Meru Networks AP320

abgn (AN600)
managed access point
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Status Unknown
Tomato any flavor	Incompatible
Platform
Brand • Model • Rev	Meru Networks AP320
FCC ID	RE7-AP300
IC ID	6749A-AP300
Type	managed access point
CPU1	Freescale (NXP) MPC8347E
CPU1 Type	MIPS
CPU1 Speed	528 MHz
Flash1 Chip	Spansion S29GL128N90TFIR2
Flash1 Size	16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
RAM1 Size	256 MiB268,435,456 B <br />2,097,152 Kib <br />262,144 KiB <br />2,048 Mib <br />0.25 GiB <br />
RAM1 Chip	Samsung K4T51163QE-ZCE6 x 4
ETH chip1	Freescale (NXP) MPC8347E
ETH chip2	Vitesse VSC8601XKN
Ethernet Port Count	1-1GbE-LAN
Wired Standard	IEEE 802.3i/3u/3ab
802dot11 OUI: none specified Ethernet OUI: 00:0C:E6 (2 E, -)
Stock bootloader	U-Boot 1.2.0
Stock FW OS	Linux 2.6.18.3
Expansion IF types	Mini PCI
Mini PCI slots	2
Power	5 VDC, 3 A
Connector type	barrel
Serial Port (UART)	yes, internal, 4-pin header, external, 8P8C, (115200 8N1), 3.3V TTL, J2
Other
Manuf/OEM/ODM	USI
Retail
FCC approval date	15 October 2007
Country of manuf	China
Radio 1
Radio1 module	USI MP-N-AT-02 rev 1.1
Radio1 module IF	Mini PCI
Chip1	Atheros AR5416
Chip2	Atheros AR5133
Wireless interface OUI	none specified
Antenna Connector Type	U.FL, RP-SMA
MIMO status	3x3:2
Wireless Standard	IEEE 802.11a/b/g/n
802.11n	up to 300/300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	2.4 or 5 GHz
Radio 2
Radio2 module	USI MP-N-AT-02 rev 1.1
Radio2 module IF	Mini PCI
Chip1	Atheros AR5416
Chip2	Atheros AR5133
Wireless interface OUI	none specified
Antenna Connector Type	none specified
MIMO status	3x3:2
Wireless Standard	IEEE 802.11a/b/g/n
802.11n	up to 300/300 Mbps
802.11g	up to 54 Mbps
802.11b	up to 11 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	2.4 or 5 GHz
FCC ID Meru Networks AP310 RE7-AP300 USI MP-N-AT-02 rev 1.1 RE7-AP300 pakedge WAP-W5N RE7-AP300

For a list of all currently documented Atheros (QCA) chipsets with specifications, see Atheros.
For a list of all currently documented Freescale (NXP) SoC's with specifications, see Freescale.
For a list of all currently documented Microsemi (Vitesse) chipsets with specifications, see Microsemi.

For a list of all currently documented Meru Networks device with specifications, see Meru Networks.

• 300 Mbps - 2SS 5GHz 802.11n (40MHz chan.),

• 300 Mbps - 2SS 2.4GHz 802.11n (40MHz chan.) = AN600 class

Overview

"MERU TRISULI DVT2.0" is silkscreened on the board.

This device is using a...

• Freescale MPC8347E ("MPC8347EVVAJFB", "533/333MHz", "QMZNL0738", "MALAYSIA")
• and alternately, SK hynix HY5PS121621C FP-Y5 RAM, and Spansion S29GL128P90TFIR2 Flash

This AP (and other Meru Networks APs) are designed to be used with a centralized AP controller.

JTAG-Serial Info

Serial

Serial Pinouts

It seems likely to be the following..

J2 [3.3] (RxD) (TxD) (GND)

Info derived from

bootloader cmd dump

javelin > help ? - alias for 'help' autoscr - run script from memory base - print or set address offset bdinfo - print Board Info structure boot - boot default, i.e., run 'bootcmd' bootd - boot default, i.e., run 'bootcmd' bootm - boot application image from memory bootp - boot image via network using BootP/TFTP protocol cmp - memory compare coninfo - print console devices and information cp - memory copy crc32 - checksum calculation echo - echo args to console erase - erase FLASH memory flinfo - print FLASH memory information go - start application at address 'addr' help - print online help icrc32 - checksum calculation iloop - infinite loop on address range imd - i2c memory display iminfo - print header information for application image imls - list all images found in flash imm - i2c memory modify (auto-incrementing) imw - memory write (fill) inm - memory modify (constant address) iprobe - probe to discover valid I2C chip addresses itest - return true/false on integer compare loadb - load binary file over serial line (kermit mode) loads - load S-Record file over serial line loady - load binary file over serial line (ymodem mode) loop - infinite loop on address range md - memory display mm - memory modify (auto-incrementing) mtest - simple RAM test mw - memory write (fill) nfs - boot image via network using NFS protocol nm - memory modify (constant address) pci - list and access PCI Configuration Space ping - send ICMP ECHO_REQUEST to network host printenv- print environment variables protect - enable or disable FLASH write protection rarpboot- boot image via network using RARP/TFTP protocol reset - Perform RESET of the CPU run - run commands in an environment variable saveenv - save environment variables to persistent storage setenv - set environment variables sleep - delay execution for some time tftpboot- boot image via network using TFTP protocol version - print monitor version javelin > base Base Address: 0x00000000 javelin > bdinfo memstart = 0x00000000 memsize = 0x08000000 flashstart = 0xFF000000 flashsize = 0x01000000 flashoffset = 0x00000000 sramstart = 0x00000000 sramsize = 0x00000000 bootflags = 0x00000001 intfreq = 528 MHz busfreq = 264 MHz ethaddr = 00:0C:E6:05:01:EE eth1addr = 00:E0:0C:00:7D:01 IP addr = 192.168.1.100 baudrate = 115200 bps javelin > printenv bootargs=root=/dev/ram0 rw console=ttyS0,115200 ramdisk_size=32768 bootcmd=bootm FFA00000 nfsboot=setenv bootargs root=/dev/nfs rw nfsroot=$serverip:$rootpath ip=$ipaddr:$serverip:$gatewayip:$netmask:$hostname:$netdev:off console=$consoledev,$baudrate $othbootargs;tftp $loadaddr $bootfile;bootm $loadaddr bootdelay=5 baudrate=115200 loads_echo=1 eth1addr=00:E0:0C:00:7D:01 rootpath=/ hostname=unknown bootfile=vmlinux.UBoot loadaddr=1200000 netdev=eth0 consoledev=ttyS0 ramdiskaddr=2000000 ramdiskfile=ramdisk.gz altbootcmd=bootm FF500000 bootlimit=2 ethact=TSEC0 ipaddr=192.168.1.100 serverip=192.168.1.2 netmask=255.255.255.0 ethaddr=00:0c:e6:05:01:ee SerialNumber=0408AP320000CE60501EE PartNumber=875-50017 HardwareRev=1 Radio0SerialNumber=81P54140 Radio1SerialNumber=81P52767 stdin=serial stdout=serial stderr=serial bootcount=1 Environment size: 834/32763 bytes javelin > flinfo Bank # 1: CFI conformant FLASH (8 x 8) Size: 16 MB in 128 Sectors AMD Standard command set, Manufacturer ID: 0x00, Device ID: 0x00 Erase timeout: 16384 ms, write timeout: 2 ms Buffer write timeout: 5 ms, buffer size: 32 bytes Sector Start Addresses: FF000000 FF020000 E FF040000 FF060000 FF080000 FF0A0000 FF0C0000 E FF0E0000 E FF100000 E FF120000 E FF140000 E FF160000 E FF180000 E FF1A0000 E FF1C0000 E FF1E0000 E FF200000 E FF220000 E FF240000 E FF260000 E FF280000 E FF2A0000 E FF2C0000 E FF2E0000 E FF300000 E FF320000 E FF340000 E FF360000 E FF380000 E FF3A0000 E FF3C0000 E FF3E0000 E FF400000 E FF420000 E FF440000 E FF460000 E FF480000 E FF4A0000 E FF4C0000 E FF4E0000 E FF500000 FF520000 FF540000 FF560000 FF580000 FF5A0000 FF5C0000 FF5E0000 FF600000 FF620000 FF640000 FF660000 FF680000 FF6A0000 FF6C0000 FF6E0000 FF700000 FF720000 FF740000 FF760000 FF780000 FF7A0000 FF7C0000 FF7E0000 FF800000 FF820000 FF840000 FF860000 FF880000 FF8A0000 E FF8C0000 E FF8E0000 E FF900000 E FF920000 E FF940000 E FF960000 E FF980000 E FF9A0000 E FF9C0000 E FF9E0000 E FFA00000 FFA20000 FFA40000 FFA60000 FFA80000 FFAA0000 FFAC0000 FFAE0000 FFB00000 FFB20000 FFB40000 FFB60000 FFB80000 FFBA0000 FFBC0000 FFBE0000 FFC00000 FFC20000 FFC40000 FFC60000 FFC80000 FFCA0000 FFCC0000 FFCE0000 FFD00000 FFD20000 FFD40000 FFD60000 FFD80000 FFDA0000 FFDC0000 FFDE0000 FFE00000 FFE20000 FFE40000 FFE60000 FFE80000 FFEA0000 FFEC0000 FFEE0000 E FFF00000 RO FFF20000 RO FFF40000 E FFF60000 E FFF80000 E FFFA0000 E FFFC0000 RO FFFE0000 RO

boot log

U-Boot 1.2.0 - rev. 0.6 (Oct 5 2007 - 19:09:59) MPC83XX Clock configuration: Coherent System Bus: 264 MHz Core: 528 MHz Local Bus Controller: 264 MHz Local Bus: 66 MHz DDR: 264 MHz SEC: 88 MHz I2C1: 88 MHz I2C2: 264 MHz TSEC1: 88 MHz TSEC2: 88 MHz USB MPH: 88 MHz USB DR: 88 MHz CPU: MPC8347E, Rev: 30 at 528 MHz Board: USI MPC8347 Watchdog enabled I2C: ready DRAM: Init DDR... SDRAM on Local Bus is NOT available! DDR RAM: 128 MB Memory test ... Testing the data lines Testing the address lines passed Top of RAM usable for U-Boot at: 08000000 Reserving 179k for U-Boot at: 07fd3000 Reserving 160k for malloc() at: 07fab000 Reserving 68 Bytes for Board Info at: 07faafbc Reserving 100 Bytes for Global Data at: 07faaf58 Stack Pointer at: 07faaf38 New Stack Pointer is: 07faaf38 Now running in RAM - U-Boot at: 07fd3000 FLASH: 16 MB In: serial Out: serial Err: serial U-Boot relocated to 07fd3000 Net: TSEC0 Un-Protected 1 sectors Un-Protected 1 sectors Erasing Flash... . done Erased 1 sectors Writing to Flash... done Protected 1 sectors Protected 1 sectors Hit any key to stop autoboot: 0 ## Booting image at ffa00000 ... Image Name: Linux Multiboot-Image Created: 2010-11-09 14:26:02 UTC Image Type: PowerPC Linux Multi-File Image (gzip compressed) Data Size: 4988700 Bytes = 4.8 MB Load Address: 00000000 Entry Point: 00000000 Contents: Image 0: 4988692 Bytes = 4.8 MB Verifying Checksum ... OK Uncompressing Multi-File Image ... OK [ 0.000000] Clearing memory: [c064d798]-[c8000000] size[079b2868] ... done [ 0.000000] Linux version 2.6.18.3 (build@europa) (gcc version 4.1.1) #2 Tue Nov 9 06:25:08 PST 2010 [ 0.000000] Built 1 zonelists. Total pages: 32768 [ 0.000000] Kernel command line: root=/dev/ram0 rw console=ttyS0,115200 ramdisk_size=32768 [ 0.000000] IPIC (128 IRQ sources, 8 External IRQs) at fe000700 [ 0.000000] PID hash table entries: 1024 (order: 10, 4096 bytes) [ 21.169310] Dentry cache hash table entries: 16384 (order: 4, 65536 bytes) [ 21.170299] Inode-cache hash table entries: 8192 (order: 3, 32768 bytes) [ 21.187373] Memory: 123392k available (1740k kernel code, 912k data, 3804k init, 0k highmem) [ 21.268843] Mount-cache hash table entries: 512 [ 22.010372] NET: Registered protocol family 16 [ 22.010520] PCI: Probing PCI hardware [ 22.010856] PCI: Cannot allocate resource region 0 of device 0000:00:00.0 [ 22.010871] PCI: Cannot allocate resource region 2 of device 0000:00:00.0 [ 22.010902] PCI: Failed to allocate mem resource #2:80000000@0 for 0000:00:00.0 [ 22.011753] Generic PHY: Registered new driver [ 22.011813] usbcore: registered new driver usbfs [ 22.011845] usbcore: registered new driver hub [ 22.012449] NET: Registered protocol family 2 [ 22.048904] IP route cache hash table entries: 1024 (order: 0, 4096 bytes) [ 22.049318] TCP established hash table entries: 4096 (order: 2, 16384 bytes) [ 22.049473] TCP bind hash table entries: 2048 (order: 1, 8192 bytes) [ 22.049550] TCP: Hash tables configured (established 4096 bind 2048) [ 22.049561] TCP reno registered [ 22.050046] MAC Trace module initialized [ 22.050085] Starting AP Rttrace Driver [ 22.050710] JFFS2 version 2.2. (NAND) (C) 2001-2006 Red Hat, Inc. [ 22.050931] Initializing Cryptographic API [ 22.051112] io scheduler noop registered [ 22.051145] io scheduler anticipatory registered (default) [ 22.051166] io scheduler deadline registered [ 22.051203] io scheduler cfq registered [ 22.162298] Generic RTC Driver v1.07 [ 22.162347] Serial: 8250/16550 driver $Revision: 1.90 $ 4 ports, IRQ sharing disabled [ 22.164670] serial8250.0: ttyS0 at MMIO 0xe0004500 (irq = 9) is a 16550A [ 22.362502] serial8250.0: ttyS1 at MMIO 0xe0004600 (irq = 10) is a 16550A [ 22.370728] RAMDISK driver initialized: 16 RAM disks of 32768K size 1024 blocksize [ 22.378772] loop: loaded (max 8 devices) [ 22.394062] Gianfar MII Bus: probed [ 22.397830] eth0: Gianfar Ethernet Controller Version 1.4, 00:0c:e6:05:01:ee [ 22.405028] eth0: Running with NAPI enabled [ 22.409205] eth0: 512/256 RX/TX BD ring size [ 22.413686] eth1: Gianfar Ethernet Controller Version 1.4, 00:00:00:00:00:00 [ 22.420875] eth1: Running with NAPI enabled [ 22.425051] eth1: 512/256 RX/TX BD ring size [ 22.429336] SKB Handler initialized(max=512) [ 22.433625] Cicada Cis8204: Registered new driver [ 22.438332] Cicada Cis8201: Registered new driver [ 22.443228] VSC8601 Gigabit Ethernet: Registered new driver [ 22.448806] Vitesse VSC8244: Registered new driver [ 22.453899] netconsole: not configured, aborting [ 22.458715] FSLMPC8347 flash device: 1000000 at ff000000 Partition number 11 [ 22.466592] FSLMPC8347 Flash Map Info: Found 1 x16 devices at 0x0 in 8-bit bank [ 22.473906] Amd/Fujitsu Extended Query Table at 0x0040 [ 22.479142] FSLMPC8347 Flash Map Info: CFI does not contain boot bank location. Assuming top. [ 22.487658] number of CFI chips: 1 [ 22.491055] cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness. [ 22.498790] Creating 11 MTD partitions on "FSLMPC8347 Flash Map Info": [ 22.505317] 0x00000000-0x00020000 : "hrcw" [ 22.509614] 0x00020000-0x00040000 : "manuf0" [ 22.513997] 0x00040000-0x00080000 : "config0" [ 22.518479] 0x00080000-0x000a0000 : "logk0" [ 22.522798] 0x000a0000-0x000c0000 : "logk1" [ 22.527091] 0x000c0000-0x00180000 : "user0" [ 22.531413] 0x00500000-0x00a00000 : "runtime0" [ 22.535979] 0x00a00000-0x00f00000 : "runtime1" [ 22.540559] 0x00f00000-0x00fc0000 : "boot0" [ 22.544880] 0x00fc0000-0x00fe0000 : "env0" [ 22.549105] 0x00fe0000-0x01000000 : "env1" [ 22.553338] FSLMPC8347MDS flash device initialized [ 22.558131] usbmon: debugfs is not available [ 22.562392] i2c /dev entries driver [ 22.566271] Ethernet over IPv4 tunneling driver [ 22.571263] TCP bic registered [ 22.574375] NET: Registered protocol family 1 [ 22.578748] NET: Registered protocol family 17 [ 22.583194] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> [ 22.589974] All bugs added by David S. Miller <davem@redhat.com> [ 22.596124] Freeing unused kernel memory: 3804k init Setting the hostname to apng-javelin Mounting filesystems mount: Mounting rwfs on /mnt/rwfs failed: No such file or directory mount: Mounting shm on /dev/shm failed: No such file or directory mount: Mounting devpts on /dev/pts failed: No such file or directory Starting syslogd and klogd Setting up networking on loopback device: Setting up networking on eth0: SIOCSIFNETMASK: Cannot assign requested address ## Error: "runmode" not defined ## Error: "runmode" not defined [ 23.489643] Meru mprintk module loaded. [ 23.610569] Starting AP Platform Driver [ 23.632043] WDT driver for MPC83xx initialized. mode:reset timeout=65535 (-65536 seconds) [ 23.660945] meru_util_mod: module license 'Proprietary' taints kernel. [ 23.678711] meru_tunnel: no version for "g_proc_meru" found: kernel tainted. [ 23.721063] Ethernet over UDP tunneling driver [ 23.772924] NET: Registered protocol family 30 e2fsck: while determining whether /dev/mtdblock2 is mounted. /dev/mtdblock2 was not cleanly unmounted, check forced. /dev/mtdblock2: 14/32 files (0.0% non-contiguous), 27/256 blocks [ 24.893115] PHY: 0:1c - Link is Up - 10/Half fsck 1.38 (30-Jun-2005) e2fsck 1.38 (30-Jun-2005) fsck.ext2: while determining whether /dev/mtdblock2 is mounted. /dev/mtdblock2: clean, 14/32 files, 27/256 blocks mke2fs 1.38 (30-Jun-2005) mke2fs: /dev/mtdblock2 is mounted ! mke2fs: it's not safe to run badblocks! mount: Mounting /dev/mtdblock2 on /opt/meru/flash failed: Device or resource busy mke2fs 1.38 (30-Jun-2005) mke2fs: Could not determine if /dev/ram1 is mounted Filesystem label= OS type: Linux Block size=1024 (log=0) Fragment size=1024 (log=0) 8192 inodes, 32768 blocks 0 blocks (0.00%) reserved for the super user First data block=1 4 block groups 8192 blocks per group, 8192 fragments per group 2048 inodes per group Superblock backups stored on blocks: 8193, 24577 Writing inode tables: done Writing superblocks and filesystem accounting information: done This filesystem will be automatically checked every 27 mounts or 180 days, whichever comes first. Use tune2fs -c or -i to override. [ 28.406362] mcap_init(), 0.3.0 initialized, interface 'eth0' [ 28.473659] Aeroscout kernel module initialized [ 28.532583] MDE module initialized [ 28.903300] wlan: 0.8.4.2 (Atheros/multi-bss) [ 29.016450] ath_hal: 0.9.17.1 (AR5212, AR5416, RF5111, RF5112, RF2413, RF5413, RF2316, RF2317, REGOPS_FUNC, PRIVATE_DIAG, WRITE_EEPROM, 11D) [ 29.046150] ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc, All Rights Reserved [ 29.071282] ath_dfs: Version 2.0.0 [ 29.071299] Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserved [ 30.983533] ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Rights Reserved [ 30.992117] ath_mailbox_init() done [ 31.038078] ath_pci: 0.9.4.5 (Atheros/multi-bss) [ 31.562689] dfs_init_radar_filters: Unknown dfs domain 0 [ 31.602405] radio0: Atheros 5416: mem=0x9fff0000, irq=19 hw_base=0xca0e0000 [ 32.129305] dfs_init_radar_filters: Unknown dfs domain 0 [ 32.168997] radio1: Atheros 5416: mem=0x9ffe0000, irq=20 hw_base=0xca160000 [ 32.260570] eth0: Entering promiscuous mode. [ 32.270024] eth0: Entering promiscuous mode. disc_parse_cmd_args: argc = 1 ## Error: "ver" not defined AP Init: VERSION: 4.0-131 201011090557 ppc stripped 4.0 Login to user('user'), AUTH level= 2 Real-time trace display enabled for severity >= 0. net_register_handler : sending signal : port moved to forwarding state net_register_handler : sending signal : tNet_init disc_parse_cmd_args: argc = 1 [01/01 00:00:11.289] INIT: Starting discovery loop [01/01 00:00:11.289] INIT: AP discovery start [01/01 00:00:11.294] INIT: Retrying Discovery ... (0 of 10) [01/01 00:00:11.295] INIT: Discovering network infrastructure [01/01 00:00:11.295] INIT: Discovery type L2. index: 9Interface [mbr] index 9 Socket created ap -1> L2 Signalling channel initiated... L3 Signalling channel initiated... net_register_handler : sending signal : net_register_handler : sending signal : net_register_handler : sending signal : ===========> Sending AP TYPE as AP300 ## Error: "ModelNumber" not defined tNetTaskMain: errno 4 recevied SIG from new thread Sending L2 Discovery frame, CTRL addr: ff:ff:ff:ff:ff:ff Sent discovery frame ===========> Sending AP TYPE as AP300 Sending L2 Discovery frame, CTRL addr: ff:ff:ff:ff:ff:ff Sent discovery frame ===========> Sending AP TYPE as AP300 Sending L2 Discovery frame, CTRL addr: ff:ff:ff:ff:ff:ff Sent discovery frame ===========> Sending AP TYPE as AP300 Sending L2 Discovery frame, CTRL addr: ff:ff:ff:ff:ff:ff Sent discovery frame ===========> Sending AP TYPE as AP300 Sending L2 Discovery frame, CTRL addr: ff:ff:ff:ff:ff:ff Sent discovery frame ===========> Sending AP TYPE as AP300 Sending L2 Discovery frame, CTRL addr: ff:ff:ff:ff:ff:ff Sent discovery frame [01/01 00:00:18.512] INIT: Wait for discovery to timeout... [01/01 00:00:34.576] INIT: Retrying Discovery ... (1 of 10) [01/01 00:00:34.576] INIT: Discovering network infrastructure [01/01 00:00:34.576] INIT: Network Configuration: Version:00010003 Controller:wlan-controller DHCP:enabled dhcpcd: MAC address = 00:0c:e6:05:01:ee