Atheros Reference AP135

The AP135 is a Qualcomm Atheros reference board, with:

• QCA9558 SoC (Scorpion) - 720MHz MIPS74kc; 600MHz DDR2 RAM; 3x3 2GHz 11n wifi;
• 128MiB RAM;
• 16MiB NOR flash (boot);
• 128MiB NAND flash;
• AR8327 ethernet switch;
• QCA9880v2 3x3 11ac PCIe NIC.

The five switch ports are connected to the AR8327:

• port 1-4 LAN map to AR8327 port 1-4
• port 5 (WAN) maps to AR8327 port 5
• SoC arge1 (GMAC0) maps to the AR8327 CPU port (GMAC0)
• SoC arge0 (GMAC1) maps to the AR8327 GMAC6

The initial boot information and environment is as follows:

U-Boot 1.1.4 (Aug 26 2013 - 16:55:16)

ap135 - Scorpion 1.0DRAM:  
sri
Scorpion 1.0
ath_ddr_initial_config(200): (32bit) ddr2 init
tap = 0x00000003
Tap (low, high) = (0x3, 0x20)
Tap values = (0x11, 0x11, 0x11, 0x11)
128 MB
Top of RAM usable for U-Boot at: 88000000
Reserving 204k for U-Boot at: 87fcc000
Reserving 192k for malloc() at: 87f9c000
Reserving 44 Bytes for Board Info at: 87f9bfd4
Reserving 36 Bytes for Global Data at: 87f9bfb0
Reserving 128k for boot params() at: 87f7bfb0
Stack Pointer at: 87f7bf98
Now running in RAM - U-Boot at: 87fcc000
Flash Manuf Id 0x1, DeviceId0 0x20, DeviceId1 0x18
flash size 16MB, sector count = 256
Flash: 16 MB
*** Warning *** : PCIe WLAN Module not found !!!
In:    serial
Out:   serial
Err:   serial
Net:   ath_gmac_enet_initialize...
athrs_sgmii_res_cal: cal value = 0xe
Fetching MAC Address from 0x87fee1fc
Fetching MAC Address from 0x87fee1fc
ath_gmac_enet_initialize: reset mask:c02200 
Scorpion  ----> S17 PHY *
Vlan config...
s17 phy0 register value 0x00004140
TEST: FINAL REG VAL after TX Calibration - 0x46000000
TEST: FINAL XMII VAL after RX Calibration - 0x56000000
TEST: FINAL ETH_CFG VAL after RX Calibration - 0x00014001
athrs17_reg_init: complete
: cfg1 0x80000000 cfg2 0x7335
eth0: 00:03:7f:11:38:4f
eth0 up
athrs17_reg_init_wan done
SGMII in forced mode
athr_gmac_sgmii_setup SGMII done
: cfg1 0x800c0000 cfg2 0x7214
eth1: 00:03:7f:11:38:50
eth1 up
eth0, eth1
Setting 0x18116290 to 0x458ba14f
Hit any key to stop autoboot:  0 
ath> printenv
bootargs=console=ttyS0,115200 root=31:02 rootfstype=jffs2 init=/sbin/init mtdparts=ath-nor0:256k(u-boot),64k(u-boot-env),6336k(rootfs),1408k(uImage),8256k(mib0),64k(ART)
bootcmd=bootm 0x9f680000
bootdelay=2
baudrate=115200
ethaddr=0x00:0xaa:0xbb:0xcc:0xdd:0xee
dir=
lu=tftp 0x80060000 ${dir}u-boot.bin&&erase 0x9f000000 +$filesize&&cp.b $fileaddr 0x9f000000 $filesize
lf=tftp 0x80060000 ${dir}ap135${bc}-jffs2&&erase 0x9f050000 +0x630000&&cp.b $fileaddr 0x9f050000 $filesize
lk=tftp 0x80060000 ${dir}vmlinux${bc}.lzma.uImage&&erase 0x9f680000 +$filesize&&cp.b $fileaddr 0x9f680000 $filesize
ethact=eth0
ipaddr=192.168.2.1
serverip=192.168.2.10
stdin=serial
stdout=serial
stderr=serial

Environment size: 685/65532 bytes
ath> 

Building FreeBSD

Check out the build scripts, then check out FreeBSD-HEAD, then cd into your FreeBSD-HEAD checkout, and:

$ sudo mkdir /tftpboot ; sudo chown (yourusername) /tftpboot $ /path/to/build/bin/build ap135 $

The tftpboot kernel (kernel.AP135); compressed kernel (kernel.AP135.lzma.uImage) and compressed rootfs (mfsroot-ap135.img.lzma) are placed in /tftpboot/.

Flashing the unit

The kernel is larger than the provided flash image size, so we're going to ignore the flash layout expected and instead do our own.

We'll erase the flash out to cover a 2MB kernel and 6MB rootfs image and then we'll reset the boot environment to boot from that new location.

ath> erase 0x9f050000 +0x800000
Erasing flash... 
First 0x5 last 0x84 sector size 0x10000
 132
Erased 128 sectors

Copy over the kernel:

ath> tftpboot 0x80050000 kernel.AP135.lzma.uImage
Trying eth0
dup 1 speed 1000
Using eth0 device
TFTP from server 192.168.2.10; our IP address is 192.168.2.1
Filename 'kernel.AP135.lzma.uImage'.
Load address: 0x50000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ######
done
Bytes transferred = 1357553 (14b6f1 hex)
ath> cp.b 0x80050000 0x9f050000 $filesize
Copy to Flash... write addr: 9f050000
ath> 

Copy over the rootfs:

ath> tftpboot 0x80050000 mfsroot-ap135.img.ulzma
Trying eth0
Using eth0 device
TFTP from server 192.168.2.10; our IP address is 192.168.2.1
Filename 'mfsroot-ap135.img.ulzma'.
Load address: 0x80050000
Loading: #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 #################################################################
	 ####################
done
Bytes transferred = 4424704 (438400 hex)
ath> cp.b 0x80050000 0x9f250000 $filesize
Copy to Flash... write addr: 9f250000
done
ath>

Then, set the new boot address:

ath> set bootcmd 'bootm 0x9f050000'
ath> saveenv
Saving Environment to Flash...
Protect off 9F040000 ... 9F04FFFF
Un-Protecting sectors 4..4 in bank 1
Un-Protected 1 sectors
Erasing Flash...Erasing flash... 
First 0x4 last 0x4 sector size 0x10000
   4
Erased 1 sectors
Writing to Flash... write addr: 9f040000
done
Protecting sectors 4..4 in bank 1
Protected 1 sectors

You should see bootcmd now be the above string.

Finally, boot:

ath> reset

TODO

• The unit has 16MiB flash, but the generated image is still 8MiB. It's mostly so it can be a drop-in replacement for the Atheros supplied firmware - it can be moved around and made bigger, but then the environment 'bootcmd' needs updating.