wae3pohz5:

WikiDevi link: https://wikidevi.com/wiki/SonicWALL_SONICPOINT-Ni_(APL21-083)

This device has an Atheros AR913X SoC and one radio. The radio is the one built into this SoC.

This device has 1 memory technology device. It is a 16 megabyte (128Mbit) parallel NOR flash chip connected in the same manner as the Buffalo WZR-HP-G300NH. Each eraseblock is 0x10000 in size. The first four eraseblocks are U-Boot and should be read-only. The next two eraseblocks are the U-Boot environment variables. The next 64 eraseblocks is a recovery Linux initramfs that is labelled "sm" and should be read-only. The next 128 eraseblocks belong to the firmware. The next 42 eraseblocks are used by the factory firmware to store the settings. The next 12 eraseblocks contain metadata about the board and is called "sysinfo" and should be read-only. The last eraseblock contains the calibration data for the 1 radio in the device and should be read-only.

This device has 128MB RAM.

The MAC address of the device is stored as regular binary data (not ASCII) at offset 0xfc0050 in flash. The radio calibration data is stored at offset 0xff1000 in flash.

The ethernet PHY (not switch) is connected via RGMII at 1000Mbps full duplex. It is a Marvell 88E1116.

The device has three LEDs and one button. The amber LED at GPIO #9 active low is the diag LED. The amber LED at GPIO #7 active low is the WLAN link LED. The green LED at GPIO #8 active low is the WLAN activity LED. The button at GPIO #11 active low is the reset button.

GPIO #17 controls whether the three LEDs are visible or not. It must be low for any of these LEDs to illuminate. This GPIO is high by default, so the kernel must bring it low at boot or the LEDs won't work.

The bootloader does not understand uImages that are compressed with LZMA. It does understand gzip and none, however. This means the uImage must be a none compressed kernel with lzma-loader to load the LZMA-compressed kernel. The bootloader does not have working Ethernet, so software (such as an initramfs image) must be loaded using YMODEM over the serial port. By default, the bootloader has a bootwait of '0' when booting normally, making entry into the bootloader prompt difficult. When you hold the reset button at power-on, an alternate static environment is loaded with a bootwait of '5'. This is intended for loading the alternate recovery Linux image from flash, but you can leverage this as a way to get to the bootloader prompt.

The serial port is accessible via an external console port. However, it conforms to SonicWALL's console port standard, not Cisco, so you will need a suitable cable or adapter to use it. The parameters are 115200bps, 8 data bits, no parity, 1 stop bit.

I do not have a representative sample of the vendor's factory upgrade image and have not figured out the factory upgrade process or format.