Pheenet WAP-654G

Pheenet WAP-654G

(Est.) release date: 2007
(Est.) initial retail price (in USD): $50
Country of manuf.: Taiwan

Local image

Type: access point, repeater

Power: 12 VDC, 1 A
Connector type: barrel

CPU1: Realtek RTL8186 (180 MHz)
FLA1: 2 MiB2,097,152 B 16,384 Kib 2,048 KiB 16 Mib 0.00195 GiB  (Macronix MX29LV160CBTC-70G)
RAM1: 16 MiB16,777,216 B 131,072 Kib 16,384 KiB 128 Mib 0.0156 GiB  (ISSI IS42S16800A-7TL)

Expansion IFs: none specified
JTAG: yes, 12-pad header, J1
Serial: yes, 4-pin header, JPU1

WI1 chip1: Realtek RTL8186
WI1 802dot11 protocols: bg
WI1 antenna connector: RP-SMA

ETH chip1: Realtek RTL8201CP
LAN speed: 100M
LAN ports: 1

bg

Stock bootloader: btcode

Stock FW OS: Linux 2.4.18 MIPS-01.00

TPFirmware supported: Wive-NG (sfstudio) • (Blog | List)

Flags: high power

Default SSID: PheeNet
Default IP address: 192.168.1.254
the IP 192.168.1.254 is used by 158 additional devices
of which 0 are Pheenet devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1324 additional devices
of which 0 are Pheenet devices

802dot11 OUI: 00:1A:50

For a list of all currently documented Realtek chipsets with specifications, see Realtek.

802.11g 54Mbps High Power AP / Bridge

Product page (Old) (New)

Support page

Datasheet

See also Pheenet WAP-654GP (int. splitter PoE)

2.2dBi detachable antenna (RP-SMA conn.)

Base Platform: RTL8186 + RL2560 (MIPS R3000 ISA-1) Spec.

Very simple access point with WIFI high output power (200mW)

that allows several wifi modes:

AP, WDS, AP + WDS, Client bridged, Ad-hoc
AP + Client bridged (aka Universal Repeater)

The original firmware doesn't have Telnet or other remote CLI interface.

It only can be configured via web interface.

It is worth mentioning the web interface doesn't allow to reboot the router,

however there is a hidden page that allows to execute custom commands:

httр://192.168.1.254/syscmd.asp

Some useful commands:

Change the MAC adresss
flash set HW_WLAN0_WLAN_ADDR 001122334455
flash set HW_NIC0_ADDR 001122334455
Change the regulatory domain
flash set HW_WLAN0_REG_DOMAIN 6

Tested firmwares

Third party firmwares like Wive-NG were successfully tested in this unit.

Version	Link	Notes
OEM 1.4c	WAP-654G(P)_v1.4c.zip	doesn't seem to flash via tftp
OEM 1.4b	WAP-654G(P), F v1.4b 070228.rar
Wive-NG 0.3.18	wive-ng-0.3.18.tar.7z	no web interface
Dlink 1.41-1	DAP1160A1-OEM_MOD-1.41.zip	modded firmware from Dlink DAP1160A1 GPL

Serial

• Boot log

UART1 output test ok
Uart init
mfid=000000c2 devid=00002249
Found 1 x 2M flash memory

---RealTek(RTL8186)at 2006.02.20-12:02+0800 version 1.4a [16bit](180MHz)
no sys signature at 00010000!
Jump to image start=0x80350000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
early printk enabled 
Determined physical RAM map:
 memory: 00800000 @ 00000000 (usable)
Initial ramdisk at: 0x80173000 (1843200 bytes)
On node 0 totalpages: 2048
zone(0): 2048 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram console=0 ramdisk_start=0 single
Calibrating delay loop... 178.99 BogoMIPS
Memory: 4628k/8192k available (1292k kernel code, 3564k reserved, 
1932k data, 44k init, 0k highmem)
Dentry-cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode-cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
check_wait... unavailable.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Serial driver version 6.02 (2003-03-12) with no serial options enabled
ttyS00 at 0x00c3 (irq = 3) is a rtl_uart1
state->flags=00000000
Realtek GPIO Driver for Flash Reload Default
block: 64 slots per queue, batch=16
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
RealTek E-Flash System Driver. (C) 2002 RealTek Corp.
Found 1 x 2M Byte MXIC MX29LV160AB at 0xbe000000
RTL8185 driver version 1.11 (2006-08-01)
8186NIC Ethernet driver v0.0.5 (Mar 3, 2006)
eth0: RTL8186-NIC at 0xbd200000, 00:01:02:03:04:05, IRQ 4
eth1: RTL8186-NIC at 0xbd300000, 04:05:06:07:08:09, IRQ 5
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
RAMDISK: ext2 filesystem found at block 0
RAMDISK: Loading 1800 blocks [1 disk] into ram disk... done.
Freeing initrd memory: 1800k freed
VFS: Mounted root (ext2 filesystem).
Freeing unused kernel memory: 44k freed
mount /proc file system ok!
serial console detected.  Disabling virtual terminals.
init started:  BusyBox v1.00-pre8 (2005.09.16-02:17+0000) multi-call binary

BusyBox v1.00-pre8 (2005.09.16-02:17+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

Initialize wlan0 interface
killall: syslogd: no process killed
killall: klogd: no process killed
SIOCGIFFLAGS: No such device
bridge br0 doesn't exist; can't delete it
Setup bridge...
device eth0 entered promiscuous mode
eth0:phy is 8201
SIOCDELRT: No such process
device wlan0 entered promiscuous mode
SIOCDELRT: No such process
br0: port 2(wlan0) entering listening state
br0: port 1(eth0) entering listening state
br0: port 2(wlan0) entering learning state
br0: port 2(wlan0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth0) entering learning state
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
SIOCDELRT: No such process
SIOCDELRT: No such process
Auto-Discovery (ver 1.01) 
342
343
# auth uses obsolete (PF_INET,SOCK_PACKET)
IEEE 802.1x (WPA) daemon, version 1.7b

# cat /proc/version 
Linux version 2.4.18-MIPS-01.00 (root@lnx103) 
(gcc version 3.3.3) #5 Thu Aug 10 13:14:01 CST 2006

# cat /proc/cpuinfo
system type             : Philips Nino
processor               : 0
cpu model               : R3000 V0.0
BogoMIPS                : 178.99
wait instruction        : no
microsecond timers      : no
tlb_entries             : 64
extra interrupt vector  : no
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available
ll emulations           : 0
sc emulations           : 0

Flash backup

Connect the serial UART Adapter. Also connect the ethernet cable.
Set a static IP on your computer, use 192.168.1.35 (or any compatible)
Press the reset button, don't release it yet
Plug the power cord, and wait 5 seconds
Release the reset button
On the serial console execute the command: flr 80300000 0 200000
On your computer execute: tftp 192.168.1.6 -m binary -c get flash-backup.bin

You should see something like this at the serial console

<RealTek>flr 80300000 0 200000
Flash read from 00000000 to 80300000 with 00200000 bytes ?
(Y)es , (N)o ? --> y
Flash Read Successed!
<RealTek>
File Start: 80300000,length=00200000

**TFTP GET File flbackup.bin,Size 00200000 Byte
*TFTP Client Download Success! File Size = 00200000 Bytes
.Success!
<RealTek>

Recovery

If you bricked the router by flashing a bad firmware follow these steps:

Connect the ethernet cable from your computer to the device.
Set a static IP on your computer, use 192.168.1.35 (or any compatible)
Press the reset button, don't release it yet
Plug the power cord, and wait 5 seconds
Release the reset button
On your computer execute: tftp 192.168.1.6 -m binary -c put valid-firmware.bin

valid-firmware.bin is supposed to be a known firmware working ok on this device

Power regulators

AnaChip AP1506-50 (U9 silkcreened): Main power regulator,12V input, 5V output
BS33P (U38 silkcreened): Low dropout regulator, 5V input, 3.3V output
BS17P (U10 silkcreened): Low dropout regulator (adjustable), 5V input, 3.1V output
BS18P (U8 silkcreened): Low dropout regulator, 5V input, 1.8V output. It runs extremely hot, probably causing unstability problems. It's recommended to install the bigger heat sink as possible.

Images

casing
board top
board bottom
serial port and JTAG