EMAC_PHY0_ADDR
EMAC_PHY1_ADDR
DEFAULT_PHY_ADDR
SPI1_IN_USE
SPI1_NOT_IN_USE
QTN_RUBY_BRINGUP_RWPA
QTN_RUBY_REF_RWPA
QTN_RUBY_SIGE
QTN_RUBY_WIFI_NONE
QTN_TPZ_SE5003L1
QTN_TPZ_SE5003L1_INV
QTN_TPZ_SKY85703
DEFAULT_WIFI_HW
UART1_NOT_IN_USE
UART1_IN_USE
DEFAULT_UART1
PCIE_NOT_IN_USE
PCIE_ENDPOINT
PCIE_ROOTCOMPLEX
GMII_DEFAULT_S2p7ns_H1p1ns
RGMII_S2p4ns_H1p4ns
RGMII_S1p8ns_H1p9ns
RGMII_P1RX00TX0E
RGMII_710F
RGMII_NODELAY
DEFAULT_RGMII_TIMING
LNA_gain_12dB
DEFAULT_EXT_LNA_GAIN
TX_ANTENNA_NUM_1
TX_ANTENNA_NUM_2
TX_ANTENNA_NUM_3
TX_ANTENNA_NUM_4
DEFAULT_TX_ANTENNA_NUM
FLASH_SIZE_JEDEC
FLASH_32MB
FLASH_16MB
        FLASH_8MB
        FLASH_4MB
@       FLASH_2MB
DEFAULT_FLASH_SIZE
TX_ANTENNA_GAIN_1_1dB
DEFAULT_TX_ANTENNA_GAIN
LNA_gain_BYPASS_N5dB
EFAULT_EXT_LNA_BYPASS_GAIN
RFIC_NOT_IN_USE
RFIC_V4_IN_USE
DEFAULT_RFIC
CALSTATE_VPD_LOG
CALSTATE_VPD_LINEAR
DEFAULT_CALSTATE_VPD
security /tmp/ffs2/
mxEMinicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7Minicom2.7
br      012345678
BOARD_ID
QTP840_5S1_MS
DDR3_16_WINBOND
DDR3_500MHz
        DDR_128MB
EMAC_NOT_IN_USE
EMAC_NOT_IN_USE
TOPAZ_PHY0_ADDR
        TOPAZ_PHY0_ADDR
SPI1_IN_USE
QTN_TPZ_SKY85703
UART1_IN_USE
PCIE_ENDPOINT
RGMII_NODELAY
LNA_gain_12dB
TX_ANTENNA_NUM_4
FLASH_SIZE_JEDEC
TX_ANTENNA_GAIN_1_1dB
LNA_gain_BYPASS_N5dB
RFIC_V4_IN_USE
CALSTATE_VPD_LOG
*band 1 us
36 14 15 20
36 14 15 20
40 14 23 21
40 14 23 21
44 14 23 21
44 14 23 21
48 14 23 21
48 14 23 21
*band 2 us
52 -1 -1 -1
52 -1 -1 -1
56 -1 -1 -1
56 -1 -1 -1
60 -1 -1 -1
60 -1 -1 -1
64 -1 -1 -1
64 -1 -1 -1
*band 3 us
100 -1 -1 -1
100 -1 -1 -1
104 -1 -1 -1
104 -1 -1 -1
108 -1 -1 -1
108 -1 -1 -1
112 -1 -1 -1
112 -1 -1 -1
116 -1 -1 -1
116 -1 -1 -1
132 -1 -1 -1
132 -1 -1 -1
136 -1 -1 -1
136 -1 -1 -1
140 -1 -1 -1
140 -1 -1 -1
*band 4 us
149 21 23 23
149 21 23 23
153 21 23 23
153 21 23 23
157 21 23 23
157 21 23 23
161 21 23 23
161 21 23 23
165 21 23 23
165 21 23 23

Then, what else can I do to help?

I assume we will be looking forward to something in here: https://downloads.openwrt.org/chaos_cal … 1/ipq806x/

Thanks for the info! Hopefully this helps get support. Don't hold your breath on the Quantenna AC chipset working though...

Not really AA given the really old kernel:

Oh boy: that J3 serial header is for the QT3840BC, the secondary 5 GHz Wi-Fi chip called QSR1000.
There's another J1 in he left front corner with same pnout for the main processor.

The cpu power of the QT is 15% of a Pentium M:

quantenna # cat /proc/cpuinfo

Processor Family: ARC 700 [0x33]
CPU speed :     500.00 Mhz
Timers:         TIMER1 TIMER0
Interrupt Vect Base:    0x88026800
Peripheral Base: NOT present; assuming 0xCOFC0000
Data UNCACHED Base (I/O): start 0xc0 Sz, 1024 MB
Bogo MIPS :     249.03
ARC700 MMU Ver [2]
   PAGE SIZE 8k
   JTLB 128 x 2 = 256 entries
   uDTLB 8 entr, uITLB 4 entr
TLB Refill "will NOT" Flush uTLBs
Detected I-cache :
  Type=2 way set-assoc, Line length=32, Size=16K (enabled)
Detected D-cache :
  Type=4 way set-assoc, Line length=32, Size=16K (enabled)
Extensions:
   MPY: 32x32 with ANY Result Reg   MAC MPY: Dual 16 x 16 and 32 x 16
   DCCM: N/A  ICCM: N/A
   CRC: N/A,   SWAP: Present   NORM: Present
   Min-Max: Present,   Barrel Shifter: Present
   Ext Arith Insn: Present
Floating Point Extension: N/A

Here's main cpu on J1:
root@pt38:/# cat /proc/cpuinfo
Processor       : ARMv7 Processor rev 0 (v7l)
processor       : 0
BogoMIPS        : 12.55

processor       : 1
BogoMIPS        : 12.55

Features        : swp half thumb fastmult vfp edsp neon vfpv3 tls vfpv4
CPU implementer : 0x51
CPU architecture: 7
CPU variant     : 0x2
CPU part        : 0x04d
CPU revision    : 0

Hardware        : Qualcomm Atheros AP148 reference board
Revision        : 0000
Serial          : 0000000000000000

root@pt38:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00c80000 00020000 "qcadata"
mtd1: 00500000 00020000 "APPSBL"
mtd2: 00080000 00020000 "APPSBLENV"
mtd3: 00140000 00020000 "rootfs_data"
mtd4: 00200000 00020000 "kernel"
mtd5: 01800000 00020000 "rootfs"
mtd6: 00c00000 00020000 "netgear"
mtd7: 046c0000 00020000 "reserve"
mtd8: 01a00000 00020000 "firmware"
mtd9: 00010000 00001000 "m25p80"
mtd10: 0003e000 0001f000 "ART.bak"
mtd11: 0001f000 0001f000 "cert"
mtd12: 0001f000 0001f000 "config"
mtd13: 0005d000 0001f000 "pot"
mtd14: 00136000 0001f000 "language"
mtd15: 001b2000 0001f000 "traffic_meter"
mtd16: 0060e000 0001f000 "ubifs"

Main cpu boot log:

U-Boot 2012.07 [local,local] (Jun 20 2014 - 17:36:49)

U-boot 2012.07 dni1 V2.2 for DNI HW ID: 29764841 NOR flash 0MB NAND flash 128MB RAM 256MB 1st Radio 3x3 2nd Radio 4x4
smem ram ptable found: ver: 0 len: 5
DRAM:  235 MiB
NAND:  128 MiB
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
131072 bytes read: OK
cdp: get part failed for 0:HLOS
Net:   MAC1 addr:6c:b0:ce:14:2a:a3
athrs17_reg_init: complete
athrs17_vlan_config ...done
S17 inits done
MAC2 addr:6c:b0:ce:14:2a:a2
eth0, eth1
Hit any key to stop autoboot:  2  1  0
Mac2 unit failed
Mac1 unit failed

nmrp server is stopped or failed !

Loading from device 0: nand0 (offset 0x1340000)

** check kernel image **
   Verifying Checksum ... OK

** check rootfs image **
   Verifying Checksum ... OK

Loading from nand0, offset 0x1340000
   Image Name:   Linux-3.4.0
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2086400 Bytes = 2 MiB
   Load Address: 41508000
   Entry Point:  41508000
Automatic boot of image at addr 0x44000000 ...
   Image Name:   Linux-3.4.0
   Image Type:   ARM Linux Kernel Image (uncompressed)
   Data Size:    2086400 Bytes = 2 MiB
   Load Address: 41508000
   Entry Point:  41508000
   Verifying Checksum ... OK
   Loading Kernel Image ... OK
OK
mtdparts variable not set, see 'help mtdparts'
no partitions defined

defaults:
mtdids  : nand0=msm_nand
mtdparts: mtdparts=msm_nand:12M@0x2d40000(netgear)
info: "mtdparts" not set
Using machid 0x1260 from environment

Starting kernel ...

Booting Linux on physical CPU 0
Linux version 3.4.0 (root@localhost.localdomain) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #29 SMP Mon Sep 22 17:28:46 IST 2014
CPU: ARMv7 Processor [512f04d0] revision 0 (ARMv7), cr=10c5387d
CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
Machine: Qualcomm Atheros AP148 reference board
Qualcomm command line: console=ttyHSL1,115200n8 ubi.mtd=rootfs root=mtd:ubi_rootfs
memory pool 3 (start 4fc00000 size 400000) initialized
Memory policy: ECC disabled, Data cache writealloc
smem_find(137, 80): wrong size 72
socinfo_init: v6, id=202, ver=1.0, raw_id=2064, raw_ver=2064, hw_plat=0,  hw_plat_ver=65536
accessory_chip=0 hw_plat_subtype=0
PERCPU: Embedded 8 pages/cpu @c0b1c000 s10560 r8192 d14016 u32768
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 58666
Kernel command line: console=ttyHSL1,115200n8 ubi.mtd=6 root=/dev/mtdblock5
PID hash table entries: 1024 (order: 0, 4096 bytes)
Dentry cache hash table entries: 32768 (order: 5, 131072 bytes)
Inode-cache hash table entries: 16384 (order: 4, 65536 bytes)
Memory: 231MB = 231MB total
Memory: 224872k/228968k available, 11672k reserved, 0K highmem
Virtual kernel memory layout:
    vector  : 0xffff0000 - 0xffff1000   (   4 kB)
    fixmap  : 0xfff00000 - 0xfffe0000   ( 896 kB)
    vmalloc : 0xcf000000 - 0xff000000   ( 768 MB)
    lowmem  : 0xc0000000 - 0xceb00000   ( 235 MB)
    pkmap   : 0xbfe00000 - 0xc0000000   (   2 MB)
    modules : 0xbf000000 - 0xbfe00000   (  14 MB)
      .text : 0xc0008000 - 0xc061f000   (6236 kB)
      .init : 0xc0700000 - 0xc0802940   (1035 kB)
      .data : 0xc0804000 - 0xc0875260   ( 453 kB)
       .bss : 0xc0875284 - 0xc091aae4   ( 663 kB)
SLUB: Genslabs=11, HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:1177
sched_clock: 32 bits at 32kHz, resolution 31240ns, wraps every 134175798ms
Console: colour dummy device 80x30
Calibrating delay using timer specific routine.. 12.55 BogoMIPS (lpj=62786)
pid_max: default: 32768 minimum: 301
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
CPU0: thread -1, cpu 0, socket 0, mpidr 80000000
Setting up static identity map for 0x4192dbb8 - 0x4192dc40
CPU1: Booted secondary processor
CPU1: thread -1, cpu 1, socket 0, mpidr 80000001
Brought up 2 CPUs
SMP: Total of 2 processors activated (25.11 BogoMIPS).
dummy:
NET: Registered protocol family 16
AXI: msm_bus_fabric_init_driver(): msm_bus_fabric_init_driver
meminfo_init: smem ram ptable found: ver: 0 len: 5
Found 1 memory banks grouped into 8 memory regions
gpiochip_add: registered GPIOs 0 to 151 on device: msmgpio
QFPROM TSENS calibration data not present
smem_find(137, 80): wrong size 72
socinfo_init: v6, id=202, ver=1.0, raw_id=2064, raw_ver=2064, hw_plat=0,  hw_plat_ver=65536
accessory_chip=0 hw_plat_subtype=0
msm_rpm_init: RPM firmware 3.0.16777336
clk_tbl_nss - loaded
msm_rpm_get_status(): Status id 393 not defined for target
msm_rpm_get_status(): Status id 393 not defined for target
msm_rpm_get_status(): Status id 393 not defined for target
msm_rpm_get_status(): Status id 393 not defined for target
msm_rpm_get_status(): Status id 393 not defined for target
msm_rpm_get_status(): Status id 393 not defined for target
rpm_vreg_set_voltage: rpm-regulator driver has not probed yet.
gsbi4_qup_clk handoff failed (-19)
msm_dmov_memcpy_init: Success
sps:BAM 0x12244000 enabled: ver:0x5, number of pipes:20
sps:BAM 0x12244000 is registered.
sps:sps is ready.
msm_pcie_setup: link initialized
PCI host bridge to bus 0000:00
pci_bus 0000:00: root bus resource [mem 0x10000000-0x17ffffff]
PCI: bus0: Fast back to back transfers disabled
PCI: bus1: Fast back to back transfers disabled
msm_pcie_setup: link initialized
PCI host bridge to bus 0000:02
pci_bus 0000:02: root bus resource [mem 0x10000000-0x13ffffff]
PCI: bus2: Fast back to back transfers disabled
PCI: bus3: Fast back to back transfers disabled
msm_pcie_setup: link initialization failed
pci 0000:02:00.0: BAR 8: assigned [mem 0x10000000-0x101fffff]
pci 0000:02:00.0: BAR 9: assigned [mem 0x10200000-0x102fffff pref]
pci 0000:03:00.0: BAR 0: assigned [mem 0x10000000-0x101fffff 64bit]
pci 0000:03:00.0: BAR 6: assigned [mem 0x10200000-0x1020ffff pref]
pci 0000:02:00.0: PCI bridge to [bus 03-03]
pci 0000:02:00.0:   bridge window [mem 0x10000000-0x101fffff]
pci 0000:02:00.0:   bridge window [mem 0x10200000-0x102fffff pref]
PCI: enabling device 0000:02:00.0 (0140 -> 0143)
pci 0000:00:00.0: BAR 9: assigned [mem 0x10000000-0x100fffff pref]
pci 0000:01:00.0: BAR 0: assigned [mem 0x10000000-0x1000ffff pref]
pci 0000:01:00.0: BAR 2: assigned [mem 0x10010000-0x1001ffff pref]
pci 0000:01:00.0: BAR 3: assigned [mem 0x10020000-0x1002ffff pref]
pci 0000:00:00.0: PCI bridge to [bus 01-01]
pci 0000:00:00.0:   bridge window [mem 0x10000000-0x100fffff pref]
PCI: enabling device 0000:00:00.0 (0140 -> 0143)
bio: create slab <bio-0> at 0
SCSI subsystem initialized
spi_qsd spi_qsd.5: master is unqueued, this is deprecated
spi_qsd spi_qsd.6: master is unqueued, this is deprecated
spi_qsd spi_qsd.2: master is unqueued, this is deprecated
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource gp_timer
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 1, 8192 bytes)
TCP established hash table entries: 8192 (order: 4, 65536 bytes)
TCP bind hash table entries: 8192 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP: reno registered
UDP hash table entries: 128 (order: 0, 4096 bytes)
UDP-Lite hash table entries: 128 (order: 0, 4096 bytes)
NET: Registered protocol family 1
smd: register irq failed on wcnss_a11
smd: deregistering IRQs
SMD: smd_core_platform_init() failed
Partition (from dni partition table) qcadata -- Offset:0 Size:64
Partition (from dni partition table) APPSBL -- Offset:64 Size:28
Partition (from dni partition table) APPSBLENV -- Offset:8c Size:4
Partition (from dni partition table) rootfs_data -- Offset:90 Size:a
Partition (from dni partition table) kernel -- Offset:9a Size:10
Partition (from dni partition table) rootfs -- Offset:aa Size:c0
Partition (from dni partition table) netgear -- Offset:16a Size:60
Partition (from dni partition table) reserve -- Offset:1ca Size:0
Partition (from dni partition table) firmware -- Offset:9a Size:d0
acpuclk-ipq806x acpuclk-ipq806x: SPEED BIN: 0
acpuclk-ipq806x acpuclk-ipq806x: ACPU PVS: 2
acpuclk-ipq806x acpuclk-ipq806x: CPU0: 6 frequencies supported
acpuclk-ipq806x acpuclk-ipq806x: CPU1: 6 frequencies supported
msm_rpm_log_probe: OK
squashfs: version 4.0 (2009/01/31) Phillip Lougher
jffs2: version 2.2. (NAND) (SUMMARY) (LZMA) (RTIME) (CMODE_PRIORITY) © 2001-2006 Red Hat, Inc.
msgmni has been set to 439
io scheduler noop registered
io scheduler deadline registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
msm_serial_hs module loaded
msm_serial_hsl: detected port #1
msm_serial_hsl.1: ttyHSL1 at MMIO 0x16340000 (irq = 184) is a MSM
msm_serial_hsl: console setup on port #1
console [ttyHSL1] enabled
msm_serial_hsl: driver initialized
ahci ahci.0: forcing PORTS_IMPL to 0x1
ahci ahci.0: AHCI 0001.0300 32 slots 1 ports 6 Gbps 0x1 impl platform mode
ahci ahci.0: flags: ncq sntf pm led clo only pmp pio slum part ccc apst
scsi0 : ahci_platform
ata1: SATA max UDMA/133 mmio [mem 0x29000000-0x2900017f] port 0x100 irq 241
msm_nand_probe: phys addr 0x1ac00000
msm_nand_probe: dmac 0x3
msm_nand_probe: allocated dma buffer at ffdfc000, dma_addr 4f57e000
status: 20
nandid: 1580a12c maker 2c device a1
ONFI probe : Found an ONFI compliant device MT29F1G08ABBEAH4    ,
Found a supported NAND device
NAND Controller ID : 0x4030
NAND Device ID  : 0x1580a12c
Buswidth : 8 Bits
Density  : 128 MByte
Pagesize : 2048 Bytes
Erasesize: 131072 Bytes
Oobsize  : 64 Bytes
CFG0 Init  : 0xa8d408c0
CFG1 Init  : 0x0004745c
ECCBUFCFG  : 0x00000203
Creating 9 MTD partitions on "msm_nand":
0x000000000000-0x000000c80000 : "qcadata"
0x000000c80000-0x000001180000 : "APPSBL"
0x000001180000-0x000001200000 : "APPSBLENV"
0x000001200000-0x000001340000 : "rootfs_data"
0x000001340000-0x000001540000 : "kernel"
0x000001540000-0x000002d40000 : "rootfs"
mtd: find squashfs magic at 0x1540000 of "msm_nand"
the correct location of partition "rootfs": 0x000001540000-0x000002d40000
0x000002d40000-0x000003940000 : "netgear"
0x000003940000-0x000008000000 : "reserve"
0x000001340000-0x000002d40000 : "firmware"
m25p80 spi5.0: found pm25lv512, expected s25fl512s
m25p80 spi5.0: pm25lv512 (64 Kbytes)
ata1: SATA link down (SStatus 0 SControl 300)
UBI: attaching mtd6 to ubi0
UBI: physical eraseblock size:   131072 bytes (128 KiB)
UBI: logical eraseblock size:    126976 bytes
UBI: smallest flash I/O unit:    2048
UBI: VID header offset:          2048 (aligned 2048)
UBI: data offset:                4096
UBI: max. sequence number:       147
UBI: attached mtd6 to ubi0
UBI: MTD device name:            "netgear"
UBI: MTD device size:            12 MiB
UBI: number of good PEBs:        96
UBI: number of bad PEBs:         0
UBI: number of corrupted PEBs:   0
UBI: max. allowed volumes:       128
UBI: wear-leveling threshold:    4096
UBI: number of internal volumes: 1
UBI: number of user volumes:     7
UBI: available PEBs:             9
UBI: total number of reserved PEBs: 87
UBI: number of PEBs reserved for bad PEB handling: 2
UBI: max/mean erase counter: 4/1
UBI: image sequence number:  1907286847
UBI: background thread "ubi_bgt0d" started, PID 639
###### netgear
########## 712:mtd_erase() eraseing is not permitted .. retruning ##########
UBI error: ubi_init: cannot attach mtd6
GPIO Bitbanged MDIO: probed
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
ipq-dwc3 ipq-dwc3.0: unable to read platform data num of dbm eps
ipq-dwc3 ipq-dwc3.1: unable to read platform data num of dbm eps
xhci-hcd xhci-hcd.0: xHCI Host Controller
xhci-hcd xhci-hcd.0: new USB bus registered, assigned bus number 1
xhci-hcd xhci-hcd.0: irq 142, io mem 0x11000000
usb usb1: New USB device found, idVendor=1d6b, idProduct=0002
usb usb1: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb1: Product: xHCI Host Controller
usb usb1: Manufacturer: Linux 3.4.0 xhci-hcd
usb usb1: SerialNumber: xhci-hcd.0
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
xhci-hcd xhci-hcd.0: xHCI Host Controller
xhci-hcd xhci-hcd.0: new USB bus registered, assigned bus number 2
usb usb2: New USB device found, idVendor=1d6b, idProduct=0003
usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb2: Product: xHCI Host Controller
usb usb2: Manufacturer: Linux 3.4.0 xhci-hcd
usb usb2: SerialNumber: xhci-hcd.0
hub 2-0:1.0: USB hub found
hub 2-0:1.0: 1 port detected
xhci-hcd xhci-hcd.1: xHCI Host Controller
xhci-hcd xhci-hcd.1: new USB bus registered, assigned bus number 3
xhci-hcd xhci-hcd.1: irq 237, io mem 0x10000000
usb usb3: New USB device found, idVendor=1d6b, idProduct=0002
usb usb3: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb3: Product: xHCI Host Controller
usb usb3: Manufacturer: Linux 3.4.0 xhci-hcd
usb usb3: SerialNumber: xhci-hcd.1
hub 3-0:1.0: USB hub found
hub 3-0:1.0: 1 port detected
xhci-hcd xhci-hcd.1: xHCI Host Controller
xhci-hcd xhci-hcd.1: new USB bus registered, assigned bus number 4
usb usb4: New USB device found, idVendor=1d6b, idProduct=0003
usb usb4: New USB device strings: Mfr=3, Product=2, SerialNumber=1
usb usb4: Product: xHCI Host Controller
usb usb4: Manufacturer: Linux 3.4.0 xhci-hcd
usb usb4: SerialNumber: xhci-hcd.1
hub 4-0:1.0: USB hub found
hub 4-0:1.0: 1 port detected
usbcore: registered new interface driver usblp
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver libusual
tsens_tm_probe : TSENS early init not done.
tsens8960-tm: probe of tsens8960-tm failed with error -14
cpuidle: using governor ladder
cpuidle: using governor menu
Netfilter messages via NETLINK v0.30.
NAT Session Management application ports priority table is loaded!
nf_conntrack version 0.5.0 (3513 buckets, 14052 max)
ip_tables: (C) 2000-2006 Netfilter Core Team
TCP: cubic registered
NET: Registered protocol family 10
ip6_tables: (C) 2000-2006 Netfilter Core Team
IPv6 over IPv4 tunneling driver
NET: Registered protocol family 17
Bridge firewalling registered
Ebtables v2.0 registered
8021q: 802.1Q VLAN Support v1.8
VFP support v0.3: implementor 51 architecture 64 part 4d variant 2 rev 0
Registering SWP/SWPB emulation handler
clock_late_init: Removing enables held for handed-off clocks
MSM Watchdog Initialized
nss_fixup_platform_data: ART not found
no pmic restart interrupt specified
msm_cache_dump_probe: could not register L2 buffer ret = -22.
VFS: Mounted root (squashfs filesystem) readonly on device 31:5.
Freeing init memory: 1032K
UBIFS: recovery needed
###### netgear
###### netgear
###### netgear
###### netgear
###### netgear
###### netgear
###### netgear
###### netgear
###### netgear
###### netgear
###### netgear
###### netgear
UBIFS: recovery completed
UBIFS: mounted UBI device 0, volume 6, name "ubifs"
UBIFS: file system size:   5206016 bytes (5084 KiB, 4 MiB, 41 LEBs)
UBIFS: journal size:       1015809 bytes (992 KiB, 0 MiB, 6 LEBs)
UBIFS: media format:       w4/r0 (latest is w4/r0)
UBIFS: default compressor: lzo
UBIFS: reserved for root:  245892 bytes (240 KiB)
- preinit -
Press the [f] key and hit [enter] to enter failsafe mode
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0xb06c instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0xa22a instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000008: 0x14ce instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000000c: 0xb06c instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0xa42a instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000014: 0x3330 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x3733 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000001c: 0x3130 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000020: 0x3735 instead
jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000024: 0x3230 instead
jffs2: Further such events for this erase block will not be printed
jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes
jffs2: empty_blocks 9, bad_blocks 0, c->nr_blocks 10
switching to jffs2
- init -

Please press Enter to activate this console. NTFS driver 2.1.30 [Flags: R/O MODULE].
PPP generic driver version 2.4.2
nss_driver - fw of size -844522688  bytes copied to load addr: 40000000nss_driver - Turbo No Support 0
nss_driver - fw of size -845162624  bytes copied to load addr: 40800000nss_gmac: **********************************************************
nss_gmac: * Driver    :NSS GMAC Driver for RTL v(3.72a)
nss_gmac: * Version   :1.0
nss_gmac: * Copyright :Copyright (c) 2013 The Linux Foundation. All rights reserved.
nss_gmac: **********************************************************
nss_gmac: GMAC1(ccc31cc0) Invalid MAC@ - using ba:bb:bc:bd:be:bf
nss_gmac: GMAC2(ccc334c0) Invalid MAC@ - using ce:cf:d0:d1:d2:d3
gre: GRE over IPv4 demultiplexor driver
ip_gre: GRE over IPv4 tunneling driver
bonding: Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
NET: Registered protocol family 24
PPTP driver version 0.8.5
xt_time: kernel timezone is -0000
ctnetlink v0.93: registering with nfnetlink.
fuse init (API version 7.18)
sysinit: sh: .: line 6: can't open '/lib/functions/gpio-button-hotplug.sh'

parent cap:128, dev cap:256
Setting MPS to 128
PCI: enabling device 0000:01:00.0 (0144 -> 0146)
PCIe MSI Interrupt Enabled
qdpc_map_sysctl_regs() Mapping sysctl
BAR:0 vaddr=0xcfa80000 busaddr=08000000 offset=0 len=65536
qdpc_map_epmem() Mapping epmem
BAR:2 vaddr=0xcfaa0000 busaddr=08010000 offset=0 len=65536
qdpc_map_dma_regs() Mapping dma registers
BAR:3 vaddr=0xcfac0000 busaddr=08020000 offset=0 len=65536
qdpc-host version v36.6.0.23 Quantenna Communications Inc.
Tx Descriptor table: uncache virtual addr: 0xffdde000 paddr: 0x4e306000
Rx Descriptor table: uncache virtual addr: 0xffdde5a0 paddr: 0x4e3065a0
EP_handled_idx: uncache virtual addr: 0xffddf1a0 paddr: 0x4e3071a0
host0: Vmac Ethernet found
PCI memory is little endian
EP map start addr : 0x00000000, Host memory start : 0x41500000
Setting HOST ready...
Requested DMA mask:0xffffffff
EP FW load request...
Start download Firmware u-boot.bin...
FW Data[0]: VA:0xcfa67000 PA:0x4dd00000 Sz=68772..
done!
Image. Sz:68772 State:0xc
Image downloaded....!
Start booting EP...
PCI memory is little endian
DMA offset : 0xbeb00000, no need to reset the value.
Setting HOST ready...
Requested DMA mask:0xffffffff
EP FW load request...
Start download Firmware topaz-linux.lzma.img...
FW Data[0]: VA:0xd1001000 PA:0x4d100000 Sz=1048576..
done!
FW Data[1]: VA:0xd1101000 PA:0x4d100000 Sz=1048576..
done!
FW Data[2]: VA:0xd1201000 PA:0x4d100000 Sz=1048576..
done!
FW Data[3]: VA:0xd1301000 PA:0x4d100000 Sz=989250..
done!
Image. Sz:4134978 State:0xc
Image downloaded....!
Start booting EP...
EP boot successful, starting config...
Connection established with Target BBIC4 board
asf: module license 'Proprietary' taints kernel.
Disabling lock debugging due to kernel taint
ath_hal: 0.9.17.1 (AR5416, AR9380, WRITE_EEPROM, TX_DATA_SWAP, RX_DATA_SWAP, 11D)
ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved
ath_dfs: Version 2.0.0
Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved
ath_spectral: Version 2.0.0
Copyright (c) 2005-2009 Atheros Communications, Inc. All Rights Reserved
SPECTRAL module built on Sep  5 2014 21:20:48
ath_tx99: Version 2.0
Copyright (c) 2010 Atheros Communications, Inc, All Rights Reserved
ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved
ath_pci: 10.2.2.39.1 (Atheros/multi-bss)
ath_pci_probe
PCI device id is 003c :003c
PCI: enabling device 0000:03:00.0 (0140 -> 0142)
ath_pci 0000:03:00.0: ath DEBUG: sc=0xcce72c00

ol_ath_pci_configure : num_desired MSI set to 0

Using PCI Legacy Interrupt
__ol_ath_attach: ath_attach TODO
__ol_ath_attach 1272 host_enable 1
__ol_ath_attach: dev name wifi0
ol_ath_set_default_tgt_config : AC Minfree buffer allocation through module param (umac.ko)
OL_ACBKMinfree : 0
OL_ACBEMinfree : 0
OL_ACVIMinfree : 0
OL_ACVOMinfree : 0
ol_ath_attach() BMI inited.
ol_ath_attach() BMI Get Target Info.
ol_ath_attach() TARGET TYPE: 7 Vers 0x4100016c
NUM_DEV=1 FWMODE=0x2 FWSUBMODE=0x0 FWBR_BUF 0
ol_ath_attach() configure Target .
ol_transfer_bin_file 1787: Download Board data len 2116
ol_ath_download_firmware: Using 0x1234 for the remainder of init
ol_transfer_bin_file 1779: Download OTP data len 7208
ol_transfer_bin_file 1825: Download Firmware data len 228904
ol_ath_attach() Download FW.
ol_ath_attach() HT Create .
ol_ath_attach() HIF Claim.
ol_ath_attach() BMI Done.
ol_ath_attach() WMI attached. wmi_handle ccad0000
+HWT
CE_recv_buf_enqueue 653 Populate last entry 512 for CE 5
CE_recv_buf_enqueue 662 CE 5 wi 511 dest_ptr 0x4c549040 nbytes 0 recv_ctxt 0xccd71000
-HWT
HTC Service:0x0300 ep:1 TX flow control disabled
CE_pkt_dl_len_set CE 4 Pkt download length 64
ol_txrx_pdev_attach: 1424 tx desc's allocated ; range starts from cac40000
HTC Service:0x0100 ep:2 TX flow control disabled
wmi_service_ready_event_rx:  WMI UNIFIED SERVICE READY event
num_rf_chain : 00000003
ht_cap_info: : 0000085b
vht_cap_info : 338001b2
vht_supp_mcs : 0000ffea
LARGE_AP enabled. num_peers 144, num_vdevs 16, num_tids 256
idx 0 req 1  num_units 0 num_unit_info 2 unit size 444 actual units 145
chunk 0 len 64380 requested ,ptr  0x4c150000
FIRMWARE:P 145 V 16 T 443

FIRMWARE:_wlan_rtt_enable
wmi_ready_event_rx:  WMI UNIFIED READY event
ol_ath_connect_htc() WMI is ready
ol_ath_set_host_app_area TODO
target uses HTT version 2.1; host uses 2.1
ol_ath_attach() connect HTC.
bypasswmi : 0
ol_regdmn_start: reg-domain param: regdmn=0, countryName=, wModeSelect=FFFFFFFF, netBand=FFFFFFFF, extendedChanMode=0.
ol_regdmn_init_channels: !avail mode 0x680c (0x2) flags 0x2150
ol_regdmn_init_channels: !avail mode 0x680c (0x1) flags 0x140
ol_regdmn_init_channels: !avail mode 0x680c (0x20) flags 0xd0
ol_regdmn_init_channels: !avail mode 0x680c (0x40) flags 0x150
ol_regdmn_init_channels: !avail mode 0x680c (0x1000) flags 0x10100
ol_regdmn_init_channels: !avail mode 0x680c (0x8000) flags 0x20100
ol_regdmn_init_channels: !avail mode 0x680c (0x10000) flags 0x40100
ol_regdmn_init_channels: !avail mode 0x680c (0x20000) flags 0x100100
ol_regdmn_init_channels: !avail mode 0x680c (0x40000) flags 0x200100
ol_regdmn_init_channels: !avail mode 0x680c (0x80000) flags 0x400100
ol_regdmn_init_channels: !avail mode 0x680c (0x100000) flags 0x800100
ol_ath_phyerr_attach: called
OL Resmgr Init-ed
ol_if_spectral_setup
SPECTRAL : get_capability not registered
HAL_CAP_PHYDIAG : Capable
SPECTRAL : Need to fix the capablity check for RADAR (spectral_attach : 231)
SPECTRAL : get_capability not registered
HAL_CAP_RADAR   : Capable
SPECTRAL : Need to fix the capablity check for SPECTRAL
(spectral_attach : 236)
SPECTRAL : get_capability not registered
HAL_CAP_SPECTRAL_SCAN : Capable
SPECTRAL : get_tsf64 not registered
spectral_init_netlink 52 NULL SKB
Green-AP : Green-AP : Attached

Green-AP : Attached
ol_ath_smart_ant_attach: Hardware doest not support Smart Antenna.
ol_if_dfs_setup: called
ol_if_dfs_attach: called; ptr=cac79984, radar_info=cd985bd0
ol_ath_rtt_meas_report_attach: called
ol_ath_attach() UMAC attach .
ol_if_dfs_configure: called
ol_if_dfs_configure: FCC domain
ol_if_dfs_disable: called
ol_ath_attach: Calling ol_if_dfs_configure
ald_init_netlink NETLINK_KERNEL_CREATE FAILED
__ol_ath_attach: init tx/rx TODO
__ol_ath_attach: hard_header_len reservation 58
Initializing Pktlogs for 11ac
__sa_init_module
ADDRCONF(NETDEV_UP): eth1: link is not ready
device eth1 entered promiscuous mode
ADDRCONF(NETDEV_UP): br-lan: link is not ready
ADDRCONF(NETDEV_UP): eth0: link is not ready
FWLOG: [55758] WAL_DBGID_TX_AC_BUFFER_SET ( 0x3, 0x1e, 0x460, 0x460, 0x0 )
FWLOG: [55758] WAL_DBGID_TX_AC_BUFFER_SET ( 0x12, 0x1e, 0x460, 0x460, 0x0 )
FWLOG: [55758] WAL_DBGID_TX_AC_BUFFER_SET ( 0x45, 0x1e, 0x460, 0x460, 0x0 )
FWLOG: [55758] WAL_DBGID_TX_AC_BUFFER_SET ( 0x67, 0x1e, 0x460, 0x460, 0x0 )
FWLOG: [55763] WHAL_ERROR_RECV_STOPPCU ( 0x110298a, 0x3 )
FWLOG: [55763] WHAL_ERROR_RESET_PM (  )
ADDRCONF(NETDEV_CHANGE): eth1: link becomes ready
br-lan: port 1(eth1) entered forwarding state
br-lan: port 1(eth1) entered forwarding state
ADDRCONF(NETDEV_CHANGE): br-lan: link becomes ready
br-lan: port 1(eth1) entered forwarding state
device host0 entered promiscuous mode
br-lan: port 2(host0) entered forwarding state
br-lan: port 2(host0) entered forwarding state
###### netgear
###### netgear
br-lan: port 2(host0) entered forwarding state
###### netgear
sysinit: === Starting stateless slave configuration

sysinit: === Setting mode to ap

sysinit: complete

sysinit: === Running start-prod

sysinit: complete

sysinit: === Setting security parameters

sysinit: === Setting AP parameters

sysinit: complete

sysinit: === Starting wireless

sysinit: complete

sysinit: === Done setting up stateless slave

sysinit: cat: can't open '/etc/modules.d/33-qca-wifi*': No such file or directory

sysinit: 'wifi0' is disabled

sysinit: cat: can't open '/etc/modules.d/33-qca-wifi*': No such file or directory

sysinit: 'wifi0' is disabled

sysinit: cat: can't open '/etc/modules.d/33-qca-wifi*': No such file or directory

sysinit: 'wifi0' is disabled

sysinit: cat: can't open '/etc/modules.d/33-qca-wifi*': No such file or directory

sysinit: don't change mode

sysinit: wifi0

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: remote_ap_num:1

sysinit: Command failed: Operation not supported

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: QCS API error 22: Invalid argument

sysinit: complete

sysinit: complete

sysinit: complete

sysinit: complete

sysinit: complete

sysinit: complete

sysinit: complete

sysinit: complete

sysinit: complete

sysinit: complete

sysinit: /etc/rc.common: eval: line 1: can't create /sys/devices/system/cpu/cpufreq/ondemand/up_threshold_any_cpu_load: nonexistent directory

sysinit: /etc/rc.common: eval: line 1: can't create /sys/devices/system/cpu/cpufreq/ondemand/up_threshold_multi_core: nonexistent directory

sysinit: /etc/rc.common: eval: line 1: can't create /sys/devices/system/cpu/cpufreq/ondemand/optimal_freq: nonexistent directory

sysinit: /etc/rc.common: eval: line 1: can't create /sys/devices/system/cpu/cpufreq/ondemand/sync_freq: nonexistent directory

###### netgear
###### netgear
###### netgear

All we want is OpenWrt running on the main cpu, ie. ipq8064 that claims to be seated on a Qualcomm Atheros AP148 reference board.

Isn't there a way to implement the api provided by the QT3840BC/QSR1000 module? We don't need OpenWrt to run on that second cpu. All we want is that 5 GHz 4x4 ac greatness hooked up to OpenWrt.

Here's r7500 architecture:

http://koolshare.cn/data/attachment/for … wcmyvg.png

Taken from this extremely detailed Chinese page on koolshare.cn.

QSR1000 is like a PCI card.

Ah so the older kernel is for the QT wireless SoC/chipset while the IPQ8064 SoC/CPU uses kernel 3.4. Official AA was kernel 3.3. Would be interesting to know if Netgear's QoS is using fq_codel.

(Last edited by drawz on 30 May 2015, 04:05)

As I can see, R7500 is already running openwrt. You can get shell access using telnet enabler.

BusyBox v1.23.2 (2015-04-22 14:51:01 CEST) built-in shell (ash)

     MM           NM                    MMMMMMM          M       M
   $MMMMM        MMMMM                MMMMMMMMMMM      MMM     MMM
  MMMMMMMM     MM MMMMM.              MMMMM:MMMMMM:   MMMM   MMMMM
MMMM= MMMMMM  MMM   MMMM       MMMMM   MMMM  MMMMMM   MMMM  MMMMM'
MMMM=  MMMMM MMMM    MM       MMMMM    MMMM    MMMM   MMMMNMMMMM
MMMM=   MMMM  MMMMM          MMMMM     MMMM    MMMM   MMMMMMMM
MMMM=   MMMM   MMMMMM       MMMMM      MMMM    MMMM   MMMMMMMMM
MMMM=   MMMM     MMMMM,    NMMMMMMMM   MMMM    MMMM   MMMMMMMMMMM
MMMM=   MMMM      MMMMMM   MMMMMMMM    MMMM    MMMM   MMMM  MMMMMM
MMMM=   MMMM   MM    MMMM    MMMM      MMMM    MMMM   MMMM    MMMM
MMMM$ ,MMMMM  MMMMM  MMMM    MMM       MMMM   MMMMM   MMMM    MMMM
  MMMMMMM:      MMMMMMM     M         MMMMMMMMMMMM  MMMMMMM MMMMMMM
    MMMMMM       MMMMN     M           MMMMMMMMM      MMMM    MMMM
     MMMM          M                    MMMMMMM        M       M
       M
 ---------------------------------------------------------------
   For those about to rock... (%C, %R)
 ---------------------------------------------------------------
root@R7500:~# cat /etc/openwrt_version 
%V
root@R7500:~# uname -a
Linux R7500 3.4.0 #1 SMP Mon Dec 15 22:42:28 CST 2014 armv7l GNU/Linux
root@R7500:~# ps w
  PID USER       VSZ STAT COMMAND
    1 root      1412 S    init
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    6 root         0 SW   [migration/0]
    7 root         0 SW   [migration/1]
    9 root         0 SW   [ksoftirqd/1]
   10 root         0 SW<  [khelper]
   30 root         0 DW   [kworker/0:1]
  109 root         0 SW   [irq/202-msmdata]
  271 root         0 SW   [sync_supers]
  273 root         0 SW   [bdi-default]
  274 root         0 SW<  [kblockd]
  279 root         0 SW<  [ata_sff]
  283 root         0 SW<  [spi_qsd.5]
  286 root         0 SW   [msm-spi-thread]
  289 root         0 SW<  [spi_qsd.2]
  300 root         0 SW   [khubd]
  392 root         0 SW<  [modem_notifier]
  394 root         0 SW<  [smd_channel_clo]
  395 root         0 SW<  [smsm_cb_wq]
  420 root         0 SW<  [qmi]
  449 root         0 SW<  [nmea]
  451 root         0 SW<  [rpcrouter]
  467 root         0 SW   [kswapd0]
  512 root         0 SW   [fsnotify_mark]
  540 root         0 SW<  [smux_notify_wq]
  541 root         0 SW<  [smux_tx_wq]
  542 root         0 SW<  [smux_rx_wq]
  543 root         0 SW<  [smux_loopback_w]
  559 root         0 SW   [scsi_eh_0]
  574 root         0 SW   [mtdblock0]
  579 root         0 SW   [mtdblock1]
  584 root         0 SW   [mtdblock2]
  589 root         0 SW   [mtdblock3]
  594 root         0 SW   [mtdblock4]
  597 root         0 DW   [kworker/1:1]
  600 root         0 SW   [mtdblock5]
  605 root         0 SW   [mtdblock6]
  610 root         0 SW   [mtdblock7]
  615 root         0 SW   [mtdblock8]
  625 root         0 SW   [mtdblock9]
  639 root         0 SW   [ubi_bgt0d]
  646 root         0 SW   [mtdblock10]
  655 root         0 SW   [mtdblock11]
  664 root         0 SW   [mtdblock12]
  673 root         0 SW   [mtdblock13]
  682 root         0 SW   [mtdblock14]
  691 root         0 SW   [mtdblock15]
  700 root         0 SW   [mtdblock16]
  753 root         0 SW<  [iewq]
  754 root         0 DW   [kinteractiveup]
  763 root         0 SW<  [msm-cpufreq]
  767 root         0 SW<  [rq_stats]
  774 root         0 SW<  [deferwq]
 1227 root         0 SW   [ubifs_bgt0_6]
 1261 root      1448 S    {rcS} /bin/sh /etc/init.d/rcS S boot
 1264 root      1408 S    logger -s -p 6 -t sysinit
 1269 root      1412 S    init
 1286 root      1412 S    klogd
 1291 root      1228 S    /bin/datalib
 1318 root         0 SW<  [nss_freq_queue]
 1323 root         0 SW<  [gmac_workqueue]
 1337 root         0 SW<  [bond0]
 1631 root       912 S    /sbin/hotplug2 --override --persistent --set-rules-file /etc/hotplug2.rules --set-coldplug-cmd /sbin/udev
 1689 root       732 S    /sbin/ubusd
 2287 root         0 SW   [kworker/0:2]
 2319 root         0 SW   [ telnetDBGD ]
 2320 root         0 SW   [ acktelnetDBGD ]
 2321 root         0 SW   [checkSBusTimeou]
 2324 root         0 SW   [NU UDP]
 2325 root         0 SW   [NU TCP]
 2365 root       952 S    /usr/sbin/dnsmasq --except-interface=lo -r /tmp/resolv.conf
 2372 root         0 SW   [nss_connmgr_ipv]
 2374 root         0 SW   [nss_connmgr_ipv]
 2404 root       848 S    /usr/sbin/ntpclient
 2465 root       884 S    /usr/sbin/ntgrddns -c /tmp/ntgrdns.conf
 2480 root      1052 S    /usr/sbin/uhttpd -h /www -r R7500 -x /cgi-bin -t 60 -p 0.0.0.0:80 -C /tmp/uhttpd.crt -K /tmp/uhttpd.key -
 2483 root      1364 S    /usr/sbin/uhttpd -h /www -r R7500 -x /cgi-bin -t 60 -p 0.0.0.0:80 -C /tmp/uhttpd.crt -K /tmp/uhttpd.key -
 2485 root       668 S    inetd
 2492 root       844 S    acld
 2493 root       672 S    aclhijackdns
 2538 root      1416 S    syslogd -m 0 -T GMT-0 -c 1151
 2565 root      1416 S    crond -c /tmp/etc/crontabs -T GMT-0
 2571 root       676 S    /usr/bin/hd-idle -i 1800
 2695 root       684 S    udhcpc -b -i eth0 -h R7500 -r 109.173.106.165 -N 109.173.106.165
 2767 root      1300 S    /usr/sbin/dbus-daemon --system
 2784 root     13120 S    /sbin/KC_BONJOUR
 2785 root      5072 S    /sbin/KC_PRINT
 2797 root      1708 S    avahi-daemon: running [R7500.local]
 2800 root       840 S    potd
 2802 root       832 S    potval
 2857 root      5412 S N  /usr/sbin/afpd -F /etc/netatalk/afpd.conf -P /var/run/afpd.pid -c 7
 2864 root      1408 S    {check_time_mach} /bin/sh /usr/sbin/check_time_machine
 4682 root       860 S    /sbin/traffic_meter
 4685 root       836 S    /usr/bin/detcable 2
 6486 root         0 SW   [kworker/1:0]
 7840 root       680 S    qevt_client -h 1.1.1.2
 7879 root       756 S    udhcpd /tmp/udhcpd.conf
 7886 root       860 S    /usr/sbin/net-scan
 7907 root       888 S    /usr/sbin/miniupnpd
 7918 root       844 S    /usr/sbin/telnetenable
 7935 root       780 S    /usr/sbin/lld2d br0
 7963 root         0 SW   [kworker/u:0]
 9448 root         0 SW   [kworker/1:3]
10268 root         0 SW   [kworker/0:3]
10898 root      1068 R    dropbear
10899 root      1256 S    -ash
10912 root      1236 S    sleep 60
10920 root      1244 R    ps w
17419 root       684 S    /usr/sbin/utelnetd -d -i br0
17420 root      1424 S    /bin/ash --login
26580 root       976 S    dropbear
30229 root         0 SW   [kworker/u:1]
root@R7500:~# cat /proc/meminfo 
MemTotal:         225884 kB
MemFree:          176588 kB
Buffers:            2976 kB
Cached:             7128 kB
SwapCached:            0 kB
Active:             8904 kB
Inactive:           5408 kB
Active(anon):       4580 kB
Inactive(anon):      828 kB
Active(file):       4324 kB
Inactive(file):     4580 kB
Unevictable:           0 kB
Mlocked:               0 kB
HighTotal:             0 kB
HighFree:              0 kB
LowTotal:         225884 kB
LowFree:          176588 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          4228 kB
Mapped:             2696 kB
Shmem:              1200 kB
Slab:              23096 kB
SReclaimable:       2528 kB
SUnreclaim:        20568 kB
KernelStack:         952 kB
PageTables:          860 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:      225884 kB
Committed_AS:      33320 kB
VmallocTotal:     786432 kB
VmallocUsed:       78284 kB
VmallocChunk:     573484 kB
root@R7500:~# cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00c80000 00020000 "qcadata"
mtd1: 00500000 00020000 "APPSBL"
mtd2: 00080000 00020000 "APPSBLENV"
mtd3: 00140000 00020000 "ART"
mtd4: 00200000 00020000 "kernel"
mtd5: 01800000 00020000 "rootfs"
mtd6: 00c00000 00020000 "netgear"
mtd7: 046c0000 00020000 "reserve"
mtd8: 01a00000 00020000 "firmware"
mtd9: 00010000 00001000 "m25p80"
mtd10: 0003e000 0001f000 "ART.bak"
mtd11: 0001f000 0001f000 "cert"
mtd12: 0001f000 0001f000 "config"
mtd13: 0005d000 0001f000 "pot"
mtd14: 00136000 0001f000 "language"
mtd15: 001b2000 0001f000 "traffic_meter"
mtd16: 0060e000 0001f000 "ubifs"
root@R7500:~# cat /rom/etc/opkg.conf 
src/gz attitude_adjustment http://downloads.openwrt.org/attitude_adjustment/12.09-rc1/ipq806x/generic/packages
dest root /
dest ram /tmp
lists_dir ext /var/opkg-lists
option overlay_root /overlay

Some networking details:

root@R7500:~# ip li
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN mode DEFAULT 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: sit0: <NOARP> mtu 1480 qdisc noop state DOWN mode DEFAULT 
    link/sit 0.0.0.0 brd 0.0.0.0
3: qca-nss-dev0: <> mtu 0 qdisc noop state DOWN mode DEFAULT 
    link/generic 
4: qca-nss-dev1: <> mtu 0 qdisc noop state DOWN mode DEFAULT 
    link/generic 
5: qca-nss-dev2: <> mtu 0 qdisc noop state DOWN mode DEFAULT 
    link/generic 
6: qca-nss-dev3: <> mtu 0 qdisc noop state DOWN mode DEFAULT 
    link/generic 
7: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT qlen 1000
    link/ether 6c:b0:ce:xx:xx:xx brd ff:ff:ff:ff:ff:ff
8: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP mode DEFAULT qlen 1000
    link/ether 6c:b0:ce:xx:xx:xx brd ff:ff:ff:ff:ff:ff
10: ifb0: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT qlen 32
    link/ether be:9b:fe:xx:xx:xx brd ff:ff:ff:ff:ff:ff
11: ifb1: <BROADCAST,NOARP> mtu 1500 qdisc noop state DOWN mode DEFAULT qlen 32
    link/ether b2:2e:65:xx:xx:xx brd ff:ff:ff:ff:ff:ff
12: bond0: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noop state DOWN mode DEFAULT 
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
13: host0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UNKNOWN mode DEFAULT qlen 256
    link/ether ea:6b:55:xx:xx:xx brd ff:ff:ff:ff:ff:ff
14: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT 
    link/ether 6c:b0:ce:xx:xx:xx brd ff:ff:ff:ff:ff:ff
17: wifi0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN mode DEFAULT qlen 539
    link/ieee802.11 6c:b0:ce:xx:xx:xx brd ff:ff:ff:ff:ff:ff
root@R7500:~# ip a sh up
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
7: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether 6c:b0:ce:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet xx.xx.xx.xx/24 brd xx.xx.xx.xx scope global eth0
    inet6 fe80::6eb0:ceff:fexx:xxxx/64 scope link 
       valid_lft forever preferred_lft forever
8: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP qlen 1000
    link/ether 6c:b0:ce:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet6 fe80::6eb0:ceff:fexx:xxxx/64 scope link 
       valid_lft forever preferred_lft forever
13: host0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UNKNOWN qlen 256
    link/ether ea:6b:55:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet6 fe80::e86b:55ff:fexx:xxxx/64 scope link 
       valid_lft forever preferred_lft forever
14: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP 
    link/ether 6c:b0:ce:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 1.1.1.1/29 brd 1.1.1.7 scope global br0:1
    inet xx.xx.xx.xx/24 brd xx.xx.xx.xx scope global br0
    inet6 xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/64 scope global dynamic 
       valid_lft 3069sec preferred_lft 3069sec
    inet6 fe80::6eb0:ceff:fexx:xxxx/64 scope link 
       valid_lft forever preferred_lft forever
17: wifi0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 539
    link/ieee802.11 6c:b0:ce:xx:xx:xx brd ff:ff:ff:ff:ff:ff
root@R7500:~# ls -l /sys/class/net/br0/brif/
lrwxrwxrwx    1 root     root             0 May 30 09:11 eth1 -> ../../eth1/brport
lrwxrwxrwx    1 root     root             0 May 30 09:11 host0 -> ../../../../pci0000:00/0000:00:00.0/0000:01:00.0/net/host0/brport

Now let's access the quantenna part:

root@R7500:~# telnet 1.1.1.2

Entering character mode
Escape character is '^]'.

soc1 login: admin


BusyBox v1.10.3 (2014-12-15 16:00:22 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

quantenna # cat /proc/version 
Linux version 2.6.35.12 (gary@debian) (gcc version 4.2.1 (ARC_2.3)) #2 Mon Dec 15 16:05:36 CST 2014
quantenna # cat /proc/mtd 
dev:    size   erasesize  name
mtd0: 00005000 00001000 "uboot"
mtd1: 00006000 00001000 "uboot_env"
mtd2: 00005000 00001000 "data"
quantenna # cat /proc/meminfo 
MemTotal:          53456 kB
MemFree:           29760 kB
Buffers:               0 kB
Cached:            14008 kB
SwapCached:            0 kB
Active:             8824 kB
Inactive:           7440 kB
Active(anon):       2408 kB
Inactive(anon):       80 kB
Active(file):       6416 kB
Inactive(file):     7360 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:             0 kB
SwapFree:              0 kB
Dirty:                 0 kB
Writeback:             0 kB
AnonPages:          2272 kB
Mapped:             1864 kB
Shmem:               232 kB
Slab:               5280 kB
SReclaimable:        512 kB
SUnreclaim:         4768 kB
KernelStack:         272 kB
PageTables:          616 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:       26728 kB
Committed_AS:      14352 kB
VmallocTotal:      49152 kB
VmallocUsed:        1024 kB
VmallocChunk:      32944 kB
quantenna # ip li
1: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: tqe: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
3: pcie0: <BROADCAST,MULTICAST,UP,10100> mtu 1500 qdisc qdrv_sch_red qlen 256
    link/ether 22:26:86:xx:xx:xx brd ff:ff:ff:ff:ff:ff
4: tqe_pcie: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
5: br0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue 
    link/ether 22:26:86:xx:xx:xx brd ff:ff:ff:ff:ff:ff
7: wifi0: <BROADCAST,MULTICAST,UP,10100> mtu 1500 qdisc qdrv_tx_sch qlen 1024
    link/ether 6c:b0:ce:xx:xx:xx brd ff:ff:ff:ff:ff:ff
quantenna # ip a
1: lo: <LOOPBACK,UP,10000> mtu 16436 qdisc noqueue 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: tqe: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
3: pcie0: <BROADCAST,MULTICAST,UP,10100> mtu 1500 qdisc qdrv_sch_red qlen 256
    link/ether 22:26:86:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet6 fe80::2026:86ff:fexx:xxxx/64 scope link 
       valid_lft forever preferred_lft forever
4: tqe_pcie: <BROADCAST,MULTICAST> mtu 1500 qdisc noop qlen 1
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
5: br0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc noqueue 
    link/ether 22:26:86:xx:xx:xx brd ff:ff:ff:ff:ff:ff
    inet 1.1.1.2/8 brd 1.255.255.255 scope global br0
    inet6 xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx/64 scope global dynamic 
       valid_lft 3417sec preferred_lft 3417sec
    inet6 fe80::2026:86ff:fexx:xxxx/64 scope link 
       valid_lft forever preferred_lft forever
7: wifi0: <BROADCAST,MULTICAST,UP,10100> mtu 1500 qdisc qdrv_tx_sch qlen 1024
    link/ether 6c:b0:ce:xx:xx:xx brd ff:ff:ff:ff:ff:ff
quantenna # cat /proc/modules 
wlan_scan_ap 8108 0 - Live 0x861c0000
wlan_tkip 9596 0 - Live 0x86250000
wlan_ccmp 5844 0 - Live 0x86338000
wlan_xauth 676 0 - Live 0x86256c00
qdrv 521524 0 - Live 0x86480000
qvspmod 65696 1 qdrv, Live 0x86340000 (P)
radar 104272 1 qdrv, Live 0x863a0000 (P)
auc_fw 4220 1 qdrv, Live 0x8788c040 (P)
wlan 390900 6 wlan_scan_ap,wlan_tkip,wlan_ccmp,wlan_xauth,qdrv, Live 0x86400000
pm_interval 4872 0 - Live 0x86140000
qtsens 1732 1 qdrv, Live 0x86241000
i2cbus 2824 1 - Live 0x86194000
qtn_debug 888 2 qdrv,radar, Live 0x86257000
qdpc_pcie 26844 1 - Live 0x86258000 SRAM 88017c40 size 6596
fwt_ctrl 125336 2 qdrv,qdpc_pcie, Live 0x861e0000 (P)
switch_tqe 15308 4 qdrv,wlan,qdpc_pcie,fwt_ctrl, Live 0x861d4000
fwt_if 4248 1 fwt_ctrl, Live 0x8788e640
dpi 6884 0 - Live 0x86138000
emaclib 19008 2 qdrv,qvspmod, Live 0x861b8000
rtl8367b 166916 1 emaclib, Live 0x86200000 (P)
bootcfg 36084 2 qdrv,radar, Live 0x861a0000
quantenna # ip ro
1.0.0.0/8 dev br0  src 1.1.1.2 
239.0.0.0/8 dev br0 
127.0.0.0/8 dev lo 
quantenna # mount
rootfs on / type rootfs (rw)
proc on /proc type proc (rw,relatime)
/dev/mtdblock2 on /mnt/jffs2 type jffs2 (rw,relatime)
devpts on /dev/pts type devpts (rw,relatime,gid=5,mode=620)
tmpfs on /tmp type tmpfs (rw,relatime)
sysfs on /sys type sysfs (rw,relatime)
quantenna # cat /proc/cmdline 
console=ttyS0,115200n8 earlyprintk=1 hw_config_id=65535
quantenna # cat default_config.txt 
mode=ap&bw=80&vht=1&region=none&channel=0&bf=1&pwr=19&scs=1&vsp=0&band=11ac
quantenna # ps w
  PID USER       VSZ STAT COMMAND
    1 root      1712 S    init  
    2 root         0 SW   [kthreadd]
    3 root         0 SW   [ksoftirqd/0]
    4 root         0 SW   [events/0]
    5 root         0 SW   [khelper]
    6 root         0 SW   [async/mgr]
    7 root         0 SW   [ruby_pm/0]
    8 root         0 SW   [sync_supers]
    9 root         0 SW   [bdi-default]
   10 root         0 SW   [kblockd/0]
   11 root         0 SW   [kswapd0]
   12 root         0 SW   [mtdblock0]
   13 root         0 SW   [mtdblock1]
   14 root         0 SW   [mtdblock2]
   38 root         0 SWN  [jffs2_gcd_mtd2]
   49 daemon    1152 S    portmap 
  164 root      1712 S    /usr/sbin/inetd 
  258 root      1336 S    iwevent --syslog 
  259 root      1328 S    qevt_server 
  734 root      2688 S    /sbin/mini_httpd -r -u root -C /mnt/jffs2/minihttpd.conf 
  765 root      1704 S    /bin/sh /scripts/cmdloop /sbin/qcsapi_rpcd --tcp 
  766 root      1704 S    /bin/sh /scripts/cmdloop /sbin/qcsapi_rpcd --pcie 
  767 root      1704 S    /bin/sh /scripts/cmdloop /sbin/call_qcsapi_rpcd --tcp 
  773 root      1960 S    /sbin/qcsapi_rpcd --tcp 
  774 root      1888 S    /sbin/qcsapi_rpcd --pcie 
  775 root      1880 S    /sbin/call_qcsapi_rpcd --tcp 
  798 root      1720 S    /bin/sh -l 
  799 root      1704 S    /sbin/syslogd -n -i eth1_0 -L -m 0 
  800 root      1696 S    /sbin/klogd -n 
  919 root         0 SW   [mlmestats]
 1583 root      2840 S    hostapd -B /tmp//hostapd.conf 
 1630 root      1704 S    /usr/sbin/telnetd 
 1631 root      1720 S    -sh 
 1651 root      1704 R    ps w 
quantenna # find /var/www/ -iname '*.php'
/var/www/tools_power.php
/var/www/config_wireless.php
/var/www/tools_logs.php
/var/www/login.php
/var/www/status_wireless.php
/var/www/config_wds.php
/var/www/config_wps_info.php
/var/www/tools_command.php
/var/www/config_networking.php
/var/www/config_aplist.php
/var/www/diag_d.php
/var/www/assoc_table.php
/var/www/index.php
/var/www/system_reboot.php
/var/www/status_networking.php
/var/www/config_macfilter.php
/var/www/system_rebooted.php
/var/www/readdec.php
/var/www/common.php
/var/www/tools_restore.php
/var/www/hidden.php
/var/www/system_upgrade.php
/var/www/diag_s.php
/var/www/tools_ubootinfo.php
/var/www/tools_admin.php
/var/www/dump_hang.php
/var/www/status_device.php
/var/www/config_wps.php
/var/www/list_mac_address.php
/var/www/status_mbss.php
/var/www/tools_log.php
/var/www/soc_event_cntr.php
/var/www/help/privacypolicy.php
/var/www/help/h_mbss.php
/var/www/help/h_hidden.php
/var/www/help/h_power.php
/var/www/help/aboutus.php
/var/www/help/terms.php
/var/www/help/h_mac_list.php
/var/www/help/h_networking.php
/var/www/help/h_wds.php
/var/www/help/h_wireless_conf.php
/var/www/help/contactus.php
/var/www/config_mbss.php
/var/www/status_wds.php
quantenna # cat /release.txt  
Base release V. build 
gary@debian on Mon Dec 15 16:05:18 CST 2014
quantenna # cat /log.txt 
tc_prio: do qdisc. dev: pcie0
tc_prio: do qdisc. dev: pcie0
tc_prio: do qdisc. dev: pcie0
quantenna # ls /scripts/
addba                                 enable_11h                            parsedump_sections                    set_wps_pin
addon_version                         enable_bf                             pcap                                  set_zero_dbm
aggoff                                enable_dyn_rtscts                     pcie_dump                             setmcs
aggon                                 enable_large_mtu                      pdtuner_setup                         setup-nospi
ap_calib                              enable_ldpc                           pg0_csum                              sgiauto
backup_bootcfg                        enable_n40only_mode                   platform_id                           sgioff
bcn_off                               enable_telnet                         power_switch                          sgion
bfctrl                                enable_txpow_cal                      program_fft_size                      show_assoc_table
bfinfo                                enable_vco_cal                        put_temp_thresh                       show_gpio_config
bfoff                                 eth_cnt                               qbr                                   show_pd_voltage_table
bfon                                  gain_adapt_enable                     qcal.rf                               show_rssi_level
bgscan                                gather_info                           qdrvcmd                               show_security_config
build_config                          generate_default_passphrase           ql                                    show_test_packet
cal_file_rev_num                      generate_default_ssid                 qpm_setup                             show_transmit_power
capture_bf_factor                     get_11h                               qtn_wds_ext.sh                        show_tx_power_table
carrier_convert                       get_board_config                      qvlan                                 slow_agc_tab
carrier_process                       get_bootval                           radardebug                            sniffer
carrier_setup                         get_config                            ratedebug                             sta_calib
carve_env_partition.sh                get_debug_flag                        rc_cal                                start-bb_only
check_wps                             get_key                               read_bb_pair                          start-cal
clr_wps                               get_linux_image_tftp                  read_bond_opt                         start-helpers.sh
cmdloop                               get_per_ssid_config                   read_temperature                      start-np
config_qtn_regulatory_db              get_phy_stats                         readmem                               start-ntpclient
configure_bootcfg_qbox710             get_rev_num                           readmem_dec                           start-prod
configure_bootcfg_quantenna           get_rfic_version                      readmem_multi                         start-qharvestd
configure_tx_power_limit              get_rx_gain                           readrfmem                             start-stateless
copy_cal_file_to_bootarea             get_rx_stats                          remote_command                        start-stateless-slave
copy_live_image_over_safety           get_tx_power                          remove_mac_addr                       start-vap
cpumon                                get_tx_stats                          restore_bootcfg                       stateless_slave_config
create_region_tx_power                get_wds_peer_list                     restore_default_config                stats
create_tx_power_info                  get_wifi_config                       rev_num                               stop_cw_signal
dbg                                   getcrc                                rfenable                              stop_test_packet
dbgbus                                hostapd-no-bridge.conf                rfstatus                              stubmac_non_zero_data_tx
dc_cal                                hostapd.conf                          rifs_mode_off                         stubmac_sec_disable
dc_iq.cal                             hw_options_to_board_id_mapping.sh     rifs_mode_on                          stubmac_sec_enable
dc_measure                            hwcount                               rld_wlandrv                           sysmsgdebug
debug-qdrv                            ifcfg.sh                              ruby-cal                              tc_prio
debug_dfs                             info                                  ruby-qvlan                            tell_pd_voltage_level
debug_hang                            int_testing                           run_bb                                topaz-cal
debuglevel                            is_two_by_four_board                  run_internal_cal                      topaz-qvlan
default_calib_data                    iwedebug                              run_internal_cal_envy2                transmit_file
delba                                 killwpa                               run_internal_cal_two_tx               trig_reset
delete_dciq_cal_bootcfg               lap                                   run_multi_tap_rx_iq                   tx_iq
delete_hw_board_config                load-qdrv                             run_multi_tap_rx_iq_delay_only        tx_lo
delete_hw_board_database              load_per_ssid_config                  run_multi_tap_rx_iq_delay_only_2Rx    tx_pow_cal
delete_pd_power_cal                   load_wds_config                       run_multi_tap_rx_iq_delay_only_40MHz  tx_power_QSR1000_au.txt
delete_regulatory_database            logmsg                                run_multi_tap_rx_iq_fft_buffer        tx_power_QSR1000_ca.txt
delete_rxiq_cal                       lsta                                  run_rxiq_12                           tx_power_QSR1000_cn.txt
delete_txpower_cal_bootcfg            m1                                    run_rxiq_34                           tx_power_QSR1000_eu.txt
dhclient_restart                      mac_setlocal                          save_sta_ssid                         tx_power_QSR1000_jp.txt
disable_11ac                          make_pd_power_cal_file                send_cw_signal                        tx_power_QSR1000_ru.txt
disable_11h                           make_txpwr_file                       send_cw_signal_4chain                 tx_power_QSR1000_us.txt
disable_ldpc                          make_txpwr_file_rfic4                 send_test_packet                      txdone_ctrl_post
disable_n40only_mode                  manage_rfcal_data                     set_11ac_mcs                          txdone_ctrl_pre
disp_link_qual                        md                                    set_ack_policy                        txpower.cal
display_tx_power_limit                mem                                   set_ad                                unload
do_backup_env.sh                      memdebug                              set_avail_chans                       update_bootcfg_file
dscp                                  mlmestats_stress_read                 set_bf_mcs                            update_image_flash
dump                                  monitor_log                           set_bootval                           update_per_ssid_config
dump_bb_mac_regs                      monitor_temperature                   set_chan_ocac                         update_ssid_param
dump_ctrl_pktmem                      mount_data_partition                  set_channel_by_calcmd                 update_tx_power_limit
dump_mac_bb_debug                     msdu_expire_off                       set_debug_flag                        update_wifi_config
dump_mac_regs                         msdu_expire_on                        set_default_generated                 user_mtest
dump_mem                              mtd_mknod                             set_dump_pkt_len                      validate_image
dump_mem_hang_check                   muc_crash_save_dmesg                  set_gain                              verify_tx_power_limit
dump_mem_mac                          muc_memmap                            set_macaddrs                          vmac
dump_pktm                             muc_profile_off                       set_max_agglen                        vsp
dump_tcm                              muc_profile_on                        set_muc_partnum                       vsp_load_profile
dumpdma                               mw                                    set_nodfs_chans_us                    vsp_profile.gcn
dumpfctl                              netdebug                              set_regulatory_power                  vsp_profile.ns
dumpirq                               node_power_level                      set_rx_gain                           wpa_supplicant.conf
dumpmuc                               non_wps_pair_remove                   set_sys_status                        wpa_supplicant.conf.wps
dumprrt                               ocac_airtime30                        set_test_mode                         write_bb_pair
dumptx                                ocac_testmode                         set_tx_bb_gain                        write_multi_tap_rx_coefs
dynamic_tx_lo                         pairing_id_script                     set_tx_pow                            writemem
eirp_info.txt                         parse_cmdline                         set_tx_rf_gain                        writerfmem
enable_11ac                           parse_per_ssid_param                  set_tx_test_pow                       xmit
quantenna # netstat -ln 
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 1.1.1.2:49152           0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:3490            0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:950             0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:23              0.0.0.0:*               LISTEN      
tcp        0      0 0.0.0.0:952             0.0.0.0:*               LISTEN      
tcp        0      0 :::80                   :::*                    LISTEN      
tcp        0      0 :::443                  :::*                    LISTEN      
udp        0      0 0.0.0.0:49300           0.0.0.0:*                           
udp        0      0 0.0.0.0:50376           0.0.0.0:*                           
udp        0      0 0.0.0.0:1900            0.0.0.0:*                           
udp        0      0 0.0.0.0:111             0.0.0.0:*                           
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path

List of running modules:

root@R7500:/sys/module# ls
8021q                   ehci_hcd                mpm                     nf_nat_ftp              rpm_master_stat         usblp
8250                    event_timer             msm8960_tsens           nf_nat_h323             rpm_regulator           userwakelock
GPL_NetUSB_02           fuse                    msm_bus_core            nf_nat_irc              rpm_resources           vt
NetUSB_02               hst_tx99                msm_serial_hs           nf_nat_pptp             rpm_stats               wlan_ext
acpuclock_krait         ifb                     msm_show_resume_irq     nf_nat_proto_gre        saw_regulator           xhci_hcd
adf                     ip6_queue               msm_thermal             nf_nat_sip              scm_pas                 xt_CLASSIFY
asf                     ip6t_CONE               msm_watchdog            nf_nat_snmp_basic       scsi_mod                xt_CT
ath_dev                 ip6t_ah                 n_smux                  nf_nat_tftp             sd_mod                  xt_HL
ath_dfs                 ip6t_eui64              nf_conntrack            nls_cp437               slhc                    xt_comment
ath_hal                 ip6t_frag               nf_conntrack_amanda     nls_iso8859_1           smd                     xt_connbytes
ath_pktlog              ip6t_hbh                nf_conntrack_broadcast  ntfs                    smd_pkt                 xt_ecn
ath_rate_atheros        ip6t_mh                 nf_conntrack_dnih323    pcie                    smd_rpcrouter           xt_helper
ath_spectral            ip6t_rt                 nf_conntrack_dnirtsp    peripheral_loader       smd_tty                 xt_hl
block                   ip6table_raw            nf_conntrack_ftp        pm_8x60                 smem_log                xt_layer7
bonding                 ipt_CONENAT             nf_conntrack_h323       ppp_async               smux_ctl                xt_owner
bridge                  ipt_ECN                 nf_conntrack_ipv4       ppp_generic             spi_qsd                 xt_physdev
clbr                    ipt_NETGEAR_REJECT      nf_conntrack_ipv6       pppoe                   spm_v2                  xt_pkttype
cpuidle                 ipt_TRIGGER             nf_conntrack_irc        pppox                   spurious                xt_quota
crc_ccitt               ipt_dnshijack           nf_conntrack_pptp       pptp                    tcp_cubic               xt_recent
dwc3                    ipt_spiDoS              nf_conntrack_proto_gre  printk                  timer                   xt_statistic
dwc3_ipq                ipt_spiadvDoS           nf_conntrack_sip        qca_nss_connmgr_ipv4    tz_log                  xt_tcpmss
ebt_802_3               ipt_urlBlock            nf_conntrack_snmp       qca_nss_connmgr_ipv6    ubi                     xt_time
ebt_among               ipv6                    nf_conntrack_tftp       qca_nss_drv             ubifs                   xz_dec
ebt_limit               kernel                  nf_defrag_ipv6          qca_nss_gmac            ufsd
ebt_pkttype             keyboard                nf_nat_STARCRAFT        qdpc_host               umac
ebt_stp                 l2tp                    nf_nat_amanda           rcutree                 usb_libusual
ebt_vlan                libahci                 nf_nat_dnih323          restart                 usb_storage
ebtable_nat             libata                  nf_nat_dnirtsp          rpm_log                 usbcore

While searching the web for strings of /etc/banner, I found this:
https://www.codeaurora.org/patches/external/qca/

Some more info on the firmware:

root@R7500:/etc# cat /firmware_version 
V1.0.0.82
root@R7500:/etc# cat /hardware_version 
R7500
root@R7500:/etc# cat /module_name 
R7500
root@R7500:/etc# cat /hw_id 
29764841+0+128+256+3x3+4x4

Case closed, then:

1. Install NETGEAR stock firmware 1.0.0.82 from http://support.netgear.com/product/R7500

2. Run telnetenable available from http://www.myopenrouter.com/article/tel … gear-r7500 (myOpenRouter is really NETGEAR somehow)

3. Install binary Attitude Adjustment packages using opkg

Plan B is: user nickf successfully compiled AA packages that ran on stock 1.0.0.82 https://forum.openwrt.org/viewtopic.php … 63#p272863

This is so awesome!

I have found the source tree for R7500: http://www.downloads.netgear.com/files/ … pl_src.zip

I have built a test version of openwrt CC for R7500, please test.
http://188.65.210.25/~kmeaw/netgear-cc-uImage

To run:
1) set up a DHCP+TFTP server on your network;
2) hook up serial to the main CPU;
3) power on the router, abort the autobooting process by pressing any key;
4) run "dhcp" command;
5) run "tftp netgear-cc-uImage";
6) run "bootm";
7) when openwrt preinit environment starts, enter failsafe mode (press 'f' and enter).

My build overlay is available on github.

re-uploaded another version of netgear-cc-uImage. Now it has a working VLAN support - "swconfig dev eth1 vlan 1 set ports '0 1 2 3 4 5 6' && swconfig dev eth1 set apply" to enable. Also have compiled backported ath10k wireless module, but haven't figured what to do with firmware yet.

(Last edited by kmeaw on 21 Jun 2015, 10:13)

Will this inexpensive PL2303 USB To RS232 TTL Converter Adapter Module with PL2303HX or this USB To RS232 TTL UART PL2303HX Auto Converter work?

Sure, it will. Mostly anything on PL2303, FT232 or CP210x chips would be fine.

Thank you.

Am I reading this thread correctly? The R7500 is already running OpenWRT stock, out of the factory? I can just enable telnet and opkg install any OpenWRT packages I want that didn't ship as standard?

What is the quantenna part that is telnettable to from the main firmware? Is that to say there is a whole separate "machine" on it running the 5GHz WiFi connectivity, bridged over a virtual interface to the primary machine?