Motorola VAP2500

an (A600)
Wireless Video Bridge
Homepage	Product page
Wikipedia	Motorola
3rd Party Firmware
dd-wrt	Status Unknown
OpenWrt	Status Unknown
Tomato any flavor	Incompatible
Platform
Brand • Model • Rev	Motorola VAP2500
FCC ID	ACQ-VAP2500
IC ID	109AS-VAP2500
Type	access point
CPU1	Quantenna QT2018BC
CPU1 Type	ARC 700
CPU1 Speed	400 MHz
Flash1 Chip	Macronix MX25L12845EMI-10G
Flash1 Size	16 MiB16,777,216 B <br />131,072 Kib <br />16,384 KiB <br />128 Mib <br />0.0156 GiB <br />
RAM1 Size	64 MiB67,108,864 B <br />524,288 Kib <br />65,536 KiB <br />512 Mib <br />0.0625 GiB <br />
RAM1 Chip	SK hynix H5PS5162GFR-S6C
ETH chip1	Quantenna QT2018BC
ETH chip2	Broadcom AC201A1
Ethernet Port Count	1-100MbE-LAN
Wired Standard	IEEE 802.3i/3u
802dot11 OUI: 30:60:23, 58:56:E8, CC:7D:37, F8:0B:BE Ethernet OUI: 30:60:23, 58:56:E8, CC:7D:37, F8:0B:BE
Stock bootloader	U-Boot
Stock FW OS	Linux 2.6.30
Expansion IF types	none specified
Power	12 VDC, 1 A
Connector type	barrel
Serial Port (UART)	yes, internal, 4-pin header, unpopulated, 3.3V TTL, (115200 8N1)
Additional chips 5GHz Front End Module;Skyworks;SE5007T;SiGe, 5007T, 130LT;4;
Other
Manuf/OEM/ODM	Gemtek WAPQ-215AN V01
Retail
FCC approval date	12 July 2013
Country of manuf	China
Radio 1
Chip1	Quantenna QT2018BC
Chip2	Quantenna QT2518B
Wireless interface OUI	30:60:23, 58:56:E8, CC:7D:37, F8:0B:BE
Antenna Connector Type	U.FL
MIMO status	4x4:4
Wireless Standard	IEEE 802.11a/n
802.11n	up to 600 Mbps
802.11a	up to 54 Mbps
WiFi Operating Frequency	5 GHz

For a list of all currently documented Broadcom chipsets with specifications, see Broadcom.
For a list of all currently documented Quantenna chipsets with specifications, see Quantenna.

For a list of all currently documented Motorola device with specifications, see Motorola.

• 600 Mbps - 4SS 5GHz 802.11n (40MHz chan.) = A600 class

Overview

"WAPQ-215AN_V01", "ESX-YX0-0000R RoHS", and "587019-001-00" is silkscreened on the board in the FCC photos.

This device would appear to be used by AT&T's U-verse service.

• Wi-Fi Certified : WFA18369 (as of 02/06/2013)

JTAG-Serial Info

Serial

Serial Pinouts

(Pin 1 has a square pad)

1. 3v3
2. TX
3. Rx
4. GND

Info derived from

boot log

Info: data uncached: addr=0xc0000000 size=1024MB Info: text at 0x88000000, stack at 0x8803e7fc(8192), heap at 0x88030000(51200), uboot size 142732 Info: i-cache is enabled Info: d-cache is enabled Info: CPU freq is 400000000, dev freq is 125000000 Info: Quantenna U-Boot version:1.4.4 Info: build date 'Jan 25 2012', time '16:07:58' ********************************************* * Motorola VAP2400 U-Boot Version: 00.02.01 * ********************************************* spi clock: val=0x3 ctl=0x80018002 spi clock: val=0x0 ctl=0x80000002 SPI flash info: name : mx25l12836e jedec_id : 0xc22018 sector size : 65536 number of sector : 256 frequency : 104000000 flags : 0x0 lock : Boot reached stage 13 Boot reached stage 12 env size = 0x3ffc Valid CRC found in flash restoring env... Boot reached stage 11 board config:etron16-160, emac0-mii, pa2 In: serial Out: serial Err: serial Boot reached stage 64 PHY found on MDIO addr:3000 0 Boot reached stage 65 QTN-EMAC Hit any key to stop autoboot: 0 get_qtnboot_envvars: vars: safety_image_addr 0x40000 safety_image_size 0x720000 live_image_addr 0x760000 live_image_size 0x720000 do_qtnboot: setenv bootargs ${bootargs} mtdparts=${mtdparts} do_qtnboot: spi_flash read 0x00760000 0x82800000 0x00720000 Read: flash=0x760000 mem=0x82800000 size=7471104 ret_size=7471104 do_qtnboot: bootm 0x82800000 Boot reached stage 1 ## Booting kernel from Legacy Image at 82800000 ... Boot reached stage 2 Boot reached stage 3 Image Name: ruby-linux Image Type: arc Linux Kernel Image (lzma compressed) Data Size: 3947621 Bytes = 3.8 MB Load Address: 80302000 Entry Point: 80302000 Verifying Checksum ... OK Boot reached stage 4 Boot reached stage 5 Boot reached stage 6 Boot reached stage 14 Uncompressing Kernel Image ... OK Boot reached stage 7 Boot reached stage 8 Command line TAG setup Params->u.cmdline.cmdline console=ttyS0,115200n8 earlyprintk=1 hw_config_id=1211 ip=192.168.1.100 mtdparts=spi_flash:128k(uboot),128k(uboot_env),7296k(linux_safety_image),7296k(linux_live_image),-(data) p console=ttyS0,115200n8 earlyprintk=1 hw_config_id=1211 ip=192.168.1.100 mtdparts=spi_flash:128k(uboot),128k(uboot_env),7296k(linux_safety_image),7296k(linux_live_image),-(data) ## Transferring control to Linux (at address 80302000) ATAG parameters 880341a8 - 8803426c... [ 0.000000] Linux version 2.6.30 (root@udp089655uds.w1.bcs.mot.com) (gcc version 4.2.1 (ARC_2.3)) #2 Mon Jun 24 10:56:44 PDT 2013 [ 0.000000] Parsing ATAG parameters from bootloader [ 0.000000] ATAG_CORE: successful parsing [ 0.000000] ATAG_CMDLINE: command line = console=ttyS0,115200n8 earlyprintk=1 hw_config_id=1211 ip=192.168.1.100 mtdparts=spi_flash:128k(uboot),128k(uboot_env),7296k(linux_safety_image),7296k(linux_live_image),-(data) [ 0.000000] Board id: 1211 [ 0.000000] [ 0.000000] Processor Family: ARC 700, Core ID: 0 [ 0.000000] CPU speed : 400.00 Mhz [ 0.000000] Timers: TIMER1 TIMER0 [ 0.000000] Interrupt Vect Base: 0x8800ec00 [ 0.000000] Peripheral Base: 0x0 [ 0.000000] Data UNCACHED Base (I/O): start 0xc0 Sz, 1024 MB [ 0.000000] ARC700 MMU Ver [2] [ 0.000000] uDTLB 8 entr, uITLB 4 entr, JTLB 128 entry/way, 2 ways [ 0.000000] TLB Refill "will NOT" Flush uTLBs [ 0.000000] Detected I-cache : [ 0.000000] Type=2 way set-assoc, Line length=32, Size=16K (enabled) [ 0.000000] Detected D-cache : [ 0.000000] Type=4 way set-assoc, Line length=32, Size=16K (enabled) [ 0.000000] Extensions: [ 0.000000] Multiplier: 32x32 with ANY Result Reg MAC Multiplier: Dual 16 x 16 and 32 x 16 [ 0.000000] CRC Instrn: NA, SWAP Instrn: Present NORM Instrn: Present [ 0.000000] Min-Max Instrn: Present, Barrel Shift Rotate Instrn: Present [ 0.000000] Ext Arith Instrn: Present [ 0.000000] On node 0 totalpages: 8192 [ 0.000000] free_area_init_node: node 0, pgdat 80f0a59c, node_mem_map 81000000 [ 0.000000] Normal zone: 36 pages used for memmap [ 0.000000] Normal zone: 0 pages reserved [ 0.000000] Normal zone: 8156 pages, LIFO batch:0 [ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 8156 [ 0.000000] Kernel command line: console=ttyS0,115200n8 earlyprintk=1 hw_config_id=1211 ip=192.168.1.100 mtdparts=spi_flash:128k(uboot),128k(uboot_env),7296k(linux_safety_image),7296k(linux_live_image),-(data) [ 0.000000] console [ruby_early0] enabled [ 0.000000] RCU-based detection of stalled CPUs is enabled. [ 0.000000] ---IRQ Request (24) ISR [ 0.000000] ---IRQ Request (25) ISR [ 0.000000] ---IRQ Request (26) ISR [ 0.000000] PID hash table entries: 256 (order: 8, 1024 bytes) [ 0.000000] clockevent mode switch to [1] [ 0.000000] clockevent mode switch to [2] [ 0.000000] ---IRQ Request (3) ISR [ 0.000000] Dentry cache hash table entries: 8192 (order: 2, 32768 bytes) [ 0.005000] Inode-cache hash table entries: 4096 (order: 1, 16384 bytes) [ 0.025000] Memory: 49848KB available (1837K code,393K data, 10192K init) [ 0.030000] Calibrating delay loop... 265.42 BogoMIPS (lpj=663552) [ 0.145000] Mount-cache hash table entries: 1024 [ 0.155000] Starting ksoftirqd, stack (thread_info) at 88002000 cpu 0 [ 0.160000] net_namespace: 720 bytes [ 0.165000] NET: Registered protocol family 16 [ 0.170000] Ruby heap in SRAM from 88010000 to 8801ffe0 [ 0.175000] Quantenna I2C device register [ 0.185000] bio: create slab <bio-0> at 0 [ 0.195000] NET: Registered protocol family 2 [ 0.200000] IP route cache hash table entries: 2048 (order: 0, 8192 bytes) [ 0.210000] TCP established hash table entries: 2048 (order: 1, 16384 bytes) [ 0.215000] TCP bind hash table entries: 2048 (order: 0, 8192 bytes) [ 0.220000] TCP: Hash tables configured (established 2048 bind 2048) [ 0.225000] TCP reno registered [ 0.225000] NET: Registered protocol family 1 [ 0.915000] JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc. [ 0.920000] msgmni has been set to 97 [ 0.925000] io scheduler noop registered (default) [ 0.930000] io scheduler anticipatory registered [ 1.470000] Serial: 8250/16550 driver, 2 ports, IRQ sharing enabled [ 1.480000] serial8250.0: ttyS0 at MMIO 0xf0000000 (irq = 48) is a 16550A [ 1.485000] console handover: boot [ruby_early0] -> real [ttyS0] [ 1.495000] brd: module loaded [ 1.505000] loop: module loaded [ 1.510000] 5 cmdlinepart partitions found on MTD device spi_flash [ 1.515000] Creating 5 MTD partitions on "spi_flash": [ 1.520000] 0x000000000000-0x000000020000 : "uboot" [ 1.525000] 0x000000020000-0x000000040000 : "uboot_env" [ 1.530000] 0x000000040000-0x000000760000 : "linux_safety_image" [ 1.540000] 0x000000760000-0x000000e80000 : "linux_live_image" [ 1.545000] 0x000000e80000-0x000001000000 : "data" [ 1.555000] spi_flash: SPI flash driver initialized successfully! [ 1.560000] emac_eth version 1.0 Quantenna Communications Inc. [ 1.565000] Random stuff D6 [ 2.210000] emac_eth_mii: probed [ 2.210000] emac_eth:eth1_emac0: phy_id=0x143bc31 addr=0 [ 2.235000] eth1_emac0: attached PHY driver [Generic PHY] (mii_bus:phy_addr=mdio_bus, irq=-1) [ 2.350000] eth1_emac0: Arasan Ethernet found at 0xed000000, irq 19 [ 2.355000] emac_eth version 1.0 Quantenna Communications Inc. [ 2.360000] u32 classifier [ 2.365000] input device check on [ 2.370000] Actions configured [ 2.370000] Netfilter messages via NETLINK v0.30. [ 2.375000] nf_conntrack version 0.5.0 (986 buckets, 3944 max) [ 2.380000] ip_tables: (C) 2000-2006 Netfilter Core Team [ 2.385000] TCP cubic registered [ 2.390000] NET: Registered protocol family 17 [ 2.395000] 802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com> [ 2.400000] All bugs added by David S. Miller <davem@redhat.com> [ 2.410000] Freeing unused kernel memory: 10192k freed [80302000] TO [80cf6000] [ 2.415000] ---IRQ Request (48) ISR init started: BusyBox v1.10.3 (2013-06-24 10:42:08 PDT) starting pid 31, tty '': '/etc/init.d/rcS' Initializing random number generator... done. Starting network... emac0 is eth1_0, emac1 is unused Using IP address "192.168.1.100". Using Net Mask "". [ 3.480000] ---IRQ Request (19) ISR ifconfig: SIOCGIFFLAGS: No such device ifconfig: SIOCSIFADDR: No such device [ 3.895000] ---IRQ Request (19) ISR Telnet disabled [ 4.265000] device eth1_0 entered promiscuous mode sh: /etc/firmware/qtn_driver.cal_ruby.0.bin: unknown operand Starting wireless... Checking if configuration files need to be upgraded... Loading modules [ 4.655000] qtn_debug: module license 'unspecified' taints kernel. [ 4.660000] Disabling lock debugging due to kernel taint [ 4.775000] se95-i2c : I2C driver register code = 0 [ 6.890000] qtn-i2c-bus i2c_read_block timed out [ 6.890000] temp_sensor : id = 0x0 [ 8.900000] qtn-i2c-bus i2c_read_block timed out [ 8.900000] temp_sensor.c : over temp thresh = 0 0 [ 10.910000] qtn-i2c-bus i2c_read_block timed out [ 10.910000] temp_sensor.c : hysteresis = 0 0 [ 11.105000] wlan using SRAM (offset:0x880100d8, size:0x498) [ 11.300000] wlan: 0.8.4.2 (0.9.3.3) [ 11.455000] qdrv using SRAM (offset:0x88010578, size:0x985c) Loading MuC driver (qtn_driver.qtn_ruby.0.bin) Waiting for Wireless Events from interfaces... Getting device opeation mode motoApp_autoConfig=>Starting device in AP mode...defined in boot cfg [ap] VAP mode selected = ap Starting qtn_dri[ 13.275000] ---IRQ Request (8) ISR ver.qtn_ruby.0.b[ 13.280000] ---IRQ Request (10) ISR in... [ 13.285000] ---IRQ Request (30) ISR [ 13.285000] qdrv: firmware: requesting rdsp_driver.0.bin [ 13.380000] qdrv: firmware: requesting qtn_driver.qtn_ruby.0.bin [ 14.075000] muc_print_initialise_shared_data linux buf 57980280 [ 14.080000] MuC: MuC build date=Wed Apr 10 18:23:35 PDT 2013 [ 14.085000] MuC: slow heap begin=0xae220 end=0x12e220 [ 14.090000] MuC: fast heap begin=0x80030000 end=0x80038000 [ 14.095000] MuC: stack start=0x8003e7a0 sp=0x8003ff08 [ 14.100000] MuC: scancnt 0 [ 14.105000] MuC: g_slow_eth_war=0 [ 14.235000] MuC: HAL fd start @ 0xe5040300, count 48, size per 100, end 0xe50415c0 [ 14.240000] MuC: Selected TX QoS schedule : 0 [ 14.245000] MuC: Dynamic one-bit autocorrelation enabled [ 14.250000] MuC: *** Enable IRQs [ 14.275000] scancnt 0 [ 16.285000] qtn-i2c-bus i2c_read_block timed out [ 16.285000] temp_sensor : id = 0x0 [ 16.290000] init_tx_power_cal: ERROR - Failed to get Temperature sensor [ 16.300000] MuC boot succeeded 2.270 seconds Valid bootval wpa_pass_str, set WPA_PASSPHRASE to 24008826048842408648688248! /scripts/hostapd.conf ssid and wpa_passphrase customized ... [ 16.735000] wifi0 (): not using net_device_ops yet [ 16.760000] VAP create succeeded 0.010 seconds Jan 1 00:00:17 iwevent: 00:00:17.338099 wifi0 Set Channel=0 Using regulatory region us region is NOT none Jan 1 00:00:18 Set Region[316]: Configuring TX power to 11 for WiFi channels 36 to 48 Jan 1 00:00:18 Set Region[316]: Configuring TX power to 17 for WiFi channels 52 to 56 Jan 1 00:00:18 Set Region[316]: Configuring TX power to 13 for WiFi channels 60 to 64 Jan 1 00:00:18 Set Region[316]: Configuring TX power to 10 for WiFi channels 100 to 104 Jan 1 00:00:18 Set Region[316]: Configuring TX power to 18 for WiFi channels 108 to 116 Jan 1 00:00:18 Set Region[316]: Configuring TX power to 15 for WiFi channels 132 to 136 Jan 1 00:00:18 Set Region[316]: Configuring TX power to 18 for WiFi channels 140 to 161 Jan 1 00:00:18 Set Region[316]: Configuring TX power to 19 for WiFi channels 165 to 165 [ 18.270000] device wifi0 entered promiscuous mode [ 18.465000] Enabling SSDP flooding wpa_passphrase_web_list is SCS BRCM rxif mac f8:0b:be:ad:ac:82 SCS using interface wifi0 [ 20.115000] qdrv_wps_button_init: WARNING - WPS push button is using GPIO pin 4 [ 20.125000] qdrv_wps_button_init: WARNING - monitored using polling [ 20.130000] qdrv_wps_button_init: WARNING - active logic is low [ 20.135000] qdrv_polling_wps_button_init: ERROR - wifi0: Failed to request GPIO4 for GPIO reset [ 20.140000] br0: port 2(wifi0) entering forwarding state Beamforming enabled. [ 20.830000] qdrv_sch_red: allocated 1536 511 [ 20.835000] qdrv_sch_red: attached to wifi0 [ 20.835000] ***** [ 20.860000] qdrv_sch_red: allocated 512 127 [ 20.865000] qdrv_sch_red: attached to eth1_0 [ 20.865000] ***** [ 21.305000] [2]Comparing register set Global control [ 21.330000] [6]Comparing register set BB Global regs [ 21.875000] SCS: Setup comparing timer Jan 1 00:00:21 iwevent: 00:00:21.935104 wifi0 Custom driver event:SCS: channel sampling disabled complete complete Reentry start /sbin/mini_httpd: started as root without requesting chroot(), warning only ******************************************************** ***** Motorola VAP2500 SW Release AT.08.00 *** ******************************************************** starting pid 448, tty '/dev/ttyS0': '/bin/sh -l' BusyBox v1.10.3 (2013-06-24 10:42:08 PDT) built-in shell (ash) Enter 'help' for a list of built-in commands. complete complete quantenna # complete motoApp_dhcp=>device_mode bootcfg set to = [ap] [OPTION12=ATT_Motorola_AP_ADAC82] [OPTION60=Motorola_AP] [OPTION125=0x7d:00:00:0d:e9:23:01:06:30:30:32:34:41:30:02:0C:4D:39:31:33:31 :34:53:41:34:31:35:38:03:0b:4d:6f:74:6f:72:6f:6c:61:5f:41:50] motoApp_dhcp=>Run DHCP request... udhcpc (v1.19.4) started Sending discover... [ 27.340000] MuC: WMM AC 0: 3 4 6 0 [ 27.345000] MuC: WMM AC 1: 7 4 10 0 [ 27.345000] MuC: WMM AC 2: 1 3 4 94 [ 27.350000] MuC: WMM AC 3: 1 2 3 47 No lease, failing motoApp_dhcp=>wait for 2 seconds to retry motoApp_dhcp=>Run DHCP request... udhcpc (v1.19.4) started Sending discover... No lease, failing motoApp_dhcp=>wait for 2 seconds to retry motoApp_dhcp=>Run DHCP request... udhcpc (v1.19.4) started Sending discover...

cat /proc/cpuinfo

quantenna # cat /proc/cpuinfo

 Processor Family: ARC 700, Core ID: 0
CPU speed :     400.00 Mhz
Timers:         TIMER1 TIMER0
Interrupt Vect Base:    0x8800ec00
Peripheral Base:        0x0
Data UNCACHED Base (I/O): start 0xc0 Sz, 1024 MB
Bogo MIPS :     266.24
ARC700 MMU Ver [2]
   uDTLB 8 entr, uITLB 4 entr, JTLB 128 entry/way, 2 ways
Detected I-cache :
  Type=2 way set-assoc, Line length=32, Size=16K (enabled)
Detected D-cache :
  Type=4 way set-assoc, Line length=32, Size=16K (enabled)
Extensions:
Multiplier: 32x32 with ANY Result Reg   MAC Multiplier: Dual 16 x 16 and 32 x 16
CRC  Instrn: NA,   SWAP Instrn: Present   NORM Instrn: Present
Min-Max Instrn: Present,   Barrel Shift Rotate Instrn: Present
Ext Arith Instrn: Present

netstat -l

quantenna # netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 192.168.1.100:49152     0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:www             0.0.0.0:*               LISTEN
tcp        0      0 0.0.0.0:https           0.0.0.0:*               LISTEN
netstat: no kernel support for AF INET6 (tcp)
udp        0      0 0.0.0.0:49300           0.0.0.0:*
udp        0      0 0.0.0.0:44639           0.0.0.0:*
udp        0      0 0.0.0.0:1900            0.0.0.0:*
netstat: no kernel support for AF INET6 (udp)
netstat: no kernel support for AF INET6 (raw)
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path

ps

quantenna # ps
  PID USER       VSZ STAT COMMAND
    1 root      1824 S    init
    2 root         0 SW<  [kthreadd]
    3 root         0 SW<  [ksoftirqd/0]
    4 root         0 SW<  [events/0]
    5 root         0 SW<  [khelper]
    6 root         0 SW<  [async/mgr]
    7 root         0 SW<  [kblockd/0]
    8 root         0 SW   [pdflush]
    9 root         0 SW   [pdflush]
   10 root         0 SW<  [kswapd0]
   11 root         0 SW<  [mtdblockd]
   24 root         0 SWN  [jffs2_gcd_mtd4]
  154 root      1296 S    iwevent --syslog
  355 root      2720 S    hostapd -B /mnt/jffs2//hostapd.conf
  435 root      2832 S    /sbin/mini_httpd -u root -C /mnt/jffs2/minihttpd.conf
  438 root      1816 S    /bin/sh /scripts/motoApp_init
  449 root      1824 S    /bin/sh -l
  451 root      1816 S    /sbin/syslogd -n -i eth1_0 -L -m 0
  452 root      1816 S    /sbin/klogd -n
  476 root      2904 S    monitor_reset_device 5 0
  478 root      2904 S    motoApp_ctrlLEDPosWifi
  479 root      2904 S    motoApp_ctrlLEDPosEth
  480 root      2904 S    motoApp_ctrlLEDPosWifi
  483 root      1824 S    /bin/sh /scripts/motoApp_dhcp
  484 root      2904 S    motoApp_ctrlLEDPosEth
  712 root      1816 R    ps
  714 root      1824 S    /bin/sh /scripts/motoApp_dhcp
  715 root      1816 R    ps
  716 root      1816 S    grep udhcpc
  717 root      1816 S    grep -v grep