EnGenius EWS660AP

abgn+ac (AC1750)
Wi-Fi 5 Outdoor Managed 3×3 Dual-Band Access Point
Homepage	Product page
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Supported
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	EnGenius EWS660AP
FCC ID	A8J-EWS660AP
Type	access point
CPU1 Y	Qualcomm Atheros QCA9558
CPU1 Type	MIPS 74Kc
CPU1 Speed	not specified
Flash1 Chip	Macronix MX25L12845EMI-10G
Flash1 Size	16 MiB 16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
RAM1 Size	128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
RAM1 Chip	Brand? Model?
ETH chip1	Qualcomm Atheros QCA9558
Switch	Qualcomm Atheros QCA9558
Ethernet Port Count	2-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab
802dot11 OUI: none specified
Stock bootloader	U-Boot
Expansion IF types	Mini PCIe
Mini PCIe slots	1
PoE	802.3at, standard
Power	? VDC, ? A
Serial Port (UART)	yes, 3.3V TTL, (115200 8N1)
Flags: PoE+
Other
3rd Party Firmware Support	OpenWrt • (List | Dev | DLs)
Radio 1
Chip1	Qualcomm Atheros QCA9558
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	3x3:3
Wireless Standard	IEEE 802.11b/g/n
802.11n	up to 450 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
WiFi Operating Frequency	2.4 GHz
Radio 2
Radio2 module	unknown
Radio2 module IF	Mini PCIe
Chip1	Qualcomm Atheros QCA9880
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	3x3:3
Wireless Standard	IEEE 802.11a/n/ac
802.11ac	up to 1300 Mbps
802.11n	up to 450 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz
FCC ID EnGenius ENS1750 A8J-EWS660AP

For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.

For a list of all currently documented EnGenius devices with specifications, see EnGenius.

• 450 Mbps - 3SS 2.4GHz 802.11n (40MHz chan.),

• 1300 Mbps - 3SS 5GHz 802.11ac (80MHz chan.) = AC1750 class

Flashing

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)

Target: ath79
Subtarget: generic
Package architecture: mips_24kc
Supported Since Commit
Support started version: 23.05.0
Current supported version: 25.12.2

LAN Comment: Supports 802.3at supply on PSE (downstream) port when powered by DC adapter or 802.3at PoE
WLAN Hardware: Qualcomm Atheros QCA9558, Qualcomm Atheros QCA9880
WLAN Comment: 3x3:3 MIMO on both bands
Installation method(s):
see git-commit
Recovery method(s):
see git-commit
Comment:
supports 802.3at supply on PSE (downstream) port when powered by DC adapter or 802.3at PoE

git • >>

ath79: add support for Senao Engenius EWS660AP FCC ID: A8J-EWS660AP Engenius EWS660AP is an outdoor wireless access point with 2 gigabit ethernet ports, dual-band wireless, internal antenna plates, and 802.3at PoE+ **Specification:** - QCA9558 SOC 2.4 GHz, 3x3 - QCA9880 WLAN mini PCIe card, 5 GHz, 3x3, 26dBm - AR8035-A PHY RGMII GbE with PoE+ IN - AR8033 PHY SGMII GbE with PoE+ OUT - 40 MHz clock - 16 MB FLASH MX25L12845EMI-10G - 2x 64 MB RAM - UART at J1 populated, RX grounded - 6 internal antenna plates (5 dbi, omni-directional) - 5 LEDs, 1 button (power, eth0, eth1, 2G, 5G) (reset) **MAC addresses:** Base MAC addressed labeled as "MAC" Only one Vendor MAC address in flash eth0 *:d4 MAC art 0x0 eth1 *:d5 --- art 0x0 +1 phy1 *:d6 --- art 0x0 +2 phy0 *:d7 --- art 0x0 +3 **Serial Access:** the RX line on the board for UART is shorted to ground by resistor R176 therefore it must be removed to use the console but it is not necessary to remove to view boot log optionally, R175 can be replaced with a solder bridge short the resistors R175 and R176 are next to the UART RX pin **Installation:** 2 ways to flash factory.bin from OEM: Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" Navigate to "Firmware Upgrade" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9fd70000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes **Return to OEM:** If you have a serial cable, see Serial Failsafe instructions otherwise, uboot-env can be used to make uboot load the failsafe image ssh into openwrt and run `fw_setenv rootfs_checksum 0` reboot, wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade **TFTP recovery:** Requires serial console, reset button does nothing rename initramfs.bin to '0101A8C0.img' make available on TFTP server at 192.168.1.101 power board, interrupt boot execute tftpboot and bootm 0x81000000 **Format of OEM firmware image:** The OEM software of EWS660AP is a heavily modified version of Openwrt Kamikaze. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-ar71xx-generic-ews660ap-uImage-lzma.bin openwrt-ar71xx-generic-ews660ap-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring. Newer EnGenius software requires more checks but their script includes a way to skip them, otherwise the tar must include a text file with the version and md5sums in a deprecated format. The OEM upgrade script is at /etc/fwupgrade.sh. OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. Note on PLL-data cells: The default PLL register values will not work because of the external AR8035 switch between the SOC and the ethernet port. For QCA955x series, the PLL registers for eth0 and eth1 can be see in the DTSI as 0x28 and 0x48 respectively. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x18050028 1` and `md 0x18050048 1`. The clock delay required for RGMII can be applied at the PHY side, using the at803x driver `phy-mode`. Therefore the PLL registers for GMAC0 do not need the bits for delay on the MAC side. This is possible due to fixes in at803x driver since Linux 5.1 and 5.3