EnGenius EnStationACv1

multiple revisions of this device, use caution

an+ac (AC867)
Wi-Fi 5 Outdoor Long Range Access Point/Wireless Bridge
Homepage	Product page
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Supported
Tomato any flavor	Incompatible
Gargoyle	Status Unknown
Platform
Brand • Model • Rev	EnGenius EnStationAC v1
FCC ID	A8J-ENSTAC
Type	enterprise access point
CPU1 Y	Qualcomm Atheros QCA9557
CPU1 Type	MIPS 74Kc
CPU1 Speed	not specified
Flash1 Chip	Macronix MX25L12845EMI-10G
Flash1 Size	16 MiB 16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
RAM1 Size	128 MiB 134,217,728 B <br />1,048,576 Kib <br />131,072 KiB <br />1,024 Mib <br />0.125 GiB <br />
RAM1 Chip	Nanya NT5TU32M16FG x 2
ETH chip1	Qualcomm Atheros QCA9557
ETH chip2	Atheros AR8035-A
ETH chip3	Atheros AR8031
Ethernet Port Count	2-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab
802dot11 OUI: none specified
Stock bootloader	U-Boot
Expansion IF types	Mini PCIe
Mini PCIe slots	1
PoE	proprietary
Power	24 VDC, ? A
Serial Port (UART)	Yes
Other
3rd Party Firmware Support	OpenWrt • (List | Dev | DLs)
Retail
Availability	End of Life
FCC approval date	10 May 2013
Radio 1
Radio1 module	unknown
Radio1 module IF	Mini PCIe
Chip1	Qualcomm Atheros QCA9882
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	2x2:2
Wireless Standard	IEEE 802.11a/n/ac
802.11ac	up to 867 Mbps
802.11n	up to 300 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz
CPU1 brand Radio1 chip1 brand Radio1 chip2 brand EnGenius EnStationACv1 Qualcomm Atheros Qualcomm Atheros EnGenius EnStationACv2 Qualcomm Atheros Qualcomm Atheros

For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.
For a list of all currently documented Qualcomm Atheros (QCA) chipsets with specifications, see Qualcomm Atheros.

For a list of all currently documented EnGenius devices with specifications, see EnGenius.

• 867 Mbps - 2SS 5GHz 802.11ac (80MHz chan.) = AC867 class

Flashing

Flashing OpenWrt

On the OpenWrt ToH (techdata entry)

Target: ath79
Subtarget: generic
Package architecture: mips_24kc
Supported Since Commit
Support started version: 21.02.0
Current supported version: 25.12.2

LAN Comment: Atheros AR8035-A GbE Phy, Atheros AR8031 GbE Phy
WLAN Hardware: Qualcomm Atheros QCA9882
Installation method(s):
see git-commit
Recovery method(s):
see git-commit

git • >>

ath79: add support for Senao Engenius EnStationAC v1 FCC ID: A8J-ENSTAC Engenius EnStationAC v1 is an outdoor wireless access point/bridge with 2 gigabit ethernet ports on 2 external ethernet switches, 5 GHz only wireless, internal antenna plates, and proprietery PoE. Specification: - QCA9557 SOC - QCA9882 WLAN (PCI card, 5 GHz, 2x2, 26dBm) - AR8035-A switch (RGMII GbE with PoE+ IN) - AR8031 switch (SGMII GbE with PoE OUT) - 40 MHz reference clock - 16 MB FLASH MX25L12845EMI-10G - 2x 64 MB RAM NT5TU32M16FG - UART at J10 (unpopulated) - internal antenna plates (19 dbi, directional) - 7 LEDs, 1 button (power, eth, wlan, RSSI) (reset) MAC addresses: MAC addresses are labeled as ETH and 5GHz Vendor MAC addresses in flash are duplicate eth0 ETH *:d3 art 0x0/0x6 eth1 ---- *:d4 --- phy0 5GHz *:d5 --- Installation: 2 ways to flash factory.bin from OEM: - if you get Failsafe Mode from failed flash: only use it to flash Original firmware from Engenius or risk kernel loop or halt which requires serial cable Method 1: Firmware upgrade page: OEM webpage at 192.168.1.1 username and password "admin" Navigate to "Firmware" page from left pane Click Browse and select the factory.bin image Upload and verify checksum Click Continue to confirm and wait 3 minutes Method 2: Serial to load Failsafe webpage: After connecting to serial console and rebooting... Interrupt uboot with any key pressed rapidly execute `run failsafe_boot` OR `bootm 0x9fd70000` wait a minute connect to ethernet and navigate to "192.168.1.1/index.htm" Select the factory.bin image and upload wait about 3 minutes Return to OEM: If you have a serial cable, see Serial Failsafe instructions otherwise, uboot-env can be used to make uboot load the failsafe image *DISCLAIMER* The Failsafe image is unique to Engenius boards. If the failsafe image is missing or damaged this will not work DO NOT downgrade to ar71xx this way, it can cause kernel loop or halt ssh into openwrt and run `fw_setenv rootfs_checksum 0` reboot, wait 3 minutes connect to ethernet and navigate to 192.168.1.1/index.htm select OEM firmware image from Engenius and click upgrade TFTP recovery: rename initramfs to 'vmlinux-art-ramdisk' make available on TFTP server at 192.168.1.101 power board hold or press reset button repeatedly NOTE: for some Engenius boards TFTP is not reliable try setting MTU to 600 and try many times Format of OEM firmware image: The OEM software of EnStationAC is a heavily modified version of Openwrt Altitude Adjustment 12.09. One of the many modifications is to the sysupgrade program. Image verification is performed simply by the successful ungzip and untar of the supplied file and name check and header verification of the resulting contents. To form a factory.bin that is accepted by OEM Openwrt build, the kernel and rootfs must have specific names... openwrt-ar71xx-enstationac-uImage-lzma.bin openwrt-ar71xx-enstationac-root.squashfs and begin with the respective headers (uImage, squashfs). Then the files must be tarballed and gzipped. The resulting binary is actually a tar.gz file in disguise. This can be verified by using binwalk on the OEM firmware images, ungzipping then untaring. Newer EnGenius software requires more checks but their script includes a way to skip them, otherwise the tar must include a text file with the version and md5sums in a deprecated format. The OEM upgrade script is at /etc/fwupgrade.sh. OKLI kernel loader is required because the OEM software expects the kernel to be no greater than 1536k and the factory.bin upgrade procedure would otherwise overwrite part of the kernel when writing rootfs. Note on PLL-data cells: The default PLL register values will not work because of the external AR8033 switch between the SOC and the ethernet PHY chips. For QCA955x series, the PLL registers for eth0 and eth1 can be see in the DTSI as 0x28 and 0x48 respectively. Therefore the PLL registers can be read from uboot for each link speed after attempting tftpboot or another network action using that link speed with `md 0x18050028 1` and `md 0x18050048 1`. For eth0 at 1000 speed, the value returned was ae000000 but that didn't work, so following the logical pattern from the rest of the values, the guessed value of a3000000 works better. later discovered that delay can be placed on the PHY end only with phy-mode as 'rgmii-id' and set register to 0x82... Tested from master, all link speeds functional