Last 5 Pages Viewed: EnGenius ECB9500 » Edimax BR-6216Mg » EnGenius ECB3500 » EnGenius ERB9250 » Pheenet WAP-654G
 

Pheenet WAP-654G

From WikiDevi.Wi-Cat.RU
Jump to navigation Jump to search

Pheenet WAP-654G

(Est.) release date: 2007
(Est.) initial retail price (in USD): $50
Country of manuf.: Taiwan

Local image
Wap-654g-case.jpg

Type: access point, repeater

Power: 12 VDC, 1 A
Connector type: barrel

CPU1: Realtek RTL8186 (180 MHz)
FLA1: 2 MiB2,097,152 B <br />16,384 Kib <br />2,048 KiB <br />16 Mib <br />0.00195 GiB <br /> (Macronix MX29LV160CBTC-70G)
RAM1: 16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br /> (ISSI IS42S16800A-7TL)

Expansion IFs: none specified
JTAG: yes, 12-pad header, J1
Serial: yes, 4-pin header, JPU1

WI1 chip1: Realtek RTL8186
WI1 802dot11 protocols: bg
WI1 antenna connector: RP-SMA

ETH chip1: Realtek RTL8201CP
LAN speed: 100M
LAN ports: 1

bg

Stock bootloader: btcode

Stock FW OS: Linux 2.4.18 MIPS-01.00

TPFirmware supported: Wive-NG (sfstudio) • (Blog | List)

Flags: high power

Default SSID: PheeNet
Default IP address: 192.168.1.254
the IP 192.168.1.254 is used by 158 additional devices
of which 0 are Pheenet devices
Default login user: admin
Default login password: admin
admin:admin credentials used by 1331 additional devices
of which 0 are Pheenet devices

802dot11 OUI: 00:1A:50

For a list of all currently documented Realtek chipsets with specifications, see Realtek.

802.11g 54Mbps High Power AP / Bridge

Product page (Old) (New)
Support page
Datasheet

See also Pheenet WAP-654GP (int. splitter PoE)

2.2dBi detachable antenna (RP-SMA conn.)

Base Platform: RTL8186 + RL2560 (MIPS R3000 ISA-1) Spec.

Very simple access point with WIFI high output power (200mW)

that allows several wifi modes:
  • AP, WDS, AP + WDS, Client bridged, Ad-hoc
  • AP + Client bridged (aka Universal Repeater)

The original firmware doesn't have Telnet or other remote CLI interface.

It only can be configured via web interface.

It is worth mentioning the web interface doesn't allow to reboot the router,

however there is a hidden page that allows to execute custom commands:

httр://192.168.1.254/syscmd.asp

Some useful commands:

  • Change the MAC adresss
    flash set HW_WLAN0_WLAN_ADDR 001122334455
    flash set HW_NIC0_ADDR 001122334455
  • Change the regulatory domain
    flash set HW_WLAN0_REG_DOMAIN 6

Tested firmwares

Third party firmwares like Wive-NG were successfully tested in this unit.

Version Link Notes
OEM 1.4c WAP-654G(P)_v1.4c.zip doesn't seem to flash via tftp
OEM 1.4b WAP-654G(P), F v1.4b 070228.rar
Wive-NG 0.3.18 wive-ng-0.3.18.tar.7z no web interface
Dlink 1.41-1 DAP1160A1-OEM_MOD-1.41.zip modded firmware from Dlink DAP1160A1 GPL

Serial

 • Boot log 
UART1 output test ok
Uart init
mfid=000000c2 devid=00002249
Found 1 x 2M flash memory

---RealTek(RTL8186)at 2006.02.20-12:02+0800 version 1.4a [16bit](180MHz)
no sys signature at 00010000!
Jump to image start=0x80350000...
decompressing kernel:
Uncompressing Linux... done, booting the kernel.
done decompressing kernel.
early printk enabled 
Determined physical RAM map:
 memory: 00800000 @ 00000000 (usable)
Initial ramdisk at: 0x80173000 (1843200 bytes)
On node 0 totalpages: 2048
zone(0): 2048 pages.
zone(1): 0 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/ram console=0 ramdisk_start=0 single
Calibrating delay loop... 178.99 BogoMIPS
Memory: 4628k/8192k available (1292k kernel code, 3564k reserved, 
1932k data, 44k init, 0k highmem)
Dentry-cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode-cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
check_wait... unavailable.
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
Serial driver version 6.02 (2003-03-12) with no serial options enabled
ttyS00 at 0x00c3 (irq = 3) is a rtl_uart1
state->flags=00000000
Realtek GPIO Driver for Flash Reload Default
block: 64 slots per queue, batch=16
RAMDISK driver initialized: 16 RAM disks of 4096K size 1024 blocksize
RealTek E-Flash System Driver. (C) 2002 RealTek Corp.
Found 1 x 2M Byte MXIC MX29LV160AB at 0xbe000000
RTL8185 driver version 1.11 (2006-08-01)
8186NIC Ethernet driver v0.0.5 (Mar 3, 2006)
eth0: RTL8186-NIC at 0xbd200000, 00:01:02:03:04:05, IRQ 4
eth1: RTL8186-NIC at 0xbd300000, 04:05:06:07:08:09, IRQ 5
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
NET4: Ethernet Bridge 008 for NET4.0
RAMDISK: ext2 filesystem found at block 0
RAMDISK: Loading 1800 blocks [1 disk] into ram disk... done.
Freeing initrd memory: 1800k freed
VFS: Mounted root (ext2 filesystem).
Freeing unused kernel memory: 44k freed
mount /proc file system ok!
serial console detected.  Disabling virtual terminals.
init started:  BusyBox v1.00-pre8 (2005.09.16-02:17+0000) multi-call binary

BusyBox v1.00-pre8 (2005.09.16-02:17+0000) Built-in shell (msh)
Enter 'help' for a list of built-in commands.

Initialize wlan0 interface
killall: syslogd: no process killed
killall: klogd: no process killed
SIOCGIFFLAGS: No such device
bridge br0 doesn't exist; can't delete it
Setup bridge...
device eth0 entered promiscuous mode
eth0:phy is 8201
SIOCDELRT: No such process
device wlan0 entered promiscuous mode
SIOCDELRT: No such process
br0: port 2(wlan0) entering listening state
br0: port 1(eth0) entering listening state
br0: port 2(wlan0) entering learning state
br0: port 2(wlan0) entering forwarding state
br0: topology change detected, propagating
br0: port 1(eth0) entering learning state
br0: port 1(eth0) entering forwarding state
br0: topology change detected, propagating
SIOCDELRT: No such process
SIOCDELRT: No such process
Auto-Discovery (ver 1.01) 
342
343
# auth uses obsolete (PF_INET,SOCK_PACKET)
IEEE 802.1x (WPA) daemon, version 1.7b

# cat /proc/version 
Linux version 2.4.18-MIPS-01.00 (root@lnx103) 
(gcc version 3.3.3) #5 Thu Aug 10 13:14:01 CST 2006

# cat /proc/cpuinfo
system type             : Philips Nino
processor               : 0
cpu model               : R3000 V0.0
BogoMIPS                : 178.99
wait instruction        : no
microsecond timers      : no
tlb_entries             : 64
extra interrupt vector  : no
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available
ll emulations           : 0
sc emulations           : 0

Flash backup

  1. Connect the serial UART Adapter. Also connect the ethernet cable.
  2. Set a static IP on your computer, use 192.168.1.35 (or any compatible)
  3. Press the reset button, don't release it yet
  4. Plug the power cord, and wait 5 seconds
  5. Release the reset button
  6. On the serial console execute the command: flr 80300000 0 200000
  7. On your computer execute: tftp 192.168.1.6 -m binary -c get flash-backup.bin

You should see something like this at the serial console 

<RealTek>flr 80300000 0 200000
Flash read from 00000000 to 80300000 with 00200000 bytes ?
(Y)es , (N)o ? --> y
Flash Read Successed!
<RealTek>
File Start: 80300000,length=00200000

**TFTP GET File flbackup.bin,Size 00200000 Byte
*TFTP Client Download Success! File Size = 00200000 Bytes
.Success!
<RealTek>

Recovery

If you bricked the router by flashing a bad firmware follow these steps:

  1. Connect the ethernet cable from your computer to the device.
  2. Set a static IP on your computer, use 192.168.1.35 (or any compatible)
  3. Press the reset button, don't release it yet
  4. Plug the power cord, and wait 5 seconds
  5. Release the reset button
  6. On your computer execute: tftp 192.168.1.6 -m binary -c put valid-firmware.bin

valid-firmware.bin is supposed to be a known firmware working ok on this device

Power regulators

  • AnaChip AP1506-50 (U9 silkcreened): Main power regulator,12V input, 5V output
  • BS33P (U38 silkcreened): Low dropout regulator, 5V input, 3.3V output
  • BS17P (U10 silkcreened): Low dropout regulator (adjustable), 5V input, 3.1V output
  • BS18P (U8 silkcreened): Low dropout regulator, 5V input, 1.8V output. It runs extremely hot, probably causing unstability problems. It's recommended to install the bigger heat sink as possible.

Wap-654g-power regulators.jpg

Images

  • casing

  • board top

  • board bottom

  • serial port and JTAG


Retrieved from "https://wikidevi.wi-cat.ru/index.php?title=Pheenet_WAP-654G&oldid=353072"